ML15335A508

Technical Requirements Manual, Technical Specification Bases, Affected Pages, Revision 34

ML15335A508
Person / Time
Site:	Monticello
Issue date:	11/20/2015
From:	Northern States Power Co, Xcel Energy
To:	Office of Nuclear Reactor Regulation
Shared Package
ML15335A486	List: L-MT-15-088, Technical Requirements Manual, Technical Specification Bases, Affected Pages, Revision 39 ML15335A482 ML15335A493 ML15335A494 ML15335A496 ML15335A497 ML15335A498 ML15335A499 ML15335A504 ML15335A505 ML15335A506 ML15335A507 ML15335A508 ML15335A509 ML15335A510 ML15335A511 ML15335A512
References
L-MT-15-088
Download: ML15335A508 (48)

Text

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-1 Revision No. 34 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND USAR Section 1.2.2 (Ref. 1) requires the reactor core and associated systems to be designed to accommodate plant operational transients or maneuvers that might be expected without compromising safety and without fuel damage. Therefore, SLs ensure that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).

The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity.

The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking.

Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions.

While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e.,

MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. The MCPR fuel cladding integrity SL ensures that during normal operation and during AOOs, at least 99.9% of the fuel rods in the core do not experience transition boiling.

Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient.

Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-2 Revision No. 34 BASES BACKGROUND (continued) reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

The reactor vessel water level SL ensures that adequate core cooling capability is maintained during all MODES of reactor operation.

Establishment of Emergency Core Cooling System initiation setpoints higher than this SL provides margin such that the SL will not be reached or exceeded.

APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY operation and AOOs. The reactor core SLs are established to preclude ANALYSES violation of the fuel design criterion that a MCPR limit is to be established, such that at least 99.9% of the fuel rods in the core would not be expected to experience the onset of transition boiling.

The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with the other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR Safety Limit.

The approved pressure range (700 to 1400 psia) of the GEXL 14 critical power correlation is applied to resolve a 10 CFR Part 21 condition concerning a potential to violate Reactor Core Safety Limit 2.1.1.1 during a Pressure Regulator Failure Maximum Demand (Open) transient (Reference 5). Application of this correlation, which applies to the GE14 fuel in the core, allows reduction of the reactor steam dome pressure from 785 to 686 psig, precluding violation of the safety limit for this event. This change in reactor steam dome pressure was approved in Amendment 185 (Reference 7).

2.1.1.1 Fuel Cladding Integrity The GEXL14 critical power correlation is applicable for all critical power calculations at pressures 686 psig and core flows 10% of rated flow (Reference 6). For operation at low pressures or low flows, another basis is used, as follows:

Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows will always be > 4.56 psi. Analyses (Ref. 2) show that with a bundle flow of 28 x 103 lb/hr, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.56 psi driving head will be > 28 x 103 lb/hr. Full scale ATLAS test

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-3 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES (continued) data taken at pressures from 0 psig to 785 psig indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER

> 50 % RTP. Thus, a THERMAL POWER limit of 25% RTP for reactor pressure < 686 psig or < 10% core flow is conservative.

2.1.1.2 MCPR The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. However, the uncertainties in monitoring the core operating state and in the procedures used to calculate the critical power result in an uncertainty in the value of the critical power. Therefore, the fuel cladding integrity SL is defined as the critical power ratio in the limiting fuel assembly for which more than 99.9% of the fuel rods in the core are expected to avoid boiling transition, considering the power distribution within the core and all uncertainties.

The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved General Electric Critical Power correlations. Details of the fuel cladding integrity SL calculation are given in Reference 2. Reference 3 includes a tabulation of the uncertainties used in the determination of the MCPR SL and of the nominal values of the parameters used in the MCPR SL statistical analysis.

2.1.1.3 Reactor Vessel Water Level During MODES 1 and 2 the reactor vessel water level is required to be above the top of the active irradiated fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes < 2/3 of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to

Reactor Core SLs B 2.1.1 Monticello B 2.1.1 Last Revision No. 34 BASES APPLICABLE SAFETY ANALYSES (continued) provide a point that can be monitored and to also provide adequate margin for effective action.

SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to prevent the release of radioactive materials to the environs.

SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforations.

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.

SAFETY LIMIT Exceeding an SL may cause fuel damage and create a potential for VIOLATIONS radioactive releases in excess of 10 CFR 50.67, Accident source term, limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SLs within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

REFERENCES

1.

USAR, Section 1.2.2.

2.

NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel" (revision specified in Specification 5.6.3).

3.

NEDE-31152P, "General Electric Fuel Bundle Designs," Revision 8, April 2001.

4.

10 CFR 50.67.

5.

GE Part 21 Notification SC05-03, Potential to Exceed Low Pressure Technical Specification Safety Limit, dated March 29, 2005.

6.

NRC Letter to A. Lingenfelter (GNF), Final Safety Evaluation for Global Nuclear Fuel (GNF) Topical Report (TR) NEDC-32851P, Revision 2, "GEXL14 Correlation for GE14 Fuel," (TAC No. MD5486) dated August 3, 2007.

7.

Amendment No. 185, Issuance of Amendment to Reduce the Reactor Steam Dome Pressure Specified in the Reactor Core Safety Limits, dated November 25, 2014. (ADAMS Accession No. ML14281A318)

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-1 Revision No. 34 B 3.3 INSTRUMENTATION B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC) System initiation, (e) main steam line pressure, (f) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (g) drywell pressure, (h) HPCI and RCIC steam line pressure, (i) reactor water cleanup (RWCU) flow, and (j) reactor steam dome pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation. The only exception is SLC System initiation.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

1. Main Steam Line Isolation Reactor Vessel Water Level - Low Low and Main Steam Line Pressure -

Low Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of all main steam isolation valves (MSIVs), MSL drain valves, and reactor sample isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system.

The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs), MSL drain valves, and recirculation sample isolation valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-2 Revision No. 34 BASES BACKGROUND (continued)

The Main Steam Line Flow - High Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an isolation of the MSIVs, MSL drain valves, and reactor sample isolation valves. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation.

The Main Steam Line Tunnel Temperature - High Function receives input from 16 channels (four from each of the four tunnel areas). The logic is arranged similar to the Main Steam Line Flow - High Function. One channel from each steam tunnel area inputs to one of four trip strings.

Two trip strings make up a trip system, and both trip systems must trip to cause isolation.

MSL Isolation Functions isolate the Group 1 valves.

2. Primary Containment Isolation The Reactor Vessel Water Level - Low and Drywell Pressure - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the Group 2 primary containment isolation valves (i.e., drywell and sump).

Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

Primary Containment Isolation Drywell Pressure - High and Reactor Vessel Water Level - Low Functions isolate the Group 2 drywell and sump isolation valves.

3, 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation The HPCI and RCIC Steam Line Flow - High Functions receive input from two channels for each system. Each channel output for each system is connected to a time delay relay that provides an output signal to two trip systems. The output signal is arranged so that any channel that trips will provide a trip signal to the trip system (one-out-of-two logic in each trip system). Each trip system associated with HPCI or RCIC will provide a closure signal to the associated system isolation valves. The HPCI

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-3 Revision No. 34 BASES BACKGROUND (continued)

Steam Supply Line Pressure - Low Function receives input from four channels. The outputs are arranged in a one-out-of-two-twice logic in one trip system. The trip system isolates all HPCI isolation valves. The RCIC Steam Supply Line Pressure - Low Function receives input from four channels. The outputs are arranged in a one-out-of-two twice logic. The output of the logic is directed to two trip systems. Each trip system is able, by itself, to isolate all RCIC isolation valves. The HPCI and RCIC Steam Line Area Temperature - High Functions receive input from 16 channels for each system. The outputs of the 16 channels are grouped in four sets of four detectors. Each set is arranged in one-out-two-twice logic. The outputs of each set provide trip signals to each of two separate isolation trip systems. Each trip system is able, by itself, to isolate all HPCI and RCIC isolation valves, as applicable.

HPCI Functions isolate the Group 4 valves and RCIC Functions isolate the Group 5 valves.

5. Reactor Water Cleanup System Isolation The RWCU Room Temperature - High, Reactor Vessel Water Level - Low Low, Drywell Pressure - High, and RWCU Flow - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RWCU valves.

Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all RWCU isolation valves. The SLC System Initiation Function receives input from the SLC initiation switch. The switch provides trip signal inputs to both trip systems in any position other than "OFF." For the purpose of this Specification, the SLC initiation switch is considered to provide one channel input into each trip system. Each of the two trip systems is connected to one of the two valves on each RWCU penetration.

RWCU Functions isolate the Group 3 valves.

6. Shutdown Cooling System Isolation The Reactor Vessel Water Level - Low Function receives input from four reactor vessel water level channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RHR

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-4 Revision No. 34 BASES BACKGROUND (continued) shutdown cooling supply isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of the RHR shutdown cooling supply isolation valves. The Reactor Steam Dome Pressure - High Function receives input from two channels, both of which provide input to two trip systems.

Any trip channel will trip both trip systems to initiate isolation of the RHR shutdown cooling supply isolation valves.

Shutdown Cooling System Isolation Functions isolate the Group 2 RHR shutdown cooling supply isolation valves.

7. Traversing Incore Probe (TIP) System Isolation The Reactor Vessel Water Level - Low and Drywell Pressure - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to initiate a TIP drive isolation signal. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate a TIP drive isolation signal.

When either Function actuates, the TIP drive mechanisms will withdraw the TIPs, if inserted, and close the inboard TIP System isolation ball valves when the TIPs are fully withdrawn. The outboard TIP System isolation valves are manual shear valves.

TIP System Isolation Functions isolate the Group 2 valves (TIP inboard isolation ball valves).

APPLICABLE The isolation signals generated by the primary containment isolation SAFETY instrumentation are implicitly assumed in the safety analyses of ANALYSES, LCO, References 1 and 2 to initiate closure of valves to limit offsite doses.

and APPLICABILITY Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"

Applicable Safety Analyses Bases for more detail of the safety analyses.

Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-5 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The OPERABILITY of the primary containment instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each Primary Containment Isolation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and nominal trip setpoints (NTSP) are derived, using the General Electric setpoint methodology guidance, as specified in the Monticello setpoint methodology. The Allowable Values are derived from the analytic limits. The difference between the analytic limit and the Allowable Value allows for channel instrument accuracy, calibration accuracy, process measurement accuracy, and primary element accuracy. The margin between the Allowable Value and the NTSP allows for instrument drift that might occur during the established surveillance period. Two separate verifications are performed for the calculated NTSP. The first, a Spurious Trip Avoidance Test, evaluates the impact of the NTSP on plant availability. The second verification, an LER Avoidance Test, calculates the probability of avoiding a Licensee Event Report (or exceeding the Allowable Value) due to instrument drift. These two verifications are statistical evaluations to provide additional assurance of the acceptability of the NTSP and may require changes to the NTSP. Use of these methods and verifications provides the assurance that if the setpoint is found conservative to the Allowable Value during surveillance testing, the instrumentation would have provided the required trip function by the time the process reached the analytic limit for the applicable events.

Certain Emergency Core Cooling Systems (ECCS) valves (e.g., RHR test line suppression pool cooling isolation) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS. The instrumentation requirements and ACTIONS associated with these signals are addressed

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-6 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) in LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS)

Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment." Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Main Steam Line Isolation 1.a. Reactor Vessel Water Level - Low Low Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level

- Low Low Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level - Low Low Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSLs on Low Low supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits.

This Function isolates the Group 1 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-7 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 1.b. Main Steam Line Pressure - Low Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue. The Main Steam Line Pressure - Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 3). For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100°F/hr) is not reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 686 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 25% RTP.)

The MSL low pressure signals are initiated from four pressure switches that are connected to the MSL header close to the turbine stop valves.

The pressure switches are arranged such that, even though physically separated from each other, each pressure switch is able to detect low MSL pressure. Four channels of Main Steam Line Pressure - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be high enough to prevent excessive RPV depressurization.

The Main Steam Line Pressure - Low Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 3).

This Function isolates the Group 1 valves.

1.c. Main Steam Line Flow - High Main Steam Line Flow - High is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line Flow - High Function is one of the Functions assumed in the analysis of the main steam line break (MSLB) (Ref. 2). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 50.67 limits.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-8 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The MSL flow signals are initiated from 16 differential pressure indicating switches that are connected to the four MSLs (differential pressure indicating switches sense differential pressure across a flow restrictor).

The differential pressure indicating switches are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow. Four channels of Main Steam Line Flow - High Function for each MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.

The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.

This Function isolates the Group 1 valves.

1.d. Main Steam Line Tunnel Temperature - High Main steam line tunnel temperature is provided to detect a leak in the RCPB in the steam tunnel and provides diversity to the high flow instrumentation. Temperature is sensed in four different areas of the steam tunnel above each main steam line. The isolation occurs when a very small leak has occurred in any of the four areas. If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

However, credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks, such as MSLBs.

Main steam line tunnel temperature signals are initiated from bimetallic temperature switches located in the four areas being monitored. Even though physically separated from each other, any temperature switch in any of the four areas is able to detect a leak. Therefore, sixteen channels of Main Steam Line Tunnel Temperature - High Function are available but only eight channels (two channels in each of the four trip strings) are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Main Steam Line Tunnel Temperature - High Allowable Value is chosen to detect a leak equivalent to between 5 gpm and 10 gpm.

This Function isolates the Group 1 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-9 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Primary Containment Isolation 2.a. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products.

The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water Level - Low Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level - Low signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Low Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"),

since isolation of these valves is not critical to orderly plant shutdown.

This Function isolates the Group 2 drywell and sump isolation valves.

2.b. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell Pressure -

High are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-10 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

This Function isolates the Group 2 drywell and sump isolation valves.

High Pressure Coolant Injection and Reactor Core Isolation Cooling Systems Isolation 3.a, 4.a. HPCI and RCIC Steam Line Flow - High Steam Line Flow - High Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for these Functions is not assumed in any USAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding. The HPCI and RCIC Steam Line Flow - High channels are each provided with a time delay relay to prevent false isolations on HPCI or RCIC Steam Line Flow - High, as applicable, during system startup transients and therefore improves system reliability.

The HPCI and RCIC Steam Line Flow - High signals are initiated from differential pressure switches (two for HPCI and two for RCIC) that are connected to the system steam lines. Two channels of both HPCI and RCIC Steam Line Flow - High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. In addition, each flow channel is connected to a time delay relay to delay the tripping of the associated HPCI or RCIC isolation trip system for a short time.

The Allowable Values are chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event. The Allowable Values associated with the time delay are chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

3.b, 4.b. HPCI and RCIC Steam Supply Line Pressure - Low Low HPCI or RCIC steam supply line pressure indicates that the pressure of the steam in the HPCI or RCIC turbine, as applicable, may be too low to continue operation of the associated systems turbine. These isolations

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-11 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) are for equipment protection and are not assumed in any transient or accident analysis in the USAR. However, they also provide a diverse signal to indicate a possible system break. These instruments are included in Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations. Therefore, they meet Criterion 4 of 10 CFR 50.36(c)(2)(ii).

The HPCI and RCIC Steam Supply Line Pressure - Low signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the system steam line. Four channels of both HPCI and RCIC Steam Supply Line Pressure - Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are selected to be high enough to prevent damage to the systems turbine.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

3.c, 4.c. HPCI and RCIC Steam Line Area Temperature - High HPCI and RCIC steam line area temperatures are provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

HPCI and RCIC Steam Line Area Temperature - High signals are initiated from bimetallic temperature switches that are appropriately located to protect the system that is being monitored. Eight instruments monitor each area. Sixteen channels for each HPCI and RCIC Steam Line Area Temperature - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a break in the associated system piping to ensure the core will not be uncovered and the radiological consequences are bounded by the main steam line break analysis.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-12 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Reactor Water Cleanup System Isolation 5.a. RWCU Flow - High The high flow signal is provided to detect a break in the RWCU System.

This will detect leaks in the RWCU System when room temperature would not provide detection (i.e., a cold leg break). Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded.

Therefore, isolation of the RWCU System is initiated when high flow is sensed to prevent exceeding offsite doses. A time delay is provided to prevent spurious trips during most RWCU operational transients. This Function is not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

The high flow signals are initiated from transmitters that monitor RWCU System flow. In addition, each flow channel is connected to a time delay relay to delay the tripping of the flow channel for a short time. Four channels of RWCU Flow - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The RWCU Flow - High Allowable Value ensures that a break of the RWCU piping is detected. The Allowable Value associated with the time delay is chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.

This Function isolates the Group 3 valves.

5.b. RWCU Room Temperature - High RWCU room temperatures are provided to detect a leak from the RWCU System. The isolation occurs even when very small leaks have occurred and is diverse to the high differential flow instrumentation for the hot portions of the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

RWCU room temperature signals are initiated from temperature elements that are located in the room that is being monitored. Four resistance temperature detectors provide input to the RWCU Room Temperature -

High Function. Four channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-13 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The RWCU Room Temperature - High Allowable Value is set low enough to detect a leak equivalent to 210 gpm.

This Function isolates the Group 3 valves.

5.c. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell Pressure -

High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

This Function isolates the Group 3 valves.

5.d. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 4). SLC System initiation signals are initiated from the SLC initiation switch.

Two channels of the SLC System Initiation Function are available and are required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7, "Standby Liquid Control (SLC) System").

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

This Function isolates the Group 3 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-14 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 5.e. Reactor Vessel Water Level - Low Low Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break. The isolation of the RWCU System on low low RPV water level supports actions to ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water Level - Low Low Function associated with RWCU isolation is not directly assumed in the USAR safety analyses because the RWCU System line break is bounded by breaks of larger systems (recirculation and MSL breaks are more limiting).

Reactor Vessel Water Level - Low Low signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

This Function isolates the Group 3 valves.

Shutdown Cooling System Isolation 6.a. Reactor Steam Dome Pressure - High The Reactor Steam Dome Pressure - High Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR)

System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the USAR.

The Reactor Steam Dome Pressure - High signals are initiated from two transmitters that are connected to different taps on the RPV. Two channels of Reactor Steam Dome Pressure - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in MODES 1, 2, and 3, since these are the only MODES in which the reactor can be pressurized; thus, equipment

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-15 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization.

This Function isolates the Group 2 RHR shutdown cooling supply isolation valves.

6.b. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level - Low Function associated with RHR Shutdown Cooling System isolation is not directly assumed in safety analyses because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL. The RHR Shutdown Cooling System isolation on low RPV water level supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level - Low signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. As noted (footnote (a) to Table 3.3.6.1-1), only one channel per trip system (with an isolation signal available to one shutdown cooling pump supply isolation valve) of the Reactor Vessel Water Level - Low Function is required to be OPERABLE in MODES 4 and 5, provided RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system.

The Reactor Vessel Water Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low Function is only required to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow path from lowering the reactor vessel level to the top of the fuel. In MODES 1 and 2, another isolation (i.e., Reactor Steam Dome Pressure - High) and

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-16 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path.

This Function isolates the Group 2 RHR shutdown cooling supply isolation valves.

Traversing Incore Probe System Isolation 7.a. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products.

The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water Level - Low Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level - Low signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Two channels of Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent isolation actuation. The isolation function is ensured by the manual shear valve in each penetration.

The Reactor Vessel Water Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown.

This Function isolates the Group 2 TIP inboard isolation ball valves.

7.b. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-17 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Two channels of Drywell Pressure -

High Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent actuation. The isolation function is ensured by the manual shear valve in each penetration.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

This Function isolates the Group 2 TIP inboard isolation ball valves.

ACTIONS The ACTIONS are modified by two Notes. Note 1 allows penetration flow path(s) to be unisolated intermittently under administrative controls.

These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room.

In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Note 2 has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, depending on the Function (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for those Functions that have channel components common to RPS instrumentation and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for those Functions that do not have channel components common to RPS instrumentation), has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-18 Revision No. 34 BASES ACTIONS (continued)

(refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

Condition C must be entered and its Required Action taken.

B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant primary containment isolation capability being lost for the associated penetration flow path(s). The MSL, Primary Containment, most of the RWCU System, Shutdown Cooling System Reactor Vessel Water Level - Low, and TIP Isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function on a valid signal. The other isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 1.a, 1.b, 2.a, 2.b, 5.a, 5.b, 5.c, 5.e, 6.b, 7.a, and 7.b, this would require both trip systems to have one channel OPERABLE or in trip. For Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. Function 1.d channels monitor several locations within a given area (e.g., different locations within the main steam tunnel area).

However, since any channel can detect a leak in any area, this would require both trip systems to have one channel OPERABLE or in trip. For Functions 3.a, 4.a, and 5.d, this would require one trip system to have one channel OPERABLE or in trip. For Function 3.b, this would require one channel in each trip string to be OPERABLE or in trip for the trip system. For Function 4.b, this would require one channel in each trip string to be OPERABLE or in trip for one trip system. For Functions 3.c and 4.c, eight channels monitor each area. These channels are arranged in two sets of four detectors, with each set of detectors arranged in a one-out-of-two-twice logic. Therefore, this would require a set in each area to have sufficient channels OPERABLE or in the tripped condition for one trip system.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-19 Revision No. 34 BASES ACTIONS (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subsequent Condition.

D.1, D.2.1, and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in MODE 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Actions D.2.1 and D.2.2). Alternately, the associated MSLs may be isolated (Required Action D.1), and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated),

operation with that MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-20 Revision No. 34 BASES ACTIONS (continued)

F.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.

For the RWCU Room Temperature - High Function, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel. That is, if the RWCU pump room A area channel is inoperable, the pump room A area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump.

The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).

G.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is acceptable due to the fact that these Functions provide a TIP System isolation, and the TIP System penetration is a small bore (approximately 1/2 inch), its isolation in a design basis event (with loss of offsite power) would be via the manually operated shear valves, and the ability to manually isolate by either the normal isolation valve or the shear valve is unaffected by the inoperable instrumentation.

H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystems inoperable or isolating the RWCU System.

The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-21 Revision No. 34 BASES ACTIONS (continued)

I.1 and I.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated). Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Primary REQUIREMENTS Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate that when a channel (a channel that is directed to two trip systems is considered to be one channel) is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> provided the associated Function maintains primary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-22 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 92 day Frequency of SR 3.3.6.1.2 is based on the reliability analyses described in References 5 and 6.

SR 3.3.6.1.3 Calibration of trip units provides a check of the actual trip setpoints (including any specified time delay). The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than that accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of References 5 and 6.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-23 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.1.4 and SR 3.3.6.1.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency of SR 3.3.6.1.4 is based on the assumption of a 92 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. The Frequency of SR 3.3.6.1.5 is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.1.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency.

REFERENCES

1.

USAR, Section 14.7.2.

2.

USAR, Section 14.7.3.

3.

USAR, Section 7.6.3.2.4.

4.

USAR, Section 6.6.1.1.

5.

NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

6.

NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1 Last Revision No. 34 BASES REFERENCES (continued)

7.

Amendment No. 185, Issuance of Amendment to Reduce the Reactor Steam Dome Pressure Specified in the Reactor Core Safety Limits, dated November 25, 2014. (ADAMS Accession No. ML14281A318)

ECCS - Operating 3.5.1 Monticello B 3.5.1-1 Revision No. 34 B 3.5 EMERGENCY CORE COOLING SYSTEM (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCS - Operating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS.

Although no credit is taken in the safety analyses for the condensate storage tanks (CSTs), they are capable of providing a source of water for the HPCI, LPCI, and CS Systems.

On receipt of an initiation signal, ECCS pumps automatically start and the system aligns and the pumps inject water, taken either from the CSTs or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps.

Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCI pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (S/RVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly and the LPCI and CS cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the RHR Service Water System. Depending on the location and size of the break, portions of the ECCS may be ineffective; however, the overall design is effective in cooling the core regardless of the size or location of the piping break.

The combined operation of all ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment.

ECCS - Operating 3.5.1 Monticello B 3.5.1-2 Revision No. 34 BASES BACKGROUND (continued)

The CS System (Ref. 1) is composed of two independent subsystems.

Each subsystem consists of a motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low. Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started in approximately 15 seconds after AC power is available. When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the CS System without spraying water in the RPV.

LPCI is an independent operating mode of the RHR System. There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps in the same RHR loop and piping and valves to transfer water from the suppression pool to the RPV via the selected recirculation loop.

Each LPCI subsystem consists of a common suction line from the suppression pool, parallel flowpaths through the two RHR pumps, and a common injection line to the RPV. An inoperable LPCI pump refers to the condition where inoperable components associated with the flowpath through one of the two parallel RHR pumps renders that LPCI pump flowpath inoperable, but the common portions of the associated LPCI subsystem are OPERABLE.

The LPCI System is equipped with a loop select logic that determines which, if any, of the recirculation loops has been broken and selects the non-broken loop for injection. If neither loop is determined to be broken, a preselected loop is used for injection. The LPCI System cross-tie valve must be open to support OPERABILITY of both LPCI subsystems.

Similarly, the LPCI swing bus, consisting of two motor control centers which are directly connected together, is required to be energized from the Division 1 power supply (normal source), with automatic transfer capability to the Division 2 power supply (backup source) to support both LPCI subsystems. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started (pumps A and B approximately 5 seconds after AC power is available and pumps C and D approximately 10 seconds after AC power is available). RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the selected recirculation loop. When the RPV pressure drops sufficiently, the LPCI flow to the RPV, via the selected recirculation loop, begins. The water then enters the reactor through the jet pumps. Full flow test lines are provided for each LPCI subsystem to route water from and to the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV.

These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling." An intertie

ECCS - Operating 3.5.1 Monticello B 3.5.1-3 Revision No. 34 BASES BACKGROUND (continued) line is provided to connect the RHR shutdown cooling suction line with the two RHR shutdown cooling loop return lines to the associated recirculation loop. This line includes two RHR intertie return line isolation valves that are normally closed and a RHR intertie suction line isolation valve that is normally open. The purpose of this line is to reduce the potential for water hammer in the recirculation and RHR systems. The isolation valves are opened during a cooldown to establish recirculation flow through the RHR suction line and return lines, thereby ensuring a uniform cooldown of this piping. The RHR intertie loop return line isolation valves receive a closure signal on LPCI initiation. In the event of an inoperable RHR intertie loop return line isolation valve, there is a potential for some of the LPCI flow to be diverted to the broken loop during a LOCA. This may cause early transition boiling during a LOCA but this condition was evaluated in the safety analysis and found acceptable. The RHR intertie line is to be isolated within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> if discovered open in MODE 1 to eliminate the need to compensate for the small change in jet pump drive flow and a reduction in core flow during a loss of coolant accident.

The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CSTs and the suppression pool. Pump suction for HPCI is normally aligned to the CSTs to minimize injection of suppression pool water into the RPV. However, if the water level in any CST is low, or if the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve.

The HPCI System is designed to provide core cooling for a wide range of reactor pressures (150 psig to 1120 psig). Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine steam supply valve open and the turbine accelerates to a specified speed. As the HPCI flow increases, the turbine governor valve is automatically adjusted to maintain design flow. Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the CSTs to allow testing of the HPCI System during normal operation without injecting water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open or remain open to prevent pump damage due to

ECCS - Operating 3.5.1 Monticello B 3.5.1-4 Revision No. 34 BASES BACKGROUND (continued) overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The LPCI and CS System discharge lines are kept full of water using a "keep fill" system (Condensate Service System). The HPCI System is normally aligned to the CSTs. The height of water in the CSTs maintains the piping full of water up to the first closed isolation valve in the discharge piping. The HPCI System discharge piping near the normally closed injection valve to the Feedwater System absorbs heat from the feedwater via conduction and valve leakage. This has the potential to form a localized steam void in the HPCI discharge piping and cause a momentum transient upon HPCI initiation. Although the momentum transient has been evaluated and shown not to adversely affect HPCI System operation, the Condensate System is utilized as a keep-fill system to maintain the HPCI discharge piping between the normally closed injection valve and the pump discharge check valve charged with water to prevent possible void formation and minimize momentum transient effects. This keep-fill system is relied upon during normal operation, but is not required for the operability of the HPCI System under normal plant conditions. Additional assessment of operability may be required under off-normal conditions, such as HPCI suction aligned to the suppression pool. The relative height of the feedwater line connection for HPCI is such that the water in the feedwater lines keeps the remaining portion of the HPCI discharge line full of water.

The ADS (Ref. 4) consists of three of the eight S/RVs. It is designed to provide depressurization of the RCS during a small break LOCA if HPCI fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (CS and LPCI), so that these subsystems can provide coolant inventory makeup. The ADS valves are normally supplied by the Instrument Nitrogen System. This pneumatic supply will automatically transfer to the Instrument Air System on high or low Instrument Nitrogen System pressure. However, both of these pneumatic supplies are non-safety related and are not assumed to operate following an accident. The safety grade pneumatic supply to two of the ADS valves is the Alternate Nitrogen System and to the third ADS valve is the S/RV Accumulator bank. The Alternate Nitrogen System contains two independent trains (i.e., subsystems) of safety related replaceable gas cylinders that supply two of the three ADS valves (S/RVs A and C). One Alternate Nitrogen System train supplies one ADS valve and other non-ADS related pneumatic loads and the other Alternate Nitrogen System train supplies a different ADS valve and other non-ADS related pneumatic loads. The S/RV Accumulator Bank supplies the third ADS valve (S/RV D), and consists of a dedicated safety related backup accumulator bank and an associated inlet check valve.

ECCS - Operating 3.5.1 Monticello B 3.5.1-5 Revision No. 34 BASES APPLICABLE The ECCS performance is evaluated for the entire spectrum of break SAFETY sizes for a postulated LOCA. The accidents for which ECCS operation is ANALYSES required are presented in References 5 and 6. The required analyses and assumptions are defined in Reference 7. The results of these analyses are also described in References 5 and 6.

This LCO helps to ensure that the following acceptance criteria for the ECCS (Ref. 8), established by 10 CFR 50.46 (Ref. 9), will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a.

Maximum fuel element cladding temperature is 2200°F;

b.

Maximum cladding oxidation is 0.17°times the total cladding thickness before oxidation;

c.

Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d.

The core is maintained in a coolable geometry; and

e.

Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 10. For a large discharge pipe break LOCA, failure of the LPCI valve on the unbroken recirculation loop is considered the most limiting break/failure combination. For a small break LOCA, HPCI failure is the most severe failure. Extended Power Uprate removed the allowance for one ADS valve out-of-service (Ref. 17). The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Each ECCS injection/spray subsystem and three ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System. The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 9 could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by Reference 9.

ECCS - Operating 3.5.1 Monticello B 3.5.1-6 Revision No. 34 BASES LCO (continued)

As noted, LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR shutdown cooling supply isolation interlock in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes when the required RHR pump is not operating or when the system is realigned from or to the RHR shutdown cooling mode. This allowance is necessary since the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure is 150 psig, ADS and HPCI are not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "ECCS - Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCI subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If one LPCI pump is inoperable, the inoperable pump must be restored to OPERABLE status within 30 days. In this condition, the remaining OPERABLE pumps provide adequate core cooling during a LOCA.

However, overall LPCI reliability is reduced, because a single failure in one of the remaining OPERABLE LPCI subsystems, concurrent with a LOCA, may result in the LPCI subsystems not being able to perform their intended safety function. The 30 day Completion Time is based on a reliability study cited in Reference 11 that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowable repair times (i.e., Completion Times).

ECCS - Operating 3.5.1 Monticello B 3.5.1-7 Revision No. 34 BASES ACTIONS (continued)

B.1 If a LPCI subsystem is inoperable for reasons other than Condition A, or a CS subsystem is inoperable, the inoperable low pressure injection/spray subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

C.1 If one LPCI pump in each subsystem is inoperable, one inoperable LPCI pump must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE ECCS subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

D.1 If two LPCI subsystems are inoperable for reasons other than Condition C or G, one inoperable subsystem must be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this condition, the remaining OPERABLE CS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining CS subsystems, concurrent with a LOCA, may result in ECCS not being able to perform its intended safety function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on a reliability study cited in Reference 11 that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service; and on previous BWR licensing precedents, and was approved for Monticello by Amendment

ECCS - Operating 3.5.1 Monticello B 3.5.1-8 Revision No. 34 BASES ACTIONS (continued) 162 (Reference 14). The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowable repair times (i.e., Completion Times).

E.1, E.2 and E.3 If any one low pressure CS subsystem is inoperable in addition to either one LPCI subsystem OR one or two LPCI pump(s), adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS subsystems. This condition results in a complement of remaining OPERABLE low pressure ECCS (i.e., one CS and either two or three LPCI pumps) whose makeup capacity is bounded by the minimum makeup capacity evaluated in the accident analysis, which assumes the limiting single component failure (Reference 10). However, overall ECCS reliability is reduced, because a single active component failure in the remaining low pressure ECCS, concurrent with a design basis LOCA, could result in the minimum required ECCS equipment not being available. Since both a CS subsystem is inoperable and a reduction in the makeup capability of the LPCI System has occurred, a more restrictive Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is required to restore either a CS subsystem or, either a LPCI subsystem OR the LPCI pump(s) to OPERABLE status. The Completion Time was developed using engineering judgment based on a reliability study cited in Reference 11, previous BWR licensing precedents, and approved for Monticello by Amendment 162 (Reference 14). This Completion Time has been found to be acceptable through operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-9 Revision No. 34 BASES ACTIONS (continued)

F.1 and F.2 If any Required Action and associated Completion Time of Condition A, B, C, D, or E is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and to MODE 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 If two LPCI subsystems are inoperable due to open RHR intertie return line isolation valve(s), the RHR intertie line must be isolated within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. The line can be isolated by closing both RHR intertie return line isolation valves or by closing one RHR intertie return line isolation valve and the RHR intertie suction line isolation valve. The 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> Completion Time is reasonable, considered the low probability of a DBA occurring during this period.

H.1 If the Required Action and associated Completion Time of Condition G is not met, the plant must be brought to a MODE in which the RHR intertie return line isolation valves are not required to be closed. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

I.1 and I.2 If the HPCI System is inoperable and the RCIC System is verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY is therefore required immediately when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine

ECCS - Operating 3.5.1 Monticello B 3.5.1-10 Revision No. 34 BASES ACTIONS (continued) if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be immediately verified, however, Condition M must be entered. In the event of component failures concurrent with a design basis LOCA, there is a potential, depending on the specific failures, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

J.1 and J.2 If any one low pressure ECCS injection/spray subsystem, or one LPCI pump in both LPCI subsystems, is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem(s) or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this condition, adequate core cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since both a high pressure system (HPCI) and a low pressure subsystem(s) are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem(s) to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

K.1 The LCO requires three ADS valves to be OPERABLE in order to provide the ADS function. Reference 12 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only two ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced, because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-11 Revision No. 34 BASES ACTIONS (continued)

L.1 and L.2 If any Required Action and associated Completion Time of Condition I, J, or K is not met, or if one ADS valve is inoperable and Condition A, B, C, D, or G are entered, or if two or more ADS valves are inoperable, or if the HPCI System is inoperable and Condition D, E, or G are entered, then the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reactor steam dome pressure reduced to 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

M.1 If two or more low pressure ECCS injection/spray systems are inoperable for reasons other than Conditions C, D, E, or G, the plant is in a degraded condition not specifically justified for continued operation, and may be in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

For some cases, per the single failure assumptions of the accident analysis the plant may not be in an unanalyzed condition (Ref. 10) but the allowable duration for operation in the condition has not been justified, therefore LCO 3.0.3 must be entered immediately.

ECCS - Operating 3.5.1 Monticello B 3.5.1-12 Revision No. 34 BASES SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the CS System and LPCI subsystems full of water ensures that the ECCS will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent a water hammer following an ECCS initiation signal. One acceptable method of ensuring that the lines are full is to vent at the high points. While the potential for developing voids in the HPCI System exists, the effects of a void have been analyzed and shown to be acceptable. The 31 day Frequency is based on the gradual nature of void buildup in the ECCS piping, the procedural controls governing system operation, and operating experience.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position.

The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position would only affect a single subsystem. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.1.3 Verification every 31 days that each ADS pneumatic pressure is within the analysis limits (S/RV Accumulator Bank header pressure 88.3 psig and Alternate Nitrogen System supply (ALT N2 TRAIN A (or B) SUPPLY) pressure 410 psig (Ref. 13)) ensures adequate pressure for reliable ADS operation. The supply associated with each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the S/RV accumulator bank and Alternate

ECCS - Operating 3.5.1 Monticello B 3.5.1-13 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

Nitrogen System trains (replaceable gas cylinders) are such that, following a failure of the pneumatic supply to them, at least five valve actuations can occur over a ten hour period (Ref. 10). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. The 31 day Frequency takes into consideration administrative controls over operation of the system and alarms for low pressure.

Each Alternate Nitrogen System is designed for the three upstream nitrogen bottles to maintain OPERABILITY while the fourth, downstream, bottle is being replaced with a fully charged bottle. During bottle changeout the capacity of the system is temporarily reduced. This is acceptable based on the remaining capacity (only one actuation is necessary to depressurize), the low rate of usage, the fact that procedures have been initiated for replenishment, and the low probability of an event during this brief period.

SR 3.5.1.4 Verification every 31 days that the RHR System intertie return line isolation valves are closed ensures that each LPCI subsystem will provide the required flow rate to the reactor pressure vessel. The 31 day Frequency has been found acceptable, considering that these valves are under strict administrative controls that will ensure the valves continue to remain closed.

The SR is modified by a Note stating that the SR is only required to be met in MODE 1. During MODE 1 operations with the RHR System intertie line isolation valves open, some of the LPCI flow may be diverted to the broken recirculation loop during a LOCA, potentially resulting in early transition boiling. In other MODES, the intertie line may be opened because the impact on the LOCA analyses is negligible.

SR 3.5.1.5 Verification of correct breaker alignment to the LPCI swing bus demonstrates that the normal AC electrical power source is powering the swing bus and the backup AC electrical power source is available to ensure proper operation of the LPCI injection valves and the recirculation pump discharge valves. If either the normal source is not powering the LPCI swing bus or the backup source is not available to the LPCI swing bus, one of the LPCI subsystems must be considered inoperable. The 31 day Frequency has been found acceptable based on engineering judgment and operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-14 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.1.6 Cycling the recirculation pump discharge valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will close when required. Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the reactor via the recirculation jet pumps. De-energizing the valve in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing the valve include de-energizing breaker control power, racking out the breaker or removing the breaker.

The Frequency of this SR is in accordance with the Inservice Testing Program. If any recirculation pump discharge valve is inoperable and in the open position, both LPCI subsystems must be declared inoperable.

SR 3.5.1.7, SR 3.5.1.8, and SR 3.5.1.9 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 7). This periodic Surveillance is performed (in accordance with the ASME Operation and Maintenance (OM) Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 9. The pump flow rates are verified against a system head equivalent to the reactor to containment pressure expected during a LOCA. In addition, for LPCI the system head for the tested pump must include a head correction that corresponds to two LPCI pumps delivering 7,740 gpm. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. These values are established analytically.

The flow tests for the HPCI System are performed at two different pressure ranges such that system capability to provide rated flow against a system head corresponding to reactor pressure is tested at both the higher and lower operating ranges of the system. The required system head should overcome the RPV pressure and associated discharge line losses. Adequate reactor steam pressure must be available to perform the tests. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the HPCI System diverts steam flow. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform

ECCS - Operating 3.5.1 Monticello B 3.5.1-15 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) these tests. Reactor steam pressure must be 950 psig to perform SR 3.5.1.8 and 150 psig to perform SR 3.5.1.9. Adequate steam flow is represented by at least one turbine bypass valve 80% open. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance test is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that HPCI is inoperable.

Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for performing the flow test after the required pressure and flow are reached is sufficient to achieve stable conditions for testing and provides reasonable time to complete the SRs. The Frequency for SR 3.5.1.7 and SR 3.5.1.8 is in accordance with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.1.9 is based on the need to perform the Surveillance under the conditions that apply during a startup from a plant outage. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.10 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures that the HPCI System will automatically restart on a Reactor Vessel Water Level - Low Low signal received subsequent to a Reactor Vessel Water Level - High trip and that the suction is automatically transferred from the CSTs to the suppression pool on a Suppression Pool Water Level - High or Condensate Storage Tank Level - Low signal. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide complete testing of the assumed safety function.

ECCS - Operating 3.5.1 Monticello B 3.5.1-16 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.11 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.12 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation since the valves are individually tested in accordance with SR 3.5.1.12.

SR 3.5.1.12 This Surveillance verifies that each ADS valve is capable of being opened, which can be determined by either of two means, i.e., Method 1 or Method 2. Applying Method 1, approved in Reference 15, valve OPERABILITY and setpoints for overpressure protection are verified in

ECCS - Operating 3.5.1 Monticello B 3.5.1-17 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) accordance with the ASME OM Code. Applying Method 2, a manual actuation of the ADS valve is performed to verify the valve is functioning properly.

Method 1 Valve OPERABILITY and setpoints for overpressure protection are verified in accordance with the requirements of the ASME OM Code (Ref. 16). Proper ADS valve function is verified through performance of inspections and overlapping tests on component assemblies, demonstrating the valve is capable of being opened. Testing is performed to demonstrate that each:

ADS S/RV main stage opens and passes steam when the associated pilot stage actuates; and ADS S/RV second stage actuates to open the associated main stage when the pneumatic actuator is pressurized; ADS S/RV solenoid valve ports pneumatic pressure to the associated S/RV actuator when energized; ADS S/RV actuator stem moves when dry lift tested in-situ.

(With exception of main and pilot stages this test demonstrates mechanical operation without steam.)

The solenoid valves and S/RV actuators are functionally tested once per cycle as part of the Inservice Testing Program. The S/RV assembly is bench tested as part of the certification process, at intervals determined in accordance with the Inservice Testing Program. Maintenance procedures ensure that the S/RV is correctly installed in the plant, and that the S/RV and associated piping remain clear of foreign material that might obstruct valve operation or full steam flow.

This methodology provides adequate assurance that the ADS valves will operate when actuated, while minimizing the challenges to the valves and the likelihood of leakage or spurious operation.

Method 2 A manual actuation of each ADS valve is performed to verify that the valve and solenoid are functioning properly and that no blockage exists in the S/RV discharge lines. This is demonstrated by the response of the turbine bypass valves, by a change in the measured flow, or by any other method suitable to verify steam flow. Adequate steam flow must be

ECCS - Operating 3.5.1 Monticello B 3.5.1-18 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) passing through the turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening.

Sufficient time is therefore allowed after the required flow is achieved to perform this SR. Adequate steam flow is represented by at least one turbine bypass valve 80% open. This SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reactor steam flow is adequate to perform the test. Reactor startup is allowed prior to performing this SR because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for manual actuation after the required flow is reached is sufficient to achieve stable conditions and provides adequate time to complete the Surveillance.

SR 3.5.1.11 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, ECCS Instrumentation, overlap this Surveillance to provide complete testing of the assumed safety function.

The Frequency of In accordance with the Inservice Testing Program is based on ASME OM Code requirements. Industry operating experience has shown that these components usually pass the SR when performed at the Code required Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.13 The LPCI System injection valves, recirculation pump discharge valves, recirculation pump suction valves, and the RHR discharge intertie line isolation valves are powered from the LPCI swing bus, which must be energized after a single failure, including loss of power from the normal source to the swing bus. Therefore, the automatic transfer capability from the normal power source to the backup power source must be verified to ensure the automatic capability to detect loss of normal power and initiate an automatic transfer to the swing bus backup power source. Verification of this capability every 24 months ensures that AC electrical power is available for proper operation of the associated LPCI injection valves, recirculation pump discharge valves, recirculation pump suction valves, and the RHR discharge intertie line isolation valves. The swing bus automatic transfer scheme must be OPERABLE for both LPCI subsystems to be OPERABLE. The Frequency of 24 months is based on the need to perform the Surveillance under the conditions that apply during a startup from a plant outage. Operating experience has shown that the components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

ECCS - Operating 3.5.1 Monticello B 3.5.1-19 Revision No. 34 BASES REFERENCES

1.

USAR, Section 6.2.2.

2.

USAR, Section 6.2.3.

3.

USAR, Section 6.2.4.

4.

USAR, Section 6.2.5.

5.

USAR, Section 14.7.2.

6.

USAR, Section 14.7.3.

7.

10 CFR 50, Appendix K.

8.

USAR, Section 6.2.1.1.

9.

10 CFR 50.46.

10.

USAR, Section 14.7.2.3.2.

11.

Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCOs for ECCS Components,"

December 1, 1975.

12.

USAR, Section 14.7.2.3.1.5.

13.

Amendment No. 155, Issuance of Amendment Re: Request to Revise Technical Specification Surveillance Requirement 3.5.1.3 to Correct the Alternate Nitrogen System Pressure, dated February 21, 2008. (ADAMS Accession Nos. ML080380638 and ML080590541)

14.

Amendment No. 162, Issuance of Amendment Regarding Completion Time to Restore a Low-Pressure Emergency Core Cooling Subsystem to Operable Status, dated July 10, 2009.

(ADAMS Accession No. ML091480782)

15.

Amendment No. 168, Issuance of Amendment Re: Testing of Main Steam Safety/Relief Valves, dated July 27, 2012. (ADAMS Accession No. ML12185A216)

16.

ASME Operation and Maintenance (OM) Code.

17.

Amendment No. 176, Monticello Nuclear Generating Plant -

Issuance of Amendment No. 176 to Renewed Facility Operating License Regarding Extended Power Uprate, (ADAMS Accession No. ML13316C459)

ECCS - Operating 3.5.1 Monticello B 3.5.1 Last Revision No. 34 BASES REFERENCES (continued)

18.

Amendment No. 184, Monticello Nuclear Generating Plant -

Issuance of Amendment to Revise Technical Specification 3.5.1, ECCS [Emergency Core Cooling System] - Operating, dated November 3, 2014. (ADAMS Accession No. ML14246A449)

[Condition F previously allowed two Core Spray subsystems to be inoperable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.]

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-1 Revision No. 34 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND USAR Section 1.2.2 (Ref. 1) requires the reactor core and associated systems to be designed to accommodate plant operational transients or maneuvers that might be expected without compromising safety and without fuel damage. Therefore, SLs ensure that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).

The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity.

The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking.

Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions.

While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e.,

MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. The MCPR fuel cladding integrity SL ensures that during normal operation and during AOOs, at least 99.9% of the fuel rods in the core do not experience transition boiling.

Operation above the boundary of the nucleate boiling regime could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient.

Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place. This chemical

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-2 Revision No. 34 BASES BACKGROUND (continued) reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

The reactor vessel water level SL ensures that adequate core cooling capability is maintained during all MODES of reactor operation.

Establishment of Emergency Core Cooling System initiation setpoints higher than this SL provides margin such that the SL will not be reached or exceeded.

APPLICABLE The fuel cladding must not sustain damage as a result of normal SAFETY operation and AOOs. The reactor core SLs are established to preclude ANALYSES violation of the fuel design criterion that a MCPR limit is to be established, such that at least 99.9% of the fuel rods in the core would not be expected to experience the onset of transition boiling.

The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with the other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR Safety Limit.

The approved pressure range (700 to 1400 psia) of the GEXL 14 critical power correlation is applied to resolve a 10 CFR Part 21 condition concerning a potential to violate Reactor Core Safety Limit 2.1.1.1 during a Pressure Regulator Failure Maximum Demand (Open) transient (Reference 5). Application of this correlation, which applies to the GE14 fuel in the core, allows reduction of the reactor steam dome pressure from 785 to 686 psig, precluding violation of the safety limit for this event. This change in reactor steam dome pressure was approved in Amendment 185 (Reference 7).

2.1.1.1 Fuel Cladding Integrity The GEXL14 critical power correlation is applicable for all critical power calculations at pressures 686 psig and core flows 10% of rated flow (Reference 6). For operation at low pressures or low flows, another basis is used, as follows:

Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flows will always be > 4.56 psi. Analyses (Ref. 2) show that with a bundle flow of 28 x 103 lb/hr, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus, the bundle flow with a 4.56 psi driving head will be > 28 x 103 lb/hr. Full scale ATLAS test

Reactor Core SLs B 2.1.1 Monticello B 2.1.1-3 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES (continued) data taken at pressures from 0 psig to 785 psig indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER

> 50 % RTP. Thus, a THERMAL POWER limit of 25% RTP for reactor pressure < 686 psig or < 10% core flow is conservative.

2.1.1.2 MCPR The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that result in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. However, the uncertainties in monitoring the core operating state and in the procedures used to calculate the critical power result in an uncertainty in the value of the critical power. Therefore, the fuel cladding integrity SL is defined as the critical power ratio in the limiting fuel assembly for which more than 99.9% of the fuel rods in the core are expected to avoid boiling transition, considering the power distribution within the core and all uncertainties.

The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved General Electric Critical Power correlations. Details of the fuel cladding integrity SL calculation are given in Reference 2. Reference 3 includes a tabulation of the uncertainties used in the determination of the MCPR SL and of the nominal values of the parameters used in the MCPR SL statistical analysis.

2.1.1.3 Reactor Vessel Water Level During MODES 1 and 2 the reactor vessel water level is required to be above the top of the active irradiated fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes < 2/3 of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to

Reactor Core SLs B 2.1.1 Monticello B 2.1.1 Last Revision No. 34 BASES APPLICABLE SAFETY ANALYSES (continued) provide a point that can be monitored and to also provide adequate margin for effective action.

SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to prevent the release of radioactive materials to the environs.

SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforations.

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.

SAFETY LIMIT Exceeding an SL may cause fuel damage and create a potential for VIOLATIONS radioactive releases in excess of 10 CFR 50.67, Accident source term, limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SLs within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

REFERENCES

1.

USAR, Section 1.2.2.

2.

NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel" (revision specified in Specification 5.6.3).

3.

NEDE-31152P, "General Electric Fuel Bundle Designs," Revision 8, April 2001.

4.

10 CFR 50.67.

5.

GE Part 21 Notification SC05-03, Potential to Exceed Low Pressure Technical Specification Safety Limit, dated March 29, 2005.

6.

NRC Letter to A. Lingenfelter (GNF), Final Safety Evaluation for Global Nuclear Fuel (GNF) Topical Report (TR) NEDC-32851P, Revision 2, "GEXL14 Correlation for GE14 Fuel," (TAC No. MD5486) dated August 3, 2007.

7.

Amendment No. 185, Issuance of Amendment to Reduce the Reactor Steam Dome Pressure Specified in the Reactor Core Safety Limits, dated November 25, 2014. (ADAMS Accession No. ML14281A318)

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-1 Revision No. 34 B 3.3 INSTRUMENTATION B 3.3.6.1 Primary Containment Isolation Instrumentation BASES BACKGROUND The primary containment isolation instrumentation automatically initiates closure of appropriate primary containment isolation valves (PCIVs). The function of the PCIVs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs). Primary containment isolation within the time limits specified for those isolation valves designed to close automatically ensures that the release of radioactive material to the environment will be consistent with the assumptions used in the analyses for a DBA.

The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary (RCPB) isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic. Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC) System initiation, (e) main steam line pressure, (f) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (g) drywell pressure, (h) HPCI and RCIC steam line pressure, (i) reactor water cleanup (RWCU) flow, and (j) reactor steam dome pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation. The only exception is SLC System initiation.

Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below.

1. Main Steam Line Isolation Reactor Vessel Water Level - Low Low and Main Steam Line Pressure -

Low Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of all main steam isolation valves (MSIVs), MSL drain valves, and reactor sample isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system.

The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs), MSL drain valves, and recirculation sample isolation valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-2 Revision No. 34 BASES BACKGROUND (continued)

The Main Steam Line Flow - High Function uses 16 flow channels, four for each steam line. One channel from each steam line inputs to one of the four trip strings. Two trip strings make up each trip system and both trip systems must trip to cause an isolation of the MSIVs, MSL drain valves, and reactor sample isolation valves. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation.

The Main Steam Line Tunnel Temperature - High Function receives input from 16 channels (four from each of the four tunnel areas). The logic is arranged similar to the Main Steam Line Flow - High Function. One channel from each steam tunnel area inputs to one of four trip strings.

Two trip strings make up a trip system, and both trip systems must trip to cause isolation.

MSL Isolation Functions isolate the Group 1 valves.

2. Primary Containment Isolation The Reactor Vessel Water Level - Low and Drywell Pressure - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the Group 2 primary containment isolation valves (i.e., drywell and sump).

Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

Primary Containment Isolation Drywell Pressure - High and Reactor Vessel Water Level - Low Functions isolate the Group 2 drywell and sump isolation valves.

3, 4. High Pressure Coolant Injection System Isolation and Reactor Core Isolation Cooling System Isolation The HPCI and RCIC Steam Line Flow - High Functions receive input from two channels for each system. Each channel output for each system is connected to a time delay relay that provides an output signal to two trip systems. The output signal is arranged so that any channel that trips will provide a trip signal to the trip system (one-out-of-two logic in each trip system). Each trip system associated with HPCI or RCIC will provide a closure signal to the associated system isolation valves. The HPCI

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-3 Revision No. 34 BASES BACKGROUND (continued)

Steam Supply Line Pressure - Low Function receives input from four channels. The outputs are arranged in a one-out-of-two-twice logic in one trip system. The trip system isolates all HPCI isolation valves. The RCIC Steam Supply Line Pressure - Low Function receives input from four channels. The outputs are arranged in a one-out-of-two twice logic. The output of the logic is directed to two trip systems. Each trip system is able, by itself, to isolate all RCIC isolation valves. The HPCI and RCIC Steam Line Area Temperature - High Functions receive input from 16 channels for each system. The outputs of the 16 channels are grouped in four sets of four detectors. Each set is arranged in one-out-two-twice logic. The outputs of each set provide trip signals to each of two separate isolation trip systems. Each trip system is able, by itself, to isolate all HPCI and RCIC isolation valves, as applicable.

HPCI Functions isolate the Group 4 valves and RCIC Functions isolate the Group 5 valves.

5. Reactor Water Cleanup System Isolation The RWCU Room Temperature - High, Reactor Vessel Water Level - Low Low, Drywell Pressure - High, and RWCU Flow - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RWCU valves.

Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all RWCU isolation valves. The SLC System Initiation Function receives input from the SLC initiation switch. The switch provides trip signal inputs to both trip systems in any position other than "OFF." For the purpose of this Specification, the SLC initiation switch is considered to provide one channel input into each trip system. Each of the two trip systems is connected to one of the two valves on each RWCU penetration.

RWCU Functions isolate the Group 3 valves.

6. Shutdown Cooling System Isolation The Reactor Vessel Water Level - Low Function receives input from four reactor vessel water level channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RHR

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-4 Revision No. 34 BASES BACKGROUND (continued) shutdown cooling supply isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of the RHR shutdown cooling supply isolation valves. The Reactor Steam Dome Pressure - High Function receives input from two channels, both of which provide input to two trip systems.

Any trip channel will trip both trip systems to initiate isolation of the RHR shutdown cooling supply isolation valves.

Shutdown Cooling System Isolation Functions isolate the Group 2 RHR shutdown cooling supply isolation valves.

7. Traversing Incore Probe (TIP) System Isolation The Reactor Vessel Water Level - Low and Drywell Pressure - High Functions receive inputs from four channels. One channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to initiate a TIP drive isolation signal. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate a TIP drive isolation signal.

When either Function actuates, the TIP drive mechanisms will withdraw the TIPs, if inserted, and close the inboard TIP System isolation ball valves when the TIPs are fully withdrawn. The outboard TIP System isolation valves are manual shear valves.

TIP System Isolation Functions isolate the Group 2 valves (TIP inboard isolation ball valves).

APPLICABLE The isolation signals generated by the primary containment isolation SAFETY instrumentation are implicitly assumed in the safety analyses of ANALYSES, LCO, References 1 and 2 to initiate closure of valves to limit offsite doses.

and APPLICABILITY Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs),"

Applicable Safety Analyses Bases for more detail of the safety analyses.

Primary containment isolation instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-5 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The OPERABILITY of the primary containment instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.6.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each Primary Containment Isolation Function specified in the Table. Nominal trip setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values and nominal trip setpoints (NTSP) are derived, using the General Electric setpoint methodology guidance, as specified in the Monticello setpoint methodology. The Allowable Values are derived from the analytic limits. The difference between the analytic limit and the Allowable Value allows for channel instrument accuracy, calibration accuracy, process measurement accuracy, and primary element accuracy. The margin between the Allowable Value and the NTSP allows for instrument drift that might occur during the established surveillance period. Two separate verifications are performed for the calculated NTSP. The first, a Spurious Trip Avoidance Test, evaluates the impact of the NTSP on plant availability. The second verification, an LER Avoidance Test, calculates the probability of avoiding a Licensee Event Report (or exceeding the Allowable Value) due to instrument drift. These two verifications are statistical evaluations to provide additional assurance of the acceptability of the NTSP and may require changes to the NTSP. Use of these methods and verifications provides the assurance that if the setpoint is found conservative to the Allowable Value during surveillance testing, the instrumentation would have provided the required trip function by the time the process reached the analytic limit for the applicable events.

Certain Emergency Core Cooling Systems (ECCS) valves (e.g., RHR test line suppression pool cooling isolation) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS. The instrumentation requirements and ACTIONS associated with these signals are addressed

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-6 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) in LCO 3.3.5.1, "Emergency Core Cooling Systems (ECCS)

Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment." Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Main Steam Line Isolation 1.a. Reactor Vessel Water Level - Low Low Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the MSIVs and other interfaces with the reactor vessel occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level

- Low Low Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals. The Reactor Vessel Water Level - Low Low Function associated with isolation is assumed in the analysis of the recirculation line break (Ref. 1). The isolation of the MSLs on Low Low supports actions to ensure that offsite dose limits are not exceeded for a DBA.

Reactor vessel water level signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low Allowable Value is chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low Allowable Value (LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of coolant accident (LOCA) to prevent offsite doses from exceeding 10 CFR 50.67 limits.

This Function isolates the Group 1 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-7 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 1.b. Main Steam Line Pressure - Low Low MSL pressure indicates that there may be a problem with the turbine pressure regulation, which could result in a low reactor vessel water level condition and the RPV cooling down more than 100°F/hr if the pressure loss is allowed to continue. The Main Steam Line Pressure - Low Function is directly assumed in the analysis of the pressure regulator failure (Ref. 3). For this event, the closure of the MSIVs ensures that the RPV temperature change limit (100°F/hr) is not reached. In addition, this Function supports actions to ensure that Safety Limit 2.1.1.1 is not exceeded. (This Function closes the MSIVs prior to pressure decreasing below 686 psig, which results in a scram due to MSIV closure, thus reducing reactor power to < 25% RTP.)

The MSL low pressure signals are initiated from four pressure switches that are connected to the MSL header close to the turbine stop valves.

The pressure switches are arranged such that, even though physically separated from each other, each pressure switch is able to detect low MSL pressure. Four channels of Main Steam Line Pressure - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be high enough to prevent excessive RPV depressurization.

The Main Steam Line Pressure - Low Function is only required to be OPERABLE in MODE 1 since this is when the assumed transient can occur (Ref. 3).

This Function isolates the Group 1 valves.

1.c. Main Steam Line Flow - High Main Steam Line Flow - High is provided to detect a break of the MSL and to initiate closure of the MSIVs. If the steam were allowed to continue flowing out of the break, the reactor would depressurize and the core could uncover. If the RPV water level decreases too far, fuel damage could occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The Main Steam Line Flow - High Function is one of the Functions assumed in the analysis of the main steam line break (MSLB) (Ref. 2). The isolation action, along with the scram function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46 and offsite doses do not exceed the 10 CFR 50.67 limits.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-8 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The MSL flow signals are initiated from 16 differential pressure indicating switches that are connected to the four MSLs (differential pressure indicating switches sense differential pressure across a flow restrictor).

The differential pressure indicating switches are arranged such that, even though physically separated from each other, all four connected to one MSL would be able to detect the high flow. Four channels of Main Steam Line Flow - High Function for each MSL (two channels per trip system) are available and are required to be OPERABLE so that no single instrument failure will preclude detecting a break in any individual MSL.

The Allowable Value is chosen to ensure that offsite dose limits are not exceeded due to the break.

This Function isolates the Group 1 valves.

1.d. Main Steam Line Tunnel Temperature - High Main steam line tunnel temperature is provided to detect a leak in the RCPB in the steam tunnel and provides diversity to the high flow instrumentation. Temperature is sensed in four different areas of the steam tunnel above each main steam line. The isolation occurs when a very small leak has occurred in any of the four areas. If the small leak is allowed to continue without isolation, offsite dose limits may be reached.

However, credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks, such as MSLBs.

Main steam line tunnel temperature signals are initiated from bimetallic temperature switches located in the four areas being monitored. Even though physically separated from each other, any temperature switch in any of the four areas is able to detect a leak. Therefore, sixteen channels of Main Steam Line Tunnel Temperature - High Function are available but only eight channels (two channels in each of the four trip strings) are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Main Steam Line Tunnel Temperature - High Allowable Value is chosen to detect a leak equivalent to between 5 gpm and 10 gpm.

This Function isolates the Group 1 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-9 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Primary Containment Isolation 2.a. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products.

The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water Level - Low Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level - Low signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Low Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"),

since isolation of these valves is not critical to orderly plant shutdown.

This Function isolates the Group 2 drywell and sump isolation valves.

2.b. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell Pressure -

High are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-10 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

This Function isolates the Group 2 drywell and sump isolation valves.

High Pressure Coolant Injection and Reactor Core Isolation Cooling Systems Isolation 3.a, 4.a. HPCI and RCIC Steam Line Flow - High Steam Line Flow - High Functions are provided to detect a break of the RCIC or HPCI steam lines and initiate closure of the steam line isolation valves of the appropriate system. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and the core can uncover. Therefore, the isolations are initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram function of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for these Functions is not assumed in any USAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC or HPCI steam line breaks from becoming bounding. The HPCI and RCIC Steam Line Flow - High channels are each provided with a time delay relay to prevent false isolations on HPCI or RCIC Steam Line Flow - High, as applicable, during system startup transients and therefore improves system reliability.

The HPCI and RCIC Steam Line Flow - High signals are initiated from differential pressure switches (two for HPCI and two for RCIC) that are connected to the system steam lines. Two channels of both HPCI and RCIC Steam Line Flow - High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. In addition, each flow channel is connected to a time delay relay to delay the tripping of the associated HPCI or RCIC isolation trip system for a short time.

The Allowable Values are chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains the MSLB event as the bounding event. The Allowable Values associated with the time delay are chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

3.b, 4.b. HPCI and RCIC Steam Supply Line Pressure - Low Low HPCI or RCIC steam supply line pressure indicates that the pressure of the steam in the HPCI or RCIC turbine, as applicable, may be too low to continue operation of the associated systems turbine. These isolations

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-11 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) are for equipment protection and are not assumed in any transient or accident analysis in the USAR. However, they also provide a diverse signal to indicate a possible system break. These instruments are included in Technical Specifications (TS) because of the potential for risk due to possible failure of the instruments preventing HPCI and RCIC initiations. Therefore, they meet Criterion 4 of 10 CFR 50.36(c)(2)(ii).

The HPCI and RCIC Steam Supply Line Pressure - Low signals are initiated from pressure switches (four for HPCI and four for RCIC) that are connected to the system steam line. Four channels of both HPCI and RCIC Steam Supply Line Pressure - Low Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are selected to be high enough to prevent damage to the systems turbine.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

3.c, 4.c. HPCI and RCIC Steam Line Area Temperature - High HPCI and RCIC steam line area temperatures are provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. These Functions are not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

HPCI and RCIC Steam Line Area Temperature - High signals are initiated from bimetallic temperature switches that are appropriately located to protect the system that is being monitored. Eight instruments monitor each area. Sixteen channels for each HPCI and RCIC Steam Line Area Temperature - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a break in the associated system piping to ensure the core will not be uncovered and the radiological consequences are bounded by the main steam line break analysis.

These Functions isolate the Groups 4 and 5 valves, as appropriate.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-12 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Reactor Water Cleanup System Isolation 5.a. RWCU Flow - High The high flow signal is provided to detect a break in the RWCU System.

This will detect leaks in the RWCU System when room temperature would not provide detection (i.e., a cold leg break). Should the reactor coolant continue to flow out of the break, offsite dose limits may be exceeded.

Therefore, isolation of the RWCU System is initiated when high flow is sensed to prevent exceeding offsite doses. A time delay is provided to prevent spurious trips during most RWCU operational transients. This Function is not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

The high flow signals are initiated from transmitters that monitor RWCU System flow. In addition, each flow channel is connected to a time delay relay to delay the tripping of the flow channel for a short time. Four channels of RWCU Flow - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The RWCU Flow - High Allowable Value ensures that a break of the RWCU piping is detected. The Allowable Value associated with the time delay is chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.

This Function isolates the Group 3 valves.

5.b. RWCU Room Temperature - High RWCU room temperatures are provided to detect a leak from the RWCU System. The isolation occurs even when very small leaks have occurred and is diverse to the high differential flow instrumentation for the hot portions of the RWCU System. If the small leak continues without isolation, offsite dose limits may be reached. Credit for these instruments is not taken in any transient or accident analysis in the USAR, since bounding analyses are performed for large breaks such as recirculation or MSL breaks.

RWCU room temperature signals are initiated from temperature elements that are located in the room that is being monitored. Four resistance temperature detectors provide input to the RWCU Room Temperature -

High Function. Four channels are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-13 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The RWCU Room Temperature - High Allowable Value is set low enough to detect a leak equivalent to 210 gpm.

This Function isolates the Group 3 valves.

5.c. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

High drywell pressure signals are initiated from pressure switches that sense the pressure in the drywell. Four channels of Drywell Pressure -

High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

This Function isolates the Group 3 valves.

5.d. SLC System Initiation The isolation of the RWCU System is required when the SLC System has been initiated to prevent dilution and removal of the boron solution by the RWCU System (Ref. 4). SLC System initiation signals are initiated from the SLC initiation switch.

Two channels of the SLC System Initiation Function are available and are required to be OPERABLE only in MODES 1 and 2, since these are the only MODES where the reactor can be critical, and these MODES are consistent with the Applicability for the SLC System (LCO 3.1.7, "Standby Liquid Control (SLC) System").

There is no Allowable Value associated with this Function since the channels are mechanically actuated based solely on the position of the SLC System initiation switch.

This Function isolates the Group 3 valves.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-14 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 5.e. Reactor Vessel Water Level - Low Low Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some interfaces with the reactor vessel occurs to isolate the potential sources of a break. The isolation of the RWCU System on low low RPV water level supports actions to ensure that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water Level - Low Low Function associated with RWCU isolation is not directly assumed in the USAR safety analyses because the RWCU System line break is bounded by breaks of larger systems (recirculation and MSL breaks are more limiting).

Reactor Vessel Water Level - Low Low signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

This Function isolates the Group 3 valves.

Shutdown Cooling System Isolation 6.a. Reactor Steam Dome Pressure - High The Reactor Steam Dome Pressure - High Function is provided to isolate the shutdown cooling portion of the Residual Heat Removal (RHR)

System. This interlock is provided only for equipment protection to prevent an intersystem LOCA scenario, and credit for the interlock is not assumed in the accident or transient analysis in the USAR.

The Reactor Steam Dome Pressure - High signals are initiated from two transmitters that are connected to different taps on the RPV. Two channels of Reactor Steam Dome Pressure - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. The Function is only required to be OPERABLE in MODES 1, 2, and 3, since these are the only MODES in which the reactor can be pressurized; thus, equipment

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-15 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) protection is needed. The Allowable Value was chosen to be low enough to protect the system equipment from overpressurization.

This Function isolates the Group 2 RHR shutdown cooling supply isolation valves.

6.b. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level - Low Function associated with RHR Shutdown Cooling System isolation is not directly assumed in safety analyses because a break of the RHR Shutdown Cooling System is bounded by breaks of the recirculation and MSL. The RHR Shutdown Cooling System isolation on low RPV water level supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level - Low signals are initiated from four differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. As noted (footnote (a) to Table 3.3.6.1-1), only one channel per trip system (with an isolation signal available to one shutdown cooling pump supply isolation valve) of the Reactor Vessel Water Level - Low Function is required to be OPERABLE in MODES 4 and 5, provided RHR Shutdown Cooling System integrity is maintained. System integrity is maintained provided the piping is intact and no maintenance is being performed that has the potential for draining the reactor vessel through the system.

The Reactor Vessel Water Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low Function is only required to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow path from lowering the reactor vessel level to the top of the fuel. In MODES 1 and 2, another isolation (i.e., Reactor Steam Dome Pressure - High) and

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-16 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) administrative controls ensure that this flow path remains isolated to prevent unexpected loss of inventory via this flow path.

This Function isolates the Group 2 RHR shutdown cooling supply isolation valves.

Traversing Incore Probe System Isolation 7.a. Reactor Vessel Water Level - Low Low RPV water level indicates that the capability to cool the fuel may be threatened. The valves whose penetrations communicate with the primary containment are isolated to limit the release of fission products.

The isolation of the primary containment on low RPV water level supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Reactor Vessel Water Level - Low Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA.

Reactor Vessel Water Level - Low signals are initiated from differential pressure transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Two channels of Reactor Vessel Water Level - Low Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent isolation actuation. The isolation function is ensured by the manual shear valve in each penetration.

The Reactor Vessel Water Level - Low Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low Allowable Value (LCO 3.3.1.1), since isolation of these valves is not critical to orderly plant shutdown.

This Function isolates the Group 2 TIP inboard isolation ball valves.

7.b. Drywell Pressure - High High drywell pressure can indicate a break in the RCPB inside the primary containment. The isolation of some of the primary containment isolation valves on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 50.67 are not exceeded. The Drywell Pressure - High Function, associated with isolation of the primary containment, is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-17 Revision No. 34 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the drywell. Two channels of Drywell Pressure -

High Function are available and are required to be OPERABLE to ensure that no single instrument failure can initiate an inadvertent actuation. The isolation function is ensured by the manual shear valve in each penetration.

The Allowable Value was selected to be the same as the ECCS Drywell Pressure - High Allowable Value (LCO 3.3.5.1), since this may be indicative of a LOCA inside primary containment.

This Function isolates the Group 2 TIP inboard isolation ball valves.

ACTIONS The ACTIONS are modified by two Notes. Note 1 allows penetration flow path(s) to be unisolated intermittently under administrative controls.

These controls consist of stationing a dedicated operator at the controls of the valve, who is in continuous communication with the control room.

In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated. Note 2 has been provided to modify the ACTIONS related to primary containment isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable primary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable primary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, depending on the Function (12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for those Functions that have channel components common to RPS instrumentation and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for those Functions that do not have channel components common to RPS instrumentation), has been shown to be acceptable (Refs. 5 and 6) to permit restoration of any inoperable channel to OPERABLE status. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-18 Revision No. 34 BASES ACTIONS (continued)

(refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

Condition C must be entered and its Required Action taken.

B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant primary containment isolation capability being lost for the associated penetration flow path(s). The MSL, Primary Containment, most of the RWCU System, Shutdown Cooling System Reactor Vessel Water Level - Low, and TIP Isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function on a valid signal. The other isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 1.a, 1.b, 2.a, 2.b, 5.a, 5.b, 5.c, 5.e, 6.b, 7.a, and 7.b, this would require both trip systems to have one channel OPERABLE or in trip. For Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. Function 1.d channels monitor several locations within a given area (e.g., different locations within the main steam tunnel area).

However, since any channel can detect a leak in any area, this would require both trip systems to have one channel OPERABLE or in trip. For Functions 3.a, 4.a, and 5.d, this would require one trip system to have one channel OPERABLE or in trip. For Function 3.b, this would require one channel in each trip string to be OPERABLE or in trip for the trip system. For Function 4.b, this would require one channel in each trip string to be OPERABLE or in trip for one trip system. For Functions 3.c and 4.c, eight channels monitor each area. These channels are arranged in two sets of four detectors, with each set of detectors arranged in a one-out-of-two-twice logic. Therefore, this would require a set in each area to have sufficient channels OPERABLE or in the tripped condition for one trip system.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-19 Revision No. 34 BASES ACTIONS (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

C.1 Required Action C.1 directs entry into the appropriate Condition referenced in Table 3.3.6.1-1. The applicable Condition specified in Table 3.3.6.1-1 is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A or B and the associated Completion Time has expired, Condition C will be entered for that channel and provides for transfer to the appropriate subsequent Condition.

D.1, D.2.1, and D.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and in MODE 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> (Required Actions D.2.1 and D.2.2). Alternately, the associated MSLs may be isolated (Required Action D.1), and, if allowed (i.e., plant safety analysis allows operation with an MSL isolated),

operation with that MSL isolated may continue. Isolating the affected MSL accomplishes the safety function of the inoperable channel. The Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

The allowed Completion Time of 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> is reasonable, based on operating experience, to reach MODE 2 from full power conditions in an orderly manner and without challenging plant systems.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-20 Revision No. 34 BASES ACTIONS (continued)

F.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels.

For the RWCU Room Temperature - High Function, the affected penetration flow path(s) may be considered isolated by isolating only that portion of the system in the associated room monitored by the inoperable channel. That is, if the RWCU pump room A area channel is inoperable, the pump room A area can be isolated while allowing continued RWCU operation utilizing the B RWCU pump.

The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing sufficient time for plant operations personnel to isolate the affected penetration flow path(s).

G.1 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, plant operations may continue if the affected penetration flow path(s) is isolated. Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable channels. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Completion Time is acceptable due to the fact that these Functions provide a TIP System isolation, and the TIP System penetration is a small bore (approximately 1/2 inch), its isolation in a design basis event (with loss of offsite power) would be via the manually operated shear valves, and the ability to manually isolate by either the normal isolation valve or the shear valve is unaffected by the inoperable instrumentation.

H.1 and H.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystems inoperable or isolating the RWCU System.

The 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> Completion Time is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-21 Revision No. 34 BASES ACTIONS (continued)

I.1 and I.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path should be closed. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to isolate the RHR Shutdown Cooling System (i.e., provide alternate decay heat removal capabilities so the penetration flow path can be isolated). Actions must continue until the channel is restored to OPERABLE status or the RHR Shutdown Cooling System is isolated.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each Primary REQUIREMENTS Containment Isolation instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are modified by a Note to indicate that when a channel (a channel that is directed to two trip systems is considered to be one channel) is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> provided the associated Function maintains primary containment isolation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> testing allowance does not significantly reduce the probability that the PCIVs will isolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-22 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Frequency is based on operating experience that demonstrates channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The 92 day Frequency of SR 3.3.6.1.2 is based on the reliability analyses described in References 5 and 6.

SR 3.3.6.1.3 Calibration of trip units provides a check of the actual trip setpoints (including any specified time delay). The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis.

Under these conditions, the setpoint must be readjusted to be equal to or more conservative than that accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analyses of References 5 and 6.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1-23 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.1.4 and SR 3.3.6.1.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency of SR 3.3.6.1.4 is based on the assumption of a 92 day calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis. The Frequency of SR 3.3.6.1.5 is based on the assumption of a 24 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.6.1.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps this Surveillance to provide complete testing of the assumed safety function. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the Surveillance when performed at the 24 month Frequency.

REFERENCES

1.

USAR, Section 14.7.2.

2.

USAR, Section 14.7.3.

3.

USAR, Section 7.6.3.2.4.

4.

USAR, Section 6.6.1.1.

5.

NEDC-31677P-A, "Technical Specification Improvement Analysis for BWR Isolation Actuation Instrumentation," July 1990.

6.

NEDC-30851P-A Supplement 2, "Technical Specifications Improvement Analysis for BWR Isolation Instrumentation Common to RPS and ECCS Instrumentation," March 1989.

Primary Containment Isolation Instrumentation B 3.3.6.1 Monticello B 3.3.6.1 Last Revision No. 34 BASES REFERENCES (continued)

7.

Amendment No. 185, Issuance of Amendment to Reduce the Reactor Steam Dome Pressure Specified in the Reactor Core Safety Limits, dated November 25, 2014. (ADAMS Accession No. ML14281A318)

ECCS - Operating 3.5.1 Monticello B 3.5.1-1 Revision No. 34 B 3.5 EMERGENCY CORE COOLING SYSTEM (ECCS) AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCS - Operating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, the Core Spray (CS) System, the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System, and the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS.

Although no credit is taken in the safety analyses for the condensate storage tanks (CSTs), they are capable of providing a source of water for the HPCI, LPCI, and CS Systems.

On receipt of an initiation signal, ECCS pumps automatically start and the system aligns and the pumps inject water, taken either from the CSTs or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pumps.

Although the system is initiated, ADS action is delayed, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCI pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the vessel to cool the core. If the break is small, the HPCI System will maintain coolant inventory as well as vessel level while the RCS is still pressurized. If HPCI fails, it is backed up by ADS in combination with LPCI and CS. In this event, the ADS timed sequence would be allowed to time out and open the selected safety/relief valves (S/RVs) depressurizing the RCS, thus allowing the LPCI and CS to overcome RCS pressure and inject coolant into the vessel. If the break is large, RCS pressure initially drops rapidly and the LPCI and CS cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the RHR Service Water System. Depending on the location and size of the break, portions of the ECCS may be ineffective; however, the overall design is effective in cooling the core regardless of the size or location of the piping break.

The combined operation of all ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS equipment.

ECCS - Operating 3.5.1 Monticello B 3.5.1-2 Revision No. 34 BASES BACKGROUND (continued)

The CS System (Ref. 1) is composed of two independent subsystems.

Each subsystem consists of a motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suppression pool to the sparger. The CS System is designed to provide cooling to the reactor core when reactor pressure is low. Upon receipt of an initiation signal, the CS pumps in both subsystems are automatically started in approximately 15 seconds after AC power is available. When the RPV pressure drops sufficiently, CS System flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the CS System without spraying water in the RPV.

LPCI is an independent operating mode of the RHR System. There are two LPCI subsystems (Ref. 2), each consisting of two motor driven pumps in the same RHR loop and piping and valves to transfer water from the suppression pool to the RPV via the selected recirculation loop.

Each LPCI subsystem consists of a common suction line from the suppression pool, parallel flowpaths through the two RHR pumps, and a common injection line to the RPV. An inoperable LPCI pump refers to the condition where inoperable components associated with the flowpath through one of the two parallel RHR pumps renders that LPCI pump flowpath inoperable, but the common portions of the associated LPCI subsystem are OPERABLE.

The LPCI System is equipped with a loop select logic that determines which, if any, of the recirculation loops has been broken and selects the non-broken loop for injection. If neither loop is determined to be broken, a preselected loop is used for injection. The LPCI System cross-tie valve must be open to support OPERABILITY of both LPCI subsystems.

Similarly, the LPCI swing bus, consisting of two motor control centers which are directly connected together, is required to be energized from the Division 1 power supply (normal source), with automatic transfer capability to the Division 2 power supply (backup source) to support both LPCI subsystems. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, all four LPCI pumps are automatically started (pumps A and B approximately 5 seconds after AC power is available and pumps C and D approximately 10 seconds after AC power is available). RHR System valves in the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the selected recirculation loop. When the RPV pressure drops sufficiently, the LPCI flow to the RPV, via the selected recirculation loop, begins. The water then enters the reactor through the jet pumps. Full flow test lines are provided for each LPCI subsystem to route water from and to the suppression pool, to allow testing of the LPCI pumps without injecting water into the RPV.

These test lines also provide suppression pool cooling capability, as described in LCO 3.6.2.3, "RHR Suppression Pool Cooling." An intertie

ECCS - Operating 3.5.1 Monticello B 3.5.1-3 Revision No. 34 BASES BACKGROUND (continued) line is provided to connect the RHR shutdown cooling suction line with the two RHR shutdown cooling loop return lines to the associated recirculation loop. This line includes two RHR intertie return line isolation valves that are normally closed and a RHR intertie suction line isolation valve that is normally open. The purpose of this line is to reduce the potential for water hammer in the recirculation and RHR systems. The isolation valves are opened during a cooldown to establish recirculation flow through the RHR suction line and return lines, thereby ensuring a uniform cooldown of this piping. The RHR intertie loop return line isolation valves receive a closure signal on LPCI initiation. In the event of an inoperable RHR intertie loop return line isolation valve, there is a potential for some of the LPCI flow to be diverted to the broken loop during a LOCA. This may cause early transition boiling during a LOCA but this condition was evaluated in the safety analysis and found acceptable. The RHR intertie line is to be isolated within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> if discovered open in MODE 1 to eliminate the need to compensate for the small change in jet pump drive flow and a reduction in core flow during a loss of coolant accident.

The HPCI System (Ref. 3) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line, where the coolant is distributed within the RPV through the feedwater sparger. Suction piping for the system is provided from the CSTs and the suppression pool. Pump suction for HPCI is normally aligned to the CSTs to minimize injection of suppression pool water into the RPV. However, if the water level in any CST is low, or if the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCI System. The steam supply to the HPCI turbine is piped from a main steam line upstream of the associated inboard main steam isolation valve.

The HPCI System is designed to provide core cooling for a wide range of reactor pressures (150 psig to 1120 psig). Upon receipt of an initiation signal, the HPCI turbine stop valve and turbine steam supply valve open and the turbine accelerates to a specified speed. As the HPCI flow increases, the turbine governor valve is automatically adjusted to maintain design flow. Exhaust steam from the HPCI turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the CSTs to allow testing of the HPCI System during normal operation without injecting water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open or remain open to prevent pump damage due to

ECCS - Operating 3.5.1 Monticello B 3.5.1-4 Revision No. 34 BASES BACKGROUND (continued) overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled with water. The LPCI and CS System discharge lines are kept full of water using a "keep fill" system (Condensate Service System). The HPCI System is normally aligned to the CSTs. The height of water in the CSTs maintains the piping full of water up to the first closed isolation valve in the discharge piping. The HPCI System discharge piping near the normally closed injection valve to the Feedwater System absorbs heat from the feedwater via conduction and valve leakage. This has the potential to form a localized steam void in the HPCI discharge piping and cause a momentum transient upon HPCI initiation. Although the momentum transient has been evaluated and shown not to adversely affect HPCI System operation, the Condensate System is utilized as a keep-fill system to maintain the HPCI discharge piping between the normally closed injection valve and the pump discharge check valve charged with water to prevent possible void formation and minimize momentum transient effects. This keep-fill system is relied upon during normal operation, but is not required for the operability of the HPCI System under normal plant conditions. Additional assessment of operability may be required under off-normal conditions, such as HPCI suction aligned to the suppression pool. The relative height of the feedwater line connection for HPCI is such that the water in the feedwater lines keeps the remaining portion of the HPCI discharge line full of water.

The ADS (Ref. 4) consists of three of the eight S/RVs. It is designed to provide depressurization of the RCS during a small break LOCA if HPCI fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (CS and LPCI), so that these subsystems can provide coolant inventory makeup. The ADS valves are normally supplied by the Instrument Nitrogen System. This pneumatic supply will automatically transfer to the Instrument Air System on high or low Instrument Nitrogen System pressure. However, both of these pneumatic supplies are non-safety related and are not assumed to operate following an accident. The safety grade pneumatic supply to two of the ADS valves is the Alternate Nitrogen System and to the third ADS valve is the S/RV Accumulator bank. The Alternate Nitrogen System contains two independent trains (i.e., subsystems) of safety related replaceable gas cylinders that supply two of the three ADS valves (S/RVs A and C). One Alternate Nitrogen System train supplies one ADS valve and other non-ADS related pneumatic loads and the other Alternate Nitrogen System train supplies a different ADS valve and other non-ADS related pneumatic loads. The S/RV Accumulator Bank supplies the third ADS valve (S/RV D), and consists of a dedicated safety related backup accumulator bank and an associated inlet check valve.

ECCS - Operating 3.5.1 Monticello B 3.5.1-5 Revision No. 34 BASES APPLICABLE The ECCS performance is evaluated for the entire spectrum of break SAFETY sizes for a postulated LOCA. The accidents for which ECCS operation is ANALYSES required are presented in References 5 and 6. The required analyses and assumptions are defined in Reference 7. The results of these analyses are also described in References 5 and 6.

This LCO helps to ensure that the following acceptance criteria for the ECCS (Ref. 8), established by 10 CFR 50.46 (Ref. 9), will be met following a LOCA, assuming the worst case single active component failure in the ECCS:

a.

Maximum fuel element cladding temperature is 2200°F;

b.

Maximum cladding oxidation is 0.17°times the total cladding thickness before oxidation;

c.

Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d.

The core is maintained in a coolable geometry; and

e.

Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 10. For a large discharge pipe break LOCA, failure of the LPCI valve on the unbroken recirculation loop is considered the most limiting break/failure combination. For a small break LOCA, HPCI failure is the most severe failure. Extended Power Uprate removed the allowance for one ADS valve out-of-service (Ref. 17). The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Each ECCS injection/spray subsystem and three ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are defined as the two CS subsystems, the two LPCI subsystems, and one HPCI System. The low pressure ECCS injection/spray subsystems are defined as the two CS subsystems and the two LPCI subsystems.

With less than the required number of ECCS subsystems OPERABLE, the potential exists that during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in Reference 9 could be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by Reference 9.

ECCS - Operating 3.5.1 Monticello B 3.5.1-6 Revision No. 34 BASES LCO (continued)

As noted, LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal when below the actual RHR shutdown cooling supply isolation interlock in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. Alignment and operation for decay heat removal includes when the required RHR pump is not operating or when the system is realigned from or to the RHR shutdown cooling mode. This allowance is necessary since the RHR System may be required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3, when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, when reactor steam dome pressure is 150 psig, ADS and HPCI are not required to be OPERABLE because the low pressure ECCS subsystems can provide sufficient flow below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "ECCS - Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCI subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCI subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If one LPCI pump is inoperable, the inoperable pump must be restored to OPERABLE status within 30 days. In this condition, the remaining OPERABLE pumps provide adequate core cooling during a LOCA.

However, overall LPCI reliability is reduced, because a single failure in one of the remaining OPERABLE LPCI subsystems, concurrent with a LOCA, may result in the LPCI subsystems not being able to perform their intended safety function. The 30 day Completion Time is based on a reliability study cited in Reference 11 that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowable repair times (i.e., Completion Times).

ECCS - Operating 3.5.1 Monticello B 3.5.1-7 Revision No. 34 BASES ACTIONS (continued)

B.1 If a LPCI subsystem is inoperable for reasons other than Condition A, or a CS subsystem is inoperable, the inoperable low pressure injection/spray subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

C.1 If one LPCI pump in each subsystem is inoperable, one inoperable LPCI pump must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE ECCS subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

D.1 If two LPCI subsystems are inoperable for reasons other than Condition C or G, one inoperable subsystem must be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this condition, the remaining OPERABLE CS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining CS subsystems, concurrent with a LOCA, may result in ECCS not being able to perform its intended safety function. The 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Completion Time is based on a reliability study cited in Reference 11 that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service; and on previous BWR licensing precedents, and was approved for Monticello by Amendment

ECCS - Operating 3.5.1 Monticello B 3.5.1-8 Revision No. 34 BASES ACTIONS (continued) 162 (Reference 14). The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowable repair times (i.e., Completion Times).

E.1, E.2 and E.3 If any one low pressure CS subsystem is inoperable in addition to either one LPCI subsystem OR one or two LPCI pump(s), adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS subsystems. This condition results in a complement of remaining OPERABLE low pressure ECCS (i.e., one CS and either two or three LPCI pumps) whose makeup capacity is bounded by the minimum makeup capacity evaluated in the accident analysis, which assumes the limiting single component failure (Reference 10). However, overall ECCS reliability is reduced, because a single active component failure in the remaining low pressure ECCS, concurrent with a design basis LOCA, could result in the minimum required ECCS equipment not being available. Since both a CS subsystem is inoperable and a reduction in the makeup capability of the LPCI System has occurred, a more restrictive Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is required to restore either a CS subsystem or, either a LPCI subsystem OR the LPCI pump(s) to OPERABLE status. The Completion Time was developed using engineering judgment based on a reliability study cited in Reference 11, previous BWR licensing precedents, and approved for Monticello by Amendment 162 (Reference 14). This Completion Time has been found to be acceptable through operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-9 Revision No. 34 BASES ACTIONS (continued)

F.1 and F.2 If any Required Action and associated Completion Time of Condition A, B, C, D, or E is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and to MODE 4 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

G.1 If two LPCI subsystems are inoperable due to open RHR intertie return line isolation valve(s), the RHR intertie line must be isolated within 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />. The line can be isolated by closing both RHR intertie return line isolation valves or by closing one RHR intertie return line isolation valve and the RHR intertie suction line isolation valve. The 18 hour2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> Completion Time is reasonable, considered the low probability of a DBA occurring during this period.

H.1 If the Required Action and associated Completion Time of Condition G is not met, the plant must be brought to a MODE in which the RHR intertie return line isolation valves are not required to be closed. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

I.1 and I.2 If the HPCI System is inoperable and the RCIC System is verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY is therefore required immediately when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine

ECCS - Operating 3.5.1 Monticello B 3.5.1-10 Revision No. 34 BASES ACTIONS (continued) if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be immediately verified, however, Condition M must be entered. In the event of component failures concurrent with a design basis LOCA, there is a potential, depending on the specific failures, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

J.1 and J.2 If any one low pressure ECCS injection/spray subsystem, or one LPCI pump in both LPCI subsystems, is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem(s) or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this condition, adequate core cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since both a high pressure system (HPCI) and a low pressure subsystem(s) are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem(s) to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

K.1 The LCO requires three ADS valves to be OPERABLE in order to provide the ADS function. Reference 12 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only two ADS valves will provide the required depressurization. However, overall reliability of the ADS is reduced, because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-11 Revision No. 34 BASES ACTIONS (continued)

L.1 and L.2 If any Required Action and associated Completion Time of Condition I, J, or K is not met, or if one ADS valve is inoperable and Condition A, B, C, D, or G are entered, or if two or more ADS valves are inoperable, or if the HPCI System is inoperable and Condition D, E, or G are entered, then the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and reactor steam dome pressure reduced to 150 psig within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

M.1 If two or more low pressure ECCS injection/spray systems are inoperable for reasons other than Conditions C, D, E, or G, the plant is in a degraded condition not specifically justified for continued operation, and may be in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

For some cases, per the single failure assumptions of the accident analysis the plant may not be in an unanalyzed condition (Ref. 10) but the allowable duration for operation in the condition has not been justified, therefore LCO 3.0.3 must be entered immediately.

ECCS - Operating 3.5.1 Monticello B 3.5.1-12 Revision No. 34 BASES SURVEILLANCE SR 3.5.1.1 REQUIREMENTS The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the CS System and LPCI subsystems full of water ensures that the ECCS will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent a water hammer following an ECCS initiation signal. One acceptable method of ensuring that the lines are full is to vent at the high points. While the potential for developing voids in the HPCI System exists, the effects of a void have been analyzed and shown to be acceptable. The 31 day Frequency is based on the gradual nature of void buildup in the ECCS piping, the procedural controls governing system operation, and operating experience.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the HPCI System, this SR also includes the steam flow path for the turbine and the flow controller position.

The 31 day Frequency of this SR was derived from the Inservice Testing Program requirements for performing valve testing at least once every 92 days. The Frequency of 31 days is further justified because the valves are operated under procedural control and because improper valve position would only affect a single subsystem. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.1.3 Verification every 31 days that each ADS pneumatic pressure is within the analysis limits (S/RV Accumulator Bank header pressure 88.3 psig and Alternate Nitrogen System supply (ALT N2 TRAIN A (or B) SUPPLY) pressure 410 psig (Ref. 13)) ensures adequate pressure for reliable ADS operation. The supply associated with each ADS valve provides pneumatic pressure for valve actuation. The design pneumatic supply pressure requirements for the S/RV accumulator bank and Alternate

ECCS - Operating 3.5.1 Monticello B 3.5.1-13 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

Nitrogen System trains (replaceable gas cylinders) are such that, following a failure of the pneumatic supply to them, at least five valve actuations can occur over a ten hour period (Ref. 10). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. The 31 day Frequency takes into consideration administrative controls over operation of the system and alarms for low pressure.

Each Alternate Nitrogen System is designed for the three upstream nitrogen bottles to maintain OPERABILITY while the fourth, downstream, bottle is being replaced with a fully charged bottle. During bottle changeout the capacity of the system is temporarily reduced. This is acceptable based on the remaining capacity (only one actuation is necessary to depressurize), the low rate of usage, the fact that procedures have been initiated for replenishment, and the low probability of an event during this brief period.

SR 3.5.1.4 Verification every 31 days that the RHR System intertie return line isolation valves are closed ensures that each LPCI subsystem will provide the required flow rate to the reactor pressure vessel. The 31 day Frequency has been found acceptable, considering that these valves are under strict administrative controls that will ensure the valves continue to remain closed.

The SR is modified by a Note stating that the SR is only required to be met in MODE 1. During MODE 1 operations with the RHR System intertie line isolation valves open, some of the LPCI flow may be diverted to the broken recirculation loop during a LOCA, potentially resulting in early transition boiling. In other MODES, the intertie line may be opened because the impact on the LOCA analyses is negligible.

SR 3.5.1.5 Verification of correct breaker alignment to the LPCI swing bus demonstrates that the normal AC electrical power source is powering the swing bus and the backup AC electrical power source is available to ensure proper operation of the LPCI injection valves and the recirculation pump discharge valves. If either the normal source is not powering the LPCI swing bus or the backup source is not available to the LPCI swing bus, one of the LPCI subsystems must be considered inoperable. The 31 day Frequency has been found acceptable based on engineering judgment and operating experience.

ECCS - Operating 3.5.1 Monticello B 3.5.1-14 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.1.6 Cycling the recirculation pump discharge valves through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will close when required. Upon initiation of an automatic LPCI subsystem injection signal, these valves are required to be closed to ensure full LPCI subsystem flow injection in the reactor via the recirculation jet pumps. De-energizing the valve in the closed position will also ensure the proper flow path for the LPCI subsystem. Acceptable methods of de-energizing the valve include de-energizing breaker control power, racking out the breaker or removing the breaker.

The Frequency of this SR is in accordance with the Inservice Testing Program. If any recirculation pump discharge valve is inoperable and in the open position, both LPCI subsystems must be declared inoperable.

SR 3.5.1.7, SR 3.5.1.8, and SR 3.5.1.9 The performance requirements of the low pressure ECCS pumps are determined through application of the 10 CFR 50, Appendix K criteria (Ref. 7). This periodic Surveillance is performed (in accordance with the ASME Operation and Maintenance (OM) Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The low pressure ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of Reference 9. The pump flow rates are verified against a system head equivalent to the reactor to containment pressure expected during a LOCA. In addition, for LPCI the system head for the tested pump must include a head correction that corresponds to two LPCI pumps delivering 7,740 gpm. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during a LOCA. These values are established analytically.

The flow tests for the HPCI System are performed at two different pressure ranges such that system capability to provide rated flow against a system head corresponding to reactor pressure is tested at both the higher and lower operating ranges of the system. The required system head should overcome the RPV pressure and associated discharge line losses. Adequate reactor steam pressure must be available to perform the tests. Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the HPCI System diverts steam flow. Therefore, sufficient time is allowed after adequate pressure and flow are achieved to perform

ECCS - Operating 3.5.1 Monticello B 3.5.1-15 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) these tests. Reactor steam pressure must be 950 psig to perform SR 3.5.1.8 and 150 psig to perform SR 3.5.1.9. Adequate steam flow is represented by at least one turbine bypass valve 80% open. Reactor startup is allowed prior to performing the low pressure Surveillance test because the reactor pressure is low and the time allowed to satisfactorily perform the Surveillance test is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that HPCI is inoperable.

Therefore, SR 3.5.1.8 and SR 3.5.1.9 are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for performing the flow test after the required pressure and flow are reached is sufficient to achieve stable conditions for testing and provides reasonable time to complete the SRs. The Frequency for SR 3.5.1.7 and SR 3.5.1.8 is in accordance with the Inservice Testing Program requirements. The 24 month Frequency for SR 3.5.1.9 is based on the need to perform the Surveillance under the conditions that apply during a startup from a plant outage. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.10 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCI, CS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions. This SR also ensures that the HPCI System will automatically restart on a Reactor Vessel Water Level - Low Low signal received subsequent to a Reactor Vessel Water Level - High trip and that the suction is automatically transferred from the CSTs to the suppression pool on a Suppression Pool Water Level - High or Condensate Storage Tank Level - Low signal. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide complete testing of the assumed safety function.

ECCS - Operating 3.5.1 Monticello B 3.5.1-16 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued)

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

SR 3.5.1.11 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.12 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 24 month Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. Operating experience has shown that these components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation since the valves are individually tested in accordance with SR 3.5.1.12.

SR 3.5.1.12 This Surveillance verifies that each ADS valve is capable of being opened, which can be determined by either of two means, i.e., Method 1 or Method 2. Applying Method 1, approved in Reference 15, valve OPERABILITY and setpoints for overpressure protection are verified in

ECCS - Operating 3.5.1 Monticello B 3.5.1-17 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) accordance with the ASME OM Code. Applying Method 2, a manual actuation of the ADS valve is performed to verify the valve is functioning properly.

Method 1 Valve OPERABILITY and setpoints for overpressure protection are verified in accordance with the requirements of the ASME OM Code (Ref. 16). Proper ADS valve function is verified through performance of inspections and overlapping tests on component assemblies, demonstrating the valve is capable of being opened. Testing is performed to demonstrate that each:

ADS S/RV main stage opens and passes steam when the associated pilot stage actuates; and ADS S/RV second stage actuates to open the associated main stage when the pneumatic actuator is pressurized; ADS S/RV solenoid valve ports pneumatic pressure to the associated S/RV actuator when energized; ADS S/RV actuator stem moves when dry lift tested in-situ.

(With exception of main and pilot stages this test demonstrates mechanical operation without steam.)

The solenoid valves and S/RV actuators are functionally tested once per cycle as part of the Inservice Testing Program. The S/RV assembly is bench tested as part of the certification process, at intervals determined in accordance with the Inservice Testing Program. Maintenance procedures ensure that the S/RV is correctly installed in the plant, and that the S/RV and associated piping remain clear of foreign material that might obstruct valve operation or full steam flow.

This methodology provides adequate assurance that the ADS valves will operate when actuated, while minimizing the challenges to the valves and the likelihood of leakage or spurious operation.

Method 2 A manual actuation of each ADS valve is performed to verify that the valve and solenoid are functioning properly and that no blockage exists in the S/RV discharge lines. This is demonstrated by the response of the turbine bypass valves, by a change in the measured flow, or by any other method suitable to verify steam flow. Adequate steam flow must be

ECCS - Operating 3.5.1 Monticello B 3.5.1-18 Revision No. 34 BASES SURVEILLANCE REQUIREMENTS (continued) passing through the turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening.

Sufficient time is therefore allowed after the required flow is achieved to perform this SR. Adequate steam flow is represented by at least one turbine bypass valve 80% open. This SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after reactor steam flow is adequate to perform the test. Reactor startup is allowed prior to performing this SR because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> allowed for manual actuation after the required flow is reached is sufficient to achieve stable conditions and provides adequate time to complete the Surveillance.

SR 3.5.1.11 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, ECCS Instrumentation, overlap this Surveillance to provide complete testing of the assumed safety function.

The Frequency of In accordance with the Inservice Testing Program is based on ASME OM Code requirements. Industry operating experience has shown that these components usually pass the SR when performed at the Code required Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.13 The LPCI System injection valves, recirculation pump discharge valves, recirculation pump suction valves, and the RHR discharge intertie line isolation valves are powered from the LPCI swing bus, which must be energized after a single failure, including loss of power from the normal source to the swing bus. Therefore, the automatic transfer capability from the normal power source to the backup power source must be verified to ensure the automatic capability to detect loss of normal power and initiate an automatic transfer to the swing bus backup power source. Verification of this capability every 24 months ensures that AC electrical power is available for proper operation of the associated LPCI injection valves, recirculation pump discharge valves, recirculation pump suction valves, and the RHR discharge intertie line isolation valves. The swing bus automatic transfer scheme must be OPERABLE for both LPCI subsystems to be OPERABLE. The Frequency of 24 months is based on the need to perform the Surveillance under the conditions that apply during a startup from a plant outage. Operating experience has shown that the components usually pass the SR when performed at the 24 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

ECCS - Operating 3.5.1 Monticello B 3.5.1-19 Revision No. 34 BASES REFERENCES

1.

USAR, Section 6.2.2.

2.

USAR, Section 6.2.3.

3.

USAR, Section 6.2.4.

4.

USAR, Section 6.2.5.

5.

USAR, Section 14.7.2.

6.

USAR, Section 14.7.3.

7.

10 CFR 50, Appendix K.

8.

USAR, Section 6.2.1.1.

9.

10 CFR 50.46.

10.

USAR, Section 14.7.2.3.2.

11.

Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCOs for ECCS Components,"

December 1, 1975.

12.

USAR, Section 14.7.2.3.1.5.

13.

Amendment No. 155, Issuance of Amendment Re: Request to Revise Technical Specification Surveillance Requirement 3.5.1.3 to Correct the Alternate Nitrogen System Pressure, dated February 21, 2008. (ADAMS Accession Nos. ML080380638 and ML080590541)

14.

Amendment No. 162, Issuance of Amendment Regarding Completion Time to Restore a Low-Pressure Emergency Core Cooling Subsystem to Operable Status, dated July 10, 2009.

(ADAMS Accession No. ML091480782)

15.

Amendment No. 168, Issuance of Amendment Re: Testing of Main Steam Safety/Relief Valves, dated July 27, 2012. (ADAMS Accession No. ML12185A216)

16.

ASME Operation and Maintenance (OM) Code.

17.

Amendment No. 176, Monticello Nuclear Generating Plant -

Issuance of Amendment No. 176 to Renewed Facility Operating License Regarding Extended Power Uprate, (ADAMS Accession No. ML13316C459)

ECCS - Operating 3.5.1 Monticello B 3.5.1 Last Revision No. 34 BASES REFERENCES (continued)

18.

Amendment No. 184, Monticello Nuclear Generating Plant -

Issuance of Amendment to Revise Technical Specification 3.5.1, ECCS [Emergency Core Cooling System] - Operating, dated November 3, 2014. (ADAMS Accession No. ML14246A449)

[Condition F previously allowed two Core Spray subsystems to be inoperable for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.]