Text

License Amendment Request: Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times-RITSTF Initiative 4b
	ML20090F820
Person / Time
Site:	Monticello
Issue date:	03/30/2020
From:	Conboy T; Northern States Power Company, Minnesota, Xcel Energy
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	L-MT-20-003
	Download: ML20090F820 (246)
	v • d • e

2807 West County Road 75 Monticello, MN 55362 March 30, 2020 L-MT-20-003 10 CFR 50.90 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 Monticello Nuclear Generating Plant Docket No. 50-263 Renewed Facility Operating License No. DPR-22 License Amendment Request: Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times

- RITSTF Initiative 4b

References:

1) Letter from the Technical Specification Task Force (TSTF) to the NRC, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, dated July 2, 2018 (ADAMS Accession No. ML18183A493)

2) NRC Safety Evaluation, Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated November 21, 2018 (ADAMS Accession No. ML18253A085)

Pursuant to 10 CFR 50.90, Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), is submitting a request for an amendment to the Technical Specifications (TS) for the Monticello Nuclear Generating Plant (MNGP).

The proposed amendment would modify TS requirements to permit the use of Risk-Informed Completion Times in accordance with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b (Reference 1). A model safety evaluation was provided by the NRC to the TSTF on November 21, 2018 (Reference 2).

Attachment 1 provides a description and assessment of the proposed change, the requested confirmation of applicability, and plant-specific verifications.

Attachment 2 provides the existing TS pages marked up to show the proposed changes.

Document Control Desk Page 2

Attachment 3 provides existing TS Bases pages marked up to show the proposed changes and is provided for information only.

Attachment 4 provides a cross-reference between the TS included in TSTF-505, Revision 2, and the MNGP plant-specific TS.

Attachment 5 provides a list of implementation items that must be completed prior to implementing the Risk-Informed Completion Time Program at MNGP.

NSPM requests approval of the proposed license amendment 12 months following acceptance, with an implementation period of 180 days.

In accordance with 10 CFR 50.91(a)(1), "Notice for Public Comment", the analysis about the issue of no significant hazards consideration using the standards in 10 CFR 50.92 is being provided to the Commission .

In accordance with 10 CFR 50.91(b)(1), "Notice for Public Comment; State Consultation", a copy of this application, with attachments, is being provided to the designated Minnesota Official.

Please contact Mr. Peter Gohdes at (612) 330-6503 or Peter.Gohdes@xenuclear.com if there are any questions or if additional information is needed.

Summary of Commitments This letter makes no new commitments and no revisions to existing commitments.

I declare under penalty of perjury, that the foregoing is true and correct.

Executed on March.Jo , 2020.

Thomas A. Conboy Site Vice President, MontiC"""""uclear Generating Plant Northern States Power Company - Minnesota Enclosures (12) cc: Administrator, Region Ill, USNRC Project Manager, Monticello, USNRC Resident Inspector, Monticello, USNRC State of Minnesota

ATTACHMENT 1 MONTICELLO NUCLEAR GENERATING PLANT EVALUATION OF PROPOSED CHANGE License Amendment Request Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b

1.0 DESCRIPTION

2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation 2.2 Facility Description 2.3 Verifications and Regulatory Commitments 2.4 Optional Variations

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Determination 3.2 Conclusions

4.0 ENVIRONMENTAL CONSIDERATION

5.0 REFERENCES

L-MT-20-003 NSPM License Amendment Request Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b

1.0 DESCRIPTION

The proposed amendment would modify the Technical Specification (TS) requirements related to Completion Times (CTs) for Required Actions to provide the option to calculate a longer, risk-informed CT (RICT). A new program, the Risk-Informed Completion Time Program, is added to TS Section 5, Administrative Controls.

The methodology for using the RICT Program is described in Nuclear Energy Institute (NEI)

Topical Report NEI 0609A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, which was approved by the NRC on May 17, 2007. Adherence to NEI 06-09-A is required by the RICT Program.

The proposed amendment is consistent with TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b. However, only those Required Actions described in Attachment 4 and Enclosure 1, as reflected in the proposed TS mark-ups provided in Attachment 2, are proposed to be changed. This is because some of the modified Required Actions in TSTF-505 are not applicable to the Monticello Nuclear Generating Plant (MNGP), and there are some plant-specific Required Actions not included in TSTF-505 that are included in this proposed amendment.

2.0 ASSESSMENT 2.1 Applicability of Published Safety Evaluation Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), has reviewed TSTF-505, Revision 2, and the model safety evaluation dated November 21, 2018 (Reference 1). This review included the supporting information provided to support TSTF-505 and the safety evaluation for NEI 06-09-A. As described in the subsequent paragraphs, NSPM has concluded that the technical basis is applicable to the MNGP and supports incorporation of this amendment in the MNGP TS.

2.2 Facility Description NSPM owns and operates the MNGP, which is a single unit plant located on the south bank of the Mississippi River within the city limits of Monticello, Minnesota. MNGP is a single cycle, forced circulation, low power density boiling water reactor, designed and supplied by the General Electric Corporation. The MNGP application for a Construction Permit and Operating License was submitted to the Atomic Energy Commission (AEC) on August 1, 1966.

Amendment No. 1 to Provisional Operating License No. DPR-22 was issued on January 13, Page 2 of 12

L-MT-20-003 NSPM 1971, granting full power operation. MNGP began full power commercial operation on June 30, 1971. The Full Term Operating License was issued on January 9, 1981. The MNGP Renewed Facility Operating License expires at midnight September 8, 2030.

The MNGP was designed and constructed to comply with NSPMs understanding of the intent of the AEC 70 General Design Criteria (GDC) for Nuclear Power Plant Construction Permits, as published on July 11, 1967. MNGP was not licensed to NUREG-0800, Standard Review Plan.

2.3 Verifications and Regulatory Commitments In accordance with Section 4.0, Limitations and Conditions, of the safety evaluation for NEI 0609-A, the following is provided:

1. Enclosure 1 identifies each of the TS Required Actions to which the RICT Program will apply, with a comparison of the TS functions to the functions modeled in the probabilistic risk assessment (PRA) of the structures, systems and components (SSCs) subject to those actions.

2. Enclosure 2 provides a discussion of the results of peer reviews and self-assessments conducted for the plant-specific PRA models which support the RICT Program, as discussed in Regulatory Guide (RG) 1.200, Section 4.2.

3. Enclosure 3 is not applicable since each PRA model used for the RICT Program is addressed using a standard endorsed by the Nuclear Regulatory Commission.

4. Enclosure 4 provides appropriate justification for excluding sources of risk not addressed by the PRA models.

5. Enclosure 5 provides the plant-specific baseline core damage frequency (CDF) and large early release frequency (LERF) to confirm that the potential risk increases allowed under the RICT Program are acceptable.

6. Enclosure 6 is not applicable since the RICT Program is not being applied to shutdown modes.

7. Enclosure 7 provides a discussion of the licensees programs and procedures that assure the PRA models that support the RICT Program are maintained consistent with the as-built, as-operated plant.

8. Enclosure 8 provides a description of how the baseline PRA model, which calculates average annual risk, is evaluated and modified to assess real-time configuration risk, and describes the scope of, and quality controls applied to the real-time model.

Page 3 of 12

L-MT-20-003 NSPM

9. Enclosure 9 provides a discussion of how the key assumptions and sources of uncertainty in the PRA models were identified, and how their impact on the RICT Program was assessed and dispositioned.

10. Enclosure 10 provides a description of the implementing programs and procedures regarding the plant staff responsibilities for the RICT Program implementation, including risk management action (RMA) implementation.

11. Enclosure 11 provides a description of the implementation and monitoring program as described in NEI 06-09-A, Section 2.3.2, Step 7.

12. Enclosure 12 provides a description of the process to identify and provide RMAs.

2.4 Optional Variations NSPM is proposing the following variations from the TS changes described in TSTF-505, Revision 2, or the applicable parts of the NRC staffs model safety evaluation dated November 21, 2018. These options were recognized as acceptable variations in TSTF-505 and the NRC model safety evaluation.

Note that, in a few instances, the MNGP TS utilize different numbering and titles than the NUREG-1433, Standard Technical Specifications, General Electric Plants, BWR/4, Revision 3.1 (Reference 2), on which TSTF-505 was based. These differences are administrative and do not affect the applicability of TSTF-505 to the MNGP TS. Only TS changes consistent with the MNGP design and TS are included. Attachment 4 is a cross-reference that provides a comparison between the Required Actions included in TSTF505 and the MNGP Required Actions included in this license amendment request. The attachment includes a summary description of the referenced Required Actions, which is provided for information purposes only and is not intended to be a verbatim description of the Required Actions. The cross-reference identifies the following:

1. MNGP Actions that have identical numbers to the corresponding NUREG-1433 Required Actions are not variations from TSTF-505, except for administrative variations (if any) such as formatting. These variations are administrative with no impact on the NRC model safety evaluation dated November 21, 2018.

2. MNGP Actions that have different numbering than the NUREG-1433 Required Actions are an administrative variation from TSTF-505 with no impact on the NRC model safety evaluation dated November 21, 2018.

3. For NUREG-1433 Required Actions that are not contained in the MNGP TS, the corresponding TSTF-505 mark-ups for the Required Actions are not applicable to MNGP. This is an administrative variation from TSTF-505 with no impact on the NRC model safety evaluation dated November 21, 2018.

Page 4 of 12

L-MT-20-003 NSPM

4. While the TSTF-505 mark-ups were performed on Revision 3.1 of NUREG-1433, the MNGP TS are based upon Revision 3 of NUREG-1433 (Reference 3). The MNGP TS conversion to the improved TS also retained elements of the original TS that were consistent with the MNGP licensing basis and differ from NUREG-1433 Revision 3.

These variations are administrative with no impact on the NRC model safety evaluation dated November 21, 2018.

5. As the proposed MNGP RICT Program is applicable in Modes 1 and 2, NSPM will not adopt changes in TSTF505 for Required Actions that are only applicable in Mode 3 and below.

6. The model application provided in TSTF-505, Revision 2, includes an attachment for revised (clean) TS pages reflecting the proposed changes. NSPM is not including such an attachment due to the number of TS pages included in this submittal that have the potential to be affected by other unrelated license amendment requests and the straightforward nature of the proposed changes. Providing only mark-ups of the proposed TS changes satisfies the requirements of 10 CFR 50.90, Application for amendment of license, construction permit, or early site permit, in that the mark-ups fully describe the changes desired. This is an administrative deviation from TSTF-505 with no impact on the NRC model safety evaluation dated November 21, 2018.

7. There are several plant-specific Limiting Conditions for Operation (LCOs) and associated Actions for which NSPM is proposing to apply the RICT Program that are variations from TSTF-505, Revision 2, as identified in Attachment 4 with additional justification provided below:

TS 3.3.7.2 - Mechanical Vacuum Pump Isolation Instrumentation LCO: Four channels of the Main Steam Line Tunnel Radiation - High Function for the mechanical vacuum pump isolation shall be OPERABLE.

Condition A: One or more channels inoperable.

MNGP TS 3.3.7.2 Condition A is a plant-specific Condition not in the NUREG-1433 STS or TSTF-505, Revision 2. Condition A applies to the Main Steam Line Tunnel Radiation - High Function for the Mechanical Vacuum Pump (MVP) isolation.

Required Actions A.1 and A.2 allow 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to either restore the inoperable channel to OPERABLE status, or place the channel in trip (unless the inoperability is the result of an inoperable MVP breaker or isolation valve). The MVP isolation instrumentation initiates a trip of the mechanical vacuum pump and isolation of the isolation valves following events in which main steam radiation monitors exceed a predetermined value. Tripping and isolating the mechanical vacuum pump limits control room and offsite doses in the event of a control rod drop accident (CRDA).The isolation logic for the Main Steam Line Tunnel Radiation - High Function consists of two independent trip systems, with two channels in each trip system. The outputs from two channels provide input into one trip system and the Page 5 of 12

L-MT-20-003 NSPM other two channels provide input into the other trip system. One channel must trip to trip a trip system and both trip systems must trip to initiate the MVP isolation function (i.e., one-out-of-two taken twice logic arrangement). However, because more than one channel inoperable per trip system results in a loss of function, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained.

In low power scenarios when the main condenser is used as a heat sink, the MVP helps maintain the condenser heat sink function. As indicated in Table E1-1 of Enclosure 1 of the MNGP TSTF-505 license amendment request (LAR), the Main Steam Line Tunnel Radiation - High trip function is not explicitly modeled in the MNGP PRA. As described in Attachment 5 to this LAR, the PRA model will be updated to include this SSC prior to exercising the RICT program for this TS. Steam jet air ejectors not available was used as a conservative surrogate representation of the risk for the Enclosure 1, Table E1-2 sample RICT calculations. This surrogate is conservative as failure of steam jet air ejectors causes loss of condenser vacuum.

Therefore, TS 3.3.7.2 Condition A meets the requirements for inclusion in the RICT Program.

TS 3.5.1 - [Emergency Core Cooling System (ECCS)] - Operating LCO: Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of three safety/relief valves shall be OPERABLE.

Condition B: One LPCI subsystem inoperable for reasons other than Condition A, or, one Core Spray subsystem inoperable.

Condition C: One LPCI pump in both LPCI subsystems inoperable.

Condition D: Two LPCI subsystems inoperable for reasons other than Condition C or G.

Condition E: One Core Spray subsystem inoperable and one LPCI subsystem inoperable; or one Core Spray subsystem inoperable and one or two LPCI pump(s) inoperable.

MNGP TS 3.5.1 Conditions B, C, D, and E are plant-specific Conditions not in the NUREG-1433 STS, and therefore not in TSTF-505, Revision 2.

The MNGP ECCS uses two independent methods (flooding and spraying) to cool the core during a loss of coolant accident (LOCA). The ECCS network consists of the High Pressure Coolant Injection (HPCI) System, two Core Spray (CS) subsystems, the two low pressure coolant injection (LPCI) subsystems (which is a mode of the Residual Heat Removal (RHR) System), and the Automatic Depressurization System (ADS).

Condition B applies to either one LPCI subsystem inoperable, for reasons other than one LPCI pump inoperable, or one CS subsystem inoperable. Required Action B.1 Page 6 of 12

L-MT-20-003 NSPM allows 7 days to restore the inoperable low pressure ECCS injection/spray subsystem to OPERABLE status. In this Condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA.

Condition C applies to one LPCI pump inoperable in each of the two LPCI subsystems. Required Action C.1 allows for 7 days to restore one of the inoperable pumps to OPERABLE. Each of the LPCI subsystems contains two pumps. In this Condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA.

Condition D applies to both LPCI subsystems inoperable for reasons other than Condition C or Condition G (due to open RHR intertie return isolation valve(s)).

Required Action D.1 allows for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore one of the inoperable LPCI subsystems to OPERABLE. In this Condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA.

Condition E applies to one CS subsystem inoperable and one LPCI subsystem inoperable, or, one CS subsystem inoperable and one or two LPCI pump(s) inoperable. Required Actions E.1, E.2, and E.3 each allow 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to either restore the CS subsystem, the LPCI subsystem, or the LPCI pumps to OPERABLE status, respectively. In each of these configurations, adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS subsystems (i.e.,

one CS and either two or three LPCI pumps) whose makeup capacity is bounded by the minimum makeup capacity evaluated in the accident analysis, which assumes the limiting single component failure.

As indicated in Table E1-1 of Enclosure 1 of the MNGP TSTF-505 LAR, the CS and LPCI subsystems are explicitly modeled in the MNGP PRA. The PRA Success Criteria are that either one CS subsystem or one LPCI subsystem injecting into the reactor vessel is sufficient to prevent core damage.

Therefore, TS 3.5.1 Conditions B, C, D, and E meet the requirements for inclusion in the RICT Program.

TS 3.6.1.8 - Residual Heat Removal (RHR) Drywell Spray LCO: Two RHR drywell spray subsystems shall be OPERABLE.

Condition A: One RHR drywell spray subsystem inoperable.

MNGP TS 3.6.1.8 Condition A is a plant-specific Condition not in the NUREG-1433 STS, and therefore not in TSTF-505, Revision 2.

Condition A applies to one RHR drywell spray subsystem inoperable. Required Action A.1 requires the inoperable subsystem to be restored to OPERABLE status within 7 days.

Page 7 of 12

L-MT-20-003 NSPM The MNGP safety analyses takes credit for the operation of the drywell spray function, not the suppression pool spray function. This mode of operation is known as the Residual Heat Removal Drywell Spray mode. As stated in the MNGP Updated Safety Analysis Report (USAR), Section 5.2.3.9, Drywell Temperature Analysis for Drywell Wall Temperature, in the event of a DBA, a minimum of one RHR drywell spray subsystem is required to mitigate the consequences of steam line breaks in the drywell and maintain the primary containment peak temperature below the design limits.

Therefore, TS 3.6.1.8 Condition A meets the requirements for inclusion in the RICT Program.

8. The following administrative changes are being made to the MNGP TS since the TS pages are undergoing change and review for the TSTF-505 application. The changes are as described below:

TS 3.3.2.2, TS page 3.3.2.2 NOTE text in Required Action C.1 is not aligned correctly. The change will fix the alignment consistent with MNGP TS formatting.

Although not part of TSTF-505, this change is administrative in nature as it involves a minor correction to the page to align with MNGP TS formatting.

TS 3.3.5.1, TS page 3.3.5.1 CTIONS is corrected to ACTIONS. Although not part of TSTF-505, this change is administrative in nature as it involves a minor correction to the page to align with MNGP TS formatting.

TS 3.3.7.2, TS page 3.3.7.2 the note "Corrected by letter dated March 9, 2009 is no longer needed and is removed from the page. Also, the NOTE text in Required Action A.2 is not aligned correctly. Although not part of TSTF-505, these changes are administrative in nature as they involve removal of a letter that is no longer applicable and fix the alignment consistent with MNGP TS formatting.

TS 3.6.1.3, TS page 3.6.1.3 text in Required Action E.1 is not aligned correctly.

The change will fix the alignment consistent with MNGP TS formatting. Although not part of TSTF-505, this change is administrative in nature as it involves a minor correction to the page to align with MNGP TS formatting.

TS 3.6.2.3, TS page 3.6.2.3 the ACTIONS and SURVEILLANCE REQUIREMENTS TS sections are not aligned correctly with the left margin. The change will fix the alignment consistent with MNGP TS formatting. Although not part of TSTF-505, this change is administrative in nature as it involves a minor correction to the page to align with MNGP TS formatting.

Page 8 of 12

L-MT-20-003 NSPM

9. One editorial change is also being made to a page in the MNGP TS not undergoing changes for the TSTF-505 application. The change is described below:

TS 3.3.5.1, TS page 3.3.5.1-10, Table 3.3.5.1 Function 2.k is corrected from Recirculation Steam Dome Pressure - Time Delay Relay (Break Detection) to Reactor Steam Dome Pressure - Time Delay Relay (Break Detection). The error was introduced as an unmarked change during issuance of the clean TS pages for Amendment 200 for adoption of TSTF-425, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b (Reference 4). Although not part of TSTF505, this change as proposed is administrative in nature as it involves a minor editorial correction to the page.

NSPM has reviewed these changes and determined that they do not affect the applicability of TSTF505, Revision 2, to the MNGP TS.

NSPM has determined that the application of a RICT for these MNGP plant-specific LCOs is consistent with TSTF-505, Revision 2, and with the NRC's model safety evaluation dated November 21, 2018. Application of a RICT for these plant-specific LCOs will be controlled under the RICT Program. The RICT Program provides the necessary administrative controls to permit extension of CTs and thereby delay reactor shutdown or remedial actions, if risk is assessed and managed within specified limits and programmatic requirements. The specified safety function or performance levels of TS required SSCs are unchanged, and the remedial actions, including the requirement to shut down the reactor, are also unchanged; only the CTs are extended by the RICT Program.

Application of a RICT will be evaluated using the methodology and probabilistic risk guidelines contained in NEI 0609A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, which was approved by the NRC on May 17, 2007 (Reference 5). The NEI 0609A methodology includes a requirement to perform a quantitative assessment of the potential impact of the application of a RICT on risk, to reassess risk due to plant configuration changes, and to implement compensatory measures and RMAs to maintain the risk below acceptable regulatory risk thresholds. In addition, the NEI 06-09-A methodology satisfies the five key safety principles specified in Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Revision 0 (Reference 6), relative to the risk impact due to the application of a RICT.

Therefore, the proposed application of a RICT in the MNGP plant-specific Actions is consistent with TSTF-505, Revision 2, and with the NRC's model safety evaluation dated November 21, 2018.

Page 9 of 12

L-MT-20-003 NSPM

3.0 REGULATORY ANALYSIS

3.1 No Significant Hazards Consideration Determination Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), has evaluated the proposed change to the TS using the criteria in 10 CFR 50.92 and has determined that the proposed change does not involve a significant hazards consideration.

NSPM requests for the Monticello Nuclear Generating Plant adoption of an approved change to the standard technical specifications (STS) and plant-specific technical specifications (TS),

to modify the TS requirements related to Completion Times for Required Actions to provide the option to calculate a longer, risk-informed Completion Time. The allowance is described in a new program in Chapter 5, Administrative Controls, entitled the Risk-Informed Completion Time Program.

As required by 10 CFR 50.91(a), an analysis of the issue of no significant hazards consideration is presented below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The proposed change permits the extension of Completion Times provided the associated risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change does not involve a significant increase in the probability of an accident previously evaluated because the change involves no change to the plant or its modes of operation. The proposed change does not increase the consequences of an accident because the design-basis mitigation function of the affected systems is not changed and the consequences of an accident during the extended Completion Time are no different from those during the existing Completion Time.

Therefore, the proposed change does not involve a significant increase in the probability or consequences of an accident previously evaluated.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

The proposed change does not change the design, configuration, or method of operation of the plant. The proposed change does not involve a physical alteration of the plant (no new or different kind of equipment will be installed).

Page 10 of 12

L-MT-20-003 NSPM Therefore, the proposed change does not create the possibility of a new or different kind of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed change permits the extension of Completion Times provided risk is assessed and managed in accordance with the NRC approved Risk-Informed Completion Time Program. The proposed change implements a risk-informed configuration management program to assure that adequate margins of safety are maintained. Application of these new specifications and the configuration management program considers cumulative effects of multiple systems or components being out-of-service and does so more effectively than the current TS.

Therefore, the proposed change does not involve a significant reduction in a margin of safety.

Based on the above, NSPM concludes that the proposed change presents no significant hazards consideration under the standards set forth in 10 CFR 50.92(c), and, accordingly, a finding of no significant hazards consideration is justified.

3.2 Conclusions In conclusion, based on the considerations discussed above, (1) there is reasonable assurance that the health and safety of the public will not be endangered by operation in the proposed manner, (2) such activities will be conducted in compliance with the Commission's regulations, and (3) the issuance of the amendment will not be inimical to the common defense and security or to the health and safety of the public.

4.0 ENVIRONMENTAL CONSIDERATION

The proposed change would change a requirement with respect to installation or use of a facility component located within the restricted area, as defined in 10 CFR 20, or would change an inspection or surveillance requirement. However, the proposed change does not involve (i) a significant hazards consideration, (ii) a significant change in the types or significant increase in the amounts of any effluents that may be released offsite, or (iii) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed change meets the eligibility criterion for categorical exclusion set forth in 10 CFR 51.22(c)(9).

Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed change.

Page 11 of 12

L-MT-20-003 NSPM

5.0 REFERENCES

1. Letter from the NRC to the Technical Specifications Task Force (TSTF), Final Revised Model Safety Evaluation of Traveler TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, dated November 21, 2018 (ADAMS Accession No. ML18269A041)

2. NRC NUREG-1433, Volume 1, Standard Technical Specifications General Electric BWR/4 Plants, Revision 3.1, dated December 1, 2005

3. NRC NUREG-1433, Volume 1, Standard Technical Specifications General Electric BWR/4 Plants, Revision 3.0, dated June 2004 (ADAMS Accession No. ML041910194)

4. Letter from the NRC to NSPM, Monticello Nuclear Generating Plant - Issuance of Amendment Re: Adoption of TSTF-425, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b (EPID: L-2017-LLA-0434), dated January 28, 2019 (ADAMS Accession No. ML19007A090)

5. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

6. NRC Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Revision 0, dated August 1998 (ADAMS Accession No. ML003740176)

Page 12 of 12

ATTACHMENT 2 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b PROPOSED TECHNICAL SPECIFICATION CHANGES (MARK-UP)

(38 Pages Follow)

INSERT EXAMPLE 1.3-8 EXAMPLE 1.3-8 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Restore subsystem 7 days subsystem to OPERABLE inoperable. status. OR In accordance with the Risk Informed Completion Time Program B. Required B.1 Be in MODE 3. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Action and Associated AND Completion Time not met. B.2 Be in MODE 5. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months When a subsystem is declared inoperable, Condition A is entered. The 7 day Completion Time may be applied as discussed in Example 1.3-2.

However, the licensee may elect to apply the Risk Informed Completion Time Program which permits calculation of a Risk Informed Completion Time (RICT) that may be used to complete the Required Action beyond the 7 day Completion Time. The RICT cannot exceed 30 days. After the 7 day Completion Time has expired, the subsystem must be restored to OPERABLE status within the RICT or Condition B must also be entered.

The Risk Informed Completion Time Program requires recalculation of the RICT to reflect changing plant conditions. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

If the 7 day Completion Time clock of Condition A has expired and subsequent changes in plant condition result in exiting the applicability of the Risk Informed Completion Time Program without restoring the inoperable subsystem to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start.

If the RICT expires or is recalculated to be less than the elapsed time since the Condition was entered and the inoperable subsystem has not been restored to OPERABLE status, Condition B is also entered and the Completion Time clocks for Required Actions B.1 and B.2 start. If the inoperable subsystems are restored to OPERABLE status after Condition B is entered, Condition A is exited, and therefore, the Required Actions of Condition B may be terminated.

INSERT RICT 1 OR In accordance with the Risk Informed Completion Time Program INSERT RICT 2 OR

NOTE----------

Not applicable when a loss of function occurs.

In accordance with the Risk Informed Completion Time Program INSERT RICT 3 or in accordance with the Risk Informed Completion Time Program INSERT RICT NOTE

NOTE----------

Risk Informed Completion Time Program not applicable to loss of function.

INSERT RICT PROGRAM 5.5.16 Risk Informed Completion Time Program This program provides controls to calculate a Risk Informed Completion Time (RICT) and must be implemented in accordance with NEI 06-09-A, Revision 0, "Risk-Managed Technical Specifications (RMTS) Guidelines." The program shall include the following:

a. The RICT may not exceed 30 days;

b. A RICT may only be utilized in MODE 1, 2;

c. When a RICT is being used, any change to the plant configuration, as defined in NEI 06-09-A, Appendix A, must be considered for the effect on the RICT.

1. For planned changes, the revised RICT must be determined prior to implementation of the change in configuration.

2. For emergent conditions, the revised RICT must be determined within the time limits of the Required Action Completion Time (i.e., not the RICT) or 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the plant configuration change, whichever is less.

3. Revising the RICT is not required if the plant configuration change would lower plant risk and would result in a longer RICT.

d. For emergent conditions, if the extent of condition evaluation for inoperable structures, systems, or components (SSCs) is not complete prior to exceeding the Completion Time, the RICT shall account for the increased possibility of common cause failure (CCF) by either:

1. Numerically accounting for the increased possibility of CCF in the RICT calculation; or

2. Risk Management Actions (RMAs) not already credited in the RICT calculation shall be implemented that support redundant or diverse SSCs that perform the function(s) of the inoperable SSCs, and, if practicable, reduce the frequency of initiating events that challenge the function(s) performed by the inoperable SSCs.

e. The risk assessment approaches and methods shall be acceptable to the NRC. The plant PRA shall be based on the as-built, as-operated, and maintained plant; and reflect the operating experience at the plant, as specified in Regulatory Guide 1.200, Revision 2. Methods to assess the risk from extending the Completion Times must be PRA methods used to support this license amendment, or other methods approved by the NRC for generic use; and any change in the PRA methods to assess risk that are outside these approval boundaries require prior NRC approval.

Completion Times 1.3 1.3 Completion Times EXAMPLES (continued)

EXAMPLE 1.3-7 ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One A.1 Verify affected 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months subsystem subsystem isolated.

inoperable. AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND A.2 Restore subsystem 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to OPERABLE status.

B. Required B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Action and associated AND Completion Time not met. B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Required Action A.1 has two Completion Times. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time begins at the time the Condition is entered and each "Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter" interval begins upon performance of Required Action A.1.

If after Condition A is entered, Required Action A.1 is not met within either the initial 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or any subsequent 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval from the previous performance (plus the extension allowed by SR 3.0.2), Condition B is entered. The Completion Time clock for Condition A does not stop after Condition B is entered, but continues from the time Condition A was initially entered. If Required Action A.1 is met after Condition B is entered, Condition B is exited and operation may continue in accordance with Condition A, provided the Completion Time for Required Action A.2 INSERT has not expired.

EXAMPLE 1.3-8 Monticello 1.3-10 Amendment No. 146 TBD

SLC System 3.1.7 3.1 REACTIVITY CONTROL SYSTEMS 3.1.7 Standby Liquid Control (SLC) System LCO 3.1.7 Two SLC subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. Concentration of sodium A.1 Restore concentration of 7 days pentaborate in solution sodium pentaborate in not within limits of solution to within limits.

Figure 3.1.7-1 and Table 3.1.7-1 Equation 2, but available volume of sodium pentaborate solution is within limits of Table 3.1.7-1 Equation 1.

B. One SLC subsystem B.1 Restore SLC subsystem to 7 days inoperable for reasons OPERABLE status. INSERT other than Condition A. RICT 1 C. Two SLC subsystems C.1 Restore one SLC 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months inoperable for reasons subsystem to OPERABLE other than Condition A. status.

D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Monticello 3.1.7-1 Amendment No. 146 148 TBD

RPS Instrumentation 3.3.1.1 3.3 INSTRUMENTATION 3.3.1.1 Reactor Protection System (RPS) Instrumentation LCO 3.3.1.1 The RPS instrumentation for each Function in Table 3.3.1.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.1.1-1.

ACTIONS

NOTE-----------------------------------------------------------

1. Separate Condition entry is allowed for each channel.

2. When the Function 2.b and 2.c channels are not within the limit of SR 3.3.1.1.2 due to APRM indication not within limits, entry into associated Conditions and Required Actions may be delayed for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months if the APRM is indicating a lower power value than the calculated power, and for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months if the APRM is indicating a higher power value than the calculated power.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months channels inoperable. INSERT OR RICT 1 A.2 --------------NOTE------------- 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Not applicable for Functions 2.a, 2.b, 2.c, 2.d, INSERT 2.f or 2.g. RICT 1 Place associated trip system in trip.

B. -----------NOTE------------ B.1 Place channel in one trip 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Not applicable for system in trip. INSERT Functions 2.a, 2.b, 2.c, 2.d, 2.f or 2.g. OR RICT 1 One or more Functions B.2 Place one trip system in 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months with one or more trip.

required channels INSERT inoperable in both trip RICT 1 systems.

Monticello 3.3.1.1-1 Amendment No. 146, 159, 171, 191 TBD

Feedwater Pump and Main Turbine High Water Level Trip Instrumentation 3.3.2.2 3.3 INSTRUMENTATION 3.3.2.2 Feedwater Pump and Main Turbine High Water Level Trip Instrumentation LCO 3.3.2.2 Four channels of Feedwater Pump and Main Turbine High Water Level Trip Instrumentation shall be OPERABLE.

APPLICABILITY: THERMAL POWER 25% RTP.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more feedwater A.1 Place channel in trip. 7 days pump and main turbine high water level trip INSERT channels inoperable. RICT 1 B. Feedwater pump and B.1 Restore feedwater pump 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months main turbine high water and main turbine high water level trip capability not level trip capability.

maintained.

Fix alignment C. Required Action and C.1 ----------NOTE-------------------

associated Completion Only applicable if Time not met. inoperable channel is the result of inoperable feedwater pump breaker or main turbine stop valve.

Remove affected feedwater 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months pump(s) and main turbine valve(s) from service.

OR Monticello 3.3.2.2-1 Amendment No. 146 TBD

ATWS-RPT Instrumentation 3.3.4.1 3.3 INSTRUMENTATION 3.3.4.1 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT)

Instrumentation LCO 3.3.4.1 Two channels per trip system for each ATWS-RPT instrumentation Function listed below shall be OPERABLE:

a. Reactor Vessel Water Level - Low Low; and

b. Reactor Vessel Steam Dome Pressure - High.

APPLICABILITY: MODE 1.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 14 days inoperable. OPERABLE status.

INSERT OR RICT 1 A.2 ---------------NOTE--------------

Not applicable if inoperable channel is the result of an inoperable breaker.

Place channel in trip. 14 days INSERT RICT 1 B. One Function with B.1 Restore ATWS-RPT trip 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months ATWS-RPT trip capability.

capability not maintained.

Monticello 3.3.4.1-1 Amendment No. 146 TBD

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B.2 ---------------NOTE--------------

Only applicable for Functions 3.a and 3.b.

Declare High Pressure 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery Coolant Injection (HPCI) of loss of HPCI System inoperable. initiation capability AND B.3 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT RICT 2 C. As required by Required C.1 --------------NOTE-------------

Action A.1 and Only applicable for referenced in Functions 1.c, 1.d, 1.e, 1.f, Table 3.3.5.1-1. 2.c, 2.d, 2.e, 2.i, 2.j, 2.l, and 2.m.

Declare supported 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery feature(s) inoperable when of loss of initiation its redundant feature ECCS capability for initiation capability is feature(s) in both inoperable. divisions AND C.2 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. INSERT RICT 2 Monticello 3.3.5.1-2 Amendment No. 146, 198 TBD

ECCS Instrumentation 3.3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. As required by Required D.1 ---------------NOTE--------------

Action A.1 and Only applicable if HPCI referenced in pump suction is not aligned Table 3.3.5.1-1. to the suppression pool.

Declare HPCI System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery inoperable. of loss of HPCI initiation capability AND D.2.1 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT OR RICT 2 D.2.2 Align the HPCI pump 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months suction to the suppression pool.

E. As required by Required E.1 --------------NOTE-------------

Action A.1 and Only applicable for referenced in Function 2.g.

Table 3.3.5.1-1. -----------------------------------

Declare supported 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery feature(s) inoperable when of loss of initiation its redundant feature ECCS capability for initiation capability is subsystems in both inoperable. divisions AND E.2 Restore channel to 7 days OPERABLE status. INSERT RICT 2 Monticello 3.3.5.1-3 Amendment No. 146, 198 TBD

ECCS Instrumentation ACTIONS 3.3.5.1 CTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME F. As required by Required F.1 Declare Automatic 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery Action A.1 and Depressurization System of loss of ADS referenced in (ADS) valves inoperable. initiation capability in Table 3.3.5.1-1. both trip systems INSERT AND RICT NOTE F.2 Place channel in trip. 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from discovery of inoperable channel concurrent with HPCI or reactor core isolation cooling INSERT (RCIC) inoperable RICT 3 AND INSERT RICT 3 8 days G. As required by Required G.1 Declare ADS valves 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery Action A.1 and inoperable. of loss of ADS referenced in initiation capability in Table 3.3.5.1-1. both trip systems INSERT AND RICT NOTE G.2 Restore channel to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months from OPERABLE status. discovery of inoperable channel concurrent with HPCI or RCIC inoperable INSERT AND RICT 3 8 days INSERT RICT 3 H. Required Action and H.1 Declare associated Immediately associated Completion supported feature(s)

Time of Condition B, C, inoperable.

D, E, F, or G not met.

Monticello 3.3.5.1-4 Amendment No. 146 TBD

ECCS Instrumentation 3.3.5.1 Table 3.3.5.1-1 (page 4 of 6)

Emergency Core Cooling System Instrumentation APPLICABLE CONDITIONS MODES REQUIRED REFERENCED OR OTHER CHANNELS FROM SPECIFIED PER REQUIRED SURVEILLANCE ALLOWABLE FUNCTION CONDITIONS FUNCTION ACTION A.1 REQUIREMENTS VALUE

2. LPCI System Reactor

k. Recirculation Steam 1, 2, 3 2 B SR 3.3.5.1.7 2.97 seconds Dome Pressure - SR 3.3.5.1.8 Time Delay Relay SR 3.3.5.1.9 (Break Detection)

l. Recirculation Pump 1, 2, 3 2 C SR 3.3.5.1.7 0.75 seconds Differential Pressure SR 3.3.5.1.8

- Time Delay Relay SR 3.3.5.1.9 (Break Detection)

m. Recirculation Riser 1, 2, 3 2 C SR 3.3.5.1.7 0.75 seconds Differential Pressure SR 3.3.5.1.8

- Time Delay Relay SR 3.3.5.1.9 (Break Detection)

3. High Pressure Coolant Injection (HPCI) System (d) (d)

a. Reactor Vessel 1, 2 , 3 4 B SR 3.3.5.1.1 -48 inches Water Level - Low SR 3.3.5.1.2 Low SR 3.3.5.1.3 SR 3.3.5.1.7 SR 3.3.5.1.8 (d) (d)

b. Drywell Pressure - 1, 2 , 3 4 B SR 3.3.5.1.2 2 psig High SR 3.3.5.1.4 SR 3.3.5.1.8 (d) (d)

c. Reactor Vessel 1, 2 , 3 2 C SR 3.3.5.1.1 48 inches Water Level - High SR 3.3.5.1.2 SR 3.3.5.1.3 SR 3.3.5.1.7 SR 3.3.5.1.8 (d) (d)

d. Condensate Storage 1, 2 , 3 2 D SR 3.3.5.1.7 29.3 inches Tank Level - Low SR 3.3.5.1.8 (d) (d)

e. Suppression Pool 1, 2 , 3 2 D SR 3.3.5.1.5 3.0 inches Water Level - High SR 3.3.5.1.6 SR 3.3.5.1.8 (d) (d)

f. High Pressure 1, 2 , 3 1 E SR 3.3.5.1.5 362 gpm and Coolant Injection SR 3.3.5.1.6 849 gpm Pump Discharge SR 3.3.5.1.8 Flow - Low (Bypass)

(d) With reactor steam dome pressure > 150 psig.

Monticello 3.3.5.1-10 Amendment No. 200 TBD

RCIC System Instrumentation 3.3.5.2 3.3 INSTRUMENTATION 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation LCO 3.3.5.2 The RCIC System instrumentation for each Function in Table 3.3.5.2-1 shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Enter the Condition Immediately inoperable. referenced in Table 3.3.5.2-1 for the channel.

B. As required by Required B.1 Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery Action A.1 and inoperable. of loss of RCIC referenced in initiation capability Table 3.3.5.2-1.

AND B.2 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT RICT 2 C. As required by Required C.1 Restore channel to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Action A.1 and OPERABLE status.

referenced in Table 3.3.5.2-1.

Monticello 3.3.5.2-1 Amendment No. 146 TBD

RCIC System Instrumentation 3.3.5.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. As required by Required D.1 ---------------NOTE--------------

Action A.1 and Only applicable if RCIC referenced in pump suction is not aligned Table 3.3.5.2-1. to the suppression pool.

Declare RCIC System 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery inoperable. of loss of RCIC initiation capability AND D.2.1 Place channel in trip. 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months INSERT OR RICT 2 D.2.2 Align RCIC pump suction to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months the suppression pool.

E. Required Action and E.1 Declare RCIC System Immediately associated Completion inoperable.

Time of Condition B, C, or D not met.

Monticello 3.3.5.2-2 Amendment No. 200 TBD

Primary Containment Isolation Instrumentation 3.3.6.1 3.3 INSTRUMENTATION 3.3.6.1 Primary Containment Isolation Instrumentation LCO 3.3.6.1 The primary containment isolation instrumentation for each Function in Table 3.3.6.1-1 shall be OPERABLE.

APPLICABILITY: According to Table 3.3.6.1-1.

ACTIONS

NOTES----------------------------------------------------------

1. Penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME INSERT RICT 3 A. One or more required A.1 Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for channels inoperable. Functions 2.a, 2.b, 5.c, 6.b, 7.a, and 7.b INSERT AND RICT 3 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for Functions other than Functions 2.a, 2.b, 5.c, 6.b, 7.a, and 7.b B. One or more Functions B.1 Restore primary 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months with primary containment isolation containment isolation capability.

capability not maintained.

C. Required Action and C.1 Enter the Condition Immediately associated Completion referenced in Time of Condition A or B Table 3.3.6.1-1 for the not met. channel.

Monticello 3.3.6.1-1 Amendment No. 146 TBD

Mechanical Vacuum Pump Isolation Instrumentation 3.3.7.2 3.3 INSTRUMENTATION 3.3.7.2 Mechanical Vacuum Pump Isolation Instrumentation LCO 3.3.7.2 Four channels of the Main Steam Line Tunnel Radiation - High Function for the mechanical vacuum pump isolation shall be OPERABLE.

APPLICABILITY: MODES 1 and 2 with the mechanical vacuum pump in service and any main steam line not isolated.

ACTIONS

N0 TE---------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Restore channel to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months inoperable. OPERABLE status.

INSERT OR Fix alignment RICT 1 A.2 --------------N 0 T E--------------

Not applicable if inoperable channel is the result of an inoperable mechanical vacuum pump breaker or isolation

_____ valve.

Place channel in trip. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months INSERT B. Mechanical vacuum B.1 Restore mechanical vacuum 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months RICT 1 pump isolation capability pump isolation capability.

not maintained.

Corrected by letter dated March. g:: 2009 Monticello 3.3.7.2-1 Amendment No. 148 TBD

LOP Instrumentation 3.3.8.1 3.3 INSTRUMENTATION 3.3.8.1 Loss of Power (LOP) Instrumentation LCO 3.3.8.1 The LOP instrumentation for each Function in Table 3.3.8.1-1 shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3, When the associated emergency diesel generator (EDG) is required to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each channel.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more channels A.1 Place channel in trip. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months inoperable. INSERT RICT 2 B. Required Action and B.1 Declare associated EDG Immediately associated Completion inoperable.

Time not met.

Monticello 3.3.8.1-1 Amendment No. 146 TBD

S/RVs 3.4.3 3.4 REACTOR COOLANT SYSTEM (RCS) 3.4.3 Safety/Relief Valves (S/RVs)

LCO 3.4.3 The safety function of seven S/RVs shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or two required A.1 Restore the required S/RVs 14 days S/RVs inoperable. to OPERABLE status.

INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Three or more required S/RVs inoperable.

Monticello 3.4.3-1 Amendment No. 146 TBD

ECCS - Operating 3.5.1 3.5 EMERGENCY CORE COOLING SYSTEM (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.1 ECCS - Operating LCO 3.5.1 Each ECCS injection/spray subsystem and the Automatic Depressurization System (ADS) function of three safety/relief valves shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3, except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure 150 psig.

ACTIONS

NOTE-----------------------------------------------------------

LCO 3.0.4.b is not applicable to HPCI.

CONDITION REQUIRED ACTION COMPLETION TIME A. One LPCI pump A.1 Restore LPCI pump to 30 days inoperable. OPERABLE status.

B. One LPCI subsystem B.1 Restore low pressure 7 days inoperable for reasons ECCS injection/spray other than Condition A. subsystem to OPERABLE INSERT status. RICT 1 OR U

One Core Spray subsystem inoperable.

Monticello 3.5.1-1 Amendment No. 202 TBD

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C. One LPCI pump in both C.1 Restore one LPCI pump to 7 days LPCI subsystems OPERABLE status. INSERT inoperable.

RICT 1 D. Two LPCI subsystems D.1 Restore one LPCI 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable for reasons subsystem to OPERABLE other than Condition C status. INSERT or G. RICT 1 E. One Core Spray E.1 Restore Core Spray 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months subsystem inoperable. subsystem to OPERABLE status. INSERT RICT 1 AND OR One LPCI subsystem E.2 Restore LPCI subsystem to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

INSERT OR OR RICT 1 One or two LPCI E.3 Restore LPCI pump(s) to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months pump(s) inoperable. OPERABLE status. INSERT RICT 1 F. Required Action and F.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, AND C, D, or E not met.

F.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months G. Two LPCI subsystems G.1 Isolate the RHR intertie 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months inoperable due to open line.

RHR intertie return line isolation valve(s).

Monticello 3.5.1-2 Amendment No. 146, 162, 184 TBD

ECCS - Operating 3.5.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME H. Required Action and H.1 Be in MODE 2. 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months associated Completion Time of Condition G not met.

I. HPCI System I.1 Verify by administrative Immediately inoperable. means RCIC System is OPERABLE.

AND I.2 Restore HPCI System to 14 days OPERABLE status. INSERT RICT 1 J. HPCI System J.1 Restore HPCI System to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months inoperable. OPERABLE status.

INSERT AND OR RICT 1 Condition A, B, or C J.2 Restore low pressure 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months entered. ECCS injection/spray subsystem(s) to INSERT OPERABLE status. RICT 1 K. One ADS valve K.1 Restore ADS valve to 14 days inoperable. OPERABLE status.

INSERT RICT 1 Monticello 3.5.1-3 Amendment No. 146, 162, 176, 184 TBD

RCIC System 3.5.3 3.5 EMERGENCY CORE COOLING SYSTEM (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 3.5.3 RCIC System LCO 3.5.3 The RCIC System shall be OPERABLE.

APPLICABILITY: MODE 1, MODES 2 and 3 with reactor steam dome pressure > 150 psig.

ACTIONS

NOTE-----------------------------------------------------------

LCO 3.0.4.b is not applicable to the RCIC System.

CONDITION REQUIRED ACTION COMPLETION TIME A. RCIC System A.1 Verify by administrative Immediately inoperable. means High Pressure Coolant Injection System is OPERABLE.

AND A.2 Restore RCIC System to 14 days OPERABLE status. INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND B.2 Reduce reactor steam 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months dome pressure to 150 psig.

Monticello 3.5.3-1 Amendment No. 146, 198 TBD

Primary Containment Air Lock 3.6.1.2 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B.3 ---------------NOTE--------------

Air lock doors in high radiation areas or areas with limited access due to inerting may be verified locked closed by administrative means.

Verify an OPERABLE door Once per 31 days is locked closed.

C. Primary containment air C.1 Initiate action to evaluate Immediately lock inoperable for primary containment overall reasons other than leakage rate per Condition A or B. LCO 3.6.1.1, using current air lock test results.

AND C.2 Verify a door is closed. 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months AND C.3 Restore air lock to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE status. INSERT RICT 1 D. Required Action and D.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND D.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Monticello 3.6.1.2-3 Amendment No. 146 TBD

PCIVs 3.6.1.3 3.6 CONTAINMENT SYSTEMS 3.6.1.3 Primary Containment Isolation Valves (PCIVs)

LCO 3.6.1.3 Each PCIV, except reactor building-to-suppression chamber vacuum breakers, shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3 ACTIONS

NOTES----------------------------------------------------------

1. Penetration flow paths may be unisolated intermittently under administrative controls.

2. Separate Condition entry is allowed for each penetration flow path.

3. Enter applicable Conditions and Required Actions for systems made inoperable by PCIVs.

4. Enter applicable Conditions and Required Actions of LCO 3.6.1.1, "Primary Containment,"

when PCIV leakage results in exceeding overall containment leakage rate acceptance criteria.

CONDITION REQUIRED ACTION COMPLETION TIME A. ------------NOTE------------ A.1 Isolate the affected 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months except for Only applicable to penetration flow path by main steam line penetration flow paths use of at least one closed INSERT with two PCIVs. and de-activated automatic AND

valve, closed manual valve, RICT 1 blind flange, or check valve 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main One or more penetration with flow through the valve steam line flow paths with one secured.

PCIV inoperable for INSERT reasons other than AND RICT 1 Condition D or E.

Monticello 3.6.1.3-1 Amendment No. 146, 148, 198 TBD

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A.2 --------------NOTES-------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of following isolation administrative means.

Verify the affected Once per 31 days for penetration flow path is isolation devices isolated. outside primary containment AND Prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days, for isolation devices inside primary containment Monticello 3.6.1.3-2 Amendment No. 146 TBD

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME C.2 --------------NOTES-------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of following isolation administrative means.

Verify the affected Once per 31 days for penetration flow path is isolation devices isolated. outside primary containment AND Prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days, for isolation devices inside primary containment Monticello 3.6.1.3-4 Amendment No. 146 TBD

PCIVs 3.6.1.3 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME D. One or more penetration D.1 Isolate the affected 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months flow paths with one or penetration flow path by more 18 inch primary use of at least one closed INSERT containment purge and and de-activated automatic RICT 2 vent valves not within valve, closed manual valve, purge and vent valve or blind flange.

leakage limits.

AND D.2 --------------NOTES-------------

1. Isolation devices in high radiation areas may be verified by use of administrative means.

2. Isolation devices that are locked, sealed, or otherwise secured may be verified by use of following isolation administrative means.

Verify the affected Once per 31 days for penetration flow path is isolation devices isolated. outside containment E. One or more MSIVs E.1 Restore leakage rate to within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months with leakage rate not limits.

within limits.

Fix alignment F. Required Action and F.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A, B, AND C, or D not met in MODE 1, 2, or 3. F.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Monticello 3.6.1.3-5 Amendment No. 146, 148, 198 TBD

Reactor Building-to-Suppression Chamber Vacuum Breakers 3.6.1.6 3.6 CONTAINMENT SYSTEMS 3.6.1.6 Reactor Building-to-Suppression Chamber Vacuum Breakers LCO 3.6.1.6 Each reactor building-to-suppression chamber vacuum breaker shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS

NOTE-----------------------------------------------------------

Separate Condition entry is allowed for each line.

CONDITION REQUIRED ACTION COMPLETION TIME A. One or more lines with A.1 Close the open vacuum 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months one reactor building-to- breaker.

suppression chamber vacuum breaker not closed.

B. One or more lines with B.1 Close one open vacuum 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months two reactor building-to- breaker.

suppression chamber vacuum breakers not closed.

C. One line with one or C.1 Restore the vacuum 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months more reactor building-to- breaker(s) to OPERABLE suppression chamber status. INSERT vacuum breakers RICT 1 inoperable for opening.

D. Two lines with one or D.1 Restore all vacuum 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months more reactor building-to- breakers in one line to suppression chamber OPERABLE status.

vacuum breakers inoperable for opening.

Monticello 3.6.1.6-1 Amendment No. 146 TBD

Suppression Chamber-to-Drywell Vacuum Breakers 3.6.1.7 3.6 CONTAINMENT SYSTEMS 3.6.1.7 Suppression Chamber-to-Drywell Vacuum Breakers LCO 3.6.1.7 Seven suppression chamber-to-drywell vacuum breakers shall be OPERABLE for opening.

AND Eight suppression chamber-to-drywell vacuum breakers shall be closed.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One required A.1 Restore one vacuum 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months suppression chamber-to- breaker to OPERABLE INSERT drywell vacuum breaker status.

inoperable for opening. RICT 1 B. One suppression B.1 Close the open vacuum 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months chamber-to-drywell breaker.

vacuum breaker not closed.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Monticello 3.6.1.7-1 Amendment No. 146 TBD

RHR Drywell Spray 3.6.1.8 3.6 CONTAINMENT SYSTEMS 3.6.1.8 Residual Heat Removal (RHR) Drywell Spray LCO 3.6.1.8 Two RHR drywell spray subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR drywell spray A.1 Restore RHR drywell spray 7 days subsystem inoperable. subsystem to OPERABLE status. INSERT RICT 1 B. Two RHR drywell spray B.1 Restore one RHR drywell 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months subsystems inoperable. spray subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.1.8.1 Verify each RHR drywell spray subsystem manual In accordance with and power operated valve in the flow path that is not the Surveillance locked, sealed, or otherwise secured in position is in Frequency Control the correct position or can be aligned to the correct Program position.

Monticello 3.6.1.8-1 Amendment No. 200 TBD

RHR Suppression Pool Cooling 3.6.2.3 3.6 CONTAINMENT SYSTEMS 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling LCO 3.6.2.3 Two RHR suppression pooling cooling subsystems shall be OPERABLE.

Fix alignment APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHR suppression A.1 Restore RHR suppression 7 days pool cooling subsystem pool cooling subsystem to INSERT inoperable. OPERABLE status.

RICT 1 B. Two RHR suppression B.1 Restore one RHR 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months pool cooling subsystems suppression pool cooling inoperable. subsystem to OPERABLE status.

C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time not met. AND C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Fix alignment SURVEILLANCE REQUIREMENTS SURVEILLANCE FREQUENCY SR 3.6.2.3.1 Verify each RHR suppression pool cooling In accordance with subsystem manual and power operated valve in the the Surveillance flow path that is not locked, sealed, or otherwise Frequency Control secured in position is in the correct position or can Program be aligned to the correct position.

Monticello 3.6.2.3-1 Amendment No. 200 TBD

RHRSW System 3.7.1 3.7 PLANT SYSTEMS 3.7.1 Residual Heat Removal Service Water (RHRSW) System LCO 3.7.1 Two RHRSW subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One RHRSW subsystem A.1 ---------------NOTE--------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown," for RHR shutdown cooling made inoperable by RHRSW System.

Restore RHRSW 7 days subsystem to OPERABLE INSERT status.

RICT 1 B. Both RHRSW B.1 ---------------NOTE--------------

subsystems inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7 for RHR shutdown cooling made inoperable by RHRSW System.

Restore one RHRSW 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months subsystem to OPERABLE status.

Monticello 3.7.1-1 Amendment No. 146 TBD

ESW System and UHS 3.7.2 3.7 PLANT SYSTEMS 3.7.2 Emergency Service Water (ESW) System and Ultimate Heat Sink (UHS)

LCO 3.7.2 Two ESW subsystems and UHS shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One ESW subsystem A.1 --------------NOTE--------------

inoperable. Enter applicable Conditions and Required Actions of LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown," for RHR shutdown cooling made inoperable by ESW.

Restore the ESW 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months subsystem to OPERABLE status.

INSERT RICT 1 B. Required Action and B.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A not AND met.

B.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months OR Both ESW subsystems inoperable.

OR UHS inoperable.

Monticello 3.7.2-1 Amendment No. 146 TBD

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME A.3 Restore required offsite 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months circuit to OPERABLE INSERT status.

RICT 1 B. One EDG inoperable. B.1 Perform SR 3.8.1.1 for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months OPERABLE required offsite circuit(s). AND Once per 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months thereafter AND B.2 Declare required feature(s), 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from supported by the inoperable discovery of EDG, inoperable when the Condition B redundant required concurrent with feature(s) are inoperable. inoperability of redundant required feature(s)

AND B.3.1 Determine OPERABLE 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months EDG is not inoperable due to common cause failure.

OR B.3.2 Perform SR 3.8.1.2 for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months OPERABLE EDG.

AND Monticello 3.8.1-2 Amendment No. 146 TBD

AC Sources - Operating 3.8.1 ACTIONS (continued)

CONDITION REQUIRED ACTION COMPLETION TIME B.4 Restore EDG to 7 days OPERABLE status. INSERT RICT 1 C. Two required offsite C.1 Declare required feature(s) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from circuits inoperable. inoperable when the discovery of redundant required Condition C feature(s) are inoperable. concurrent with inoperability of redundant required feature(s)

AND C.2 Restore one required offsite 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months circuit to OPERABLE INSERT status.

RICT 1 D. One required offsite --------------------NOTE-------------------

circuit inoperable. Enter applicable Conditions and Required Actions of LCO 3.8.7, AND "Distribution Systems - Operating,"

when Condition D is entered with no One EDG inoperable. AC power source to any division.

D.1 Restore required offsite 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months circuit to OPERABLE status.

INSERT RICT 1 OR D.2 Restore EDG to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months OPERABLE status. INSERT RICT 1 E. Two EDGs inoperable. E.1 Restore one EDG to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months OPERABLE status.

Monticello 3.8.1-3 Amendment No. 146 TBD

DC Sources - Operating 3.8.4 3.8 ELECTRICAL POWER SYSTEMS 3.8.4 DC Sources - Operating LCO 3.8.4 The Division 1 and Division 2 125 VDC and 250 VDC electrical power subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more required A.1 Restore battery terminal 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months battery chargers on voltage to greater than or Division 1 or Division 2 equal to the minimum inoperable. established float voltage.

AND A.2 Verify battery float current Once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months 2 amps for 250 VDC batteries and 1 amp for 125 VDC batteries.

AND A.3 Restore required Division 1 7 days or Division 2 battery INSERT charger(s) to OPERABLE status. RICT 1 B. One Division 1 or B.1 Restore Division 1 or 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Division 2 DC electrical Division 2 DC electrical power subsystem power subsystem to INSERT inoperable for reasons OPERABLE status. RICT 1 other than Condition A.

Monticello 3.8.4-1 Amendment No. 146 TBD

Distribution Systems - Operating 3.8.7 3.8 ELECTRICAL POWER SYSTEMS 3.8.7 Distribution Systems - Operating LCO 3.8.7 Division 1 and Division 2 AC and DC electrical power distribution subsystems shall be OPERABLE.

APPLICABILITY: MODES 1, 2, and 3.

ACTIONS CONDITION REQUIRED ACTION COMPLETION TIME A. One or more AC --------------------NOTE-------------------

electrical power Enter applicable Conditions and distribution subsystems Required Actions of LCO 3.8.4, "DC inoperable. Sources - Operating," for DC divisions made inoperable by inoperable power distribution subsystems.

A.1 Restore AC electrical power 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months distribution subsystem(s) to INSERT OPERABLE status.

RICT 1 B. One or more DC B.1 Restore DC electrical 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months electrical power power distribution distribution subsystems subsystem(s) to INSERT inoperable. OPERABLE status. RICT 1 C. Required Action and C.1 Be in MODE 3. 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months associated Completion Time of Condition A or B AND not met.

C.2 Be in MODE 4. 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months Monticello 3.8.7-1 Amendment No. 146 TBD

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.14 Spent Fuel Pool Boral Monitoring Program The program provides routine monitoring and actions to ensure that the condition of Boral in the spent fuel pool racks is appropriately monitored to ensure that the Boral neutron attenuation capability described in the criticality safety analysis of USAR Section 10.2.1 is maintained. The program shall include the following:

a. Periodic physical examination of representative Boral coupons or in situ storage racks at a frequency defined by observed trends or calculated projections of Boral degradation. The measurement will be performed to ensure that average thickness of the coupon (or average thickness of a representative area of the in situ storage rack) does not exceed the nominal design thickness of the coupon (or storage rack) plus the 0.055-inch dimension assumed for the analyzed blister.

b. Neutron attenuation testing of a representative Boral coupon or in situ storage rack shall be performed prior to December 31, 2015, and thereafter at a frequency of not more than 10 years, or more frequently based on observed trends or calculated projections of Boral degradation. The acceptance criterion for minimum boron areal density will be that value assumed in the criticality safety analysis (0.013 gm/cm2).

c. Description of appropriate corrective actions for discovery of nonconforming Boral.

5.5.15 Surveillance Frequency Control Program This program provides controls for Surveillance Frequencies. The program shall ensure that Surveillance Requirements specified in the Technical Specifications are performed at intervals sufficient to assure the associated Limiting Conditions for Operation are met.

a. The Surveillance Frequency Control Program shall contain a list of Frequencies of those Surveillance Requirements for which the Frequency is controlled by the program.

b. Changes to the Frequencies listed in the Surveillance Frequency Control Program shall be made in accordance with NEI 04-10, Risk-Informed Method for Control of Surveillance Frequencies, Revision 1.

c. The provisions of Surveillance Requirements 3.0.2 and 3.0.3 are applicable to the Frequencies established in the Surveillance Frequency Control INSERT Program.

RICT Program Monticello 5.5-13 Amendment No. 200 TBD

ATTACHMENT 3 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b PROPOSED TECHNICAL SPECIFICATION BASES CHANGES (MARK-UP)

(PROVIDED FOR INFORMATION ONLY)

(40 Pages Follow)

INSERT TSB RICT 1 or in accordance with the Risk Informed Completion Time Program INSERT TSB RICT 2 Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program.

INSERT TSB RICT 3 Alternatively, a Completion Time can be determined in accordance with the Risk Informed Completion Time Program. This Completion Time is modified by a Note to clarify that the Risk Informed Completion Time Program is not applicable to a Required Action associated with a Condition that represents a loss of safety function.

SLC System B 3.1.7 BASES APPLICABILITY (continued) core cell containing fuel assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") ensures that the reactor will not become critical. Therefore, the SLC System is not required to be OPERABLE when only a single control rod can be withdrawn.

ACTIONS A.1 If the concentration of sodium pentaborate in solution is not within limits of Figure 3.1.7-1 and Table 3.1.7-1 Equation 2 (ATWS design basis) but available volume of sodium pentaborate solution is within limits of Table 3.1.7-1 Equation 1 (original design basis), the concentration must be restored to within limits in 7 days. It is not necessary under these conditions to enter Condition C for both SLC subsystems inoperable since they are capable of performing their original design basis function, as well as providing suppression pool pH control following a LOCA. Because of the low probability of an event and the fact that the SLC System capability still exists for vessel injection under these conditions, the allowed Completion Time of 7 days is acceptable and provides adequate time to restore concentration to within limits.

INSERT B.1 TSB RICT 1 If one SLC subsystem is inoperable for reasons other than Condition A, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystem is adequate to perform the ATWS design basis function, as well as providing suppression pool pH control following a LOCA. However, the overall reliability is reduced because a single failure in the remaining OPERABLE subsystem could result in reduced SLC System shutdown capability. The 7 day Completion Time is based on the availability of an OPERABLE subsystem capable of performing the intended SLC System function and the low probability of a Design Basis Accident (DBA) or severe transient occurring concurrent with the failure of the Control Rod Drive (CRD) System to shut down the plant.

C.1 If both SLC subsystems are inoperable for reasons other than Condition A, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is considered acceptable given the low probability of a DBA or transient occurring concurrent with the failure of the control rods to shut down the reactor.

Monticello B 3.1.7-3 Revision No. 52 TBD

RPS Instrumentation B 3.3.1.1 BASES ACTIONS (continued)

Prior to expiration of the time allotted by the note, the absolute difference between the channel and calculated power is required to be restored to within the limit of SR 3.3.1.1.2 ( 2% RTP) or the applicable Condition entered and Required Actions taken. This note is based on the time required to perform APRM adjustments on multiple channels and the impact on safety; additional time is allowed when the APRM is indicating a higher power value than the calculated power, i.e., out of limits but conservative.

INSERT A.1 and A.2 TSB RICT 2 Because of the diversity of sensors available to provide trip signals and the redundancy of the RPS design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref. 16) to permit restoration of any inoperable channel to OPERABLE status. However, this out of service time is only acceptable provided the associated Function's inoperable channel is in one trip system and the Function still maintains RPS trip capability (refer to Required Actions B.1, B.2 and C.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel or the associated trip system must be placed in the tripped condition per Required Actions A.1 and A.2. Placing the inoperable channel in trip (or the associated trip system in trip) would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternatively, if it is not desired to place the channel (or trip system) in trip (e.g., as in the case where placing the inoperable channel in trip would result in a full scram), Condition D must be entered and its Required Action taken. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance is not allowed for Reactor Mode Switch - Shutdown Position Function and Manual Scram Function channels since with one channel inoperable RPS trip capability is not maintained. In this case, Condition C must be entered and its Required Actions taken.

As noted, Action A.2 is not applicable for APRM Functions 2.a, 2.b, 2.c, 2.d, 2.f, or 2.g. lnoperability of one required APRM channel affects both trip systems. For that condition, Required Action A.1 must be satisfied, and is the only action (other than restoring operability) that will restore capability to accommodate a single failure. lnoperability of more than one required APRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel.

Monticello B 3.3.1.1-24 Revision No. 52 TBD

RPS Instrumentation B 3.3.1.1 BASES ACTIONS (continued)

B.1 and B.2 Condition B exists when, for any one or more Functions, at least one required channel is inoperable in each trip system. In this condition, provided at least one channel per trip system is OPERABLE, the RPS still maintains trip capability for that Function, but cannot accommodate a single failure in either trip system.

Required Actions B.1 and B.2 limit the time the RPS scram logic, for any Function, would not accommodate single failure in either trip system (e.g.,

one-out-of-one and one-out-of-one arrangement for a typical four channel Function). The reduced reliability of this logic arrangement was not evaluated in Reference 16 for the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time. Within the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the associated Function will have all required channels OPERABLE or in trip (or any combination) in one trip system.

Completing one of these Required Actions restores RPS to a reliability level equivalent to that evaluated in Reference 16, which justified a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowable out of service time as presented in Condition A. The trip system in the more degraded state should be placed in trip or, alternatively, all the inoperable channels in that trip system should be placed in trip (e.g., a trip system with two inoperable channels could be in a more degraded state than a trip system with four inoperable channels if the two inoperable channels are in the same Function while the four inoperable channels are all in different Functions). The decision of which trip system is in the more degraded state should be based on prudent judgment and take into account current plant conditions (i.e., what MODE the plant is in). If this action would result in a scram, it is permissible to place the other trip system or its inoperable channels in trip.

The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months Completion Time is judged acceptable based on the INSERT remaining capability to trip, the diversity of the sensors available to TSB RICT 2 provide the trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram, Condition D must be entered and its Required Action taken. The 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance is not allowed for Reactor Mode Switch - Shutdown Position Function and Manual Scram Function channels since with two channels inoperable RPS trip capability is not maintained. In this case, Condition C must be entered and its Required Action taken.

Monticello B 3.3.1.1-25 Revision No. 52 TBD

Feedwater Pump and Main Turbine High Water Level Trip Instrumentation B 3.3.2.2 BASES ACTIONS A Note has been provided to modify the ACTIONS related to Feedwater Pump and Main Turbine High Water Level Trip Instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable feedwater and main turbine high water level trip instrumentation channels provide appropriate compensatory measures for separate inoperable channels.

As such, a Note has been provided that allows separate Condition entry for each inoperable Feedwater Pump and Main Turbine High Water Level Trip Instrumentation channel.

A.1 With one or more channels inoperable and trip capability maintained, the remaining OPERABLE channels can provide the required trip signal.

However, overall instrumentation reliability is reduced because a single failure in one of the remaining channels concurrent with feedwater controller failure, maximum demand event, may result in the instrumentation not being able to perform its intended function.

Therefore, continued operation is only allowed for a limited time. If the inoperable channel(s) cannot be restored to OPERABLE status within the Completion Time, the channel(s) must be placed in the tripped condition per Required Action A.1. Placing the inoperable channel(s) in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel(s) in trip (e.g., as in the case where placing the inoperable channel(s) in trip would result in a feedwater pump or main turbine trip), Condition C must be entered and its Required Action taken.

The Completion Time of 7 days is based on the low probability of the event occurring coincident with a single failure in a remaining OPERABLE channel.

INSERT TSB RICT 2 B.1 With the feedwater pump and main turbine high water level trip capability not maintained, the Feedwater Pump and Main Turbine High Water Level Trip Instrumentation cannot perform its design function. Therefore, continued operation is only permitted for a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period, during which feedwater pump and main turbine high water level trip capability must be restored. The trip capability is considered maintained when sufficient Monticello B 3.3.2.2-3 Revision No. 52 TBD

ATWS-RPT Instrumentation B 3.3.4.1 BASES ACTIONS (continued)

A.1 and A.2 With one or more channels inoperable, but with ATWS-RPT trip capability for each Function maintained (refer to Required Actions B.1 and C.1 Bases), the ATWS-RPT System is capable of performing the intended function. However, the reliability and redundancy of the ATWS-RPT instrumentation is reduced, such that a single failure in the remaining trip system could result in the inability of the ATWS-RPT System to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status. Because of the diversity of sensors available to provide trip signals, the low probability of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of ATWS-RPT, 14 days is provided to restore the inoperable channel (Required Action A.1). Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, placing the channel in trip with no further restrictions is not allowed if the inoperable channel is the result of an inoperable breaker, since this may not adequately compensate for the inoperable breaker (e.g., the breaker may be inoperable such that it will not open). If it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an RPT),

or if the inoperable channel is the result of an inoperable breaker, Condition D must be entered and its Required Actions taken.

INSERT B.1 TSB RICT 2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the recirculation pump MG set drive motor field breakers to be OPERABLE or in trip.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and that one Function is still maintaining ATWS-RPT trip capability.

Monticello B 3.3.4.1-5 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued) INSERT TSB RICT 3 only begins upon discovery that the HPCI System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation or as in the case where placing an inoperable channel in trip would result in an immediate initiation without time delay when an initiation signal is received), Condition H must be entered and its Required Action taken.

C.1 and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in redundant automatic initiation capability being lost for the feature(s).

Required Action C.1 features would be those that are initiated by Functions 1.c, 1.d, 1.e, 1.f, 2.c, 2.d, 2.e, 2.i, 2.j, 2.l, and 2.m (i.e., low pressure ECCS). Redundant automatic initiation capability is lost if:

(a) two Function 1.c channels are inoperable; (b) two Function 2.c channels are inoperable; (c) two Function 1.d channels are inoperable; (d) two Function 2.d channels are inoperable; (e) two Function 1.e channels are inoperable; (f) two Function 2.e channels are inoperable; (g) two Function 1.f channels are inoperable; (h) two or more Function 2.i channels, associated with a recirculation pump are inoperable such that both trip systems lose initiation capability; (i) two or more Function 2.j channels are inoperable such that both trip systems lose initiation capability; (j) two Function 2.l channels are inoperable; or (k) two Function 2.m channels are inoperable. Since each inoperable channel would have Required Action C.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion Monticello B 3.3.5.1-26 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued) of the associated system to be declared inoperable. However, since channels for both low pressure ECCS subsystems are inoperable (e.g.,

both CS subsystems), and the Completion Times started concurrently for the channels in both subsystems, this results in the affected portions in both subsystems being concurrently declared inoperable. For these Functions the affected portions are the associated low pressure ECCS pumps.

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Note states that Required Action C.1 is only applicable for Functions 1.c, 1.d, 1.e, 1.f, 2.c, 2.d, 2.e, 2.i, 2.j, 2.l, and 2.m. Required Action C.1 is not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic). This loss was considered during the development of Reference 3 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both subsystems (e.g., both CS subsystems) cannot be automatically initiated due to inoperable channels within the same Function as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its INSERT TSB RICT 3 Monticello B 3.3.5.1-27 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued)

Required Action taken. The Required Actions do not allow placing the channel in trip since this action would either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic component initiation capability for the HPCI System. Automatic component initiation capability is lost if two Function 3.d channels or two Function 3.e channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the HPCI System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of HPCI initiation capability. As noted, Required Action D.1 is only applicable if the HPCI pump suction is not aligned to the suppression pool, since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action D.1, the Completion Time only begins upon discovery that the HPCI System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1 or the suction source must be aligned to the suppression pool per Required Action D.2.2. Placing the inoperable channel in trip performs the intended function of the channel (shifting the suction source to the suppression pool). Performance of either of these two Required Actions will allow operation to continue. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the HPCI System piping remains filled with water.

Alternately, if it is not desired to perform Required Actions D.2.1 INSERT TSB RICT 3 Monticello B 3.3.5.1-28 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued) and D.2.2 (e.g., as in the case where shifting the suction source could drain down the HPCI suction piping), Condition H must be entered and its Required Action taken.

E.1 and E.2 Required Action E.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the Low Pressure Coolant Injection Pump Discharge Flow - Low (Bypass) Function results in redundant automatic initiation capability being lost for the feature(s). For Required Action E.1, the features would be those that are initiated by Function 2.g (i.e., LPCI). Redundant automatic initiation capability is lost if one or more Function 2.g channels associated with pumps in LPCI subsystem A and one or more Function 2.g channels associated with pumps in LPCI subsystem B are inoperable. Since each inoperable channel would have Required Action E.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected LPCI pump to be declared inoperable. However, since channels for more than one LPCI pump are inoperable, and the Completion Times started concurrently for the channels of the LPCI pumps, this results in the affected ECCS pumps being concurrently declared inoperable.

In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the subsystem associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . A Note is also provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to the LPCI Function. Required Action E.1 is not applicable to HPCI Function 3.f since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 3 and considered acceptable for the 7 days allowed by Required Action E.2. The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

INSERT TSB RICT 3 Monticello B 3.3.5.1-29 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued)

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action F.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable, untripped channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or INSERT tripping of channels.

TSB RICT 3 Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE. If either HPCI or RCIC is inoperable, the time is shortened to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable, untripped channel cannot exceed 8 days. If the INSERT status of HPCI or RCIC changes such that the Completion Time changes TSB RICT 1 from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable, untripped channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action F.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.

G.1 and G.2 Required Action G.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within similar ADS trip system Functions result in automatic initiation capability being lost for the ADS.

Automatic initiation capability is lost if either: (a) one Function 4.b channel and one Function 5.b channel are inoperable; or (b) a combination of Functions 4.c, 4.d, 5.c, and 5.d channels are inoperable such that channels associated with five or more low pressure ECCS pumps are inoperable.

Monticello B 3.3.5.1-31 Revision No. 52 TBD

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS (continued)

In this situation (loss of automatic initiation capability), the 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months or 8 day allowance, as applicable, of Required Action G.2 is not appropriate, and all ADS valves must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of ADS initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action G.1, the Completion Time only begins upon discovery that the ADS cannot be automatically initiated due to inoperable channels within similar ADS trip system Functions as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it INSERT TSB minimizes risk while allowing time for restoration or tripping of channels.

RICT 3 Because of the diversity of sensors available to provide initiation signals and the redundancy of the ECCS design, an allowable out of service time of 8 days has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status if both HPCI and RCIC are OPERABLE (Required Action G.2). If either HPCI or RCIC is inoperable, the time shortens to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months . If the status of HPCI or RCIC changes such that the Completion Time changes from 8 days to 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months , the 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months begins upon discovery of HPCI or RCIC inoperability. However, the total time for an inoperable channel cannot exceed 8 days. If the status of HPCI or RCIC changes such that the Completion Time changes from 96 hours0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months to 8 days, the "time zero" for beginning the 8 day "clock" begins upon discovery of the inoperable channel. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, Condition H must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action would not necessarily result in a safe state for the channel in all events.

INSERT TSB RICT 1 H.1 With any Required Action and associated Completion Time not met, the associated feature(s) may be incapable of performing the intended function, and the supported feature(s) associated with inoperable untripped channels must be declared inoperable immediately.

Monticello B 3.3.5.1-32 Revision No. 52 TBD

RCIC System Instrumentation B 3.3.5.2 BASES ACTIONS (continued)

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1 and B.2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level - Low Low channels in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not credited in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

INSERT TSB RICT 3 Monticello B 3.3.5.2-5 Revision No. 52 TBD

RCIC System Instrumentation B 3.3.5.2 INSERT BASES TSB RICT 3 ACTIONS (continued) inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool).

Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction source could drain down the RCIC suction piping), Condition E must be entered and its Required Action taken.

within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC System REQUIREMENTS instrumentation Function are found in the SRs column of Table 3.3.5.2-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows: (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Function 2; and (b) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1 and 3, provided the associated Function maintains RCIC initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a parameter on other similar channels. It is based on the assumption that instrument channels monitoring the same parameter should read Monticello B 3.3.5.2-7 Revision No. 52 TBD

Primary Containment Isolation Instrumentation B 3.3.6.1 INSERT BASES TSB RICT 2 ACTIONS (continued)

(refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue with no further restrictions. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an isolation),

Condition C must be entered and its Required Action taken.

B.1 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in redundant primary containment isolation capability being lost for the associated penetration flow path(s). The MSL, Primary Containment, most of the RWCU System, Shutdown Cooling System Reactor Vessel Water Level - Low, and TIP Isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that both trip systems will generate a trip signal from the given Function on a valid signal. The other isolation Functions are considered to be maintaining primary containment isolation capability when sufficient channels are OPERABLE or in trip, such that one trip system will generate a trip signal from the given Function on a valid signal. This ensures that one of the two PCIVs in the associated penetration flow path can receive an isolation signal from the given Function. For Functions 1.a, 1.b, 2.a, 2.b, 5.a, 5.b, 5.c, 5.e, 6.b, 7.a, and 7.b, this would require both trip systems to have one channel OPERABLE or in trip. For Function 1.c, this would require both trip systems to have one channel, associated with each MSL, OPERABLE or in trip. Function 1.d channels monitor several locations within a given area (e.g., different locations within the main steam tunnel area).

However, since any channel can detect a leak in any area, this would require both trip systems to have one channel OPERABLE or in trip. For Functions 3.a, 4.a, and 5.d, this would require one trip system to have one channel OPERABLE or in trip. For Function 3.b, this would require one channel in each trip string to be OPERABLE or in trip for the trip system. For Function 4.b, this would require one channel in each trip string to be OPERABLE or in trip for one trip system. For Functions 3.c and 4.c, eight channels monitor each area. These channels are arranged in two sets of four detectors, with each set of detectors arranged in a one-out-of-two-twice logic. Therefore, this would require a set in each area to have sufficient channels OPERABLE or in the tripped condition for one trip system.

Monticello B 3.3.6.1-18 Revision No. 52 TBD

Mechanical Vacuum Pump Isolation Instrumentation B 3.3.7.2 BASES APPLICABILITY The mechanical vacuum pump isolation is required to be OPERABLE in MODES 1 and 2 when the mechanical vacuum pump is in service (i.e.,

taking suction on the main condenser) and any main steam line not isolated, to mitigate the consequences of a postulated CRDA. In this condition, fission products released during a CRDA could be discharged directly to the environment. Therefore, the mechanical vacuum pump isolation is necessary to assure conformance with the radiological evaluation of the CRDA. In MODE 3, 4 or 5 the consequences of a control rod drop are insignificant, and are not expected to result in any fuel damage or fission product releases. In MODES 1 or 2 when the mechanical vacuum pump is not in operation or the main steam lines are isolated, fission product releases via this pathway would not occur.

ACTIONS A Note has been provided to modify the ACTIONS related to mechanical vacuum pump isolation instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for inoperable mechanical vacuum pump isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable mechanical vacuum pump isolation instrumentation channel.

INSERT A.1 and A.2 TSB RICT 2 With one or more channels inoperable, but with mechanical vacuum pump isolation capability maintained (refer to Required Action B.1 Bases),

the mechanical vacuum pump isolation instrumentation is capable of performing the intended function. However, the reliability and redundancy of the mechanical vacuum pump isolation instrumentation is reduced, such that a single failure in one of the remaining channels could result in the inability of the mechanical vacuum pump isolation instrumentation to perform the intended function. Therefore, only a limited time is allowed to restore the inoperable channels to OPERABLE status. Because of the low probability of extensive number of inoperabilities affecting multiple channels, and the low probability of an event requiring the initiation of the mechanical vacuum pump isolation, 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months has been shown to be acceptable (Ref. 3) to permit restoration of any inoperable channel to OPERABLE status (Required Action A.1). Alternately, the inoperable channel may be placed in trip (Required Action A.2), since this would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. As noted, Monticello B 3.3.7.2-3 Revision No. 52 TBD

LOP Instrumentation B 3.3.8.1 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

2. 4.16 kV Essential Bus Degraded Voltage A reduced voltage condition on a 4.16 kV essential bus indicates that, while offsite power may not be completely lost to the respective essential bus, available power may be insufficient for starting large ECCS motors without risking damage to the motors that could disable the ECCS function. Therefore, power supply to the bus is transferred from offsite power to onsite EDG power when the voltage on the bus drops below the 4.16 kV Essential Bus Degraded Voltage Function Allowable Values (degraded voltage with a time delay). This ensures that adequate power will be available to the required equipment.

The 4.16 kV Essential Bus Degraded Voltage Allowable Values are low enough to prevent inadvertent power supply transfer, but high enough to ensure that sufficient power is available to the required equipment. The Time Delay Allowable Values are long enough to provide time for the offsite power supply to recover to normal voltages, but short enough to ensure that sufficient power is available to the required equipment.

Three channels of 4.16 kV Essential Bus Degraded Voltage Function per associated bus are only required to be OPERABLE when the associated EDG is required to be OPERABLE to ensure that no single instrument failure can preclude the EDG function. (Three channels input to each of the two essential buses and EDGs.) Refer to LCO 3.8.1 and LCO 3.8.2 for Applicability Bases for the EDGs.

ACTIONS A Note has been provided to modify the ACTIONS related to LOP instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable LOP instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable LOP instrumentation channel.

INSERT A.1 TSB RICT 3 With one or more channels of a Function inoperable, the Function is not capable of performing the intended function. Therefore, only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to restore the inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the Monticello B 3.3.8.1-4 Revision No. 52 TBD

S/RVs B 3.4.3 BASES ACTIONS (continued)

The 14 day Completion Time to restore the inoperable required S/RVs to OPERABLE status is based on the relief capability of the remaining S/RVs, the low probability of an event requiring S/RV actuation, and a reasonable time to complete the Required Action.

INSERT B.1 and B.2 TSB RICT 2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If the safety function of the inoperable required S/RVs cannot be restored to OPERABLE status within the associated Completion Time of Required Action A.1, or if the safety function of three or more required S/RVs is inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This Surveillance requires that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 1. The demonstration of the S/RV safety lift settings must be performed during shutdown, since this is a bench test, to be done in accordance with the INSERVICE TESTING PROGRAM. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The S/RV setpoint is +/- 3% for OPERABILITY; however, the valves are reset to +/- 1% during the Surveillance to allow for drift.

SR 3.4.3.2 This Surveillance verifies that each S/RV is capable of being opened, which can be determined by either of two means, i.e., Method 1 or Method 2. Applying Method 1, approved in Reference 5, valve OPERABILITY and setpoints for overpressure protection are verified in accordance with the ASME OM Code. Applying Method 2, a manual actuation of the S/RV is performed to verify that the valve is functioning properly.

Monticello B 3.4.3-3 Revision No. 49 TBD

ECCS - Operating B 3.5.1 BASES ACTIONS (continued)

INSERT B.1 TSB RICT 2 If a LPCI subsystem is inoperable for reasons other than Condition A, or a CS subsystem is inoperable, the inoperable low pressure injection/spray subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining OPERABLE subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

INSERT C.1 TSB RICT 2 If one LPCI pump in each subsystem is inoperable, one inoperable LPCI pump must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE ECCS subsystems, concurrent with a LOCA, may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 11) that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

INSERT D.1 TSB RICT 2 If two LPCI subsystems are inoperable for reasons other than Condition C or H, one inoperable subsystem must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, the remaining OPERABLE CS subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced, because a single failure in one of the remaining CS subsystems, concurrent with a LOCA, may result in ECCS not being able to perform its intended safety function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on a reliability study cited in Reference 11 that evaluated the impact on ECCS availability, assuming various components and subsystems were taken out of service; and on previous BWR licensing precedents, and was approved for Monticello by Amendment Monticello B 3.5.1-7 Revision No. 54 TBD

ECCS - Operating B 3.5.1 BASES ACTIONS (continued) 162 (Reference 14). The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowable repair times (i.e., Completion Times).

E.1, E.2 and E.3 If any one low pressure CS subsystem is inoperable in addition to either one LPCI subsystem OR one or two LPCI pump(s), adequate core cooling is ensured by the OPERABILITY of HPCI and the remaining low pressure ECCS subsystems. This condition results in a complement of remaining OPERABLE low pressure ECCS (i.e., one CS and either two or three LPCI pumps) whose makeup capacity is bounded by the minimum makeup capacity evaluated in the accident analysis, which assumes the limiting single component failure (Reference 10). However, overall ECCS reliability is reduced, because a single active component failure in the remaining low pressure ECCS, concurrent with a design basis LOCA, could result in the minimum required ECCS equipment not being available. Since both a CS subsystem is inoperable and a reduction in the makeup capability of the LPCI System has occurred, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either a CS subsystem or, either a LPCI subsystem OR the LPCI pump(s) to OPERABLE status. The Completion Time was developed using engineering judgment based on a reliability study cited in Reference 11, previous BWR licensing precedents, and approved for Monticello by Amendment 162 (Reference 14). This Completion Time has been found to be acceptable through operating experience.

INSERT 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months F.1 and F.2 TSB RICT 2 If any Required Action and associated Completion Time of Condition A, B, C, D, or E is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Monticello B 3.5.1-8 Revision No. 54 TBD

ECCS - Operating B 3.5.1 BASES ACTIONS (continued)

G.1 If two LPCI subsystems are inoperable due to open RHR intertie return line isolation valve(s), the RHR intertie line must be isolated within 18 hours2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months . The line can be isolated by closing both RHR intertie return line isolation valves or by closing one RHR intertie return line isolation valve and the RHR intertie suction line isolation valve. The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months Completion Time is reasonable, considered the low probability of a DBA occurring during this period.

H.1 If the Required Action and associated Completion Time of Condition G is not met, the plant must be brought to a MODE in which the RHR intertie return line isolation valves are not required to be closed. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

INSERT I.1 and I.2 TSB RICT 1 If the HPCI System is inoperable and the RCIC System is verified to be OPERABLE, the HPCI System must be restored to OPERABLE status within 14 days. In this condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY is therefore required immediately when HPCI is inoperable. This may be performed as an administrative check by examining logs or other information to determine if RCIC is out of service for maintenance or other reasons. It does not mean to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. If the OPERABILITY of the RCIC System cannot be immediately verified, however, Condition M must be entered. In the event of component failures concurrent with a design basis LOCA, there is a potential, depending on the specific failures, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

Monticello B 3.5.1-9 Revision No. 54 TBD

ECCS - Operating B 3.5.1 BASES ACTIONS (continued) INSERT J.1 and J.2 TSB RICT 1 If any one low pressure ECCS injection/spray subsystem, or one LPCI pump in both LPCI subsystems, is inoperable in addition to an inoperable HPCI System, the inoperable low pressure ECCS injection/spray subsystem(s) or the HPCI System must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this condition, adequate core cooling is ensured by the OPERABILITY of the ADS and the remaining low pressure ECCS subsystems. However, the overall ECCS reliability is significantly reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since both a high pressure system (HPCI) and a low pressure subsystem(s) are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the HPCI System or the low pressure ECCS injection/spray subsystem(s) to OPERABLE status. This Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

K.1 The LCO requires three ADS valves to be OPERABLE in order to provide the ADS function. The 14 day Completion Time is based on a reliability study cited in Reference 11 and has been found to be acceptable through operating experience.

INSERT TSB RICT 2 L.1 and L.2 If any Required Action and associated Completion Time of Condition I, J, or K is not met, or if one ADS valve is inoperable and Condition A, B, C, D or G are entered, or if two or more ADS valves are inoperable, or if the HPCI System is inoperable and Condition D, E, or G are entered, then the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Monticello B 3.5.1-10 Revision No. 54 TBD

RCIC System B 3.5.3 BASES BACKGROUND (continued) height of the feedwater line connection for RCIC is such that the water in the feedwater lines keeps the remaining portion of the RCIC discharge line full of water. Therefore, RCIC does not require a "keep fill" system.

APPLICABLE The function of the RCIC System is to respond to transient events by SAFETY providing makeup coolant to the reactor. The RCIC System is not an ANALYSES Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. The RCIC System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the low pressure ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity for maintaining RPV inventory during an isolation event. Management of gas voids is important to RCIC System OPERABILITY (Ref. 3).

APPLICABILITY The RCIC System is required to be OPERABLE during MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig, since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure 150 psig, the low pressure ECCS injection/spray subsystems can provide sufficient flow to the RPV. In MODES 4 and 5, RCIC is not required to be OPERABLE since RPV water inventory control is required by LCO 3.5.2, RPV Water Level Inventory Control.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC System. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC System and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

INSERT A.1 and A.2 TSB RICT 1 If the RCIC System is inoperable during MODE 1, or MODE 2 or 3 with reactor steam dome pressure > 150 psig, and the HPCI System is immediately verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days. In this condition, loss of the RCIC System will not affect the overall plant capability to provide Monticello B 3.5.3-2 Revision No. 52 TBD

Primary Containment Air Lock B 3.6.1.2 BASES ACTIONS (continued)

Required Action B.3 is modified by a Note that applies to air lock doors located in high radiation areas or areas with limited access due to inerting and that allows these doors to be verified locked closed by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted.

Therefore, the probability of misalignment of the door, once it has been verified to be in the proper position, is small.

C.1, C.2, and C.3 If the air lock is inoperable for reasons other than those described in Condition A or B, Required Action C.1 requires action to be immediately initiated to evaluate containment overall leakage rates using current air lock leakage test results. An evaluation is acceptable since it is overly conservative to immediately declare the primary containment inoperable if both doors in an air lock have failed a seal test or if the overall air lock leakage is not within limits. In many instances (e.g., only one seal per door has failed), primary containment remains OPERABLE, yet only 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (according to LCO 3.6.1.1) would be provided to restore the air lock door to OPERABLE status prior to requiring a plant shutdown. In addition, even with both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the primary containment air lock must be verified closed. This action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Required Action C.3). The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in the air lock.

INSERT D.1 and D.2 TSB RICT 1 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Monticello B 3.6.1.2-5 Revision No. 52 TBD

PCIVs B 3.6.1.3 BASES INSERT TSB RICT 1 INSERT ACTIONS (continued) TSB RICT 2 lines). The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3. For the main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown.

For affected penetrations that have been isolated in accordance with Required Action A.1, the affected penetration flow path(s) must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside primary containment and capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility. following isolation Condition A is modified by a Note indicating that this Condition is only applicable to those penetration flow paths with two PCIVs. For penetration flow paths with one PCIV, Condition C provides the appropriate Required Actions.

Required Action A.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas, and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.

Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

Monticello B 3.6.1.3-5 Revision No. 52 TBD

PCIVs B 3.6.1.3 BASES ACTIONS (continued) boundary and the small pipe diameter of the affected penetrations. In the event the affected penetration flow path is isolated in accordance with Required Action C.1, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident are isolated. This Required Action does not require any testing or valve manipulation. Rather, it involves verification that these devices outside containment capable of potentially being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. For the devices inside primary containment, the time period specified "prior to entering MODE 2 or 3 from MODE 4 if primary containment was de-inerted while in MODE 4, if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls ensuring that device misalignment is an unlikely possibility. following isolation Condition C is modified by a Note indicating that this Condition is only applicable to penetration flow paths with only one PCIV. For penetration flow paths with two PCIVs, Conditions A and B provide the appropriate Required Actions. This Note is necessary since this Condition is written specifically to address those penetrations with a single PCIV.

Required Action C.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted.

Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

D.1 and D.2 In the event one or more 18 inch primary containment purge and vent valves are not within the purge and vent valve leakage limits, purge and vent valve leakage must be restored to within limits or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed Monticello B 3.6.1.3-7 Revision No. 52 TBD

PCIVs B 3.6.1.3 BASES INSERT ACTIONS (continued)

TSB RICT 3 and de-activated automatic valve, closed manual valve, and blind flange.

If a purge or vent valve with resilient seals is utilized to satisfy Required Action D.1, it must have been demonstrated to meet the leakage requirements of SR 3.6.1.3.11. The specified Completion Time is reasonable, considering that one containment purge or vent valve remains closed so that a gross breach of primary containment does not exist.

following isolation In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be in the isolation position should an event occur. This Required Action does not require any testing or valve manipulation.

Rather, it involves verification that those isolation devices outside containment and potentially capable of being mispositioned are in the correct position. The Completion Time of "once per 31 days for isolation devices outside primary containment" is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low. following isolation Required Action D.2 is modified by two Notes. Note 1 applies to isolation devices located in high radiation areas and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Note 2 applies to isolation devices that are locked, sealed, or otherwise secured in position and allows these devices to be verified closed by use of administrative means. Allowing verification by administrative means is considered acceptable, since the function of locking, sealing, or securing components is to ensure that these devices are not inadvertently repositioned.

E.1 With one or more penetration flow paths with one or more MSIVs not within leakage limits, the assumptions of the safety analysis may not be met. Therefore, the leakage must be restored to within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolated penetration is assumed to be the actual pathway leakage through the isolation device.

If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices.

Monticello B 3.6.1.3-8 Revision No. 52 TBD

Reactor Building-to-Suppression Chamber Vacuum Breakers B 3.6.1.6 BASES ACTIONS (continued)

C.1 With one line with one or more vacuum breakers inoperable for opening, the leak tight primary containment boundary is intact and the remaining OPERABLE vacuum breakers in the other line are capable of providing the vacuum relief function. However, overall system reliability is reduced because a single failure (to open) of one of the vacuum breakers in the other line results in a loss of the vacuum breaker function. Therefore, the inoperable vacuum breaker must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This is consistent with the Completion Time for Condition A and the fact that the leak tight primary containment boundary is being maintained.

INSERT D.1 TSB RICT 1 With two lines with one or more vacuum breakers inoperable for opening, the primary containment boundary is intact. However, in the event of a containment depressurization, the function of the vacuum breakers is lost.

Therefore, all vacuum breakers in one line must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . This Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, which requires that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

E.1 and E.2 If all the vacuum breakers in one line cannot be closed or restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Monticello B 3.6.1.6-4 Revision No. 52 TBD

Suppression Chamber-to-Drywell Vacuum Breakers B 3.6.1.7 BASES APPLICABILITY (continued) of the drywell, which, after the suppression chamber-to-drywell vacuum breakers open (due to excessive differential pressure between the suppression chamber and drywell), would result in depressurization of the suppression chamber. The limiting pressure and temperature of the primary system prior to a DBA occur in MODES 1, 2, and 3. Excessive negative pressure inside the drywell could occur due to inadvertent actuation of drywell sprays.

In MODES 4 and 5, the probability and consequences of these events are reduced by the pressure and temperature limitations in these MODES; therefore, maintaining suppression chamber-to-drywell vacuum breakers OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one of the required vacuum breakers inoperable for opening (e.g.,

the vacuum breaker is not open and may be stuck closed or not within its opening setpoint limit, so that it would not function as designed during an event that depressurized the drywell), the remaining six OPERABLE vacuum breakers are capable of providing the vacuum relief function.

However, overall system reliability is reduced because a single failure in one of the remaining vacuum breakers could result in an excessive suppression chamber-to-drywell differential pressure during a DBA.

Therefore, with one of the seven required vacuum breakers inoperable, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore at least one of the inoperable vacuum breakers to OPERABLE status so that plant conditions are consistent with those assumed for the design basis analysis. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is considered acceptable due to the low probability of an event in which the remaining vacuum breaker capability would not be adequate.

INSERT B.1 TSB RICT 2 An open vacuum breaker allows communication between the drywell and suppression chamber airspace, and, as a result, there is the potential for suppression chamber overpressurization due to this bypass leakage if a LOCA were to occur. Therefore, the open vacuum breaker must be closed. A short time is allowed to close the vacuum breaker due to the low probability of an event that would pressurize primary containment. If vacuum breaker position indication is not reliable, an alternate method of verifying that the vacuum breakers are closed is to verify that the differential pressure decay between the suppression chamber and drywell is maintained within the Allowable Region of Figure B 3.6.1.7-1. The Figure was originally developed from a test performed with a shim holding each vacuum breaker 1/16 inch open at the bottom. The required 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is considered adequate to perform this test.

Monticello B 3.6.1.7-3 Revision No. 52 TBD

RHR Drywell Spray B 3.6.1.8 BASES LCO (continued) safety related independent power supplies. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR drywell spray subsystem is OPERABLE when one of the pumps, the heat exchanger, and associated piping (including drywell spray header and nozzles), valves, instrumentation, and controls are OPERABLE. Management of gas voids is important to RHR Drywell Spray System OPERABILITY (Ref. 4).

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR drywell spray subsystems OPERABLE is not required in MODE 4 or 5.

INSERT ACTIONS A.1 TSB RICT 1 With one RHR drywell spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE RHR drywell spray subsystem is adequate to perform the primary containment bypass leakage mitigation function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced drywell spray mitigation capability. The 7 day Completion Time was chosen in light of the redundant RHR drywell spray capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

B.1 With both RHR drywell spray subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the drywell spray mitigation function.

The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and because alternative methods to remove heat from primary containment are available.

C.1 and C.2 If the inoperable RHR drywell spray subsystem cannot be restored to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and Monticello B 3.6.1.8-2 Revision No. 52 TBD

RHR Suppression Pool Cooling B 3.6.2.3 BASES LCO During a DBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE with power from two safety related independent power supplies. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure.

An RHR suppression pool cooling subsystem is OPERABLE when one of the pumps, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE. Management of gas voids is important to RHR Suppression Pool Cooling System OPERABILITY (Ref. 3).

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.

INSERT ACTIONS A.1 TSB RICT 1 With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this condition, the remaining OPERABLE RHR suppression pool cooling subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

B.1 With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and the potential avoidance of a plant shutdown transient that could result in the need for the RHR suppression pool cooling subsystems to operate.

Monticello B 3.6.2.3-2 Revision No. 52 TBD

RHRSW System B 3.7.1 BASES APPLICABILITY In MODES 1, 2, and 3, the RHRSW System is required to be OPERABLE to support the OPERABILITY of the RHR System for primary containment cooling (LCO 3.6.2.3, "Residual Heat Removal (RHR) Suppression Pool Cooling") and decay heat removal (LCO 3.4.7, "Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown"). The Applicability is therefore consistent with the requirements of these systems.

Although the LCO for the RHRSW System is not applicable In MODES 4 and 5, the capability of the RHRSW System to perform its necessary related support functions may be required for OPERABILITY of the supported systems.

INSERT ACTIONS A.1 TSB RICT 2 Required Action A.1 is intended to handle the inoperability of one RHRSW subsystem. The Completion Time of 7 days is allowed to restore the RHRSW subsystem to OPERABLE status. With the unit in this condition, the remaining OPERABLE RHRSW subsystem is adequate to perform the RHRSW heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE RHRSW subsystem could result in loss of RHRSW function. The Completion Time is based on the redundant RHRSW capabilities afforded by the OPERABLE subsystem and the low probability of an event occurring requiring RHRSW during this period.

7 day The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

B.1 With both RHRSW subsystems inoperable, the RHRSW System is not capable of performing its intended function. At least one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time for restoring one RHRSW subsystem to OPERABLE status, is based on the Completion Times provided for the RHR suppression pool cooling function.

The Required Action is modified by a Note indicating that the applicable Conditions of LCO 3.4.7, be entered and Required Actions taken if the inoperable RHRSW subsystem results in inoperable RHR shutdown cooling. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components.

Monticello B 3.7.1-3 Revision No. 52 TBD

ESW System and UHS B 3.7.2 BASES LCO The ESW subsystems are independent of each other to the degree that each has separate controls, power supplies, and the operation of one does not depend on the other. In the event of a DBA, one subsystem of ESW is required to provide the minimum heat removal capability assumed in the safety analysis for the system to which it supplies cooling water. To ensure this requirement is met, two subsystems of ESW must be OPERABLE. At least one subsystem will operate, if the worst single active failure occurs coincident with the loss of offsite power.

A subsystem is considered OPERABLE when it has an OPERABLE UHS, one OPERABLE pump, and an OPERABLE flow path capable of taking suction from the intake structure and transferring the water to the appropriate equipment.

The OPERABILITY of the UHS is based on having a minimum water level in the pump well of the intake structure of 899 ft mean sea level and a maximum water temperature of 90°F.

The isolation of the ESW System to components or systems may render those components or systems inoperable, but does not affect the OPERABILITY of the ESW System. The core spray pump motors do not require emergency service water flow through the motor cooler for the core spray pump to remain OPERABLE. However, cooling water flow shall be restored to extend the motor thrust bearings oil life (Ref. 2).

Cooling water flow should be restored at the next available opportunity.

APPLICABILITY In MODES 1, 2, and 3, the ESW System and UHS are required to be OPERABLE to support OPERABILITY of the equipment serviced by the ESW System. Therefore, the ESW System and UHS are required to be OPERABLE in these MODES.

Although the LCO for the ESW System and UHS is not applicable in MODES 4 and 5, the capability of the ESW System and UHS to perform their necessary related support functions may be required for OPERABILITY of the supported systems.

INSERT ACTIONS A.1 TSB RICT 1 With one ESW subsystem inoperable, the ESW subsystem must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With the unit in this condition, the remaining OPERABLE ESW subsystem is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE ESW subsystem could result in loss of ESW function.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on the redundant ESW System capabilities afforded by the OPERABLE subsystem and the low probability of an accident occurring during this time period.

Monticello B 3.7.2-2 Revision No. 52 TBD

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

The remaining OPERABLE required offsite circuit and EDGs are adequate to supply electrical power to the onsite Class 1E AC Electrical Power Distribution System. Thus, on a component basis, single failure protection may have been lost for the required feature's function; however, function is not lost. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

INSERT A.3 TSB RICT 2 Consistent with Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition A for a period that should not exceed 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With one required offsite circuit inoperable, the reliability of the offsite system is degraded, and the potential for a loss of offsite power is increased, with attendant potential for a challenge to the plant safety systems. In this condition, however, the remaining OPERABLE required offsite circuit and EDGs are adequate to supply electrical power to the onsite Class 1E Distribution System.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

B.1 To ensure a highly reliable power source remains with one EDG inoperable, it is necessary to verify the availability of the required offsite circuits on a more frequent basis. Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met. However, if a required offsite circuit fails to pass SR 3.8.1.1, it is inoperable. Upon required offsite circuit inoperability, additional Conditions must then be entered.

B.2 Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that an EDG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single division Monticello B 3.8.1-7 Revision No. 52 TBD

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable EDG cannot be confirmed not to exist on the remaining EDG, performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of that EDG.

In the event the inoperable EDG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the plant corrective action program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time to confirm that the OPERABLE EDG is not affected by the same problem as the inoperable EDG.

B.4 In Condition B, the remaining OPERABLE EDG and required offsite circuits are adequate to supply electrical power to the onsite Class 1E AC Electrical Power Distribution System. The 7 day Completion Time takes into account the capacity and capability of the remaining AC sources, a reasonable time for repairs, and the low probability of a DBA occurring during this period.

INSERT TSB RICT 2 C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of inoperability of redundant required features concurrent with inoperability of two required offsite circuits. Required Action C.1 reduces the vulnerability to a loss of function. The Completion Time for taking these actions is reduced to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months from that allowed with one division without offsite power (Required Action A.2). The rationale for the reduction to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate.

These features are designed with redundant safety related divisions, (i.e.,

single division systems are not included in the list). Redundant required features failures consist of any of these features that are inoperable because any inoperability is on a division redundant to a division with inoperable offsite circuits.

Monticello B 3.8.1-9 Revision No. 52 TBD

AC Sources - Operating B 3.8.1 BASES ACTIONS (continued)

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC sources two less than required by the LCO, operation may continue for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . If two required offsite sources are restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , unrestricted operation may continue. If only one required offsite source is restored within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , power operation continues in accordance with Condition A.

INSERT TSB RICT 2 D.1 and D.2 Pursuant to LCO 3.0.6, the Distribution Systems - Operating ACTIONS would not be entered even if all AC sources to it were inoperable, resulting in de-energization. Therefore, the Required Actions of Condition D are modified by a Note to indicate that when Condition D is entered with no AC source to any 4.16 kV essential bus (i.e., the bus is de-energized), ACTIONS for LCO 3.8.7, "Distribution Systems -

Operating," must be immediately entered. This allows Condition D to provide requirements for the loss of the required offsite circuit and one EDG without regard to whether a division is de-energized. LCO 3.8.7 provides the appropriate restrictions for a de-energized division.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in Condition D for a period that should not exceed 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In Condition D, individual redundancy is lost in both the offsite electrical power system and the onsite AC electrical power system. Since power system redundancy is provided by two diverse sources of power, however, the reliability of the power systems in this Condition may appear higher than that in Condition C (loss of both required offsite circuits). This difference in reliability is offset by the susceptibility of this power system configuration to a single bus or switching failure. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a DBA occurring during this period.

INSERT TSB RICT 2 E.1 With two EDGs inoperable, there is no remaining standby AC source.

Thus, with an assumed loss of offsite electrical power, insufficient standby AC sources are available to power the minimum required ESF functions.

Since the offsite electrical power system is the only source of AC power for the majority of ESF equipment at this level of degradation, the risk associated with continued operation for a very short time could be less than that associated with an immediate controlled shutdown. (The immediate shutdown could cause grid instability, which could result in a total loss of AC power.) Since any inadvertent unit generator trip could Monticello B 3.8.1-11 Revision No. 52 TBD

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the battery will be restored to its fully charged condition (Required Action A.2) from any discharge that might have occurred due to the charger inoperability.

A discharged battery having terminal voltage of at least the minimum established float voltage indicates that the battery is on the exponential charging current portion (the second part) of its recharge cycle. The time to return a battery to its fully charged state under this condition is simply a function of the amount of the previous discharge and the recharge characteristic of the battery. Thus there is good assurance of fully recharging the battery within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , avoiding a premature shutdown with its own attendant risk.

If established battery terminal float voltage cannot be restored to greater than or equal to the minimum established float voltage within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , and the charger is not operating in the current-limiting mode, a faulty charger is indicated. A faulty charger that is incapable of maintaining established battery terminal float voltage does not provide assurance that it can revert to and operate properly in the current limit mode that is necessary during the recovery period following a battery discharge event that the DC system is designed for.

If the charger is operating in the current limit mode after 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months that is an indication that the battery is partially discharged and its capacity margins will be reduced. The time to return the battery to its fully charged condition in this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps for 250 VDC batteries and less than or equal to 1 amp for 125 VDC batteries. This indicates that, if the battery had been discharged as the result of the inoperable battery charger, it has now been fully recharged. If at the expiration of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period the battery float current is not less than or equal to 2 amps this indicates there may be additional battery problems and the battery must be declared inoperable.

Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum INSERT TSB RICT 1 Monticello B 3.8.4-5 Revision No. 52 TBD

DC Sources - Operating B 3.8.4 BASES ACTIONS (continued) established float voltage has been used (e.g., balance of plant non-Class 1E battery charger). The 7 day Completion Time reflects a reasonable time to effect restoration of the qualified battery charger to OPERABLE status.

INSERT B.1 TSB RICT 2 Condition B represents one division with a loss of ability to completely respond to an event, and a potential loss of ability to remain energized during normal operation. It is therefore imperative that the operator's attention focus on stabilizing the unit, minimizing the potential for complete loss of DC power to the affected division. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is consistent with the allowed time for an inoperable DC Distribution System division.

If one of the required DC electrical power subsystems is inoperable for reasons other than Condition A (e.g., inoperable battery charger(s) and associated inoperable batteries), the remaining DC electrical power subsystems have the capacity to support a safe shutdown and to mitigate an accident condition. Since a subsequent worst case single failure could, however, result in the loss of minimum necessary DC electrical subsystems to mitigate a worst case accident, continued power operation should not exceed 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on Regulatory Guide 1.93 (Ref. 8) and reflects a reasonable time to assess unit status as a function of the inoperable DC electrical power subsystem and, if the DC electrical power subsystem is not restored to OPERABLE status, to prepare to effect an orderly and safe unit shutdown.

C.1 and C.2 If the inoperable 125 VDC or 250 VDC electrical power subsystem cannot be restored to OPERABLE status within the required Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide 1.93 (Ref. 8).

Monticello B 3.8.4-6 Revision No. 52 TBD

Distribution Systems - Operating B 3.8.7 BASES APPLICABILITY (continued)

b. Adequate core cooling is provided, and containment OPERABILITY and other safety functions are maintained in the event of a postulated DBA.

Electrical power distribution subsystem requirements for MODES 4 and 5 and other conditions in which AC and DC electrical power distribution subsystems are required are covered in the Bases for LCO 3.8.8, "Distribution Systems - Shutdown."

ACTIONS A.1 With one or more Division 1 and Division 2 required AC buses or load centers inoperable and a loss of function has not occurred, the remaining AC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required AC buses and load centers must be restored to OPERABLE INSERT status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

TSB RICT 2 The Condition A worst scenario is one division without AC power (i.e., no offsite power to the division and the associated EDG inoperable). In this situation, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit and restoring power to the affected division. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this Condition is acceptable because of:

a. The potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit; and

b. The low potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.10, "Safety Function Determination Program (SFDP).")

Required Action A.1 is modified by a Note that requires the applicable Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating,"

to be entered for DC divisions made inoperable by inoperable power Monticello B 3.8.7-4 Revision No. 52 TBD

Distribution Systems - Operating B 3.8.7 BASES ACTIONS (continued) distribution subsystems. This is an exception to LCO 3.0.6 and ensures the proper actions are taken for these components. Inoperability of a distribution system can result in loss of charging power to batteries and eventual loss of DC power. This Note ensures that the appropriate attention is given to restoring charging power to batteries, if necessary, after loss of distribution systems.

B.1 With one or more DC distribution panel(s) inoperable, and a loss of function has not yet occurred, the remaining DC electrical power distribution subsystem is capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystem could result in the minimum required ESF functions not being supported. Therefore, the required DC electrical power distribution subsystem(s) must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated battery or charger.

INSERT Condition B worst scenario is one division without adequate DC power, TSB RICT 1 potentially with both the battery significantly degraded and the associated charger nonfunctioning. In this situation the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the majority of components that would be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, which would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;

b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power, while not providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division; and Monticello B 3.8.7-5 Revision No. 52 TBD

ATTACHMENT 4 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b CROSS REFERENCE OF TSTF-505 AND MNGP TECHNICAL SPECIFICATIONS (PROVIDED FOR INFORMATION ONLY)

(14 Pages Follow)

L-MT-20-003 NSPM Cross-Reference of TSTF-505 and MNGP Technical Specifications Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments Completion Times 1.3 1.3 Example 1.3-8 [NEW TS] [NEW TS] No The MNGP TS do not currently contain this 1.3-8 1.3-8 example. Example to be added to the TS to be consistent with TSTF-505. This is a new definition only (i.e., there is no RICT directly applicable to the TS).

Standby Liquid Control (SLC) System 3.1.7 3.1.7 One SLC subsystem inoperable [for 3.1.7.B 3.1.7.B Yes TSTF-505 changes are incorporated.

reasons other than Condition A].

Reactor Protection System (RPS) 3.3.1.1 3.3.1.1 Instrumentation One or more required channels 3.3.1.1.A.1 3.3.1.1.A.1 Yes MNGP TS contains a NOTE which is not contained inoperable. 3.3.1.1.A.2 3.3.1.1.A.2 Yes in NUREG-1433 which limits Required Action A.2 from being applied to MNGP TS 3.3.1.1 Functions 2.a, 2.b, 2.c, 2.d, 2.f, and 2.g. The MNGP Function 2, Average Power Range Monitors, design differs from that assumed in NUREG-1433. See Enclosure 1 of this submittal for further detail.

Under certain circumstances, with more than one required channel inoperable, a loss of function can occur. Condition C would be entered with a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time and no RICT. Therefore, TSTF505 changes are incorporated.

Page 1 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments One or more Functions with one or more 3.3.1.1.B.1 3.3.1.1.B.1 Yes MNGP TS contains a NOTE which is not contained required channels inoperable in both trip 3.3.1.1.B.2 3.3.1.1.B.2 Yes in NUREG-1433 which limits Condition B from systems. being applied to MNGP TS 3.3.1.1 Functions 2.a, 2.b, 2.c, 2.d, 2.f, and 2.g. The MNGP Function 2, Average Power Range Monitors, design differs from that assumed in NUREG-1433. See Enclosure 1 of this submittal for further detail.

Under certain circumstances, with more than one required channel inoperable, a loss of function can occur. Condition C would be entered with a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time and no RICT. Therefore, TSTF505 changes are incorporated.

Source Range Monitor (SRM) 3.3.1.2 3.3.1.2 Instrumentation One or more required SRMs inoperable 3.3.1.2.A.1 3.3.1.2.A.1 No NSPM has determined there is negligible benefit to in MODE 2 with intermediate range applying a RICT to this Condition in the MNGP TS.

monitors (IRMs) on Range 2 or below. Therefore, TSTF-505 changes are not incorporated.

Feedwater and Main Turbine High 3.3.2.2 3.3.2.2 Water Level Trip Instrumentation One feedwater and main turbine high 3.3.2.2.A.1 3.3.2.2.A.1 Yes Under certain circumstances, with more than one water level trip channel inoperable. required channel inoperable, a loss of function can occur. Condition B would be entered with a 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time and no RICT. Therefore, TSTF-505 changes are incorporated.

Page 2 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments Two or more feedwater and main turbine 3.3.2.2.B.1 3.3.2.2.B.1 No The wording of the MNGP TS differs from that in high water level trip channels inoperable. NUREG-1433. The MNGP TS wording is for level trip capability not maintained, which represents loss of function. Therefore, TSTF-505 changes are not incorporated.

End of Cycle Recirculation Pump Trip 3.3.4.1 -

(EOC-RPT) Instrumentation One or more required channels 3.3.4.1.A.1 - No The MNGP TS do not contain this TS. Therefore, inoperable. 3.3.4.1.A.2 - No TSTF-505 changes are not incorporated.

Anticipated Transient Without Scram 3.3.4.2 3.3.4.1 Recirculation Pump Trip (ATWS-RPT)

Instrumentation One or more channels inoperable. 3.3.4.2.A.1 3.3.4.1.A.1 Yes Under certain circumstances, with more than one 3.3.4.2.A.2 3.3.4.1.A.2 Yes required channel inoperable, a loss of function can occur. Condition B would be entered with a 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time and no RICT. Therefore, TSTF-505 changes are incorporated.

Emergency Core Cooling System 3.3.5.1 3.3.5.1 (ECCS) Instrumentation As required by Required Action A.1 and 3.3.5.1.B.3 3.3.5.1.B.3 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.1-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

Page 3 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments As required by Required Action A.1 and 3.3.5.1.C.2 3.3.5.1.C.2 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.1-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

As required by Required Action A.1 and 3.3.5.1.D.2.1 3.3.5.1.D.2.1 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.1-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

As required by Required Action A.1 and 3.3.5.1.E.2 3.3.5.1.E.2 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.1-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

As required by Required Action A.1 and 3.3.5.1.F.2 3.3.5.1.F.2 Yes The RICT insert format is modified from TSTF-505, referenced in Table 3.3.5.1-1. Revision 2, to align with MNGP TS 1.2, "Logical Connectors", direction to only use first level logic for Completion Times.

Under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

Page 4 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments As required by Required Action A.1 and 3.3.5.1.G.2 3.3.5.1.G.2 Yes The RICT insert format is modified from TSTF-505, referenced in Table 3.3.5.1-1. Revision 2, to align with MNGP TS 1.2, "Logical Connectors", direction to only use first level logic for Completion Times.

Under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

Reactor Core Isolation Cooling (RCIC) 3.3.5.2 3.3.5.2 System Instrumentation As required by Required Action A.1 and 3.3.5.2.B.2 3.3.5.2.B.2 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.2-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

As required by Required Action A.1 and 3.3.5.2.D.2.1 3.3.5.2.D.2.1 Yes Under certain circumstances, with more than one referenced in Table 3.3.5.2-1. channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

Page 5 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments Primary Containment Isolation 3.3.6.1 3.3.6.1 Instrumentation One or more required channels 3.3.6.1.A.1 3.3.6.1.A.1 Yes The RICT insert format is modified from TSTF-505, inoperable. Revision 2, to align with MNGP TS 1.2, "Logical Connectors", direction to only use first level logic for Completion Times.

Under certain circumstances, with more than one required channel inoperable, a loss of function can occur. Condition B would be entered with a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time and no RICT. TSTF-505 changes are incorporated.

Low-Low Set (LLS) Instrumentation 3.3.6.3 3.3.6.3 One or more LLS valves with one or 3.3.6.3.A.1 3.3.6.3.A.2 No Consistent with a RICT not being applied to MNGP more channels inoperable. TS 3.6.1.5, Low-Low Set (LLS) Valves, NSPM does not propose to add a RICT to the LLS valve instrumentation. Therefore, TSTF505 changes are not incorporated.

Page 6 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments Mechanical Vacuum Pump Isolation - 3.3.7.2 Instrumentation

[MNGP TS Condition] - 3.3.7.2.A.1 Yes This LCO is MNGP plant-specific and therefore not One or more channels inoperable. 3.3.7.2.A.2 Yes in NUREG-1433 or TSTF-505 Revision 2.

Under certain circumstances, with more than one required channel inoperable, a loss of function can occur. Condition B would be entered with a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time and no RICT.

Therefore, changes consistent with TSTF505 are incorporated.

Loss of Power (LOP) Instrumentation 3.3.8.1 3.3.8.1 One or more channels inoperable. 3.3.8.1.A.1 3.3.8.1.A.1 Yes Under certain circumstances, with more than one channel inoperable, a loss of function may occur.

Therefore, a Note is added to the Completion Time which prohibits applying a RICT when a loss of function has occurred. TSTF-505 changes are incorporated.

Safety/Relief Valves (S/RVs) 3.4.3 3.4.3

[ One [or two] [required] S/RV[s] 3.4.3.A.1 3.4.3.A.1 Yes TSTF-505 changes are incorporated.

inoperable.

Page 7 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments ECCS - Operating 3.5.1 3.5.1 One low pressure ECCS injection/spray 3.5.1.A.1 - No The MNGP TS do not contain this TS. Therefore, subsystem inoperable. TSTF-505 changes are not incorporated.

OR One LPCI pump in both LPCI subsystems inoperable.

[MNGP TS Condition] - 3.5.1.B.1 Yes This is a MNGP plant-specific Condition. MNGP One LPCI subsystem inoperable for TS Condition B does not involve loss of function as reasons other than Condition A. the remaining OPERABLE ECCS subsystems provide adequate core cooling during a loss of OR coolant accident (LOCA). Therefore, changes consistent with TSTF-505 are incorporated.

One Core Spray subsystem inoperable.

[MNGP TS Condition] - 3.5.1.C.1 Yes This is a MNGP plant-specific Condition. MNGP One LPCI pump in both LPCI TS Condition C does not involve loss of function as subsystems inoperable. the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA.

Therefore, changes consistent with TSTF-505 are incorporated.

[MNGP TS Condition] - 3.5.1.D.1 Yes This is a MNGP plant-specific Condition. MNGP Two LPCI subsystems inoperable for TS Condition D does not involve a loss of function reasons other than Condition C or G. as the remaining OPERABLE ECCS subsystems provide adequate core cooling during a LOCA.

Therefore, changes consistent with TSTF-505 are incorporated.

Page 8 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments

[MNGP TS Condition] - 3.5.1.E.1 Yes This is a MNGP plant-specific Condition. MNGP One Core Spray subsystem inoperable. - 3.5.1.E.2 Yes Condition E does not involve a loss of function as

- 3.5.1.E.3 Yes the remaining ECCS subsystems provide AND adequate core cooling during a LOCA. Therefore, changes consistent with TSTF-505 are One LPCI subsystem inoperable. incorporated.

OR One or two LPCI pump(s) inoperable.

HPCI System inoperable. 3.5.1.C.2 3.5.1.I.2 Yes TSTF-505 changes are incorporated.

HPCI System inoperable. 3.5.1.D.1 3.5.1.J.1 Yes The wording of MNGP TS Condition J differs from 3.5.1.D.2 3.5.1.J.2 Yes NUREG-1433 Condition D in that it applies to AND HPCI System inoperable and Condition A, B, or C entered. Changes consistent with TSTF-505 are Condition A entered. incorporated.

One ADS valve inoperable. 3.5.1.E.1 3.5.1.K.1 Yes TSTF-505 changes are incorporated.

One ADS valve inoperable. 3.5.1.F.1 - No The MNGP TS do not contain this Condition.

3.5.1.F.2 - No Therefore, TSTF-505 changes are not AND incorporated.

Condition A entered.

[Reactor Core Isolation Cooling 3.5.3 3.5.3 (RCIC)] System RCIC System inoperable. 3.5.3.A.2 3.5.3.A.2 Yes TSTF-505 changes are incorporated.

Primary Containment Air Lock 3.6.1.2 3.6.1.2 Primary containment air lock inoperable 3.6.1.2.C.3 3.6.1.2.C.3 Yes TSTF-505 changes are incorporated.

for reasons other than Condition A or B.

Page 9 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments Primary Containment Isolation Valves 3.6.1.3 3.6.1.3 (PCIVs)

NOTE----------------------- 3.6.1.3.A.1 3.6.1.3.A.1 Yes TSTF-505 changes are incorporated.

Only applicable to penetration flow paths with two [or more] PCIVs.

One or more penetration flow paths with one PCIV inoperable [for reasons other than Condition[s] D [and E)).

[ One or more penetration flow paths 3.6.1.3.E.1 3.6.1.3.D.1 Yes Wording of MNGP TS differs from TSTF-505 (i.e.,

with one or more containment purge MNGP TS uses 18 inch primary containment valves not within purge valve leakage purge and vent valves and purge and vent limits. valve). TSTF-505 changes are incorporated.

Reactor Building-to-Suppression 3.6.1.7 3.6.1.6 Chamber Vacuum Breakers One line with one or more reactor 3.6.1.7.C.1 3.6.1.6.C.1 Yes TSTF-505 changes are incorporated.

building-to-suppression chamber vacuum breakers inoperable for opening.

Two [or more] lines with one or more 3.6.1.7.D.1 3.6.1.6.D.1 No The MNGP design only includes two lines.

reactor building-to-suppression chamber Consequently, the MNGP TS Condition does not vacuum breakers inoperable for opening. contain the or more wording from NUREG-1433.

Therefore, for MNGP, two lines with one or more reactor building-to-suppression chamber vacuum breakers inoperable for opening constitutes a loss of function. Therefore, TSTF-505 changes are not incorporated.

Suppression Chamber-to-Drywell 3.6.1.8 3.6.1.7 Vacuum Breakers Page 10 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments One required suppression chamber-to- 3.6.1.8.A.1 3.6.1.7.A.1 Yes TSTF-505 changes are incorporated.

drywell vacuum breaker inoperable for opening.

Residual Heat Removal (RHR) Drywell - 3.6.1.8 Spray

[MNGP TS Condition] - 3.6.1.8.A.1 Yes This is a MNGP plant-specific Condition. The One RHR drywell spray subsystem MNGP safety analyses take credit for the operation inoperable. of the drywell spray function, not the suppression pool spray function. MNGP TS Condition A does not involve a loss of function. Therefore, TSTF-505 changes are incorporated.

Residual Heat Removal (RHR) 3.6.2.3 3.6.2.3 Suppression Pool Cooling One RHR suppression pool cooling 3.6.2.3.A.1 3.6.2.3.A.1 Yes TSTF-505 changes are incorporated.

subsystem inoperable.

Residual Heat Removal (RHR) 3.6.2.4 -

Suppression Pool Spray One RHR suppression pool spray 3.6.2.4.A.1 - No See MNGP TS 3.6.1.8 - the MNGP TS do not subsystem inoperable. contain this TS. Therefore, TSTF-505 changes are not incorporated.

[Drywell Cooling System Fans] 3.6.3.1 -

Two [required] [drywell cooling system 3.6.3.1.B.2 - No The MNGP TS do not contain this TS. Therefore, fans] inoperable. TSTF-505 changes are not incorporated.

Residual Heat Removal Service Water 3.7.1 3.7.1 (RHRSW) System Page 11 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments One RHRSW pump in each subsystem 3.7.1.B.1 - No The MNGP TS do not contain this Condition.

inoperable. Therefore, TSTF-505 changes are not incorporated.

One RHRSW subsystem inoperable for 3.7.1.C.1 3.7.1.A.1 Yes Wording of MNGP TS differs from TSTF-505 (i.e.,

reasons other than Condition A. MNGP TS does not have Condition A from NUREG-1433/TSTF-505). TSTF-505 changes are incorporated.

[Plant Service Water (PSW)] System 3.7.2 3.7.2 and [Ultimate Heat Sink (UHS)]

One [PSW] pump in each subsystem 3.7.2.B.1 - No The MNGP TS do not contain this Condition.

inoperable. Therefore, TSTF-505 changes are not incorporated.

[ One or more cooling towers with one 3.7.2.C.1 - No The MNGP TS do not contain this Condition.

cooling tower fan inoperable. Therefore, TSTF-505 changes are not incorporated.

One [PSW] subsystem inoperable for 3.7.2.E.1 3.7.2.A.1 Yes Wording of MNGP TS differs from TSTF-505 (i.e.,

reasons other than Condition[s] A [and MNGP TS does not have Condition A or C from C]. NUREG-1433/TSTF-505 and uses Emergency Service Water (ESW) instead of PSW). TSTF-505 changes are incorporated.

The Main Turbine Bypass System 3.7.7 3.7.7

[Requirements of the LCO not met or 3.7.7.A.1 3.7.7.A.1 No The MNGP Main Turbine Bypass System design Main Turbine Bypass System only includes two bypass valves. Therefore, one inoperable]. bypass valve inoperable results in a loss of function. Therefore, TSTF-505 changes are not incorporated.

AC Sources - Operating 3.8.1 3.8.1 Page 12 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments One [required] offsite circuit inoperable. 3.8.1.A.3 3.8.1.A.3 Yes TSTF-505 changes are incorporated.

One [required] DG inoperable. 3.8.1.B.4 3.8.1.B.4 Yes TSTF-505 changes are incorporated.

Two [required] offsite circuits inoperable. 3.8.1.C.2 3.8.1.C.2 Yes TSTF-505 changes are incorporated.

One [required] offsite circuit inoperable. 3.8.1.D.1 3.8.1.D.1 Yes TSTF-505 changes are incorporated.

3.8.1.D.2 3.8.1.D.2 Yes AND One [required] DG inoperable.

[ One [required] [automatic load 3.8.1.F.1 - No The MNGP TS do not contain this Condition.

sequencer] inoperable. Therefore, TSTF-505 changes are not incorporated.

DC Sources - Operating 3.8.4 3.8.4 One [or two] battery charger[s on one 3.8.4.A.3 3.8.4.A.3 Yes Wording of MNGP TS differs from TSTF-505 (i.e.,

division] inoperable. MNGP TS added the term required since each 250 VDC subsystem has two battery chargers and a spare, but only two are required to be OPERABLE in each 250 VDC subsystem. In addition, each 125 VDC subsystem has one battery charger, with a spare battery charger that is common to both 125 VDC subsystems. Lastly, MNGP Condition A contains Division 1 or Division 2 specific to plant nomenclature). TSTF-505 changes are incorporated.

One [or two] batter[y][ies on one division] 3.8.4.B.1 - No The MNGP TS do not contain this Condition.

inoperable. Therefore, TSTF-505 changes are not incorporated.

Page 13 of 14

L-MT-20-003 NSPM Table A4-1: Cross-Reference of TSTF-505 and MNGP Technical Specifications TSTF-505 Tech Spec Section Title / TSTF-505 MNGP Apply Condition Description TS TS RICT? Comments One DC electrical power subsystem 3.8.4.C.1 3.8.4.B.1 Yes Wording of MNGP TS differs from TSTF-505 (i.e.,

inoperable for reasons other than MNGP TS added the term Division 1 or Division 2 Condition A [or B]. specific to plant nomenclature). TSTF-505 changes are incorporated.

Inverters - Operating 3.8.7 -

One [required] inverter inoperable. 3.8.7.A.1 - No The MNGP TS do not contain this TS. Therefore, TSTF-505 changes are not incorporated.

Distribution Systems - Operating 3.8.9 3.8.7 One or more AC electrical power 3.8.9.A.1 3.8.7.A.1 Yes TSTF-505 changes are incorporated.

distribution subsystems inoperable.

[ One or more AC vital buses inoperable. 3.8.9.B.1 - No The MNGP TS do not contain this Condition.

Therefore, TSTF-505 changes are not incorporated.

One or more [station service] DC 3.8.9.C.1 3.8.7.B.1 Yes TSTF-505 changes are incorporated.

electrical power distribution subsystems inoperable.

Programs and Manuals 5.5 5.5 Programs and Manuals 5.5.18 5.5.16 No The MNGP TS do not currently contain this program. The new RICT Program will be added to the MNGP TS 5.5.18 consistent with TSTF-505.

Page 14 of 14

ATTACHMENT 5 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b MNGP RICT PROGRAM PRA IMPLEMENTATION ITEMS (1 Page Follows)

L-MT-20-003 NSPM RICT Program PRA Implementation Items

1.0 INTRODUCTION

The table below identifies the items that are required to be completed prior to implementation of the Risk Informed Completion Time (RICT) Program at the Monticello Nuclear Generating Plant (MNGP). All issues identified below will be addressed and any associated changes will be made, focused-scope peer reviews will be performed on changes that are PRA upgrades as defined in the PRA standard (ASME/ANS RA-Sa-2009, as endorsed by RG 1.200, Revision 2), and any findings will be resolved and reflected in the PRA of record prior to implementation of the RICT Program.

Table A5-1: RICT Program PRA Implementation Items No. Implementation Items

1. NSPM shall ensure that Reactor Protection System RPS Instrumentation is modeled in the MNGP PRA with the sufficient detail to accurately calculate a RICT prior to implementation of the RICT Program.

2. NSPM shall ensure that Mechanical Vacuum Pump system and isolation instrumentation are modeled in the MNGP PRA with sufficient detail to accurately calculate a RICT prior to implementation of the RICT Program.

3. NSPM shall ensure that the Automatic Depressurization System (ADS) and instrumentation is modeled in the MNGP PRA with sufficient detail to accurately calculate a RICT prior to implementation of the RICT Program.

Page 1 of 1

ENCLOSURE 1 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b LIST OF REVISED REQUIRED ACTIONS TO CORRESPONDING PRA FUNCTIONS (60 Pages Follow)

L-MT-20-003 NSPM List of Revised Required Actions to Corresponding PRA Functions

1.0 INTRODUCTION

Section 4.0, Limitations and Conditions, Item 2 of the NRC Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS)

Guidelines, Revision 0 (Reference 2), identifies the following needed content:

The license amendment request (LAR) will provide identification of the TS Limiting Conditions for Operation (LCOs) and action requirements to which the RMTS will apply.

The LAR will provide a comparison of the TS functions to the PRA modeled functions of the structures, systems, and components (SSCs) subject to those LCO actions.

The comparison should justify that the scope of the PRA model, including applicable success criteria such as number of SSCs required, flow rate, etc., are consistent with licensing basis assumptions (i.e., 50.46 [Emergency Core Cooling System (ECCS)]

flowrates) for each of the TS requirements, or an appropriate disposition or programmatic restriction will be provided.

This enclosure provides confirmation that the Monticello Nuclear Generating Plant (MNGP)

PRA models include the necessary scope of SSCs and their functions to address each proposed application of the Risk-Informed Completion Time (RICT) Program to the proposed scope TS LCO Conditions, and provides the information requested for Section 4.0, Item 2 of the NRC Final Safety Evaluation. The scope of the comparison includes each of the TS LCO conditions and associated required actions within the scope of the RICT Program.

Table E1-1 below lists each TS LCO Condition to which the RICT Program is proposed to be applied and documents the following information regarding the TSs with the associated safety analyses, the analogous PRA functions and the results of the comparison:

Column Tech Spec

Description:

Lists all of the LCOs and condition statements within the scope of the RICT Program.

Column SSCs Covered by TS LCO Condition and Applicable Mode(s): The SSCs addressed by each action requirement and the Modes in which they apply relative to the MNGP RICT Program. Note that SSCs not applicable to the MNGP RICT Program are not listed.

Column Modeled in PRA?: Indicates whether the SSCs addressed by the TS LCO Condition are included in the PRA.

Column Function Covered by TS LCO Condition: Lists a summary of the required functions from the design basis analyses.

Page 1 of 60

L-MT-20-003 NSPM

Column Design Success Criteria: A summary of the success criteria from the design basis analyses.

Column PRA Success Criteria: The function success criteria modeled in the PRA.

Column Comments: Provides the justification or resolution to address any inconsistencies between the TS and PRA functions regarding the scope of SSCs and the success criteria. Where the PRA scope of SSCs is not consistent with the TS, additional information is provided to describe how the LCO condition can be evaluated using appropriate surrogate events. Differences in the success criteria for TS functions are addressed to demonstrate the PRA criteria provide a realistic estimate of the risk of the TS condition as required by NEI 06-09-A, Revision 0.

The corresponding SSCs for each TS LCO and the associated TS functions are identified and compared to the PRA. This description also includes the design success criteria and the applicable PRA success criteria. Any differences between the scope or success criteria are described in the table. Scope differences are justified by identifying appropriate surrogate events which permit a risk evaluation to be completed using the Configuration Risk Management Program tool for the RICT Program. Differences in success criteria typically arise due to the requirement in the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter ASME/ANS PRA Standard)

(Reference 3) to make PRAs realistic rather than bounding, whereas design basis criteria are necessarily conservative and bounding. The use of realistic success criteria is necessary to conform to capability Category II of the ASME/ANS PRA standard as required by NEI 06-09-A, Revision 0.

Examples of calculated RICT are provided in Table E1-2 for each individual Condition to which the RICT applies (assuming no other SSCs modeled in the PRA are unavailable). These example calculations demonstrate the scope of the SSCs covered by TSs modeled in the PRA. Note that the more limiting of the core damage frequency (CDF) and large early release frequency (LERF) RICT result is shown.

Following implementation of the RICT Program, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 06-09-A and the NRC Final Safety Evaluation. The actual RICT values may differ from the RICTs presented in this enclosure.

Page 2 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.1.7.B One [Standby Two SLC subsystems Yes Provide a One of two SLC Same PRA also credits Liquid Control (Mode 1 & 2) backup subsystems the control rod (SLC)] capability for drive hydraulics subsystem bringing the system for inoperable for reactor from full reactivity control reasons other power to a cold, in non-than xenon free anticipated Condition A. shutdown transient without a SCRAM (ATWS) events.

3.3.1.1.A One or more Intermediate Range required Monitors (IRMs) channels inoperable. Function 1.a, eight No Reactor Trip One Neutron Flux - None (Notes 1 and 2)

Neutron Flux - High Initiation High High channel High channels (two (SCRAM) in each RPS trip IRM channels per system Reactor Protection System (RPS) logic channel)

(Mode 2)

Function 1.b, eight No SCRAM One Inop. channel None (Notes 1 and 2)

Inop. channels (two in each RPS trip IRM channels per system RPS logic channel)

(Mode 2)

Page 3 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Average Power Range Monitors Function 2.a, four No SCRAM Two Neutron Flux - None (Notes 1, 2, and Neutron Flux - High High (Setdown) 3)

(Setdown) channels channels (Mode 2)

Function 2.b, four No SCRAM Two Simulated None (Notes 1, 2, and Simulated Thermal Thermal Power - 3)

Power - High High channels channels (Mode 1)

Function 2.c, four No SCRAM Two Neutron Flux - None (Notes 1, 2, and Neutron Flux - High High channels 3) channels (Mode 1)

Function 2.d, four No SCRAM Two Inop channels None (Notes 1, 2, and Inop. channels 3)

(Mode 1)

Function 2.e, four No SCRAM One 2-Out-Of-4 None (Notes 1, 2, and 2Out-Of-4 Voter Voter channel in 3) channels each RPS trip (Mode 1 & 2) system Page 4 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 2.f, four No SCRAM Two Oscillation None (Notes 1, 2, and

[Oscillation Power Power Range 3)

Range Monitor Monitor Upscale (OPRM)] Upscale channels channels

( 20% RTP)

Function 2.g, four No SCRAM Two Extended Flow None (Notes 1, 2, and Extended Flow Window Stability - 3)

Window Stability - High channels High channels (Within EFW boundary defined in COLR)

Function 3, four Reactor No SCRAM One Reactor None (Notes 1 and 2)

Vessel Steam Dome Vessel Steam Pressure - High Dome Pressure -

channels High channel in (Mode 1 & 2) each RPS trip system Function 4, four Reactor No SCRAM One Reactor None (Notes 1 and 2)

Vessel Water Level - Vessel Water Level Low channels - Low channel in (Mode 1 & 2) each RPS trip system Page 5 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 5, sixteen Main No SCRAM One of two Main None (Notes 1, 2, and Steam Isolation Valve - Steam Isolation 4)

Closure channels (four Valve - Closure Main Steam Isolation channels in three of Valve - Closure four steam lines) channels per RPS logic channel)

(Mode 1; Mode 2 with reactor pressure 600 psig)

Function 6, four Drywell No SCRAM One Drywell None (Notes 1 and 2)

Pressure - High Pressure - High channels channel in each of (Mode 1 & 2) two trip systems Scram Discharge Volume Water Level -

High Function 7.a, four No SCRAM One Resistance None (Notes 1 and 2)

Resistance Temperature Temperature Detector Detector channel in channels each RPS trip (Mode 1 & 2) system or one RTD channel in one trip system and one Float Switch channel in the other trip system Page 6 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 7.b, four No SCRAM One Float Switch None (Notes 1 and 2)

Float Switch channels channel in each (Mode 1 & 2) RPS trip system or one Float Switch channel in one trip system and one RTD channel in the other trip system Function 8, eight No SCRAM Three Turbine Stop None (Notes 1, 2, and Turbine Stop Valve - Valve - Closure 5)

Closure channels (two channels in each of Turbine Stop Valve - two trip systems Closure channels per RPS logic channel)

(> 40% RTP)

Function 9, four Turbine No SCRAM One Turbine None (Notes 1 and 2)

Control Valve Fast Control Valve Fast Closure, Acceleration Closure, Relay Oil Pressure - Acceleration Relay Low channels (two Oil Pressure - Low instruments per RPS channel in each logic channel) RPS trip system

(> 40% RTP)

Page 7 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.1.1.B ------NOTE------ See 3.3.1.1.A above, with the exception of the following Functions excluded by the Condition Not applicable NOTE:

for Functions 2.a, 2.b, 2.c, Average Power Range Monitors 2.d, 2.f or 2.g.

Function 2.a, Neutron Flux - High, (Setdown)

Function 2.b, Simulated Thermal Power - High One or more

Function 2.c, Neutron Flux - High Functions with

Function 2.d, Inop.

one or more

Function 2.f, OPRM Upscale required

Function 2.g, Extended Flow Window Stability - High channels inoperable in both trip systems.

3.3.2.2.A One or more Four Reactor Vessel Yes Trip of One specific Same (Note 15) feedwater Water Level - High Feedwater Reactor Vessel pump and channels Pumps and Main Water Level - High main turbine (THERMAL POWER Turbine channel in each of high water 25% RTP) two trip systems or level trip both channels in a channels trip system inoperable.

3.3.4.1.A One or more Function a, four Reactor Yes Trip both Two Reactor Same channels Vessel Water Level - Recirculation Vessel Water Level inoperable. Low Low channels Pumps - Low Low (Mode 1) channels in either of two trip systems Page 8 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function b, four Reactor Yes Trip Both Two Reactor Same Vessel Steam Dome Recirculation Vessel Steam Pressure - High Pumps Dome Pressure -

channels High channels in (Mode 1) either of two trip systems 3.3.5.1.B As required by Core Spray (CS)

Required System Action A.1 and referenced in Function 1.a, four Yes Actuate both CS One specific Same (Note 15)

Table 3.3.5.1- Reactor Vessel Water system divisions Reactor Vessel

1. Level - Low Low and the Water Level - Low channels associated EDG Low channel in (Mode 1 & 2) each of two actuation systems or both channels in an actuation system for a given CS division Function 1.b, four Yes Actuate both CS One specific Same (Note 15)

Drywell Pressure - system divisions Drywell Pressure -

High channels and the High channel in (Mode 1 & 2) associated EDG each of two actuation systems or both channels in an actuation system for a given CS division Page 9 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Low Pressure Coolant Injection (LPCI) System Function 2.a, four Yes Actuate both One specific Same (Note 15)

Reactor Vessel Water LPCI system Reactor Vessel Level - Low Low divisions Water Level - Low channels Low channel in (Mode 1 & 2) each of two actuation systems or both channels in an actuation system for a given LPCI division Function 2.b, four Yes Actuate both One specific Same (Note 15)

Drywell Pressure - LPCI system Drywell Pressure -

High channels divisions High channel in (Mode 1 & 2) each of two actuation systems or both channels in an actuation system for a given LPCI division Page 10 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 2.f, sixteen Yes Actuate both Two Low Pressure Same Low Pressure Coolant LPCI system Coolant Injection Injection Pump Start - divisions Pump Start - Time Time Delay Relay Delay Relays in channels (four relays one logic channel in each of two logic of each of two LPCI channels in each actuation systems LPCI actuation system)

(Mode 1 & 2)

Function 2.h, four Not Actuate both One specific Same (Notes 6 and 15)

Reactor Steam Dome explicitly LPCI system Reactor Steam Pressure - Low divisions Dome Pressure -

(Break Detection) Low (Break channels Detection) channel (Mode 1 & 2) in each of two actuation systems or both channels in an actuation system for a given LPCI division Function 2.k, two Not Actuate one One Reactor Steam Same (Note 6)

Reactor Steam Dome explicitly LPCI system Dome Pressure -

Pressure - Time division Time Delay Relay Delay Relay (Break (Break Detection)

Detection) channels channel to actuate (Mode 1 & 2) one LPCI division Page 11 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments HPCI System Function 3.a, four Yes Actuate HPCI One specific Same (Note 15)

Reactor Vessel Water system Reactor Vessel Level - Low Low Water Level - Low channels Low channel in (Mode 1; Mode 2 with each of two LPCI reactor steam dome actuation systems pressure > 150 psig) or both channels in an actuation system Function 3.b, four Yes Actuate HPCI One Drywell Same (Note 15)

Drywell Pressure - system Pressure - High High channels channel in each of (Mode 1; Mode 2 with two CS actuation reactor steam dome systems or both pressure > 150 psig) channels in an actuation system 3.3.5.1.C As required by CS System Required Action A.1 and Function 1.c, two Yes Permit CS One Reactor Steam Same referenced in Reactor Steam Dome System Dome Pressure -

Table 3.3.5.1- Pressure - Low Actuation Low (Injection

1. (Injection Permissive) Permissive) channels channel (Mode 1 & 2)

Page 12 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 1.d, two Yes Permit CS One Reactor Steam Same Reactor Steam Dome System Dome Pressure Pressure Permissive Actuation Permissive - Low

- Low (Pump (Pump Permissive)

Permissive) channels channel from either (Mode 1 & 2) CS division Function 1.e, two Not Permit CS One Reactor Steam Same (Note 7)

Reactor Steam Dome explicitly System Dome Pressure Pressure Permissive Actuation Permissive -

- Bypass Timer Bypass Timer (Pump Permissive) (Pump Permissive) channels channel from either (Mode 1 & 2) CS division Function 1.f, two Core Yes Permit CS One Core Spray Same Spray Pump Start - System Pump Start - Time Time Delay Relay Actuation Delay Relay channels channel per pump (Mode 1 & 2)

LPCI System Function 2.c, two Yes Permit actuation One Reactor Steam Same Reactor Steam Dome of both LPCI Dome Pressure -

Pressure - Low divisions Low (Injection (Injection Permissive) Permissive) channels channel (Mode 1 & 2)

Page 13 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 2.d, two Yes Permit actuation One Reactor Steam Same Reactor Steam Dome of both LPCI Dome Pressure Pressure Permissive divisions Permissive - Low

- Low (Pump (Pump Permissive)

Permissive) channels channel (Mode 1 & 2)

Function 2.e, two Not Permit actuation One Reactor Steam Same (Note 7)

Reactor Steam Dome explicitly of one LPCI Dome Pressure Pressure Permissive division Permissive -

- Bypass Timer Bypass Timer (Pump Permissive) (Pump Permissive) channels channel (Mode 1 & 2)

Function 2.i, eight Not Actuate either One of two Same (Note 6)

Recirculation Pump explicitly LPCI pump in channels of Differential Pressure - each LPCI Recirculation Pump High (Break division Differential Detection) channels Pressure - High (Mode 1 & 2) (Break Detection) from each LPCI division Page 14 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 2.j, four Not Actuate both One specific Same (Notes 6 and 15)

Recirculation Riser explicitly LPCI Divisions Recirculation Riser Differential Pressure - Differential High (Break Pressure - High Detection) channels (Break Detection)

(Mode 1 & 2) channel in each of two actuation systems or both channels in an actuation system Function 2.l, two Not Actuate one One Recirculation Same (Note 6)

Recirculation Pump explicitly LPCI division Pump Differential Differential Pressure - Pressure - Time Time Delay Relay Delay Relay (Break (Break Detection) Detection) channel channels (Mode 1 & 2)

Function 2.m, two Not Actuate/de- One Recirculation Same (Note 6)

Recirculation Riser explicitly actuate both Riser Differential Differential Pressure - LPCI divisions Pressure - Time Time Delay Relay Delay Relay (Break (Break Detection) Detection) channel channels (Mode 1 & 2)

Page 15 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.5.1.D As required by HPCI System Required Action A.1 and Function 3.d, two Yes Change HPCI One Condensate Same referenced in Condensate Storage suction path Storage Tank Level Table 3.3.5.1- Tank Level - Low - Low channel

1. channels (Mode 1; Mode 2 with reactor steam dome pressure > 150 psig)

Function 3.e, two Yes Change HPCI One Suppression Same Suppression Pool suction path Pool Water Level -

Water Level - High High channel channels (Mode 1; Mode 2 with reactor steam dome pressure > 150 psig) 3.3.5.1.E As required by LPCI System Required Action A.1 and Function 2.g, four Low Not Delay bypass One Low Pressure Same (Note 8) referenced in Pressure Coolant explicitly flow for one Coolant Injection Table 3.3.5.1- Injection Pump LPCI pump on Pump Discharge

1. Discharge Flow - Low pump startup Flow - Low (Bypass) channels (Bypass) channel (Mode 1 & 2) per LPCI pump Page 16 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.5.1.F As required by Automatic Required Depressurization Action A.1 and System (ADS) Trip referenced in Systems A and B Table 3.3.5.1-

1. Functions 4.a and 5.a, Not Actuate all ADS Two Reactor Same (Note 9) four Reactor Vessel explicitly valves Vessel Water Level Water Level - Low - Low Low Low channels channels in either (Mode 1; Mode 2 with of two ADS reactor steam dome actuation systems pressure > 150 psig) 3.3.5.1.G As required by ADS Trip Systems A Required and B Action A.1 and referenced in Functions 4.b and 5.b, Not Actuate all ADS One Automatic Same (Note 9)

Table 3.3.5.1- two Automatic explicitly valves Depressurization

1. Depressurization System Initiation System Initiation Timer channel on Timer channels each ADS actuation (Mode 1; Mode 2 with system reactor steam dome pressure > 150 psig)

Functions 4.c and 5.c, Not Actuate all ADS One Core Spray Same (Note 9) four Core Spray Pump explicitly valves Pump Discharge Discharge Pressure - Pressure - High High channels channel from one of (Mode 1; Mode 2 with two CS pumps reactor steam dome pressure > 150 psig)

Page 17 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Functions 4.d and 5.d, Not Actuate all ADS One Low Pressure Same (Note 9) eight Low Pressure explicitly valves Coolant Injection Coolant Injection Pump Discharge Pump Discharge Pressure - High Pressure - High channel from one of channels two sets of LPCI (Mode 1; Mode 2 with pumps reactor steam dome pressure > 150 psig) 3.3.5.2.B As required by Function 1, four Reactor Yes Actuate RCIC One specific Same (Note 15)

Required Vessel Water Level - Reactor Vessel Action A.1 and Low Low channels Water Level - Low referenced in (Mode 1; Mode 2 with Low channel in Table 3.3.5.2- reactor steam dome each of two CS

1. pressure > 150 psig) actuation systems or both channels in an actuation system 3.3.5.2.D As required by Function 3, two Yes Change RCIC One Condensate Same Required Condensate Storage suction path Storage Tank Level Action A.1 and Tank Level - Low - Low channels referenced in channels Table 3.3.5.2- (Mode 1; Mode 2 with

1. reactor steam dome pressure > 150 psig)

Page 18 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.6.1.A One or more Main Steam Line required Isolation channels inoperable. Function 1.a, four Not Main Steam Line Two Reactor Same (Note 10)

Reactor Vessel Water explicitly Isolation Vessel Water Level Level - Low Low - Low Low channels channels in either (Mode 1 & 2) of two trip systems Function 1.b, four Not Main Steam Line Two Main Steam Same (Note 10)

Main Steam Line explicitly Isolation Line Pressure -

Pressure - Low Low channels in channels either of two trip (Mode 1) systems Function 1.c, sixteen Not Main Steam Line Two Main Steam Same (Note 10)

Main Steam Line Flow explicitly Isolation Line Flow - High

- High channels (four channels in either instruments per of two trip systems Primary Containment Isolation logic channel)

(Mode 1 & 2)

Page 19 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Function 1.d, sixteen Not Main Steam Line Two Main Steam Same (Note 10)

Main Steam Line explicitly Isolation Line Tunnel Tunnel Temperature - Temperature -

High channels (four High channels in instruments per either of two trip Primary Containment systems Isolation logic channel)

(Mode 1 & 2)

Primary Containment Isolation Function 2.a, four Not Primary One Reactor Same (Note 10)

Reactor Vessel Water explicitly Containment Vessel Water Level Level - Low channels Isolation - Low channel in (Mode 1 & 2) each of two trip systems Function 2.b, four Not Primary One Drywell Same (Note 10)

Drywell Pressure - explicitly Containment Pressure - High High channels Isolation channel in each of (Mode 1 & 2) two trip systems Page 20 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments HPCI System Isolation Function 3.a, two Not HPCI Isolation One HPCI Steam Same (Note 10)

HPCI Steam Line explicitly Line Flow - High Flow - High channels channel in either of (Mode 1 & 2) two logic systems causes isolation in two isolation systems Function 3.b, four Not HPCI Isolation Two specific HPCI Same (Note 10)

HPCI Steam Supply explicitly Steam Supply Line Line Pressure - Low Pressure - Low channels channels (Mode 1 & 2)

Function 3.c, sixteen Not HPCI Isolation Two specific HPCI Same (Note 10)

HPCI Steam Line explicitly Steam Line Area Area Temperature - Temperature -

High (four instruments High channels in per HPCI logic either of two logic channel) channels causes (Mode 1 & 2) isolation in two isolation systems Page 21 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments RCIC System Isolation Function 4.a, two Not RCIC Isolation One RCIC Steam Same (Note 10)

RCIC Steam Line explicitly Line Flow - High Flow - High channels channel in either of (Mode 1 & 2) two logic systems causes isolation in two isolation systems Function 4.b, four Not RCIC Isolation Two specific RCIC Same (Note 10)

RCIC Steam Supply explicitly Steam Supply Line Line Pressure - Low Pressure - Low channels channels cause (Mode 1 & 2) isolation in two isolation systems Function 4.c, sixteen Not RCIC Isolation Two specific RCIC Same (Note 10)

RCIC Steam Line explicitly Steam Line Area Area Temperature - Temperature -

High channels High channels in (Mode 1 & 2) either of two logic channels cause isolation in two isolation systems Page 22 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Reactor Water Cleanup (RWCU) System Isolation Function 5.a, four Not RWCU Isolation One RWCU Flow - Same (Note 10)

RWCU Flow - High explicitly High channel in channels each of two trip (Mode 1 & 2) systems Function 5.b, four Not RWCU Isolation One RWCU Room Same (Note 10)

RWCU Room explicitly Temperature -

Temperature - High High channel in channels each of two trip (Mode 1 & 2) systems Function 5.c, four Not RWCU Isolation One Drywell Same (Note 10)

Drywell Pressure - explicitly Pressure - High High channels channel in each of (Mode 1 & 2) two trip systems Function 5.d, two SLC Not RWCU Isolation One SLC System Same (Note 10)

System Initiation explicitly Initiation channel in channels each of two trip (Mode 1 & 2) systems Function 5.e, four Not RWCU Isolation One Reactor Same (Note 10)

Reactor Vessel Water explicitly Vessel Water Level Level - Low Low - Low Low channel channels in each of two trip (Mode 1 & 2) systems Page 23 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments Shutdown Cooling System Isolation Function 6.a, four Not Shutdown One Reactor Steam Same (Note 10)

Reactor Steam Dome explicitly Cooling System Dome Pressure -

Pressure - High Isolation High channel in channels each of two trip (Mode 1 & 2) systems Traversing Incore Probe System Isolation Function 7.a, four Not Traversing One Reactor Same (Note 10)

Reactor Vessel Water explicitly Incore Probe Vessel Water Level Level - Low channels System Isolation - Low channel in (Mode 1 & 2) each of two trip systems Function 7.b, four Not Traversing One Drywell Same (Note 10)

Drywell Pressure - explicitly Incore Probe Pressure - High High channels System Isolation channel in each of (Mode 1 & 2) two trip systems 3.3.7.2.A One or more Four channels of Main No Mechanical One Main Steam Note 11 (Note 11) channels Steam Line Tunnel Vacuum Pump Line Tunnel inoperable. Radiation - High Isolation in a Radiation - High instrumentation Control Rod channel in each of (Mode 1 & 2 with the Drop Accident two trip systems mechanical vacuum pump in service and any main steam line not isolated)

Page 24 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.3.8.1.A One or more Function 1, eight Not Sense Essential One 4.16 kV Same (Note 12) channels channels of 4.16 kV explicitly Bus Loss of Essential Bus Loss inoperable. Essential Bus Loss of Voltage and of Voltage channel Voltage (four Transfer to in each of two sets instruments per logic EDGs per bus division)

(Mode 1 & 2) 4.16 kV Essential Bus Degraded Voltage Function 2.a, six Not Sense Essential Two Bus Same (Note 12) channels of Bus explicitly Bus Degraded Undervoltage Undervoltage (three Voltage and channels per bus instruments per logic transfer to EDGs division)

(Mode 1 & 2)

Function 2.b, six Not Sense Essential Two Time Delay Same (Note 12) channels of Time explicitly Bus Degraded channels per bus Delay (three Voltage and instruments per logic transfer to EDGs channel)

(Mode 1 & 2) 3.4.3.A One or two Seven S/RVs Yes Reactor Five S/RVs Non-ATWS:

required (Mode 1 & 2) Pressure Vessel Two S/RVs

[Safety/Relief Overpressure Valves Protection (RPV) ATWS:

(S/RVs)] Three S/RVs inoperable.

Page 25 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.5.1.B One [Low Two LPCI subsystems Yes Low pressure One LPCI One LPCI Pressure and two Core Spray injection into the subsystem and two subsystem with Coolant subsystems RPV Core Spray one of two pumps Injection (Mode 1; Mode 2, subsystems injecting into the (LPCI)] except high pressure reactor vessel.

subsystem coolant injection (HPCI) OR inoperable for and ADS valves are not OR reasons other required to be Two LPCI than OPERABLE with reactor subsystems and One CS Condition A. steam dome pressure one Core Spray subsystem 150 psig) subsystem injecting into the OR reactor vessel.

One Core Spray subsystem inoperable.

3.5.1.C One LPCI Four LPCI pumps Yes Low pressure One LPCI pump in Same as PRA pump in both (Mode 1; Mode 2, injection into the each LPCI Success Criteria LPCI except high pressure RPV subsystem for TS 3.5.1.B subsystems coolant injection (HPCI) inoperable. and ADS valves are not (further design required to be diversity exists OPERABLE with reactor through the steam dome pressure remaining ECCS 150 psig) subsystems as well as the RCIC System)

Page 26 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.5.1.D Two LPCI Two LPCI subsystems Yes Low pressure Two CS Same as PRA subsystems (Mode 1; Mode 2, injection into the subsystems Success Criteria inoperable for except high pressure RPV for TS 3.5.1.B reasons other coolant injection (HPCI) (further design than Condition and ADS valves are not diversity exists C or G. required to be through the HPCI OPERABLE with reactor System; as well as steam dome pressure the RCIC System) 150 psig) 3.5.1.E One Core Two CS subsystems Yes Low pressure One CS subsystem Same as PRA Spray and two LPCI injection into the and one LPCI Success Criteria subsystem subsystems including RPV subsystem for TS 3.5.1.B inoperable. four LPCI pumps (two LPCI pumps per LPCI OR AND subsystem)

(Mode 1; Mode 2, One CS subsystem One LPCI except high pressure and two LPCI subsystem coolant injection (HPCI) pumps inoperable. and ADS valves are not required to be (further design OR OPERABLE with reactor diversity exists steam dome pressure through the HPCI One or two 150 psig) System; as well as LPCI pump(s) the RCIC System) inoperable.

Page 27 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.5.1.I HPCI System One HPCI System Yes High Pressure (One of one HPCI Feedwater Based on inoperable. (Mode 1; Mode 2, Injection into the System inoperable) subsystems thermal except high pressure RPV hydraulic coolant injection (HPCI) Two LPCI OR calculations, and ADS valves are not subsystems and feedwater or required to be two Core Spray One RCIC RCIC can OPERABLE with reactor subsystems in System provide steam dome pressure conjunction with the adequate 150 psig) Automatic OR makeup for high Depressurization pressure System (ADS) ADS in injection.

conjunction with (further design one of four LCPI diversity exists pumps or one of through the RCIC two CS pumps System)

Page 28 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.5.1.J HPCI System One HPCI System, two Yes RPV Inventory (One of one HPCI Feedwater Based on inoperable. LPCI subsystems Control and System inoperable) subsystems; or thermal (containing four total Decay Heat RCIC; or one out hydraulic AND LPCI pumps), and two Removal Three LPCI pumps of four LPCI calculations, Core Spray subsystems (Condition A); or pumps; or one CS feedwater or Condition A, B, (Mode 1; Mode 2, one LPCI subsystem RCIC can or C entered. except high pressure subsystem or one provide coolant injection (HPCI) Core Spray adequate and ADS valves are not subsystem makeup for high required to be (Condition B); or pressure OPERABLE with reactor one LPCI pump in injection. One of steam dome pressure each LPCI the low pressure 150 psig) subsystem injection/spray (Condition C), in pumps (LPCI or conjunction with CS) is adequate ADS when depressurized (further design diversity exists through the RCIC System) 3.5.1.K One ADS Three ADS valves Yes RPV Rapid Three ADS valves Two ADS valves valve (Mode 1; Mode 2, Depressurization inoperable. except high pressure coolant injection (HPCI) and ADS valves are not required to be OPERABLE with reactor steam dome pressure 150 psig)

Page 29 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.5.3.A RCIC System One RCIC System Yes Supply High (One of one RCIC Same inoperable. (Mode 1; Mode 2 with Pressure System inoperable) reactor steam dome Makeup Water to pressure > 150 psig) the RPV One HPCI System 3.6.1.2.C Primary One primary Not Isolate Primary One of two primary Same (Note 13) containment containment air lock explicitly Containment containment air air lock (Mode 1 & 2) during Personnel lock doors closed inoperable for Entry and Exit with acceptable reasons other containment than Condition leakage per LCO A or B. 3.6.1.1 3.6.1.3.A ------NOTE------ Primary Containment Yes Limit Fission One of two Primary One isolation Lines less than Only Isolation Valves Product Release Containment valve in each 2 inches in applicable to (Mode 1 & 2) during and Isolation Valves per modeled diameter are penetration following penetration penetration. screened from flow paths with Postulated LERF and thus two PCIVs. Design Basis are not modeled

Accidents and have no One or more (DBAs) quantitative penetration impact on LERF flow paths with one PCIV inoperable for reasons other than Condition D or E.

Page 30 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.6.1.3.D One or more Seven 18 inch Primary Yes Limit Fission One or more One isolation Lines less than penetration Containment Purge and Product Release penetration flow valve in each 2 inches in flow paths with Vent Valves during and paths with one 18 modeled diameter are one or more 18 (Mode 1 & 2) following inch primary penetration. screened from inch primary Postulated DBAs containment purge LERF and thus containment or vent valve closed are not modeled purge and vent such that gross and have no valves not breach of primary quantitative within purge containment does impact on LERF and vent valve not exist leakage limits.

3.6.1.6.C One line with Four vacuum breakers, Yes Relieve vacuum One line with two Same one or more located two in series when primary vacuum breakers reactor between two parallel containment OPERABLE for building-to- lines depressurizes opening suppression (Mode 1 & 2) below reactor chamber building vacuum pressure.

breakers inoperable for opening.

3.6.1.7.A One required Eight suppression Yes Relieve vacuum Six suppression One suppression suppression chamber-to-drywell in the drywell chamber-to-drywell chamber-to-chamber-to- vacuum breakers vacuum breakers drywell vacuum drywell (Mode 1 & 2) OPERABLE for breaker vacuum opening OPERABLE for breaker opening inoperable for opening.

Page 31 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.6.1.8.A One RHR Two RHR drywell spray Yes Lower Drywell One RHR drywell One of two drywell spray subsystems (each Pressure and spray subsystem pumps in one subsystem containing two pumps) Temperature RHR drywell inoperable. (Mode 1 & 2) following a DBA spray subsystem 3.6.2.3.A One RHR Two RHR suppression Yes Removes Heat One RHR Same suppression pool cooling subsystems from the suppression pool pool cooling (Mode 1 & 2) Suppression cooling subsystem subsystem Pool following a inoperable. DBA 3.7.1.A One [Residual Two RHRSW Yes Provide cooling One RHRSW Same Heat Removal subsystems water for the subsystem Service Water (Mode 1 & 2) RHR System (RHRSW)] heat subsystem exchangers, inoperable. required for a safe shutdown following a DBA or transient 3.7.2.A One Two ESW subsystems No Provide cooling One ESW None Hydraulic

[Emergency (Mode 1 & 2) water for the subsystem analysis has Service Water removal of heat been performed (ESW)] from equipment to show that subsystem required for a emergency inoperable. safe reactor service water shutdown (ESW) is not following a DBA required to or transient prevent CDF or LERF.

Page 32 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.8.1.A One required Three qualified circuits Yes Provide power One qualified circuit Same when offsite circuit consisting of all from offsite to the grid for a offsite power inoperable. breakers, transformers, transmission Class 1E 4.16 kV available switches, interrupting network to onsite essential bus devices, cabling, and Class 1E 4.16 controls to transmit kV essential bus power from the offsite transmission network to the Class 1E 4.16 kV essential bus (Mode 1 & 2) 3.8.1.B One Two EDGs Yes Provide power to One EDG Same when

[Emergency (Mode 1 & 2) onsite Class 1E offsite power not Diesel 4.16 kV essential available Generator bus when offsite (EDG)] power is lost inoperable.

3.8.1.C Two required Three qualified circuits Yes Provide power One qualified circuit Same when offsite circuits consisting of all from offsite to the grid for a offsite power inoperable. breakers, transformers, transmission Class 1E 4.16 kV available switches, interrupting network to onsite essential bus devices, cabling, and Class 1E 4.16 controls to transmit kV essential bus power from the offsite transmission network to the Class 1E 4.16 kV essential bus (Mode 1 & 2)

Page 33 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.8.1.D One required Three qualified circuits Yes Provide power One qualified circuit Offsite Power offsite circuit consisting of all from offsite to the grid and one Available:

inoperable. breakers, transformers, transmission EDG for a Class 1E One offsite circuit switches, interrupting network to onsite 4.16 kV essential AND devices, cabling, and Class 1E 4.16 bus Offsite Power Not controls to transmit kV essential bus Available:

One EDG power from the offsite and provide One EDG for one inoperable. transmission network to power to onsite essential bus the Class 1E 4.16 kV Class 1E 4.16 essential bus and two kV essential bus EDGs when offsite (Mode 1 & 2) power is lost 3.8.4.A One or more Six chargers in the Yes Ensure Two battery Same (Note 14) required 250 VDC electrical availability of chargers for each battery power subsystems; two required DC 250 VDC electrical chargers on normally inservice power to shut power subsystem Division 1 or 125 VDC chargers and down the reactor Division 2 one spare 125 VDC and maintain it in One battery inoperable. charger per division. a safe condition charger for each Three chargers in the 125 VDC electrical 125 VDC subsystems; power subsystem one 125 VDC battery charger in each division plus one spare 125 VDC that can be used on either division.

(Mode 1 & 2)

Page 34 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments 3.8.4.B One Division 1 Two 250 VDC and two Yes Ensure One of two Same or Division 2 125 VDC electrical availability of electrical power DC electrical power subsystems required DC subsystems power (Mode 1 & 2) power to shut subsystem down the reactor inoperable for and maintain it in reasons other a safe condition than Condition A.

3.8.7.A One or more Two AC electrical power Yes Ensure One AC electrical Same AC electrical distribution subsystems availability of power distribution power each consisting of one required AC subsystem capable distribution 4.16 kV essential bus, power to shut of supporting subsystems 480 VAC load centers, down the reactor minimum safety inoperable. and transformers and maintain it in functions (Mode 1 & 2) a safe condition 3.8.7.B One or more Two 125/250 VDC Yes Ensure One DC electrical Same DC electrical electrical power availability of power distribution power distribution systems required DC subsystem capable distribution each consisting of a power to shut of supporting subsystems 125/250 VDC down the reactor minimum safety inoperable. distribution cabinet and and maintain it in functions 125 VDC distribution a safe condition panel (Mode 1 & 2)

Table E1-1 Notes:

1. The RPS is comprised of two independent trip systems (A and B) with three logic channels in each trip system (logic channels A1, A2, and A3, B1, B2, and B3) as described in Reference 3. The automatic trip logics of trip system A are logic channels A1 and A2; Page 35 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments the manual trip logic of trip system A is logic channel A3. Similarly, the trip logics for trip system B are logic channels B1, B2, and B3.

The outputs of the automatic logic channels in a trip system are combined in a one-out-of-two logic so that either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as a one-out-of-two taken twice logic. The outputs of the manual logic channels in a trip system are combined in a one-out-of-one logic. The tripping of both manual logic channels will produce a scram. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for a short time delay after the full scram signal is received.

The short time delay on reset ensures that the scram function will be completed.

2. The RPS is not modeled explicitly in PRA. This RPS is currently modeled by mechanical and electrical failures as point estimates.

These values were driven from quantifying the NUREG/CR 5500 Volume 3 (Reference 7) fault tree. For sample RICT calculations, RPS electrical failure probability was increased by quantification results from failing the modeled channels (functions 3 and 4) in the NUREG/CR 5500 Volume 3 fault tree. These two signals, along with others, are appropriate for several plant upset conditions, such as main steam line isolation valve or MSIV closure, loss of feedwater, and various losses of electrical loads. The PRA model will be updated to include the applicable RPS instrumentation prior to exercising the RICT program for this TS. The RPS modeling will replace the point estimate failure with detailed modeling in accordance with Regulatory Guide 1.200, Revision 2 (Reference 8).

3. The APRM System is divided into four APRM channels and four 2-out-of-4 voter channels. Each APRM channel provides inputs to each of the four voter channels. The four voter channels are divided into two groups of two each; with each group of two providing inputs to one RPS trip system. The system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one un-bypassed APRM will result in a "half-trip in all four of the voter channels, but no trip inputs to either RPS trip system. Because APRM trip Functions 2.a, 2.b, 2.c, 2.f, and 2.g are implemented in the same hardware, these trip Functions are combined with APRM lnop trip Function 2.d. Any Function 2.a, 2.b, 2.c, 2.d, or 2.g trip from any two un-bypassed APRM channels will result in a full trip in each of the four voter channels, which in turn results in two trip inputs into each RPS trip system logic channel (A1, A2, B1 and B2). Similarly, any Function 2.d, 2.f, or 2.g trip from any two un-bypassed APRM channels will result in a full trip from each of the four voter channels.

4. MSIV closure signals are initiated from position switches located on each of the eight MSIVs. Each MSIV has two position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve - Closure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve

- Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a scram to occur.

Page 36 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments

5. Turbine Stop Valve - Closure signals are initiated from position switches located on each of the four TSVs. One position switch and two independent contacts are associated with each stop valve. One of the two contacts provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve - Closure channels, each consisting of one position switch. The logic for the Turbine Stop Valve - Closure Function is such that three or more TSVs must be closed to produce a scram.

6. LPCI loop select logic failure was used as a conservative surrogate. This basic event represents the probability that LPCI loop select fails in such a way that it causes LPCI injection to occur on the loop where the line break occurred.

7. The ECCS auto start signals failed to actuate was used as a surrogate. These events are representative for reactor steam dome pressure permissive bypass timer relays.

8. Failure of the minimum flow valve to open was used as a conservative surrogate for the RICT calculation. This surrogate is conservative as the valves failure to open makes the RHR pump unavailable.

9. Failure of all ADS valves to open was used as a conservative surrogate for the RICT calculation. The model will be updated to include these SSCs prior to exercising the RICT program for this TS. The PRA Success Criteria will match the Design Success Criteria.

10. Failure of primary containment isolation valves to close was used as a conservative surrogate as appropriate for each function evaluated in a RICT calculation.

11. SSCs are not modeled. The PRA model will be updated to include the Mechanical Vacuum Pump system and Isolation instrumentation prior to exercising the RICT Program for this TS. The MVPI instrumentation system will be implemented in PRA to meet the ASME standard. Failure of the steam jet air ejectors was used as a conservative surrogate representation of the risk for the Table E1-2 sample calculations. This is a conservative surrogate, since the failure of steam jet air ejectors causes loss of condenser vacuum.

12. Failure of loss of power relays to shift to the de-energized position was used as a conservative surrogate for the RICT calculation.

The failure to shift to the de-energized position was chosen for this TS, since the instrumentation function is to de-energize the relays Page 37 of 60

L-MT-20-003 NSPM Table E1-1: In-scope TS/LCO Conditions to Corresponding PRA Functions SSCs Covered by TS Function MNGP MNGP TS LCO Condition and Modeled Covered by TS Design Success PRA Success TS Description Applicable Mode(s) in PRA LCO Condition Criteria Criteria Comments on loss of power.

13. Since the containment airlock is not modeled, there are no explicit PRA Success Criteria. However, failure of the containment airlock function is modeled as a pre-existing leak probability in the PRA, which is a conservative surrogate in the PRA. This is a conservative surrogate, since the surrogate failure is equivalent to a break in containment in which an inoperable airlock may not be considered a break in the containment. Compliance with the remaining portions of LCO Condition 3.6.1.2.C ensure that at least one door is maintained closed in the air lock. Thus, the function is still maintained.

14. While the spare Division 2 125 VDC battery charger can be used to supply either the Division 1 or Division 2 125 VDC subsystem, it can be used to meet the LCO requirements only for the Division 2 125 VDC subsystem. If it is supplying the Division 1 125 VDC subsystem, the Division 1 125 VDC subsystem is inoperable, but the function is maintained available.

15. The logic is arranged such that it takes specific combinations of channels in each trip/actuation system to cause the logic to be made up. For example, there are two channel combinations where one of two taken twice will cause the logic to be made up and two channel combinations where one of two taken twice will not cause the logic to be made up. In addition, both channels in either trip system in two of two taken once will also cause the logic to be made up.

Page 38 of 60

L-MT-20-003 NSPM RICTs were calculated for both trains when applicable and the most limiting RICT is specified in the Table E1-2. Following implementation of the RICT Program, the actual RICT values will be calculated using the actual plant configuration and the current revision of the PRA model representing the as-built, as-operated condition of the plant, as required by NEI 0609A, Revision 0 and the NRC Final Safety Evaluation.

RICTs are based on the internal events (including internal flooding) and internal fire PRA model calculations with seismic CDF and LERF penalties. RICTs calculated to be greater than 30 days are capped at 30 days based on NEI 06-09-A, Revision 0. RICTs not capped at 30 days are rounded to nearest number of days.

Per NEI 06-09-A, Revision 0, for cases where the total CDF or LERF is greater than 1E-03/yr or 1E-04/yr, respectively, the RICT Program will not be entered.

Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.1.7.B One [Standby Liquid Control (SLC)] subsystem inoperable for 30 Days reasons other than Condition A.

3.3.1.1.A One or more required channels inoperable. 30 Days 3.3.1.1.B --------------------------------------NOTE-------------------------------------------

Not applicable for Functions 2.a, 2.b, 2.c, 2.d, 2.f or 2.g.

30 Days One or more Functions with one or more required channels inoperable in both trip systems.

3.3.2.2.A One or more feedwater pump and main turbine high water level trip 30 Days channels inoperable.

3.3.4.1.A One or more channels inoperable. 30 Days 3.3.5.1.B As required by Required Action A.1 and referenced in 16 Days Table 3.3.5.1-1.

3.3.5.1.C As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.1-1.

3.3.5.1.D As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.1-1.

3.3.5.1.E As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.1-1.

3.3.5.1.F As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.1-1.

3.3.5.1.G As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.1-1.

3.3.5.2.B As required by Required Action A.1 and referenced in 16 Days Table 3.3.5.2-1.

Page 39 of 60

L-MT-20-003 NSPM Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.3.5.2.D As required by Required Action A.1 and referenced in 30 Days Table 3.3.5.2-1.

3.3.6.1.A One or more required channels inoperable. 30 Days 3.3.7.2.A One or more channels inoperable. 30 Days 3.3.8.1.A One or more channels inoperable. 30 Days 3.4.3.A One or two required [Safety/Relief Valves (S/RVs)] inoperable. 30 Days 3.5.1.B One LPCI subsystem inoperable for reasons other than Condition A.

17 Days OR One Core Spray subsystem inoperable.

3.5.1.C One LPCI pump in both LPCI subsystems inoperable. 30 Days 3.5.1.D Two LPCI subsystems inoperable for reasons other than Condition No Entry(1)

C or G.

3.5.1.E One Core Spray subsystem inoperable.

AND One LPCI subsystem inoperable. No Entry(1)

OR One or two LPCI pump(s) inoperable.

3.5.1.I HPCI System inoperable. 30 Days 3.5.1.J HPCI System inoperable.

AND 16 Days Condition A, B, or C entered.

3.5.1.K One ADS valve inoperable. 30 Days 3.5.3.A RCIC System inoperable. 17 Days 3.6.1.2.C Primary containment air lock inoperable for reasons other than 13 Days Condition A or B.

3.6.1.3.A ------NOTE------

Only applicable to penetration flow paths with two PCIVs.

30 Days One or more penetration flow paths with one PCIV inoperable for reasons other than Condition D or E.

Page 40 of 60

L-MT-20-003 NSPM Table E1-2: In-Scope TS/LCO Conditions RICT Estimate Tech Spec LCO Condition RICT Estimate 3.6.1.3.D One or more penetration flow paths with one or more 18 inch primary containment purge and vent valves not within purge and 30 Days vent valve leakage limits.

3.6.1.6.C One line with one or more reactor building-to-suppression chamber 30 Days vacuum breakers inoperable for opening.

3.6.1.7.A One required suppression chamber-to-drywell vacuum breaker 30 Days inoperable for opening.

3.6.1.8.A One RHR drywell spray subsystem inoperable. 30 Days 3.6.2.3.A One RHR suppression pool cooling subsystem inoperable. 22 Days 3.7.1.A One RHRSW subsystem inoperable. 22 Days 3.7.2.A One ESW subsystem inoperable. 30 Days(2) 3.8.1.A One required offsite circuit inoperable. 8 Days 3.8.1.B One EDG inoperable. 30 Days 3.8.1.C Two required offsite circuits inoperable. No Entry(1) 3.8.1.D One required offsite circuit inoperable.

AND 6 Days One EDG inoperable.

3.8.4.A One or more required battery chargers on Division 1 or Division 2 29 Days inoperable.

3.8.4.B One Division 1 or Division 2 DC electrical power subsystem No Entry(1) inoperable for reasons other than Condition A.

3.8.7.A One or more AC electrical power distribution subsystems No Entry(1) inoperable.

3.8.7.B One or more DC electrical power distribution subsystems No Entry(1) inoperable.

Table E1-2 Notes:

1. Several quantification results exceed the risk cap level of 1E-03 (CDF) or 1E-04 (LERF). Those LCOs are listed as No Entry given the quantified risk. However, it is possible that the LCO could be entered for a partial failure and would result in lower quantified risk. In a lower risk condition, entry into the RICT program would be allowed.

2. The ESW subsystem was not required to be credited in thermal hydraulic analysis to mitigate core damage or LERF. Therefore, there is no risk impact by removing the subsystem from service.

Page 41 of 60

L-MT-20-003 NSPM 2.0 ADDITIONAL JUSTIFICATION FOR SPECIFIC ACTIONS This section contains the additional technical justification for the list of Required Actions from Table 1, Conditions Requiring Additional Technical Justification, of TSTF-505, Revision 2.

NSPMs additional justification for each of the identified MNGP TS is provided below:

2.1 TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation LCO: Four channels of Feedwater Pump and Main Turbine High Water Level Trip instrumentation shall be OPERABLE.

Condition A: One or more feedwater pump and main turbine high water level trip channels inoperable.

As indicated in Table E1-1, the Feedwater Pump and Main Turbine High Water Level Trip Instrumentation channels are explicitly modeled in the MNGP PRA. The PRA Success Criterion is the same as the design success criterion, which is one specific Reactor Vessel Water Level - High channel in each of two trip systems or both channels in a trip system.

Four channels of Reactor Vessel Water Level - High instrumentation are provided as input to initiation logic that trips the two feedwater pumps and the main turbine. The logic arrangement is such that one specific Reactor Vessel Water Level - High channel in each of two trips systems, or both channels in one trip system, will cause the trip function. Trip capability can be lost if certain combinations of two specific channels are inoperable and not tripped. TSTF505 changes are incorporated. However, as more than one channel inoperable can result in a loss of function, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained.

Therefore, TS 3.3.2.2 Condition A meets the requirements for inclusion in the RICT Program.

2.2 TS 3.3.8.1 - Loss of Power (LOP) Instrumentation LCO: The LOP instrumentation for each Function in Table 3.3.8.1-1 shall be OPERABLE.

Condition A: One or more channels inoperable.

As indicated in Table E1-1, the LOP Instrumentation channels are not explicitly modeled in the MNGP PRA. Failure of loss of power relays to deenergized position will be used as a conservative surrogate for the RICT calculation. The PRA Success Criterion is two of four channels.

The 4.16 kV Essential Bus Loss of Voltage Function is monitored by four undervoltage relays for each emergency bus, whose outputs are arranged in a one-out-of-two twice logic configuration (i.e., one channel in each of two trip systems must trip for LOP actuation). Four channels input to each of the two emergency diesel generators (EDGs). The 4.16 kV Essential Page 42 of 60

L-MT-20-003 NSPM Bus Degraded Voltage Function is monitored by three undervoltage relays (with its associated time delay) for each emergency bus, whose outputs are arranged in a two-out-of-three logic configuration. Three channels input to each of the two essential buses and EDGs. Both LOP Functions provide an automatic start signal to both EDGs.

For the 4.16 kV Essential Bus Loss of Voltage Function, two (or more) channels inoperable represents a loss of function if two inoperable channels are on the same trip system. For the 4.16 kV Essential Bus Degraded Voltage Function, two (or more) channels inoperable represents loss of function. Given this, a Note is added to the Completion Time which prohibits applying a RICT when trip capability is not maintained.

Therefore, TS 3.3.8.1 Condition A meets the requirements for inclusion in the RICT Program.

2.3 TS 3.6.1.2 - Primary Containment Air Lock LCO: The primary containment air lock shall be OPERABLE.

Condition C: Primary containment air lock inoperable for reasons other than Condition A or B.

As indicated in Table E1-1, the Primary Containment Air Lock is not explicitly modeled in the MNGP PRA. The PRA Success Criteria is the same as the Design Success Criteria which is one containment air lock door closed with acceptable containment leakage per LCO 3.6.1.1.

Failure of the containment airlock function is modeled as a pre-existing leak probability in the PRA, which is a conservative surrogate in the PRA.

One double door primary containment air lock has been built into the primary containment to provide personnel access to the drywell and to provide primary containment isolation during the process of personnel entering and exiting the drywell. As part of the primary containment pressure boundary, the air lock's safety function is related to control of containment leakage rates following a DBA. The DBA that postulates the maximum release of radioactive material within primary containment is a loss of coolant accident (LOCA). Thus, the air lock's structural integrity and leak tightness are essential to the successful mitigation of such an event.

Compliance with the remaining portions of TS 3.6.1.2 ensures that there is a physical barrier (i.e., closed door) and an acceptable overall leakage from containment. Thus, the function is still maintained. Required Action C.1 of TS 3.6.1.2 requires the condition to be assessed in accordance with TS 3.6.1.1, Primary Containment (i.e., initiate action to evaluate overall primary containment leakage rate per LCO 3.6.1.1, using current air lock test results with a Completion Time of immediately).

Therefore, TS 3.6.1.2 Condition C meets the requirements for inclusion in the RICT Program.

Page 43 of 60

L-MT-20-003 NSPM 2.4 TS 3.6.1.3 - Primary Containment Isolation Valves (PCIVs)

LCO: Each PCIV, except reactor building-to-suppression chamber vacuum breakers, shall be OPERABLE.

Condition D: One or more penetration flow paths with one or more 18 inch primary containment purge and vent valves not within purge and vent valve leakage limits.

As indicated in Table E1-1, the 18 inch primary containment purge and vent valves are explicitly modeled in the MNGP PRA. The PRA Success Criteria is the same as the Design Success Criteria.

The MNGP design includes one 18 inch primary containment purge line containing two 18 inch air-operated purge valves in series and two 18 inch primary containment vent lines each containing two 18 inch air-operated vent valves in series. The primary containment purge and vent valves are normally maintained closed in Modes 1, 2, and 3 to ensure the primary containment boundary is maintained. The isolation valves on the 18 inch vent lines have 2 inch bypass lines around them for use during normal reactor operation. Use of the 2 inch vent will prevent high pressure from reaching the Standby Gas Treatment System filter trains in the unlikely event of a loss of coolant accident (LOCA) during venting. The 18 inch purge and vent valves are capable of closing in the environment of a LOCA. As loss of function may occur if two valves are inoperable in the same line, a Note is added to the Completion Time which prohibits applying a RICT when there is a loss of function.

Therefore, TS 3.6.1.3 Condition D meets the requirements for inclusion in the RICT Program.

3.0 EVALUATION OF INSTRUMENTATION AND CONTROL SYSTEMS The following Instrumentation Technical Specifications (TS) Sections are included in the TSTF505 application for the Monticello Nuclear Generating Plant (MNGP):

1. TS 3.3.1.1 - Reactor Protection System (RPS) Instrumentation

2. TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation

3. TS 3.3.4.1 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation

4. TS 3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation

5. TS 3.3.5.2 - Reactor Core Isolation Cooling (RCIC) System Instrumentation

6. TS 3.3.6.1 - Primary Containment Isolation Instrumentation

7. TS 3.3.7.2 - Mechanical Vacuum Pump Isolation Instrumentation

8. TS 3.3.8.1 - Loss-of-Power (LOP) Instrumentation As described in Section 7.1.1, Monticello Conformance to IEEE 279, of the MNGP Updated Safety Analysis Report (USAR), the MNGP TS 3.3, INSTRUMENTATION, LCOs were developed to assure that the MNGP facility maintains necessary redundancy and diversity.

The Reactor Protection System (RPS) and Primary Containment Isolation System (PCIS) were designed to meet a single failure criterion including single short circuits and single open circuits Page 44 of 60

L-MT-20-003 NSPM which were later embodied in IEEE 279-1968. These systems fully meet the single failure requirements of the IEEE 2791968 criteria including the single component failure definition as defined in paragraph 4.2 of IEEE 279-1968. In addition, the integrated ECCS fully meets the single failure criterion of IEEE 279-1968.

TSTF-505 (Reference 4) sets forth the following as guidance for what is to be included in this enclosure:

The description of proposed changes to the protective instrumentation and control features in TS Section 3.3, "Instrumentation," should confirm that at least one redundant or diverse means (other automatic features or manual action) to accomplish the safety functions (for example, reactor trip, SI, containment isolation, etc.) remains available during use of the RICT, consistent with the defense-in-depth philosophy as specified in RG 1.174. (Note that for each application, the staff may selectively audit the licensing basis of the most risk-significant functions with proposed RICTs to verify that such diverse means exist.)

The MNGP instrumentation design creates defense-in-depth due to the redundancy of the channels for each function, as described in the following tables. In general, the following principles apply to each MNGP instrumentation system (see Tables E1-3, E1-4, E1-5, E1-6, E1-7, E1-8, E1-9, and E1-10 for specific details):

Each function has multiple channels.

A failed channel does not cause or prevent a trip/actuation.

When applicable, if 1 channel in the function is out-of-service, then the 1 channel can be placed in trip.

The following sections provide the justification that defense-in-depth is maintained for the applicable functions throughout the application of the RICT Program. Note that the following tables include a complete description of the functions for the instrumentation TS covered in this section, whereas Table E1-1 only includes those functions in scope of the RICT Program.

3.1 TS 3.3.1.1 - Reactor Protection System (RPS) Instrumentation The RPS Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The RPS, as described in the MNGP USAR, Section 7.6.1.2.1, includes sensors, relays, bypass circuits, and switches that are necessary to cause initiation of a reactor scram. Functional diversity is provided by monitoring a wide range of dependent and independent parameters. The input parameters to the scram logic are from instrumentation that monitors reactor vessel water level, reactor vessel pressure, neutron flux, main steam line isolation valve position, turbine control valve acceleration relay oil pressure, turbine stop valve position, drywell pressure, and scram discharge volume water level, as well as reactor mode switch in shutdown position and manual scram signals. There are at least four redundant sensor input signals from each of these parameters (with the exception of the reactor mode switch in shutdown and manual scram signals). Some channels include Page 45 of 60

L-MT-20-003 NSPM electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an RPS trip signal to the trip logic.

Table E1-3 below presents the TS 3.3.1.1 logic descriptions for all of the functions listed in TS Table 3.3.1.1-1:

Table E1-3: RPS Instrumentation Diversity Function Logic Logic Description Intermediate Range Monitors Function 1.a, Neutron Flux - 2/8 The IRM System is divided into two groups of IRM High High channels, with four IRM channels inputting to each trip system. One channel in each trip system is allowed to be bypassed. One IRM channel tripped in each RPS trip system causes a SCRAM.

Function 1.b, Inop. 2/8 See Function 1.a.

Average Power Range Monitors Function 2.a, Neutron Flux - 2/4 APRM System is divided into four APRM channels and four High (Setdown) 2-out-of-4 voter channels. Each APRM channel provides inputs to each of the four voter channels. The four voter channels are divided into two groups of two each; with each group of two providing inputs to one RPS trip system.

The system is designed to allow one APRM channel, but no voter channels, to be bypassed. A trip from any one un-bypassed APRM will result in a "half-trip in all four of the voter channels, but no trip inputs to either RPS trip system.

Function 2.b, Simulated 2/4 See Function 2.a above.

Thermal Power - High Function 2.c, Neutron Flux - 2/4 See Function 2.a above.

High Function 2.d, Inop. 2/4 See Function 2.a above.

Function 2.e, 2Out-Of-4 2/4 The 2-Out-Of-4 Voter includes separate outputs to RPS for Voter the two independently voted sets of Functions, each of which is redundant (four total outputs). The logic is one-out-of-two taken twice.

Function 2.f, OPRM Upscale 2/4 See Function 2.a above.

Function 2.g, Extended Flow 2/4 See Function 2.a above.

Window Stability - High Function 3, Reactor Vessel 2/4 Four channels, with two channels in each RPS trip system, Steam Dome Pressure - High are arranged in a one-out-of-two taken twice logic.

Function 4, Reactor Vessel Water 2/4 Four channels, with two channels in each RPS trip system, Level - Low are arranged in a one-out-of-two taken twice logic.

Page 46 of 60

L-MT-20-003 NSPM Table E1-3: RPS Instrumentation Diversity Function Logic Logic Description Function 5, Main Steam Isolation 3/16 Each of the eight MSIVs has two position switches; one Valve - Closure inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve - Closure channels. The logic is arranged such that either the inboard or outboard valve on three or more of the main steam lines must close in order for a SCRAM to occur.

Function 6, Drywell Pressure - 2/4 Four channels, with two channels in each RPS trip system, High are arranged in a one-out-of-two taken twice logic.

Scram Discharge Volume Water Level - High Function 7.a, Resistance 2/4 SDV water level is measured by two diverse methods. One Temperature Detector Resistance Temperature Detector channel in each of two trip systems or one Float Switch channel in one trip system and one Resistance Temperature Detector channel in the other trip system. These combinations are arranged in a one-out-of-two taken twice logic.

Function 7.b, Float Switch 2/4 SDV water level is measured by two diverse methods. One Float Switch channel in each of two trip systems or one Float Switch channel in one trip system and one Resistance Temperature Detector channel in the other trip system. These combinations are arranged in a one-out-of-two taken twice logic.

Function 8, Turbine Stop Valve - 6/8 Signals are initiated from position switches located on each Closure of the four Turbine Stop Valves (TSV). One position switch and two independent contacts are associated with each TSV. One of the two contacts provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from each of the four TSVs.

The logic is such that three or more TSVs must be closed to produce a SCRAM.

Function 9, Turbine Control Valve 2/4 Four channels, with two channels in each RPS trip system, Fast Closure, Acceleration Relay are arranged in a one-out-of-two taken twice logic.

Oil Pressure - Low Function 10, Reactor Mode 2/2 There is one channel for each of the two manual scram Switch - Shutdown Position logic channels. In order to cause a scram it is necessary that both channels be actuated.

Function 11, Manual Scram 2/2 See Function 10 above.

Page 47 of 60

L-MT-20-003 NSPM 3.2 TS 3.3.2.2 - Feedwater Pump and Main Turbine High Water Level Trip Instrumentation The Feedwater Pump and Main Turbine High Water Level Trip Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a feedwater pump and main turbine trip signal to the trip logic.

Table E1-4 below presents the logic descriptions for the functions in TS 3.3.2.2:

Table E1-4: Feedwater Pump and Main Turbine High Water Level Trip Instrumentation Diversity Function Logic Description Reactor Vessel Water Level - 2/4 Four channels of Reactor Vessel Water Level - High High instrumentation are arranged such that one specific Reactor Vessel Water Level - High channel in each of two trip systems or both channels in a trip system cause the trip function.

3.3 TS 3.3.4.1 - Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation The ATWS-RPT Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ATWS-RPT System, as described in the MNGP USAR, includes sensors, relays, bypass capability circuit breakers, and switches that are necessary to cause initiation of a recirculation pump trip. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an ATWS-RPT signal to the trip logic.

Table E1-5 below presents the logic descriptions for the functions in TS 3.3.4.1:

Table E1-5: ATWS-RPT Instrumentation Diversity Function Logic Logic Description Function a, Reactor Vessel Water 2/4 The ATWS-RPT consists of two independent trip systems, Level - Low Low with two channels of Reactor Vessel Steam Dome Pressure - High and two channels of Reactor Vessel Water Level - Low Low in each trip system. Each ATWS-RPT trip system is a two-out-of-two logic for each Function.

Either two Reactor Vessel Water Level - Low Low or two Reactor Vessel Steam Dome Pressure - High signals are needed to trip a trip system. The outputs of the channels in a trip system are combined in a logic arrangement such that either trip system will trip both recirculation pumps.

Page 48 of 60

L-MT-20-003 NSPM Table E1-5: ATWS-RPT Instrumentation Diversity Function Logic Logic Description Function b, Reactor Vessel 2/4 See Function a above.

Steam Dome Pressure - High 3.4 TS 3.3.5.1 - Emergency Core Cooling System (ECCS) Instrumentation The ECCS instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The ECCS instrumentation actuates core spray (CS), low pressure coolant injection (LPCI), high pressure coolant injection (HPCI), Automatic Depressurization System (ADS), and the emergency diesel generators (EDGs). The ECCS Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment.

Table E1-6 below presents the TS 3.3.5.1 logic descriptions for all of the functions listed in TS Table 3.3.5.1-1.

Table E1-6: ECCS Instrumentation Diversity Function Logic Logic Description CS System Function 1.a, Reactor Vessel 2/4 The Reactor Vessel Water Level - Low Low initiation signal Water Level - Low Low is generated coincident with Reactor Steam Dome Pressure - Low (Pump Permissive) or if the Reactor Vessel Water Level - Low Low signal is sustained for 18 minutes. Four transmitters are connected to four trip units.

The outputs of the trip units are connected to relays whose contacts are arranged in a one specific channel in each of two actuation systems or both channels in an actuation system logic arrangement.

Function 1.b, Drywell Pressure 2/4 The outputs of four pressure switches are connected to

- High relays whose contacts are directed to two trip systems. The outputs of the trip units are connected to relays whose contacts are arranged in a one specific channel in each of two actuation systems or both channels in an actuation system logic arrangement.

Function 1.c, Reactor Steam 1/2 The outputs of two redundant pressure switches are Dome Pressure - Low connected to relays whose contacts input into two trip (Injection Permissive) systems. Each trip system is arranged in a one-out-of-two logic.

Function 1.d, Reactor Steam 1/2 The outputs of two redundant switches are connected to Dome Pressure Permissive - relays whose contacts are directed to two trip systems and Low (Pump Permissive) the logic in each trip system is arranged in a one-out-of-two logic.

Page 49 of 60

L-MT-20-003 NSPM Table E1-6: ECCS Instrumentation Diversity Function Logic Logic Description Function 1.e, Reactor Steam 1/2 There are two redundant time delay relays. A time delay Dome Pressure Permissive - relay is located in each trip system in a one-out-of-one Bypass Timer (Pump logic for each trip system.

Permissive)

Function 1.f, Core Spray 1/1 There is one time delay relay per CS pump.

Pump Start - Time Delay Relay LPCI System Function 2.a, Reactor Vessel 2/4 Four redundant transmitters are connected to four trip Water Level - Low Low units. The outputs of the four trip units are connected to relays whose contacts are directed to two trip systems. The logic arrangement is such that one specific channel in each of two actuation systems or both channels in an actuation system causes actuation.

Function 2.b, Drywell Pressure 2/4 Same as Function 2.b.

- High Function 2.c, Reactor Steam 1/2 The outputs of two redundant pressure switches are Dome Pressure - Low connected to relays whose contacts input into two trip (Injection Permissive) systems. Each trip system is arranged in a one-out-of-two logic.

Function 2.d, Reactor Steam 1/2 The outputs of two redundant switches are connected to Dome Pressure Permissive - relays whose contacts are directed to two trip systems and Low (Pump Permissive) the logic in each trip system is arranged in a one-out-of-two logic.

Function 2.e, Reactor Steam 1/1 One of two redundant time delay relays is located in each Dome Pressure Permissive - trip system and a contact associated with an associated Bypass Timer (Pump relay (one-out-of-one logic for each trip system).

Permissive)

Function 2.f, Low Pressure 2/4 per There are four time delay relays per LPCI pump. The Coolant Injection Pump Start - LPCI outputs of the time delay relays are arranged in a one-out-Time Delay Relay pump of-two taken twice logic for each LPCI pump.

Function 2.g, Low Pressure 1/1 per One bypass flow switch per LPCI pump is used to protect Coolant Injection Pump LPCI the pump on startup. The logic is arranged such that the Discharge Flow - Low pump flow switch causes is disabled until the associated pump is (Bypass) up to speed.

Function 2.h, Reactor Steam 2/4 Four pressure switches that sense the reactor steam dome Dome Pressure - Low (Break pressure. One specific channel is required in each of two Detection) actuation systems or both channels in an actuation system for a given LPCI division.

Page 50 of 60

L-MT-20-003 NSPM Table E1-6: ECCS Instrumentation Diversity Function Logic Logic Description Function 2.i, Recirculation 2/4 Eight differential pressure switches between the suction Pump Differential Pressure - and discharge of each recirculation pump. Two of four High (Break Detection) channels from each Recirculation Pump.

Function 2.j, Recirculation 2/4 One specific channel in each of two actuation systems or Riser Differential Pressure - both channels in an actuation system High (Break Detection)

Function 2.k, Reactor Steam 1/1 One channel per LPCI division.

Dome Pressure - Time Delay Relay (Break Detection)

Function 2.l, Recirculation 1/1 One channel per LPCI division.

Pump Differential Pressure -

Time Delay Relay (Break Detection)

Function 2.m, Recirculation 1/1 One channel per LPCI division.

Riser Differential Pressure -

Time Delay Relay (Break Detection)

HPCI System Function 3.a, Reactor Vessel 2/4 Four redundant transmitters are connected to four trip Water Level - Low Low units. The outputs of the trip units are connected to relays whose contacts are arranged such that one specific channel is required in each of two actuation systems or both channels in an actuation system.

Function 3.b, Drywell Pressure 2/4 Same as Function 3.b.

- High Function 3.c, Reactor Vessel 2/2 Reactor Vessel Water Level - High signals for HPCI are Water Level - High initiated from two level transmitters from the narrow range water level measurement instrumentation. Both signals are required in order to close the HPCI turbine's stop valve.

Function 3.d, Condensate 1/2 Two level switches are used to detect low water level in the Storage Tank Level - Low CST (one on each CST). Either switch can cause the suppression pool suction valves to open and the CST suction valve to close (one-out-of-two logic).

Function 3.e, Suppression 1/2 Signals are initiated from two level switches. The logic is Pool Water Level - High arranged such that either switch can cause the suppression pool suction valves to open and the CSTs suction valve to close (one-out-of-two logic).

Function 3.f, High Pressure 1/1 One flow switch is used to detect the HPCI System's flow Coolant Injection Pump rate.

Discharge Flow - Low (Bypass)

Page 51 of 60

L-MT-20-003 NSPM Table E1-6: ECCS Instrumentation Diversity Function Logic Logic Description Automatic Depressurization System (ADS) Trip Systems A and B Functions 4.a/5.a, Reactor 1/2 The ADS logic in each trip system is arranged in two Vessel Water Level - Low strings. Each string has a contact from Reactor Vessel Low Water Level - Low Low. Each string also has a contact that represents a CS or LPCI pump discharge pressure signal.

All contacts in both logic strings must close and the ADS initiation timer must time out to initiate an ADS trip system.

Either the A or B trip system will cause all the ADS relief valves to open.

Functions 4.b/5.b, Automatic 1/1 See Function 4.a/5.a above.

Depressurization System Initiation Timer Functions 4.c/5.c, Core Spray 2/4 Each ADS trip system includes two discharge pressure Pump Discharge Pressure - permissive switches from all CS and LPCI pumps. Any one High of the six low pressure pumps is sufficient to permit automatic depressurization.

Functions 4.d/5.d, Low 2/8 See Function 4.c/5.c above.

Pressure Coolant Injection Pump Discharge Pressure -

High 3.5 TS 3.3.5.2 - Reactor Core Isolation Cooling (RCIC) System Instrumentation The RCIC System instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that injection by the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. RCIC Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment.

Table E1-7 below presents the TS 3.3.5.2 logic descriptions for all of the functions listed in TS Table 3.3.5.2-1:

Page 52 of 60

L-MT-20-003 NSPM Table E1-7: RCIC System Instrumentation Diversity Function Logic Logic Description Function 1, Reactor Vessel 2/4 Four transmitters are connected to four trip units. The Water Level - Low Low outputs of the trip units are connected in a one specific channel in each of two actuation systems, or both channels in an actuation system, logic arrangement.

Function 2, Reactor Vessel 2/2 The Reactor Vessel Water Level - High trip is arranged in Water Level - High a two-out-of-two logic.

Function 3, Condensate Storage 1/2 Two level switches are used to detect low water level in the Tank Level - Low CST (one for each CST). Either switch can cause the suppression pool suction valves to open and the CST suction valve to close.

3.6 TS 3.3.6.1 - Primary Containment Isolation Instrumentation Primary Containment Isolation Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The isolation instrumentation includes the sensors, relays, and switches that are necessary to cause initiation of primary containment and reactor coolant pressure boundary isolation. Most channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs a primary containment isolation signal to the isolation logic.

Functional diversity is provided by monitoring a wide range of independent parameters. The input parameters to the isolation logics are (a) reactor vessel water level, (b) area ambient temperatures, (c) main steam line (MSL) flow measurement, (d) Standby Liquid Control (SLC)

System initiation, (e) main steam line pressure, (f) high pressure coolant injection (HPCI) and reactor core isolation cooling (RCIC) steam line flow, (g) drywell pressure, (h) HPCI and RCIC steam line pressure, (i) reactor water cleanup (RWCU) flow, and (j) reactor steam dome pressure. Redundant sensor input signals from each parameter are provided for initiation of isolation. The only exception is SLC System initiation. Primary containment isolation instrumentation has inputs to the trip logic of the isolation functions listed below:

Table E1-8 below presents the TS 3.3.6.1 logic descriptions for all of the functions listed in TS Table 3.3.6.1-1:

Table E1-8: Primary Containment Isolation Instrumentation Diversity Function Logic Description Main Steam Line Isolation Function 1.a, Reactor Vessel 2/4 One channel associated with each Function inputs to one Water Level - Low Low of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of all main steam isolation valves (MSIVs), MSL drain valves, and reactor sample isolation valves. Any channel will trip Page 53 of 60

L-MT-20-003 NSPM Table E1-8: Primary Containment Isolation Instrumentation Diversity Function Logic Description the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all main steam isolation valves (MSIVs), MSL drain valves, and recirculation sample isolation valves.

Function 1.b, Main Steam Line 2/4 See Function 1.a above.

Pressure - Low Function 1.c, Main Steam Line 2/16 There are four channels for each steam line. One channel Flow - High from each steam line inputs to one of the four trip strings.

Two trip strings make up each trip system and both trip systems must trip to cause an isolation of the MSIVs, MSL drain valves, and reactor sample isolation valves. Each trip string has four inputs (one per MSL), any one of which will trip the trip string. The trip strings are arranged in a one-out-of-two taken twice logic. This is effectively a one-out-of-eight taken twice logic arrangement to initiate isolation.

Function 1.d, Main Steam Line 2/16 The 16 channels (four from each of the four tunnel areas).

Tunnel Temperature - High The logic is arranged similar to the Main Steam Line Flow -

High Function. One channel from each steam tunnel area inputs to one of four trip strings. Two trip strings make up a trip system, and both trip systems must trip to cause isolation.

Primary Containment Isolation Function 2.a, Reactor Vessel 2/4 One channel associated with each Function inputs to one Water Level - Low of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the Group 2 primary containment isolation valves (i.e., drywell and sump). Any channel will trip the associated trip string.

Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation.

Function 2.b, Drywell Pressure 2/4 See Function 2.a above.

- High HPCI System Isolation Function 3.a, HPCI Steam 1/2 Each channel output for each system is connected to a Line Flow - High time delay relay that provides an output signal to two trip systems. The output signal is arranged so that any channel that trips will provide a trip signal to the trip system (one-out-of-two logic in each trip system). Each trip system associated with HPCI will provide a closure signal to the associated system isolation valves.

Page 54 of 60

L-MT-20-003 NSPM Table E1-8: Primary Containment Isolation Instrumentation Diversity Function Logic Description Function 3.b, HPCI Steam 2/4 The outputs are arranged in a one-out-of-two-twice logic in Supply Line Pressure - Low one trip system. The trip system isolates all HPCI isolation valves.

Function 3.c, HPCI Steam 2/16 The outputs of the 16 channels are grouped in four sets of Line Area Temperature - High four detectors. Each set is arranged in one-out-of-two-twice logic. The outputs of each set provide trip signals to each of two separate isolation trip systems. Each trip system is able, by itself, to isolate all HPCI isolation valves, as applicable.

RCIC System Isolation Function 4.a, RCIC Steam 1/2 Each channel output for each system is connected to a Line Flow - High time delay relay that provides an output signal to two trip systems. The output signal is arranged so that any channel that trips will provide a trip signal to the trip system (one-out-of-two logic in each trip system). Each trip system associated with RCIC will provide a closure signal to the associated system isolation valves.

Function 4.b, RCIC Steam 2/4 The outputs are arranged in a one-out-of-two twice logic.

Supply Line Pressure - Low The output of the logic is directed to two trip systems. Each trip system is able, by itself, to isolate all RCIC isolation valves.

Function 4.c, RCIC Steam 2/16 The outputs of the 16 channels are grouped in four sets of Line Area Temperature - High four detectors. Each set is arranged in one-out-of-two-twice logic. The outputs of each set provide trip signals to each of two separate isolation trip systems. Each trip system is able, by itself, to isolate all RCIC isolation valves, as applicable.

Reactor Water Cleanup System Isolation Function 5.a, RWCU Flow - 2/4 One channel associated with each function inputs to one of High four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RWCU valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of all RWCU isolation valves.

Function 5.b, RWCU Room 2/4 See Function 5.a above.

Temperature - High Function 5.c, Drywell Pressure 2/4 See Function 5.a above.

- High Page 55 of 60

L-MT-20-003 NSPM Table E1-8: Primary Containment Isolation Instrumentation Diversity Function Logic Description Function 5.d, SLC System 1/1 The switch provides trip signal inputs to both trip systems Initiation in any position other than OFF. The SLC initiation switch is considered to provide one channel input into each trip system. Each of the two trip systems is connected to one of the two valves on each RWCU penetration.

Function 5.e, Reactor Vessel 2/4 See Function 5.a above.

Water Level - Low Low Shutdown Cooling System Isolation Function 6.a, Reactor Steam 1/2 Both channels provide input to two trip systems. Any trip Dome Pressure - High channel will trip both trip systems to initiate isolation of the RHR shutdown cooling supply isolation valves.

Function 6.b, Reactor Vessel 2/4 Note that Function 6.b is only applicable in Mode 3. One Water Level - Low channel associated with each Function inputs to one of four trip strings. Two trip strings make up a trip system and both trip systems must trip to cause an isolation of the RHR shutdown cooling supply isolation valves. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate isolation of the RHR shutdown cooling supply isolation valves.

Traversing Incore Probe (TIP)

System Isolation Function 7.a, Reactor Vessel 2/4 One channel associated with each Function inputs to one Water Level - Low of four trip strings. Two trip strings make up a trip system and both trip systems must trip to initiate a TIP drive isolation signal. Any channel will trip the associated trip string. Only one trip string must trip to trip the associated trip system. The trip strings are arranged in a one-out-of-two taken twice logic to initiate a TIP drive isolation signal.

Function 7.b, Drywell Pressure 2/4 See Function 7.a above.

- High 3.7 TS 3.3.7.2 - Mechanical Vacuum Pump Isolation Instrumentation The Mechanical Vacuum Pump Isolation Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. The mechanical vacuum pump isolation instrumentation includes sensors, relays and switches that are necessary to cause initiation of mechanical vacuum pump isolation. The channels include electronic equipment that compares measured input signals with pre-established setpoints.

Page 56 of 60

L-MT-20-003 NSPM When the setpoint is exceeded, the channel output relay actuates, which then outputs an isolation signal to the mechanical vacuum pump isolation logic.

Table E1-9 below presents the logic descriptions for the functions in TS 3.3.7.2:

Table E1-9: Mechanical Vacuum Pump Isolation Instrumentation Diversity Function Logic Description Mechanical Vacuum Pump Isolation Main Steam Line Tunnel 2/4 The isolation logic consists of two independent trip Radiation - High systems, with two channels of the Main Steam Line Tunnel Radiation - High Function in each trip system. The outputs from two channels provide input into one trip system and the other two channels provide input into the other trip system. One channel must trip to trip a trip system and both trip systems must trip to initiate the mechanical vacuum pump isolation function (i.e., one-out-of-two taken twice logic arrangement).

3.8 TS 3.3.8.1 - Loss-of-Power (LOP) Instrumentation The LOP Instrumentation also employs diversity in the number and variety of different inputs which will actuate the associated equipment. Each 4.16 kV essential bus has its own independent LOP instrumentation and associated trip logic. The voltage for each bus is monitored at two levels, which can be considered as two different undervoltage Functions:

4.16 kV Essential Bus Loss of Voltage and 4.16 kV Essential Bus Degraded Voltage, as described in the MNGP USAR. Both LOP Functions provide an automatic start signal to both EDGs. However, only the automatic start signal to the associated EDG (the EDG in the same division) is required.

Table E1-10 below presents the TS 3.3.8.1 logic descriptions for all of the functions listed in TS Table 3.3.8.1-1.

Table E1-10: LOP Instrumentation Diversity Function Logic Description Function 1, 4.16 kV Essential 2/4 The 4.16 kV Essential Bus Loss of Voltage Function is Bus Loss of Voltage monitored by four undervoltage relays for each emergency bus, whose outputs are arranged in a one-out-of-two twice logic configuration (i.e., one channel in each of two trip systems must trip for LOP actuation).

Page 57 of 60

L-MT-20-003 NSPM Table E1-10: LOP Instrumentation Diversity Function Logic Description 4.16 kV Essential Bus Degraded Voltage Function 2.a, Bus 2/3 The 4.16 kV Essential Bus Degraded Voltage Function is Undervoltage monitored by three undervoltage relays (with its associated time delay) for each emergency bus, whose outputs are arranged in a two-out-of-three logic configuration.

Function 2.b, Time Delay 2/3 See Function 2.a above.

3.9 Regulatory Guide 1.174, Revision 2, Section 2.1.1 - Defense-in-Depth In accordance with the principles contained within Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2 (Reference 5), defense-in-depth consists of several elements and consistency with the defense-in-depth philosophy is maintained if the following occurs:

A reasonable balance is preserved among prevention of core damage, prevention of containment failure, and consequence mitigation.

o The MNGP TS reflect this balance by allowing one sensor module or channel to be placed in trip, while preserving the fundamental safety function of the applicable system. Tripping an inoperable channel does not affect the number of channels required to provide the safety function.

Over-reliance on programmatic activities as compensatory measures associated with the change in the licensing basis is avoided.

o No programmatic activities are relied upon as compensatory measures when one or two channels of the applicable instrumentation are inoperable. The remaining operable channels for that function are fully capable of performing the safety function of the applicable system.

System redundancy, independence, and diversity are preserved commensurate with the expected frequency, consequences of challenges to the system, and uncertainties (e.g.,

no risk outliers).

o System redundancy, independence and diversity remain the same as in the as designed condition. The number of operable functions has not been decreased (diversity), the number of minimum operable channels to perform the safety function has not been decreased, and the channels remain independent as originally designed, even with one channel inoperable.

Page 58 of 60

L-MT-20-003 NSPM

Defenses against potential common-cause failures are preserved, and the potential for the introduction of new common-cause failure mechanisms is assessed.

o This LAR does not impact the original determination of common-cause failure for the applicable instrumentation and its functions. It may allow the CTs to be extended for one or two channels in a function to be inoperable prior to placing the channel in trip.

Placing the channel in trip fulfils that channels trip function needed to perform the safety function of the applicable system.

Independence of barriers is not degraded.

o Barriers are not affected by this LAR request.

Defenses against human errors are preserved.

o In the conditions listed in the TS, a potential extension of the TS CTs does not change any personnel actions required when the TS Action is entered. Therefore, no change to the possibility of a human error is introduced and no changes to the defenses against that potential human error have been altered.

The intent of the plant's design criteria is maintained.

o The design criteria of the applicable systems are maintained as reflected in the USAR. Redundancy, diversity of signal and independence of trip/actuation channel functions are maintained with the requested change. The change requested in the LAR does not physically change the applicable systems in any way. It only allows additional time, under certain low risk conditions in accordance with the RICT Program, to perform actions that the NRC has previously determined to be acceptable.

Therefore, the defense-in-depth principals prescribed in Regulatory Guide 1.174, Revision 2, are met.

4.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

3. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

4. Institute of Electrical and Electronics Engineers (IEEE) Standard 279-1968, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, dated August 30, 1968 Page 59 of 60

L-MT-20-003 NSPM

5. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated May 2011 (ADAMS Accession No. ML100910006)

6. NSPM PRA Document PRA-MT-DA, Data Analysis Notebook, Revision 5.0, dated March 2019

7. NRC NUREG/CR-5500, Volume 3, Reliability Study: General Electric Reactor Protection System, 1984-1995, dated February 1999

8. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014)

Page 60 of 60

ENCLOSURE 2 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b INFORMATION SUPPORTING CONSISTENCY WITH REGULATORY GUIDE 1.200, REVISION 2 (8 Pages Follow)

L-MT-20-003 NSPM Information Supporting Consistency with Regulatory Guide 1.200, Revision 2

1.0 INTRODUCTION

The purpose of this enclosure is to provide information on the technical adequacy of the Monticello Nuclear Generating Plant (MNGP) Probabilistic Risk Assessment (PRA) internal events model (including internal flooding) and the MNGP Fire PRA model in support of the license amendment request (LAR) to adopt TSTF-505, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b, Revision 2 (Reference 1). The MNGP internal events (including internal flooding) and fire PRA (FPRA) models described within this LAR are arranged in a combined one-top model configuration. These models are the same peer reviewed models described in the Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submittals associated with the adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Reference 2), and TSTF425, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b (Reference 3),

respectively, with revisions to reflect the as-built/as-operated plant. The revised model incorporates the FPRA model specific logic for fire impacts and alternate shutdown into the most recent internal events (including internal flooding) model to develop an all hazards model for the application. The revision addressed finding level Facts and Observations (F&Os) for these models that were closed through the peer review findings closure process.

Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Revision 0 (Reference 4), as clarified by the NRC final safety evaluation of this report (Reference 5), defines the technical attributes of a PRA model and its associated Configuration Risk Management Program (CRMP) tool required to implement this risk-informed application. Meeting these requirements satisfies Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2 (Reference 7), requirements for risk-informed plant-specific changes to a plant's licensing basis.

NSPM employs a multi-faceted approach to establishing and maintaining the technical adequacy and fidelity of PRA models for its nuclear generation sites. This approach includes both a PRA maintenance and update process procedure and the use of self-assessments and independent peer reviews.

Section 2.0 of this enclosure describes the overall approach used to perform the peer review findings closure reviews for the MNGP PRAs. Section 3.0 discusses the requirements related to the scope of the MNGP PRA internal events model (including internal flooding). Section 4.0 addresses the technical adequacy of the MNGP PRA full power internal events (FPIE) model including internal flood for this application. Section 5.0 addresses the technical adequacy of the MNGP Fire PRA model for this application. Section 6.0 lists references used in the development of this enclosure.

Page 1 of 8

L-MT-20-003 NSPM 2.0 PEER REVIEW FINDINGS CLOSURE PROCESS All the PRA models described below have been subject to a full-scope peer review consistent with the guidance of RG 1.200, Revision 2, against the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter ASME/ANS PRA Standard), Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 8), utilizing the NEI 05-04, Process for Performing PRA Peer Reviews Using the ASME PRA Standard (Internal Events), Revision 2 (Reference 9), and NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Revision 1 (Reference 10). The peer review teams issued Facts and Observations (F&Os) for those technical requirements in which Capability Category (CC) II of the ASME/ANS PRA Standard was not believed to be fully met. In addition to the full-scope peer reviews, a focused-scope peer review was performed on the FPRA to account for enhanced fire modelling methods incorporated into the model.

NSPM took actions to address these F&Os and independent F&O closure assessments were performed to review the closure actions. These reviews included F&Os that were associated with "met" supporting requirements (SRs), as well as all F&Os associated with SRs that were met at the CC I level. Expectations regarding preparation for the review (NEI 05-04, Section 4.2) and conduct of the self-assessment by the host utility (NEI 05-04, Section 4.3) were addressed prior to conduct of these reviews. This included documentation by NSPM of resolution of the prior PRA peer review finding-level F&Os and preparation of the information required for this independent assessment. The documented bases for F&O closure provided by NSPM included a written assessment whether the resolution constituted PRA maintenance or PRA upgrade.

The multi-disciplinary teams of reviewers for each closure review met the independence and relevant peer reviewer qualifications requirements in the ASME/ANS PRA Standard and related guidance. A total of 22 internal events F&Os and 75 fire F&Os were assessed, each of which was assigned to at least two of the reviewers.

References 9, 14, and 15 provide additional details of the F&O closure reviews, including the approach taken:

The process guidance in NEI 05-04, Section 4.6, was applicable to this review.

The independent technical review team reviewed the documented bases for closure of the finding-level F&Os prepared by NSPM.

The independent technical review team determined whether the finding-level F&Os in question had been adequately addressed and could be closed out by consensus.

As part of this process each F&O was reviewed regarding whether the closure response represented PRA maintenance or a PRA upgrade.

Section 3 of each F&O closure report specifically states that the closure review team concluded that all SRs where the F&Os have been closed are now met at CC II.

Details of the F&O Closure review assessments are documented in Appendix A of the F&O Closure Reports. The assessment for each F&O includes the determination that Page 2 of 8

L-MT-20-003 NSPM each closed finding meets CC II for all the applicable SRs of the ASME/ANS PRA Standard, as endorsed by RG 1.200, Revision 2.

3.0 REQUIREMENTS RELATED TO SCOPE OF MNGP INTERNAL EVENTS PRA (INCLUDING INTERNAL FLOODING) AND FIRE PRA MODELS Both the internal events PRA model of record (MOR) and the internal fire PRA MOR are at-power models (i.e., they directly address plant configurations during plant Modes 1 and 2 of reactor operation). The models include both core damage frequency (CDF) and large early release frequency (LERF). Internal flooding is included in both the CDF and LERF internal events PRA models. As described previously, the internal events (including internal flooding)

PRA model described within this LAR are the same peer reviewed models as those described within the NSPM submittal of the applications to adopt 10 CFR 50.69 and TSTF-425, with revisions to reflect the as-built/as-operated plant.

Of note, a limited amount of FLEX equipment is modeled in the PRA model in accordance with NEI 1606, Crediting Mitigating Strategies in Risk-Informed Decision Making, Revision 0 (Reference 6). Specifically, two FLEX Transfer Cubes are credited to refill the diesel fire pump tank. Based on a sensitivity study (Reference 11), credit for this limited amount of FLEX equipment reduces CDF by ~ 1% and has no impact on LERF. Due to very small CDF and LERF impact, inclusion of the limited amount of FLEX equipment in the PRA model will have a minimal impact on the Risk-Informed Completion Time (RICT) calculation results.

4.0 SCOPE AND TECHNICAL ADEQUACY OF MNGP INTERNAL EVENTS AND INTERNAL FLOODING PRA MODEL NEI 06-09-A requires that the PRA be reviewed to the guidance of RG 1.200 for a PRA which meets CC II for the supporting requirements of the internal events at power ASME/ANS PRA Standard. It also requires that deviations from these CCs relative to the RICT Program be justified and documented.

The information provided in this section demonstrates that the MNGP internal events PRA model (including internal flooding) meets the expectations for PRA scope and technical adequacy as presented in RG 1.200, Revision 2.

The MNGP PRA was peer reviewed in April 2013 applying NEI 05-04, the ASME/ANS PRA Standard, and RG 1.200, Revision 2. The purpose of this review was to provide a method for establishing the technical adequacy of the PRA for the spectrum of potential risk-informed plant licensing applications for which the PRA may be used. The 2013 MNGP PRA peer review (Reference 12) was a full-scope review of the technical elements of the internal events and internal flood, at-power PRA.

The ASME/ANS PRA Standard has 325 individual SRs for the Internal Events At-Power PRA (Part 2), and Internal Flood At-Power PRA (Part 3). The MNGP peer review included all of these SRs. Twelve of the SRs were judged to be not applicable. Of the remaining 313 ASME/ANS PRA Standard SRs, 93% were determined to be supportive of CC II or greater. A Page 3 of 8

L-MT-20-003 NSPM total of 22 finding-level F&Os were written by the peer review team that indicated where improvements needed to be made to meet CC II for the remaining SRs. Subsequent to the peer review, NSPM implemented PRA model and documentation changes to address these F&Os.

An F&O closure review was completed in October 2017 in accordance with the process documented in Appendix X to NEI 05-04, as well as the requirements published in the ASME/ANS PRA Standard and RG 1.200, Revision 2. This findings closure review was performed by the BWR Owners Group (Reference 13) and determined that each of the 22 findings were closed. Consequently, all applicable ASME/ANS PRA Standard SRs are now judged to be met at the CC II level. Therefore, Version 3.4 of the internal events PRA meets the requirements for PRA technical adequacy for this application. The FPIE PRA has since been updated to Version 5.0 to account for miscellaneous updates, e.g., incorporating feedwater overfill event, building an all hazard model, etc.

5.0 SCOPE AND TECHNICAL ADEQUACY OF MNGP FIRE PRA The information provided in this section demonstrates that the MNGP fire PRA model meets the expectations for PRA scope and technical adequacy as presented in RG 1.200, Revision 2, to fully support the requirements of the RICT Program.

A state-of-the-art FPRA was developed using the guidance provided by NUREG/CR-6850, Volume 2, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2:

Detailed Methodology (Reference 14), and NUREG/CR-6850, Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements (Reference 15). The FPRA is built upon the internal events PRA which was modified to capture the effects of fire. The current version of the FPRA model is Revision 5.0.

A full-scope FPRA peer review was performed in March 2015 on the Revision 1a model, applying the NEI 07-12 process, the ASME/ANS PRA Standard, and RG 1.200, Revision 2.

The purpose of this review was to establish the technical adequacy of the FPRA for the spectrum of potential risk-informed plant licensing applications for which the FPRA may be used. The 2015 MNGP FPRA peer review was a full-scope review of all of the technical elements of the MNGP at-power Revision 1a FPRA against all technical elements in Section 4 of the ASME/ANS PRA Standard, including the referenced internal events SRs in Section 2. All SRs were reviewed against the CC II requirements.

The FPRA Section of the ASME/ANS PRA Standard has 182 individual SRs and references 237 individual SRs in the internal events PRA section; the MNGP FPRA peer review (Reference 16) included all of the SRs and all applicable reference SRs. For the assessment of the reviewed ASME/ANS PRA Standard SRs, 102 unique F&Os were generated by the peer review team, 73 were peer review findings, 28 were suggestions, and one was considered a best practice. There were no unreviewed analysis methods identified during the review.

In Revision 4.0 of the MNGP FPRA Model, enhanced fire modeling methods (heat soak) were added. To support the incorporation of these new methods in the PRA, a focused-scope peer Page 4 of 8

L-MT-20-003 NSPM review was performed against high level requirements FSS-C, FSS-D, FSS-G, and FSS-H for CC II in December 2016 (Reference 17). This focused-scope peer review resulted in 2 additional finding F&Os. Therefore, the Revision 4.0 model had a total of 75 open finding F&Os as a result of the two peer reviews.

An F&O closure review was conducted in October 2017 in accordance with the process documented in Appendix X to NEI 07-12, as well as the requirements published in the ASME/ANS PRA Standard and RG 1.200, Revision 2. This findings closure review was performed by ENERCON Services, Inc. (Reference 18) and determined that 61 of the 75 findings had been closed.

The FPRA model was updated (Revision 5.0) in February 2019 to address the 14 open findings. A more recent findings closure review was conducted in April 2019 in accordance with Appendix X of NEI 05-04/07-12/12-06 in conjunction with the ASME/ANS PRA Standard.

This review was performed by Jensen Hughes (Reference 19) and determined that all 14 of the remaining 14 findings have now been closed. NSPM determined that one model change constituted a PRA upgrade, which became the subject of a separate focused scope peer review (Reference 20). It should be noted that this focused scope review was done by a subset of the F&O closure team but was treated as a separate activity from the closure review. The peer review specifically addressed SRs FSS-F2, H2 through H5, and D1 through D4 of the 2009 ASME/ANS PRA Standard to determine if these SRs were met at CC II concerning the modeling of potential structural steel collapse and damage to sensitive electronics. The SRs selected included those that pertained to the selection, usage and documentation of the fire modeling that was utilized. The one resultant finding is discussed in Table E2-1.

Table E2-1: MNGP Open FPRA Peer Review Findings F&O Impact on Number SR Peer Review Finding Resolution Application FSS-H4 FSS-H4 From MNGP Fire PRA The resolution of the F&O has This finding is FSS-H5 Focused Scope Peer been improved upon by expanding mostly Review 2019 for the documentation in the following documentation upgrade areas: related with some necessary The fire modeling

Provided FDS input files in the sensitivity runs analysis provided in the both MCR and SSA Notebooks. and re-Main Control Room

Provided heat release rate calculations.

(MCR) abandonment (HRR) curves (inputs and/or However, there and Safe Shutdown outputs) for MCR and SSA are no modeling Analysis (SSA) Notebooks. changes expected notebooks, Appendix F

Provided better discussion of the as a result. It is of FPRA-MT-MCR, Rev. following inputs in the MCR and expected that this 5 and Appendix C of SSA Notebooks by adding F&O finding can FPRA-MT-SSA, assumptions and discussion: be considered Revision 5, involves the o Geometry closed once the use of Fire Dynamics o Boundaries and boundary documentation is Simulator (FDS) to conditions completed.

evaluate the potential Therefore, it is Page 5 of 8

L-MT-20-003 NSPM Table E2-1: MNGP Open FPRA Peer Review Findings F&O Impact on Number SR Peer Review Finding Resolution Application for target damage by o Fuel properties expected not to postulated fires. The o Ventilation conditions have any impact model input values are (forced or natural) on the application.

not fully described or

Verified that the beam documented, especially temperature devices reflected in Appendix F of FPRA- the hottest temperature and MT-MCR, Rev. 5 in a added more devices to manner that facilitates demonstrate that the SSA beam Fire PRA applications, temperatures reported reflect upgrades, and peer the peak temperature of the reviews. There is very beam laterally.

little description of the

Reran each FDS case with a geometry, boundaries beam height less than 1 m to and boundary validate that the thickness of the conditions, fuel cell in the SSA scenarios properties, the adequately accounts for the ventilation conditions exposed back side boundary (forced, natural), and condition.

any simplifying

Re-calculated SSA equivalence assumptions such as ratio in Table 10 of the SSA geometric extent, Notebook revision 5.0.1 to utilize geometric resolution, the mechanically vented fuel composition, etc. equation and not natural ventilation to incorporate a more accurate ventilation condition on the turbine deck

Performed sensitivities using a higher and lower HRR of 15%

against the base case severe turbine generator fire to help evaluate the potential for structural failure in the SSA evaluation for fuel burning rate.

Therefore, Version 5.0 of the MNGP FPRA meets the requirements for PRA technical adequacy for this application.

6.0 REFERENCES

1. Letter from the Technical Specification Task Force (TSTF) to the NRC, TSTF Comments on Draft Safety Evaluation for Traveler TSTF-505, Provide Risk-Informed Extended Completion Times and Submittal of TSTF-505, Revision 2, dated July 2, 2018 (ADAMS Accession No. ML18183A493)

Page 6 of 8

L-MT-20-003 NSPM

2. Letter (L-MT-18-010) from NSPM to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, dated March 28, 2018 (ADAMS Accession No. ML18087A323)

3. Letter (L-MT-17-083) from NSPM to the NRC, License Amendment Request:

Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated December 19, 2017 (ADAMS Accession No. ML17353A189)

4. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

5. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

6. NEI Topical Report NEI 16-06, Crediting Mitigating Strategies in Risk-Informed Decision Making, Revision 0, dated August 2016 (ADAMS Accession No. ML16286A297)

7. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014)

8. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

9. NEI Topical Report NEI 05-04, Process for Performing Internal Events PRA Peer Reviews Using the ASME/ANS PRA Standard, Revision 2, dated November 2008 (ADAMS Accession No. ML083430462)

10. NEI Topical Report NEI 07-12, Fire Probabilistic Risk Assessment (FPRA) Peer Review Process Guidelines, Revision 1, dated June 2010 (ADAMS Accession No. ML102230070)

11. NSPM PRA Document PRA-CALC-MT-RICT, TSTF-505 LAR Supporting Calculations, Revision 0, dated March 2020

12. NSPM PRA Document PRA-CALC-13-007, Monticello Internal Events PRA Peer Review Report, Revision 0, dated June 2016 Page 7 of 8

L-MT-20-003 NSPM

13. NSPM PRA Document PRA-CALC-17-016, MNGP Internal Events PRA Facts and Observations Independent Assessment Report, Revision 0, dated October 2017

14. NRC NUREG/CR-6850, Volume 2, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology, dated September 2005 (ADAMS Accession No. ML15167A411)

15. NRC NUREG/CR-6850, Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements, dated September 2010 (ADAMS Accession No. ML103090242)

16. NSPM PRA Document PRA-CALC-15-001, Monticello Fire PRA Peer Review Report, Revision 0, dated April 2015

17. NSPM PRA Document PRA-CALC-16-008, Fire PRA Focused Scope Peer Review Report, Revision 0, dated January 2017

18. NSPM PRA Document PRA-CALC-17-019, MNGP Fire PRA F&O Closure Report, Revision 0, dated November 2017

19. NSPM PRA Document PRA-CALC-19-002, MNGP Fire PRA F&O Closure Independent Assessment, Revision 0, dated April 2019

20. NSPM PRA Document PRA-CALC-19-006, MNGP Fire PRA Focused Scope Peer Review, Revision 0, dated April 2019 Page 8 of 8

ENCLOSURE 3 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b INFORMATION SUPPORTING TECHNICAL ADEQUACY OF PRA MODELS WITHOUT PRA STANDARDS ENDORSED BY REGULATORY GUIDE 1.200, REVISION 2 (1 Page Follows)

L-MT-20-003 NSPM Information Supporting Technical Adequacy of PRA Models without PRA Standards Endorsed by Regulatory Guide 1.200, Revision 2 This enclosure is not applicable to the Monticello Nuclear Generating Plant (MNGP) submittal.

Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy, is not proposing to use any PRA models in the MNGP Risk-Informed Completion Time Program for which a PRA standard endorsed by the NRC in Regulatory Guide 1.200, Revision 2, does not exist.

Page 1 of 1

ENCLOSURE 4 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b INFORMATION SUPPORTING JUSTIFICATION OF EXCLUDING SOURCES OF RISK NOT ADDRESSED BY THE PRA MODELS (21 Pages Follow)

L-MT-20-003 NSPM Information Supporting Justification of Excluding Sources of Risk Not Addressed by the PRA Models

1.0 INTRODUCTION

AND SCOPE Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1), as clarified by the NRC final safety evaluation (Reference 2),

requires that the license amendment request (LAR) provide a justification for exclusion of risk sources from the Probabilistic Risk Assessment (PRA) model based on their insignificance to the calculation of configuration risk, and to discuss conservative analyses applied to the configuration risk calculation. This enclosure addresses this requirement by discussing the overall generic methodology to identify and disposition such risk sources, and providing the Monticello (MNGP)-specific results of the application of the generic methodology and the disposition of impacts on the MNGP Risk-Informed Completion Time (RICT) Program. Section 3.0 of this enclosure presents the plant-specific conservative analysis of seismic risk to MNGP.

Section 4.0 presents the justification for excluding analysis of other external hazards from the MNGP PRA. The MNGP internal events (including internal flooding) and fire PRA (FPRA) models described within this LAR are arranged in a combined one-top model configuration.

These models are the same peer reviewed models described in the Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM),

submittals associated with the adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Reference 3), and TSTF-425, Relocate Surveillance Frequencies to Licensee Control -

RITSTF Initiative 5b (Reference 4), respectively, with revisions to reflect the as-built/as-operated plant.

NEI 06-09-A does not provide a specific list of hazards to be considered in a RICT Program.

However, non-mandatory Appendix 6-A of the American Society of Mechanical Engineers (ASME) / American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter ASME/ANS PRA Standard), Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 5) provides a guide for identification of most of the possible external events for a plant site. Additionally, NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1 (Reference 6), provides a discussion of hazards that should be evaluated to assess uncertainties in plant PRAs and support the risk-informed decision-making process. These hazards were reviewed for MNGP, along with a review of information pertaining to the site region and plant design to identify the set of external events to be considered. Information from the MNGP Updated Safety Analysis Report (USAR) pertaining to the geologic, seismologic, hydrologic, and meteorological characteristics of the site region, and the current and projected industrial activities in the plant vicinity was reviewed.

No new site-specific or plant-unique external hazards were identified through this review. The list of hazards from Appendix 6-A of the ASME/ANS PRA Standard that were considered for MNGP is summarized in Table E4-2.

Page 1 of 21

L-MT-20-003 NSPM The scope of this enclosure is consideration of the hazards listed in Table E4-2 for applicability to MNGP. Seismic events in particular are evaluated quantitatively in Section 3.0, and the other listed external hazards are evaluated and screened as low risk in Section 4.0.

2.0 TECHNICAL APPROACH The guidance contained in NEI 06-09-A states that all hazards that contribute significantly to incremental risk of a configuration must be quantitatively addressed in the implementation of the RICT Program. The following approach focuses on the risk implications of specific external hazards in the determination of the risk management action time (RMAT) and RICT for the Technical Specification (TS) Limiting Conditions for Operation (LCO) selected as part of the RICT Program.

Consistent with NUREG-1855, Revision 1, external hazards may be addressed as follows:

1. Screening the hazard based on a low frequency of occurrence,

2. Conservatively assess the potential impact and including it in the decision-making, or

3. Developing a PRA model to be used in the RMAT/RICT calculation.

The overall process for addressing external hazards considers two aspects of the external hazard contribution to risk.

The first is the contribution from the occurrence of beyond design basis conditions, e.g.,

winds greater than design, seismic events greater than design-basis earthquake (DBE),

etc. These beyond design basis conditions challenge the capability of the systems, structures, and components (SSCs) to maintain functionality and support safe shutdown of the plant.

The second aspect addressed is the challenges caused by external conditions that are within the design basis, but still require some plant response to assure safe shutdown (e.g., high winds or seismic events causing loss of offsite power, etc.). While the plant design basis assures that the safety-related equipment necessary to respond to these challenges are protected, the occurrence of these conditions nevertheless cause a demand on these systems that in and of itself presents a risk.

2.1 Hazard Screening The first step in the evaluation of the external hazard is screening based on an estimation of a conservative core damage frequency (CDF) for beyond design basis hazard conditions. An example of this type of screening is reliance on the NRCs 1975 Standard Review Plan (SRP)

(Reference 7) which is acknowledged in the NRCs Individual Plant Examination of External Events (IPEEE) procedural guidance (Reference 8) as assuring a conservative CDF of less than 1E-06 per year for each hazard. The conservative CDF estimate is often characterized by the likelihood of the site being exposed to conditions that are beyond the design basis limits and an estimate of the conservative conditional core damage probability for those conditions. If the conservative CDF for the hazard can be shown to be less than 1E-06 per year, then Page 2 of 21

L-MT-20-003 NSPM beyond design basis challenges from the hazard can be screened and do not need to be addressed quantitatively in the RICT Program. The basis for this is as follows:

The overall calculation of the RICT is limited to an incremental core damage probability (ICDP) of 1E-05.

The maximum time interval allowed for the RICT is 30 days.

If the maximum CDF contribution from a hazard is <1E-06 per year, then the maximum ICDP from the hazard is <1E-07 (1E-06/year

30 days/365 days/year).

Thus, the conservative ICDP contribution from the hazard is shown to be less than 1%

of the permissible ICDP in the conservative time for the condition. Such a minimal contribution is not significant to the decision in computing a RICT.

The MNGP hazard screening analysis from the IPEEE has been updated to reflect current site conditions. The results are discussed in Section 4.0, and show that all events listed in Table E4-2 can be screened for MNGP, except for seismic events.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant using this approach, some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. These considerations are addressed in Section 4.0.

2.2 Hazard Analysis for CDF Contribution There are two options in cases where the conservative CDF for the external hazard cannot be shown to be less than 1E-06 per year. The first option is to develop a PRA model that explicitly models the challenges created by the hazard and the role of the SSCs included in the RICT Program in mitigating those challenges. The second option for addressing an external hazard is to compute a conservative CDF contribution from the hazard. The conservative approach used for seismic risk is described in Section 3.0.

2.3 Evaluation of Conservative Large Early Release Frequency (LERF) Contribution The RICT Program requires addressing both core damage and large early release risk. When a comprehensive PRA does not exist, the LERF considerations can be estimated based on the relevant parts of the internal events LERF analysis. This can be done by considering the nature of the challenges induced by the hazard and relating those to the challenges considered in the internal events PRA. This can be done in a realistic manner or a conservative manner. The goal is to provide a representative or conservative conditional large early release probability (CLERP) that aligns with the conservative CDF evaluation. The incremental large early release frequency (ILERF) is then computed as:

ILERFHazard = ICDFHazard

CLERPHazard Page 3 of 21

L-MT-20-003 NSPM The conservative approach used for seismic LERF is described in Section 3.0.

2.4 Risks from Hazard Challenges Upon estimation of a conservative CDF and LERF, the analysis approach must assure that the RICT Program calculations reflect the change in CDF and LERF caused by out-of-service equipment. As discussed in Section 3.0, seismic risk is the only beyond design basis hazard that could not be screened out for MNGP. The approach used considers that the change in risk with equipment out-of-service will not be higher than the conservative seismic CDF.

The above steps address the direct risks from damage to the facility from external hazards.

While the direct CDF contribution from beyond design basis hazard conditions can be shown to be non-significant without a full PRA, there may be risks that are related to the fact that some external hazards can cause a plant challenge even for hazard severities that are less than the design basis limit. For example, high winds, tornadoes, and seismic events below design basis levels can cause extended loss of offsite power conditions. Additionally, depending on the site, external floods can challenge the availability of normal plant heat removal mechanisms.

The approach to be taken in this step is to identify the plant challenges caused by the occurrence of the hazard within the design basis and evaluate whether the risks associated with these events are either already considered in the existing PRA model or they not significant to the risk. Section 3.0 provides the analysis of the beyond design basis seismic hazards for the MNGP site, and Section 4.0 provides an analysis of the representative external hazards for MNGP.

3.0 CONSERVATIVE SEISMIC ANALYSIS This section presents a conservative analysis of the potential seismic impact for inclusion in the decision-making process, as a seismic PRA (SPRA) is not available for MNGP. The process for analyzing an unscreened external hazard without the use of a full PRA involves the following three steps:

1. Conservatively Estimate CDF

2. Evaluate Potential Risk Increases Due to Out-of-Service Equipment

3. Qualitatively Evaluate LERF Contribution 3.1 Conservatively Estimate Seismic CDF A seismic PRA is not developed for MNGP. MNGP performed the equivalent of a reduced-scope seismic margins assessment (SMA) for the MNGP IPEEE (Reference 9), with an additional focus on a few components, in accordance with Supplement 5 of Generic Letter 8820 (Reference 10). The seismic hazard for the MNGP site was re-evaluated in 2014 and provided to the NRC (Reference 11). The site safe shutdown earthquake (SSE) is documented in this report as 0.12 g. For screening purposes, a Ground Motion Response Spectrum (GMRS) was developed and a probabilistic seismic hazard analysis was completed using the Page 4 of 21

L-MT-20-003 NSPM Central and Eastern United States (CEUS) Seismic Source Characterization for nuclear facilities and the updated Electric Power Research Institute (EPRI) Ground-Motion Model. For both the 1 to 10 Hz response spectrum and portions of higher frequency (>10 Hz), the GMRS exceeds the SSE, which merited a seismic risk evaluation, spent fuel pool evaluation and a high frequency (HF) confirmation. However, based on the NRC staff's further comparison of the GMRS to the SSE and the review of additional hazard and risk information, the NRC staff concluded, as described in a letter dated October 27, 2015 (Reference 12), that a seismic risk evaluation was not merited for the MNGP. In addition, the staff concluded that the GMRS determined by the licensee adequately characterizes the reevaluated seismic hazard for the MNGP site. NSPM submitted a high frequency (HF) confirmation report (Reference 13) for the MNGP to the NRC and the NRC concluded that the licensee correctly implemented the guidance in conducting the HF confirmation for the MNGP (Reference 14).

NSPM also submitted a Mitigating Strategies Assessment (MSA) report (Reference 15) stating that the MNGP MSA was performed consistent with Appendix H of NEI 12-06, Diverse and Flexible Coping Strategies (FLEX) Implementation Guide, Revision 4 (Reference 16), which describes acceptable methods for demonstrating that the reevaluated seismic hazard is addressed within the MNGP mitigation strategies for beyond-design-basis external events.

Guidance document NEI 12-06, Revision 4, has been endorsed (with exceptions) by the NRC in JLD-ISG-2012-01, Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, Revision 2 (Reference 17). Therefore, the methodology used by the licensee is acceptable to perform an assessment of the mitigation strategies that addresses the reevaluated seismic hazard. The NRC completed its review of the seismic hazard MSA for the MNGP and concluded that sufficient information has been provided to demonstrate that the licensee's plans for the development and implementation of guidance and strategies under Order EA 049 appropriately addressed the reevaluated seismic hazard information stemming from the 10 CFR 50.54(f) letter and that no further responses or regulatory actions associated with Phase 2 of Near-Term Task Force (NTTF) Recommendation 2.1 Seismic were required for MNGP (Reference 14).

Therefore, an alternative approach is taken to provide an estimate of seismic core damage frequency (SCDF) based on the current MNGP seismic hazard curve and assuming the seismic capacity of a component whose seismic failure would lead directly to core damage.

This approach to estimation of the SCDF uses the plant level high confidence of low probability of failure (HCLPF) seismic capacity obtained from Table C-2 of Reference 18 and convolves the corresponding failure probabilities as a function of seismic hazard level with the seismic hazard curve from Reference 11. This is a commonly used approach to estimate SCDF when a seismic PRA is not available; see Section 10-B.9 of the ASME/ANS PRA Standard. This approach is consistent with approaches that have been used in other regulatory applications.

The EPRI completed site-specific evaluations using new site-specific hazard estimates for plants in the CEUS (Reference 11). The Expedited Seismic Evaluation Process (ESEP) for sites with a GMRS that exceeds the SSE in the spectral range from 1 to 10 Hz developed SCDF estimates and compared them to the SCDF estimates previously developed by the NRC (Reference 19). The approach in the 2014 EPRI evaluation estimated SCDF using the plant-Page 5 of 21

L-MT-20-003 NSPM level HCLPF seismic capacity (0.12g), composite variability (c of 0.4), and spectral ratios for MNGP from Table C-2 of Reference 18, convolved with the new site-specific seismic hazard.

This approximation is consistent with the approach and calculated SCDF values from Appendix D of Reference 12, which ranged from 1.9E-05 to 3.2E-05 for MNGP. Using the same MNGP HCLPF and spectral ratios, and the hazard curves from Reference 11, the total MNGP SCDF is estimated to be 3.0E-05. This SCDF value will be used as the conservative estimate of instantaneous SCDF (ICDFseismic) for the MNGP TSTF-505 LAR RICT calculations.

3.2 Evaluate Potential Seismic Risk Increase Due to Out-of-Service Equipment The approach taken in the computation of SCDF assumes that the SCDF can be based on the likelihood that a single seismic-induced failure leads to core damage. This approach is conservative and implicitly relies on the assumption that seismic-induced failures of equipment show a high degree of correlation (i.e., if one SSC fails, all similar SSCs will also fail). This assumption is conservative, but direct use of this assumption in evaluating the risk increase from out-of-service equipment could lead to an underestimation of the change in risk.

However, if one were to assume no correlation at all in the seismic failures, then the seismic risk would be lower than the risk predicted by a fully correlated model, but the change in risk using the un-correlated model with a redundant piece of important equipment out-of-service would be equivalent to the level predicted by the correlated model.

If the industry accepted approach (Reference 19) of correlation is assumed, the conditional core damage frequency given a seismic event will remain unaltered whether equipment is out-of-service or not. Thus, the risk increase due to out-of-service equipment cannot be greater than the total SCDF estimated by the conservative method used in Reference 11. That is, for the MNGP site, the delta SCDF from equipment out-of-service cannot be greater than 3.0E-05 per year.

To summarize the above considerations:

The baseline seismic risk in this approach is assumed to be zero, whereas there will always be some level of baseline seismic risk for a zero-maintenance plant configuration. Therefore, the incremental seismic risk (configuration seismic risk -

baseline seismic risk) will always be overstated using a seismic penalty based on the total estimated seismic risk.

The limiting HCLPF approach assumes that a failure of a component with seismic capacity at that HCLPF leads directly to core damage (CD). However, even common failure of a given set of components (e.g., all emergency diesel generators (EDGs))

would not lead directly to CD, especially in light of the post-Fukushima FLEX mitigating strategies now in place. In reality, there are few SSCs whose failure would lead to seismic CD with any significant frequency. Examples could be important structures, or the reactor pressure vessel, or distributed systems such as all cable trays or all piping systems.

Page 6 of 21

L-MT-20-003 NSPM

In a seismic PRA, seismic impacts to similar components (e.g., all the EDGs) are typically assumed to be correlated unless there are reasons to justify not correlating.

Correlation has the effect of introducing common cause impacts. So, if one train of emergency AC power fails seismically, both trains are modeled as likely to fail given the same seismic event. So, in general, most seismic impacts would effectively be equivalent to TS loss of function.

Given the above, the use of a seismic penalty based on assuming seismic core damage given the plant level HCLPF is appropriate.

3.3 Evaluate Seismic LERF Contribution The current MNGP full-power internal events (FPIE) PRA (Reference 20) includes a comprehensive treatment of LERF due to internally-initiated events. The internal events PRA provides an estimate of the conditional probability of LERF for each modeled initiating event.

Seismic events would not be expected to induce containment bypass scenarios (e.g.,

Interfacing Systems Loss of Coolant Accident (ISLOCA)) and the bypass resulting from ISLOCA is not a function of containment seismic capability. Therefore, a conservative conditional large early release probability for seismic events (CLERP seismic) can be obtained by examining the event-specific CDF and event-specific LERF, for the non-direct bypass events:

CLERPIE = LERFIE / CDFIE Using the current MNGP FPIE PRA, the average CLERP over all initiating events other than direct containment bypass events is approximately 9.2% as shown in Table E4-1 below:

Table E4-1: MNGP Non-Bypass CLERF Summary LERF (per reactor critical years Non-Bypass Non-Bypass Non-Bypass

(/ RCY)) LERF (/ RCY) CDF (/ RCY) CDF (/ RCY) CLERP 6.10E-07 6.03E-07 6.54E-06 6.53E-06 9.2%

The CLERP for the MNGP initiating events ranges from 0% to 72.97%. A LERF-weighted average CLERP can be computed for each initiating event as follows:

CLERPweighted event i = CLERPevent i * (LERFevent i / Total LERF)

The overall weighted CLERP is the sum of the event CLERP values. The weighted CLERP calculated for the MNGP FPIE model results other than direct containment bypass events, including the events with CLERP values above the average CLERP, is 2.55%.

Based on the above discussion, a 5% value of CLERP is chosen as an adequately conservative, but not overly pessimistic, estimate for use in the seismic induced LERF Page 7 of 21

L-MT-20-003 NSPM calculation. This encompasses all internal events initiators contributing to total LERF and total CDF for those events that do not result in direct containment bypass.

The incremental conservative large early release frequency from seismic events (i.e., the SLERF) for use in RICT calculations is then computed as:

ILERFSeismic = ICDFSeismic

CLERPSeismic = 3.0E-05

0.05 = 1.5E-06 Since this estimation of CLERP may change as the internal events PRA model is updated, the estimate will be updated for the RICT program with each internal events model update.

3.4 Conclusion The above analysis provides the technical basis for addressing the seismic-induced core damage risk for MNGP by reducing the ICDP/ILERP criteria to account for a conservative estimate of the configuration risks due to seismic events.

The RICT and RMAT calculations are based on the discussion provided above. The actual RICT and RMAT calculations performed by the MNGP Configuration Risk Management Tool are based on adding an incremental 3.0E-05 per year seismic CDF contribution and a corresponding 1.5E-06 per year seismic LERF contribution to the configuration-specific delta CDF and delta LERF attributed to internal and fire events contributions. This is accomplished by adding these seismic contributions to the instantaneous CDF/LERF whenever a RICT is in effect. This method ensures that an incremental seismic CDF/LERF equal to the conservative SCDF/SLERF is added to internal and fire events incremental CDF/LERF contribution for every RICT occurrence.

4.0 EVALUATION OF EXTERNAL EVENT CHALLENGES AND IPEEE UPDATE RESULTS The primary purpose of this section is to address the incremental risk associated with challenges to the facility that do not exceed the design capacity. This section also provides the results of the hazard screening described earlier. Seismic events are the only external hazard that was not screened out. Table E4-2 lists the external hazards considered.

4.1 Hazard Screening Except Seismic Events The MNGP IPEEE provides an assessment of the risk to the MNGP associated with external hazards. Additional analyses have been done since the IPEEE to provide updated risk assessments of various hazards, such as aircraft impacts, industrial facilities and pipelines, and external flooding (Reference 21).

Table E4-2 reviews the bases for the evaluation of these hazards, identifies any challenges posed, and identifies any additional treatment of these challenges, if required. Table E4-3 provides the criteria applied in the progressive screening process used in this assessment.

The conclusions of the assessment, as documented in Table E4-2, assure that the hazard Page 8 of 21

L-MT-20-003 NSPM either does not present a design-basis challenge to MNGP, or is adequately addressed in the PRA.

External hazards other than seismic can be screened for the MNGP site.

In the application of RICTs, a significant consideration in the screening of external hazards is whether particular plant configurations could impact the decision on whether a particular hazard that screens under the normal plant configuration and the base risk profile would still screen given the particular configuration. The external hazards screening evaluation for MNGP has been performed accounting for such configuration-specific impacts. The process involves several steps.

As a first step in this screening process, hazards that screen for one or more of the following criteria (as defined in Table E4-3) still screen regardless of the configuration, as these criteria are not dependent on the plant configuration.

The occurrence of the event is of sufficiently low frequency that its impact on plant risk does not appreciably impact CDF or LERF. (Criterion C2)

The event cannot occur close enough to the plant to affect it. (Criterion C3)

The event which subsumes the external hazard is still applicable and bounds the hazard for other configurations (Criterion C4)

The event develops slowly, allowing adequate time to eliminate or mitigate the hazard or its impact on the plant. (Criterion C5)

The next step in the screening process is to consider the remaining hazards (i.e., those not screened per the above criteria) to consider the impact of the hazard on the plant given particular configurations for which a RICT is allowed. For hazards for which the ability to achieve safe shutdown may be impacted by one or more such plant configurations, the impact of the hazard to particular SSCs is assessed and a basis for the screening decision applicable to configurations impacting those SSCs is provided.

As noted above, the configurations to be evaluated are those involving unavailable SSCs whose LCOs are included in the RICT program.

Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Aircraft Impact Y PS4 The nearest major airport is Minneapolis-St. Paul International (MSP) which is located approximately 45 miles from the site.

There is one Federal airway (V2) which passes Page 9 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT over the plant site. The probability of an aircraft traveling this airway crashing into the plant is calculated to be on the order of 1.0E-06 per year.

The IPEEE reports results from bounding assessments to demonstrate that the risk due to this hazard is less than 1.0E-06 per year.

Avalanche Y C3 The topography surrounding the MNGP precludes the possibility of a snow avalanche.

Biological Event Y C5 Actions committed to and completed by the MNGP in response to Generic Letter 89-013 (Service Water System Problems Affecting Safety-Related Equipment) (Reference 22) provide on-going control of biological hazards.

These controls are described in MNGP procedure EWI08.22.01, Generic Letter 89-013 (Reference 23). Additionally, actions taken in response to INPO SOER 07-2 (Intake Structure Blockage) provide an additional layer of biological hazard management.

Based on these actions, the hazard is slow to develop and can be identified via monitoring and managed via standard maintenance processes.

Coastal Erosion Y C3 The mid-western inland location of the MNGP precludes the possibility of coastal erosion.

Drought Y C5 These effects would take place slowly allowing time for orderly plant reductions including shutdowns.

External Flooding and Y C1 The external flooding hazard at the MNGP was Intense Precipitation recently updated as a result of the post-Fukushima 10 CFR 50.54(f) Request for Information and the flood hazard reevaluation report (FHRR) was submitted to the NRC for review on May 12, 2016 (Reference 24). The results indicate that flooding from rivers and streams are bounded by the current licensing basis and do not pose a challenge to the plant.

Flooding from local intense precipitation was evaluated and will not challenge any safety functions at the MNGP.

Page 10 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Extreme Wind or Y C1 Wind damage is bounded by tornadoes, and the Tornadoes PS4 tornado wind speed corresponding to the 1.0E-06 per year exceedance frequency is less than the MNGP design value. Therefore, damage due to the forces associated with extreme winds or tornadoes can be screened.

For tornado missiles, those areas housing critical equipment required to assure safe shutdown were designed to prevent penetration of exterior walls by two types of missiles that could be generated by a tornado:

A) A utility pole 35-feet long by 14-inches in diameter and a unit weight of 35 pounds per cubic foot having a velocity of 200 mph; and B) A one ton missile, such as a compact type automobile, traveling at 100 mph at a maximum height of 25-feet above grade and with a contact area of 25 square feet.

The CDF associated with tornado missiles is less than 1.1 E-07 per year.

Fog Y C1 The principal effects of such events (such as C4 freezing fog) would be to cause a loss of offsite power and are addressed in the weather-related Loss of Offsite Power (LOOP) initiating event in the internal events PRA model for the MNGP.

Forest or Range Fire Y C1 The site landscaping and lack of forestation C3 prevent such fires from posing a threat to MNGP.

C4 Furthermore, the principal effects of such events would be to cause a LOOP and are addressed in the weather-related LOOP initiating event in the internal events PRA model for MNGP.

Frost Y C4 The principal effects of such events would be to cause a LOOP and are addressed in the weather-related LOOP initiating event in the internal events PRA model for MNGP.

Page 11 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Hail Y C1 Hail is bounded by other events for which the C4 plant is designed. The principal effects of such events would be to cause a LOOP and are addressed in the weather-related LOOP initiating event in the internal events PRA model for the MNGP.

High Summer Y C1 The principal effects of such events would result Temperature C4 in elevated river temperatures which are C5 monitored by station personnel. The design maximum temperature for the Emergency Service Water System is 90°F and the average monthly temperature at the MNGP typically does not approach that value. Should the river temperature exceed that value, the river is isolated by closing control gates at the inlet and discharge structures and the cooling tower system would operate in closed cycle operation at full capacity. The climatology at the MNGP is such that extreme heat would have an insignificant effect on plant operations.

High Tide, Lake Level, Y C3 High tide or lake levels are not applicable to the or River Stage C4 site because of location. Impact of High River Stage is included as an impact in the external flooding analysis.

Hurricane Y C3 The mid-western location of the MNGP precludes C4 the possibility of a hurricane. Additionally, hurricanes would be covered under Extreme Winds and Tornados and Local Intense Precipitation.

Ice Cover Y C1 Important piping systems and liquid storage tanks C4 at the MNGP are either inside heated buildings or are protected from the cold by heat tracing or insulation to prevent adverse effects from severe cold. Furthermore, the capacity reduction of the UHS due to extreme cold would be a slow process that would allow plant operators sufficient time to ensure that the decay heat removal function was maintained. The principal effects of such events would be to cause a LOOP and are addressed in the weather-related LOOP initiating event in the internal events PRA model for the MNGP.

Page 12 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Industrial or Military Y C3 There are no military facilities in proximity to the Facility Accident C4 plant (the closest is a National Guard facility at MSP airport, ~45 miles away). The hazards associated with an industrial facility accident are screened elsewhere in this table (e.g.,

transportation accident, pipeline accident).

Internal Fire N None The MNGP internal fire PRA addresses risk from internal fire events.

Internal Flooding N None The MNGP internal events PRA addresses risk from internal flooding events.

Landslide Y C3 In the immediate vicinity of the MNGP, there are no steep hills. Therefore, it is not applicable to the site because of topography.

Lightning Y C1 Lightning strikes can result in losses of offsite C4 power or surges in instrumentation output if grounding is not fully effective. The latter events often lead to reactor trips. Both results are incorporated into the MNGP internal events PRA model through the incorporation of generic and plant-specific data.

Low Lake Level or Y C1 The MNGP uses water from the Mississippi river River Stage C5 through an intake canal at 898 feet mean sea level (MSL), which is 6 feet below the design low flow stage of 904 feet MSL. In addition, the Cooling Tower system can remove the heat rejected by the circulating water system over the entire expected range of operating loads using closed cycle operation. Any such changes in river level would occur slowly over time, which would allow the plant to safely reduce power or shut down.

Low Winter Y C1 Plant piping and equipment located outside of Temperature C4 plant buildings are protected by heat tracing to C5 prevent adverse effects from severe cold. The principal effects of such events would be to cause a loss of offsite power. The effects of weather-related losses of offsite power are included in the MNGP PRA models. These effects would take place slowly allowing time for orderly plant power reductions, including shutdowns.

Page 13 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Meteorite/Satellite Y C2 The frequency of a meteorite or satellite strike is Strike judged to be very low such that the risk impact from such events is insignificant.

Pipeline Accident Y C1 The nearest hazardous material or natural gas pipeline is located more than one mile south of the plant. The effects on plant structures due to a pipeline explosion located approximately one mile from the site are bounded by tornado loadings.

Release of Chemicals Y C3 Chlorination of water systems is performed using from On-site storage C4 a hypochlorite system. No chlorine gas is stored PS1 on-site. Chemical hazards stored and transported in the vicinity of the plant are analyzed in conformance with the guidance set forth by RG 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, Revision 1, and NUREG-0570 (References 25 and 26). Therefore, this hazard can be excluded from the RICT Program evaluation.

River Diversion Y C1 Diversion of the Mississippi River was reviewed under the Fukushima 10 CFR 50.54(f) Request for Information and the FHRR was submitted to the NRC for review in Reference 24. The location of the MNGP site is adjacent to the natural channel of the Mississippi River. A review of the United States Geological Survey from 1961 and 2013 showed no change in the course of the Mississippi River channels in the site vicinity. The river channel in the area of the site does not include prominent bluffs or other features that could be susceptible to landslide which could potentially result in migration of the channel more directly towards the site. There are no man-made channels, canals, diversions, or permanent levees used for conveyance of water and flood protection near the site.

Sand or Dust Storm Y C1 The frequency of a LOOP accounts for severe C3 weather, including sand or dust storms.

C4 Seiche Y C3 The closest lakes are more than 1 mile from the site. There is no large body of water close the site for this event.

Page 14 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Seismic Activity N None Seismic impacts are evaluated in terms of a conservative SCDF applied to the calculation of RICT values. See Section 3.0 of this enclosure.

Snow Y C1 The average snowfall per year in Monticello, C4 Minnesota is 46.3 inches. The maximum recorded snowfall from a single storm in Minnesota occurred near Finland and measured 46.5 inches.

One inch of snowfall weighs approximately 1 psf, which means the estimated weight from a postulated maximum snowfall would be 46.5 psf.

The design basis roof live load is 50 psf, which is within the design basis.

Soil Shrink-Swell Y C3 The soil at the site consists of layers of bedrock, mostly cemented sandstone and engineered backfill. Due to the permeable nature of the granular soils at the site, the soil is resistant to shrink-swell.

Storm Surge Y C4 The potential for storm surge was evaluated in the FHRR and determined to be bounded by External Flooding.

Toxic Gas Y C4 The hazards associated with toxic gas are screened elsewhere in this table (e.g., Industrial and Military Facility Accidents, Release of Chemicals in Onsite Storage).

Transportation Y C1 Land Transportation - based on the proximity of Accidents C3 the nearest major roadways, truck explosions C4 pose no danger to the MNGP.

Rail Transportation - based on the proximity of the nearest commercial railroad line, potential impacts are covered by Extreme Wind or Tornado as well as Release of Chemicals in Onsite Storage.

Water Transportation - the MNGP is located near the headwaters of the Mississippi River.

Therefore, the river is shallow and narrow as it passes the plant, which prevents movement of large craft near the plant, limiting the activity primarily to pleasure craft. Based on that proximity, potential impacts are covered by Extreme Wind or Tornado as well as Release of Chemicals in Onsite Storage.

Page 15 of 21

L-MT-20-003 NSPM Table E4-2: Evaluation of Risks from External Hazards (Reference 21)

Screened Screening External Hazard Out? (Y/N) Criterion(a) Disposition for RICT Tsunami Y C3 The mid-western location of the MNGP precludes the possibility of a tsunami.

Turbine-Generated Y PS4 The probabilistic analysis performed for Missiles postulated failures of turbines in the MNGP has shown that the overall probability of turbine missile damage is less than the NRC-accepted value of 1.0E-07 per year. Therefore, this hazard can be excluded from the RICT Program evaluation.

Volcanic Activity Y C3 Not applicable to the MNGP as the site is not close to any active volcanoes.

Waves Y C4 The potential impacts of waves were evaluated in the FHRR and determined to be bounded by External Flooding.

Note (a): See Table E4-3 for descriptions of screening criteria.

Table E4-3: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Initial Preliminary C1. Event damage potential is NUREG/CR-2300 Screening less than events for which plant (Reference 27) is designed.

ASME/ANS PRA Standard RA-Sa-2009 (Reference 5)

C2. Event has lower mean NUREG/CR-2300 frequency and no worse consequences than other ASME/ANS PRA events analyzed. Standard RA-Sa-2009 C3. Event cannot occur close NUREG/CR-2300 enough to the plant to affect it.

ASME/ANS PRA Standard RA-Sa-2009 C4. Event is included in the NUREG/CR-2300 Not used to screen.

definition of another event. Used only to include ASME/ANS PRA within another event.

Standard RA-Sa-2009 C5. Event develops slowly, ASME/ANS PRA allowing adequate time to Standard RA-Sa-2009 eliminate or mitigate the threat.

Page 16 of 21

L-MT-20-003 NSPM Table E4-3: Progressive Screening Approach for Addressing External Hazards Event Analysis Criterion Source Comments Progressive PS1. Design basis hazard ASME/ANS PRA Screening cannot cause a core damage Standard RA-Sa-2009 accident.

PS2. Design basis for the event NUREG-1407 meets the criteria in the NRC (Reference 8) 1975 Standard Review Plan (SRP) (Reference 7). ASME/ANS PRA Standard RA-Sa-2009 PS3. Design basis event mean NUREG-1407 frequency is < 1E-05 per year and the mean conditional core ASME/ANS PRA damage probability is < 0.1. Standard RA-Sa-2009 PS4. Bounding mean CDF is NUREG-1407

< 1E-06 per year.

ASME/ANS PRA Standard RA-Sa-2009 Detailed PRA Screening not successful. PRA NUREG-1407 needs to meet requirements in the ASME/ ANS PRA Standard. ASME/ANS PRA Standard RA-Sa-2009 4.2 Seismically-Induced Loss of Offsite Power Challenges For the MNGP site, the only incremental risk associated with challenges to the facility that do not exceed the design capacity that is not already addressed is seismically-induced LOOP.

The Risk Assessment of Operational Events Handbook (Reference 28) presents a calculation of the frequency for seismically-induced LOOP events for all U.S. nuclear power plants, based on the lowest fragility SSCs (e.g., ceramic insulators). The seismic initiating event frequency used in Reference 18 was obtained from the MNGP seismic hazard distribution developed in response to NTTF Recommendation 2.1 (References 11 and 14).

As obtained from Table A-0-1 of Reference 28, the seismic-induced LOOP frequency for MNGP is 1.84E-05 per year. The conditional probability of a LOOP given a seismic event is 7.56E-02 (from Table A-0-1 in Appendix 1 of Reference 28). The seismically-induced (unrecoverable) LOOP frequency is therefore less than 7.6% of the total unrecovered LOOP frequency that is already accounted for in the internal events PRA. This frequency is judged to be a sufficiently small fraction that it will not significantly impact the RICT Program calculations and it can be omitted.

Page 17 of 21

L-MT-20-003 NSPM

5.0 CONCLUSION

S Based on this analysis of external hazards for MNGP, no additional external hazards other than seismic events need to be added to the existing PRA model. The evaluation concluded that the hazards either do not present a design-basis challenge to MNGP, the challenge is adequately addressed in the PRA, or the hazard has a negligible impact on the calculated RICT and can be excluded.

The ICDP/ILERP acceptance criteria of 1E-05/1E-06 will be used within the RICT Program framework to calculate the resulting RICT and RMAT based on the total configuration-specific delta CDF/LERF attributed to internal events and internal fire, plus the seismic conservative delta CDF/LERF values.

6.0 REFERENCES

1. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

2. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

3. Letter (L-MT-18-010) from NSPM to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, dated March 28, 2018 (ADAMS Accession No. ML18087A323)

4. Letter (L-MT-17-083) from NSPM to the NRC, License Amendment Request:

Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated December 19, 2017 (ADAMS Accession No. ML17353A189)

5. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

6. NRC NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, dated March 2017 (ADAMS Accession No. ML17062A466)

7. NRC NUREG-75/087, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants, LWR Edition, September 1975 (ADAMS Accession No. ML081510817)

Page 18 of 21

L-MT-20-003 NSPM

8. NRC NUREG-1407, Procedural and Submittal Guidance for the Individual Plant Examination of External Events (IPEEE) for Severe Accident Vulnerabilities, dated June 1991 (ADAMS Accession No. ML063550238)

9. NSPM Report NSPLMI-95001, Monticello Individual Plant Examination of External Events (IPEEE), Revision 1, dated November 17, 1995 (Legacy Accession No.

9511300255)

10. NRC Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities - 10 CFR 50.54(f) (Generic Letter No. 88-20), dated November 23, 1988 (ADAMS Accession No. ML031150465)

11. Letter (L-MT-14-045) from NSPM to the NRC, MNGP Seismic Hazard and Screening Report (CEUS Sites), Response to NRC Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-ichi Accident, dated May 14, 2014 (ADAMS Accession No. ML14136A288)

12. Letter from the NRC to NSPM, Final Determination of Licensee Seismic Probabilistic Risk Assessments Under the Request for Information Pursuant to Title 10 of the Code of Federal Regulations 50.54(f) Regarding Recommendation 2.1 Seismic of the Near-Term Task Force (NTTF) Review of Insights from the Fukushima Dai-ichi Accident, dated October 27, 2015 (ADAMS Accession No. ML15194A015)

13. Letter (L-MT-17-025) from NSPM to the NRC, High Frequency Supplement to Seismic Hazard Screening Report, Response to NRC Request for Information Pursuant to 10 CFR 50.54(f) Regarding Recommendation 2.1 of the Near-Term Task Force Review of Insights from the Fukushima Dai-Ichi Accident, dated April 11, 2017 (ADAMS Accession No. ML17101A598)

14. Letter from the NRC to NSPM, Monticello Nuclear Generating Plant - Staff Review of Mitigating Strategies Assessment Report of The Impact of The Reevaluated Seismic Hazard Developed in Response to the March 12, 2012, 50.54(f) Letter, dated October 10, 2017 (ADAMS Accession No. ML17277B007)

15. Letter (L-MT-17-055) from NSPM to the NRC, Monticello Nuclear Generating Plant:

Seismic Mitigating Strategies Assessment (MSA) Report for the Reevaluated Seismic Hazard Information - NEI 12-06, Revision 4, Appendix H, H.4.4, Path 4, dated July 26, 2017 (ADAMS Accession No. ML17208A015)

16. NEI Topical Report NEI 12-06, Diverse and Flexible Coping Strategies (FLEX)

Implementation Guide, Revision 4, dated December 2016 (ADAMS Accession No. ML16354B421)

Page 19 of 21

L-MT-20-003 NSPM

17. NRC Interim Staff Guidance JLD-ISG-2012-01, Compliance with Order EA-12-049, Order Modifying Licenses with Regard to Requirements for Mitigation Strategies for Beyond-Design-Basis External Events, Revision 2, dated February 2017 (ADAMS Accession No. ML17005A188)

18. NRC Generic Issue 199 (GI-199) Implications of Updated Probabilistic Seismic Hazard Estimates in Central and Eastern United States on Existing Plants, Safety/Risk Assessment, dated August 2010 (ADAMS Accession No. ML100270639)

19. Letter from EPRI to NEI, Fleet Seismic Core Damage Frequency Estimates for Central and Eastern U.S. Nuclear Power Plants Using New Site-Specific Seismic Hazard Estimates, dated March 11, 2014 (ADAMS Accession No. ML14080A589)

20. NSPM PRA Document PRA-MT-L2, Level 2 Accident Sequence Notebook, Revision 5.0, dated March 2019

21. NSPM PRA Document PRA-CALC-18-005, MNGP Screening of External Hazards for 50.69, Revision 2, dated February 2020

22. NRC Generic Letter GL 89-13, Service Water System Problems Affecting Safety-Related Equipment (Generic Letter 89-13), dated July 18, 1989 (ADAMS Accession No. ML031150348)

23. NSPM Monticello Engineering Work Instruction EWI-08.22.01, Generic Letter 89-013, Revision 14

24. Letter (L-MT-16-024) from NSPM to the NRC, Monticello Nuclear Generating Plant:

Response to Post-Fukushima Near-Term Task Force (NTIF) Recommendation 2.1.

Flooding - Flood Hazard Reevaluation Report, dated May 12, 2016 (ADAMS Accession No. ML16145A179)

25. NRC Regulatory Guide 1.78, Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release, Revision 1, dated December 2001 (ADAMS Accession No. ML013100014)

26. NRC NUREG-0570, Toxic Vapor Concentrations in the Control Room Following a Postulated Accidental Release, dated June 1979 (ADAMS Accession No. ML063480551)

27. NRC NUREG/CR-2300, Volume 2, PRA Procedures Guide: A Guide to the Performance of Probabilistic Risk Assessments for Nuclear Power Plants, January 1983 (ADAMS Accession No. ML063560440)

Page 20 of 21

L-MT-20-003 NSPM

28. NRC Handbook, Risk Assessment of Operational Events Handbook, Volume 2 -

External Events, Internal Fires - Internal Flooding - Seismic - Other External Events -

Frequencies of Seismically-Induced LOOP Events, Revision 1.02, dated November 2017 (ADAMS Accession No. ML17349A301)

Page 21 of 21

ENCLOSURE 5 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b BASELINE CDF AND LERF (4 Pages Follow)

L-MT-20-003 NSPM Baseline CDF and LERF

1.0 INTRODUCTION

Section 4.0, Item 6 of the NRC Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Revision 0, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (Reference 2), requires that the license amendment request (LAR) provide the plant-specific total core damage frequency (CDF) and large early release frequency (LERF) to confirm applicability of the limits of Regulatory Guide (RG) 1.174, Revision 1 (Reference 3). (Note that RG 1.174, Revision 2 (Reference 4), issued by the NRC in May 2011, did not revise these limits.) The Monticello Nuclear Generating Plant (MNGP) internal events (including internal flooding) and fire PRA (FPRA) models described within this LAR are arranged in a combined one-top model configuration. These models are the same peer reviewed models described in the Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submittals associated with the adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Reference 5), and TSTF-425, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b (Reference 6), respectively, with revisions to reflect the as-built/as-operated plant.

The purpose of this enclosure is to demonstrate that the MNGP total CDF and total LERF are below the guidelines established in RG 1.174. RG 1.174 does not establish firm limits for total CDF and LERF, but recommends that risk-informed applications be implemented only when the total plant risk is no more than about 1E-4/year for CDF and 1E-5/year for LERF.

Demonstrating that these limits are met confirms that the risk metrics of NEl-06-09-A can be applied to the MNGP Risk Informed Completion Time (RICT) Program.

2.0 TECHNICAL APPROACH The MNGP PRA model maintenance and update process includes model of record updates which are full scope model updates that include all documentation required by the American Society of Mechanical Engineers (ASME)/American Nuclear Society (ANS) RA-Sa-2009 PRA Standard (hereafter ASME/ANS PRA Standard), Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications (Reference 7) and application specific models which are created using the model of record as a starting point and modified to update the PRA, due to implementation of plant changes, or correct errors to support one or more risk-informed applications. The application specific models contain one or more updates to the model of record and are documented as a standalone model. As documented in Enclosure 2, the current model of record for the Full Power Internal Events (FPIE) PRA is Revision 5.0 and the model of record for the fire PRA is also Revision 5.0. In addition to the model of record, the fire PRA model has been revised to create an application specific model. The FPRA Revision 5.0-APP2 model was created to support the Surveillance Frequency Control Program. This application-specific model was used as a starting point to support creation of sample RICT Page 1 of 4

L-MT-20-003 NSPM timeframes in Enclosure 1. For completeness, the baseline CDF/LERF values from both the models of record and the application-specific models are included in this enclosure.

The following tables include the MNGP CDF and LERF values from a quantification of the applicable model revision for both FPIE (including internal flooding) and fire PRA. The tables also include an estimate of the seismic contribution to CDF and LERF, as described in . Other external hazards are below accepted screening criteria and therefore do not contribute significantly to the totals.

Table E5-1 lists the CDF and LERF values from the baseline Model of Record (MOR) FPIE Revision 5.0 (including internal flooding) and Fire PRA Revision 5.0 models (References 8 and 9, respectively).

Table E5-1: Total Baseline Model of Record CDF/LERF MNGP Baseline CDF MNGP Baseline LERF Source Contribution Source Contribution Internal Events PRA 6.54E-06 Internal Events PRA 6.10E-07 (PRA-MT-QU Rev 5.0 MOR) (PRA-MT-QU Rev 5.0 MOR)

Fire PRA 5.75E-05 Fire PRA 4.91E-06 (FPRA-MT-FQ Rev 5.0 MOR) (FPRA-MT-FQ Rev 5.0 MOR)

Seismic CDF1 3.00E-05 Seismic LERF1 1.50E-06 Other External Events No significant Other External Events No significant contribution contribution Total CDF 9.40E-05 Total LERF 7.02E-06 Table E5-1 Notes:

1. Based on the seismic CDF and LERF penalty factors calculated in Enclosure 4.

Table E5-2 lists the CDF and LERF values from the baseline MOR FPIE Revision 5.0 (including internal flooding) and fire PRA Rev 5.0-APP2 models (References 8 and 10, respectively).

Page 2 of 4

L-MT-20-003 NSPM Table E5-2: Total Baseline Application Specific Model CDF/LERF MNGP Baseline CDF MNGP Baseline LERF Source Contribution Source Contribution Internal Events PRA 6.54E-06 Internal Events PRA 6.10E-07 (PRA-MT-QU Rev 5.0 MOR) (PRA-MT-QU Rev 5.0 MOR)

Fire PRA 5.70E-05 Fire PRA 4.73E-06 (FPRA Rev 5.0-APP2) (FPRA Rev 5.0-APP2)

Seismic CDF1 3.00E-05 Seismic LERF1 1.50E-06 Other External Events No significant Other External Events No significant contribution contribution Total CDF 9.36E-05 Total LERF 6.84E-06 Table E5-2 Notes:

1. Based on the seismic CDF and LERF penalty factors calculated in Enclosure 4.

As demonstrated in Tables E5-1 and E5-2, the total CDF and total LERF for both the PRA models of record and application-specific PRA models are within the guidelines set forth in RG 1.174 and support small changes in risk that may occur during RICT entries following implementation of the RICT Program. Therefore, the proposed MNGP RICT Program implementation is consistent with NEI 06-09-A guidance.

3.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

3. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated May 2011 (ADAMS Accession No. ML100910006)

4. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014)

Page 3 of 4

L-MT-20-003 NSPM

5. Letter (L-MT-18-010) from NSPM to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, dated March 28, 2018 (ADAMS Accession No. ML18087A323)

6. Letter (L-MT-17-083) from NSPM to the NRC, License Amendment Request:

Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated December 19, 2017 (ADAMS Accession No. ML17353A189)

7. ASME Standard ASME/ANS RA-Sa-2009, Addenda to ASME/ANS RA-S-2008 Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, dated February 2, 2009

8. NSPM PRA Document PRA-MT-QU, Quantification Notebook, Revision 5.0, dated March 2019

9. NSPM PRA Document FPRA-MT-FQ, Fire Quantification Notebook, Revision 5.0, dated March 2019

10. NSPM PRA Document PRA-CALC-18-009, TSTF-425 PRA STRIDE Evaluations, Revision 1, dated November 2019 Page 4 of 4

ENCLOSURE 6 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b JUSTIFICATION OF APPLICATION OF AT-POWER PRA MODELS TO SHUTDOWN MODES (1 Page Follows)

L-MT-20-003 NSPM Justification of Application of At-Power PRA Models to Shutdown Modes

1.0 INTRODUCTION

This enclosure is not applicable to the Monticello Nuclear Generating Plant submittal. Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy, is proposing to apply the Risk-Informed Completion Time Program only in Modes 1 and 2.

Page 1 of 1

ENCLOSURE 7 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b PRA MODEL UPDATE PROCESS (3 Pages Follow)

L-MT-20-003 NSPM PRA Model Update Process

1.0 INTRODUCTION

Section 4.0, Item 8 of the NRC Final Safety Evaluation (Reference 1) of the Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 2), requires that the license amendment request (LAR) provide a discussion of the licensees programs and procedures which assure the PRA models supporting the RMTS are maintained consistent with the as-built/as-operated plant. Norther States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), maintains a process and procedure to maintain and update the Probabilistic Risk Assessment (PRA) models in manner to ensure these models reflect the as-built, as-operated plant. For NSPM, a PRA model of record (MOR) is used to evaluate plant risks for the Monticello Nuclear Generating Plant (MNGP).

This enclosure describes the administrative controls and procedural processes applicable to the configuration control and update of the Probabilistic Risk Assessment (PRA) models used to support the Risk-Informed Completion Time (RICT) Program, which will be in place to ensure that these models reflect the as-built/as-operated plant. Plant changes, including physical modifications and procedure revisions, will be identified and reviewed prior to implementation to determine if they could impact the PRA models per the PRA Change Database Use and Application Guide (Reference 3) and the PRA Guideline for Model Maintenance and Update (Reference 4). The PRA model update process will ensure these plant changes are incorporated into the PRA models as appropriate. The process will include discovered conditions and errors associated with the PRA models which will be addressed in the applicable site Corrective Action Program (CAP).

Should a plant change or a discovered condition be identified with potential significant impact to the RICT Program calculations as defined by the plant procedures (References 3 and 4), an unscheduled update to the PRA model will be implemented. Otherwise, the PRA model change is incorporated into a subsequent periodic model update. Such pending changes are considered when evaluating other changes until they are fully implemented into the PRA models. Periodic updates are nominally performed every two fuel cycles.

2.0 PRA MODEL UPDATE PROCESS 2.1 Internal Event, Internal Flood and Fire PRA Model Maintenance and Update The NSPM fleet risk management process and model governance ensures that the applicable PRA MOR and application-specific models used for the RICT Program reflects the as-built, as-operated plant for MNGP. The PRA model update process delineates the responsibilities and guidelines for controlling and updating the full power internal events, internal flood and fire PRA models including both the periodic and unscheduled PRA model updates.

Page 1 of 3

L-MT-20-003 NSPM The process includes provisions to track, evaluate and prioritize potential impact areas affecting the technical elements of the PRA models (e.g., due to plant changes, plant/industry operational experience, or errors or limitations identified in the model), assessing the individual and cumulative risk impact of unincorporated changes, and controlling the model and necessary computer files, including those associated with the Configuration Risk Management (CRM) model.

2.2 Review of Plant Changes for Incorporation into the PRA Model

1. The NSPM PRA Change Database (PCD) is the tool used to identify and track all PRA model changes including physical modifications to the facility and to operating practices and procedures with consideration of both temporary and permanent changes. Changes with potential significant risk impact are tracked using the NSPM PRA Change Database (PCD) and the Corrective Action Process (CAP).

2. Plant changes or discovered conditions captured in the PCD are subject to an applicability review for potential impacts to the PRA models including the CRM model and the subsequent risk calculations which support the RICT Program (NEI 06-09-A, Section 2.3.4, Items 7.2 and 7.3, and Section 2.3.5, Items 9.2 and 9.3).

3. Plant changes are preliminary evaluated and screened based on risk criteria consistent with fleet procedural requirements (References 3 and 4) with consideration of the cumulative impact of other pending changes. Changes with potential for significant impact will be incorporated in an unscheduled update and application-specific PRA model(s), consistent with the NEI 06-09-A guidance (Section 2.3.5, Items 9.2) with the PRA model published the following quarter.

4. Otherwise, the change is assigned a priority and is incorporated at a subsequent periodic updated consistent with fleet procedural requirements (Reference 4).

5. PRA MOR updates for the MNGP are nominally performed once every two fuel cycles, but may be sooner or later depending on plant needs and management discretion.

6. If a PRA model change is required for the CRM model, but cannot be immediately implemented for a significant plant change or discovered condition, one of the following is applied:

a. Analysis to address the expected risk impact of the change via risk-informed screening criteria will be performed. In such a case, these analyses become part of the RICT Program calculation process until the plant changes are incorporated into the published PRA model and within the appropriate time associated with the priority of the update.

b. The application and use of such bounding analyses, as appropriate, may serve as quantitative analyses to support the expected risk impact of the change and is consistent with the guidance of NEI 06-09-A.

Page 2 of 3

L-MT-20-003 NSPM

c. Appropriate administrative restrictions on the use of the RICT program for extended Completion Time are put in place until the model changes are completed, consistent with the guidance of NEI 06-09-A, Section 2.3.5, Item 9.3.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9.3.

3.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

3. NSPM Procedure FP-PE-PRA-01, PRA Change Database Use and Application Guide, Revision 9

4. NSPM Procedure FP-PE-PRA-02, PRA Guideline for Model Maintenance and Update, Revision 17 Page 3 of 3

ENCLOSURE 8 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b ATTRIBUTES OF THE CONFIGURATION RISK MANAGEMENT MODEL (4 Pages Follow)

L-MT-20-003 NSPM Attributes of the Configuration Risk Management Model

1.0 INTRODUCTION

Section 4.0, Item 9 of the NRC Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 2), requires that the license amendment request (LAR) provide a description of the probabilistic risk assessment (PRA) models and tools used to support the RMTS. This includes identification of how the baseline probabilistic risk assessment (PRA) model will be modified for use in the Configuration Risk Management (CRM) tools, quality requirements applied to the PRA models and CRM tools, consistency of calculated results from the PRA and CRM model, and training and qualification programs applicable to personnel responsible for development and use of the CRM tools. This item should also confirm that the RICT Program tools can be readily applied for each Technical Specification (TS) Limiting Conditions for Operation (LCO) within the scope of the plant-specific submittal.

This enclosure describes the necessary changes to the peer-reviewed baseline PRA models for use in the Configuration Risk Management Program (CRMP) software to support the Risk-Informed Completion Time (RICT) Program. The process that will be employed to adapt the baseline models is demonstrated:

a) To preserve the core damage frequency (CDF) and large early release frequency (LERF) quantitative results; b) To maintain the quality of the peer-reviewed PRA models; and c) To correctly accommodate changes in risk due to configuration-specific consideration.

Quality control and training programs applicable to the RICT Program are also discussed in this enclosure.

2.0 TRANSLATION OF BASELINE MODEL FOR USE IN CONFIGURATION RISK The baseline PRA model for internal events, including internal flood and internal fire, are peer-reviewed models. These models are updated when necessary to incorporate plant changes to reflect the as-built/as-operate plant as discussed in Enclosure 7. The PRA models are fully integrated as an all hazards model, which may be optimized for quantification speed but will be verified to provide results equivalent to the baseline models and in accordance with approved procedures.

The CRM software will be used to facilitate all configuration-specific risk calculations and support RICT Program Implementation. The baseline PRA models are modified to create a CRM-specific model as follows:

Page 1 of 4

L-MT-20-003 NSPM

The unit availability factor is set to 1.0 (unit available).

Maintenance unavailability is set to zero/false unless unavailable due to the con-figuration.

Mutually exclusive combinations, including normally disallowed maintenance combinations, are adjusted to allow accurate analysis of the configuration.

For systems where some trains are in service and some in standby, the CRM model addresses the configurations of the plant in a manner to include defining in-service trains and alignments as needed. There are no changes in success criteria needed to account for the time in the core operating cycle or for seasonal variations.

The CRM software is designed to quantify the configuration for internal events, including internal flooding and fire, and seismic risk contribution when calculating the risk management action time (RMAT) and RICT. The unique aspect of the CRM software for the RICT Program will be the quantification of the fire risk and the inclusion of the seismic risk contribution.

The treatment of common cause failure (CCF) will be in accordance with the approach described in NEI 06-09. For planned RICTs (e.g., to perform preventive maintenance tasks),

no changes in CCF factors would be made in the CRM model since no failures have occurred and adjustment of CCF groups to account for the out-of-service component would result in a net reduction in the total CCF probability for the remaining in-service components. For emergent failures, Operations personnel would perform an extent of condition evaluation (using existing plant processes) to determine if any CCF potential exists. If CCF cannot be ruled out and the potential exists for a loss of function, then RICT would not apply. If the potential CCF is determined to not result in a loss of function, then a quantitative or qualitative evaluation of the impact on the RICT would be performed. If a quantitative evaluation of increased CCF probability is performed, the adjustment to CCF probability will be made in accordance with RG 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking:

Technical Specifications, Revision 1 (Reference 6). If a qualitative evaluation is performed, Risk Management Actions to manage a possible common cause failure would be considered for implementation.

3.0 QUALITY REQUIREMENT AND CONSISTENCY OF PRA MODEL AND CONFIGURATION RISK MANAGEMENT TOOLS The approach for establishing and maintaining the quality of the PRA models, including the CRM model, includes both a PRA maintenance and update process (described in ), and the use of self-assessments and independent peer review (described in ).

The information provided in Enclosure 2 demonstrates that the MNGP internal events (including internal flooding) and internal fire PRA models reasonably conform to the associated industry standards endorsed by Regulatory Guide (RG) 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Page 2 of 4

L-MT-20-003 NSPM Revision 2 (Reference 3). This information provides a robust basis for concluding that the PRA models are of sufficient quality for use in risk-informed licensing actions.

For maintenance of an existing CRM model, changes made to the baseline PRA model in translation to the CRM model will be controlled and documented in accordance with Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), PRA procedures (References 4 and 5). These procedures address the process for identification and corrective actions to evaluate and disposition model errors and changes to ensure models are accurate, as described in Enclosure 7. Because the CRM model is developed from the complete baseline PRA models (i.e., it is not a simplified model), the results of this model would be expected to be essentially identical to those of the constituent baseline PRA models for internal events, internal flooding, and internal fire hazards.

Acceptance testing is performed after every CRM model update to ensure that the software works as intended and that quantification results are reasonable. The CRM model is nominally updated to reflect the as-built, as-operated plant once every two fuel cycles (Reference 5), but may be sooner or later depending on plant needs and management discretion.

These actions satisfy NEI 06-09-A, Section 2.3.5, Item 9.

4.0 TRAINING AND QUALIFICATION The PRA staff is responsible for development and maintenance of the CRM model. Operations and Work Control staff will use the configuration risk tool under the RICT Program. The PRA and Operations staff are trained in accordance with a program using National Academy for Nuclear Training ACAD documents, which is also accredited by Institute of Nuclear Power Operations (INPO).

5.0 APPLICATION OF THE CONFIGURATION RISK TOOL TO THE RICT PROGRAM SCOPE The Electrical Power Research Institute (EPRI) Phoenix Risk Monitor software, or equivalent, will be used to facilitate all configuration-specific risk calculations and support the RICT Program implementation. This program is specifically designed to support the implementation of RMTS. The Phoenix Risk Monitor software will permit the user to evaluate all plant configurations using appropriate mapping of plant equipment to the PRA basic events. The equipment in the scope of the RICT program shall be able to be evaluated in the appropriate PRA models. The Phoenix Risk Monitor software implementation will conform to NSPM software quality assurance requirements.

6.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

Page 3 of 4

L-MT-20-003 NSPM

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

3. NRC Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, dated March 2009 (ADAMS Accession No. ML090410014)

4. NSPM Procedure FP-PE-PRA-01, PRA Change Database Use and Application Guide, Revision 9

5. NSPM Procedure FP-PE-PRA-02, PRA Guideline for Model Maintenance and Update, Revision 17

6. NRC Regulatory Guide 1.177, An Approach for Plant-Specific, Risk-Informed Decisionmaking: Technical Specifications, Revision 1, dated May 2011 (ADAMS Accession No. ML100910008)

Page 4 of 4

ENCLOSURE 9 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b KEY ASSUMPTIONS AND SOURCES OF UNCERTAINTY (5 Pages Follow)

L-MT-20-003 NSPM Key Assumptions and Sources of Uncertainty

1.0 INTRODUCTION

The purpose of this enclosure is to disposition the impact of Probabilistic Risk Assessment (PRA) modeling epistemic uncertainty for the Risk Informed Completion Time (RICT) Program.

Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1), Section 2.3.4, item 10 requires an evaluation to determine insights that will be used to develop risk management actions (RMAs) to address these uncertainties.

The baseline internal events PRA (including internal flood) and fire PRA models document assumptions and sources of uncertainty and these were reviewed during the model peer reviews. Therefore, the approach taken is to review these documents to identify the items which may be directly relevant to the RICT Program calculations, to perform sensitivity analyses where appropriate, to discuss the results and to provide dispositions for the RICT Program. The Monticello Nuclear Generating Plant (MNGP) internal events (including internal flooding) and fire PRA (FPRA) models described within this LAR are arranged in a combined one-top model configuration. These models are the same peer reviewed models described in Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), submittals associated with the adoption of 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors (Reference 2), and TSTF-425, Relocate Surveillance Frequencies to Licensee Control - RITSTF Initiative 5b (Reference 3), respectively, with revisions to reflect the as-built/as-operated plant.

The epistemic uncertainty analysis approach described below applies to the internal events PRA and any epistemic uncertainty impacts that are unique to fire PRA are also addressed. In addition, NEI 06-09-A requires that the uncertainty be addressed in RICT Program Real Time Risk tools by consideration of the translation from the PRA model. The Real Time Risk model, also referred to as the Configuration Risk Management (CRM) model, discussed in of this license amendment request (LAR), includes internal events, flooding events and fire events. The model translation uncertainties evaluation and impact assessment are limited to new uncertainties that could be introduced by application of the CRM tool during RICT Program calculations.

2.0 ASSESSMENT OF INTERNAL EVENTS PRA EPISTEMIC UNCERTAINTY IMPACTS In order to identify key sources of uncertainty for the RICT Program application, an evaluation of internal events base PRA model uncertainty was performed, based on the guidance in NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1 (Reference 4) and the Electric Power Research Institute (EPRI) Technical Report (TR)-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments (Reference 5). As described in NUREG-1855, Revision 1, sources of uncertainty include parametric uncertainties, modeling uncertainties, and completeness (or scope and level of detail) uncertainties.

Page 1 of 5

L-MT-20-003 NSPM Parametric uncertainty was addressed as part of the MNGP baseline PRA model quantification (Reference 6). Modeling uncertainties are considered in both the base PRA and in specific risk-informed applications. Assumptions are made during the PRA development as a way to address a particular modeling uncertainty. Plant-specific assumptions made for each of the MNGP internal events PRA technical elements are documented in the individual notebooks for those technical elements. The internal events PRA model uncertainties evaluation is documented in Reference 7 and considers the modeling uncertainties for the base PRA by identifying assumptions, determining if those assumptions are related to a source of modeling uncertainty and characterizing that uncertainty, as necessary. EPRI compiled a listing of generic sources of modeling uncertainty to be considered for each PRA technical element (Reference 4), and the evaluation performed for the MNGP (Reference 7) considered each of the generic sources of modeling uncertainty as well as the plant-specific sources. A specific evaluation of the identified uncertainties for their impact on the RICT application was performed in Reference 8.

Completeness uncertainty addresses scope and level of detail. Uncertainties associated with scope and level of detail are documented in the PRA (Reference 7) and are then considered for their impact (Reference 8) on this LAR. No specific issues of PRA completeness have been identified relative to this LAR, based on the results of the internal events PRA (including internal flood) review.

NEI 06-09-A recommends that uncertainty be evaluated for specific configurations included in the RICT program (i.e., specific limiting conditions for operation (LCO) included in the RICT program). Uncertainties leading to conservative modeling that would result in more limiting RICTs than might otherwise be calculated are not considered as key sources of uncertainty for the RICT program. Also, since the RICT calculations are based on delta-risk (rather than absolute risk) and are primarily influenced by removing equipment from service, potential uncertainties that pertain to non-equipment-related parts of the model (such as human error events, initiating event frequencies, etc.) will generally be negated out of the delta-risk RICT calculation.

Based on the Reference 8 review of internal events sources of uncertainty, no specific uncertainty issues have been identified that would impact the RICT application.

3.0 ASSESSMENT OF FIRE PRA EPISTEMIC UNCERTAINTY IMPACTS The purpose of the following discussion is to address the epistemic uncertainty in the MNGP FPRA. The FPRA model includes various sources of uncertainty that exist because there is both inherent randomness in elements that comprise the FPRA and because the state of knowledge in these elements continues to evolve. The development of the MNGP FPRA was guided by NUREG/CR-6850, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology (References 9 and 10), and the FPRA model used consensus models described in NUREG/CR-6850. Enclosure 2 provides a detailed discussion of the peer review Facts and Observations (F&Os) and the resolutions.

Page 2 of 5

L-MT-20-003 NSPM The MNGP FPRA was developed using consensus methods outlined in NUREG/CR-6850 and interpretations of technical approaches as required by the NRC. Further, appropriate fire impacts were identified for the systems modeled in the internal events PRA and were addressed in the FPRA. Fire PRA methods were based on NUREG/CR-6850, as well as other more recent NUREGs (e.g., NUREG-7150, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE) (Reference 11), NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, United States Fire Event Experience Through 2009 (Reference 12), and NUREG-2178, Refining And Characterizing Heat Release Rates From Electrical Enclosures During Fire (RACHELLE-FIRE) - Volume 1: Peak Heat Release Rates and Effects of Obstructed Plume (Reference 13), and published frequently asked questions (FAQs) for the FPRA.

NSPM used guidance provided in NUREG-1855 and EPRI TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (Reference 14), to review plant-specific and generic uncertainties associated with the FPRA for the RICT Program application. The potential sources of model uncertainty in the MNGP FPRA model were evaluated for their potential impacts on the RICT calculations in Reference 8. The review identified no specific uncertainty issues that would impact the RICT application.

4.0 ASSESSMENT OF TRANSLATION (REAL TIME RISK MODEL) UNCERTAINTY IMPACTS Incorporation of the baseline PRA models into the CRM model used for RICT Program calculations may introduce new sources of model uncertainty. Table E9-1 provides a description of the relevant model changes and dispositions of whether any of the changes made represent possible new sources of model uncertainty that must be addressed. Refer to for additional discussion on the CRM model.

Table E9-1: Assessment of Translation Uncertainty Impacts CRM Model Change and Part of Model Assumptions Affected Impact on Model Disposition PRA model logic structure Fault tree logic The model, if restructured, Since the restructured model may be optimized to model will be logically equivalent will produce comparable increase solution speed. structure, and produce results numerical results, this is not a affecting both comparable to the base source of uncertainty for the internal events PRA logic model. RICT program.

and fire PRAs Incorporation of seismic Calculation of The addition of Since this is a conservative risk bias to support RICT RICT and conservative impacts for approach for addressing Program risk calculations. RMAT within seismic events has no seismic risk in the RICT the CRM impact on base PRA or Program, it is not a source of Conservative values for model CRM model. Impact is translation uncertainty, and the seismic delta CDF reflected in calculation of RICT Program calculations are and LERF are applicable. all RICTs and RMATs. not impacted. Therefore, no Page 3 of 5

L-MT-20-003 NSPM Table E9-1: Assessment of Translation Uncertainty Impacts CRM Model Change and Part of Model Assumptions Affected Impact on Model Disposition mandatory RMAs are required.

Set plant availability Risk metric Initiating event This change is consistent with (Reactor Critical Years calculated in frequencies are calculated CRM Tool practice; therefore, Factor) basic event to 1.0. per reactor in per reactor critical this change does not represent critical years years. The availability a source of translation versus per factor is used in the base uncertainty and RICT Program calendar PRA to convert the risk calculations are not impacted.

years. metric to calendar years Therefore, no mandatory RMAs for average risk. The CRM are required.

model evaluates specific configurations during at-power conditions with the reactor critical, so the conversion is not required, and the factor is 1.0.

5.0 REFERENCES

1. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

2. Letter (L-MT-18-010) from NSPM to the NRC, Application to Adopt 10 CFR 50.69, Risk-Informed Categorization and Treatment of Structures, Systems and Components for Nuclear Power Reactors, dated March 28, 2018 (ADAMS Accession No. ML18087A323)

3. Letter (L-MT-17-083) from NSPM to the NRC, License Amendment Request:

Application for Technical Specification Change Regarding Risk-Informed Justification for the Relocation of Specific Surveillance Frequency Requirements to a Licensee Controlled Program, dated December 19, 2017 (ADAMS Accession No. ML17353A189)

4. NRC NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, dated March 2017 (ADAMS Accession No. ML17062A466)

5. EPRI Technical Report TR-1016737, Treatment of Parameter and Model Uncertainty for Probabilistic Risk Assessments, dated December 2008

6. NSPM PRA Document PRA-MT-QU, Quantification Notebook, Revision 5.0, dated March 2019 Page 4 of 5

L-MT-20-003 NSPM

7. NSPM PRA Document PRA-MT-UN, Sources of Modeling Uncertainty Notebook, Revision 5.0, dated March 2019

8. NSPM PRA Document PRA-CALC-MT-19-018, MNGP Impact of Model Uncertainty to the RICT Process, Revision 0, dated February 2020

9. NRC NUREG/CR-6850, Volume 2, EPRI/NRC-RES Fire PRA Methodology for Nuclear Power Facilities, Volume 2: Detailed Methodology, dated September 2005 (ADAMS Accession No. ML15167A411)

10. NRC NUREG/CR-6850, Supplement 1, Fire Probabilistic Risk Assessment Methods Enhancements, dated September 2010 (ADAMS Accession No. ML103090242)

11. NRC NUREG/CR 7150, Volume 1, Joint Assessment of Cable Damage and Quantification of Effects from Fire (JACQUE-FIRE), Volume 1: Phenomena Identification and Ranking Table (PIRT) Exercise for Nuclear Power Plant Fire-Induced Electrical Circuit Failure, dated October 2012 (ADAMS Accession No. ML12313A105)

12. NRC NUREG-2169, Nuclear Power Plant Fire Ignition Frequency and Non-Suppression Probability Estimation Using the Updated Fire Events Database, United States Fire Event Experience Through 2009, Revision 0, dated January 2015 (ADAMS Accession No. ML15016A069)

13. NRC NUREG-2178, Volume 1, Refining and Characterizing Heat Release Rates from Electrical Enclosures During Fire (RACHELLE-FIRE) - Volume 1: Peak Heat Release Rates and Effects of Obstructed Plume, Revision 0, dated April 2016 (ADAMS Accession No. ML16110A140)

14. EPRI Technical Report TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, dated December 2012 Page 5 of 5

ENCLOSURE 10 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b PROGRAM IMPLEMENTATION (4 Pages Follow)

L-MT-20-003 NSPM 0 Program Implementation

1.0 INTRODUCTION

Section 4.0, Item 10 of the NRC Final Safety Evaluation (Reference 1) for Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 2), requires that the license amendment request (LAR) provide a description of the implementing programs and procedures regarding plant staff responsibilities for the Risk Managed Technical Specifications (RMTS) implementation, and specifically discuss the decision process for risk management action (RMA) implementation during a Risk-Informed Completion Time (RICT). Several procedures and processes are detailed in other enclosures that are not repeated in this enclosure addressing Probabilistic Risk Assessment (PRA) Model Update, Cumulative Risk Assessment, Monitoring Program and Risk Management Actions.

This enclosure provides a description of the implementing programs and the administrative controls and procedures regarding the plant staff responsibilities for the RICT Program, including training of plant personnel, and specifically discusses the decision process for RMA implementation during extended Completion Times (CT).

2.0 RICT PROGRAM AND PROCEDURES Northern States Power Company, a Minnesota corporation, doing business as Xcel Energy (hereafter NSPM), will develop a program description and implementing procedures for the RICT Program. The program description will establish the management responsibilities and general requirements for risk management, training, implementation, and monitoring of the RICT program. More detailed procedures will provide specific responsibilities, limitations, and instructions for implementing the RICT program. The program description and implementing procedures will incorporate the programmatic requirements for the RMTS included in NEI 0609-A. The program will be integrated with the online work control process. The work control process currently identifies the need to enter a Limiting Conditions for Operation (LCO) action statement as part of the planning process and will additionally identify whether the provisions of the RICT program are requirements for the planned work. The risk thresholds associated with 10 CFR 50.65(a)(4) performance monitoring provisions and Mitigating System Performance Index (MSPI) thresholds will assist in controlling the amount of risk expended in use of the RICT program (Reference 2, Table 3-1).

The Operations Department (licensed operators) is responsible for compliance with the Technical Specification (TS) and will be responsible for the implementation of the RICTs and RMAs. Entry into the RICT program will require management approval prior to pre-planned activities and as soon as practicable following emergent conditions.

Page 1 of 4

L-MT-20-003 NSPM 0 The procedures for the RICT program will address the following attributes consistent with NEI 06-09-A:

Plant management positions with authority to approve entry into RICT Program.

Important definitions related to the RICT Program.

Departmental and position responsibilities for activities in the RICT Program.

Plant conditions for which the RICTs can be applied under voluntary and emergent conditions.

Limitations on implementing RICTs under voluntary and emergent conditions.

Implementation of the RICT and risk management action time (RMAT) within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or within the most limiting front-stop CT after a plant configuration change.

Requirement to identify and implement RMAs when the RMAT is exceeded or is anticipated to be exceeded, and to consider common cause failure potential in emergent RICTs.

Guidance on the use of RMAs including the conditions under which they may be credited in RICT calculations.

Conditions for exiting a RICT.

Documentation requirements related to individual RICT evaluations, implementation of extended CTs, and accumulated annual risk.

3.0 RICT PROGRAM TRAINING The scope of training for the RICT Program will include rules for the new TS program, configuration risk management (CRM) software (Electric Power Research Institute (EPRI)

Phoenix Risk Monitor), TS Actions included in the program, and procedures. This training will be conducted for the following NSPM personnel:

Site Personnel

Operations Manager

Operations Personnel (Licensed and Non-Licensed)

Outage Manager

Plant Manager

Work Planning Personnel

Regulatory Affairs Personnel

Selected Maintenance Personnel Page 2 of 4

L-MT-20-003 NSPM 0

Other Selected Management Fleet Support & Corporate Personnel

Operations Corporate Functional Area Manager

Operations Training

Regulatory Affairs Personnel

Risk Management Personnel and Managers

Training Management and Personnel

Engineering

Other Selected Management Training will be carried out in accordance with the NSPM training procedures and processes.

These procedures were written based on the Institute of Nuclear Power Operations (INPO)

Accreditation requirements, as developed and maintained by the Nation Academy for Nuclear Training. NSPM has planned two levels of training for the implementation of the RICT Program. They are described below:

3.1 Level 1 Training This is the most detailed training. It is intended for those individuals who will be directly involved in the implementation of the RICT Program. This level of training includes the following attributes:

Specific training on the revised TS.

Record keeping requirements.

Case studies.

Hands-on experience with the CRM tool for calculating RMAT and RICT.

Identifying appropriate RMAs.

Common cause failure RMA considerations in emergent RICTs.

Other detailed aspects of the RICT Program.

3.2 Level 2 Training This training is applicable to plant management positions with authority to approve entry into the RICT Program, as well as supervisors, managers, and other personnel who will closely support RICT implementation. Additionally, this training with be given to remaining personnel who require an awareness of the RICT Program. These individuals need a broad understanding of the purpose, concepts, and limitations of the RICT Program. Level 2 training is different from Level 1 training in that hands-on time with the Real Time Risk Tool, case studies, and other specifics are not required.

All of the above training will be conducted within the procedural guidance set forth in NSPMs training and qualification procedures, unless otherwise noted.

Page 3 of 4

L-MT-20-003 NSPM 0

4.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

Page 4 of 4

ENCLOSURE 11 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b MONITORING PROGRAM (2 Pages Follow)

L-MT-20-003 NSPM 1 Monitoring Program

1.0 INTRODUCTION

Section 4.0, Item 12 of the NRC Final Safety Evaluation (SE) (Reference 1) for Nuclear Energy Institute (NEI) Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 2), requires that the license amendment request (LAR) provide a description of the implementing and monitoring program as described in Regulatory Guide (RG) 1.174, An Approach For Using Probabilistic Risk Assessment In Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1 (Reference 3), and NEI 06-09-A. (Note that Revision 2 of RG 1.174 (Reference 4) was issued by the NRC in May 2011 which made editorial changes to the applicable section referenced in the NRC SE for Section 4.0, Item 12.)

This enclosure provides a description of the process applied to govern and monitor calculation of cumulative risk impact in support of the Risk-Informed Completion Time (RICT) Program, specifically the calculation of cumulative risk of extended Completion Times (CTs). Calculation of the cumulative risk for the RICT Program is discussed in Step 14 of Section 2.3.1 and Step 7.1 of Section 2.3.2 of NEI 06-09-A. General requirements for a Performance Monitoring Program for risk-informed applications are discussed in Element 3 of the RG 1.174, Revision 2.

2.0 DESCRIPTION

OF MONITORING PROGRAM The RICT Program will require calculation of cumulative risk impacts at least once every two fuel cycles. For the assessment period under evaluation, plant and system historical data is collected to establish the risk increase associated with each application of an extended CT for both core damage frequency (CDF) and large early release frequency (LERF). The total risk impact will be calculated by summing all risk associated with each RICT application. This summation is the change in CDF or LERF above the zero maintenance baseline levels during the period of operation in the extended CT (i.e., beyond the front-stop CT). The change in risk will be converted to average annual values and documented every two fuel cycles.

The total average annual change in risk for extended CTs will be compared to the guidance of RG 1.174, Revision 2, Figures 4 and 5, acceptance guidelines for CDF and LERF, respectively. If the actual annual risk increase is acceptable (i.e., not in Region I of Figures 4 and 5 of RG 1.174, Revision 2), then RICT Program implementation is acceptable for the assessment period. Otherwise, further assessment of the cause of exceeding the acceptance guidelines of RG 1.1.74, Revision 2, and implementation of any necessary corrective actions to ensure future plant operation is within the guidelines will be conducted under the corrective action program (CAP).

The evaluation of the cumulative risk will also identify areas for consideration, such as:

RICT applications that dominated the risk increase.

Page 1 of 2

L-MT-20-003 NSPM 1

Risk contributions from planned vs. emergent RICT applications.

Risk Management Actions (RMA) implemented but not credited in the risk calculations.

Risk impact from applying RICT to avoid multiple shorter duration outages.

Based on a review of the considerations above, corrective actions will be developed and implemented as appropriate. These actions may include:

Administrative restrictions of the use of RICTs for specific high-risk configurations.

Additional RMAs for specific configurations.

Rescheduling planned maintenance activities.

Deferring planned maintenance to shutdown conditions.

Use of temporary equipment to replace out-of-service systems, structures, or components (SSC).

Plant modifications to reduce risk impact of future planned maintenance configurations.

In addition to impacting cumulative risk, the implementation of the RICT Program may potentially impact the unavailability of SCCs. The Maintenance Rule (MR) monitoring programs under 10 CFR 50.65 provide for evaluation and disposition of unavailability impacts which may be incurred from implementation of the RICT Program. The SSCs in the scope of the RICT Program which are also in the scope of the MR allows the use of the MR Program.

The monitoring program of the MR, along with the specific assessment of cumulative risk impact described above, serve as the Implementation and Monitoring Program for the RICT Program as described in Element 3 of RG 1.174, Revision 1, and NEI 06-09-A.

3.0 REFERENCES

1. Letter from the NRC to NEI, Final Safety Evaluation for Nuclear Energy Institute (NEI)

Topical Report (TR) NEI 06-09, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines (TAC No. MD4995), dated May 17, 2007 (ADAMS Accession No. ML071200238)

2. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

3. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 1, dated November 2002 (ADAMS Accession No. ML023240437)

4. NRC Regulatory Guide 1.174, An Approach for Using Probabilistic Risk Assessment in Risk-Informed Decisions on Plant-Specific Changes to the Licensing Basis, Revision 2, dated May 2011 (ADAMS Accession No. ML100910006)

Page 2 of 2

ENCLOSURE 12 MONTICELLO NUCLEAR GENERATING PLANT License Amendment Request Revise Technical Specifications to Adopt Risk Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times - RITSTF Initiative 4b RISK MANAGEMENT ACTION EXAMPLES (10 Pages Follow)

L-MT-20-003 NSPM 2 Risk Management Action Examples

1.0 INTRODUCTION

This enclosure describes the process for identification and implementation of Risk Management Actions (RMA) applicable during extended Completion Times (CT) and provides examples of RMAs. RMAs will be governed by plant procedures for planning and scheduling maintenance activities. The procedures will provide guidance for the determination and implementation of RMAs when entering the Risk-Informed Completion Time (RICT) Program consistent with the guidance provided in Nuclear Energy Institute (NEI) Topical Report NEI 0609-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0 (Reference 1).

2.0 RESPONSIBILITIES For planned entries into the RICT Program, Work Management is responsible for developing the RMAs with assistance from Operations and Risk Management. Operations is responsible for approval and implementation of RMAs. For emergent entry into extended CTs, Operations is also responsible for developing the RMAs.

3.0 PROCEDURAL GUIDANCE For planned maintenance activities, implementation of RMAs will be required if it is anticipated that the risk management action time (RMAT) will be exceeded. For emergent activities, RMAs must be implemented if the RMAT is reached. Also, if an emergent event occurs requiring recalculation of a RMAT already in place, the procedure will require a reevaluation of the existing RMAs for the new plant configuration to determine if new RMAs are appropriate.

These requirements of the RICT Program are consistent with the guidance of NEI 06-09-A. For emergent entry into a RICT, if the extent of condition is not known, RMAs related to the success of redundant and diverse SSCs and reducing the likelihood of initiating events relying on the affected function will be developed and implemented to address the increased likelihood of a common cause event.

RMAs will be implemented in accordance with current procedures (e.g., References 2, 3, and

4) no later than the time at which an incremental core damage probability (ICDP) of 1E-6 is reached, or no later than the time when an incremental large early release probability (ILERP) of 1E-7 is reached. If, as the result of an emergent condition, the instantaneous core damage frequency (ICDF) or the instantaneous large early release frequency (ILERF) exceeds 1E-3 per year or 1E-4 per year, respectively, RMAs are also required to be implemented. These requirements are consistent with the guidelines of NEI 0609-A.

Page 1 of 10

L-MT-20-003 NSPM 2 RMAs are developed for the configuration based on the following considerations:

1) Comparison of the initiator distribution in the current and base configurations. Initiators with increased importance will be considered for heightened awareness of operator response to those initiators.

2) Comparison of the fire compartment distribution of risk in the current and base configurations. Fire compartments with increased importance will be considered for RMAs.

3) Review of component failure importance. Components with large potential increases in risk will be considered for RMAs.

By determining which initiators, fire compartments, or components are most important from a CDF or LERF perspective for a specific plant configuration, RMAs may be created to protect these components or increase awareness of their importance. Similarly, knowledge of the initiating event or sequence contribution to the configuration-specific CDF or LERF allows development of RMAs that enhance the capability to mitigate such events. The guidance in NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1 (Reference 5), and EPRI TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty (Reference 6), will be used in examining PRA results for significant contributors for the configuration, to aid in identifying appropriate compensatory measures (e.g., related to risk-significant systems that may provide diverse protection or important support systems).

If the planned activity or emergent condition includes a SSC that is identified to impact fire PRA, as identified in the current Real Time Risk Program, fire PRA specific RMAs associated with that SSC will be implemented per the current plant procedure. Common cause RMAs will also be considered for emergent conditions where the extent of condition cannot rule out the potential for common cause failure in accordance with NSPM procedures.

It is possible to credit RMAs in RICT calculations, to the extent the associated plant equipment and operator actions are modeled in the PRA; however, such quantification of RMAs is neither required nor expected by NEI 06-09-A. Nonetheless, if RMAs will be credited to determine RICTs, the procedure instructions will be consistent with the guidance in NEI 06-09-A.

NEI 06-09-A classifies RMAs into the three categories described below:

1) Actions to increase risk awareness and control.

Shift brief

Pre-job brief

Training

Presence of strategic engineer or other expertise related to the activity

Special purpose procedure to identify risk sources and contingency plans Page 2 of 10

L-MT-20-003 NSPM 2

2) Actions to reduce the duration of maintenance activities.

Pre-staging materials

Conducting training on mock-ups

Performing the activity around the clock

Performing walk-downs on the actual system(s) to be worked on prior to beginning work

3) Actions to minimize the magnitude of the risk increase.

Suspend or minimize activities on redundant systems

Suspend or minimize activities on other systems that adversely affect the CDF or LERF

Suspend or minimize activities on systems that may cause a trip or transient to minimize the likelihood of an initiating event that the out-of-service component is meant to mitigate

Use temporary equipment to provide backup power, ventilation, etc.

Reschedule other risk-significant activities 4.0 EXAMPLES Multiple example RMAs that may be considered during a RICT Program entry to reduce the risk impact and ensure adequate defense-in-depth are provided below. Specific examples are given for unavailability of one Emergency Diesel Generator (EDG), one offsite source, one EDG and one offsite source, one battery charger, or one Residual Heat Removal (RHR) pump.

4.1 One EDG Inoperable For TS 3.8.1.B, one required EDG inoperable, additional RMAs would include:

1. Actions to increase risk awareness and control.

Briefing of the on-shift Operations crew concerning the unit activities, including any compensatory measures established.

o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for review of the appropriate emergency operating procedures for:

Loss of Offsite Power and station blackout including bus crossties.

Performance of a walkdown and validation of remaining operable EDG to validate standby/readiness condition.

Notifications to the transmission system operator (TSO) of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Page 3 of 10

L-MT-20-003 NSPM 2

Minimize the accumulation of transient combustibles in accordance with the station fire protection program for the impacted fire zones.

2. Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub-schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase.

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluation of weather conditions for threats to the reliability of offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers.

Deferral of planned maintenance or testing that affects the reliability of operable EDGs and their associated support equipment. Treat the remaining operable EDG as protected equipment.

Deferral of planned maintenance or testing on redundant train safety systems. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected EDG.

Implementation of equipment protection schemes in accordance with NSPM procedure FP-OP-PEQ-01 (Reference 7), as required.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those fire zones identified as being significant for the configuration.

4.2 One Required Offsite Circuit Inoperable For TS 3.8.1.A, one required offsite circuit inoperable, additional RMAs would include:

Page 4 of 10

L-MT-20-003 NSPM 2

1. Actions to increase risk awareness and control.

Briefing of the on-shift Operations crew concerning the unit activities, including any compensatory measures established.

o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for review of the appropriate emergency operating procedures for:

Loss of Offsite Power and station blackout including bus crossties.

Performance of a walkdown and validation of the EDGs to validate standby/readiness condition.

Notifications to the TSO of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Minimize the accumulation of transient combustible in accordance with the station fire protection program for the impacted fire zones.

2. Actions to reduce the duration of maintenance activities.

For preplanned RICT entry, creation of a sub-schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase.

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluation of weather conditions for threats to the reliability of remaining offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and station reserve transformers.

Protection of the remaining offsite source, including switchyard and transformer.

Deferral of planned maintenance or testing that affects the reliability of the EDGs and their associated support equipment. Treat these as protected equipment.

Implementation of equipment protection schemes in accordance with NSPM procedure FP-OP-PEQ-01, as required.

Page 5 of 10

L-MT-20-003 NSPM 2

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected offsite source.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those fire zones identified as being significant for the configuration.

4.3 One Required Offsite Circuit Inoperable and One Required EDG Inoperable For TS 3.8.1.D, one required offsite circuit inoperable and one required EDG inoperable, additional RMAs would include:

1. Actions to increase risk awareness and control:

Briefing of the on-shift Operations crew concerning the unit activities, including any compensatory measures established.

o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for review of the appropriate emergency operating procedures for:

Loss of Offsite Power and station blackout including bus crossties.

Performance of a walkdown and validation of remaining operable EDG to validate standby/readiness condition.

Notifications to the TSO of the configuration so that any planned activities with the potential to cause a grid disturbance are deferred.

Minimize the accumulation of transient combustible in accordance with the station fire protection program for the impacted fire zones.

For a planned RICT, prior to removal from service the actions in the loss of bus procedure associated with the inoperable EDG would be reviewed.

2. Actions to reduce the duration of maintenance activities:

For preplanned RICT entry, creation of a sub-schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

Page 6 of 10

L-MT-20-003 NSPM 2

3. Actions to minimize the magnitude of the risk increase:

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluation of weather conditions for threats to the reliability of remaining offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and station reserve transformers.

Deferral of planned maintenance or testing that affects the reliability of the EDGs and their associated support equipment for the remaining buses.

Implementation of equipment protection schemes in accordance with NSPM procedure FP-OP-PEQ-01, as required.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected bus.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those fire zones identified as being significant for the configuration.

Place unaffected trains of systems into service. For example, if one of two instrument nitrogen compressors is powered by the affected bus, the other unaffected compressor would be placed in service to support containment atmosphere control. This would be done prior to entry into a planned RICT.

4.4 Division 1 or 2 DC Electrical Power Subsystem Inoperable For TS 3.8.4.A, Division 1 or 2 DC electrical power subsystems inoperable, additional RMAs would include:

1. Actions to increase risk awareness and control:

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established.

o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

Loss of DC division Station blackout

Briefing of the on-shift operations crew concerning the impact the DC division has on the potential response to plant events such as reduced control systems.

Page 7 of 10

L-MT-20-003 NSPM 2

Perform a walkdown and validation of the remaining Emergency Core Cooling System (ECCS) train to validate standby/readiness condition.

Prior to removal from service. If a planned RICT, the actions in the associated loss of bus procedure would be reviewed and implemented.

Minimize the accumulation of transient combustible in accordance with the station fire protection program for the impacted fire zones.

Minimize activities that could trip the unit.

2. Actions to reduce the duration of maintenance activities:

For preplanned RICT entry, creation of a sub-schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase:

Proactively implement RMAs during times of high grid stress conditions, such as during high demand conditions.

Evaluation of weather conditions for threats to the reliability of remaining offsite power supplies.

Deferral of elective maintenance in the switchyard, on the station electrical distribution systems, and on the main and auxiliary transformers.

Deferral of planned maintenance or testing that affects the reliability of the EDGs and their associated support equipment for the remaining buses.

Protection of the remaining DC electrical buses.

Remove nonessential loads from battery to extend time voltage will remain above minimum required level.

Implementation of 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected bus.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those fire zones identified as being significant for the configuration.

Page 8 of 10

L-MT-20-003 NSPM 2 4.5 One Low Pressure ECCS Injection/Spray Subsystem Inoperable For TS Action 3.5.1.A, one low pressure ECCS injection/spray subsystem inoperable, the RMAs would include the following:

1. Actions to increase risk awareness and control:

Brief the on-shift operations crew concerning the unit activities, including any compensatory measures established.

o Specific focus areas would be to review appropriate emergency or abnormal operating procedures for:

LOCA events Loss of DC division Station blackout

Perform a walkdown and validation of the remaining ECCS train to validate standby/readiness condition.

Minimize the accumulation of transient combustible in accordance with the station fire protection program for the impacted fire zones.

2. Actions to reduce the duration of maintenance activities:

For preplanned RICT entry, creation of a sub-schedule related to the specific evolution which is reviewed for personnel resource availability.

Confirmation of parts availability prior to entry into a preplanned RICT.

Walkdown of work prior to execution.

3. Actions to minimize the magnitude of the risk increase:

Defer planned maintenance or testing activities on the redundant ECCS low pressure injection loops and associated support equipment. Treat those systems as protected equipment.

Defer planned maintenance or testing that affects the reliability of those safety systems that provide a defense-in-depth. If testing or maintenance activities must be performed, a review of the potential risk impact will be performed.

Minimize activities that could trip the unit.

Verify system alignment of remaining loops of low pressure ECCS.

Implementation of equipment protection schemes in accordance with NSPM procedure FP-OP-PEQ-01, as required.

Page 9 of 10

L-MT-20-003 NSPM 2

Implement 10 CFR 50.65(a)(4) fire-specific RMAs associated with the affected ECCS loop.

Maintain detection, suppression, and fire zone barriers intact and minimize transient combustibles for those fire zones identified as being significant for the configuration.

5.0 REFERENCES

1. NEI Topical Report NEI 06-09-A, Risk-Informed Technical Specifications Initiative 4b, Risk-Managed Technical Specifications (RMTS) Guidelines, Revision 0, dated October 2012 (ADAMS Accession No. ML12286A322)

2. NSPM Fleet Procedure FP-OP-RSK-01, Risk Monitoring and Risk Management, Revision 10

3. NSPM Fleet Guidance Document FG-OP-RSK-01, Configuration Risk Monitor User Guide, Revision 3

4. NRC NUREG-1855, Guidance on the Treatment of Uncertainties Associated with PRAs in Risk-Informed Decision Making, Revision 1, dated March 2017 (ADAMS Accession No. ML17062A466)

5. EPRI Technical Report TR-1026511, Practical Guidance on the Use of PRA in Risk-Informed Applications with a Focus on the Treatment of Uncertainty, dated December 2012

6. NSPM Fleet Procedure FP-OP-PEQ-01, Protected Equipment Program, Revision 23 Page 10 of 10

v t e Letter Sequence Request
EPID:L-2020-LLA-0062, TSTF-505 (Approved, Closed)
Initiation Request Acceptance... Supplement Administration Questions Answers 21 December 2020 20 April 2021 Results Approval Other: ML20328A038
MONTHYEAR2021-01-08 [Table View]

L-MT-20-003, License Amendment Request: Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times-RITSTF Initiative 4b

Text

References:

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

5.0 REFERENCES

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

5.0 REFERENCES

1.0 INTRODUCTION

1.0 INTRODUCTION

Description:

4.0 REFERENCES

1.0 INTRODUCTION

6.0 REFERENCES

1.0 INTRODUCTION

5.0 CONCLUSION

6.0 REFERENCES

1.0 INTRODUCTION

3.0 REFERENCES

1.0 INTRODUCTION

1.0 INTRODUCTION

3.0 REFERENCES

1.0 INTRODUCTION

6.0 REFERENCES

1.0 INTRODUCTION

5.0 REFERENCES

1.0 INTRODUCTION

4.0 REFERENCES

1.0 INTRODUCTION

2.0 DESCRIPTION

3.0 REFERENCES

1.0 INTRODUCTION

5.0 REFERENCES

Navigation menu

L-MT-20-003, License Amendment Request: Revise Technical Specifications to Adopt Risk-Informed Completion Times TSTF-505, Revision 2, Provide Risk-Informed Extended Completion Times-RITSTF Initiative 4b

Text

References:

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

5.0 REFERENCES

1.0 DESCRIPTION

3.0 REGULATORY ANALYSIS

4.0 ENVIRONMENTAL CONSIDERATION

5.0 REFERENCES

1.0 INTRODUCTION

1.0 INTRODUCTION

Description:

4.0 REFERENCES

1.0 INTRODUCTION

6.0 REFERENCES

1.0 INTRODUCTION

5.0 CONCLUSION

6.0 REFERENCES

1.0 INTRODUCTION

3.0 REFERENCES

1.0 INTRODUCTION

1.0 INTRODUCTION

3.0 REFERENCES

1.0 INTRODUCTION

6.0 REFERENCES

1.0 INTRODUCTION

5.0 REFERENCES

1.0 INTRODUCTION

4.0 REFERENCES

1.0 INTRODUCTION

2.0 DESCRIPTION

3.0 REFERENCES

1.0 INTRODUCTION

5.0 REFERENCES

Navigation menu

Search