ML21070A121

From kanterella
Jump to navigation Jump to search
8 to Updated Safety Analysis Report, Section 6, Plant Engineered Safeguards
ML21070A121
Person / Time
Site: Monticello Xcel Energy icon.png
Issue date: 02/11/2021
From:
Xcel Energy, Northern States Power Company, Minnesota
To:
Office of Nuclear Reactor Regulation
Shared Package
ML21070A105 List:
References
L-MT-21-004
Download: ML21070A121 (81)
v • d • e


Text

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 1 of 81 TABLE OF CONTENTS Section Page 6.1 Summary Description ..............................................................................5 6.1.1 Introduction .................................................................................................5 6.1.2 Containment Systems ................................................................................5 6.1.3 Emergency Core Cooling System (ECCS) .................................................5 6.1.3.1 Gas Accumulation Management ................................................................5 6.1.4 Other Systems or Features ........................................................................5 6.1.4.1 Main Steam Line Flow Restrictors ..............................................................5 6.1.4.2 Control Rod Velocity Limiters .....................................................................5 6.1.4.3 Control Rod Drive Housing Supports..........................................................5 6.1.4.4 Standby Liquid Control System ..................................................................5 6.1.4.5 Main Control Room and Emergency Filtration Train Building .....................5 Table 6.1-1 Plant Engineered Safeguards Emergency Core Cooling Systems Summary ....................................................................................................5 6.2 Emergency Core Cooling System (ECCS) ..............................................5 6.2.1 Introduction .................................................................................................5 6.2.1.1 ECCS Design Basis....................................................................................5 6.2.1.2 Description and Function of ECCS .............................................................5 6.2.2 Core Spray System ....................................................................................5 6.2.2.1 Design Basis ..............................................................................................5 6.2.2.2 Description .................................................................................................5 6.2.2.2.1 General.......................................................................................................5 6.2.2.2.2 Core Spray Operating Sequence ...............................................................5 6.2.2.2.3 Operating Sequence with Plant on Normal Auxiliary AC Power .................5 6.2.2.2.4 Operating Sequence with Plant on Emergency Diesel Standby Power .........................................................................................................5 6.2.2.3 Performance Analysis.................................................................................5 6.2.2.4 Inspection and Testing ...............................................................................5 6.2.2.5 Operating Sequence Response Times .......................................................5 6.2.3 Residual Heat Removal System (RHR) ......................................................5 6.2.3.1 Design Basis ..............................................................................................5 6.2.3.1.1 Safety Objective .........................................................................................5 6.2.3.1.2 Operational Objective .................................................................................5 6.2.3.1.3 Performance Objective ...............................................................................5

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 2 of 81 TABLE OF CONTENTS (CONT'D)

Section Page 6.2.3.2 Description .................................................................................................5 6.2.3.2.1 Introduction .................................................................................................5 6.2.3.2.2 Low Pressure Coolant Injection Subsystem (LPCI) ....................................5 6.2.3.2.3 Containment Spray/Cooling ........................................................................5 6.2.3.2.4 Equipment Characteristics..........................................................................5 6.2.3.2.5 Operational Sequence - LPCI .....................................................................5 6.2.3.3 Performance Analysis.................................................................................5 6.2.3.3.1 Core Flooding .............................................................................................5 6.2.3.3.2 Containment Spray and Cooling .................................................................5 6.2.3.3.3 RHR Pump Runout .....................................................................................5 6.2.3.3.4 RHR Shutdown Requirements ...................................................................5 6.2.3.3.5 RHR Intertie Line Analysis ..........................................................................5 6.2.3.4 Inspection and Testing ...............................................................................5 6.2.4 High Pressure Coolant Injection System (HPCI) ........................................5 6.2.4.1 Design Basis ..............................................................................................5 6.2.4.2 Description .................................................................................................5 6.2.4.2.1 General.......................................................................................................5 6.2.4.2.2 System Characteristics ...............................................................................5 6.2.4.2.3 Operational Sequence - HPCI ....................................................................5 6.2.4.2.4 HPCI Automatic Isolation ............................................................................5 6.2.4.2.5 HPCI Turbine Trip.......................................................................................5 6.2.4.2.6 Flow Control ...............................................................................................5 6.2.4.2.7 Standby Water Supply From Suppression Pool .........................................5 6.2.4.2.8 Continuous Operation.................................................................................5 6.2.4.2.9 Termination of Operation ............................................................................5 6.2.4.2.10 Space Cooling ............................................................................................5 6.2.4.2.11 Condensate Storage Tank..........................................................................5 6.2.4.3 Performance Analysis.................................................................................5 6.2.4.4 Inspection and Testing ...............................................................................5 6.2.5 Automatic Depressurization System (ADS) ................................................5 6.2.5.1 Design Basis ..............................................................................................5 6.2.5.2 Description .................................................................................................5 6.2.5.3 Performance Analysis.................................................................................5 6.2.5.4 Inspection and Testing ...............................................................................5

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 3 of 81 TABLE OF CONTENTS (CONT'D)

Section Page 6.2.6 ECCS Performance Evaluation ..................................................................5 6.2.7 Additional Analysis .....................................................................................5 6.2.7.1 Reliability of Mitigating Systems for Small Break LOCA Events .................5 Table 6.2-1 Reactor Core Spray Cooling System Equipment Design Parameters .................................................................................................5 Table 6.2-2 Residual Heat Removal System (RHR) Equipment Design Parameters .................................................................................................5 Table 6.2-3 High Pressure Coolant Injection System Equipment Design Parameters .................................................................................................5 6.3 Main Steam Line Flow Restrictions ........................................................5 6.3.1 Design Basis ..............................................................................................5 6.3.2 Description .................................................................................................5 6.3.3 Performance Analysis.................................................................................5 6.3.4 Inspection and Testing ...............................................................................5 6.4 Control Rod Velocity Limiters .................................................................5 6.4.1 Design Basis ..............................................................................................5 6.4.2 Description .................................................................................................5 6.4.3 Performance Analysis.................................................................................5 6.4.4 Inspection and Testing ...............................................................................5 6.5 Control Rod Drive Housing Supports .....................................................5 6.5.1 Design Basis ..............................................................................................5 6.5.2 Description .................................................................................................5 6.5.3 Performance Analysis.................................................................................5 6.5.4 Inspection and Testing ...............................................................................5 6.6 Standby Liquid Control System ..............................................................5 6.6.1 Design Basis ..............................................................................................5 6.6.1.1 Original Design Basis .................................................................................5 6.6.1.2 Design Basis in Accordance with the ATWS Rule ......................................5 6.6.1.3 Design Basis for LOCA Accident Mitigation................................................5 6.6.1.4 Design Basis for Pump Discharge Relief Valve ..........................................5 6.6.2 Description .................................................................................................5

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 4 of 81 TABLE OF CONTENTS (CONT'D)

Section Page 6.6.3 Performance Analysis.................................................................................5 6.6.4 Inspection and Testing ...............................................................................5 Table 6.6-1 Reactor Core Standby Liquid Control System Principal Design Parameters .................................................................................................5 6.7 Main Control Room, Emergency Filtration Train Building and Technical Support Center Habitability....................................................5 6.7.1 Design Basis ..............................................................................................5 6.7.2 Description .................................................................................................5 6.7.3 Performance Analysis.................................................................................5 6.7.4 Inspection and Testing ...............................................................................5 6.8 References ................................................................................................5 FIGURES ...................................................................................................................5 Figure 6.2-2 Typical Core Spray Pump Characteristics ..................................................5 Figure 6.2-4 Typical RHR Pump Characteristics ............................................................5 Figure 6.2-5 RHR - Simplified P&ID - LPCI Mode Selecting Specified Loop ..................5 Figure 6.2-6 RHR - Simplified P&ID - Containment Spray/Cooling Mode .......................5 Figure 6.2-7a LPCI System - Logic Control System Arrangement ....................................5 Figure 6.2-7b LPCI System - Loop Selection/Break Detection Functional Block Diagram ......................................................................................................5 Figure 6.3-1 Main Steamline Flow Restrictor Nozzle ......................................................5 Figure 6.4-1 Control Rod Velocity Limiter Isometric........................................................5 Figure 6.5-1 Control Rod Drive Housing Support Isometric ............................................5

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 5 of 81 6.1 Summary Description 6.1.1 Introduction This section summarizes the engineered safeguards which are provided to the reactor.

The engineered safeguards are in addition to the safety features included in the design of the reactor, reactor primary system, plant and reactor control systems and other instrumentation or process systems. Most of the safeguards features serve no function during normal plant operation but are included for the sole purpose of reducing the consequences of several postulated design basis accidents described in Section 14.

6.1.2 Containment Systems The containment systems are described in Section 5. Those containment systems which are considered engineered safety features are: (1) Primary Containment, (2) Secondary Containment, (3) Containment Isolation System, and (4) the Standby Gas Treatment System.

6.1.3 Emergency Core Cooling System (ECCS)

The ECCS provide for continuity of reactor core cooling over the entire range of postulated breaks in the reactor primary system. The design of the cooling systems assumes that, although highly improbable, there may be a double ended break in one of the pipes connected to the primary system. Systems are provided to maintain cooling whether the assumed break is in the largest or smallest pipe and whether it is a steam or water containing line.

The systems included in the ECCS are:

a. Core Spray System (CS)
b. Low Pressure Coolant Injection System (LPCI)
c. High Pressure Coolant Injection System (HPCI)
d. Automatic Depressurization System (ADS)

These systems are summarized in Table 6.1-1.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 6 of 81 6.1.3.1 Gas Accumulation Management The potential for gas accumulating in safety significant systems is a concern to the operability of the systems. Gas accumulation has the potential to air bind the pump, cause a loss of discharge pressure and flow capacity, affect core cooling flow, and cause significant pressure transients downstream of the system pumps. NRC Generic Letter 2008-01 (Reference 52) requested that each addressee evaluate its ECCS, DHR [Decay Heat Removal] system, and containment spray system licensing basis, design, testing and corrective actions to ensure that gas accumulation is maintained less than the amount that challenges operability of these systems, and that appropriate action is taken when conditions adverse to quality are identified.

In response to the Generic Letter and questions from the NRC staff, NSP provided information in May and October 2008, August 2009, and May 2011 submittals (References 57, 54, 56 and 55).

For MNGP the following plant systems or operating modes of certain systems were determined to be within the scope of and evaluated in response to GL 2008-01.

Emergency Core Cooling Systems (ECCS)

Low Pressure ECCS

Gas accumulation within the subject systems is managed by the Gas Accumulation Management Program (GAMP). The program provides instructions for Identification and evaluation of susceptible gas locations, development of gas void acceptance criteria and waterhammer load calculations, monitoring frequencies, trending, and documentation requirements. The GAMP closely concurs with industry guidance contained in NEI 09-10 (Reference 84) and within it the associated NRC SE.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 7 of 81 6.1.4 Other Systems or Features 6.1.4.1 Main Steam Line Flow Restrictors A flow restricting venturi is installed in each main steam line. Its purpose is to protect the fuel barrier by limiting the flow of steam, and therefore the loss of reactor coolant from the reactor vessel, in the postulated case of a complete severance of a main steam line.

6.1.4.2 Control Rod Velocity Limiters Control rod velocity limiters are provided as an integral part of each control rod. They provide hydraulic damping to reduce the free fall velocity of the rod and thereby reduce the consequences in the event the control rod became detached from its drive and dropped from the core.

6.1.4.3 Control Rod Drive Housing Supports Control rod drive housing supports prevent the blowout of a control rod in the event a control rod drive housing breaks or separates from the bottom of the reactor vessel.

6.1.4.4 Standby Liquid Control System The Standby Liquid Control System is designed to bring the reactor from full power to a cold, Xenon free, shutdown assuming that none of the withdrawn control rods can be inserted. The analysis is actually performed assuming all of the control rods are in the full-out condition. The system is started by the control room operator and injects a neutron absorbing solution into the reactor primary system. The system also functions to mitigate the radiological consequences of a design basis accident LOCA by maintaining suppression pool pH greater than 7 through injection of sodium pentaborate solution (reference USAR Section 14.7.2).

6.1.4.5 Main Control Room and Emergency Filtration Train Building Heating, ventilating and air conditioning equipment is provided to maintain a suitable environment in the Control Room and certain other essential areas. Radiological protection is also provided for personnel in these areas.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 8 of 81 Table 6.1-1 Plant Engineered Safeguards Emergency Core Cooling Systems Summary Effective Operating Function No. of Pumps Coolant Flow ** Pressure Range Power Core 2 3020 gpm @ 145 psi* 320 psig AC Power -

Spray (design value) to Normal or 0 psig Standby Diesel LPCI 4 6000 gpm @ 262 psi* 260 psig AC Power -

12,000 gpm @ 20 psi* to Normal or 0 psig Standby Diesel HPCI 1 3000 gpm over entire 1120 psig Reactor effective pressure to Decay range 150 psig Steam Turbo Pump ADS 3*** Cools by Controlled 1125 psig DC Power Depressurization to Normal or 50 psig Standby 125 Vdc Power

  • Reactor Vessel to drywell pressure differential.
    • See Section 14.7.2 for minimum flow requirements assumed by the plant safety analysis.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 9 of 81 6.2 Emergency Core Cooling System (ECCS) 6.2.1 Introduction The principle of coolant system design is to provide core cooling continuity over the entire range of operating conditions and postulated accident conditions. During normal operation, heat is removed from the core through the steam-turbine-condenser cycle or through the use of the reactor shutdown cooling system. When electrical power is unavailable to pump cooling water to the condensers and heat exchangers, and in the absence of any loss of coolant from the primary systems, the core is cooled by use of the Reactor Core Isolation Cooling System (RCIC).

However, the means are needed to provide continuity of core cooling during postulated accident conditions. This is accomplished by means of the Emergency Core Cooling System (ECCS) which consists of: a Core Spray System, a High Pressure Coolant Injection System (HPCI), a Residual Heat Removal System (RHR), and an Automatic Depressurization System (ADS). Each of the systems is designed to cover a specific range of accident conditions and collectively provide a redundancy of function to avoid undetected common failure mechanisms. An integrated system performance evaluation to determine the ECCS capability has been made and is discussed in Section 6.2.6.

6.2.1.1 ECCS Design Basis The performance of the Emergency Core Cooling Systems is determined through application of the 10CFR50 Appendix K evaluation models and then showing conformance to the acceptance criteria of 10CFR50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water-Cooled Nuclear Power Reactors.

The applicable acceptance criteria, extracted from 10CFR 50.46 are as follows:

(1) Peak cladding temperature. The calculated maximum fuel element cladding temperature shall not exceed 2200°F.

(2) Maximum cladding oxidation. The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

(3) Maximum hydrogen generation. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

(4) Coolable geometry. Calculated changes in core geometry shall be such that the core remains amenable to cooling. Conformance with coolable geometry requirements is demonstrated by conformance with the 2200°F peak cladding temperature limit and local cladding oxidation limit of 17% (Reference 65).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 10 of 81 (5) Long-term cooling. After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core. Long term cooling is satisfied by either 1) the core flooded above the top of active fuel, or 2) the core flooded to the elevation of the jet pump suction (2/3 core height) and one core spray system operating at design flow of 3020 gpm to the core spray sparger nozzles (Reference 66).

6.2.1.2 Description and Function of ECCS The design objectives of the emergency core cooling systems are to prevent fuel clad melting and limit to a negligible amount any metal water reaction as a result of all coolant system mechanical failures up to and including those equivalent to a double-ended break in a recirculation pipe. To achieve this capability, even in the absence of all off-site power, several systems have been integrated together to provide the required capacity and redundancy. The individual systems and their integrated performance is evaluated below.

The design basis for the ECCS is to adequately cool the core and to limit potential radioactive releases from the fuel in the event of a loss-of-coolant accident. To provide adequate cooling of the core requires that core geometry be maintained and that clad temperature and metal-water reactions be limited during the accident.

Analyses of ECCS performance are based on computer codes developed by General Electric or AREVA. The evaluations documented in Chapter 14 provides the Monticello ECCS licensing basis and the demonstration of conformance to the first three criteria above (Section 6.2.1.1).

The ECCS pumps for LPCI and Core Spray are located in corner rooms at the basement level of the reactor building. These rooms are sealed to preclude flooding of the pumps from the torus room. The corner rooms are only accessible from the 935-foot elevation. The drains in these corner rooms utilize orifices to limit potential cross-flooding through connected drains to the capacity of the sump pumps.

The post LOCA long-term operability of the Core Spray and RHR pumps is enhanced by the use of Nukon insulation exclusively inside the drywell. Nukon has been tested for compliance with Reg. Guide 1.82, Rev. 1 (Reference 21), to assure that displaced insulation does not collect at the pump inlet debris screens and impede the positive suction head of the pumps.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 11 of 81 6.2.2 Core Spray System 6.2.2.1 Design Basis The original design basis for the Core Spray System was:

a. The calculated fuel cladding temperature does not exceed 2200°F as a result of the various postulated loss-of-coolant accidents for a range of pipe failure sizes from below those for which adequate protection is offered by the High Pressure Coolant Injection System up to and including the design basis loss of coolant accident. (A complete double-ended severance of Recirculation loop pipe.)
b. The Core Spray System consists of two independent loops.
c. Each Core Spray loop meets the above design basis requirements without reliance on off-site power supplies.
d. Each component of each loop is tested periodically.
e. Each Core Spray loop is designed to operate in conjunction with either the Automatic Depressurization or HPCI Systems.

As a result of 10CFR Part 50, Appendix K, and as reflected in the ECCS-LOCA safety analysis (see Section 14.7.2), the design basis for the Core Spray System is to restore and maintain the coolant in the reactor vessel in combination with other emergency core cooling systems such that the core is adequately cooled to preclude fuel damage. Also, items b., c., and d. above still apply.

The Core Spray System flow requirement established by the ECCS-LOCA analysis of Section 14.7.2 resulted in a total rated flow requirement of 2835 gpm (2672 gpm minimum flow into the core shroud plus 163 gpm margin for leakage at 130 psid reactor to containment pressure) (Reference 63, 65, 67, 78, and 83). This flow rate demonstrates adequate flow to meet the flow rate assumptions used for the ECCS-LOCA analysis and applies to the short term time period until the core is reflooded. Supplemental analyses show that the acceptance criteria of the ECCS-LOCA analysis are still met when the minimum injection flow into the core shroud and leakage margin are changed to 2700 gpm and 135 gpm, respectively, at a reactor vessel-to-torus differential pressure of 130 psid to account for EDG frequency uncertainty, the impact on pump discharge from NPSHr, and postulated maximum wear ring degradation (References 79). After the core is reflooded the long term core spray flow requirements are a flow rate sufficient to fill the reactor above top of active fuel or a flow rate of 3020 gpm delivered to the core spray sparger nozzles when the core has been reflooded to 2/3 core height (Reference 66).

Internal piping which connects each spray sparger to its reactor pressure penetration is designed and routed to meet the necessary flexibility requirements for thermal expansion and also to accommodate postulated vessel movement even though such movement is not considered credible.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 12 of 81 Design of the piping system external to the reactor vessel reflects consideration for potential damage to the piping. The pipe runs of each system are physically separated and located to take maximum advantage of protection afforded by the reactor building structure. Drywell penetrations for the core spray pipes are located to achieve minimum length pipe runs within the drywell and to provide maximum circumferential distance between main steam and feedwater lines.

6.2.2.2 Description 6.2.2.2.1 General Two independent Core Spray loops are provided for use under loss-of-coolant conditions associated with large pipe breaks and reactor vessel depressurization.

Each of the two core spray cooling loops consists of a pump, valves, and piping to an independent circular sparger ring inside the reactor vessel inner shroud just over the core. Suction water is normally supplied from the suppression pool, but can also be supplied by the condensate storage tank. The P&ID for the systems is shown in Drawing NH-36248, Section 15, and system equipment specifications are given in Table 6.2-1.

The core spray starts when the injection valve is opened and the reactor vessel pressure drops below the pump discharge pressure. Rated flow is achieved when the reactor to drywell pressure differential decreases to 145 psi. The accumulation of the core spray water in the bottom of the vessel floods the core to a fuel zone level indication of 2/3 core height before 300 seconds for the maximum design break (References 65 and 66).

The design flow capacity of the pump in each loop is approximately 3020 gpm at a total developed pump head of 710 feet, as shown in Figure 6.2-2. This provides additional flow above the minimum required flow assumed by the plant safety analysis in Section 14.7.2. The power required for each pump is approximately 800 HP. The normal water source for the pump suction is the suppression pool.

The core spray pumps and motors are located in the corners at the lowest level of the reactor building. Physical separation of the pumps is achieved by locating pumps in different corners.

Suction water from the pressure suppression pool to the pumps is taken from a common ring header that has four suction lines connected to strainer assemblies located in the torus. The torus penetrations and the strainer assemblies are positioned above the bottom of the suppression pool and below the pool surface to minimize the risk of plugging from debris. Sufficient flow area is available to meet the flow requirements of the combined use of a Core Spray System and LPCI with debris loading (References 42 and 43). NRC Bulletin 93-02, Supplement 1, dated February 18, 1994, (Reference 22) described concerns related to the potential loss of Emergency Core Cooling Systems due to the possibility of suction strainer plugging.

Monticello responded to the NRC Bulletin by letter dated April 19, 1994 (Reference 23). Plant procedures provide the necessary guidance to minimize the potential, mitigate the consequences, or compensate for suction strainer fouling. A suction strainer screen size with 1/8 openings has been selected to screen out particles capable of plugging the Core Spray nozzles.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 13 of 81 A bypass line to the suppression pool is provided so that the pumps are not damaged while operating with the discharge valves shut.

The piping of each Core Spray System is fabricated of a combination of stainless and carbon steel from the suppression chamber to the manual isolation valve in the drywell. Relief valves are utilized for pressure protection of this section of the system.

The spray spargers and spray nozzles are fabricated from 304 stainless steel to meet ASME Code,Section III, Class C (Reference 25). The core structure supporting the spray spargers is also fabricated of 304 stainless steel material.

The power source for each Core Spray System is located on separate emergency buses. Power for these emergency buses can be supplied from the diesel generators. A test line capable of full system flow is connected from a point near the outside motor-operated isolation valve back to the torus. Flow can be diverted into this line to test operability of the pumps and control system during reactor operation.

The control system is arranged to provide two independent and separately isolated control and power circuits for operation of the two independent core spray subsystems.

6.2.2.2.2 Core Spray Operating Sequence Initiation of the Core Spray Systems occurs on signals indicating: 1) reactor low-low water level coincident with low reactor pressure or 2) reactor low-low water level sustained for 15 minutes (nominal) or 3) high drywell pressure. The reactor low-low water level and high drywell pressure are each detected by four independent level or pressure switches connected in a logic array. The reactor low-low water level signal or the high drywell pressure signal also initiate starting of the Emergency Diesel Generators. Low reactor pressure is detected by two independent pressure switches connected in a one-out-of-two logic array.

Opening of the motor-operated isolation valves is accomplished only after the reactor pressure decays below a permissive signal, initiated by two pressure switches connected in a one-out-of-two logic array.

6.2.2.2.3 Operating Sequence with Plant on Normal Auxiliary AC Power Upon receipt of the initiation signal, the core spray pump in each system is started after a 15 second delay. These same initiation signals cause the motor-operated isolation valves to open when a low reactor pressure signal is present. The pumps are operated on the minimum flow bypass which discharges back to the suppression pool when the motor-operated isolation valves are shut or reactor pressure is above pump discharge pressure.

The motor-operated pump suction valves are key locked open. The test return valves are automatically closed (if open) immediately upon receipt of an initiation signal.

The suction valves are normally open and the test return valves are normally closed during normal power plant operation.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 14 of 81 6.2.2.2.4 Operating Sequence with Plant on Emergency Diesel Standby Power Each of the core spray pumps is operated from different buses, each of which is energized by a different Emergency Diesel Generator. Upon receipt of the initiation signal, both diesels are started. When power is required to be supplied from the Emergency Diesel Generators, energization of the pump motor is delayed 25 seconds to permit the diesel to accelerate and to allow for load sequencing of the RHR pumps before the core spray pump load is applied.

6.2.2.3 Performance Analysis Core Spray, along with LPCI, is designed to maintain continuity of core cooling for a large spectrum of loss-of-coolant accidents. Core Spray provides adequate cooling along with LPCI for intermediate and large line break sizes up to and including the design basis double-ended recirculation line break, without assistance from any other Emergency Core Cooling system. The integrated performance of Core Spray in conjunction with other Emergency Core Cooling Systems is given in Section 14.7.2.

For the first few seconds following the DBA-LOCA, the reactor feedwater and recirculation pumps coast down, providing makeup to the system and nearly normal recirculation flow. The reactor pressure is initially held up primarily due to the action of the turbine initial pressure regulator. During this time the water level outside the shroud is decreasing rapidly because of the high critical flow rate through the break.

The water level inside the shroud is maintained at the steam separators while the stored heat is removed and the voids are swept from the core region. When the water level inside the shroud reaches the top of the jet pump inlet (2/3 core height) the level is held up. Further decreases in level inside the shroud are the result of flashing due to depressurization and boiloff. As the level outside the shroud drops below the suction side vessel penetration of the recirculation loop, the level is held up in the unbroken loop. As the broken recirculation loop is completely drained of liquid, the break flow changes to steam which causes the increase in vessel depressurization rate. When the vessel pressure decreases to below the shutoff head of the Core Spray pumps and the system is ready to deliver flow, Core Spray injection begins. For a short time the Core Spray flow is in equilibrium with the flashing rate and the water level inside the shroud is constant. Then as Core Spray flow increases due to the decreasing pressure, the water level inside the shroud increases. When the water level in the jet pumps reaches the top of the jet pumps, water spills over from inside the shroud to outside the shroud raising the water level in the unbroken loop slowly.

The water level inside the shroud is slightly above the jet pump inlet due to the higher void fraction in the core compared to that in the jet pumps. The water level inside the shroud continues to rise slowly due to the decreasing pressure and corresponding increase in core void fraction. When the water leg in the jet pumps becomes subcooled (due to the accumulation of subcooled water in the lower plenum caused by the second reactor Core Spray cooling loop acting as a flooder) the water level inside the shroud rises very rapidly since a much larger elevation head is available in the jet pumps which then can support a much higher swollen level in the core.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 15 of 81 The Core Spray motor operated isolation valves are interlocked to prevent their opening until the reactor pressure has decreased to a preset value. This interlock is provided from pressure switches, the outputs of which are connected in a one-out-of-two logic in each valve opening circuit. A search was made for a second parameter to be measured to give diversity to this signal, however it was concluded that reactor pressure is the only satisfactory parameter. Therefore, in order to preclude possible common mode failures, these two switches, which are connected to two widely separated reactor vessel pressure taps, are of different basic design, i.e., diaphragm vs. Bourdon tube.

The control logic for the Core Spray motor operated isolation valves (A loop and B loop) allows single valve operability tests with reactor pressure above 420 psi. The valves can be opened, one at a time, through the contacts of their control switches.

Key locked bypass switches allow closure of the outboard isolation valve if a Core Spray pump fails to start or trips after receiving an auto initiation signal. This modification allows operation of these valves for containment isolation purposes.

The consequences of bypass switch failure were analyzed. A failure of either of these switches would not result in system degradation beyond that previously considered in the accident analysis.

6.2.2.4 Inspection and Testing Provisions have been designed into Core Spray (CS) to test the performance of its various components. These provisions and tests are summarized as follows:

a. CS Instrumentation Operational test of entire system.

Periodic system tests using test lines, built in test jacks, alarms and lights.

b. CS Valves Pre-operational test of entire system.

Periodic system tests using test lines.

Leak-off lines between isolation valves.

Motor-valves can be exercised independently.

c. CS Pumps Pre-operational test of entire system.

Periodic system tests using test lines.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 16 of 81

d. Spray Sparger Pre-operational test of entire system.
e. Spray Nozzles Pre-operational test of entire system.
f. CS Relief Valves Can be removed and tested for setpoint.
g. Screens Pre-operational test of entire system.

Periodic system tests using test lines.

Pressure indicator on pump suction during above tests.

Each Core Spray loop may be tested independently during reactor operation as follows:

a. When a loop is being tested, the other loop is still available and starts if called upon by the automatic sequence. The system being tested would in this case immediately change from the test mode to the emergency operation mode.
b. The pump of the loop under test may be started by its manual control switch.

The test return valve is opened to allow the pump to be tested at full flow. Flow and pressure instrumentation is observed for correct response and the system outside the drywell may be checked for leaks.

c. The check valves may only be functionally tested during cold shutdown.

6.2.2.5 Operating Sequence Response Times Core Spray response time and the factors that influence this response time are discussed in Section 14.7.2.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 17 of 81 6.2.3 Residual Heat Removal System (RHR)

The RHR System provides both safety and operational functions as follows:

6.2.3.1 Design Basis 6.2.3.1.1 Safety Objective The objective of the Residual Heat Removal (RHR) System is to restore and maintain the coolant inventory in the reactor vessel so that the core is adequately cooled after a Loss-of-Coolant Accident (LOCA). The RHR System, also, provides cooling for the suppression pool so that condensation of the steam resulting from the blowdown due to the design basis LOCA is ensured. The RHR System further extends the redundancy of the Emergency Core Cooling Systems by provision for containment spray/cooling.

6.2.3.1.2 Operational Objective The RHR System provides the means to meet the following operational objectives:

a. Remove decay heat and residual heat from the nuclear system so that refueling and primary system servicing can be performed.
b. Supplement the spent fuel pool cooling and demineralizer system capacity when necessary to provide additional cooling capacity.

6.2.3.1.3 Performance Objective

a. The RHR System acts automatically, in combination with other Emergency Core Cooling Systems, to restore and maintain the coolant inventory in the reactor vessel such that the core is adequately cooled to preclude fuel damage following a design basis LOCA.
b. The RHR System in conjunction with other Emergency Core Cooling Systems, has such diversity and redundancy that only a highly improbable combination of events could result in an inability to provide adequate core cooling.
c. The source of water for restoration of reactor vessel coolant inventory is located within the primary containment in such a manner that a closed cooling water path is established.
d. To provide a high degree of assurance that the RHR System operates satisfactorily during a LOCA each active component is capable of being tested during cold shutdown.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 18 of 81 6.2.3.2 Description 6.2.3.2.1 Introduction The RHR System is designed for three modes of operation to satisfy all the objectives and bases. These modes are 1) Low Pressure Coolant Injection Subsystem (LPCI), 2) Containment Spray/Cooling Subsystem, and 3) Reactor Shutdown Cooling Subsystem. The first two are primarily safety functions and are described in this section. Shutdown cooling is for routine operation and is described in Section 10.2. To provide clarity to the information presented herein, each mode of operation is defined as a subsystem of the RHR System and is discussed separately.

The major equipment of the RHR System consists of two heat exchangers, four main injection pumps (RHR pumps), and four RHR Service Water System pumps. The equipment is connected by associated valves and piping, and the controls and instrumentation are provided for proper system operation. The P&IDs for the RHR System are shown in drawings NH-36246 and NH-36247, Section 15.

The RHR pumps were sized on the basis of the flow required to support the various operating modes of the RHR System. The Low Pressure Coolant Injection (LPCI) mode of the RHR System is provided to assure that the core is adequately cooled following a loss of coolant accident. Each RHR pump is designed to deliver greater than or equal to 4000 gpm. This provides margin above the minimum required flow assumed for the plant safety analysis in Section 14.7.2. The RHR Service Water System pumps are sized to assure sufficient cooling water to the RHR heat 604000000443 exchangers to remove the required amount of heat energy from the suppression pool. When an RHRSW pump is normally operating, the cooling water (service water) pressure in the tube side of the heat exchanger is maintained higher than the shellside pressure to ensure that in case of a leak in the tubes of the heat exchanger, the radioactive coolant does not leak into the Service Water System.

The heat exchangers are sized on the basis of their required duty for the containment cooling function. A summary of the design requirements of the system is presented in Table 6.2-2. The pump characteristics are shown in Figure 6.2-4.

Connections are provided on the reactor shutdown cooling system piping circuit for making connection to the Spent Fuel Pool Cooling and Demineralizer System so that the RHR heat exchangers may be used to assist spent fuel pool cooling when required.

Provision is also made for emergency supply of cooling water to the core from the river via the RHR Service Water System. This connection is shown on Section 15 Drawings NH-36664 and NH-36247, and is further described in Section 10.4.2. It is also possible to supply emergency cooling water to the core from the river via the diesel fire pump. The Fire Protection System connects with the RHR Service Water cooling water line to provide this alternate source of water. A manual valve and blank flange is provided on the intertie to allow the connection to a source of water following a Beyond Design Basis Event.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 19 of 81 One loop, consisting of a heat exchanger, two RHR pumps in parallel and associated piping, is located in one corner room of the lowest floor of the Reactor Building. The other heat exchanger, pumps, and piping, forming a second loop, are located in another corner room of the Reactor Building to minimize the possibility of a single physical event causing the loss of the entire system. Both loops are located as close to the suction header as practical in order to minimize the vulnerability of the piping.

The discharge of the two loops of the RHR System are cross connected by a single header, making it possible to supply either loop from the pumps in the other loop.

RHR equipment is designed in accordance with Class I seismic criteria (see Section

12) to resist sufficiently the response motion within the Reactor Building from the design basis earthquake. The RHR pumps are assumed to be filled with water for the seismic analysis.

The pumps are designed and constructed in accordance with the Standards of the Hydraulic Institute. A minimum flow line to the suppression pool is provided so that the pumps are not damaged while operating with the discharge valves shut. The shell side of the heat exchangers is designed in accordance with the ASME Code,Section III Class C vessels (Reference 25), and the tube side is designed in accordance with Section VIII. The provisions of the Winter Addenda of 1966, paragraph N2113 apply (Reference 29).

As part of the recirculation system piping replacement program, a four-inch intertie line was added between the RHR shutdown cooling suction line and the RHR recirculation loop return lines. The purpose of this line is to reduce the potential for water hammer in the recirculation and RHR Systems that could occur when placing shutdown cooling in service, especially with an isolated or idle recirculation loop. The line also permits warm-up of a cold loop and eliminates the need to fill the RHR suction and return lines from the condensate service system prior to initiating shutdown cooling. This line is normally closed in the RUN mode by the closure of valves MO-4085A and B (see Section 15 Drawings NH-36246 and NH-36247).

6.2.3.2.2 Low Pressure Coolant Injection Subsystem (LPCI)

The Low Pressure Coolant Injection subsystem (LPCI) is an integral part of the RHR System. It operates to restore and maintain the coolant inventory in the reactor vessel after a LOCA so that the core is sufficiently cooled. A simplified P&ID for the LPCI mode of RHR is shown in Figure 6.2-5. A detailed discussion of the requirements and response of the LPCI equipment which operates during a LOCA may be found in Section 6.2.3.3.

In general, LPCI operation involves restoring the water level in the reactor vessel to a sufficient height for adequate cooling after a LOCA. The LPCI subsystem operates in conjunction with the High Pressure Coolant Injection (HPCI) System, the Automatic Depressurization System (ADS), and the Core Spray (CS) cooling system to achieve this goal.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 20 of 81 The HPCI System is a high head, low flow system and pumps water into the reactor vessel when the reactor primary system is at high pressure. It is described in Section 6.2.4. If the HPCI System fails to deliver the required flow of cooling water to the reactor vessel, the Automatic Depressurization feature of the Reactor Pressure Relief System functions to reduce system pressure so that LPCI subsystem operates to inject water into the pressure vessel. LPCI is a low head, high flow system and delivers rated flow to the reactor vessel when the differential pressure between the reactor vessel and primary containment is 20 psi or less. The HPCI turbine trips when the turbine steam supply pressure has decreased to the isolation setpoint. All these operations are carried out automatically. The LPCI subsystem is designed to reflood the reactor vessel to at least two-thirds core height and to maintain this level.

After the core has been flooded to this height, the capacity of one RHR pump is more than sufficient to maintain the level. The safety analysis assumes that after the core has been reflooded to 2/3 core height that one core spray pump throttled to design flow is used to maintain the required level for cooling the core. RHR is used in the long term safety analysis, i.e. after 600 seconds, to remove decay heat from primary containment (Reference 66).

During LPCI operation, the RHR pumps take suction from the suppression pool and discharge to the reactor vessel into the core region through one of the recirculation loops. NRC Bulletin 93-02, Supplement 1, dated February 18, 1994, (Reference 22) described concerns related to the potential loss of Emergency Core Cooling Systems due to the possibility of suction strainer plugging. Monticello responded to the NRC Bulletin by letter dated April 19, 1994 (Reference 23). Plant procedures provide the necessary guidance to minimize the potential, mitigate the consequences, or compensate for suction strainer fouling.

Instrumentation is provided to select an undamaged path for injection of the LPCI flow as described in Section 6.2.3.2.5. Any spillage through a break in the lines within the primary containment returns to the suppression pool through the pressure suppression vent lines. A bypass line to the suppression pool is provided so that the pumps are not damaged while operating with the discharge valves shut. Service water flow to the RHR heat exchangers is not required immediately after a LOCA because heat rejection from the containment is not necessary during the time it takes to flood the reactor.

Power for the RHR pumps is supplied from safety related essential buses. These buses are normally powered from adjacent non-safety buses fed from the auxiliary off-site source. However, if this non-safety bus source becomes unavailable, power is available from an emergency off-site source (1AR) or the dedicated standby Emergency Diesel Generator (EDG) associated with that essential bus.

During an ECCS initiation, coincident with a loss of normal off-site power, Core Spray logic will apply trip signals and block start signals to the RHR Service Water pumps. Under these conditions, when both RHR pumps in a division are operating, these signals will be sealed in, effectively blocking out the RHR Service Water pumps. These signals can be cleared when the ECCS initiation has cleared and one of the divisional RHR pumps is shut down, or when normal off-site power is restored.

Trip signals are also applied to the RHR Service Water pumps directly from the LPCI logic when an ECCS initiation signal is present. These signals automatically clear when the ECCS initiation signal clears.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 21 of 81 A keylock switch in the Main Control Room can be used to bypass the RHR Service Water trip and lockout signals allowing the RHR Service Water pumps to be manually started if the ECCS initiating signal has not automatically cleared. If normal off-site power is not available, procedural controls are in place to manually secure a divisional RHR or Core Spray pump for each divisional RHR Service Water pump to be started. This ensures that the associated divisional EDG or 1AR transformer, the emergency off-site power source, will not be overloaded.

The containment pressure analysis (Section 5.2.3.3) assumes that the RHR containment spray/cooling mode and the RHR Service Water pumps are not initiated until 600 seconds after the beginning of the accident. For the DBA-LOCA case, the core has been reflooded to 2/3 core height indicated or higher within this time and only leakage and boil off water must be replaced. At any time after the core is reflooded reactor operator action is required to establish RHR Service Water System flow and to reduce flow in the ECCS pumps to an indicated flow rate of 4000 gpm through the RHR heat exchanger and to a flow rate 3020 gpm delivered to the core spray sparger nozzles for core spray. Core spray pump flow must have an indicated flow rate high enough to overcome postulated leakage that may exist prior to reaching the CS sparger nozzles. These flow rates are assumed after 600 seconds to insure pump reliability and NPSH requirements are met while meeting all safety analysis requirements (References 66 and 69). Depending on plant conditions, the bypass switch and procedural controls described above may be utilized to achieve RHR Service Water flow.

Automatic engineered safety feature action during the initial ten minutes after any DBA event is desirable since this allows the reactor operator to assess the prevailing situation and to be able to take further corrective action (e.g. start the RHR Service Water pumps) to minimize the post accident conditions (e.g. long term core and containment cooling requirements). Operator action can be taken to set up the unit for long term core cooling and containment cooling when core water level has reached 2/3 core height indicated or higher, see section 6.2.3.3.2 (Reference 66).

6.2.3.2.3 Containment Spray/Cooling The containment spray/cooling subsystem is an integral part of the RHR System and is used as necessary to maintain the suppression pool temperature below Technical Specification limits. This assures that in the event of a design basis loss of coolant accident, the bulk pool temperature does not exceed 170°F when steam quenching is required. The selection of 170°F is based on Mark I tests (See Section 5.2.3.1) which showed that at this temperature complete condensation of blowdown steam from the design basis LOCA can be expected.

Interlocks are provided to prevent operation of the containment spray if the containment pressure is below approximately 1 psig. Lack of pressure indicates there is no need for containment spray and therefore nothing to be gained by operating the spray. The logic for this interlock is a one-out-of-two-twice logic. Test jacks are provided to permit testing of these switches during reactor operation.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 22 of 81 With the RHR System in the containment spray/cooling mode of operation, the RHR pumps are aligned to pump water from the suppression pool through the RHR heat exchangers where cooling takes place by transferring heat to the service water. The flow returns to the suppression pool via the full flow test line. A simplified P&ID for the containment spray/cooling mode of RHR is shown in Figure 6.2-6. NRC Bulletin 93-02, Supplement 1, dated February 18, 1994, (Reference 22) described concerns related to the potential loss of Emergency Core Cooling Systems due to the possibility of suction strainer plugging. Monticello responded to the NRC Bulletin by letter dated April 19, 1994 (Reference 23). Plant procedures provide the necessary guidance to minimize the potential, mitigate the consequences, or compensate for suction strainer fouling.

The containment spray/cooling mode, also, provides additional redundancy to the Emergency Core Cooling Systems for post-accident conditions. The water pumped through the RHR heat exchangers may be diverted to spray headers in the drywell and above the suppression pool. The spray headers in the drywell condense any steam that may exist in the drywell thereby lowering containment pressure. The spray collects in the bottom of the drywell until the water level rises to the level of the pressure suppression vent lines where it overflows and drains back to the suppression pool. Approximately 5% of this flow may be directed to the suppression chamber spray ring to cool any non-condensable gases collected in the free volume above the suppression pool.

Containment spray/cooling mode is also credited by the Mark I Program to eliminate chugging loads that may occur during small break accidents when the reactor is pressurized and containment pressure exceeds 12 psig. This is controlled by the Emergency Operating Procedures (Reference 60). See USAR section 5.2.3.2.1.

Containment heat removal for long term LOCA and Appendix R events is based on use of one RHR pump operating at a nominal flow rate of 4000 gpm through the RHR heat exchanger and one RHRSW pump operating at a nominal flow rate of 3500 gpm (References 73 and 74). With a loss of offsite power the minimum flow valves on the RHR pumps may fail open as the air accumulators on these valves deplete. The long term analysis for DBA LOCA containment response includes flow through the minimum flow lines while maintaining a nominal flow rate of 4000 gpm through the RHR heat exchanger for RHR (Reference 66).

The spray headers of the RHR System cannot be placed in operation unless the core cooling requirements of the low pressure core injection subsystem have been satisfied. These requirements may be bypassed by the reactor operator using a keylock switch in the Main Control Room.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 23 of 81 6.2.3.2.4 Equipment Characteristics

a. RHR Circulating (LPCI) Pumps The pumps were sized on the basis of the original LPCI design flow requirements. The current subsystem flow requirements stated in the Technical Specifications are determined by calculation of the rate of coolant loss due to the design basis break of a 28-inch recirculation line. The system is required to inject sufficient makeup water to reflood the vessel to the appropriate height before the fuel cladding is overheated and then maintain the level at 2/3 of core height. The pump head characteristic is selected such that sufficient, but less than rated, flow is provided before the HPCI turbine is tripped due to low steam supply pressure. This is done to ensure against core overheating over the complete spectrum of breaks up to the design break. The specifications for those pumps are shown in Table 6.2-2 and the pump performance curve is shown in Figure 6.2-4.
b. RHR Service Water System Pumps Cooling water for the two RHR System heat exchangers is provided by four RHR Service Water pumps located in the Intake Structure. Two RHR Service Water pumps deliver cooling water to each heat exchanger. Heat is transferred from the primary water to the cooling water and is subsequently discharged to the river. These pumps develop sufficient head to cause the pressure at the cooling water heat exchanger outlet to be greater than the primary water pressure at the rated heat exchanger flow in order to prevent leakage of reactor primary system water to the river.
c. RHR Heat Exchangers Each of the RHR heat exchangers is rated to remove 57.5 x 106 BTU/hr when the hot inlet temperature is 165°F and the cooling water temperature is 85°F (See Table 6.2-2). General Electric report, NEDC 33322P (Reference 62),

presents a safety evaluation to support plant operation with a 90°F service water temperature. This heat exchanger capacity is sufficient to prevent the suppression pool temperature from exceeding the limits discussed in Section 5.2.3.1 immediately following reactor blowdown from a LOCA. It is also sufficient to control the long term heat up from that accident without exceeding the containment design temperature and pressure limits discussed in Section 5.2.3.3. Service Water temperature for containment analysis is discussed in Section 5.2.3.2.4.

The RHR heat exchangers are designed so that the tube side flow consists of RHR Service Water and the shell side flow originates from the RHR System.

When the RHR service water pumps are normally operating, the pressure on the tube side of the heat exchanger is maintained above the pressure on the shell side with a control valve that is manually operated from the Control Room.

The higher pressure on the tube side prevents reactor water leakage into the RHR Service Water system and thereby into the river. The control valve also has an automatic mode which is set to maintain the tube side at least 20 psi above the shell side; however, the automatic mode is not normally used.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 24 of 81

d. RHR Valves Redundant isolation valves are located on the RHR piping where the system is connected into the primary system. The isolation valves provide protection against core uncoverage if the piping should break in these systems. The isolation valves are interlocked with reactor pressure to protect the lower pressure RHR piping. Additionally, check valves are incorporated on each injection line to protect the LPCI against high reactor pressure in cases of a component malfunction. The isolation valves are designed to withstand reactor pressure and temperature.

Divisional RHR torus discharge valves are interlocked with their respective Shutdown Cooling suction valves to prevent an inadvertent valve line-up where Reactor Vessel water could drain into the torus.

The cross-tie line between the two loops contains one motor-operated and one manual (locked open) valve. Check valves and stop valves are located on the circulating pump discharge lines, and flow control valves are provided on the lines where flow adjustment is necessary.

Several manual valves are installed where necessary to permit maintenance on the system and are normally locked open.

e. Piping and Fittings Two independent pipe lines which are physically separated and protected as much as practical are each sized for full subsystem flow thereby providing redundancy in flow paths for system operation.

All system components are designed in accordance with applicable codes for reactor auxiliary systems. The system is protected from plugging by the use of multiple suction header connections with strainers.

Two separate lines with separate spray headers provide containment spray/cooling in the drywell. Suppression chamber spray is provided from a single spray header which is supplied by two separate pipe lines.

The Residual Heat Removal System discharge lines in the torus were modified during the 1978 refueling outage by addition of elbows fitted with a reducer on the end of each of the two discharge lines. The elbow and reducer were directed perpendicular to the major axis of the torus to produce counterclockwise flow.

The purpose of the modification was to promote mixing of the suppression pool water during a steam blowdown through the SRV discharge lines. T-quenchers were installed at the termination of all the eight SRV discharge lines within the suppression chamber pool. Subsequent testing under operating conditions demonstrated significantly lower hydrodynamic loads on the containment but a reduction in thermal mixing in the suppression pool. Holes have been added to the end caps of the T-quenchers to promote counter clockwise mixing of the pool. Additional movement of the pool is obtained with RHR flow through the RHR return line which is directed in a counter clockwise direction.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 25 of 81

f. Liquid Radwaste System Connections When the HPCI or RCIC are operated, the suppression chamber water level rises. The normal level can be restored by opening RHR valves and discharging water through the liquid radwaste system for processing.
g. Instrumentation and Control The system pumps are activated on signals of 1) reactor low-low water level and low reactor pressure or 2) a signal of high drywell pressure or 3) Reactor low-low water level for 15 minutes (nominal) similar to that received by the Core Spray cooling. Low-low water level or high drywell pressure also trip the recirculation pumps. Power is supplied from the EDGs if normal auxiliary power fails. The valves in the high pressure part of the system are automatically opened to establish the LPCI flow path when reactor pressure decreases to a preset value.

System reference characteristics obtained during preoperational testing are used for comparison in system surveillance tests to determine variations from normal operation.

To assure that flow is available in the event that a line in the high pressure portion of the system is broken, instrumentation is provided which causes necessary valves to close or open (as needed) to establish the full LPCI flow.

Interlocks are provided to assure that one of the RHR pumps (or one Core Spray pump) is delivering output pressure before permitting the ADS to operate.

Annunciators on panel CO3 in the Control Room provide notice of an alarm condition when any RHR pump receives an automatic trip.

Interlocks are provided to prevent LPCI flow from being diverted to the containment spray cooling mode unless the core is flooded. A key lock switch permits this interlock to be overridden if containment pressure remains high.

Containment spray is also prevented if containment pressure indicates it is not required.

The suppression chamber water temperature is measured. When the water temperature reaches approximately 90°F, an alarm is activated. Operator action establishes RHR Service Water System cooling flow through the RHR heat exchangers and containment cooling flow to the torus.

The necessary instrumentation to test the integrity of the major equipment (pumps, valves, and heat exchangers) is also provided.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 26 of 81 6.2.3.2.5 Operational Sequence - LPCI Initiation of LPCI occurs on signals indicating: 1) reactor low-low water level and low reactor pressure, 2) reactor low-low water level sustained for 15 minutes (nominal) or 3) high drywell pressure. Low-low water level and high drywell pressure are each detected by four independent level and pressure switches connected in a logic array.

The reactor low-low water level signal or the high drywell pressure signal also initiate starting of the EDGs. Low reactor pressure is detected by two independent pressure switches connected in a one-out-of-two logic array.

Upon Receipt of Initiation Signal - Normal AC Power Available

a. EDGs start, but do not connect to emergency buses. They may subsequently be shut down if the operator decides they are not required.
b. Permissives become available to active pumps and valves.
c. The sequence timers begin to operate when permissives are received.
d. Pump suction valves are normally maintained open.
e. Pumps A and B start after a 5 second delay.
f. 5-seconds later, pumps C and D start.
g. RHR Service Water pumps trip (if running).
h. Heat exchanger service water outlet valves close (if open).

Upon Receipt of Initiation Signal - Normal AC Power Not Available

a. When normal AC power is not available, and the emergency diesel generators are ready to load, pumps A and B (one on each diesel) are energized after a 5 second delay.
b. After 5 more seconds, pumps C and D (one on each diesel) are energized.
c. The injection valves open with a decrease of reactor pressure, as described below.
d. The open recirculation loop pump suction valves remain open.

A LPCI break detection system determines which recirculation loop is broken and provides the unbroken recirculation loop to be used for LPCI injection. If neither loop is broken, a preselected loop is used for injection. The system makes the loop selection by comparing the pressure in the five riser pipes on one recirculation loop with the pressure in the corresponding risers on the other recirculation loop. The unbroken recirculation loop has a higher pressure than the broken loop. Such an indication (as determined by a one-out-of-two-twice logic) causes the LPCI flow to be injected into the unbroken loop. The break detection logic is included in Figures 6.2-7a and b.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 27 of 81 During normal operation with both recirculation pumps running a short time delay (approximately 2 seconds) is provided before final energization of the selected valves in order to allow full differential pressure to be established across the recirculation loops.

If one or both of the recirculation pumps are not running, the system still selects an undamaged injection path. To assure that a break in an operating loop is not masked by the pressure developed by one operating recirculation pump, both pumps are tripped. This causes maximum pressure differential to be developed between the two loops. The reactor pressure permissive acts as a break size indicator, permitting complete recirculation pump coastdown before loop selection on smaller breaks for which an operating pump could mask the differential pressure caused by the break.

For larger breaks, pump coastdown is not required and the reactor pressure permissive is satisfied before the time at which loop selection must be made in order to assure no delay in the start of LPCI flow.

The effects of a failure of the recirculation pump trip circuitry to trip the operating pump during LPCI initiation has been evaluated by General Electric for power operation at 1670 MWt (Reference 11). General Electric found that failure to trip the operating pump could result in LPCI injection into the broken loop only in the case of small breaks of 0.5 square feet or less. In the limiting case (0.5 square foot break), an increase in peak clad temperature (PCT) of less than 300°F will result. However, the PCT remains several hundred degrees below that calculated for the limiting large break. Therefore, the recirculation pump LPCI trip logic is not essential to plant safety. This conclusion is also valid for power operation at 2004 MWt since for small breaks at or less than the minimum detectable break (0.4 ft2), the loop selection logic is assumed to erroneously detect the broken recirculation loop and the LPCI flow entering the vessel is reduced further following GE methodology (Reference 65) and no flow from LPCI is credited for break sizes less than the minimum detectable break per AREVA methodology (Reference 81).

The sensing circuits for break detection and valve selection are arranged such that failure of a single device or circuit to function on demand does not prevent correct selection of the loop for coolant injection.

If the break is not a recirculation loop, the admission or injection valves in the preselected loop automatically open. The valves are interlocked so that valves in one line only are open at any given time.

The LPCI initiation signal also closes the containment spray/cooling subsystem valves (if open). These valves are normally closed.

As a result of concerns expressed during an NRC review, a confirmation was requested that it was not possible to rapidly isolate a loss-of-coolant accident (LOCA) occurring between the recirculation discharge and suction valves on plants with LPCI loop selection logic. Normally, for a large LOCA that has not been rapidly isolated, the vessel blows down to a low pressure condition where the low pressure Emergency Core Cooling System (ECCS) initiates and refloods the core. However, rapid isolation of the LOCA might lead to low water inventory while system pressure remained high preventing actuation of the low pressure ECCS and reflooding of the core.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 28 of 81 The LPCI loop selection logic was modified so that the recirculation pump suction valve does not receive a signal to close during LPCI initiation. The recirculation pump discharge valve still closes upon LPCI initiation providing the correct path of coolant to the vessel. This modification precludes the isolation of a break between the suction and discharge valves.

6.2.3.3 Performance Analysis 6.2.3.3.1 Core Flooding The integrated performance of the LPCI system in conjunction with other Emergency Core Cooling Systems is discussed in Section 6.2.6.

The maximum vessel pressure against which the RHR pumps must deliver some flow is determined by the required overlap with HPCI system which has a low pressure cut off for the HPCI turbine at about 150 psig. In conjunction with HPCI, the LPCI system can provide adequate coverage for the intermediate and smaller breaks over the entire pressure range.

The LPCI flow rate entering the vessel is dependent upon the number of pumps which are providing flow through the injection line. The ECCS-LOCA analysis (Reference 65, 78, and 81) assumes LPCI flow rates of 7740 gpm for two pump, 10,800 gpm for three pumps, and 12,000 gpm for four pumps at a reactor vessel to drywell differential pressure of 20 psid (Reference 63). Supplemental analyses show that LPCI flow rates of 7740 gpm for two pump, 11,275 gpm for three pumps, and 14,222 gpm for four pumps at a reactor vessel-to-torus differential pressure of 20 psid, which reflect adjustments made to account for EDG frequency uncertainty, the impact on pump discharge head from NPSHr and postulated maximum wear ring degradation in excess of 10%, still satisfy the acceptance criteria of the ECCS-LOCA analysis (Reference 79 and 81).

When the reactor primary system pressure drops to the shutoff head of the LPCI, a check valve in the LPCI injection line opens. Prior to this time, the LPCI control logic system has sensed the loop in which the break has occurred, and opened the LPCI injection valve to the unbroken recirculation line. These actions provide an integral flow path for the injection of the LPCI flow into the bottom plenum of the reactor vessel. As the LPCI flow accumulates, the level rises inside the shroud. When the level reaches the top of the jet pumps, spill over occurs for a time raising the level outside the shroud. As the subcooled LPCI flow begins spilling into the region outside the shroud, the depressurization effect of the break is reduced since the subcooled water is now flowing out the break. As the pressure begins to rise, the LPCI flow is reduced until a quasi-equilibrium pressure is reached. At this point the break is partially covered by subcooled water which has spilled over the top of the jet pumps and the equivalent area of the break available for steam blowdown is thus reduced. The size of the break available for steam blowdown is maintained at the required equilibrium value by the LPCI spillage. If pressure were to rise, the LPCI flow would be reduced, the equivalent break size steam blowdown would increase and pressure would drop.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 29 of 81 Equilibrium is not actually attained because of the HPCI and Automatic Depressurization System effects on the transient. Although HPCI flow is lost when pressure is reduced sufficiently, the automatic depressurization valves would be manually opened soon after the HPCI flow is lost. Also, no credit is taken for the pressure reduction effect of the cold LPCI water in the reactor vessel.

There exists a break size below which the LPCI requires depressurization assistance to maintain core cooling. For these small breaks, the HPCI and Automatic Depressurization System provide the necessary depressurization to allow LPCI to protect the core across the entire break spectrum.

LPCI injection valves are interlocked to prevent their opening until the reactor pressure has decreased to a preset value. This interlock is provided from pressure switches, the outputs of which are connected in a one-out-of-two logic in each valve opening circuit. A search was made for a second parameter to be measured to give diversity to this signal, however, it was concluded that reactor pressure is the only satisfactory parameter. Therefore, in order to lessen the possibility of a common mode failure, these two switches, which are connected to two widely separated reactor vessel pressure taps, are of different basic design, e.g., diaphragm vs.

Bourdon tube.

6.2.3.3.2 Containment Spray and Cooling The containment spray or cooling function can be performed with the RHR after the core is flooded, which, for even the largest line break is accomplished within a few minutes. One of the RHR pumps can be shut down and one or two RHR - Service Water System pumps started manually to provide cooling water to the RHR heat exchangers. Suppression pool water can then be diverted to either of two cooling modes:

a. Containment Spray The operator may divert flow to drywell or suppression pool spray headers by opening the applicable supply valves and throttling the LPCI flow control valve.

A combined containment spray and suppression pool cooling flow measurement and a LPCI flow measurement is used to inform the operator of the flow distribution between containment and the vessel. An interlock is provided to prevent spray actuation if the containment pressure is below 1 psig.

Lack of pressure indicates spray is not required.

b. Suppression Pool Cooling The water in the suppression chamber is cooled directly without using the torus spray header by diverting flow through the full flow test line. A motor operated valve is used to regulate flow.

In addition to the normal reactor vessel level instrumentation, the level is also measured inside the core shroud by two sensors. If the water level in the shroud is sufficient, a permissive is given to allow LPCI flow to be diverted manually to the spray header in the drywell and/or the suppression chamber. Valving permits the operator to obtain a variable division of flow between LPCI and containment spray or cooling as described above.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 30 of 81 If the reactor water level inside the core shroud decreased below minimum, the system flow is all returned automatically from the containment spray headers or torus cooling lines to the LPCI admission valves.

Note that the containment spray interlock based on core level (2/3 core height interlock) can be manually bypassed via key-lock switch if operation of containment spray is required and adequate core level for cooling can be verified and maintained.

This is necessary as the 2/3 core height interlock level switches are set to activate at a nominal value corresponding to 2/3 core height level at 290 psig vessel pressure (saturation). Process variations greatly affect the actual core level corresponding to the trip and the use of the interlock bypass is appropriate when adequate core level can be verified via other instrumentation and containment spray operation is necessary.

6.2.3.3.3 RHR Pump Runout An investigation at a BWR-4 plant identified a design deficiency that could potentially disable the long term core and containment cooling system following a postulated Loss-of-Coolant Accident (LOCA). This design deficiency involves the potential for RHR pumps to operate in excess of design flow (runout) during a postulated LOCA which could result in damage to the pumps due to cavitation and/or motor overload.

A single failure in the loop selection logic could result in (1) four RHR pumps injecting into a broken recirculation loop, or (2) Four RHR pumps injecting into both recirculation loops simultaneously, with one loop broken. In addition, operation with three pumps providing flow (one pump inoperable as allowed per Technical Specifications) to the unbroken loop may closely approach runout conditions.

An analysis of the potential RHR pump runout situations was performed for Monticello. On the basis of the characteristic pump brake horsepower and motor current at runout flow, and the available NPSH at runout flow, the Monticello LPCI pumps are not subject to motor overload in the runout condition. Details of the analysis are included in Reference 2.

Evaluations of post LOCA NPSH for the Monticello Core Spray and LPCI pumps were performed as part of a re-evaluation of design basis containment temperature and pressure response stemming from concerns associated with ECCS suction strainer blockage. For the short term analysis where these conditions could exist, the RHR pumps may have negative margin to the NPSHreff requirements that include consideration of hydraulic uncertainties. This was determined to be acceptable.

Once the pumps are throttled to provide a nominal flow rate of 4000 gpm to the RHR heat exchangers assumed for the long term analysis after 600 seconds, adequate margin exists to meet NPSHreff requirements (References 66 and 69). See Section 5.2.3.3.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 31 of 81 6.2.3.3.4 RHR Shutdown Requirements The shutdown cooling (SDC) analysis for 2004 MWth extended power uprate (EPU) conditions determined that the time needed for cooling the reactor to 125°F during normal reactor shutdown, with two SDC loops (i.e., two RHR heat exchangers) with all pumps in service, is approximately 26.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. This calculated normal reactor shutdown time exceeds the original licensed thermal power SDC time criterion of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which was selected, based on engineering judgment so that the SDC mode of operation will not become a critical path during refueling operations. This SDC design criterion was used as one of the bases for sizing the RHR heat exchangers and does not constitute a plant operational parameter. The increase in the normal reactor shutdown time for EPU indicates that a normal reactor shutdown may take longer, which could delay the start of an outage. This delay may have an effect on plant availability, but has no effect on plant safety, or the design operating margins (References 62 and 70).

6.2.3.3.5 RHR Intertie Line Analysis A safety analysis of the addition of the RHR Intertie Line was performed by General Electric (Reference 10).

The following potential adverse effects were identified:

(1) An impact of the 10 CFR Part 50, Appendix K, analysis due to an increase in Design Basis Accident (DBA) break area equal to a four-inch line (0.08 square feet).

(2) An additional flow path between the broken and unbroken recirculation loops affects core flow and may cause early boiling transition during a Loss of Coolant Accident (LOCA).

(3) An increase in containment peak pressure and temperature due to the larger DBA break size.

(4) An increase in containment suppression pool loads (Mark I Long Term Program considerations) due to the larger DBA break size.

(5) When the intertie line is in use, measured recirculation drive flow will be slightly greater than drive flow delivered to the jet pumps. Flow biased scrams and rod blocks may be affected.

These effects were analyzed and the following conclusions were drawn:

(1) The LOCA analysis specifically accounts for the intertie line contribution to the break size; see Section 14.7.2.

(2) Safety analysis was performed assuming the additional flow path area of the open RHR Intertie line. The results of the analysis met all acceptance criteria and was deemed satisfactory.

(3) The increase in containment peak pressure and temperature is negligible.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 32 of 81 (4) The increase in suppression pool loading is negligible.

(5) A Technical Specification 3.5.1 action provides 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br /> to isolate the RHR Intertie line if discovered open in Mode 1. Requiring the intertie line to be isolated will eliminate the need to compensate for the small change in jet pump drive flow and a reduction in core flow during a loss of coolant accident.

AREVA did not analyze an RHR intertie open line.

6.2.3.4 Inspection and Testing To assure that the LPCI system functions properly, specific provisions are made for periodically testing the operability and performance of several components of the system. In addition, surveillance features provide continuous monitoring of the integrity of vital portions of the system.

a. Pre-Operational Testing Prior to plant startup, a pre-operational test of the complete system was conducted. This test has assured proper functioning and operation of all instrumentation, pumps, heat exchangers, and valves. It also verified that the system meets its design performance requirements. In addition, system reference characteristics, such as pressure differentials and flow rates, were established for use as base points for check measurements in testing during plant operation.
b. Periodic Surveillance and Testing A design flow functional test of the RHR pumps is performed for a pair of pumps during normal plant operation by taking suction from the suppression pool and discharging through the test lines back to the suppression pool. The discharge valves to the reactor recirculation loops remain closed during this test and reactor operation is undisturbed. An operational test of these discharge valves is performed by shutting the downstream valve after it has been satisfactorily tested and then operating the discharge valve. The discharge valves to the containment spray headers are checked in a similar manner by operating the upstream and downstream valves individually. All these valves can be actuated from the control room using remote manual switches. Control system design provides an automatic return from test mode to operating mode if LPCI initiation is required during testing. Testability of the sensor circuits is enhanced by installation of built in test jacks, alarms and indicating lights.

Testing of the sequencing of the LPCI mode of operation is performed with the reactor shut down. Testing the operation of the valves required for the remaining modes of operation of the system is performed at this time.

Periodic inspection and maintenance of the pumps, pump motors, and heat exchangers is carried out in accordance with the manufacturers instructions.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 33 of 81 6.2.4 High Pressure Coolant Injection System (HPCI) 6.2.4.1 Design Basis The design basis for the High Pressure Coolant Injection System (HPCI) is summarized as follows:

a. The HPCI System is provided to insure that adequate core cooling takes place for all break sizes less than those sizes for which the LPCI or Core Spray cooling system can adequately protect the core without assistance from other safeguards systems.
b. The HPCI System meets the above basic requirement without reliance on an off-site power or water source for the injection system.
c. The HPCI System is designed so that each component of the system can be tested on a periodic basis.
d. The HPCI System is capable of providing coolant makeup in the event of a loss of all AC Power (Station Blackout) and is the system credited in the SBO analysis.

6.2.4.2 Description 6.2.4.2.1 General The HPCI System is designed to pump water into the reactor vessel under loss-of-coolant conditions which do not result in rapid depressurization of the pressure vessel. The loss-of-coolant might be due to loss of reactor feedwater or to small line breaks which do not cause depressurization of the reactor vessel.

The HPCI System is shown on Section 15 Drawings NH-36249 and NH-36250.

Principal design parameters are given in Table 6.2-3.

6.2.4.2.2 System Characteristics The HPCI turbine is driven with steam from the reactor vessel. Two sources of water are available for the HPCI System. Normally, water is supplied for the suction of the HPCI pump from the two condensate storage tanks. When the level in either tank falls to the Technical Specification setpoint, the pump suction is automatically transferred to the suppression pool. A level switch associated with each tank provides one-out-of-two logic for this transfer. This transfer may also be made manually by the operator. One condensate storage tank may be taken out of service for inspection and maintenance during plant operation. In this case, HPCI pump suction is required to be aligned to the suppression pool.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 34 of 81 Water from either the condensate storage tank or the suppression pool is pumped into the reactor vessel through the feedwater line, and flow is distributed within the reactor vessel through the feedwater sparger to obtain mixing with the hot water in the reactor pressure vessel. Bechtel calculations have shown that the HPCI-to-feedwater connection is not jeopardized by thermal shock and consequently there is no thermal sleeve installed in this connection. Water leaving the vessel through a line break drains by gravity back to the suppression pool. The RHR System is required for cooling of the suppression pool after several hours of HPCI operation.

The HPCI system was originally designed to pump 3000 gpm into the reactor vessel within a reactor pressure range of about 1120 psig to 150 psig. This provides margin above the minimum required flow of 2700 gpm assumed for the plant safety analysis in Section 14.7.2. As the pressure decreases, the turbine throttle valves open more to pass the required steam flow to match the pump power which is proportional to pressure. The size of the system is selected on the basis of providing sufficient core cooling to prevent clad overheating during the time that the pressure in the reactor vessel decreases to a value that the Core Spray System and/or the LPCI sub-system become effective.

The integrated performance of the HPCI System in conjunction with other Emergency Core Cooling Systems is discussed in Section 6.2.6.

Operation of the system is dependent upon reactor water level signals. Either low-low reactor water level or high drywell pressure starts the system and high reactor water level stops it. The steam supply to the unit includes a moisture drain pot ahead of the turbine to eliminate condensate collection in the pipe thereby permitting rapid start of the unit without warm-up. Turbine speed is limited by the turbine governor system and turbine power is controlled by the HPCI flow control.

Provisions are made to manually override the flow control if the operator should deem it necessary. Exhaust steam from the unit is discharged into the suppression pool.

The turbine glands are vented to the gland seal condenser and water from the booster pump is routed through the condenser for cooling purposes. Operation of the normally aligned HPCI System requires only power from the plant Division II battery system for operation.

The piping of the system is designed to ANSI B31.1 (Reference 28) and the pumps to Section VIII of the ASME Code (Reference 37). Arrangement of the piping includes considerations for potential damage and open runs are protected by structural steel or reinforced concrete. A fatigue evaluation for the HPCI turbine exhaust torus nozzle (Reference 15) concluded that a usage factor of .947 for HPCI turbine operational testing corresponds to 7866 allowable operational tests of the HPCI turbine.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 35 of 81 6.2.4.2.3 Operational Sequence - HPCI Initiation of the High Pressure Coolant Injection (HPCI) occurs on signals indicating reactor low-low water level or high drywell pressure. Low-low reactor water level and high drywell pressure are each detected by four independent level and pressure switches connected in a one out of two twice logic array.

Upon receipt of initiation signal, the HPCI turbine and its required auxiliary equipment start automatically with simultaneous operation of the following equipment without reliance on any AC power:

(1) Steam supply line outboard isolation valve open (if closed) - this is a normally open valve (2) Turbine steam supply and stop valves open (3) Pump suction valve from condensate storage tank opens (if closed) - this valve is normally open (4) Pump discharge valves open (5) Steam line drain valves close to main condenser (6) Test line return valves to condensate storage tank close A minimum flow bypass system back to the suppression chamber is provided for pump protection. The bypass valve is automatically opened on low pump flow and closed on high flow when a HPCI System automatic initiation signal is present and the HPCI System is lined up for automatic operation. In the event of a low water level in either condensate storage tank, the pump suction valves from the suppression chamber open and the suction valve from the condensate storage tanks closes. The valves are interlocked to prevent opening the valve from the condensate storage tank whenever both valves from the suppression chamber are full open. The test bypass valves to the condensate storage tank are also interlocked closed when either suction valve from the suppression chamber is fully open.

6.2.4.2.4 HPCI Automatic Isolation Initiation for automatic isolation of the HPCI occurs on HPCI steam line high flow, low pressure, or high area temperature in the steamline space. High area temperature and high flow are indications of a steam line break. High temperature is detected by four sets of one-out-of-two-twice logic array. Low steam line pressure is detected by four independent pressure switches in a one-out-of-two-twice logic array. High steam line flow is detected by two independent pressure indicating switches connected in a one out of two logic array. A venturi (not elbow taps) supplies the high steam flow signal. The venturi has been shown to be more reliable than elbow taps in preventing spurious trips. Therefore no modifications were made to meet NUREG-0737, Item II.K.3.15 (Reference 8).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 36 of 81 The isolation signal automatically closes the steam supply line isolation valves and the suppression chamber pump suction valves (if open). This same signal also prevents opening of the above valves and the turbine stop valve preventing automatic turbine start.

6.2.4.2.5 HPCI Turbine Trip Automatic trip of the HPCI turbine occurs on high turbine exhaust pressure, low pump suction pressure, high reactor water level, low steam supply line pressure, HPCI auto isolation (steam supply line space high temperature or steam supply line high flow) or turbine overspeed. The steam line isolation logic is discussed in the preceding section. The turbine overspeed trip is a mechanical trip. The high reactor water level trip seals in until either a manual restart is initiated or a low-low reactor water level signal is received. High turbine exhaust pressure is detected by two redundant pressure switches connected in a one-out-of-two logic array. Low pump suction pressure is detected by one pressure switch. High reactor water level is detected by two redundant level switches connected in a two-out-of-two-once logic array. During preoperational testing a test was conducted to assure that a high water level trip will override a high drywell pressure signal to shut down the HPCI turbine.

6.2.4.2.6 Flow Control A flow control system is provided to automatically regulate turbine power to deliver design injection flow. Provisions are included to manually override this flow control system by manual adjustment of turbine power to obtain the desired flow.

6.2.4.2.7 Standby Water Supply From Suppression Pool In the event of either low water level in the condensate storage tank or high water level in the suppression chamber, level switches initiate closure of the pump suction valve from the condensate storage tank and opening of the two pump suction valves from the suppression pool.

6.2.4.2.8 Continuous Operation Operation of the HPCI turbine continues as long as reactor pressure, as measured at the HPCI steam line, is above 150 psig. Components are designed to maintain constant output as the pressure is reduced. The system automatically maintains a constant flow rate between the low-low and high level trip points if the break size is within the capacity of the pump and the reactor is not depressurized below 150 psig.

6.2.4.2.9 Termination of Operation When the reactor pressure, as measured at the HPCI steam line, falls below 150 psig, the speed of the turbine-pump unit begins to decrease and gradually slows to a stop by friction losses. Core cooling at this time is accomplished by either the Core Spray or LPCI Systems.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 37 of 81 6.2.4.2.10 Space Cooling The HPCI space cooling system is composed of two air cooling units with one isolated, which are not required for HPCI operability because the HPCI room initial temperature is maintained equal to or below 100°F (during normal operation). The units are powered from separate emergency power sources and cooling water can be supplied from either the Service Water system or from the Emergency Service Water System upon a loss of off-site power.

6.2.4.2.11 Condensate Storage Tank The High Pressure Coolant Injection pump is normally lined up to the condensate storage tanks. The suction is switched to the suppression pool upon low level being sensed in either condensate storage tank or high level in the suppression pool. The Station Blackout event credits the existence of 44,329 gallons of water in the CSTs for decay heat removal using the method of NUMARC 87-00 Section 7.2.1 for HPCI operation (References 62 and 71).

The condensate storage tank and attached piping were originally designed as non-safety related and non-seismic. As part of the Seismic Category I Piping Review Program, the pump suction piping (from the HPCI pump suction to condensate storage tank suction isolation valve) was verified to be qualified to withstand a seismic event. This provides adequate assurance that the system can be isolated from the non-seismic, non-safety related condensate storage tank water source if necessary.

The instrumentation associated with the automatic transfer from the condensate storage tank to the suppression pool has also been verified to be safety related and capable of withstanding a seismic event.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 38 of 81 6.2.4.3 Performance Analysis The HPCI System is designed to provide adequate reactor core cooling for small breaks below the capability of the unassisted Core Spray or LPCI and to depressurize the reactor primary system to aid the LPCI and Core Spray. A detailed discussion of the performance of the HPCI in conjunction with the LPCI and Core Spray is given in Section 6.2.6.

During the initial phase of the transient before the HPCI System begins operation, the reactor primary system pressure does not change significantly due to the release of the core stored energy and the action of the main turbine initial pressure regulator.

The small liquid break cannot remove enough energy from the system to cause a rapid pressure decrease. When the HPCI System begins operation a significant change in the vessel pressure occurs due to the condensation of steam by the cold fluid pumped into the reactor vessel by the HPCI System. The effect of the mass additions by HPCI are also reflected in the changing slope of the liquid level traces.

As the reactor vessel pressure continues to decrease, the HPCI flow momentarily reaches equilibrium with the flow through the break. Continued depressurization causes the break flow to decrease below the HPCI flow and the liquid levels begin to rise. When the HPCI flow decreases due to low steam supply pressure, the levels begin to drop off, but remain high enough for adequate core cooling for at least 1000 seconds. With either LPCI or Core Spray, the level would be maintained. This type of response is typical of the small breaks; the core never uncovers and is continuously cooled throughout the transient so that no core damage of any kind occurs for breaks that lie within the range of the HPCI System.

Based upon performance analysis of equipment provided, it is concluded that the HPCI System maintains water inventory sufficient to assure core cooling for small breaks. For larger breaks, it causes depressurization as well as helping to maintain liquid inventory. This depressurization enables the Core Spray and/or LPCI System to function before fuel clad melting can occur.

6.2.4.4 Inspection and Testing To assure that the HPCI functions properly if it is needed, specific provisions are made for testing the operability and performance of the various parts of the system.

Testing of the sensing circuitry is enhanced by the installation of built in test jacks, alarms and indicating lights.

The following paragraphs detail the testing and surveillance that were/or can be accomplished during the different modes of operation of the plant.

a. Prior to Plant Startup Preoperational tests were performed on the motor operated valves, control devices, sensors and the lubricating oil pump. During the reactor start up program, complete flow and system tests were performed after sufficient power was achieved to provide the required steam flow.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 39 of 81

b. Reactor Operating or at Hot Standby (1) A test of the system up to the isolation valve can be conducted with steam from the reactor vessel. The steam admission valve is opened, providing steam to drive the turbine-pump unit at its rated output. The valves from the suppression chamber and to the feedwater line remain closed and water is pumped from the condensate storage tank, through the system, and returned to the condensate tank by way of the test line.

(2) The turbine-pump unit is periodically tested by pumping from the condensate storage tank through the pumps and back to the condensate storage tank.

(3) With the pump off and the maintenance block valve upstream of the pump discharge valve closed, the pump discharge valve may be tested by stroking open and closed with the remote manual switch.

(4) In the event that an automatic start signal is received while the HPCI is in the test mode, the test is automatically terminated and the HPCI will align for injection into the reactor vessel.

6.2.5 Automatic Depressurization System (ADS) 6.2.5.1 Design Basis Design bases for the Automatic Depressurization System are:

a. To provide a backup to the HPCI System for depressurizing the reactor vessel in time to permit LPCI to provide adequate core cooling to prevent fuel clad melting.
b. The ADS is automatically actuated after receipt of simultaneous RHR or Core Spray pump running and low-low reactor water level signals.
c. Automatic operation is delayed sufficiently to permit the reactor operator to evaluate the need for depressurization and forestall automatic operation if he so desires.
d. Overpressure safety/relief action is provided when reactor pressure reaches the safety/relief set pressure.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 40 of 81 In response to NUREG-0737, Item II.K.3.18, ADS Logic Modifications (Reference 30), Northern States Power participated in the BWR Owners Group program to study ADS actuation logic alternatives which would eliminate the need for manual actuation to assure adequate core cooling. The NRC Staffs evaluation of this study was transmitted in Reference 12. In order to implement options found acceptable by the NRC Staff in Reference 12 in BWR-3 plants, including Monticello, further work had to be done which identified modifications to the start logic of the low pressure ECCS pumps. General Electric Report AE-06-0184, Rev 1, July, 1984, Modification of ECCS Pump Start Logic, was transmitted by Reference 13. Option 2B described in AE-06-0184 was chosen for implementation at Monticello. In support of option 2B a detailed analysis to determine bypass timer setting was performed and described in General Electric Report AE-79-0884, August 29, 1984, Bypass Timer Calculation for the ADS/ECCS Modification for Monticello which was also transmitted by Reference 13. The NRC Staff found the proposed modifications to be acceptable (Reference 14) and they were installed during the 1986 refueling outage.

In 1986, NSP requested a license amendment (Reference 50) to add the ADS logic modifications into the Monticello Technical Specifications (TS). The proposed TS specified a maximum bypass timer setting of 24 minutes, based on evaluations previously performed (Reference 13), NRC approval of those evaluations (Reference 14) and new evaluations (reference 50) that demonstrated acceptable results with the 10 CFR 50, Appendix K limit of 2200°F. The NRC approved the proposed TS in 1989 (Reference 51).

In 2012, the special event analysis for the plant response to a break outside containment and a simultaneous high pressure injection failure, which is consistent with the MNGP compliance for NUREG-0737 Item II.K.3.18, was updated and revised. The timer setpoints were changed to 15 minutes (nominal). See EC20651, ADS Bypass Timer Setpoint Change.

In 2012, NSPM requested a license amendment (Reference 58) to eliminate the lower Technical Specification limit on the ADS bypass timer. The NRC approved the proposed TS change in 2012 (Reference 59).

6.2.5.2 Description The Automatic Depressurization System accomplishes reactor vessel depressurization by blowdown through automatic opening of the safety/relief valves which vent steam to the suppression pool. For small breaks the vessel is depressurized in sufficient time to allow either Core Spray or LPCI to provide adequate core cooling to prevent any clad melting. For large breaks, the vessel depressurizes through the break without assistance. Depressurization of the reactor vessel may be accomplished manually by the reactor operator or without operator action by the automatic depressurization circuitry.

Automatic actuation requires indication of low-low reactor water level. This circuit is connected in a two-out-of-two-once logic arrangement. An additional interlock is provided to assure that at least one RHR or Core Spray pump is delivering output pressure. Any one of the six pumps, with its corresponding pump switch arrangement, can provide the permissive to clear this interlock.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 41 of 81 A time delay circuit is located in series with the blowdown activation signal to provide time for the HPCI or Condensate and Feedwater System to achieve proper operation restoring reactor coolant level. If, however, these systems fail to deliver sufficient flow, the blowdown would be activated upon termination of the time delay and indication of pressure output of RHR or core spray pumps.

The time delay also provides surveillance time in which the operator can evaluate possible spurious activation signals. A permissive signal from the time delay circuit serves as the confirming signal to a two-out-of-two-once network to activate the relief valve unless the sequence is interrupted by the operator. Manual blowdown of the reactor vessel is accomplished independently of the automatic circuitry. Excessive reactor vessel pressure is automatically relieved by a steam operated pilot valve which in turn activates the main valve. This mode of operation is more completely described in Section 4.4.2.

Three main steam safety relief valves (SRVs) are used in the automatic circuitry. Five other SRVs are installed, but they are not connected into the ADS circuitry.

To assure that the ADS valves are able to operate, provisions are made to power each valve, independently, from alternate power sources. Each valve normally draws power from a predetermined 125 Vdc system. Upon loss of voltage from the predetermined source a relay transfers that valve to the other 125 Vdc power source.

This occurs through a combination of open and closed contacts, in conjunction with a bus power monitor, which comprise an automated power transfer scheme. A loss of bus voltage would be detected and the bus would be isolated from the circuit by a set of opening contacts, coincident with corresponding contacts closing to latch the circuit to the alternate bus. Additionally, two valve specific fuses on the bus side of the contacts protect the bus and associated circuits from faults occurring on the load side. With this arrangement single component failures cannot negate the manual operation of these valves.

6.2.5.3 Performance Analysis The Automatic Depressurization System (ADS) is designed to depressurize the reactor to permit either LPCI or Core Spray to cool the reactor core during a small break Loss-Of-Coolant Accident; this size break would result in a coolant loss without a significant pressure reduction, so neither low pressure system alone could prevent clad damage. The performance analysis of the ADS is conducted in the same manner and with the same basic assumptions as the Core Spray analysis discussed in Section 6.2.2. When the ADS is actuated, the critical flow of steam through the relief valves results in a maximum energy removal rate with a corresponding minimum mass loss. Thus, the specific internal energy of the saturated fluid in the system is rapidly decreased, which causes a pressure reduction. Although some steam cooling would occur during the blowdown phase, no credit is taken for this in the GE/GNF analysis. Steam cooling during blowdown is credited in the AREVA analysis if there is steam cooling occurring. Moreover, since the ADS does not provide coolant makeup to the reactor, the ADS is considered only in conjunction with LPCI or Core Spray and is interlocked to assure that at least one of these pumps is delivering output pressure.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 42 of 81 The relief capacity of the ADS is based on the time required after its initiation to depressurize the nuclear system so that the core can be cooled by Core Spray and LPCI. Based on the AREVA analysis, at least two ADS valves must be the larger size (5.03" bore) to depressurize the nuclear system fast enough to maintain acceptable peak clad temperatures.

Analysis has determined that by operating all three ADS valves, the depressurization requirement is met. The three valves are signaled to open and remain open upon detection of low-low reactor water level and after up to a 138 second time delay (analytical limit) (References 63 and 81). The time delay is provided to prevent an unnecessary depressurization if the abnormal condition is removed during this time or if the operator determines depressurization is not desirable. The three valves associated with the auto depressurization function are totally independent of the SRV low-low set valves and the safety function of the Low-Low Set System (see Section 4.4.2.3).

The entire ECCS complex provided for the Monticello Plant is designed to operate in the absence of all off-site power. The probability of the loss of both the off-site and the redundant on-site AC power supplies is below the level for which automatic protection should be required. However, to alleviate concerns that AC power might not be available to make up coolant inventory during ADS operation, an interlock was provided to assure that at least one of the RHR or core spray pumps is operating. It should be noted, however, that the ability to interrupt the depressurization cycle on loss of all AC power is available to the operator. If the operator, as directed by emergency procedures, identifies a valid reason for stopping the auto-relief cycle, he would manually block its initiation or completion utilizing the ADS inhibit switches in the main control room. Auto depressurization would be blocked for as long as the operator deemed necessary.

As indicated in Section 6.2.5.2 above, these valves are provided with automatic circuitry which assures continuity of power to the valves. Each valve has separate loss of power relays to provide additional independence.

The possibility of water being entrained in the valve internals has been investigated.

Such a possibility was considered in the design of the valves and sufficient drainage paths were deliberately created by providing adequate clearances around the second stage pilot valve. In addition, in normal operation the temperature of the entire valve is substantially above 212°F so that entrained water would vaporize and discharge through the downstream piping which operates at very nearly atmospheric pressure.

6.2.5.4 Inspection and Testing As described in Section 4.4.4, the valves for the Auto Depressurization System (ADS) have been tested prior to installation. These tests were overpressure hydrostatic strength tests, leakage tests and steam tests to test the set point and specified response times. After installation, the ADS circuitry is the only portion of the system that can easily be tested. The valve setpoint is checked with a bench test in accordance with the Monticello In-service Inspection and Testing Program (Section 13.4.6).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 43 of 81 6.2.6 ECCS Performance Evaluation The Monticello Emergency Core Cooling Systems have been analyzed in accordance with the NRC requirements (Reference 4) and the acceptance criteria of 10CFR50.46.

The objective of the LOCA analysis is to provide assurance that the most limiting break size, break location, and single failure combination have been considered for the plant.

Details of the analysis results and conclusion are discussed in Section 14.7.2.

In response to NUREG-0737 (Reference 30) Item II.K.3.17, the NRC reviewed a report of Monticello emergency core cooling systems outages. The NRC concluded that the requirements of Item II.K.3.17 had been met and there was no need for a cumulative outage time requirement at that time (Reference 9).

6.2.7 Additional Analysis 6.2.7.1 Reliability of Mitigating Systems for Small Break LOCA Events An analysis was performed by General Electric on the reliability of a typical BWR-4 to mitigate the consequences of a small break LOCA with degraded system performance. The conclusions of this analysis are also applicable to the BWR-3.

The conclusions are as follows:

(1) The combined reliability of HPCI and (RCIC + CRD) is comparable to the estimated ADS reliability.

(2) The low pressure injection systems (LPCI and CS) reliability is controlled by the ADS reliability.

(3) The total plant reliability of all mitigating systems to cool the core in the long term is controlled by the reliability of the decay heat removal function.

In summary, the BWR provides ample margin to accommodate transients and accidents even with assumed degraded system performance. In addition, sensitivity analyses demonstrate that the overall unreliability results remain approximately the same even with variations by a factor of 3 to 10 in individual component failure rates.

Details of the analysis and met hodology are discussed in Reference 5.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 44 of 81 Table 6.2-1 Reactor Core Spray Cooling System Equipment Design Parameters Pumps Number 2 Type Single stage - vertical - centrifugal Seals Mechanical Drive Electric motor Power source AC power - normal or standby emergency diesel Pump casing Cast steel Impeller Bronze Shaft Stainless Steel Code ASME Section III, Class C, 1965 Edition Flow* See Figure 6.2-2 Head See Figure 6.2-2 Power (required) 800 hp Spray Headers Number 2 - 100% capacity Number of nozzles 204 per header Type of nozzles 50%-3/4-inch Sprocco #2772 (modified) 50%-3/4 open 90° Els Piping Code ANSI B31.1, 1977 Edition with Winter 1978 Addenda

  • Note: See Section 14.7.2 for the flow assumed by the plant safety analysis.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 45 of 81 Table 6.2-2 Residual Heat Removal System (RHR) Equipment Design Parameters (Page 1 of 2)

RHR Pumps Number 4 Type Single stage - vertical - centrifugal Seals Mechanical Drive Electric motor Power source Normal auxiliary or standby emergency diesel Pump casing Cast steel Impeller Bronze Shaft Stainless Steel Code ASME Section III, Class C, 1965 Edition Performance Characteristics 3 pumps running At reactor pressure 20 psi above suppression chamber pressure:

Flow* 4000 +/- 10% gpm each; 12,000 gpm total Head 310 ft Power ** 600 hp each; 1800 hp total At reactor pressure 262 psi above suppression chamber pressure:

Flow 2000 gpm each; 6,000 gpm total Head 640 ft Power ** 600 hp each; 1800 hp total RHR Service Water Pumps Number 4 Type Vertical - centrifugal Power source Normal - auxiliary or standby emergency diesel Flow 3500 gpm each; 7000 gpm total Head (per pump) 626 ft

    • Note: Monticellos RHR pump motor inventory includes both 600 and 700 HP motors that may be used on any of the four RHR pumps.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 46 of 81 Table 6.2-2 Residual Heat Removal System (RHR) Equipment Design Parameters (Page 2 of 2)

Heat Exchangers Number 2 Rated heat load 57.5 x 106 Btu/hr each Primary side flow 8,000 gpm Secondary side flow 7,000 gpm Primary side inlet temperature 165°F Secondary side inlet temperature 85°F Design temperatures River water (secondary side) 350°F Containment water (primary side) 350°F Design pressures Primary side (shell) 500 psi Secondary side (tube) 450 psi Design Code Primary side ASME Section III, Class C, 1965 Edition with Summer 1966 Addenda Secondary side ASME Section VIII, 1965 Edition with Winter 1966 Addenda Containment Spray Cooling System Containment Spray Headers Number 2 Number nozzles (A Loop) 104 Number nozzles (B Loop) 105 Nozzle Pressure drop 75 psi Type nozzle Fog Jet Flow per header 7200 gpm Suppression chamber spray header Number 1 Number nozzles 11 Nozzle pressure drop 75 psi Type Fog jet Flow 360 gpm

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 47 of 81 Table 6.2-3 High Pressure Coolant Injection System Equipment Design Parameters Turbine Steam Pressure Inlet 1125 to 155 psia Steam Pressure Exhaust 65 psi maximum Steam Temperature 558°F to 360°F Speed 3900 to 2125 rpm Emergency Starting 25 seconds Steam Flow 112,000 to 53,000 lb/hr Pump Number 1 main - 1 booster Type (main) multi-stage, horizontal, centrifugal (booster) single-stage,horizontal, centrifugal, gear driven Discharge pressure 1185 to 215 psig Flow 3000 gpm constant Control and Instrumentation Power 125 Vdc 120 Vac (which can be supplied by 250 Vdc)

Auxiliary Oil Pump Motor Power 250 Vdc

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 48 of 81 6.3 Main Steam Line Flow Restrictions 6.3.1 Design Basis The main steam line flow restrictors protect the fuel barrier by limiting the loss of water from the reactor vessel before main steam line isolation valve closure in case of a main steam line rupture outside the primary containment. To accomplish this, the flow restrictions were designed to protect the fuel barrier by limiting the loss of coolant from the reactor vessel following a steam line rupture outside of the primary containment to the extent that the reactor vessel water level does not fall below the top of the core within the time required to close the main steam line isolation valves. This includes withstanding the maximum pressure difference expected across the restrictor following complete severance of a main steam line.

6.3.2 Description A main steam line flow restrictor is provided for each of the four main steam lines. The restrictor is a complete assembly welded into the main steam line between the reactor vessel and the first main steam line isolation valve, and downstream of the main steam line safety relief valves. The restrictor limits the coolant flow rate from the reactor vessel in the event of a main steam line break outside of the primary containment to less than 144.9% of the rated flow at 2004 MWt extended power uprate conditions based on a choked flow rating of 3.02 Mlbsm/hr and 1025 psia reactor vessel dome pressure (Reference 61). The restrictor assembly consists of a venturi type nozzle insert welded into a carbon steel pipe. The venturi type nozzle insert is constructed of Austenitic stainless steel and is held in place with a full circumferential fillet weld.

Figure 6.3-1 shows a cross section view of the steam flow restrictor nozzles. Materials and fabrication methods are shown on the figure.

Maximum clearance between the pipe ID and the OD of the castings is 0.020 inches.

This clearance is necessary to allow for differential expansion as the nozzles are heated. Maximum possible vibration would therefore be 0.020 inches peak to peak.

Although vibration is not expected, analyses indicate that this maximum vibration would not limit the life of the nozzle due to fatigue effects.

The flow restrictor and container pipe are designed and fabricated in accordance with USAS B31.1.0 (Reference 31). Preinstallation inspection and testing is in accordance with the specified ASME Boiler and Pressure Vessel Code (Reference 35). The flow restrictor has no moving parts, and the mechanical structure of the restrictor is capable of withstanding the velocities and forces under main steam line break conditions at a maximum pressure of 1375 psi.

The ratio of the venturi throat diameter to the steam line diameter is approximately 0.6.

This results in 12.93 psi (Reference 68) pressure difference at rated flow but limits the steam flow in a severed line to less than 144.9% of rated flow at 2004 MWt without an appreciable increase in steam moisture content during normal operation. The restrictor is also used as a flow measuring element to initiate closure of the main steam line isolation valves if the steam flow exceeds pre-selected limits.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 49 of 81 6.3.3 Performance Analysis In the event of a main steam line break outside the primary containment, the steam flow rate is restricted in the venturi throat by a two-phase critical flow phenomena. This limits the steam flow rate, thereby reducing the reactor vessel coolant blowdown rate and decreasing the fuel clad temperature increase due to the blowdown. The probability of fuel failure and its consequences are therefore decreased.

Analysis of the steam line rupture accident shows that the core remains covered with water and that the amount of radioactive materials released to the environs through the main steam line break does not exceed 10CFR50.67 limits.

Rapid depressurization caused by the hypothetical break results in flashing of some of the reactor coolant and an accompanying increase in moisture in the flowing steam.

Stresses resulting from the two phase mixture impinging on the flow restrictor do not exceed allowable code limits.

Tests were conducted on a scale model to determine final design and performance characteristics of the flow restrictor, including maximum flow rate of the restrictor corresponding to the accident conditions, pressure losses under normal plant operating conditions and discharge moisture level. The tests showed that the flow restrictor operation at critical throat velocities is stable and predictable. Unrecovered differential pressure across the scale model restrictor was consistently about ten percent of the total nozzle pressure differentials, and the restrictor performance was in agreement with the existing ASME correlation. Full size restrictors have a slightly different hydraulic shape and a differential pressure loss of approximately fifteen percent.

During the startup testing program and escalation to full rated power, it was observed that the total indicated steam flow was substantially less than that which would be consistent with existing feedwater flow and electrical energy output. Following this observation, the pressure drop across the venturi nozzles was measured and found to be substantially less than was predicted by the calibration curve for the existing steam flow rate. The cause of the problem was shown to be leakage into the throat pressure sensing piezometer ring from high pressure regions surrounding this ring.

A modification to correct the pressure leakage problem was designed and tested. The low pressure tap is enlarged and a sleeve is inserted that terminates at a point near the surface of the nozzle throat. The modification effectively bypasses the piezometer ring.

Tests were conducted to assure predictable performance characteristics, and the stress analysis was performed to verify the structural integrity of the modified nozzle assembly (Reference 6).

A subsequent test program at the plant has demonstrated that the modified nozzles perform acceptably (Reference 7).

6.3.4 Inspection and Testing Because the flow restrictor forms a permanent part of the main steam line piping and has no moving components, no operational testing program is needed.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 50 of 81 6.4 Control Rod Velocity Limiters A topical report describing and analyzing the control rod velocity limiter was submitted separately to the Atomic Energy Commission as APED-5446, Control Rod Velocity Limiter, (Reference 32) and is incorporated herein by reference.

6.4.1 Design Basis The purpose of the control rod velocity limiter is to reduce the consequences in the event a high-worth control rod became detached from its rod drive and dropped out of the reactor core. To accomplish this purpose the velocity limiter was designed using the following basis:

a. The control rod free fall velocity is less than 5 ft per second.
b. A minimum impedance of the control rod scram time or positioning ability is maintained.
c. The velocity limiter is integrally attached to the control rod structure.

6.4.2 Description The velocity limiter assembly consists of a single Type 304 stainless steel casting in the shape of two nearly-mated conical elements. These elements are separated from one another by four radial spacers. The separated surfaces of the upper and lower conical elements differ by 15°, with the peripheral separation less than the central separation.

The velocity limiter assembly, shown in Figure 6.4-1 with its associated components, acts within a cylindrical guide tube. The annulus between the guide and the velocity limiter assembly permits the free passage of water over the smooth surface of the cone when the control rod is scrammed in the upward direction. In the opposite direction, however, water is trapped by the lower cone and discharged through the interface between the two conical sections. Because this water is jetted in a partially reversed direction into water flowing upward in the annulus, a severe turbulence is created, thereby slowing the descent of the control rod and limiter assembly.

The guide tubes are 10-inch, schedule 10, Type 304 stainless steel pipe. Each guide tube has a back-seat on the lower end which rests on the control rod drive thimble. This seat restricts water flow out of the tube during a velocity limiter free-fall; the seat also restricts water flow into the interior of the guide tube during normal reactor operation to prevent coolant bypass of the fuel elements.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 51 of 81 6.4.3 Performance Analysis During the development of the velocity limiter, sensitivity tests were performed to assess the effect of manufacturing tolerances in the following items on the velocity limiter performance: Limiter and guide tube diametral tolerance; Nozzle (interfacial gap between cones) gap; Top cone thickness; Limiter/guide tube eccentricity; and Surface finish. These tests and the optimization of the velocity limiter design are described in detail in APED- 5446, Control Rod Velocity Limiter (Reference 32). The results of these tests are summarized as follows:

Dropout Velocities Cold reactor - 2.46 ft/sec Hot reactor - 2.86 ft/sec Scram Times 10% of full insertion - 0.55 sec 90% of full insertion - 5.0 sec 6.4.4 Inspection and Testing Testing and inspecting of the control rod velocity limiter is not required following installation of the control rod assembly. In addition to close surveillance during the fabrication of the rod velocity limiter and control rod assembly manufacture, random control rod assemblies were shop tested which included rod drop tests. Each velocity limiter was visually inspected and gauged prior to assembly. The operation of the individual control rod assemblies for normal operation and scram conditions was confirmed during preoperational testing.

6.5 Control Rod Drive Housing Supports 6.5.1 Design Basis The control rod drive housing supports protect against additional damage to the nuclear system process barrier or damage to the fuel barrier by preventing any significant nuclear transient in the event a drive housing breaks or separates from the bottom of the reactor vessel. To accomplish this the control rod drive housing supports were designed in accordance with the following:

Design Basis

a. Control rod downward motion shall be limited, following a postulated control rod drive (CRD) housing failure, so that any resulting nuclear transient could not be sufficient to cause fuel damage.
b. Clearance shall be provided between the housings and the supports to prevent vertical contact stresses due to their respective thermal expansion during plant operation.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 52 of 81 6.5.2 Description The control rod housing supports are illustrated in Figure 6.5-1. Horizontal beams are installed immediately below the bottom head of the reactor vessel, between the rows of control rod housings and are bolted to brackets which are welded to the steel liner of the drive room in the reactor support pedestal.

Hanger rods, about 10 feet long by 1-3/4 inches in diameter, are supported from the beams on stacks of disc springs which compress about 2 inches under design load.

The support bars are bolted between the bottom ends of the hanger rods. The spring pivots at the top and the beveled loose-fitting ends on the support bars prevent substantial bending moment in the hanger rods if the support bars are overloaded.

Individual grids rest on support bars between adjacent beams. Because a single piece grid would be difficult to handle in the limited work space and because it is necessary that control rod drives, position indicators, and incore instrumentation components are accessible for inspection and maintenance, each grid is designed to be assembled or disassembled in place. Each grid assembly is made from two grid plates, a clamp and a bolt. The top part of the clamp acts as a guide to assure that each grid is correctly positioned directly below the respective CRD housing which it would support in the postulated accident.

When the support bars and grids are installed, a gap of less than 1 inch at room temperature (approximately 70°F) is provided between the grid and the bottom contact surface of the control rod drive flange. During system heatup, this gap is reduced by a net downward expansion of the housings with respect to the supports. In the hot operating condition, the gap is approximately 1/4 inch.

In the postulated CRD housing failure, the CRD housing supports are loaded when the lower contact surface of the CRD flange contacts the grid. The resulting load is then carried by two grid plates, two support bars, four hanger rods, their disk springs, and two adjacent beams.

The American Institute of Steel Construction (AISC) Specification for the Design, Fabrication, and Erection of Structural Steel for Building was used in the design of the CRD housing support system. However, to provide a structure that absorbs as much energy as practical without yielding, the allowable tension and bending stresses were taken as 90% of yield, and the shear stress as 60% of yield. These are 1.5 times the corresponding AISC allowable stresses of 60% and 40% of yield. This stress criterion is considered desirable for this application and adequate for the once in a lifetime loading condition.

For mechanical design purposes, the postulated failure resulting in the highest forces is an instantaneous circumferential separation of the CRD housing from the reactor vessel, with an internal pressure of 1250 psig (reactor vessel design pressure) acting on the area of the separated housing. The weight of the separated housing, control rod drive, and blade, plus the force of 1250 psig pressure acting on the area of the separated housing gives a force of approximately 35,000 lbs. This force is multiplied by a factor of 3 for impact, conservatively assuming the housing travels through a 1-inch gap before contacting the supports. The total force (105 lbs) is then treated as a static load in design formulas.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 53 of 81 6.5.3 Performance Analysis Downward travel of CRD housing and its control rod following the postulated housing failure is the sum of the compression of the disk springs under dynamic loading and the initial gap between the grid and the bottom contact surface of the CRD flange. If the reactor were cold and pressurized, the downward motion of the control rod would be limited to the approximate 2 inch spring compression plus a gap of less than one inch. If the reactor were hot and pressurized, the gap would be approximately 1/4 inch and the spring compression slightly less than in the cold condition. In either case, the control rod movement following a housing failure is limited substantially below one drive notch movement (6 inches). The nuclear transient from sudden withdrawal of any control rod through a distance of one drive notch at any position in the core does not result in a transient sufficient to cause damage to any radioactive material barrier. This meets the fuel damage prevention criteria of design basis 6.5.1-a.

The control rod drive housing supports are in place any time the reactor is to be operated. The housing supports may be removed when the reactor is in the shutdown condition even when the reactor is pressurized, because all control rods are then inserted. Even if a control rod is ejected under the shutdown condition, the reactor remains subcritical, because it is designed to remain subcritical with any one control rod fully withdrawn at any time.

At plant operating temperature a gap of approximately 1/4 inch is maintained between the CRD housing and the supports, at lower temperatures the gap is greater. Because the supports do not come in contact with any of the CRD housings, except during the postulated accident condition, vertical contact stresses are prevented as required by safety design basis 6.5.1-b.

6.5.4 Inspection and Testing When the reactor is in the shutdown mode, the control rod drive housing supports may be removed to permit inspection and maintenance of the control rod drives. When the support structure is reinstalled, it is inspected for proper assembly, particular attention being given to assure that the correct gap between the CRD flange lower contact surface and the grid is maintained. Since the structure is not stressed until an accident occurs, testing is unnecessary. If an accident should occur any deformed parts would be replaced during repair.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 54 of 81 6.6 Standby Liquid Control System 6.6.1 Design Basis 6.6.1.1 Original Design Basis The design objective of the Standby Liquid Control System (SLCS) is to provide the capability of bringing the reactor, at any time in a cycle, to a subcritical condition with the reactor in the most reactive xenon-free state with all of the control rods in the full-out condition. To meet this objective, the Standby Liquid Control System was originally designed to inject a quantity of boron which produces an equivalent concentration of at least 660 ppm of natural boron in the reactor in less than 125 minutes. In addition, a 25% boron concentration margin was added to allow for leakage and imperfect mixing. This resulted in the requirement to inject an equivalent concentration of at least 825 ppm of natural boron in the reactor in less than 125 minutes to produce an actual concentration of at least 660 PPM. With a sodium pentaborate solution with natural Boron-10 isotopic enrichment of 19.8 atom % a volume of 1400 gallons of solution having a 21.4 wt % sodium pentaborate concentration was required to meet the shutdown requirement. At a boron concentration of 10.8 wt %, a volume of solution equal to the maximum tank capacity of 2895 gallons was required.

The boron enrichment of the sodium pentaborate solution is a Boron-10 level of 55.0 atom % or greater as compared to 19.8 atom % (naturally occurring Boron-10). This is equivalent to an enrichment ratio of 2.78. With the enriched boron being utilized, the required boron concentration level (concentration of B-10 and B-11) can be reduced by the ratio of enrichment. The weight of sodium pentaborate necessary to meet the shutdown requirement can be calculated as follows:

SB = (W)(BC/106)(1.25)(1/MW)(19.8/E) where; W = Weight of the Water to be Borated = 715,000 lbs including; a) Reactor Coolant Weight = 521,440 lbs

(+ 48 inches @ 68°F) b) Reactor Recirculation Loops = 61,780 lbs c) RHR Loops (in shutdown cooling mode) = 130,000 lbs BC = Boron Concentration Level = 660 ppm 1.25 = 25% to account for imperfect mixing MW = Molecular Weight Ratio of boron to sodium pentaborate (Na2B10016

  • 10H20)

SB = Weight of Sodium Pentaborate (lbs)

E = Boron Enrichment (atom %)

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 55 of 81 The following equation can then be used to calculate the indicated tank volume which the operator reads in the control room. The minimum indicated tank volume (gal) necessary to meet the original design basis would be calculated as follows:

where; SB = Weight of Sodium Pentaborate (lbs)

VC = Volume Conversion = 7.481 gal/ft3 WD = Density of Water = 62.00 lbs/ft3 at 100 °F SG = Specific Gravity of Sodium Pentaborate = (0.0051xC) + 0.998 C = Concentration of Sodium Pentaborate (wt %)

  • To account for instrument inaccuracies (100 gal on the wide range and 28 gal on the narrow range) an additional 128 gallons is added.

Substituting in for SB using the equation from the previous page and multiply the constants together:

This yields a minimum indicated volume of 1404.2 gallons of solution required at 10.7 wt % is necessary to meet the original design basis with an enrichment of 55.0 atom %. With a minimum pump flow rate value of 24 gpm, the solution necessary to bring the reactor to shutdown will be pumped in under 59 minutes.

The operator will shut the SLCS pump off at an indicated volume of 0 gallons. An indicated volume of 0 gallons results in an actual volume remaining in the tank of 325 gallons. This 325 gallons represents 225 gallons for that unusable portion of the tank volume below the suction nozzle of the pump and 100 gallons for the wide range instrument inaccuracy which is necessary to prevent pump cavitation should the instrumentation be reading higher than the actual level.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 56 of 81 6.6.1.2 Design Basis in Accordance with the ATWS Rule To comply with the ATWS Rule, a higher rate of boron injection is required compared with that required under the original design basis. This rate must be equivalent to 86 gpm of sodium pentaborate at a 13 wt % concentration and natural Boron-10 enrichment for a 251-inch reactor vessel. Monticello has a 205-inch vessel. The method of normalizing the required boron injection for a 251-inch diameter vessel to the 205-inch diameter Monticello vessel in this section is consistent with the method submitted and approved by the exemption contained in References 16 and 17. In Generic Letter 85-03, Clarification of Equivalent Control Capacity for Standby Liquid Control Systems, dated January 28, 1985 (Reference 33), the staff provided clarification of equivalent control capacity as follows:

1. The equivalent in control capacity wording was chosen to allow flexibility in the implementation of the requirement. For example, the equivalence can be obtained by increasing flow rate, boron concentration, or boron enrichment.
2. The 86 gallons per minute and 13-weight percent sodium pentaborate were values used in NEDE-24222, Assessment of BWR Mitigation of ATWS.

Volumes I and II, December 1979, (Reference 34) for BWR-4, BWR-5 and BWR-6 plants with a 251-inch vessel inside diameter. The fact that different values would be equivalent for smaller plants was recognized in NEDE-24222.

The flow rates given here are normalized from a 251-inch diameter vessel plant to a 218-inch diameter vessel plant, i.e., the 66 gpm control liquid injection rate in a 218 is equivalent to 86 gpm in a 251. This is done to bound the analysis....(pp. 2-15) [NEDE-24222]).

3. The important parameters to consider in establishing equivalence are vessel boron concentration required to achieve shutdown and the time required to achieve that vessel boron concentration. The minimally acceptable system should show an equivalence in the parameters to the 251-inch diameter vessel studied in NEDE-24222.

The equivalence requirement can be demonstrated if the following relationship is shown to be true:

(Q/86 gpm)(M251/M)(C/13 wt %)(E/19.8 atom %) 1 where the plant-specific parameters are defined as:

Q = minimum SLCS flow rate (one or two pump operation as appropriate), gpm.

M = mass of water in the reactor vessel and recirculation system at the hot rated conditions, lbs.

C = minimum sodium pentaborate solution concentration, wt %.

E = minimum expected Boron-10 isotope enrichment (19.8 atom % for natural boron), atom %.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 57 of 81 The value of M251 (the mass of the water in the reactor vessel and recirculation system at rated conditions in the reference plant) is 628,300 lbs for a BWR-3/4. This value was calculated based on rated temperature, rated void content, normal water level, control rods fully withdrawn, expected minimum vessel dimensions, and nominal vessel internals dimensions. The plant specific values for Monticello are a flow rate (Q) of 24 gpm, a boron concentration (C) of 10.7 wt % and a boron enrichment (E) of 55.0 atom %. The mass of water in the reactor vessel and recirculation system at the hot rated conditions (M) for Monticello is 400,000 lbs.

Using the Monticello specific values yields:

(24/86)(628,300/400,000)(10.7/ 13)(55.0/19.8) = 1.0022 The Hot Shutdown Boron Weight (HSBW) is calculated on generic bases for each fuel line (e.g. GE14). The HSBW is confirmed effective on plant- and cycle-specific basis.

The HSBW value was analyzed in the MELLLA+ SER NEDC-33006P-A, Rev. 3 (Reference 76). In the response to RAI 5 of NEDC-33006P-A, GEH evaluated the impact of different HSBW values on the final suppression pool temperature. In the response to RAI 1.10 of NEDC-33006PA, GEH provided the HSBW in parts per million (ppm) as a function of core exposure where the average value is very close to the analysis value of 522 ppm. The NRC staff concluded that the acceptability of 522 ppm would need to be evaluated on a plant-specific basis. This was done for MNGP through ODYN simulation and the best estimate simulation with a 3D TRACG simulation for the ATWS analysis. Thus, the applicability of the generic HSBW value for MNGP under MELLLA+ conditions was confirmed.

Fuel design differences may impact the power and pressure excursion experienced during the ATWS event. This in turn may impact the amount of steam discharged to the suppression pool and containment. Any impact on the steam discharged to the suppression pool would primarily be caused by the differences in the void coefficient and the boron worth of the two fuel designs, GE14 and ATRIUM 10XM. The void coefficient determines how fast the reactor power will decrease and to what power level the reactor will decrease following the recirculation pump trip. The more negative the void coefficient, the greater the decrease in power. The boron worth determines how fast power will decrease after the standby liquid control (SLC) system is initiated.

The fuel design difference in void coefficient is much smaller than the cycle variation in void coefficient for a given fuel design. The boron worth of the two fuel designs is very similar, indicating the negative reactivity effects due to the boron insertion will be similar and the core power response as the boron is injected into the system will be very similar. Introduction of ATRIUM 10XM fuel will not significantly impact the long-term ATWS response and the current analysis remains applicable (Reference 78).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 58 of 81 6.6.1.3 Design Basis for LOCA Accident Mitigation The SLCS functions to mitigate the consequences of the design basis Loss-of-Coolant Accident (LOCA). The LOCA radiological consequences analysis using Alternative Source Term (AST) methodology assumes that the SLC tank contents will be injected post-LOCA, Sodium pentaborate in the SLC solution acts as a buffer to maintain suppression pool pH above 7 as acids are formed in primary containment post-LOCA. Maintaining suppression pool pH above 7 prevents conversion of particulate radioiodine species to elemental iodine, resulting in less radioiodine released to the environment and lower accident dose (References 45 through 49).

6.6.1.4 Design Basis for Pump Discharge Relief Valve The Standby Liquid Control system (SBLC) is designed for injection at a maximum reactor pressure equal to the upper analytical limit for the main steam safety relief valves (SRVs) operating in the safety relief mode. A SBLC relief valve setpoint margin analysis has been performed. This analysis verifies adequate margin for the pump discharge relief valve setpoint to insure no inadvertent operation occurs during worst case expected reactor conditions where system use is postulated.

The GE ATWS analysis shows that for the limiting case the peak vessel pressure is 1489 psig, which is more limiting than the AREVA representative ATWS peak pressure analysis value of 1452 psig (Reference 80), providing additional margin compared to the limiting GE ATWS peak pressure analysis. This peak occurs prior to SBLC system pump start which is assumed to occur at the later of (1) the time of high pressure ATWS recirculation pump trip plus 120 seconds operator action time, or (2) the time at which the suppression pool reaches a boron injection initiation temperature of 110 deg F. The lower plenum vessel pressure is postulated to drop to a maximum value of 1205 psig at the time of pump start. This is below the SBLC relief valve nominal setpoint of 1500 psig and results in a relief valve simmer margin well above the recommended minimum value of 75 psi. In the event that the SBLC system is initiated before the time that reactor pressure recovers from the first transient peak of the ATWS, resulting in opening of the SBLC system relief valves, the reactor pressure must reduce sufficiently to ensure SBLC system relief valve closure. The analytical results indicate pump discharge relief valves would reclose before the time when rated SBLC injection is assumed in the ATWS analysis. Consideration was given to the system flow, head losses for full injection, and cyclic pressure pulsations due to the positive displacement pump operation in determining the pressure margin to the opening set point for the pump discharge relief valves (Reference 62, 72, and 75).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 59 of 81 6.6.2 Description The equipment for the Standby Liquid Control System (SBLC) is located in the Reactor Building and consists of an unpressurized tank for low temperature sodium pentaborate solution storage, a pair of full capacity positive displacement pumps, two explosive actuated shear plug valves, heaters, piping, valves, and instrumentation. The P&ID of the standby liquid control system is shown on Section 15 Drawing NH-36253.

Table 6.6-1 summarizes the principal design parameters.

The liquid control tank is complete with a top cover, heater, vent, and drain. The pump suction line is arranged to minimize entry of particulate material which might settle on the tank bottom. Heaters are provided in the tank to heat the water during initial mixing and to maintain temperature as required during normal operation. Heaters are also provided on the piping between the tank and injection pumps. At low tank level, the neutron absorber solution is a 10.7% solution which has a saturation temperature of 52°F (including 5°F Tech Spec required margin). The tank and piping temperature are maintained above approximately 65°F. Low or high temperature at either the piping or the tank causes an alarm in the control room. Two independent level indication systems are provided on the tank. A separate power supply is provided for each level indication system. Liquid level alarms are also provided on the neutron absorber solution tank.

The sodium pentaborate solution is delivered to the reactor by one of two 28 gpm, 1500 psi, positive displacement stainless steel pumps. The pumps and piping are protected from overpressure by two relief valves which discharge back to the poison tank.

The explosive valves are double squib actuated shear plug valves. A low current electrical monitoring system gives visible (pilot light) indication of circuit continuity through both firing squibs in each valve. Loss of continuity through the squibs also causes an alarm in the control room.

Control of injection is provided by a key lock switch which starts the pumps and opens the squib-operated valves. One position of the switch starts one pump and opens one valve. If there is no indication of flow, the operator can switch to the second position which operates the other pump and valve. Use of the key switch minimizes the probability of an accidental injection of the neutron absorber solution. The key lock switch is normally maintained in the unlocked position with the key installed during plant operation when the system is required to be operable but can be locked to prevent accidental injection of neutron absorber solution when desired. The admission valves for this system are the explosive type to provide a high assurance of opening when actuated and to ensure that no boron leaks into the reactor when the injection pump is being tested. The explosive valve circuits are fused to protect the control bus in the event an internal short circuit develops when the explosive is fired.

A test tank and demineralized water supply are an integral part of the system to facilitate system testing and flushing.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 60 of 81 6.6.3 Performance Analysis The neutron absorbing solution in the standby liquid control system is 10.7% by weight of 55 atom percent enriched sodium pentaborate (Na2B10O16-10H2O) at 1404-gallon tank level. This solution volume is available to bring the final boron concentration in the primary system to at least 297 ppm (expressed as parts of enriched Boron-10 per million parts of reactor water by weight). The 297 ppm value is derived from:

(660 ppm + 25%) 19.8 which is equal to (825 ppm) 19.8 55 55 Included in this amount is a 25% margin for leakage and non-uniform mixing.

The Standby Liquid Control System is always operable even in the event of an off-site power failure since it can be powered from the diesel generators. Each pump and valve system is supplied from different diesel-supplied buses. Control power is supplied from the same bus as the power source for that system.

The normal design room temperature of 65°F and the heaters and their alarms assure that the solution (even including solution that may be in the pump inlet piping) is maintained above the saturation temperature of the solution. These portions of the system are the only ones potentially containing stagnant neutron absorbing solution. All portions of the discharge piping are inside the reactor building and are, therefore, warm.

The design basis LOCA radiological analyses assume that within one hour, SBLC injection will begin to enter the suppression pool and all injection will be complete within two hours. Recirculation between the suppression pool and the reactor vessel through flow out the postulated recirculation pipe break occurs, providing transport and mixing of the sodium pentaborate in support of the pH control function. The analyses demonstrate that a sufficient concentration and quantity of sodium pentaborate is available for injection into the reactor vessel during the DBA LOCA to maintain suppression pool pH greater than 7 post-LOCA (References 45 through 49).

6.6.4 Inspection and Testing The system must be tested periodically to establish operability of all components. To avoid introducing boron into the reactor, the test is done in two parts. Without firing the explosive operated valves, each pump can be started locally. Provisions are made to flush the system with demineralized water before this test. The pumps are tested by pumping demineralized water to the test tank. A second test, performed during reactor shutdown, consists of firing the explosive valves and pumping demineralized water from the test tank into the reactor vessel. This tests operability of the system down stream of the explosive valves. After this test, the explosive charge and the shear plugs are replaced in the explosive operated valves.

The containment isolation valves, two check valves located in series near the drywell penetration, are tested by means of test connections.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 61 of 81 Should the Standby Liquid Control System ever be used to shut down the reactor, the sodium pentaborate would be removed from the primary system by flushing for gross dilution and by operation of the reactor cleanup demineralizer system for final polishing.

Boron concentration and enrichment of the solution in the tank is periodically determined by chemical analysis.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 62 of 81 Table 6.6-1 Reactor Core Standby Liquid Control System Principal Design Parameters SYSTEM PARAMETERS Required Natural Boron 660 ppm + 25% margin for mixing Concentration (Dispersed In and leakage = 825 ppm Reactor Coolant)

Poison Injection Rate (Tech Spec, minimum) 24 gpm Poison Compound Na2B10O16 10H2O Nominal Tank Capacity 3000 Gallons PUMP PARAMETERS Type of Pump Triplex Plunger Number 2 (one required) - 100%

capacity each DESIGN CONDITIONS (EACH PUMP)

Capacity 28 gpm Total Developed Head 1500 psi Suction Pressure Atmospheric Type of Drive Electric motor POWER SOURCES Pumping AC Power (Normal Auxiliary or Standby Diesel Generator)

Control Plant Battery Heaters AC Power (Normal Auxiliary or by Manual Switching to Standby Diesel Generator)

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 63 of 81 6.7 Main Control Room, Emergency Filtration Train Building and Technical Support Center Habitability 6.7.1 Design Basis The heating, ventilating and air conditioning system that serves the Main Control Room (MCR) and Emergency Filtration Train (EFT) building is designed to provide cool air in the summer and warm air for heating in the winter. Ductwork is utilized to distribute air.

The air flow in the MCR and portions of the EFT building is normally pressurized with return air arranged to pass back to the air conditioning unit while supplemental outside air is drawn through the outside air ductwork. The EFT system can be manually placed into 100% recirculating mode if required.

The CRV-EFT System will serve the MCR and EFT building during normal or emergency conditions. An emergency condition is defined as that due to a high radiation or detection of toxic chemical vapors in the outside air. During high radiation or detection of toxic chemicals, automatic or manual isolation of the Control Room Envelope (CRE) occurs; the CRE consists of the MCR, first floor EFT building (excluding the battery room), second floor EFT building, and a portion of the third floor EFT building.

6.7.2 Description The air handling units are self-contained package units complete with electric coils for heating and cooling coils for air conditioning.

In the normal operating mode, the MCR and EFT building first and second floors are served by one of the redundant Seismic Class I air conditioning units. The MCR and portions of the EFT building ventilation are normally provided with outside air from the outside air ductwork. Upon receipt of an emergency signal (high radiation in the reactor building plenum or on the refueling floor, low-low reactor water level, drywell high pressure, or high radiation in the Control Room intake), dampers will automatically close, if not already closed, to isolate the CRE and a filtration train will start to provide filtered outside air to pressurize the CRE.

The CRV-EFT System will be manually placed in 100% recirculation, which isolates outside air intake, if toxic chemical vapors are sensed in the Control Room air.

During high radiation conditions, HEPA/charcoal filtered outside air will be supplied to the MCR and portions of the EFT building to pressurize them so that contaminated air will not infiltrate. This arrangement is typical of those provided for BWRs with high off-gas stacks.

The control room ventilation system may be isolated from the outside air supply duct by manual action from the control room or by automatic action. Closure of the isolation dampers is provided in an emergency condition, to prevent injection of contaminated air such as would result from leakage which bypasses secondary containment following a LOCA or a steam line break outside containment.

A non-redundant, non-Class IE smoke detector, which meets NFPA requirements, is provided in the outside air intake.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 64 of 81 The CRV-EFT system normally operates from off-site AC power. If off-site power is not available, the system will be automatically supplied by the diesel generators.

The following components of the air handling system for the Main Control Room are redundant and Seismic Class I to provide protection for the control room personnel during design basis accident conditions.

Packaged air conditioning units and HEPA/charcoal filtration units complete with their supply air fans.

Radiation detectors Tornado dampers and a section of the air distribution ductwork Distribution ductwork and blanking plates Outside air isolation dampers The Technical Support Center (TSC) is served by a separate non-redundant, non-seismic air conditioning and filtration unit called the Technical Support Center Emergency Ventilation System (TSC-EVS).

6.7.3 Performance Analysis The system for the control room complies with the requirements of NUREG-0737 as stated in NSPs submittals and the NRCs acceptance SER (Reference 38). Control room personnel are protected against radioactive gases so that the plant can be safely shutdown under design basis accident condition. Electrical and physical redundancy has been provided for all CRV-EFT System components that serve the main control room. Redundant portions of the control room CRV-EFT System meet the single failure criterion.

Due to the close proximity of the radiation detectors and their associated signal cables, the radiation monitor system has been modified in order to meet the single failure criterion. If a radiation monitor failure signal is received, the CRV-EFT System will trip into its fail safe mode which is the high radiation mode.

The design basis Loss of Coolant Accident (LOCA) radiological consequences analysis assumes unfiltered inleakage to the Control Room envelope of 500 cfm for the duration of the accident. For the design basis FHA, MSLBA, and CRDA, analysis using the Alternative Source Term methodology has demonstrated that operation of an Emergency Filtration Train is not required to maintain Control Room dose below GDC 19 and 10CFR50.67 limits. Reference USAR Section 14.7

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 65 of 81 6.7.4 Inspection and Testing The EFT surveillance requirements include an explicit reference to the testing criteria of Section 10, HEPA Filter Bank In-Place Test, and Section 11, Adsorber Bank In-Place Test, of ASME N510-1989, Testing of Nuclear Air Treatment Systems (Reference 39),

and to ASTM D 3803-89 Standard Test Method for Nuclear-Grade Activated Carbon (Reference 40). Because of the design vintage and the configuration of the Monticello EFT system, the following exceptions to the requirements of ASME N510-1989 in-place testing are taken:

1. A visual inspection of applicable items from Section 5.5.1 of ASME N510-1989 is performed. Examples of items that are not applicable to Monticello include dovetail type access gaskets with a seating surface suitable for a knife edge seal and shaft seals.
2. The housing leak test in Section 6.2.2 and Table 1 of ASME N510-1989 is not performed because the EFT was built to be tested to ANSI/ASME N510-1980 which does not require these tests to be performed periodically. A smoke test has been incorporated into the test program as an alternative to the housing leak test.

NRC acceptance of continued use of the two exceptions to ASME N510-1989 testing requirements is reflected in License Amendment 112 (Reference 41).

3. Heater testing requirements were removed as part of implementation of TSTF-522, Revise Ventilation System Surveillance Requirements to Operate for 10 Hours per Month. RG 1.52, revision 3, states humidity control is accounted for when testing charcoal at 95% relative humidity. Since the Ventilation and Filter Testing Program tests the charcoal at 95% relative humidity, the in-line heaters are not required. The emergency filtration trains are operated per the Surveillance Frequency Control Program for at least 15 minutes to demonstrate the equipment and controls are functioning properly.

NRC acceptance of the heater function not being required is reflected in License Amendment 181. The Surveillance Frequency Control Program is described in Technical Specifications Section 5.5, Programs and Manuals and was approved in License Amendment 200.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 66 of 81 6.8 References

1. Deleted.
2. NSP (L O Mayer) letter to the NRC (D L Ziemann), Supplement to June 7, 1976 Letter Concerning LPCI Design, dated July 30, 1976.
3. Deleted.
4. NRC (D L Ziemann) letter to NSP (L O Mayer), Monticello Nuclear Generating Plant, dated March 11, 1977.
5. General Electric report, NEDO-24876, Reliability of BWR-4 Mitigating Systems for Small Break LOCA Events, November 1980.
6. General Electric report NEDO-13234, Steam Line Flow-Limiting Test Program, R.H.

Moen, November 1971.

7. General Electric report NEDO-10544, Modified Steam Line Flow-Limiting Venturi Test Program, E.L. Strickland, November 1971.
8. NRC (D B Vassallo) letter to NSP (D M Musolf), NUREG-0737 Item II.K.3.15, Isolation of HPCI/RCIC, dated January 6, 1983.
9. NRC (D B Vassallo) letter to NSP (D M Musolf), Review of NUREG-0737 Item II.K.3.17, Report on Outages of ECC Systems, dated August 24, 1983.
10. General Electric report NEDO-30477 Safety Analysis of the RHR Intertie Line Monticello Nuclear Generating Plant, Revision 1, June, 1984.
11. General Electric report MDE-16-0186, Assessment of the ECCS Performance of the Monticello Nuclear Generating Plant With No Recirculation Pump Trip, C.H. Stoll, March 1986.
12. NRC (D B Vassallo) letter to NSP (D M Musolf), NUREG-0737, Item II.K.3.18, ADS Logic Modifications, dated June 13, 1983.
13. NSP (D M Musolf) letter to NRC, Implementation of NUREG-0737, Item II.K.3.18, ADS Logic Modifications, dated October 24, 1984.
14. NRC (D B Vassallo) letter to NSP (D M Musolf), NUREG-0737, Item II.K.3.18, ADS Logic Modification, dated January 29, 1985.
15. NUTECH (Dr J K Smith) letter to NSP (C K Anderson), Fatigue Evaluation for Monticello HPCI and RCIC Turbine Exhaust Torus Nozzles, dated December 4, 1987.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 67 of 81

16. NSP (D M Musolf) letter to the NRC, Request for Exemption From the Requirements of 10 CFR 50.62 Requirements for Reduction of Risk From Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants, dated August 18, 1987.
17. NRC (D C DiIanni) letter to NSP (D M Musolf), Environmental Assessment and Finding of No Significant Impact, December 11, 1987.
18. Deleted.
19. Deleted.
20. Deleted.
21. Regulatory Guide 1.82, Rev 1, Water Sources for Long Term Recirculation Cooling Following a Loss-of-Coolant Accident, November, 1985.
22. NRC Bulletin 93-02, Debris Plugging of Emergency Core Cooling Suction Strainers, Supplement 1, dated February 18, 1994.
23. NSP (R O Anderson) letter to the NRC, Initial (60 day) Response to NRC Bulletin 93-02, Supplement 1, Debris Plugging of Emergency Core Cooling Suction Strainers, dated April 19, 1994.
24. Deleted.
25. ASME Boiler and Pressure Vessel Code,Section III, Class C Vessels, 1965 Edition with Summer 1966 Addenda.
26. Deleted.
27. Deleted.
28. American National Standard Code for Pressure Piping, Power Piping, ANSI B31.1, 1977 Edition with Winter 1978 Addenda.
29. ASME Boiler and Pressure Vessel Code,Section VIII, Winter Addenda of 1966.
30. NUREG-0737, Clarification of TMI Action Plan Requirements, November 1980.
31. USA Standard Code for Pressure Piping, USAS B31.1.0 - 1967, Power Piping.
32. General Electric report, APED-5446, Control Rod Velocity Limiter, March 1967.
33. NRC (D G Eisenhut) Generic Letter 85-03, Clarification of Equivalent Control Capacity for Standby Liquid Control Systems, dated January 28, 1985.
34. General Electric report NEDE-24222, Assessment of BWR Mitigation of ATWS, Volumes I and II, December 1979.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 68 of 81

35. ASME Boiler and Pressure Vessel Code,Section III.
36. Deleted.
37. ASME Boiler and Pressure Vessel Code,Section VIII, 1965 Edition.
38. NRC (J J Stefano) letter to NSP (D M Musolf), Amendment No. 65 to Facility Operating License No. DPR-22 (TAC No. 56977), dated May 30, 1989.
39. ASME N510-1989 Testing of Nuclear Air Treatment Systems.
40. ASTM D 3803-89 Standard Test Method for Nuclear-Grade Activated Carbon.
41. NRC (C F Lyon) letter to NSP (M F Hammer), Issuance of Amendment Re:

Emergency Filtration Train Testing Exceptions and Technical Specification Revisions (TAC No. MA8419), dated August 18, 2000.

42. NRC (C F Lyon) letter to NMC (J S Forbes), Monticello Nuclear Generating Plant -

Completion of Activity for NRC Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling-Water Reactors, dated May 6, 1996 (TAC No. M96156), dated September 27, 2001.

43. NMC (J D Purkis) letter to NRC, Completion of Evaluation of Debris Loading for ECCS Suctions Strainers and Closeout of NRC Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling-Water Reactors, dated August 30, 2001.
44. Deleted.
45. NRC (P S Tam) letter to NMC (J T Conway), Monticello Nuclear Generating Plant -

Issuance Of Amendment Re: Full-Scope Implementation Of The Alternative Source Term Methodology (TAC NO. MC8971), dated December 7, 2006.

46. NRC (P S Tam) letter to NMC (J T Conway), Monticello Nuclear Generating Plant (MNGP) - Correction Of Safety Evaluation Associated With Alternative Source Term Amendment (TAC NO. MC8971), dated April 17, 2007.
47. NMC (J T Conway) letter to the NRC, License Amendment Request - Full Scope Application of an Alternative Source Term, dated September 15, 2005.
48. NMC (J T Conway) letter to the NRC, Full Scope Alternate Source Term -

Supplemental Information, dated April 13, 2006.

49. NMC (J T Conway) letter to the NRC, Response to Request for Additional Information Related to License Amendment Request for Full Scope Alternative Source Term, dated August 22, 2006.
50. NSP (D M Musolf) letter to NRC, License Amendment Request Dated December 5, 1986; Reactor Vessel Level Instrumentation, ADS Logic Changes and S/RV Discharge Pipe Pressure Switch Setpoints, dated December 5, 1986.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 69 of 81

51. NRC (J J Stefano) letter to NSP (D M Musolf), Amendment No. 62 to Facility Operating License No. DPR-22 (TAC No. 65572), dated March 31, 1999.
52. NRC Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems, January 11, 2008.
53. Monticello Nuclear Generating Plant (MNGP) - Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems. Proposed Alternative Course of Action (TAC No.

MD7847) Sept. 9, 2008.

54. Nine-Month Response to NRC Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems (TAC No. MD7847) October 14, 2008.
55. Response to Request for Additional Information Related to Generic Letter 2008-01 May 20, 2011.
56. Monticello Nuclear Generating Plant Nine-Month supplemental (Post-Outage)

Response to NRC Generic Letter 2008-01 August 14, 2009.

57. Generic Letter 2008-01: Three Month Response to Generic Letter 2008-01 April 11, 2008.
58. NSPM letter L-MT-12-028 License Amendment Request: Revise Allowable Value for the Automatic De-pressurization System Bypass Timer, April 5, 2012.
59. Monticello Nuclear Generating Plant - Issuance of Amendment Regarding the Automatic De-pressurization System Bypass Timer (TAC NO. ME8345) September 7, 2012.
60. NSP (D M Musolf) letter to NRC, "Submittal of the Monticello Mark I Containment Long Term Program Plant Unique Analysis Report," dated December 15, 1982
61. NSPM letter L-MT-13-020 (M A Schimmel) to the NRC, "Monticello Extended Power Uprate (EPU): Second Supplemental for Gap Analysis Updates (TAC MD9990),"

dated February 27, 2013.

62. GE Hitachi Report NEDC-33322P, Revision 3, "Safety Analysis Report for Monticello Constant Pressure Power Uprate," October 2008
63. GE Document GE-NE-0000-0060-9285-Rev 5, "ECCS/LOCA Analysis Input Parameters (Form OPL-4/5)," May 10, 2012 (located in EC 20651).
64. Letter from F. Paradiso to R. Rohrer, Monticello Nuclear Plant GE14 ECCSLOCA Evaluation with RHR Intertie Line Open, NSA 01459, October 10, 2001.
65. GE Hitachi EPU Project Task Report GE-NE-0000-0060-9286-TR-R2, Revision 2, "Task T0407: ECCS-LOCA SAFER/GESTR," October 2011 (located in Monticello calculation number 11-180).

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 70 of 81

66. NSPM letter L-MT-12-082 (M A Schimmel) to NRC, "Monticello Extended Power Uprate and Maximum Extended Load Line Limit Analysis Plus License Amendment Requests: Supplement to Address SECY 11-0014 Use of Containment Accident Pressure (TAC Nos. MD9990 and ME3145)," dated September 28, 2012.
67. NRC (P S Tam) letter to NSPM (T J O'Connor), "Monticello Nuclear Generating Plant

- Issuance of Amendment RE: Minimum Core Spray Pump Flow Rate (TAC ME5441)," dated January 11, 2012.

68. GE Hitachi EPU Project Task Report GE-NE-0000-0060-8791-TR-R0, Revision 0, "Task T0300: Nuclear Boiler System," November 2007 (Monticello calculation number 11-221).
69. Monticello Calculation 12-040, Rev. 0A, "Containment Accident Pressure Assessment of ECCS Pump NPSHA Requirements for Extended Power Uprate (EPU)."
70. NMC EPU Project Task Report T0310, Revision 0, "Task T0310: Residual Heat Removal System," November 2007 (Monticello calculation number 11-330).
71. GE Hitachi EPU Project Task Report GE-NE-0000-0073-2176-TR-R0, Revision 0, "Task T0903: Station Blackout," March 2008 (Monticello calculation number 11-184).
72. GE Hitachi EPU Project Task Report GE-NE-0000-0065-0227-TR-R1, Revision 1, "Task T0609: Standby Liquid Control System," February 2009 (Monticello calculation number 11-240).
73. GE Hitachi EPU Project Task Report GE-NE-0000-0060-9229-TR-R3, Revision 3, "Task T0400: Containment System Response," February 2011 (Monticello calculation number 11-173).
74. GE Hitachi EPU Project Task Report GE-NE-0000-0074-5421-TR-R0, Revision 0, "Task T0611: Appendix R Fire Protection," December 2007 (Monticello calculation number 11-174).
75. GE Hitachi Report "Task T0902: Anticipated Transients Without Scram," March 2014 (Monticello calculation number 15-040).
76. GE-Hitachi, NEDC-33006P-A, Revision 3, General Electric Boiling Water Reactor Maximum Extended Load Line Limit Analysis Plus, dated June 2009 (ADAMS Accession No. ML091800530).
77. Safety Analysis Report for Monticello Maximum Extended Load Line Limit Analysis Plus, NEDC-33435P, Revision 1, December 2009.
78. GE Hitachi MELLLA+ Project Task Report 0000-0096-6889-TR-R1, Revision 1, Task T0407: ECCS-LOCA SAFER/GESTR, October 2011 (located in Monticello calculation 11-180).
79. Monticello calculation 13-055, Rev. 1, "Core Spray and LPCI Flow Delivery to Reactor Vessel for Safety Analysis."

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 71 of 81

80. ANP-3295 Rev 3, "Monticello Licensing Analysis for EFW (EPU/MELLLA+),"

February 2016.

81. Calculation 16-014 Revision 1, Monticello LOCA Break Spectrum for EPU/EFW with ATRIUM' 10XM Fuel and Revised Modeling Parameters.
82. ANP-3720P Revision 0, Monticello LOCA MAPLHGR Limits for EPU/EFW with ATRIUM 10XM Fuel and Revised Modeling Parameters, January 2019.
83. EMF-2361(P)(A) Revision 0, EXEM BWR-2000 ECCS Evaluation Model, Framatome ANP, May 2001.
84. NEI 09-10 Rev. 1a-A Guidelines for Effective Prevention and Management of System Gas Accumulation.
85. NRC (R F Kuntz) letter to NSPM (P A Gardner), "Monticello Nuclear Generating Plant

- Issuance of Amendment RE: Technical Specifications Task Force Standard Technical Specifications Change Traveler TSTF-523, Revision 2, "Generic Letter 2008-01, Managing Gas Accumulation" (CAC No. MF6479)" dated June 21, 2016.

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 72 of 81 FIGURES

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 73 of 81 Figure 6.2-2 Typical Core Spray Pump Characteristics

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 74 of 81 Figure 6.2-4 Typical RHR Pump Characteristics

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 75 of 81 Figure 6.2-5 RHR - Simplified P&ID - LPCI Mode Selecting Specified Loop

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 76 of 81 Figure 6.2-6 RHR - Simplified P&ID - Containment Spray/Cooling Mode

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 77 of 81 Figure 6.2-7a LPCI System - Logic Control System Arrangement

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 78 of 81 Figure 6.2-7b LPCI System - Loop Selection/Break Detection Functional Block Diagram

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 79 of 81 Figure 6.3-1 Main Steamline Flow Restrictor Nozzle

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 80 of 81 Figure 6.4-1 Control Rod Velocity Limiter Isometric HANDLE 6.5 D-120 EXTENDED HANDLE MODEL SHEATH 143 NEUTRON ABSORBER RODS BLADE COUPLING RELEASE HANDLE VELOCITY LIMITER COUPLING SOCKET

MONTICELLO UPDATED SAFETY ANALYSIS REPORT USAR-06 Revision 38 SECTION 6 PLANT ENGINEERED SAFEGUARDS Page 81 of 81 Figure 6.5-1 Control Rod Drive Housing Support Isometric

Retrieved from "https://kanterella.com/w/index.php?title=ML21070A121&oldid=3415728"