ML24128A101

Updated Safety Analysis Report (Usar), Revision 38, Section 1, Introduction and Summary Description, Redacted

ML24128A101
Person / Time
Site:	Prairie Island
Issue date:	04/30/2024
From:	Northern States Power Company, Minnesota, Xcel Energy
To:	Office of Nuclear Reactor Regulation
Shared Package
ML24128A092	List: ML24128A088 ML24128A098 ML24128A099 ML24128A100 ML24128A101 ML24128A102 ML24128A103 ML24128A104 ML24128A105 ML24128A106 ML24128A107 ML24128A108 ML24128A109 ML24128A110 ML24128A111 ML24128A112 ML24128A113 ML24128A114 ML24128A115 ML24128A116 ML24128A117 ML24128A118 ML24128A119 ML24128A120
References
L-PI-24-010
Download: ML24128A101 (1)

Text

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page i

SECTION 1 INTRODUCTION AND

SUMMARY

DESCRIPTION

TABLE OF CONTENTS Page

1.1 PURPOSE, SCOPE AND ORGANIZATION OF REPORT ......................1.1-1 1.1.1 Introduction ..............................................................................1.1-1 1.1.2 Methods of Technical Presentation ..........................................1.1-2 1.2 PRINCIPAL DESIGN CRITERIA .............................................................1.2-1 1.2.1 Overall Plant Requirements (GDC 1 - GDC 5) .........................1.2-2 1.2.2 Protection by Multiple Fission Product Barriers (GDC 6-GDC 10) ......................................................................1.2-3 1.2.3 Nuclear and Radiation Controls (GDC 11 - GDC 18) ...............1.2-5 1.2.4 Reliability and Testability of Protection Systems (GDC 19-GDC 26) ....................................................................1.2-7 1.2.5 Reactivity Control (GDC 27 - GDC 32) .....................................1.2-10 1.2.6 Reactor Coolant Pressure Boundary (GDC 33 - GDC 36) .......1.2-12 1.2.7 Engineered Safety Features (GDC 37 - GDC 65) ....................1.2-14 1.2.8 Fuel and Waste Storage Systems (GDC 66-GDC 69) .............1.2-20 1.2.9 Plant Effluents (GDC 70) ..........................................................1.2-21 1.3

SUMMARY

DESIGN DESCRIPTION AND SAFETY ANALYSIS ............1.3-1 1.3.1 Plant Site and Environs ............................................................1.3-1 1.3.2 Structures .................................................................................1.3-3 1.3.3 Nuclear Steam Supply System .................................................1.3-3 1.3.4 Reactor and Plant Control ........................................................1.3-4 1.3.5 Waste Disposal System ...........................................................1.3-4 1.3.6 Fuel Handling System ..............................................................1.3-5 1.3.7 Turbine and Auxiliaries .............................................................1.3-5 1.3.8 Electrical System ......................................................................1.3-5 1.3.9 Engineered Safety Features .....................................................1.3-5 1.3.10 Shared Facilities and Equipment ..............................................1.3-7

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page ii

TABLE OF CONTENTS [Continued]

Page

1.4 IDENTIFICATION OF LICENSEE AND CONTRACTORS ......................1.4-1 1.4.1 Licensee ...................................................................................1.4-1 1.4.2 Contractors ...............................................................................1.4-1 1.5 GENERAL DESIGN CRITERIA ...............................................................1.5-1

1.6 REFERENCES

........................................................................................1.6-1

LIST OF TABLES TABLE 1.3-1 AUXILIARY, EMERGENCY, AND WASTE DISPOSAL SYSTEM SHARED SYSTEMS

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

TABLE 1.3-3 SHARED COMPONENTS NOT REQUIRED FOR NORMAL PLANT OPERATION

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page iii

TABLE OF CONTENTS [Continued]

LIST OF FIGURES

FIGURE 1.1-1 LEGEND FOR FLOW DIAGRAM

FIGURE 1.1-2 INSTRUMENT AND VALVE LEGEND

FIGURE 1.1-3 GA SITE LAYOUT

FIGURE 1.1-4 GA BUILDING ARRANGEMENT & COLUMN ROW GRID

FIGURE 1.1-5 GA PLAN @ ELEVATION 695 - GROUND FLOOR

FIGURE 1.1-6 GA PLAN @ ELEVATION 715 - MEZZANINE

FIGURE 1.1-7 GA PLAN @ ELEVATION 735 - OPERATING FLOOR

FIGURE 1.1-8 GA PLAN @ ELEVATION 755 - VENTILATION EQUIPMENT FLOOR

FIGURE 1.1-9 GA PLAN @ ELEVATION 679 - CONDENSER PIT

FIGURE 1.1-10 GA PLAN @ ELEVATION 695 - GROUND FLOOR

FIGURE 1.1-11 GA PLAN @ ELEVATION 715 - MEZZANINE

FIGURE 1.1-12 GA PLAN @ ELEVATION 735- OPERATING FLOOR

FIGURE 1.1-13 GA PLAN @ ELEVATION 670

FIGURE 1.1-14 GA PLAN @ ELEVATION 695

FIGURE 1.1-15 GA TURBINE/AUXILIARY/FUEL HANDLING - (N-S LOOKING EAST)

FIGURE 1.1-16 GA TURBINE/AUXILIARY/REACTOR - (N-S LOOKING EAST)

FIGURE 1.1-17 SERVICE/AUXILIARY/D5 & D6 (E-W LOOKING NORTH)

FIGURE 1.1-18 SCREENHOUSE - (N-S LOOKING WEST)

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page iv

THIS PAGE IS LEFT INTENTIONALLY BLANK

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.1-1

SECTION 1 INTRODUCTION AND

SUMMARY

DESCRIPTION

1.1 PURPOSE, SCOPE AND ORGANIZATION OF REPORT

1.1.1 Introduction

This Updated Safety Analysis Report (USAR) is submitted by Northern States Power Company, a Minnesota Corporation (NSPM), herein designated as the licensee (refer to section 1.4.1), for the Prairie Island Nuclear Generating Plant, herein designated as the plant, consisting of two units situated at the Prairie Island site near Red Wing, Minnesota, in accordance with the requirements of 10CFR50 Section 50.71(e) as published in the Federal Register on May 9, 1980. The two units are known as Prairie Island Units 1 and 2.

This USAR is the updated version of the Final Safety Analysis Report (FSAR). The FSAR was originally submitted on January 28, 1971. That document will be referred to as the original FSAR. Unit 1 licensing was based on the FSAR as amended through amendment 36. Unit 2 licensing was based on the FSAR as amended through amendment 38. Amendment 38 was submitted on May 3, 1974. After May 3, 1974, the FSAR was not amended and became an historical document, which will be referred to as the FSAR. The USAR contains a current description of the Prairie Island Nuclear Generating Plant, Units 1 and 2, as of the latest revision date (see document control section). The USAR will be revised on a refueling interval basis per 10CFR50.71(e)(4),

within 6 months following each Unit 2 refueling outage.

The Prairie Island Nuclear Generating Plant, Units 1 and 2, each employ a 2-loop pressurized water reactor. NSPM owns the facility. Northern States Power Company, a Minnesota corporation (NSPM) operates the facility. Westinghouse Electric Corporation designed and supplied the nuclear steam supply system, the initial reactor fuel, and the turbines in both Unit 1 and Unit 2. Mitsubishi Hitachi designed and supplied the replacement electric generator for both units. Framatome-ANP designed and supplied the Unit 1 Steam Generators. AREVA-NP designed and supplied the Unit 2 Steam Generators. Pioneer Service and Engineering Company (PS&E) was the plants architect-engineer. Northern States Power Company was the constructor.

The plant was constructed, pursuant to Construction Permits CPPR-45 and CPPR-46, at the Prairie Island site in Goodhue County, Minnesota. Construction started on June 26, 1969. Initial fuel loading was completed during Fall of 1973 for Unit 1 and Fall of 1974 for Unit 2. Following a period of testing, full commercial operation began on December 16, 1973 for Unit 1 under Facility Operating License Number DPR-42, and on December 21, 1974 for Unit 2 under Facility Operating License Number DPR-60.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.1-2

This USAR contains an analysis and evaluation of the plant, including the core, based on operation at 1677 MWt per reactor, which is equivalent to a gross electrical output of 584 MWe. Each reactor is capable of an ultimate power output of 1721.4 MWt, and steam and power conversion equipment, including the turbine generator output is based on plant efficiency and operational requirements. All plant safety systems, including containment and engineered safeguards, were designed and originally evaluated for operation at the maximum power level of 1721.4 MWt.

The containment for each unit was designed by PS&E and consists of two systems:

A primary containment consisting of a free-standing low-leakage steel vessel, including its penetrations, isolation systems and heat removal systems.

A secondary medium leakage concrete shield building surrounding the primary containment, including special ventilation systems for its annulus and adjacent auxiliary building.

1.1.2 Methods of Technical Presentation

1.1.2.1 Purpose This USAR contains the changes necessary to reflect significant information and analyses submitted to the Commission by NSPM or prepared by NSPM pursuant to Commission requirements since the submittal of the FSAR.

1.1.2.2 Radioactive Material Barrier Concept

The safety aspects of this report pertain to the relationship between plant behavior under varied circumstances and the radiological consequences to persons offsite. This report is oriented to the radioactive material barrier approach as this approach facilitates evaluation of the radiological effect of the plant on the environs and to the health and safety of the general public.

The relationship of a system or component to these radioactive material barriers is the overriding consideration as to the depth of technical information presented about that system or component. Systems that must operate to preserve the radioactive material barriers are described in the greatest detail. Systems that have little relationship to the radioactive material barriers are described only with as much detail as is necessary to establish their functional role in the plant.

1.1.2.3 Organization of Contents

The USAR is organized into 14 major sections each of which consists of a number of subsections. The principal architectural and engineering criteria which define the broad frame of reference within which the plant is designed are set forth in subsection 1.2.

Subsection 1.3 presents a brief description of the plant in which the nuclear safety systems and engineered safeguards are separated from the other plant systems, so that those systems essential to safety are clearly identified.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.1-3

Section 2 contains a description and evaluation of the site and environs, supporting the suitability for a nuclear plant of the size and type described.

Section 3 and Section 4 describe the reactors and the reactor coolant systems, Section 5 the containment and related systems, and Sections 6 through 12 the emergency and other auxiliary systems.

Section 13 describes the Companys program for organization and training of plant personnel.

Section 14 is a safety evaluation summarizing the analyses which demonstrate the adequacy of the reactor protection system, and the engineered safety features systems.

The consequences of various postulated accidents are within the criteria in 10CFR50.67.

The appendices to the USAR describe and evaluate, (D) radioactive source bases, (E) environmental studies, (F) probable maximum flood, (G) containment system evaluation (H) meteorological program, (I) postulated pipe failure analysis outside containment, (J) pre-operational and start-up tests and (K) containment pressure response to LOCA.

Incorporated into the design of this plant are features to improve both operational performance and overall safety which have been presented in special topical reports.

These reports are referenced in the text where applicable.

1.1.2.4 Format Organization of Subsections

The USAR Table of Contents is provided with Volume One and shows 2 or 3 digit subsection detail only (1.2, 12.3, etc.). Tables of Contents for each section are provided at the beginning of each section.

The listing of effective pages showing the current revision and effective date of each page is provided with Volume One.

Tables and figures are grouped in numerical order at the end of each section. The order is tables first, then figures.

References are listed in order of appearance in a separate subsection just ahead of the tables at the end of each major section. Some of the references used in the USAR may not have been previously submitted to the NRC, but are available from NSP.

Subsections are numerically identified by order of appearance in a section using a decimal numbering system, e.g., 3.4, the fourth subsection in Section 3.0. Subsections are further subdivided using decimal numbers (3.4.1.1, etc.). Pages within each subsection are consecutively numbered (3.4-1, 3.4-2, etc.).

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.1-4

Tabulations of data are designated Tables and are identified by the subsection number followed by a hyphen and the number of the table according to its order of mention in the text, (Table 3.4-5 is the fifth table of subsection 3.4). Drawings, pictures, sketches, curves, graphs, and engineering diagrams are identified as Figures and are numbered using the same convention as tables.

The general organization of a subsection describing a system or component usually follows:

a. Design Basis

b. Description

c. Performance Analysis

d. Inspection and Testing

Identification of symbols used on Flow Diagrams is given on Figures 1.1-1 and 1.1-2.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-1

1.2 PRINCIPAL DESIGN CRITERIA

The Prairie Island Nuclear Generating Plant was designed and constructed to comply with NSP's understanding of the intent of the proposed AEC General Design Criteria for Nuclear Power Plant Construction Permits (Appendix A to 10CFR50), as published in the Federal Register on July 11, 1967 (Reference 1). Since the construction of the plant was significantly completed prior to the issuance of the February 20, 1971, 10CFR50, Appendix A General Design Criteria, the plant was not reanalyzed and the FSAR was not revised to reflect these later criteria. However, the AEC Safety Evaluation Report acknowledged that the AEC staff assessed the plant, as described in the FSAR, against the Appendix A design criteria and ... are satisfied that the plant design generally conforms to the intent of these criteria. (Reference 5, Section 3.1.)

Section 1.2 of the USAR presents a brief description of related plant features which are provided to meet the design objectives reflected in groups of the proposed general design criteria. Section 1.5 of the USAR presents a brief description of related plant features which are provided to meet the design objectives reflected in each of the 70 proposed (July 1967) general design criteria. The description of plant structures, systems and components is more fully developed in succeeding sections of the USAR, as indicated by references in Sections 1.2, 1.3, and 1.5. The succeeding sections state the licensees understanding of the intent of the criteria and describe how the plant design complies with those requirements. As originally presented in the FSAR, the licensees understanding of the intent of the criteria are in the form of re-stated GDCs that differ in wording and content from the AECs proposed 1967 GDC. The re-stated GDCs match, in general, those provided in a document transmitted October 2, 1967 by the Atomic Industrial Forum entitled Comments of Forum Committee on Reactor Safety on AECs Proposed Construction Permit Criteria. (Reference 6)

For those structures, systems and components that have been added to the plant or other licensing commitments made, the appropriate vintage general design criteria has been identified in the applicable section of the USAR.

In Section 1.5, those criteria which were originally designated in parentheses as Category A required that more definitive information be provided to the AEC at the construction permit stage. All other criteria were designated as Category B. However, these categories are no longer applicable and are not included.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-2

1.2.1 Overall Plant Requirements (GDC 1 - GDC 5)

1. Quality Standards

2. Performance Standards

3. Fire Protection

4. Sharing of Systems

5. Records Requirements

All systems and components of the facility are classified according to their importance.

Those items vital to safe shutdown whose failure might cause or increase the severity of an accident or result in an uncontrolled release of substantial amount of radioactivity are designated Design Class I.

Design Class I systems and components are essential to the protection of the health and safety of the public. Quality standards of material selection, design, fabrication and inspection conform to the applicable provisions of recognized codes, and good nuclear practice.

All systems and components designated Design Class I are designed so that there is no loss of function in the event of the Design Basis Earthquake acting in the horizontal (0.12g) and vertical (0.08g) directions simultaneously. In addition, Design Class I structures and equipment are designed to withstand all environmental factors including tornadoes. The working stress for both Design Class I and Design Class II items are kept within code allowable values for the operating basis earthquake. Similarly, measures are taken in the plant design to protect against high winds, flooding, and other natural phenomena.

Fire prevention in all areas of the nuclear unit is provided by structure and component design which maximizes the use of fire-resistant materials, optimizes the containment of combustible materials and maintains exposed combustible materials below their ignition temperature in the design atmosphere. Fixed or portable fire fighting equipment is provided with capacities proportional to the energy that might credibly be released by fire.

The Fire Protection System provided has the design capability to extinguish any fire which might occur at the plant.

Those systems of components which are shared, between the two units or functionally within a single unit, are designed in such a manner that plant safety is not impaired by the sharing.

A complete set of as-built facility plant and system diagrams, including arrangement plans and structural plans, and records of initial tests and operation are maintained throughout the life of the plant. A set of all the quality assurance data generated during fabrication and erection of the essential components of the plant, as defined by the quality assurance program, is retained.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-3

Reference sections:

Section Title Section

Methodology, Hydrology & Seismology 2.3, 2.4, 2.6 Reactor Coolant System 4.1 Containment System 5.1 Engineered Safety Features 6.1 Plant Instrumentation and Control Systems 7.1 Fire Prevention Design 7.8.4 Plant Electrical Systems 8.1 Plant Fire Protection Program 10.3.1 Plant Principal Structures and Equipment 12.2 Section Title Section

Initial Tests and Operation 13.4.1, Appendix J Quality Assurance Design & Construction (FSAR) Appendix C Operation (USAR) 13.4.5, Appendix C

1.2.2 Protection by Multiple Fission Product Barriers (GDC 6-GDC 10)

1. Reactor Core Design

2. Suppression of Power Oscillations

3. Overall Power Coefficient

3. Reactor Coolant Pressure Boundary

5. Containment

The reactor core, with its related control and protection system, is designed to function throughout its design lifetime without exceeding acceptable fuel damage limits. The core design, together with reliable process and decay heat removal systems, provides for this capability under all expected conditions of normal operation with appropriate margins for uncertainties and anticipated transient situations.

Each Reactor Control and Protection System is designed to actuate a reactor trip for any anticipated combination of plant conditions, when necessary, to ensure a minimum Departure from Nucleate Boiling (DNB) ratio equal to or greater than the applicable limit.

The design of the reactor core and related protection systems ensures that power oscillations which could cause fuel damage in excess of acceptable limits are not possible or can be readily suppressed.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-4

The potential for possible spatial oscillation of core power distribution has been reviewed. It is concluded that tolerable low frequency xenon oscillations may occur in the axial dimension. Control systems (control rods and boron) are available to suppress these oscillations. The core is stable to xenon oscillations in the X-Y dimension.

Out-of-core instrumentation is provided to obtain necessary information concerning power distribution. This instrumentation is adequate to enable the operator to monitor and control xenon induced oscillations.

The Reactor Coolant System in conjunction with its control and protective provisions is designed to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated system interactions, and maintain the stresses within applicable code stress limits.

The materials of construction of the pressure boundary of the Reactor Coolant System are protected, by control of coolant chemistry, from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetime.

System conditions resulting from anticipated transients or malfunctions are monitored, and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions to a safe level.

The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASME Boiler and Pressure Vessel Code.

Isolable sections of the system containing components designed in conformance with Section III of the ASME Boiler and Pressure Vessel Code are provided with overpressure relieving devices discharging to closed systems, such that the system code allowable relief pressure within the protected section is not exceeded.

The containment design pressure and temperature exceeds the peak pressure and temperature occurring as the result of the complete blowdown of the reactor coolant through any pipe rupture of the Reactor Coolant System up to and including the hypothetical severance of a reactor coolant pipe.

The penetration for the main steam, feedwater, blowdown and sample lines are designed so that the penetration is stronger than the piping system and the containment will not be breached due to a hypothesized pipe rupture. All lines connected to the Reactor Coolant System that penetrate the containment are also anchored in the loop compartment shield walls and are each provided with at least one valve between the anchor and the coolant system. These anchors are designed to withstand the thrust moment and torque resulting from a hypothesized rupture of the attached pipe or the loads induced by the Design Basis Earthquake.

All isolation valves are supported to withstand, without impairment of valve operability, the loading of the design basis accident coincident with the Design Basis Earthquake.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-5

Reference section:

Section Title Section

Reactor 3.1, 3.2 Reactor Coolant System 4 Containment System 5 Plant Protection Systems 7.4 Safety Analysis 14

1.2.3 Nuclear and Radiation Controls (GDC 11 - GDC 18)

1. Control Room

2. Instrumentation and Control System

3. Fission Process Monitors and Controls

4. Core Protection Systems

5. Engineered Safety Features Protection Systems

6. Monitoring Reactor Coolant Pressure Boundary

7. Monitoring Radioactivity Releases

8. Monitoring Fuel and Waste Storage

The plant is equipped with a control room which contains the controls and instrumentation necessary for operation of both reactors and turbine generators under normal and accident conditions.

Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subjected to doses under postulated accident conditions during occupancy of, ingress to and egress from the control room which, in the aggregate, would exceed 5 Rem TEDE for the duration of the accident.

For each unit, instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain neutron flux, reactor coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.

Other instrumentation and control systems are provided to monitor and maintain within prescribed operating ranges the temperatures, pressures, flows, and levels in the Reactor Coolant Systems, Steam Systems, Containments and other Auxiliary Systems.

The quantity and types of instrumentation provided are adequate for safe and orderly operation of all systems and processes over the full operating range of the plant.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-6

The operational status of each reactor is monitored from the control room. When the reactor is subcritical the neutron source multiplication is continuously monitored and indicated by proportional counters located in instrument wells in the primary shield adjacent to the reactor vessel. The source range detector channels can be checked prior to operations in which criticality may be approached. Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate, is slow enough to give ample time to start corrective action (boron dilution stop and/or emergency boron injection) to prevent the core from becoming critical.

Means for showing the relative reactivity status of each reactor is provided by control bank positions displayed in the control room. Periodic samples of coolant boron concentration can be taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion.

Instrumentation and controls provided for the protection systems are designed to trip the reactors when necessary to prevent or limit fission product release from the cores and to limit energy release; to signal containment isolation; and to control the operation of engineered safety features equipment.

During reactor operation in the startup and power modes, redundant safety limit signals will automatically actuate two reactor trip breakers which are in series with the rod drive mechanism coils. This action would interrupt rod drive power and initiate reactor trip.

If the reactor protection system receives signals which are indicative of an approach to an unsafe operating condition, the system actuates alarms, prevents control rod motion, initiates load cutback, and/or opens the reactor trip breakers.

The basic reactor tripping philosophy is to define an allowable region of power and coolant temperature conditions. This allowable range is defined by the primary tripping functions, the overpower T trip, overtemperature T trip, and the nuclear power range high flux trip. The operating region below these trip settings is designed so that no combination of power, temperatures and pressure could result in DNBR less than the applicable limit. Additional tripping functions such as power range high positive and negative neutron flux rate, power range neutron flux (low setpoint), intermediate range high neutron flux, source range high neutron flux, pressurizer high pressure, pressurizer low pressure, pressurizer high level, RCP breaker open, RCP bus undervoltage, RCP bus underfrequency, steam generator low-low level, safety injection initiation, turbine trip and manual trip are provided to backup the primary tripping functions for specific accident conditions and mechanical failures.

Rod stops from nuclear intermediate and power range high flux, overpower T and overtemperature T deviation are provided to prevent abnormal power conditions which could result from excessive control rod withdrawal initiated by a malfunction of the reactor control system or by operator violation of administrative procedures.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-7

Positive indication in the control room of leakage of coolant from the Reactor Coolant System to the containment is provided by equipment which permits continuous monitoring of the containment air activity and humidity, and is provided by the runoff from the condensate collecting pans under the cooling coils of the containment air cooling (fan coil) units. The basic design criterion is the detection of deviations from normal containment environmental conditions including air particulate activity, radiogas activity, humidity, condensate runoff and in addition, in the case of gross leakage, the liquid inventory in the process systems and containment sump.

The containment atmosphere, the plant vents, the containment cooling water discharges, the condenser air ejectors, the steam generator blowdown effluents, and the Waste Disposal System liquid effluent are monitored for radioactivity concentration during all normal operations, anticipated transients and accident conditions.

For the case of leakage from the reactor containment under accident conditions the plant area radiation monitoring system supplemented by portable survey equipment provides adequate monitoring of releases during an accident.

Monitoring and alarm instrumentation are provided for fuel and waste storage and handling areas to detect excessive radiation levels. Monitoring and alarms are also provided to detect inadequate cooling of spent fuel. Radiation monitors are provided to maintain surveillance over the release of radioactive gases and liquids.

Controlled ventilation systems remove airborne radioactivity from the atmosphere of the fuel storage and waste treatment areas of the auxiliary building and discharge it through filters to the atmosphere via the vents. Radiation monitors are in continuous service in these areas to actuate high-activity alarms on the control board annunciator.

Reference sections:

Section Title Section

Engineered Safety Features 6 Plant Instrumentation and Control Systems 7 Shielding and Radiation Protection 12.3

1.2.4 Reliability and Testability of Protection Systems (GDC 19-GDC 26)

1. Protection System Reliability

2. Protection Systems Redundancy and Independence

3. Single Failure Definition

4. Separation of Protection and Control Instrumentation Systems

5. Protection Against Multiple Disability for Protection Systems

6. Emergency Power for Protection Systems

7. Demonstration of Functional Operability of Protection Systems

8. Protection Systems Fail-safe Design

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-8

Upon a loss of power to the coils, the rod cluster control (RCC) assemblies are released and fall by gravity into the core. The reactor internals, fuel assemblies, RCC assemblies and drive system components are designed as Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube. Furthermore, the RCC assemblies are never fully withdrawn from their guide thimbles in the fuel assembly while in the core. As a result of these design safeguards and the flexibility designed into the RCC assemblies, abnormal loadings and misalignments can be sustained without impairing operation of the RCC assemblies.

Protection channels are designed with sufficient redundancy for individual channel calibration and testing to be made during operation without degrading the reactor protection system. Bypass removal of one trip circuit is accomplished by placing that channel in a partial-tripped mode, i.e., a two-out-of-three channel becomes a one-out-of-two channel. Testing does not cause a trip unless a trip condition exists in a concurrent channel. The trip signal furnished by the remaining channels would be unimpaired in this event.

In the Reactor Protection System two reactor trip breakers are provided to interrupt power to the RCCA drive mechanisms. The breaker main contacts are connected in series (with the power supply) so that opening either breaker interrupts power to all RCC assemblies permitting them to fall by gravity into the core. Each breaker is opened through an undervoltage trip coil. Each protection channel actuates two separate trip logic trains, one for each reactor trip breaker undervoltage trip coil. The protection system is thus inherently safe in the event of a loss of rod control power.

Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions when combined are combined only at the sensor. A failure in the control circuit does not affect the protection channel.

The power supplied to the channels is fed from four instrument buses for each unit.

Each of the buses is normally powered through an inverter by a 480v safeguards bus, which can be connected to one of the plants emergency generators. In the event of the loss of its associated 480v safeguards bus, each of the instrument buses is powered by the respective train 125 VDC safeguards battery.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-9

The initiation of the engineered safety features provided for loss-of-coolant accidents, e.g., high head safety injection and residual heat removal pumps, and containment spray systems, is accomplished from redundant signals derived from Reactor Coolant System and containment pressure instrumentation. The initiation signal for containment spray comes from coincidence of three sets of one-out-of-two high-high containment pressure signals. On loss of voltage of a safety features equipment bus, the diesel generator will be automatically started and connected to the bus provided no other source of power is available to the bus. The signals for initiation of safety injection are main steam line low pressure, pressurizer low pressure, containment high pressure and manual from the control room. A safety injection initiation will then cause a reactor trip, isolate main feedwater, start the diesel generators, start the auxiliary feedwater pumps, safety injection pumps, containment fan coil units and safeguards cooling water pumps, initiate containment isolation, containment ventilation isolation and control room ventilation isolation. The main steam isolation valves on both loops will be closed by a high-high containment pressure signal. The main steam isolation valve will be closed by a high-high steam flow in that loop coincident with a safety injection signal or high steam flow coincident with low-low T-average and a safety injection signal.

The components of the protection system are designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.

Each protection channel in service at power is capable of being calibrated and tripped independently by simulated signals to verify its operation without tripping the plant.

Each reactor trip circuit is designed so that trip occurs when the circuit is de-energized; an open circuit or loss of channel power therefore, causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from independent instrument panels. In addition, the reactor protection system will energize the normally de-energized shunt trip device, which in turn trips the reactor trip breaker.

Redundancy in emergency power is provided in that there are two diesel-generator sets dedicated to each unit, and capable of supplying separate 4160 volt buses. One complete set of safety features equipment for the associated unit is therefore independently supplied from each diesel generator.

Diesel engine cranking is accomplished by a stored energy system supplied solely for the associated diesel-generator. The undervoltage relay scheme is designed so that loss of power does not prevent the relay scheme from functioning properly.

The ability of the diesel-generator sets to start within the prescribed time and to carry load is checked during the integrated SI test. The diesel-generator breaker is closed automatically after starting during this testing. The generator may also be manually synchronized to the 4160 volt bus for loading.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-10

Reference section:

Section Title Section

Plant Protection System 7.4 Plant Electrical Systems 8

1.2.5 Reactivity Control (GDC 27 - GDC 32)

1. Redundancy of Reactivity Control

2. Reactivity Hot Shutdown Capability

3. Reactivity Shutdown Capability

4. Reactivity Holddown Capability

5. Reactivity Control Systems Malfunction

6. Maximum Reactivity Worth of Control Rods

In addition to the reactivity control achieved by the RCC assemblies as detailed in Section 7, reactivity control is provided by the Chemical and Volume Control System which regulates the concentration of boric acid solution neutron absorber in the Reactor Coolant System. The system is designed to prevent uncontrolled or inadvertent reactivity changes which might cause system parameters to exceed design limits.

The reactivity control systems provided are capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes.

The RCC assemblies are divided into two categories comprised of control and shutdown rod groups. The control group of RCC assemblies is used to compensate for short term reactivity changes at power such as those produced due to variations in reactor power requirements or in coolant temperature. The soluble poison control is used to compensate for the more slowly occurring changes in reactivity throughout core life such as those due to fuel depletion, fission product buildup and decay, and load follow.

The shutdown groups are provided to supplement the control groups of RCC assemblies to make the reactor at least one per cent subcritical (keff = 0.99) following trip from any credible operating condition to the hot zero power condition assuming the most reactive RCC assembly remains in the fully withdrawn position.

Any time that the plant is at power, the quantity of boric acid retained in available boric acid tanks and ready for injection always exceeds that quantity required for normal cold shutdown of one unit.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-11

For each unit, boric acid is pumped from the boric acid tanks by one of the boric acid transfer pumps to the suction of the charging pumps which inject boric acid into the reactor coolant system. Each charging pump and any boric acid transfer pump can be operated from diesel generator power on loss of offsite power. Boric acid can be injected by one pump at a rate which takes the reactor to hot shutdown, with no rods inserted, in less than 80 minutes. In 80 additional minutes, enough boric acid can be injected to compensate for xenon decay although xenon decay below the equilibrium operating level does not begin immediately, but could occur up to 26 hours3.009259e-4 days <br />0.00722 hours <br />4.298942e-5 weeks <br />9.893e-6 months <br /> after shutdown, depending upon power history. If two boric acid transfer pumps and two charging pumps are available, these time periods are reduced. Additional boric acid injection is employed if it is desired to bring the reactor to cold shutdown conditions.

In the event that injection using the Charging Pumps is not available, the Safety Injection system can perform this function using borated water from the refueling water storage tank. If necessary, the RCS can be sufficiently depressurized to allow injection with the Safety Injection Pumps. Since the CVCS is normally used for responding to slower reactivity transients, crediting the Safety Injection Pumps in this event is considered acceptable.

The Reactor Protection Systems are designed to limit reactivity transients to DNBR equal to or greater than the applicable limit due to any single malfunction in the deboration controls.

The maximum reactivity worth of control rods and the maximum rates of reactivity of insertion employing both control rods and boron removal are limited to values for which acceptable transient analysis results are obtained in terms of preventing rupture of the reactor coolant pressure boundary or disruption of the core or vessel internals to a degree so as to lose capability to cool the core.

The rod cluster drive mechanisms are wired into preselected groups and are normally prevented from being withdrawn in other than their respective groups. The control and shutdown rod drive mechanisms are of the magnetic latch type and the coil actuation is programmed to provide variable speed rod travel. The insertion rate is analyzed in the detailed plant analysis. It is assumed that two of the highest worth groups are accidentally withdrawn at maximum speed. This is to insure that the reactivity insertion rates are well within the capability of the reactor protection circuits. Thus core damage is prevented.

Reference sections:

Section Title Section Reactor; Principal Design Criteria 3.1.2 Plant Protection System 7.4 Regulating Systems 7.2 Chemical and Volume Control System 10.2.3

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-12

1.2.6 Reactor Coolant Pressure Boundary (GDC 33 - GDC 36)

1. Reactor Coolant Pressure Boundary Capability

2. Reactor Coolant Pressure Boundary Rapid Propagation Failure Prevention

3. Reactor Coolant Pressure Boundary Brittle Fracture Prevention

4. Reactor Coolant Pressure Boundary Surveillance

The reactor coolant boundary is shown to be capable of accommodating without rupture, the static and dynamic loads imposed as a result of a sudden reactivity insertion such as a rod ejection.

Definition of Reactor Coolant Pressure Boundary.

Per 10 CFR 50.2, Reactor Coolant Pressure Boundary means all those pressure-containing components of pressurized water-cooled nuclear power reactors, such as pressure vessels, piping, pumps and valves, which are:

(1) Part of reactor coolant system or (2) Connected to the reactor coolant system, up to and including any and all of the following:

(i) The outermost containment isolation valve in system piping the penetrates primary reactor containment,

(ii) The second of two valves normally closed during normal reactor operation in system piping which does not penetrate primary reactor containment,

(iii) The reactor coolant system safety and relief valves.

For completeness, additional Prairie Island clarifications from Section 12.2.1.2, Design Codes, are repeated below.

(3) The reactor coolant system

(i) Portions of associated auxiliary systems connected to the reactor coolant system. For piping of these systems which penetrate primary reactor containment, the boundary extends to and includes the first containment isolation valve outside the containment capable of external actuation. For piping of these systems which contain two valves, both of which are normally closed during normal reactor operation, the boundary extends to and includes the second of these two valves (the second of which must be capable of external actuation), whether or not the system piping penetrates primary reactor containment.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-13

(ii) Portions of the emergency core cooling system connected to the reactor coolant system. For piping of these systems which penetrate primary reactor containment, the boundary extends to and includes the first containment isolation valve outside containment capable of external actuation. For piping of these systems which do not penetrate primary reactor containment, the boundary extends to and includes the second of two valves normally closed during normal reactor operation.

The operation of the reactor is such that the severity of a rod ejection accident is inherently limited. Since rod cluster control assemblies are used to control load variations only and boron dilution is used to compensate for core depletion, only the RCCA in the controlling groups are inserted in the core at power, and at full power these rods are only partially inserted. This condition can be verified by a rod insertion limit monitor.

By using the flexibility in the selection of control groupings, radial locations and position as a function of load, the design limits the maximum fuel temperature for the highest worth ejected rod to a value which precludes any resultant damage to the Reactor Coolant System pressure boundary, from possible excessive pressure surges.

The Reactor Vessel Material Surveillance Program monitors the effects of radiation on reactor vessel materials and establishes operating limits to assure that brittle fracture of the reactor vessel will not occur. The program is in accordance with ASTM-E-185 (Ref. 3).

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-14

Reference sections:

Section Title Section

Reactor Coolant System 4.1, 4.6 Vessel NDTT 4.7.2 Appendix 4A of FSAR

1.2.7 Engineered Safety Features (GDC 37 - GDC 65)

1. Engineered Safety Features Basis for Design

2. Reliability and Testability of Engineered Safety Features

3. Emergency Power for Engineered Safety Features

4. Missile Protection

5. Engineered Safety Features Performance Capability

6. Engineered Safety Features Components Capability

7. Accident Aggravation Prevention

8. Emergency Core Cooling Systems Capability

9. Inspection of Emergency Core Cooling Systems

10. Testing of Emergency Core Cooling Systems Components

11. Testing of Emergency Core Cooling Systems

12. Testing of Operational Sequence of Emergency Core Cooling Systems

13. Containment Design Basis

14. NDT Requirement for Containment Material

15. Reactor Coolant Pressure Boundary Outside Containment

16. Containment Heat Removal Systems

17. Containment Isolation Valves

18. Containment Leakage Rate Testing

19. Containment Periodic Leakage Rate Testing

20. Provisions for Testing of Penetrations

21. Provisions for Testing of Isolation Valves

22. Inspection of Containment Pressure-reducing Systems

23. Testing of Containment Pressure-reducing Systems

24. Testing of Containment Spray Systems

25. Testing of Operational Sequence of Containment Pressure-reducing Systems

26. Inspection of Air Cleanup Systems

27. Testing of Air Cleanup Systems Components

28. Testing of Air Cleanup Systems

29. Testing of Operational Sequence of Air Cleanup Systems

The design, fabrication, testing and inspection of the core, reactor coolant pressure boundary and their protection systems give assurance of safe and reliable operation under all anticipated normal, transient, and accident conditions. However, engineered safety features are provided in the facility to back up the safety provided by these components.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-15

These engineered safety features have been designed to cope with any size reactor coolant pipe break up to and including the circumferential rupture of any pipe assuming unobstructed discharge from both ends, and to cope with any steam or feedwater line break. The total loss of all offsite power is assumed concurrent with these accidents.

The primary purpose of the Safety Injection System is to automatically deliver cooling water to the reactor core in the event of a loss-of-coolant accident. This limits the fuel clad temperature and ensures that the core will remain intact and in place, with its heat transfer geometry preserved. This protection is afforded for:

a. All pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends.

b. A loss of coolant associated with the rod ejection accident.

c. A steam generator tube rupture.

The principal design criteria for loss-of-coolant accident evaluations are given in Section 14.6.

These criteria assure the core geometry is retained to such an extent that effective cooling of the core is not impaired.

For any rupture of a steam pipe and the associated uncontrolled heat removal from the core, the Emergency Core Cooling System adds shutdown reactivity so that with a stuck rod, no off-site power, and minimum engineered safety features, there is no consequential damage to the primary Reactor Coolant System and the core remains in place and intact. With no stuck rod, no-off-site power and all equipment operating at design capacity, there is insignificant cladding rupture.

The Safety Injection System consists of centrifugal safety injection pumps driven by electric motors, and passive accumulator tanks which are self energized and which act independently of any actuation signal or power source.

The release of fission products from the containment is limited in three ways:

a. Blocking the potential leakage paths from the containment. This is accomplished by:

1. A steel, leak-tight containment vessel with testable penetrations;

2. Isolation of process lines which imposes double barriers for each line penetrating the containment;

3. A shield building surrounding the containment vessel with an associated ventilation system containing particulate, absolute and charcoal filters;

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-16

4. A special zone ventilation system, collecting leakage from the auxiliary building and discharging it through particulate, absolute and charcoal filters.

b. Reducing the fission product concentration in the containment atmosphere.

This is accomplished by spraying water which removes airborne elemental iodine vapor by washing action.

c. Reducing the containment pressure and thereby limiting the driving potential for fission product leakage by cooling the containment atmosphere using the following systems:

1. Containment Spray System

2. Containment Air Cooling System A comprehensive program of plant testing is formulated for all equipment systems and system control vital to the functioning of engineered safety features. The program consists of performance tests of individual pieces of equipment in the manufacturers shop, integrated tests of the system as a whole, and periodic tests of the actuation circuitry and mechanical components to assure reliable performance upon demand, throughout the plant lifetime.

The plant is supplied with normal, standby and emergency power sources as follows:

a. The normal source of auxiliary power for safeguards equipment is the off-site power source. Power is supplied via the reserve auxiliary transformer or the cooling tower substation transformer.

b. Two emergency diesel-generators for each unit are connected to the emergency buses to supply power in the event of loss of all other a-c auxiliary power. Each of the two emergency diesel generators per unit is capable of supplying automatically the engineered safety features load required for an acceptable post-blowdown containment pressure transient for any loss-of-coolant accident, or for shutdown of the unit.

c. Emergency power supply for vital instruments and for control is supplied from the 125V DC systems.

For such engineered safety features as are required to ensure safety in the event of such an accident or equipment failure, protection from these dynamic effects or missiles is considered in the layout of plant equipment and missile barriers.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-17

Layout and structural design specifically protect injection paths leading to unbroken reactor coolant loops against damage as a result of the maximum reactor coolant pipe rupture. Injection lines penetrate the main compartment walls which act as missile barriers. The injection headers are located in the missile-protected area between the compartment walls and the containment outside wall. Individual injection lines are connected to the injection header, pass through the compartment walls and then connect to the loops. Movement of the injection line associated with rupture of a reactor coolant loop is accommodated by line flexibility and by the design of the pipe supports such that no damage outside the missile barrier is possible.

Each engineered safety feature provides sufficient performance capability to accommodate any single failure of an active component and still function in a manner to avoid undue risk to the health and safety of the public.

Under the hypothetical accident conditions, the Containment Air Cooling System and the Containment Spray System are designed to supply the post-accident cooling capacity to rapidly reduce the containment pressure following blowdown.

All active components of the Safety Injection System (with the exception of injection line isolation valves) and the Containment Spray System are located outside the containment and not subjected to containment accident conditions.

Instrumentation, motors, cables and penetrations located inside the containment are selected to meet the most adverse accident conditions to which they may be subjected.

These items are either protected from containment accident conditions or are designed to withstand, without failure, exposure to the worst combination of temperature, pressure, and humidity expected during the required operational period.

The reactor is maintained subcritical following a Reactor Coolant System pipe rupture accident. Introduction of borated cooling water into the core results in a net negative reactivity addition. The control rods insert and remain inserted.

The delivery of cold safety injection water to the reactor vessel following accidental expulsion of reactor coolant has been analyzed. The results indicate that no further loss of integrity of the Reactor Coolant System boundary occurs as explained in Section 4.1.

Design provisions are made to facilitate access to the critical parts of the reactor vessel internals, injection nozzles, pipes, valves and safety injection pumps for visual or boroscopic inspection for erosion, corrosion and vibration wear evidence, and for non-destructive inspection where such techniques are desirable and appropriate.

The design provides for periodic testing of active components of the Safety Injection System for operability and functional performance. The safety injection and residual heat removal pumps are tested periodically during plant operation using the minimum flow recirculation lines provided.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-18

An integrated system test can be performed during reactor refueling shutdown when the residual heat removal loop is in service. This test would not introduce flow into the Reactor Coolant System but would demonstrate the operation of the valves, pump circuit breakers, and automatic circuitry upon initiation of safety injection. Refer to Technical Specifications and the Surveillance Frequency Control Program for current Surveillance Requirements.

The design provides for continuously monitoring the accumulator tank pressure and level during plant operation.

The accumulators and the safety injection piping up to the final isolation valve are maintained full of borated water while the plant is in operation. Flow in each of the high head injection header lines and in the main flow line for the residual heat removal pumps is monitored by a flow indicator.

The design provides for capability to test initially, to the extent practical, the full operational sequence up to the design conditions for the Safety Injection System to demonstrate the state of readiness and capability of the system.

These functional tests provide information to confirm valve operating times, pump motor starting times, the proper automatic sequencing of load addition to the diesel-generators, and delivery rates of injection water to the Reactor Coolant System.

The following general criteria are followed to assure conservatism in computing the required containment structural load capacity:

a. In calculating the containment pressure, rupture sizes up to and including a double-ended severance of reactor coolant pipe are considered.

b. In considering post-accident pressure effects, various malfunctions of the emergency systems are evaluated. Contingent mechanical or electrical failures are assumed to disable one of the diesel generators, such that only two of the four fan-coil units and one of the two containment spray pumps operate.

c. The pressure and temperature loadings obtained by analyzing various loss-of-coolant accidents, when combined with operating loads and maximum wind or seismic forces, do not exceed the load-carrying capacity of the structure, its access opening or penetrations.

Discharge of reactor coolant through a double-ended rupture of the main loop piping, followed by operation of only those engineered safety features which can run simultaneously with power from one emergency on-site diesel generator results in a sufficiently low radioactive material leakage from the containment structure that there is not undue risk to the health and safety of the public.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-19

The reinforced concrete shield building containment is not susceptible to a low temperature brittle fracture. The containment vessel is enclosed within the shield building and thus is not exposed to the temperature extremes of the environs. The containment ambient temperature during operation is between 50F and 120F which is well above the NDT temperature + 30F for the liner material. Containment penetrations which can be exposed to the environment are also designed to the NDT + 30F criterion.

Isolation valves are provided as necessary for all fluid system lines penetrating the containment to assure at least two barriers for redundancy against leakage of radioactive fluids to the environment in the event of a loss-of-coolant accident. These barriers, in the form of isolation valves or closed systems, are defined on an individual line basis. In addition to satisfying containment isolation criteria, the valving is designed to facilitate normal operation and maintenance of the systems and to ensure reliable operation of other engineered safety features.

After completion of the containment structure and installation of all penetrations, an initial integrated leakage rate test was conducted at the peak calculated accident pressure, maintained for a minimum of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, to verify that the leakage rate was well below the Technical Specification Limit.

Periodic leak rate tests are performed as required in accordance with the Appendix J leak rate testing program.

Penetrations are designed with double seals so as to permit test pressurization of the interior of the penetration. To accomplish this, a supply of clean, dry, compressed air or nitrogen is connected to the penetrations raising the internal pressure to the containment internal design pressure. Leakage from the system is checked by measurement of the pressure decay or metering of flow rate required to maintain the test pressure. In the event excessive leakage is discovered, penetration groups can then be checked separately.

Capability is provided to the extent practical for testing the functional operability of valves and associated apparatus during periods of reactor shutdown.

Initiation of containment isolation employs coincidence circuits which allow checking of the operability and calibration of one channel at a time.

The main steam and feedwater piping and isolation valves in systems which connect to the Reactor Coolant System are hydrostatically tested to detect leakage. The steam line isolation valves are tested periodically for operability.

Design provisions are made to the extent practical to facilitate access for periodic visual inspection of important components of the Containment Air Cooling and Containment Spray Systems.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-20

The containment pressure reducing systems are designed to the extent practical so that the spray pumps, spray injection valves and spray nozzles can be tested periodically and after any component maintenance for operability and functional performance.

Permanent test lines for all the containment spray loops are located so that all components up to the isolation valves at the containment may be tested. These isolation valves are checked separately.

Periodic testing is performed to verify that spray nozzles are not obstructed.

Capability is provided to test initially, to the extent practical, the operational startup sequence beginning with transfer to alternate power sources.

Reference sections:

Section Title Section

Containment System 5 Engineered Safety Features 6 Plant Electrical Systems 8

1.2.8 Fuel and Waste Storage Systems (GDC 66-GDC 69)

1. Prevention of Fuel Storage Criticality

2. Fuel and Waste Storage Decay Heat

3. Fuel and Waste Storage Radiation Shielding

4. Protection Against Radioactivity Release From Spent Fuel and Waste Storage

Borated water is used to fill the spent fuel storage pit at a concentration to maintain spent fuel pool Keff < 0.95. The fuel is stored vertically in an array with sufficient center-to-center distance between assemblies to assure Keff < 1.0 even if unborated water were used to fill the pit.

During reactor vessel head removal and while loading and unloading fuel from the reactor, the boron concentration is maintained at a level sufficient to prevent a loss of shutdown margin due to inadvertent dilution.

The design of the fuel handling equipment incorporates built-in interlocks and safety features.

The refueling water provides a reliable and adequate cooling medium for spent fuel transfer. Heat removal is accomplished with an auxiliary cooling system.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-21

Adequate shielding for radiation protection is provided during reactor refueling by conducting all spent fuel transfer and storage operations under water. This permits visual control of the operation at all times while maintaining radiation levels less than 2.5 mrem/hr at or near the water surface. Pit water level is indicated, and water to be removed from the pit must be pumped out as there are no gravity drains. Shielding is provided for waste handling and storage facilities to permit operation within requirements of 10CFR20.

Gamma radiation is continuously monitored at various locations in the Auxiliary Building.

A high level signal is alarmed locally and is annunciated in the control room.

Auxiliary shielding for the Waste Disposal System and its storage components is designed to limit the dose rate to levels not exceeding 1 mrem/hr in normally occupied areas, to levels not exceeding 2.5 mrem/hr in intermittently occupied areas and to levels not exceeding 15 mrem/hr in controlled occupancy areas.

All waste handling and storage facilities are contained and equipment designed so that accidental releases directly to the atmosphere are monitored and will not exceed the guidelines of 10CFR100.

The reactor cavity, refueling canal and spent fuel storage pit are reinforced concrete structures with seam-welded stainless steel plate liners. These structures are designed to withstand the anticipated earthquake loadings as Design Class I structures so that the liner will prevent leakage.

Reference sections:

Section Title Section

Fuel Storage and Fuel Handling Systems 10.2.1 Plant Radioactive Waste Control Systems 9 Shielding and Radiation Protection 12.3 Standby Safety Features Analysis 14.5 1.2.9 Plant Effluents (GDC 70)

1. Control of Releases of Radioactivity to the Environment

Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and off-site shipments are in accordance with applicable governmental regulations.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.2-22

Radioactive fluids entering the Waste Disposal System are collected in sumps and tanks until determination of subsequent treatment can be made. They are sampled and analyzed to determine the quantity of radioactivity, with an isotopic identification if necessary. Before discharge, radioactive fluids are processed as required and then released under controlled conditions. The system design and operation are characteristically directed toward minimizing releases to unrestricted areas in accordance with Appendix I to 10CFR Part 50. Discharge streams are appropriately monitored and safety features are incorporated to preclude release rates in excess of the limits of 10CFR20.

Radioactive gases are transferred to an augmented gaseous radwaste system. The gases are segregated, recombined, and then pumped by compressors through a manifold to one of the gas decay tanks where they are held a suitable period of time for decay. Cover gases in the nitrogen blanketing system are re-used to minimize gaseous wastes. During normal operation, gases are discharged intermittently at a controlled rate from these tanks through the monitored plant vent.

Liquid wastes are processed to remove radioactive materials. Filter cartridges, the spent resins from the demineralizers, and the concentrates from the evaporators are packaged and stored on-site until shipment off-site for disposal. Miscellaneous solid wastes, such as paper, rags and glassware, are compressed for storage, disposal or further processing.

Reference section:

Section Title Section

Plant Radioactive Waste Control Systems 9

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-1

1.3

SUMMARY

DESIGN DESCRIPTION AND SAFETY ANALYSIS

The inherent design of the pressurized water, closed-cycle reactor significantly reduces the quantities of fission products which are released to the atmosphere. Four barriers exist between fission product accumulation and the environment. These are the uranium dioxide fuel matrix, the fuel cladding, the reactor vessel and coolant loops, and the reactor containment. The consequences of a breach of the fuel cladding are greatly reduced by the ability of the uranium dioxide lattice to retain fission products. Escape of fission products through fuel cladding defects would be contained within the pressure vessel, loops and auxiliary systems. Breach of these systems or equipment would release the fission products to the reactor containment where they would be retained.

The reactor containment is designed to adequately retain these fission products under the most severe accident conditions, as analyzed in Section 14.

Several engineered safety features have been incorporated into the plant design to reduce the consequences of a loss of coolant accident. These safety features include a Safety Injection System. This system automatically delivers borated water to the reactor vessel for cooling the core under high and low reactor coolant pressure conditions. The Safety Injection System also serves to insert negative reactivity into the core in the form of borated water during an uncontrolled plant cooldown following a steam line break or an accidental steam release. Other safety features which have been included in the reactor containment design are a Containment Air Cooling System which acts to effect a depressurization of the containment following a loss of coolant accident, and a Containment Spray System which acts to depressurize the containment and remove elemental iodine from the atmosphere by washing action.

1.3.1 Plant Site and Environs

Section 2 of this report provides detailed information on the site and environs of the Prairie Island Nuclear Generating Plant Units 1 and 2 which confirms the suitability of the site. This section summarizes the principal design characteristics of the site and environs.

The plant site is located in southeastern Minnesota on the west bank of the Mississippi River about 26 miles SE of the Twin City Metropolitan Area. The nearest population center is Eagen, Minnesota. Cooling water is drawn from the Mississippi River.

Farming is the predominant activity in this moderately-populated area of the state. The plant is situated in a productive dairy farming and vegetable canning region; however, there is heavy industrialization to the northwest in the Twin Cities and to the south in Red Wing.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-2

The sub-surface soils at the site consist of permeable sandy alluvium which are generally suitable from a bearing capacity standpoint for support of the structures.

However, settlement restrictions and a low margin of safety against liquefaction of the upper 50 feet (above elevation 645) of alluvium required that certain critical structures be supported on densified sand. Several hundred feet of sound sandstone underlie the alluvial soils.

River flows vary widely through the year. Generally, maximum flows occur in the spring and minimum flows occur in late summer (July, August, September) or mid-winter (January, February). The low flow of record is 2100 cfs (1936) and the average flow is 15,020 cfs. The plant design, construction and operation, including the radioactive waste control system, take into consideration the extremes of river flow and stage. The cooling towers are operated in accordance with the NPDES permit.

The finished plant grade (695 feet MSL) is about 20 feet above mean river level (674.5 feet MSL), 7 feet above the record (687.7 feet MSL-1965), and 1 ft above the predicted 1,000 year flood (693.5 feet MSL). The plant is designed to withstand the effects of the probable maximum flood (703.6 feet MSL)

The meteorology of the site area is basically that of a continental location with favorable atmospheric dilution conditions prevailing. Diffusion climatology comparisons with other locations indicate that the site is typical of midwestern United States. All structures are designed to withstand the maximum potential loadings resulting from a wind speed of 100 mph. The design is in accordance with standard codes and normal engineering practices. It is estimated that the probability of experiencing tornadic forces at the site is of the order of one chance per 220 years. In spite of this low probability, features of the plant important to the integrity of reactor core cooling are designed to withstand the forces of short-term tornadoes.

There is no evidence of even ancient inactive faulting closer than six miles to the site.

Inactive faults are located approximately 6 and 13 miles from the site. No activity has occurred along either of these faults in recent geologic times. The seismic design for critical structures and equipment for this plant is based on dynamic analyses of acceleration or velocity-response spectrum curves, based on a horizontal ground acceleration of 0.06g. Earthquake design is based on ordinary allowable stresses as set forth in the applicable codes. As an additional requirement, the design is such that a safe shutdown can be made during a horizontal ground acceleration of 0.12g. Seismic design criteria and the safety classification of important components are described in Section 12.

An environmental radiation monitoring program was initiated in May 1970.

Measurements are made of the radioactivity present in air, surface and well water, raw milk, vegetation, fish and other selected specimens. An ecological study of the Mississippi River in the areas of the plant was also begun in May 1970. Meteorological and water quality data has been gathered since May 1968.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-3

1.3.2 Structures

The major structures are the containment vessels, the shield buildings, the turbine building, the auxiliary building, D5/D6 diesel generator building, administration and service buildings, intake structures, and radwaste building. General equipment and plant layouts appear in Figures 1.1-3 through 1.1-18 and 2.2-1. All structures housing the reactors, their essential auxiliaries, and engineered safeguards systems are designed and rigorously analyzed to meet the most severe environmental conditions.

These conditions and the applicable structural design criteria are described in Section 12.

Each reactor containment consists of a cylindrical steel shell with a hemispherical dome and ellipsoidal bottom designed to withstand the internal pressure accompanying a loss-of-coolant accident. Each containment vessel is surrounded by a cylindrical shield building constructed of reinforced concrete which serves as a radiation shielding for normal operation and for the loss-of-coolant condition. In addition, the shield building acts as a secondary containment structure for control of containment leakage.

The auxiliary building housing the essential auxiliaries, control room and spent fuel storage facilities for both units is located adjacent to the reactor buildings. The turbine building housing the turbine-generators and technical support center for both units is located adjacent to the auxiliary building. The D5/D6 diesel generator building housing the Unit 2 emergency diesel generators and electrical safeguards buses is located adjacent to the auxiliary and turbine buildings. The administration and service buildings housing general offices and computer facilities is located adjacent to the turbine building. The radwaste building, resin disposal building, and drum storage enclosure which house the radioactive waste handling, treatment, storage and disposal facilities for both units are all located adjacent to the auxiliary building.

The plant screenhouse houses the cooling water pumps, fire pumps, circulating water pumps, trash racks and traveling screens. The intake screenhouse contains trash racks and traveling screens.

1.3.3 Nuclear Steam Supply System

The Nuclear Steam Supply System for each unit consists of a pressurized water reactor, Reactor Coolant System, and associated auxiliary fluid systems. The Reactor Coolant System is arranged as two closed reactor coolant loops connected in parallel to the reactor vessel, each containing a reactor coolant pump and a steam generator. An electrically heated pressurizer is connected to one of the loops.

The reactor core is composed of uranium dioxide pellets enclosed in ZIRLO/Zircaloy tubes with welded end plugs. The tubes are supported in assemblies by a spring clip grid structure. The mechanical control rods consist of clusters of stainless steel clad absorber rods and ZIRLO/Zircaloy guide tubes located within the fuel assembly.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-4

The steam generators are vertical U-tube units utilizing Alloy 690 tubes. Integral separating equipment reduces the moisture content of the steam at the steam outlet nozzle to less than 0.1% for the limiting analyzed condition of 10% steam generator tube plugging.

The reactor coolant pumps are vertical, single stage, centrifugal pumps equipped with controlled leakage shaft seals.

Auxiliary systems are provided to charge the Reactor Coolant System and to add makeup water, purify reactor coolant water, provide chemicals for corrosion inhibition and reactor control, cool system components, remove residual heat when the reactor is shutdown, cool the spent fuel storage pool, sample reactor coolant water, provide for emergency safety injection, and vent and drain the Reactor Coolant System.

1.3.4 Reactor and Plant Control

The reactor is controlled by a coordinated combination of chemical shim and mechanical control rods. The control system allows the plant to accept step load changes of 10% and ramp load changes of 5% per minute as described in sections 4 and 7. It is also designed to sustain reactor operation following a step nominal full load rejection up to 40.0% power.

Complete supervision of both the reactor and turbine generator is accomplished from the control room. Units 1 and 2 share the control room located in the auxiliary building.

The control room layout including location of control boards for each unit is shown in Figure 7.8-1.

Annunciators for alarms on the two units are on different control boards and have different audible tones which make them distinguishable.

The waste disposal control board is located in the Auxiliary Building. This board permits the control and monitoring of the processing of wastes from a central location in the same general area where equipment is located.

1.3.5 Waste Disposal System

The Waste Disposal System, common to both units, provides all equipment necessary to collect, process, and prepare for disposal all potentially radioactive liquid, gaseous, and solid wastes produced as a result of reactor operation.

Liquid wastes are collected and processed as required. The waste evaporator condensate is sampled to determine residual activity and monitored during discharge to the river via the condenser circulating water discharge to assure concentrations as low as practicable below 10CFR20 limits. The evaporator residues are solidified, drummed and shipped from the site for ultimate disposal in an authorized location.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-5

Gaseous wastes are collected and stored until their radioactivity level is low enough so that discharge to the environment will be as low as practicable below 10CFR20 limits.

1.3.6 Fuel Handling System Each reactor is refueled with equipment designed to handle spent fuel under water from the time it leaves either reactor vessel until it is placed in a cask for shipment from the site. Underwater transfer of spent fuel provides an optically transparent radiation shield, as well as a reliable source of coolant for removal of decay heat. This system also provides capability for receiving, handling and storage of new fuel. Both the new fuel storage facility and the spent fuel storage facility are shared by the two units.

1.3.7 Turbine and Auxiliaries

The turbine is a three-element, tandem-compound, four-flow exhaust, 1800 rpm unit that has moisture separation and reheating between the HP and LP elements.

Multi-pressure radial flow surface condensers with deaerating hotwells, steam-jet air ejector, three 50% capacity condensate pumps, two 50% capacity motor-driven feedwater pumps, and five stages of feedwater heaters are provided. One steam-driven auxiliary feedwater pump per unit and one motor-driven auxiliary feedwater pump per unit are available to remove residual heat in case of a complete loss of off-site power.

1.3.8 Electrical System

The main generator is an 1,800 rpm, 3 phase, 60 cycle, hydrogen innercooled unit.

One three phase main step-up transformer on each unit delivers power to the 345 KV switchyard.

The Station Service System consists of auxiliary transformers, 4160 V. switchgear, 480 V. motor control centers, and 125 V. d-c and 120 V. a-c equipment.

Emergency power, supplied by alternate sources including two emergency diesel generators for each unit, is capable of operating post-accident containment cooling equipment as well as both high head and low head safety injection pumps to ensure an acceptable post-loss-of-coolant containment pressure transient. Sufficient power capacity is provided to safely shut down the second (non-accident) unit with its emergency diesel generators at the same time adequate power is provided to the engineered safety features of the unit having the accident.

1.3.9 Engineered Safety Features

The Engineered Safety Features provided for this plant have redundancy of component and power sources such that under the conditions of a hypothetical loss-of-coolant accident as well as all other accidents analyzed in Section 14, the system does, including the effects of a single failure, maintain the integrity of the containment and keep the exposure of the public below the criteria in 10CFR50.67.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-6

The systems provided are summarized below:

a. The Containment System structure, together with the Containment Isolation, provides a highly reliable, essentially leak-tight barrier against the escape of fission products to the environment.

b. The Safety Injection System provides borated water to cool the core by injection into the core outlet plenum and cold legs of the reactor coolant loops.

c. The Containment Air Cooling System provides a dynamic heat sink to cool the containment atmosphere. The system utilizes the normal containment ventilation and cooling equipment.

d. Each Containment Spray System provides a spray of cool water to the containment atmosphere to work in parallel with the Containment Air Cooling System during the injection phase of LOCA mitigation. In addition to heat removal, the spray system is also effective in scrubbing fission products from the containment atmosphere.

e. The Auxiliary Feedwater System provides high-pressure feedwater to the steam generators in order to maintain water inventory for removal of heat energy from the Reactor Coolant System in the event the main feedwater system is not available. Redundant water supplies and power sources are provided to motor and steam operated pumps.

f. The following redundant ventilation systems are provided to assist in handling activity releases in important areas of the plant:

1. The Auxiliary Building Special (Category 1 Ventilation Zone) Ventilation System is designed to process high airborne-activities in important areas of the auxiliary building. Air from this ventilation system is passed through particulate, absolute and charcoal filters before release to the environment;

2. The Shield Building Special Ventilation System provides pressure control in the annulus between the Containment Vessel and the Shield Building, and recirculation of annulus air through particulate, absolute and charcoal filters during accident conditions;

3. The Control Room Air Ventilation System processes control room air through particulate, absolute and charcoal filters during conditions of high airborne activity in the environs of the control room.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-7

g. Two quick-start diesel generators are provided for each unit to supply adequate power for plant safety in the event of loss of station and off-site a-c power. Each generator has adequate capacity to supply the engineered safety features for the design basis accident in one unit, or to allow the unit to be placed in a safe shutdown condition in the event of loss of outside electrical power.

h. The Safeguards 125 VDC Electrical Power System for each unit consists of two independent and redundant safety related DC electrical power Subsystems (Train A and Train B). Each subsystem consists of one 125 VDC battery, battery charger, and associated distribution equipment.

i. The Component Cooling System is provided to remove heat from major components in the Nuclear Steam Supply System under normal conditions and from all components associated with the removal of reactor core decay heat under accident conditions.

j. The Cooling Water System provides a water supply for normal plant equipment heat loads, and to safeguards equipment during normal and emergency operating conditions.

1.3.10 Shared Facilities and Equipment

Separate and similar systems and equipment are provided for each unit except for those systems listed in Tables 1.3-1, 1.3-2 and 1.3-3. A functional evaluation of the components of the systems which are required for normal plant operation and are shared by the two units is provided in Table 1.3-2 and for engineered safeguard related systems in the appropriate section as referenced in Table 1.3-1. Table 1.3-3 is a functional evaluation of those shared components not required for normal plant operation.

Those structures and buildings which are shared by the two units are listed below. The related equipment and floorplan layouts are given in Figures 1.1-3 through 1.1-18 and 2.2-1. A discussion of control room sharing is contained in Section 7.

Auxiliary Building Radwaste Building Resin Disposal Building Low Level Radwaste Storage Enclosure Turbine Building Administration and Service Buildings Control Room Spent Fuel Pool and Enclosure Plant Screenhouse and Intake Screenhouse External Circulating Water Structures

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.3-8

THIS PAGE IS LEFT INTENTIONALLY BLANK

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.4-1

1.4 IDENTIFICATION OF LICENSEE AND CONTRACTORS

1.4.1 Licensee

By license amendment, dated September 22, 2008, the NRC made NSPM the licensee authorized to use and operate Prairie Island Nuclear Generating Plant Units 1 and 2.

1.4.2 Contractors

Westinghouse Electric Corporation of Pittsburgh was originally engaged to design, fabricate and deliver the nuclear steam supply system and the turbine generator.

Pioneer Service & Engineering Company of Chicago was engaged as architect-engineer.

John A. Blume & Associates of San Francisco was engaged to serve as special consultants for analysis of structural equipment and piping under seismic effects.

NUS Corporation of Washington, D.C. was engaged as the principal consultant for meteorological studies. NUS also served as a nuclear consultant during the design, construction and start-up of the plant.

Dames & Moore of Chicago was engaged to perform the hydrologic, geologic, seismic and foundation studies.

Framatome-ANP designed and supplied the Unit 1 Steam Generators.

AREVA-NP designed and supplied the Unit 2 Steam Generators.

Mitsubishi Hitachi designed and supplied the replacement electric generator for Unit 1 and Unit 2.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.4-2

THIS PAGE IS LEFT INTENTIONALLY BLANK

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-1

1.5 GENERAL DESIGN CRITERIA

The Prairie Island Nuclear Generating Plant was designed and constructed to comply with NSPs understanding of the intent of the AEC General Design Criteria for Nuclear Power Plant Construction Permits, as proposed on July 10, 1967 (Reference 1). Since the construction of the plant was significantly completed prior to the issuance of the February 20, 1971, Appendix A General Design Criteria, the plant was not reanalyzed and the FSAR was not revised to reflect these later criteria. However, the AEC Safety Evaluation Report acknowledged that the AEC staff assessed the plant, as described in the FSAR, against the Appendix A design criteria and ...are satisfied that the plant design generally conforms to the intent of these criteria. (Reference 5, Section 3.1.)

Section 1.2 of the USAR presents a brief description of related plant features which are provided to meet the design objectives reflected in groups of the proposed general design criteria. Section 1.5 of the USAR presents a brief description of related plant features which are provided to meet the design objectives reflected in each of the 70 proposed (July 1967) general design criteria. The description of plant structures, systems and components is more fully developed in succeeding sections of the USAR, as indicated by references in Sections 1.2, 1.3, and 1.5. The succeeding sections state the licensees understanding of the intent of the criteria and describe how the plant design complies with those requirements. As originally presented in the FSAR, the licensees understanding of the intent of the criteria are in the form of re-stated GDCs that differ in wording and content from the AECs proposed 1967 GDC. The re-stated GDCs match, in general, those provided in a document transmitted October 2, 1967 by the Atomic Industrial Forum entitled Comments of Forum Committee on Reactor Safety on AECs Proposed Construction Permit Criteria. (Reference 6)

For those structures, systems and components that have been added to the plant or other licensing commitments made, the appropriate vintage general design criteria have been identified in the applicable section of the USAR.

In Section 1.5, those criteria which were originally designated in parentheses as Category A required that more definitive information be provided to the AEC at the construction permit stage. All other criteria were designated as Category B. However, these categories are no longer applicable and are not included.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-2

I. OVERALL PLANT REQUIREMENTS

CRITERION 1 - QUALITY STANDARDS

Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed.

Where generally recognized codes or standards on design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety functions, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of sufficiency and applicability or codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is required.

ANSWER

The systems and components of the facility are classified according to their importance in the prevention and mitigation of accidents which could cause undue risk to the health and safety of the public.

Prairie Islands original classification system utilized a combination of Design Classes and Quality Assurance Types. Design Classes are defined in Section 12 and Quality Assurance Types are defined below.

The original, PINGP specific, classification system has been replaced by a system utilizing industry standard and regulatory documents as input. Thus, the current classification system is based on SSC functions and uses standard industry terminology, such as safety related.

In general, QA Type I is associated with Safety Related, QA Type II is associated with Augmented Quality (a subset of Non-Safety Related), and QA Type III is associated with standard quality Non-Safety Related. Safety Related, Augmented Quality, and Non-Safety Related are defined in applicable fleet procedures.

A discussion of the codes and standards, quality assurance programs, test provisions, etc., applying to each system is included in that portion of the USAR describing that system. A listing of the applicable sections is included in Section 1.2.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-3

Quality Assurance Types

QA Type I - Those items for which the Quality Assurance Program must assure the highest feasible degree of quality standards consistent with the importance of the safety function to be performed. This category includes those items of the plant which are essential to the prevention of accidents which could affect the public health and safety by the release of quantities(1) of radioactivity or are required in the mitigation of the consequences of such accidents.

QA Type II - Those items for which the Quality Assurance Program must engender a high confidence that the item will perform satisfactorily. This category includes those items whose failure would not directly affect the health and safety of the public, but the failure of which could cause severe economic loss or cause the plant to experience an extended outage.

QA Type III - This category includes all other items not included in Types I and II.

CRITERION 2 - PERFORMANCE STANDARDS

Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.

(1) A substantial amount of radioactivity is defined as that amount of radioactive material which would produce radiation levels at the site boundary in excess of 1% of 10 CFR100. In accordance with Amendments 229/217 the classification of the Manipulator Cranes including the load cells, the Spent Fuel Pool Bridge Crane, the Spent Fuel Transfer System (exclusive of the transfer tube/blind flange), the Rod Cluster Control Changing Fixtures, and Spent Fuel Assembly Handling Tool classification is based on a definition of substantial amount of radioactivity of: that amount of radioactive material which would produce radiation levels at the site boundary in excess of 10% of 10CFR100.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-4

ANSWER

The systems and components designated Class I in Section 12, in conjunction with administrative controls and analysis, as applicable, are designed to withstand, without loss of capability to protect the public, the most severe environmental phenomena ever experienced at the site with appropriate margins included in the design for uncertainties in historical data. Potential environmental hazards are discussed and analyzed in Sections 2 and 14 of the report and the influence of these hazards on various aspects of the plant design is discussed in the sections covering the specific systems and components concerned. An outline of the design philosophy for Class I systems and components and a listing of the applicable report sections describing the systems and components covered by this criterion are included in Section 1.2.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-5

CRITERION 3 - FIRE PREVENTION

The reactor facility shall be designed (1) to minimize the probability of events such as fires and explosions and (2) to minimize the potential effects of such events to safety.

Noncombustible and fire resistant materials shall be used whenever practical throughout the facility, particularly in areas containing critical portions of the facility such as containment, control room, and components of engineered safety features.

ANSWER

Through the use of noncombustible and fire resistant materials wherever practical in the facility and the limitation of combustible supplies (e.g., logs, records, manuals, etc.) in such areas as the control rooms to amounts required for current operation, the probability of such events as fire and explosion and the effects of such events should they occur are minimized. Fire protection criteria are discussed in Section 1.2 and specific means of meeting these criteria are described in Sections 7 and 10.

CRITERION 4 - SHARING OF SYSTEMS

Reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

ANSWER

As noted in Section 1.2, those systems or components which are shared, either between the two units or functionally within a single unit, are designed in such a manner that plant safety is not impaired by the sharing. Specific instances of component or system sharing are described in the appropriate sections of the report as listed in Section 1.2. A functional evaluation of safety related shared systems is presented in Table 1.3-1 and 1.3-2.

CRITERION 5 - RECORDS REQUIREMENTS

Records of the design, fabrication, and construction of essential components of the plant shall be maintained by the reactor operator or under its control throughout the life of the reactor.

ANSWER

The applicant maintains, either in its possession or under its control, a complete set of records of the design, fabrication, construction and testing of Class I plant components throughout the life of the plant. Section 13 presents summary of records requirements for plant operation, maintenance, modification and review of procedures.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-6

II. PROTECTION BY MULTIPLE FISSION PRODUCT BARRIERS

CRITERION 6 - REACTOR CORE DESIGN

The reactor core shall be designed to function throughout its design lifetime, without exceeding acceptable fuel damage limits which have been stipulated and justified. The core design, together with reliable process and decay heat removal systems, shall provide for this capability under all expected conditions of normal operation with appropriate margins for uncertainties and for transient situations which can be anticipated, including the effects of the loss of power to recirculation pumps, tripping out of a turbine generator set, isolation of the reactor from its primary heat sink, and loss of all offsite power.

ANSWER

The ability of the core to function throughout its lifetime without exceeding acceptable fuel damage limits is discussed in Section 3. Detailed information on core design and performance is included in Section 3. The instrumentation and controls associated with the reactor are described in Section 7 while decay heat removal systems are discussed in Sections 6 and 10. Section 14 demonstrates that adequate fuel integrity is maintained under those postulated abnormal situations which could ultimately lead to problems in this area.

CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS

The core design, together with reliable controls, shall ensure that power oscillations which could cause damage in excess of acceptable fuel damage limits are not possible or can be readily suppressed.

ANSWER

The inherent ability of the core to prevent and suppress power oscillations and the instrumentation and controls provided to assist in this function is discussed in Sections 3 and 7, respectively CRITERION 8 - OVERALL POWER COEFFICIENT

The reactor shall be designed so that the overall power coefficient in the power operating range shall not be positive.

ANSWER

The overall power coefficient is discussed in Section 3 and the core reload safety analysis for each fuel cycle.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-7

CRITERION 9 - REACTOR COOLANT PRESSURE BOUNDARY

The reactor coolant pressure boundary shall be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime.

ANSWER

As discussed in detail in Section 4, the reactor coolant pressure boundary materials, design, analysis, fabrication and testing preclude the possibility of gross rupture or significant leakage throughout its design lifetime.

CRITERION 10 - CONTAINMENT

Containment shall be provided. The containment structure shall be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other engineered safety features as may be necessary, to retain for as long as the situation requires the functional capability to protect the public.

ANSWER

The design of the containment structure, and associated auxiliary systems is described in Section 5. Other Engineered Safety Features required to suppress pressure inside the containment are described in Sections 6 and 10. Section 14 demonstrates the adequacy of such systems under various accident conditions including a rupture of the largest reactor coolant pipe.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-8

III. NUCLEAR AND RADIATION CONTROLS

CRITERION 11 - CONTROL ROOM

The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit access, even under accident condition, to equipment in the control room or other areas as necessary to shut down and maintain safe control of the facility without radiation exposures of personnel in excess of 10CFR20 limits. It shall be possible to shut the reactor down and maintain it in a safe condition if access to the control room is lost due to fire or other cause.

ANSWER

A common control room contains all controls and instrumentation necessary for operation of each units reactor, turbine generator, and auxiliary and emergency systems under normal or accident conditions.

The control room is designed and equipped to minimize the possibility of events which might preclude occupancy. In addition, provisions were made for bringing both units to and maintaining a safe shutdown condition for an extended period of time from locations outside the control room.

Safe shutdown is a reactor condition that requires the ability to maintain the reactor sub-critical, remove core decay heat, assure reactor coolant pressure boundary integrity for an extended time period and maintain the integrity of components whose failure could result in excessive offsite release. These conditions may be achieved by operator actions or by automatic reactor protection functions.

The reactor conditions stated above are consistent with those conditions described in the Technical Specifications as Mode 3, Hot Standby, except as otherwise defined by 10CFR50.48.

The employment of non-combustible and fire retardant materials in the construction of the control room contained equipment and furnishings, the limitation of combustible supplies to the minimum consistent with safe and efficient operation of the plant, the location of fire fighting equipment in the control room, and the continuous presence of an operator minimize the probability that the control room will become uninhabitable. In addition, the control room ventilation system is designed to keep the control room at a positive pressure and can be operated in a recirculating mode to prevent fire originating outside the control room from spreading to the control area.

Protection from Toxic Chemical Release is described in Section 2.9.4.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-9

Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subjected to doses under postulated accident conditions during occupancy, ingress or egress of control room, which in the aggregate, would not exceed 5 Rem TEDE for the duration of the accident. The control room ventilation consists of a system having a large percentage of recirculated air during normal operation. After the postulated accident, outside air is automatically isolated and a portion of the recirculation air flow is rerouted through a system of HEPA and charcoal filters. Operation of the Control Room Ventilation System is discussed in Section 10.3.3.

CRITERION 12 - INSTRUMENTATION AND CONTROL SYSTEMS

Instrumentation and controls shall be provided as required to monitor and maintain variables within prescribed operating ranges.

ANSWER

As discussed in detail in Section 7, sufficient instrumentation and controls are provided for safe and efficient operation of the facility. Additional details on instrumentation and controls are included in sections relating to specific systems and components.

CRITERION 13 - FISSION PROCESS MONITORS AND CONTROLS

Means shall be provided for monitoring and maintaining control over the fission process throughout core life and for all conditions that can reasonably be anticipated to cause variations in reactivity of the core, such as indication of position of control rods and concentration of soluble reactivity control poisons.

ANSWER

The means provided for monitoring the fission and the means of determining control rod position are described in Section 7 while the means of control and determination of boron concentration are detailed in Section 10.

CRITERION 14 - CORE PROTECTION SYSTEMS

Core protection systems, together with associated equipment, shall be designed to act automatically to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits.

ANSWER

The instrumentation and controls provided to prevent or suppress conditions which could result in exceeding acceptable fuel damage limits are described in Section 7.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-10

CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEMS Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features.

ANSWER

The facility is provided with adequate instrumentation and controls to sense accident situations and initiate the operation of necessary engineered safeguards systems. This protection system is presented in detail in Sections 6, 7, 10 and 11.

CRITERION 16 - MONITORING REACTOR COOLANT PRESSURE BOUNDARY

Means shall be provided for monitoring the reactor coolant pressure boundary to detect leakage.

ANSWER

Means of detecting leakage from the Reactor Coolant System is provided by measuring the airborne activity and humidity of the lower containment compartment, condensate collected by the fan coil units and indicating changes in makeup requirements and containment sump levels. These leakage detection methods are presented in detail in Section 6.

CRITERION 17 - MONITORING RADIOACTIVITY RELEASES

Means shall be provided for monitoring the containment atmosphere, the facility effluent discharge paths, and the facility environs for radioactivity that could be released from normal operations, from anticipated transients, and from accident conditions.

ANSWER

The facility contains means for monitoring the containment atmosphere, effluent discharge paths, and the facility environs for radioactivity which could be released under any conditions. The details of the effluent discharge path and containment monitoring methods are contained in Sections 7 and 9 while the Radiological Environmental Monitoring Program is described in Section 2.

CRITERION 18 - MONITORING FUEL AND WASTE STORAGE

Monitoring and alarm instrumentation shall be provided for fuel and waste storage and handling areas for conditions that might contribute to loss of continuity in decay heat removal and to radiation exposures.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-11

ANSWER

Sufficient monitoring and alarm instrumentation is provided in waste and fuel storage areas to detect conditions which might contribute to loss of cooling for decay heat removal or abnormal radiation releases. Details of the monitoring systems are included in Sections 7, 9 and 10.

IV. RELIABILITY AND TESTABILITY OF PROTECTION SYSTEMS

CRITERION 19 - PROTECTION SYSTEMS RELIABILITY

Protection systems shall be designed for high functional reliability and in-service testability commensurate with the safety functions to be performed.

ANSWER

All protection systems are designed for the utmost in reliability based on extensive testing in the shop and many years of actual operating experience. Sufficient redundancy of such systems is provided to enable test of instrumentation channels during plant operation without jeopardizing reactor safety. Detailed description of various portions of the systems are included in Section 7.

CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE

Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection channel. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served.

ANSWER As detailed in Section 7, sufficient redundancy and independence is designed into the protection systems to assure that no single failure nor removal from service of any component or channel results in loss of the protection function. In addition, the Proposed IEEE Criteria for Nuclear Power Plant Protection Systems of the Institute of Electrical and Electronic Engineer, IEEE No. 279, August 30, 1968 (Ref. 4), was employed in the detailed design of the protection systems.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-12

CRITERION 21 - SINGLE FAILURE DEFINITION

Multiple failures resulting from a single event shall be treated as a single failure.

ANSWER

When evaluating the control, protection, engineered safeguards and other systems of the facility, multiple failures resulting from a single event are treated as a single failure.

The ability of each system to perform its function with a single failure is discussed in the sections describing the individual systems.

A single failure is described as:

A random failure and its consequential effects, in addition to an initiating occurrence, that results in the loss of capability of a component to perform its intended safety function(s).

Fluid and electrical systems are considered to be designed against an assumed single failure if neither (1) a single failure of any active component (assuming passive components function properly), nor (2) a single failure of any passive component (assuming active components function properly) results in a loss of the capability of the system to perform its nuclear safety function.

During the short term, the single failure considered may be limited to an active failure. During the long term, assuming no prior failure during the short term, the limiting single failure considered can be either active or passive.

The short term is defined as that period of operation up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an initiating event, but for purposes of design of the emergency core cooling and containment spray systems, the short term shall be considered to terminate upon transfer of these systems to the long term cooling mode with the ECCS in low-head recirculation. There are exceptions; for example, for evaluating dose, passive failure of a RHR pump seal is not assumed to occur for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an accident. The long term is defined as that period of safety related fluid system operation following the short term, during which the safety function of the system is required.

For electrical systems, no distinction is made between failures of active and passive components and all such failures must be considered in applying the single failure criterion.

Active failure in a fluid system is the failure of a component which relies on mechanical movement for its operation to complete its intended function on demand. Examples include a failure of a motor or air operated valve to move or assume its correct position on demand, failure of a pump to start or failure of an emergency diesel generator to start.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-13

A passive failure in a fluid system is a breach in the fluid pressure boundary or a mechanical failure which adversely affect a flow path. Examples include the failure of a simple check valve to move to its correct position when required or leakage from failed components (such as a pump seal or valve packing).

Leakage due to pressure boundary breaches are limited to 50 gpm maximum; i.e., random piping breaks are not considered credible in addition to the initiating event.

CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION SYSTEM

Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels.

ANSWER

Protection and control channels in the facility protection systems were designed in accordance with the IEEE-279, Proposed IEEE Criteria For Nuclear Power Plant Protection Systems (Ref. 4).

The coincident trip philosophy was employed to prevent a single failure from causing a spurious trip or from defeating the function of any channel.

Each reactor trip is designed so that the trip occurs upon deenergization of the circuit; and open circuit or loss of power to a channel will, therefore, result in that channel going into its trip mode. In addition, the reactor protection system will energize the normally de-energized shunt trip device, which in turn trips the reactor trip breaker. Redundancy within each channel provides reliability and independence of operation. Channel independence is carried throughout the system from the sensor to the relay providing the logic. In some cases, however, it is desirable to employ a common sensor for both a control and protection channel. Both functions are fully isolated in the remainder of the channel, control being derived from the primary safety signal path through an isolation amplifier. As such, failure in the control circuitry does not adversely affect the safety channel.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-14

CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION SYSTEMS

The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function.

ANSWER

Protection system components are being designed and arranged so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function. Details of this protection are provided in the appropriate portions of Section 7.

CRITERION 24 - EMERGENCY POWER FOR PROTECTION SYSTEMS

In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems.

ANSWER

The facility is supplied with normal, reserve and emergency power to provide for the required functioning of the protection systems.

In the event of a reactor and turbine trip, emergency power is supplied by 2 diesel generators per unit, as described in Section 8. Any one diesel is capable of supplying the emergency power requirements for that unit.

The instrumentation and controls portions of the protection systems is supplied from the 125-VDC station batteries during the diesel startup period, as described in Section 8.

CRITERION 25 - DEMONSTRATION OF FUNCTIONAL OPERABILITY OF PROTECTION SYSTEMS

Means shall be included for testing protection systems while the reactor is in operation to demonstrate that no failure or loss of redundancy has occurred.

ANSWER

Each protection channel in service at power is capable of being calibrated and tested at power to verify its operation. Details of the means used to test protection system instrumentation are included in Section 7.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-15

CRITERION 26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN

The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.

ANSWER

The details of the design and failure modes of the various protection channels are found in portions of Section 7 concerned with those channels.

V. REACTIVITY CONTROL

CRITERION 27 - REDUNDANCY OF REACTIVITY CONTROL

At least two independent reactivity control systems, preferably of different principles, shall be provided.

ANSWER

Two independent reactivity control systems, rod cluster control assemblies and boric acid dissolved in the reactor coolant, are employed in the facility.

Details of the construction and operation of the rod cluster control system are included in Sections 3 and 7. Means of controlling the boric acid concentration are included in Section 10.

CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY

At least two of the reactivity control systems provided shall independently be capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes, sufficiently fast to prevent exceeding acceptable fuel damage limits.

ANSWER

The rod cluster control system is capable of making and holding the core subcritical from all operating and hot shutdown conditions and sufficiently fast to prevent exceeding acceptable fuel damage limits. The chemical shim control is also capable of making and holding the core subcritical, but at a slower rate, and is not employed as a means of compensating for rapid reactivity transients. The rod cluster control system is, therefore, used in protecting the core from such transients. Details of the operation and effectiveness of these systems are included in Sections 3, 7 and 10.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-16

CRITERION 29 - REACTIVITY SHUTDOWN CAPABILITY

At least one of the reactivity control systems provided shall be capable of making the core subcritical under any condition (including anticipated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margins greater than the maximum worth of the most effective control rod when fully withdrawn shall be provided.

ANSWER

As detailed in Section 3, the reactor may be made subcritical by the rod cluster control system sufficiently fast to prevent exceeding acceptable fuel damage limits, under all anticipated conditions even with the most reactive rod control cluster fully withdrawn.

CRITERION 30 - REACTIVITY HOLDDOWN CAPABILITY

At least one of the reactivity control systems provided shall be capable of making and holding the core subcritical under any conditions with appropriate margins for contingencies.

ANSWER

The facility is provided with the means of making and holding the core subcritical under any anticipated conditions and with appropriate margin for contingencies. These means are discussed in detail in Sections 3, 7 and 10. Combined use of the rod cluster control system and the chemical shim control system permit the necessary shutdown margin to be maintained during long term xenon decay and plant cooldown.

CRITERION 31 - REACTIVITY CONTROL SYSTEMS MALFUNCTION

The reactivity control systems shall be capable of sustaining any single malfunction, such as, unplanned continuous withdrawal (not ejection) of a control rod, without causing a reactivity transient which could result in exceeding acceptable fuel damage limits.

ANSWER

The facility reactivity control systems are such that acceptable fuel damage limits are not exceeded even in the event of a single malfunction of either system. An analysis of the effects of possible malfunction is presented in Chapters 3, 7 and 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-17

CRITERION 32 - MAXIMUM REACTIVITY WORTH OF CONTROL RODS

Limits, which include considerable margin, shall be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.

ANSWER

The maximum reactivity worth of control rods and the maximum rates of reactivity insertion employing both control rods and boron removal are limited to values which prevent rupture of the coolant pressure boundary or disrupt the core or vessel internals to a degree which could impair the effectiveness of emergency core cooling. Details of rod worths, reactivity insertion rates and their relationship to plant safety are included in Sections 3 and 14.

VI. REACTOR COOLANT PRESSURE BOUNDARY

CRITERION 33 - REACTOR COOLANT PRESSURE BOUNDARY CAPABILITY

The reactor coolant pressure boundary shall be capable of accommodating without rupture, and with only limited allowance for energy absorption through plastic deformation, the static and dynamic loads imposed on any boundary component as a result of any inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition.

ANSWER

The reactor coolant boundary is designed to accommodate static and dynamic loads associated with sudden reactivity insertions (e.g., rod ejection) without failure. Details of the design can be found in Sections 3 and 4 and an analysis of the effects of such incidents as rod ejection is included in Section 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-18

CRITERION 34 - REACTOR COOLANT PRESSURE BOUNDARY RAPID PROPAGATION FAILURE PREVENTION

The reactor coolant pressure boundary shall be designed to minimize the probability of rapidly propagating type failures. Consideration shall be given (a) to the notch-toughness properties of materials extending to the upper shelf of the Charpy transition curve, (b) to the state of stress of materials under static and transient loadings, (c) to the quality control specified for materials and component fabrication to limit flaw sizes, and (d) to the provisions for control over service temperature and irradiation effects which may require operational restrictions.

ANSWER

The reactor coolant pressure boundary is designed to minimize the probability of rapidly propagating type failures. To fulfill these requirements, the selection of materials for the systems and the fabrication of components are closely controlled and inspected. The details of the material selection and inspection procedures are contained in Section 4.

CRITERION 35 - REACTOR COOLANT PRESSURE BOUNDARY BRITTLE FRACTURE PREVENTION

Under conditions where reactor coolant pressure boundary system components constructed of ferritic materials may be subjected to potential loadings, such as a reactivity-induced loading, service temperature shall be at least 120F above the nil ductility transition (NDT) temperature of the component material if the resulting energy release is expected to be absorbed by plastic deformation or 60F above the NDT temperature of the component material if the resulting energy release is expected to be absorbed within the elastic strain energy range.

ANSWER

Sufficient testing and analysis of materials employed in reactor coolant system components was performed to insure that the required NDT limits specified in the criterion are met. Removable test capsules are installed in the reactor vessel and are removed and tested at various times in the plant lifetime to determine the effects of operation on system materials. Details of the testing and analysis programs are included in Section 4.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-19

CRITERION 36 - REACTOR COOLANT PRESSURE BOUNDARY SURVEILLANCE

Reactor coolant pressure boundary components shall have provisions for inspection, testing, and surveillance by appropriate means to assess the structural and leaktight integrity of the boundary components during service lifetime. For the reactor vessel, a material surveillance program conforming with ASTM-E-185-66 shall be provided.

ANSWER

Provision has been made in the reactor coolant system design for adequate inspection testing and surveillance during the facilitys service lifetime. The reactor coolant system inservice inspection program is discussed in Section 4.7. The vessel material surveillance inspection program conforms to ASTM-E-185 (Ref. 3). These provisions are also discussed in detail in Section 4.

VII. ENGINEERED SAFETY FEATURES

CRITERION 37 - ENGINEERED SAFETY FEATURES BASIS FOR DESIGN

Engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems. As a minimum, such engineered safety features shall be designed to cope with any size reactor coolant pressure boundary break up to and including the circumferential rupture of any pipe in that boundary assuming unobstructed discharge from both ends.

ANSWER

The containment systems, containment air cooling system, the safety injection system, the special zone ventilation systems, the containment vessel internal spray system, the auxiliary feedwater system and the diesel generators comprise the engineered safety features for the facility. These systems and their supporting systems (component cooling system and cooling water system) are designed to cope with any size reactor coolant pressure boundary break up to and including rupture of the largest reactor coolant pipe. The design bases for each system are included in the appropriate portions of Sections 5, 6, 8 and 10. An analysis of the performance of the safeguards is presented in Section 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-20

CRITERION 38 - RELIABILITY AND TESTABILITY OF ENGINEERED SAFETY FEATURES

All engineered safety features shall be designed to provide high functional reliability and ready testability. In determining the suitability of a facility for proposed site, the degree of reliance upon and acceptance of the inherent and engineered safety afforded by the systems, including engineered safety features, will be influenced by the known and the demonstrated performance capability and reliability of the systems, and by the extent to which the operability of such systems can be tested and inspected where appropriate during the life of the plant.

ANSWER

All engineered safety features components were tested in the manufacturers shop and after installation at the facility to demonstrate their reliability. Provision has also been made in the system design for periodic testing of engineered safety features during the plant lifetime. Details of the tests to be performed and the basis for the determination of system reliability are included in Section 5 for the containment and containment isolation system, and in Sections 6, 8 and 10 for the remaining engineered safety features.

CRITERION 39 - EMERGENCY POWER FOR ENGINEERED SAFETY FEATURES

Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite power system and the offsite power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.

ANSWER

Reliability of electric power supply is insured through two independent connections to the system grid, and a redundant source of emergency power from four diesel generators installed in the facility. Power to the engineered safety features is assured even with the failure of a single active component in each system. The facility electrical systems, including network interconnections and the emergency power system, are described in Section 8.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-21

CRITERION 40 - MISSILE PROTECTION

Protection for engineered safety features shall be provided against dynamic effects and missiles that might result from plant equipment failure.

ANSWER

All engineered safety features are protected against dynamic effects and missiles resulting from equipment failures. The means for accomplishing this protection are described in Sections 5, 6 and 12.

CRITERION 41 - ENGINEERED SAFETY FEATURES PERFORMANCE CAPABILITY

Engineered safety features such as emergency core cooling and containment heat removal systems shall provide sufficient performance capability to accommodate partial loss of installed capacity and still fulfill the required safety function. As a minimum, each engineered safety features shall provide this required safety function assuming a failure of a single active component.

ANSWER

Sufficient redundancy and duplication is incorporated into the design of the engineered safety features to insure that they may perform their function adequately even with the loss of a single active component. Details of the capability of these systems under normal and component malfunction conditions are included in Section 6 and 10. An analysis of the adequacy of these systems to perform their functions is included in Section 14.

CRITERION 42 - ENGINEERED SAFETY FEATURES COMPONENTS CAPABILITY

Engineered safety features shall be designed so that the capability of each component and system to perform its required function is not impaired by the effects of a loss-of-coolant accident.

ANSWER

The design of the engineered safety features, the materials selected for fabrication of these systems, and the layout of the various portions of the systems combine to insure that the performance of the engineered safety features is not impaired by the effects of a loss-of-coolant accident. Details of the design and construction of the engineered safety features are included in Sections 5, 6, 8 and 10. The ability of these features to perform their functions is analyzed in Section 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-22

CRITERION 43 - ACCIDENT AGGRAVATION PREVENTION

Engineered safety features shall be designed so that any action of the engineered safety features which might accentuate the adverse after-effects of the loss of normal cooling is avoided.

ANSWER

The operation of the engineered safety features will not accentuate the after effects of a loss-of-coolant accident. These considerations are detailed in Sections 5, 6, 8, 10 and 14.

CRITERION 44 - EMERGENCY CORE COOLING SYSTEMS CAPABILITY

At least two emergency core cooling systems, preferably of different design principles, each with a capability of accomplishing abundant emergency core cooling, shall be provided. Each emergency core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the emergency core cooling function and to limit the clad metal-water reaction to negligible amounts for all sizes of breaks in the reactor coolant pressure boundary, including the double-ended rupture of the largest pipe. The performance of each emergency core cooling system shall be evaluated conservatively in each area of uncertainty. The systems shall not share active components and shall not share other features or components unless it can be demonstrated that (a) the capability of the shared feature or component to perform its required function can be readily ascertained during reactor operation, (b) failure of the shared feature or component does not initiate a loss-of-coolant accident, and (c) capability of the shared feature or component to perform its required function is not impaired by the effects of a loss-of-coolant accident and is not lost during the entire period this function is required following the accident.

ANSWER

By combining the use of passive accumulators with two independent high pressure pumping systems and two independent low pressure pumping systems abundant emergency core cooling is provided even if there should be a failure of any component in any system. A description of the system and its operation is contained in Section 6 and an analysis of the operation of the system under accident conditions is included in Section 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-23

CRITERION 45 - INSPECTION OF EMERGENCY CORE COOLING SYSTEMS

Design provisions shall be made to facilitate physical inspection of all critical parts of the emergency core cooling systems, including reactor vessel internals and water injection nozzles.

ANSWER

The design of the emergency core cooling system is such that critical portions are accessible for examination by visual, optical or other nondestructive means. Details of the inspection program for the reactor vessel internals are included in Section 4 while inspection of the remaining portions of the system is discussed in Section 6.

CRITERION 46 - TESTING OF EMERGENCY CORE COOLING SYSTEM COMPONENTS

Design provisions shall be made so that active components of the emergency core cooling systems, such as pumps and valves, can be tested periodically for operability and required functional performance.

ANSWER

The emergency core cooling system design permits periodic testing of active components for operability and required functional performance. The test procedures are described in Section 6.

CRITERION 47 - TESTING OF EMERGENCY CORE COOLING SYSTEMS

A capability shall be provided to test periodically the delivery capability of the emergency core cooling systems at a location as close to the core as is practical.

ANSWER

By recirculation to the refueling water storage tank, the emergency core cooling system delivery capability can be tested periodically. The system can be so tested to the last valve before the piping enters the reactor coolant piping. Details of the system tests are included in Section 6.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-24

CRITERION 48 -TESTING OF OPERATIONAL SEQUENCE OF EMERGENCY CORE COOLING SYSTEMS

A capability shall be provided to test under conditions as close to design as practical the full operational sequence that would bring the emergency core cooling systems into action, including the transfer to alternate power sources.

ANSWER Provision has been made in the emergency core cooling system design for testing the sequence of operation including transfer to alternate power sources. The details of these tests are included in Section 6, and the switching sequence from normal to emergency power is described in Section 8.

CRITERION 49 - CONTAINMENT DESIGN BASIS

The containment structure, including access openings and penetrations, and any necessary containment heat removal systems shall be designed so that the containment structure can accommodate without exceeding the design leakage rate the pressures and temperatures resulting from the largest credible energy release following a loss-of-coolant accident, including a considerable margin for effects from metal-water or other chemical reactions, that could occur as a consequence of failure of emergency core cooling systems.

ANSWER

The reactor containment vessel and its contained heat removal system are designed to accommodate the pressures and temperatures associated with a loss of coolant accident without exceeding the design leak rate. A considerable margin for unidentified energy sources has been included in the design. The loadings and energy sources considered in the design and the stress and loading criteria are described in Section 12.

An analysis of the performance of the containment during a loss-of-coolant accident is included in Section 14. The heat removal systems are described in Section 6 (Containment Vessel Internal Spray System and Containment Air Cooling System).

Design of the concrete shield building is given in Section 12.

CRITERION 50 - NDT REQUIREMENTS FOR CONTAINMENT VESSEL

Principal load carrying components of ferritic materials exposed to the external environment shall be selected so that their temperatures under normal operating and testing conditions are not less than 30F above nil ductility transition (NDT) temperature.

ANSWER

As stated in Section 5, all containment ferritic materials are selected to ensure that their temperature under normal operating and testing conditions will be at least 30°F above nil ductility transition temperature.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-25

CRITERION 51 - REACTOR COOLANT PRESSURE BOUNDARY OUTSIDE CONTAINMENT

If part of the reactor coolant pressure boundary is outside the containment, appropriate features as necessary shall be provided to protect the health and safety of the public in case of an accidental rupture in that part. Determination of the appropriateness of features such as isolation valves and additional containment shall include consideration of the environmental and population conditions surrounding the site.

ANSWER

The reactor coolant pressure boundary is defined as those piping systems and components which contain reactor coolant at design pressure and temperature. With the exception of the reactor coolant sampling lines, the entire reactor coolant pressure boundary, as defined above, is located entirely within the reactor containment vessel.

All sampling lines are provided with remotely operated valves for isolation in the event of a failure. These valves also close automatically on a containment isolation signal.

Sampling lines are only used during infrequent sampling and can be readily isolated.

All other piping and components which may contain reactor coolant are low pressure, low temperature systems which would yield minimal environmental doses in the event of failure.

The Sampling System and low pressure systems are described in Section 10.

CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEM

Where active heat removal systems are needed under accident conditions to prevent exceeding containment design pressure, at least two systems, preferably of different principles, each with full capacity, shall be provided.

ANSWER

Heat capability for the Containment is provided by two separate, engineered safety features systems. These are the Containment Vessel Internal Spray System, whose components are described in Section 6.4 and the Containment Air Cooling System whose components operate as described in Section 6.3.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-26

CRITERION 53 - CONTAINMENT ISOLATION VALVES

Penetrations that require closure for the containment function shall be protected by redundant valving and associated apparatus.

ANSWER

At least two barriers are provided between the atmosphere outside the containment and the containment atmosphere, the reactor coolant system, or closed systems which are assumed vulnerable to accident forces. The valving installed on the various systems penetrating the containment and the other barriers employed in the design are described in Sections 5, 6 and 10.

CRITERION 54 - CONTAINMENT LEAKAGE RATE TESTING

Containment shall be designed so that an integrated leakage rate testing can be conducted at design pressure after completion and installation of all penetrations and the leakage rate measured over a sufficient period of time to verify its conformance with required performance.

ANSWER

Provision is included in the containment vessel design for integrated leak rate testing after completion of construction. The test procedure is described in Section 5 and is formulated to demonstrate that leakage is below the Containment Leakage Rate Testing Program limits.

CRITERION 55 - CONTAINMENT PERIODIC LEAKAGE RATE TESTING

The containment shall be designed so that integrated leakage rate testing can be done periodically at design pressure during plant lifetime.

ANSWER

Provision for full integrated leak rate testing of the containment is incorporated in the design. The testing procedures are discussed in Section 5.

CRITERION 56 - PROVISIONS FOR TESTING OF PENETRATIONS

Provisions shall be made for testing penetrations which have resilient seals or expansion bellows to permit leaktightness to be demonstrated at design pressure at any time.

ANSWER

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-27

Each containment penetration includes a means to test its leaktightness at any time.

This system is described in Section 5.

CRITERION 57 - PROVISIONS FOR TESTING OF ISOLATION VALVES

Capability shall be provided for testing functional operability of valves and associated apparatus essential to the containment function for establishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits.

ANSWER

The containment isolation system, including test provisions, is described in Section 5.

CRITERION 58 - INSPECTION OF CONTAINMENT PRESSURE-REDUCING SYSTEMS

Design provisions shall be made to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as, pumps, valves, spray nozzles, torus, and sumps.

ANSWER

The design of the Containment Vessel Internal Spray Systems includes provision for physical inspection of vital components. The inspectability of the spray systems is discussed in Section 6.

CRITERION 59 - TESTING OF CONTAINMENT PRESSURE-REDUCING SYSTEMS COMPONENTS

The containment pressure-reducing systems shall be designed so that active components, such as pumps and valves, can be tested periodically for operability and required functional performance.

ANSWER

Component testing of the Containment Vessel Internal Spray Systems is discussed in detail in Section 6.

CRITERION 60 - TESTING OF CONTAINMENT SPRAY SYSTEMS

A capability shall be provided to test periodically the delivery capability of the containment spray system at a position as close to the spray nozzles as is practical.

ANSWER

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-28

All portions of the Containment Vessel Internal Spray Systems may be tested. The delivery capacity may be tested up to the last valve before the system enters the containment. Details of the Containment Vessel Internal Spray System are included in Section 6.

CRITERION 61 - TESTING OF OPERATIONAL SEQUENCE OF CONTAINMENT PRESSURE-REDUCING SYSTEMS

A capability shall be provided to test under conditions as close to the design as practical the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources.

ANSWER

Capability for testing of the operational sequence of the Containment Vessel Internal Spray System is incorporated into the system design. Details of the Containment Vessel Internal Spray System are included in Section 6. The switching sequence from normal to emergency power is described in Section 6.

CRITERION 62 - INSPECTION OF AIR CLEANUP SYSTEMS

Design provisions shall be made to facilitate physical inspection of all critical parts of the containment air cleanup systems, such as ducts, filters, fans and dampers.

ANSWER

The inspection of the special zone ventilation systems and their components is discussed in Section 10.

CRITERION 63 - TESTING OF AIR CLEANUP SYSTEMS COMPONENTS

Design provisions shall be made so that active components of the air cleanup systems, such as fans and damper, can be tested periodically for operability and required functional performance.

ANSWER Testing of special zone ventilation system components is discussed in Section 10.

CRITERION 64 - TESTING OF AIR CLEANUP SYSTEMS

A capability shall be provided for in situ periodic testing and surveillance of the air cleanup systems to ensure (a) filter bypass paths have not developed and (b) filter and trapping materials have not deteriorated beyond acceptable limits.

ANSWER

In situ testing of the special zone ventilation system is discussed in Section 10.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-29

CRITERION 65 - TESTING OF OPERATIONAL SEQUENCE OF AIR CLEANUP SYSTEMS

A capability shall be provided to test under conditions as close to design as practical the full operational sequence that would bring the air cleanup systems into action, including the transfer to alternate power sources and the designing air flow delivery capability.

ANSWER

The operational sequence testing of the special zone ventilation system is discussed in Section 10.

CRITERION 66 - PREVENTION OF FUEL STORAGE CRITICALITY

Criticality in new and spent fuel storage shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls.

ANSWER

Criticality in new and spent fuel storage areas is prevented both by physical separation of new and spent fuel elements and the presence of borated water in the spent fuel storage pit. Criticality prevention is discussed in detail in Section 10.

CRITERION 67 - FUEL AND WASTE STORAGE DECAY HEAT

Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities that could result in radioactivity release to plant operating areas or the public environs.

ANSWER

The Spent Fuel Pool Cooling system provides decay heat removal for the spent fuel pool. The system is capable of handling a maximum heat load corresponding to both pools being filled with a combined total of 1362 normally discharged fuel assemblies plus a freshly off loaded core consisting of 121 fuel assemblies. Details of the Spent Fuel Pool Cooling System and fuel handling facilities are described in Section 10.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.5-30

CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING

Shielding for radiation protection shall be provided in the design of spent fuel and waste storage facilities as required to meet the requirements of 10CFR20.

ANSWER

Shielding is provided for fuel handling and waste storage areas to lower radiation doses to levels below limits specified in 10CFR20. Shielding for these areas and other plant shielding requirements and criteria are included in Sections 9 and 12.

CRITERION 69 - PROTECTION AGAINST RADIOACTIVITY RELEASE FROM SPENT FUEL AND WASTE STORAGE

Containment of fuel and waste storage shall be provided if accidents could lead to release of undue amounts of radioactivity to the public environs.

ANSWER

All fuel storage and waste storage facilities are designed to prevent the release of undue radioactivity to the public. Fuel storage facilities are described in Section 10, waste storage facilities are described in Sections 9 and 12 and analysis of potential accidents in these systems is included in Section 14.

CRITERION 70 - CONTROL OF RELEASES OF RADIOACTIVITY TO THE ENVIRONMENT

The facility design shall include those means necessary to maintain control over the plant radioactive effluents, whether gaseous, liquid, or solid. Appropriate holdup capacity shall be provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be expected to require operational limitations upon the release of radioactive effluents to the environment. In all cases, the design for radioactivity control shall be justified (a) on the basis of 10CFR20 requirements for normal operations and for any transient situation that might reasonably be anticipated to occur and (b) on the basis of 10CFR100 dosage level guidelines for potential reactor accidents of exceeding low probability of occurrence except that reduction of the recommended dosage levels may be required where high population densities of very large cities can be affected by the radioactive effluents.

ANSWER

Provision is included in the facility design for storage and processing of radioactive waste and the release of such wastes under controls adequate to prevent exceeding the limits of 10CFR20. The facility also includes provision to prevent radioactivity releases during accidents from exceeding the guidelines of 10CFR100. A description of the Radioactive Waste Disposal System is included in Section 9. The effects of potential accidents, including a loss-of-coolant accident, are analyzed in Section 14.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.6-1

1.6 REFERENCES

1. Atomic Energy Commission Proposed Rule Making, Part 50 - Licensing of production and utilization facilities; general design criteria for nuclear power plant construction permits, Federal Register 32, no. 132 (July 11, 1967):

10213. [NRC Accession Number: ML043310029]

2. American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section III, Appendix G, Protection Against Nonductile Failure.

3. American Society for Testing and Materials, E185 - Recommended Practice for Surveillance Tests on Structural Materials in Nuclear Reactors.

4. Institute of Electrical and Electronics Engineers, IEEE-279, Proposed IEEE Criteria for Nuclear Power Plant Protection Systems, 1968.

5. Atomic Energy Commission Safety Evaluation, dated September 28, 1972.

6. Letter, E.A. Wiggin (Atomic Industrial Forum) to Reactor Safety Committee, Comments of Forum Committee on Reactor Safety on AECs Proposed Construction Permit Criteria, October 2, 1967.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37 Page 1.6-2

THIS PAGE IS LEFT INTENTIONALLY BLANK

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-1 Auxiliary, Emergency, and Waste Disposal System Shared Systems

Engineered System Section Reference Safeguard Related

CVCS Boron Makeup and Recovery Subsystem 10.2.3 Yes

Component Cooling System 10.4.2 Yes

Spent Fuel Pool Cleanup and Cooling System 10.2.2 No

Fuel Handling System 10.2.1 No

Cooling Water System 10.4.1 Yes

Radioactive Waste Control System 9.1 No

Auxiliary Building Special Ventilation System 10.3.4 Yes

Fire Protection System for Other Than Class I Areas 10.3.1 No

Condensate Polishing System 11.8 No

Circulating Water System 11.5 No

Station Air System 10.3.10 No

Control Room Air Conditioning System 10.3.3 Yes

Steam Exclusion System App. I No

Safeguards Chilled Water System 10.4.3 No

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 1 of 8 Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Chemical Boric Acid Storage of 3 Three tanks are provided Yes No Simultaneous shutdown of 2 N/A and Tanks boric acid for with one tank aligned to (See Note 1) both units. (See Note 2)

Volume refueling each unit and the third Control shutdown tank as a spare. Each System unit-designated tank has sufficient boric acid solution to achieve Mode 5, Cold Shutdown for that unit. However, to meet surveillance procedures for readily-available quantities of boric acid to meet Cold Shutdown requirements, credit may be taken for the portion of the available standby tank not reserved for the opposite unit.

Batching Tank Makeup of 1 One tank is provided for No No N/A N/A N/A fresh the two units. (See Note 2) concentrated boric acid solution.

Hold-up Tanks Storage of 3 Three tanks are provided No No N/A N/A N/A dilute boric to handle the rejected acid prior to chemical shim solution recycle from all expected processing. operating and start-up transients for two unit plant operation Recirculation Handling of 1 Serves the common No No N/A N/A N/A Pump tank inventory hold-up tanks.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 2 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Gas Stripper Pumping of 3 Three pumps are No No N/A N/A N/A Feed Pumps chemical shim provided, each with solution to be sufficient capacity to processed supply water for using ion processing.

exchangers and filtration or evaporation.

Evaporator Remove 4 Cation and anion No No N/A N/A N/A Feed Ion significant demineralizers are Exchanger contaminants operated as necessary to from the achieve the desired process contaminant removal stream. efficiencies.

Gas Stripper When 2 Two processing No No N/A N/A N/A Boric Acid operating, packages serve as Evaporator process used common equipment for Packages chemical shim the two units. When in solution to service, each package produce will normally be operated concentrated separately. Capability boric solution exists for processing and distillate either unit with one for reuse or package.

release.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 3 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Monitor Tanks Reservoirs for 3 Three monitor tanks are No No N/A N/A N/A processed provided to collect the water for water processed from analysis prior the CVCS Holdup Tanks.

to release or Each tank is sized to reuse. hold the condensate produced by one evaporator in approximately eight hours.

Monitor Tank Pump water 2 Two pumps are provided No No N/A N/A N/A Pumps from the with adequate capacity monitor tanks to handle both units.

to the river or One pump serves as a for reuse. spare to the other.

Evaporator Remove 2 Two demineralizers are No No N/A N/A N/A Condensate impurities from provided, each with Demineralizers processed sufficient capacity to water. serve both units. One resin bed serves as a spare to the other.

Reactor Storage of 4 Four tanks are provided, No No N/A 2 N/A Makeup Water clean makeup each adequately sized to Storage Tank water serve one unit.

Reactor Supply 4 Two pumps are provided No No N/A 2 Yes Makeup Miscellaneous for each unit, each with Pumps reactor sufficient capacity to makeup serve needs of one unit.

The other two pumps serve as backups to the first two.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 4 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Auxiliary Component Intermediate 4 Four exchangers are Yes Yes The recirculation phase of the 2 Yes Coolant Cooling Heat heat provided to serve both post LOCA condition in one system Exchangers exchanger units. Except to speed unit with a simultaneous Mode between cooldown, only one 3, Hot Standby condition in the cooling water exchanger is required second unit.

and per unit. Normally, each component units component cooling cooling water. system operates independently although provision to cross-tie is made.

Component Circulate 4 Four pumps are Yes Yes The recirculation phase of the 2 Yes Cooling Water component provided. One pump will post LOCA condition in one Pumps cooling water provide adequate unit with a simultaneous Mode for circulation to cool each 3, Hot Standby condition in the miscellaneous unit. One additional second unit.

services in pump is provided for both units. each unit to serve as a spare.

Component Surge and 2 One tank is provided for No No N/A N/A N/A Cooling Surge head tanks for each unit. These tanks Tanks component can be isolated if cooling water required.

loop.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 5 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Waste Each containment structure has its own reactor coolant drain tank with Disposal 2 pumps, and containment sump. All other waste disposal equipment is in the common auxiliary and services buildings. This shared equipment includes:

Laundry and Hot Shower Tank, 1 Yes No N/A N/A N/A Chemical Drain Tank, Sump Tank, Waste Holdup Tank, Gas Decay Tanks, Waste Condensate Tanks, Waste Condensate Pumps, Waste Gas Compressor, Waste Evaporator Train, Drumming Station, Baling Station, Gas manifolds, Gas Analyzer, and Decontamination Area

Cooling Screen House Environment 1 A common screen house Yes Yes The recirculation phase of the See Cooling Yes Water and Headers for Cooling is provided for the two post LOCA condition in one Water Pumps System Water units unit with a simultaneous Mode Pumping 3, Hot Standby condition in the Equipment second unit.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 6 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Cooling Water Provide 5 Five cooling water Yes Yes The recirculation phase of the 1 Yes Pumps cooling water pumps, two direct diesel post LOCA condition in one for common engine driven and three unit with a simultaneous Mode component electric motor driven, are 3, Hot Standby condition in the cooling loop, provided to supply water second unit the to the dual, common loop containment piped system for the two ventilation units. Normally, two cooling fans, motor driven pumps will and supply both units; the miscellaneous additional pumps provide loads in the increased capacity when Turbine and required. In the loss of Auxiliary auxiliary A.C. case, the Building. diesel engine driven pumps and/or the vertical electric motor driven pump connected to the diesel generator are the source of cooling water

Fire The Fire Protection System, utilizes water spray, cardox, halon, hose No N/A N/A N/A N/A Protection lines and sprinklers which are actuated by fusible heads, rate of rise detectors, thermal detectors, smoke detectors or ionization detectors to combat fire. Portable extinguishers are also provided extensively throughout the plant facilities. This system is designed to extinguish any probable combination of simultaneous fires which might occur at the station. The shared equipment includes:

Fire Pumps (121 and 122)

Jockey Pump Sprinkler System Screen Wash Pump

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 7 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Aerated The Aerated Drains Treatment system receives radioactive, aerated, N/A N/A N/A N/A N/A Drains liquid waste and treats it so that it can be returned to the plant as Treatment make-up water or be discharged to the river. The shared equipment (Liquid includes:

Waste Disposal)

ADT Collection Tanks and Pumps ADT Condensate Receiver Tanks and Pumps ADT Monitor Tanks and Pumps ADT Miscellaneous Drains Collection Tank and Pump ADT Ion Exchangers ADT Sump Tank and Pump Cask Wash Down Area Sump Pump ADT Filters ADT Evaporators

Condensat A condensate polishing system is provided for both units. Each unit N/A N/A N/A N/A N/A e Polishing has its own filter/demineralizers. The backwash and flush water subsystem is cross-tied, and the backwash air supply , spent resin disposal, and resin disposal building (RDB) sump equipment is sized to service both units. The shared equipment includes:

Backwash Waste Clamshell Filters Backwash Air Compressors and Receivers Spent Resin Transfer Tank Spent Resin Transfer Pump RDB and Truck Area Sumps

Station Air A common station air system supplies the instrument and service air N/A N/A N/A N/A N/A (Instrument requirements for both units. Each unit has its own instrument air dryer and and instrument air header. The IA headers are cross-tied. The shared Service Air) equipment includes:

Air Compressors Moisture Separators Aftercoolers Air Receivers

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-2 SHARED COMPONENTS REQUIRED FOR NORMAL PLANT OPERATION

Page 8 of 8

Ability to Tolerate Under Emergency (and Shutdown Quantity Emergency Conditions where Associated) Required to Either Maintenance of a Serves Serves Conditions Which Make the Meet the Single Item of Equipment Components Quantity Shutdown Emergency Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Safeguard Chillers Supply chilled 2 Yes Yes LOOP with concurrent SBO in 1 Train Yes Chilled water to unit other unit Water coolers in System safety related compartments for localized heat removal

Notes for Table 1.3-2

(1) Boric acid injection affords back up reactivity shutdown capability, independent of control rod clusters which normally serve this function in the short term situation.

(2) N/A Not Applicable, i.e., Serves No Emergency Function.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-3 SHARED COMPONENTS NOT REQUIRED FOR NORMAL PLANT OPERATION

Page 1 of 3

Emergency Ability to Tolerate Under (and Shutdown where Quantity Emergency Conditions Associated) Required to Either Maintenance of a Single Serves Serves Conditions Which Make Meet the Item of Equipment Components Quantity Shutdown Emergency the Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component

Spent Spent Fuel Purification of 1 One demineralizer Yes No N/A N/A N/A Fuel Pool Pool the spent fuel is provided. See Note (1)

Cooling Demineralizer pool water and refueling water

Spent Fuel Purification of 3 Three filters are Yes No N/A N/A N/A Pool Filter the spent fuel provided. See Note (1) pool water and refueling water.

Spent Fuel Cooling Spent 2 One heat exchanger Yes No See Note (2) See Note (3) See Note (4)

Pool Heat Fuel Pool has sufficient See Note (1)

Exchanger Water capacity to maintain reasonable pool temperatures when handling the design basis normal heat load See Note (2).

A redundant heat exchanger is provided to protect against a loss of heat removal capacity due to a failure of the operating heat exchanger

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-3 SHARED COMPONENTS NOT REQUIRED FOR NORMAL PLANT OPERATION

Page 2 of 3

Emergency Ability to Tolerate Under (and Shutdown where Quantity Emergency Conditions Associated) Required to Either Maintenance of a Single Serves Serves Conditions Which Make Meet the Item of Equipment Components Quantity Shutdown Emergency the Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component Spent Fuel Recirculation 2 One pump has the Yes No See Note (2) See Note (3) See Note (4)

Pool Pump of spent fuel capacity to maintain See Note (1) pool water. pool temperatures when handling the design basis normal heat load.

Fuel Spent Fuel Storage of 2 Two common pools Yes No N/A N/A N/A Handling Storage Pool spent fuel are provided with See Note (1)

System elements from adequate rack refueling until storage space to shipment. meet the requirements of two units.

New Fuel Storage of 1 A common area with No No N/A N/A N/A Storage Area new fuel new fuel storage elements from rack is provided with delivery until adequate space to loading into serve both units.

the reactors.

PRAIRIE ISLAND UPDATED SAFETY ANALYSIS REPORT USAR Section 1 Revision 37

TABLE 1.3-3 SHARED COMPONENTS NOT REQUIRED FOR NORMAL PLANT OPERATION

Page 3 of 3

Emergency Ability to Tolerate Under (and Shutdown where Quantity Emergency Conditions Associated) Required to Either Maintenance of a Single Serves Serves Conditions Which Make Meet the Item of Equipment Components Quantity Shutdown Emergency the Maximum Demands Maximum or Failure of one System Shared Function Provided Explanation Function Function on the System Demand Active Component Spent Fuel Transfer of 1 A common bridge is Yes No N/A N/A N/A Pool Bridge fuel elements provided serving the between common spent fuel storage and pool.

the fuel transfer system.

Notes for Table 1.3-3 (1) Operation of the Spent Fuel Handling and Disposal System is only required when the shutdown is for refueling purposes.

(2) The design basis abnormal or faulted heat load (See 10.2.2.3).

(3) Two pumps and two heat exchangers will maintain the pool water temperature with acceptable limits (See 10.2.2.3).

(4) Assuming the failure of one pump or one heat exchanger, the pump(s) and heat exchanger(s) remaining will still maintain the pool water temperature within acceptable limits (See 10.2.2.3).

1 2 3 4 5 6 7 8 9 10 11 12

REVISIONS

H AS BUILT-

ADD LEGEND DATA FOR GLOBE VALVE A WITH FLOW OVER SEAT A

PER DRR PI-93-183

DWN: KLH 8-12-93 CHK'D: GDP 8-12-93

MOD#:

FILMED: 8-26-93 76 AS BUILT-

COMPLETE REDRAW TO INCLUDE MORE COMPRE-HENSIVE SET OF SYMBOLS.

PER DRR PI-08-037

DWN: JLB 5-2-08 INSTRUMENTATION VALVES PIPING SPECIALTIES EQUIPMENT FIRE PROTECTION MISCELLANEOUS CHK'D: CMR 5-30-08 MOD#: EC-12653 FILMED: 6-08 INSTRUMENT LINE SYMBOLS SYMBOL DESCRIPTION SYMBOL DESCRIPTION SYMBOL DESCRIPTION SYMBOL DESCRIPTION SYMBOL DESCRIPTION 77 AS BUILT-

ADDED (2) NEW SYMBOLS TO REPRESENT REGULATOR VALVE.

B INSTRUMENT PRIMARY PIPING 3-WAY VALVE ANNUBAR AIR RELEASE VALVE WALL B ARROWS SHOW PER DRR PI-18-102 INSTRUMENT PNEUMATIC CONTROL LINES FAILURE MODE ACCUMULATOR ANGLE DRAIN VALVE DWN: LAB 2-21-19 BLIND FLANGE OR CHK'D: RSA 3-21-19 INSTRUMENT ELECTRICAL LINES 4-WAY VALVE TEMPORARY CONNECTION MOD#: 601000000989 APP'D: DB 3-21-19 INSTRUMENT CAPILLARY LINES BLANK FLANGE 78 AS BUILT-BUTTERFLY VALVE "78" WITH POST INDICATOR ADDED NEW SYMBOL TO L L L L L INSTRUMENT HYDRAULIC LINES CAP -THREADED REPRESENT A BLANK AIR CYLINDER ACTUATOR A FLANGE.

CAP -WELDED BLENDER CHECK VALVE -ALARM INSTRUMENT GRAPHIC SYMBOLS ANGLE VALVE PER DRR PI-19-278

DWN: LAB 12-19-19 DIAPHRAGM SEAL DELUGE VALVE CHK'D: KF 12-19-19 WESTINGHOUSE FURNISHED DAMPER - CONTROL MOD#: 601000001986 BALL VALVE DRAIN TO SUMP APP'D: DB 12-20-19 TRANSMITTER TRANSMITTER

21001 P.S.&E. TAG NO. DRAIN FUNNEL DAMPER - MOTOR A BELLOWS SEAL FDP FIRE DETECTION PANEL C C PANEL MTD BUTTERFLY VALVE FAN, BLOWER OR PANEL ELEC. SWITCH MOUNTED EDUCTOR COMPRESSOR WITH LAMPS CAPPED STEM FIRE HOSE RACK 1 LAMP 2 LAMPS 3 LAMPS 4 LAMPS WITH FOG NOZZLE CHECK VALVE HEATER LOCAL EXPANSION JOINT (STEAM OR ELECTRICAL)

LOCAL PANEL / LOCAL MOUNTED MOUNTED RACK (DUAL OUTPUT) CHECK VALVE F FILTER HYDRANT & HOSE HOUSE (SPRING LOADED)

FLANGE CONNECTION O.S. & Y. GATE VALVE CONTROL VALVE (PIPING OR EQUIPMENT)

INDICATOR LAMP (AIR DIAPHRAGM OPERATED) SERVICE WTR HOSE STATION FLEX CONNECTION WITH VALVE & COUPLING HEAT EXCHANGER 1-LAMP 2-LAMP DIAPHRAGM VALVE (ANY TYPE) SPRINKLER -PENDANT FLOW NOZZLE D CONTROL DAMPER SPRINKLER -UPRIGHT D CONTROL VALVE WITH PANEL MTD EXTENSION STEM FLOW ORIFICE MOTOR OPERATED DAMPER INDICATING LIGHTS OPERATOR WATER FLOW ALARM

MOTOR OPERATED VALVE (PADDLE TYPE)

HOSE OR TUBING FLOAT CHECK VALVE WATER FOG NOZZLE

SOLENOID VALVE HOSE CONNECTION M

MIXER FOOT VALVE JOHNSON SCREEN (AIR OR ELECTRICAL)

CONTROL DRIVE OR TEMPERATURE ELEMENT GATE VALVE LINE CODING LOOP SEAL (TRAP)

GATE VALVE (DOUBLE DISC) PROPELLER FAN DARK BAND INDICATES P&ID'S & PROCESS FLOW DIAGRAMS INPUT TO COMPUTER GLOBE VALVE QUICK DISCONNECT

CATEGORY I-HAND WHEEL OPERATOR REDUCER -

E INSTRUMENT CODES PUMP -CENTRIFUGAL VENTILATION ZONE E

10-2MS-18 10

A - ALARM LM - LIQUID MONITOR INSTRUMENT ACTUATED RUPTURE DISC C - CONTROLLER LS - LIMIT SWITCH ( I I )-- ( I I I )---

OPERATOR WITH PUMP -POSITIVE PIPE SIZE LINE NUMBER -- ---

D - DRAFT MD - MOTOR OPER DAMPER VALVE POSITIONER DISPLACEMENT UNIT 2 SYSTEM F - FLOW MS - HUMIDITY SWITCH DENOTES LIMITS OF Q.A. TYPES H - HYDROGEN MV - MOTOR ACTUATED VALVE M SG SIGHT GLASS PRIMARY FLOW LINES (2 & LARGER)1/

I - INDICATOR OT - ORSAT TEST MOTOR OPERATOR 2 L - LEVEL PB - PUSHBUTTON STATION -OUT OF SYSTEM DASHED M - MANOMETER PH - HYDROGEN-HYDROXYL CONCN NEEDLE VALVE SPARGER 1 (INSIDE VESSEL) SECONDARY FLOW LINES (UNDER 2 )/2 O - OXYGEN PM - POSITION MOVEMENT -OUT OF SYSTEM DASHED P - PRESSURE PQ - POWER SUPPLIES PLUG VALVE PUMP -VERTICAL SHAFT

R - RECORDER PS - PRESSURE SWITCH INSIDE OUTSIDE S - SMOKE PT - PRESSURE TEST SPECTACLE FLANGE SHIELD WALL PENETRATION T - TEMPERATURE RE - RADIATION ELEMENT QUICK HAND ACTUATOR

V - VACUUM RM - RADIATION MONITOR R SPRAY NOZZLES F AM - AREA MONITOR SD - SMOKE DETECTOR REMOTE MANUAL ACTUATOR (INSIDE VESSEL) SS CS F A/S- AIR SUPPLY SP - SPEED MATERIAL TRANSITION PIECE

CB - COMBUSTIBLES SV - SOLENOID VALVE CC - CONDUCTIVITY CELL TD - TEMPERATURE DIFFERENTIAL SAFETY AND RELIEF VALVE T STEAM TRAP ELECTRICAL HEAT TRACING

CD - CONTROL DAMPER TE - TEMPERATURE ELEMENT (T/C RTD)

CS - CONTROL STATION TM - TELEVISION MONITOR STRAINER 2 2 S

CV - CONTROL VALVE TS - TEMPERATURE SWITCH STEAM GENERATOR QUALITY ASSURANCE TYPE CY - CONDUCTIVITY TT - TEMPERATURE TEST SELF CONTAINED (PIPE OR EQUIP. QA TYPE 2)

REGULATOR STRAINER (Y-TYPE)

DP - DIFFERENTIAL PRESSURE TU - TRIP UNIT ES - ELECTRICAL SWITCH TV - TRANSFER VALVE 2 1 SHUT-OFF VALVE QUALITY ASSURANCE TYPE FE - FLOW ELEMENT DOA - DISSOLVED OXYGEN ANALYZER CHANGE (VALVE & DOWN-FM - FISSION PRODUCT MNTR HUM - HUMIDITY THERMAL SLEEVE STREAM PIPE QA TYPE 1)

FS - FLOW SWITCH S/CV- SIGNAL CONVERTER S FT - FLOW TEST SER - SEQUENCE OF EVENT RECORDER SOLENOID OPERATOR SEISMIC ANCHOR IL - INDICATING LAMP VBD - VIBRATION DETECTOR VACUUM BREAKER LD - LEAK DETECTOR G STEM LEAKOFF (ROUTED) TANK -ATMOSPHERIC

STOP CHECK VALVE SEISMIC ENDPOINT VENT TO ATMOSPHERE

THROTTLE VALVE TANK -OR VESSEL VESSEL MANWAY PRESSURIZED ABBREVIATIONS

REGULATED VALVE DA - DELUGE SYSTEM AUTOMATIC DM - DELUGE SYSTEM MANUAL VALVE INSTALLED WITH FS - FLOW SWITCH (PADDLE TYPE) This map / document is a tool to assist employees in the performance of their jobs. Your personal safety is provided for FLOW OVER THE SEAT HH - HYDRANT & HOSE HOUSE by using safety practices, procedures and equipment as described in safety training programs, manuals and SPAR's.

DWN DATE SIGNIFICANT NO.8630 100 1 L.C.- VALVE SEALED CLOSED (WIRE SEAL) 4000 CHECKED GROUP 1 2 3 4 5 CL 6 L.O.- VALVE SEALED OPEN (WIRE SEAL)

PROJECT NO.

BLACKED-IN VALVES ARE PA - PRE-ACTION AUTOMATIC APP'D & CERT. FLOW DIAGRAM NORMALLY CLOSED SWP - STAIRWAY WET PIPE SYSTEM INSTRUMENT & VALVE LEGEND H WPS - WET PIPE SYSTEM H

FILMED NORTHERN STATES POWER COMPANYSCALENONE REV78

PRAIRIE ISLAND NUCLEAR GENERATING PLANTNF-39214 RED WING, MINNESOTA

$$USERNAME$$ NF-39214.DGNNSP GENERATION CAD

$$$$$$SYTIME$$$$$$$$$$$$SYDATE$$$$$$

$$$$$$$$$DESIGNFIL$$$$$$$$$

1 2 3 4 5 6 7 8 9 10 12

FIGURE 1.1-2 REV. 37

CAD FILE: U01102.DGN 1 2 3 4 5 6 7 8 9 10 11 12

REVISIONS

A AS BUILT-

INCORPORATE THIS DWG

INTO THE NSP DWG SYSTEM PER DWP PI-00-66 A "79" DJP4-25-00 A DWN:

CHK'D: CMR 5/3/00 PROJECT #: SPCE-ME-0383

FILMED 5/00 76 AS BUILT-

ADDED BARRIER FENCES

PER DRR PI-08-082

DWN: DMN 1-14-09

CHK'D: AA 3-27-09

MOD#: EC-12518

FILMED: 4-09

77 AS BUILT-

REMOVE DELAY FENCE NORTH See Notes & Reference drawings OF INTERSECTION POINT W/

NEW EAST/WEST PA FENCE

PER EC-18326

DWN: KJF 1-16-12 B CHK'D: TEO 1-24-12B New AS BUILT-

ADDED RAZOR WIRE EAST Admin OF PLANT PA FENCE.

Building

PER DRR PI-11-241 Chlorine DWN: KJF 1-16-12

CHK'D: TEO 1-24-12 House Screenhouse MOD#: EC-17242

APP'D: CMR 1-25-12

78 AS BUILT-

REVISED TO ADD THE SAF Light Fuel Oil & (SECURITY ACCESS FACILITY)

Pole Transfer House & EXPANDED PA FENCING,

REMOVE BARRIER FENCING &

Overhead Overhead REFERENCE TO RAZOR WIRE SECURITY & ASSOCIATED DETAILS AS ACCESS Overhead Power Power DIRECTED BY SECURITY Power Approx. 20 Ft. Lines Lines FACILITY Skyway Lines PER DRR PI-11-252 C Approx. 100 Ft. DWN: KJF 6-18-12 C

CHK'D: JCL 6-21-12

MOD#: EC-15220

APP'D: CMR 7-2-12 Sw. Old Sw. 79 AS BUILT-Stand Administration Stand Xfmr Xfmr Xfmr Xfmr UPDATED NW CORNER OF PA Building PER SECURITY UPGRADE.

Xfmr (M) (R) (R) (M) Xfmr Hydrogen INCORPORATED FCR

601000001465-052.

(GT) Oil Storage (GT) Stg. Area PER DRR PI-20-075

DWN: JEK 12-1-20 Trans. CHK'D: TPB 12-1-20 Oil Security `594,350N 594,350N MOD#: 601000001465

APP'D: DB 12-2-20 Sump Guardhouse 2,355,675E 2,356,115E Security Turbine Building Gas Diesel House Bldg.

D Cond. D Security Cable Trench Covers: Stg.

Boric Acid Storage Tank

Tank Room Below

D5 / D6 Unit 2 Unit 1 Service Building Auxiliary Auxiliary Building

D5 / D6 Fuel Oil Building Building Water Rcvng Tank Treat. Sulfuric Acid Area Tank Encl

E E Cond Stg Unit 2 Unit 1 Waste Neut.

Tanks Reactor Reactor Tank House Building Building

Fire Protection hydrant houses:

Emerg. Gen.

Building

Spent Fuel Storage 594,000N Enclosure below Rad Waste F 2,355,500E Building No. 2 F Warehouse LLRW Drum Storage Resin Disp. Bldg Drum Transfer

& Truck Loading

Security fence restrictions:

No vehicles or materials stored Construction within 10 feet of fence. Fab Shop

G End of Paved Road Reference Drawings No. 1 Warehouse Security Fence Details - NF-85530-1 Thru 10.

Notes

1) - Denotes PA Fence

2) See Dwg. NF-85530-2 Detail "E" For Post Installation .

3) See Dwg. NF-85530-1 Thru 5 For Notes & Tolerances.

This map / document is a tool to assist employees in the performance of their jobs. Your personal safety is provided for

by using safety practices, procedures and equipment as described in safety training programs, manuals and SPAR's.

4) Non - Security Related.

DWNDB DATE3-15-00 SIGNIFICANT NO.8630 2 6200 1250 CHECKED GROUP 1 2 3 4 5 CL 6

PROJECT NO.

APP'D & CERT. PRAIRIE ISLAND SECURITY

SEE REV "A" H FENCE DRAWING H

FILMED

NORTHERN STATES POWER COMPANY SCALE" = 1' REV79

PRAIRIE ISLAND NUCLEAR GENERATING PLANTNF-85530-6 RED WING, MINNESOTA

$$USERNAME$$ NF-85530-6.DGNNSP GENERATION CAD

$$$$$$SYTIME$$$$$$$$$$$$SYDATE$$$$$$

$$$$$$$$$DESIGNFIL$$$$$$$$$

1 2 3 4 5 6 7 8 9 10 12

FIGURE 1.1-3 REV. 37

CAD FILE: U01103.DGN

USAR SECTION 01 Revision 38

Figure 1.1-5 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-6 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-7 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-8 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-9 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-10 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-11 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-12 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-13 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-14 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-15 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-16 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-17 withheld from public disclosure under 10 CFR 2.390

USAR SECTION 01 Revision 38

Figure 1.1-18 withheld from public disclosure under 10 CFR 2.390