ML050460309

Response to Generic Letter 2003-01, Control Room Habitability

ML050460309
Person / Time
Site:	Nine Mile Point
Issue date:	01/31/2005
From:	William Holston Constellation Energy Group
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
GL-03-001, NMPIL 1918, TAC MB9825, TAC MB9826
Download: ML050460309 (59)

Text

Constellation EnergyP RO. Box 63 Nine Mile Point Nuclear Station Lycoming, New York 13093 January 31, 2005 NMP1L 1918 ATTN: Document Control Desk U. S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Nine Mile Point Units 1 and 2 Docket Nos. 50-220 and 50-410 License Nos. DPR-63 and NPF-69 Response to Generic Letter 2003-0 1, Control Room Habitability (TAC Nos. MB9825, MB9826)

Gentlemen:

On June 12, 2003, the NRC issued Generic Letter (GL) 2003-01, "Control Room Habitability," requesting all addressees to submit information demonstrating that the control rooms at their facilities comply with current licensing and design bases, applicable regulatory requirements, and that suitable design, maintenance, and testing control measures are in place for maintaining this compliance. GL 2003-01 requested that the above information be forwarded within 180 days of the issuance date of the GL.

Alternatively, for addressees who could not meet this schedule, GL 2003-01 requested a 60 day response describing the addressee's proposed alternative course of action, the basis for acceptability, and the schedule for completion.

By letter dated August 11, 2003 (NMP1L 1752), Nine Mile Point Nuclear Station, LLC (NMPNS), provided the 60 day response to the GL for both Nine Mile Point Unit 1 (NMP1) and Unit 2 (NMP2). Attachment 2 to that letter provided a list of all regulatory commitments contained in the correspondence including a commitment to perform tracer gas testing by March 31, 2004, and to prepare and submit the responses to Items 1, 1(a),

1(b), 1(c), 2 and 3 of GL 2003-01 by December 31, 2004. By letter dated December 28, 2004 (NWP1L 1907), NMPNS notified the NRC that the responses to Items 1, 1(a), 1(b),

1(c), 2 and 3 of GL 2003-01 would be submitted by January 31, 2005.

The NMP 1 tracer gas test was performed in February 2004. By letter dated March 29, 2004 (NMP2L 2115), NMPNS informed the NRC that the commitment date to perform the NMP2 tracer gas test was revised from March 31, 2004 to September 30, 2004. The NMP2 tracer gas test was subsequently performed in August 2004.

W t0

Page 2 NMP1L 1918 The purpose of this letter is to submit the NMPNS responses to Items 1, 1(a), 1(b), 1(c), 2 and 3 of GL 2003-01. Attachments I and 2 provide the required responses for NMPI and NMP2, respectively. Attachment 3 provides a list of all regulatory commitments contained in this correspondence, including the schedule for completion. Attachment 4 provides a copy of the NMP1 principal design criteria and a comparison to the General Design Criteria of Appendix A to 10 CFR 50.

Very truly yours, William C. Holston Manager Engineering Services WCH/JJD/RF Attachments cc:

Mr. S. J. Collins, Regional Administrator, Region I Mr. G. K. Hunegs, NRC Senior Resident Inspector Mr. P. S. Tam, Senior Project Manager, NRR (2 copies)

ATTACHMENT 1 GENERIC LETTER 2003-01, CONTROL ROOM HABITABILITY RESPONSES TO REQUESTED INFORMATION NINE MILE POINT UNIT I Requested Information

1.

Provide confirmation that your facility's control room meets the applicable habitability regulatory requirements (e.g., GDC 1, 3, 4, 5, and 19) and that the control room habitability systems (CRHSs) are designed, constructed, configured, operated and maintained in accordance with the facility's design and licensing bases.

Nine Mile Point Unit 1 (NMP I) Response Design Function The primary function of the control room air treatment (CRAT) system is to maintain habitability within the control room during normal and accident conditions. The CRAT system provides heating and cooling to the control complex for personnel comfort and control instrument protection. It provides clean uncontaminated air to the control complex, monitors radiation levels at the fresh air intake to automatically filter any contaminated outside air entering the system, maintains positive pressure in the control complex relative to the surrounding area and the outside environment and removes smoke and heat from the control complex and the cable spreading room in the event of a fire.

The control room emergency ventilation portion of the CRAT system (also known as the control room emergency ventilation system, or CREVS) provides for the monitoring of radiation levels at the outside air intakes and automatically filters contaminated outside air through the high efficiency particulate air filters and charcoal adsorbers upon a loss of coolant accident (LOCA) or a main steam line break (MSLB) signal, or the detection of high radiation. This emergency ventilation portion can also be manually initiated for cases such as toxic chemical releases. There are no specific functional requirements on the CRAT system during a station blackout event since there is no immediate threat to the control room, reactor operation or refueling operation for a limited period of time.

Provisions exist to power the cooling, ventilation and heating units from the emergency diesel generators.

The control complex consists of three separate areas; the main control room area with restroom, kitchen and office, the adjacent instrument shop, and the auxiliary control room with enclosed computer room. The CRAT system has a return/recirculation duct for each of the three areas. The supply and return duct in the main control room and the instrument shop have manual or remote balancing dampers to balance air flow throughout the complex. The emergency ventilation system contains high efficiency particulate air (HEPA) filters with a minimum efficiency of 99% on removing 0.3 microns and larger particles; it also includes a bank of activated charcoal filters. The filtered air is Page 1 of 10

discharged from the filter units and mixed with recirculated air before being discharged into the control complex supply. In case of fire in the control complex or cable spreading room, the CRAT system is equipped with a smoke purge system which, upon manual initiation, will provide relief from smoke and excessive heat in the affected area.

The control room normal ventilation mode is operated with the outside air and recirculated air mixture passing through one roughing filter unit and an 85% dust efficiency filter unit, cooled by one of two redundant chilled water cooling coils and exhausted to the control complex by the control room recirculating fan. The minimum air flow of 14,500 scfm is provided by a fan to maintain a control complex temperature of approximately 750F; however, during design basis outdoor conditions, the control room could reach 80.5°F. The system maintains a positive design pressure within the control complex relative to the outside atmosphere and surrounding areas of greater than 1/16 inch water gauge, minimizing inleakage of outside unfiltered air into the control complex.

The CRAT system switches to the emergency ventilation mode upon a LOCA or a MSLB signal, upon high radiation indication from either of two radiation monitors installed in the outside air inlet ductwork, or upon manual initiation. Upon initiation by any of the above conditions, the two outside normal mode blocking valves will close and one of two redundant emergency ventilation fan trains will actuate to provide 2250 scfm (+/-10%) of filtered make up air to the control room/ventilation system and a positive pressure inside the control complex relative to the surrounding areas and outside atmosphere. This mode utilizes the normal ventilation system to provide heating and cooling of the control complex.

CRAT operability is verified periodically by performance of technical specification surveillance testing and inservice examination. Functional verification is performed by measuring the combined pressure drop across the HEPA and charcoal filter banks with each CRAT fan operating at design flow rate and demonstrating that a 1/16 inch water gauge positive pressure differential can be maintained relative to adjacent areas. HEPA and charcoal filter efficiencies are verified by in-place testing as well as lab testing of charcoal bed samples. Control room chiller system components are included in the inservice testing program. Actuation signals indicative of a LOCA or MSLB are also verified.

Licensing Basis The construction permit for NMiPI was issued on April 12, 1965. Thus, the principal design criteria used at NMP1 were developed prior to publishing draft principal design criteria by the Atomic Energy Commission. Section l.A of the NMP1 Updated Final Safety Analysis Report (UFSAR) lists the principal design criteria used for the design of NMP1, which are oriented toward the twenty-seven criteria issued by the Atomic Energy Commission on November 22, 1965. The original licensing criteria for the CRHSs were stipulated in the Final Safety Analysis Report with all applicable supplements and addendums. The NMPl Technical Supplement to Petition for Conversion from Provisional Operating License to Full-Term Operating License, dated July 1972 provided a discussion of the NMP1 conformance to the Niagara Mohawk Power Corporation's Page 2 of 10

(NMAPC, the licensee for NMP1 at that time) interpretation of the intent of the General Design Criteria (GDC), including GDCs 1, 3, 4, 5 and 19.

In response to NUREG-0737, Three Mile Island (TMI) Action Plan Item III.D.3.4 "Control Room Habitability Requirements," a control room habitability study was performed. Based on aNRC staff review, in a letter dated March 28, 1983, NMPC committed to make modifications which would establish an acceptable degree of compliance with GDC 19, specifically the single failure criterion. The modifications were the installation of redundant emergency intake dampers, redundant normal intake isolation dampers, redundant cooling water coils and redundant radiation monitors in the normal intake. In addition, NMPC committed to provide additional self contained breathing apparatuses (SCBAs) within the control room. By letter dated May 21, 1984, the NRC provided its safety evaluation (SE) for NMIP1 on TMI IlI.D.3.4. In the SE, the NRC stated that the proposed modifications were sufficient to meet the staff's single failure criterion. The NRC staff also concluded that the calculations of control room operator doses following design basis accidents provided for review would be within GDC 19 guidelines and were acceptable.

On May 2, 1998, NMPC submitted an emergency license amendment request to modify the initiation instrumentation for the CRAT system due to a revised analysis which concluded that the control room radiation monitors located in the intake duct of the control room ventilation system would not automatically initiate during a LOCA and that the technical specification set point for the monitors would not provide assurance that personnel occupying the control room during a MSLB would not receive exposures in excess of GDC 19 guidelines. In lieu of utilizing the radiation monitors, NMPC proposed to automatically initiate the CRAT system on either a MSLB or LOCA signal from the reactor protection system. The NRC approved this change with Technical Specification Amendment (TSA) 161, issued on May 23, 1998. The NRC did require that the radiation monitors remain in use, although no longer credited to initiate the CRAT system.

As part of TSA 161, the NRC added a license condition 2C(4) requiring NMPC to submit a license amendment request by December 18, 1998, with proposed methods for complying with GDC 19 dose guidelines without relying on the use of potassium iodide (KI). A revised dose analysis was submitted on December 18, 1998, as required. This dose analysis is considered the current licensing/design basis analysis. Since license condition 2C(4) remains in effect, KI is currently maintained in the control room available for operator use even though its use is not credited in the revised dose analysis.

By letter dated August 23, 2000 (NMP1L 1528), NMPC did notify the NRC that it may utilize alternative methods to address satisfaction of the GDC 19 dose guidelines in the future.

As such, the NMP 1 control room and CRHSs are designed, constructed and configured in conformance with its licensing basis. Administrative programs for control of design changes, quality assurance and procedure revisions are in place to ensure that NMP1 is operated and maintained in accordance with its design and licensing basis.

Page 3 of 10

As discussed further below, tracer gas testing results have shown that the NMP 1 control room has not been maintained in accordance with its design and licensing basis and that corrective action, reanalysis of the radiological dose consequences to control room operators, is necessary. The Generic Letter 91-18 analyses developed after obtaining the tracer gas test results conclude that compensatory measures are not necessary. However, as required by License Condition 2C(4), KI tablets are available for operator use.

Requested Information 1(a)

Emphasis should be placed on confirming that the most limiting unfiltered inleakage into your CRE (and the filtered inleakage if applicable) is no more than the value assumed in your design basis radiological analyses for control room habitability. Describe how and when you performed the analyses, tests, and measurements for this confirmation.

NMPI Response Prior to tracer gas testing of the control room envelope (CRE), potential sources of inleakage were identified and evaluated. Items walked down and evaluated included door seals, pipe and conduit penetrations and seals, duct seams, dampers, structural joints and heating, ventilation and air conditioning (HVAG) access doors. As a result, door seals were adjusted, several conduits were resealed, a check valve was installed in the drain line from the air handling unit, and cracks in masonry walls were caulked. In addition, several vent locks were installed to support the tracer gas testing. The CRE was also surveyed for positive pressure to ensure that the ventilation system was properly balanced.

The test methodology used for the tracer gas tests was the constant injection method of the American Society for Testing and Materials (ASTM) standard E741-00, "Standard Test Method for Determining Air Change in a Single Zone by Means of a Tracer Gas Dilution." For the constant injection method, a constant flow of tracer gas is injected into the CRE until the resulting concentration in the envelope reaches a steady state value.

This occurs when the amount of tracer gas entering the CRE is the same as the amount leaving the CRE. By injecting the tracer gas in the outside air flow used for pressurization of the envelope, an estimate of the filtered and unfiltered airflow that provides this pressurization airflow can be made by measuring the concentration of tracer gas in the outside airflow while at the same time measuring the steady state concentration in the CRE. During performance of the inleakage tests, ingress and egress to/from the CRE was minimized.

A characterization test of the CRE with the ventilation system operating in the normal mode and with air handling unit (AHU) fan motor 11 operating was performed on February 18, 2004. The purpose of this test was to assure that the CRE could be treated as a single zone, a requirement for ASTM E741. This was accomplished by taking gas samples throughout the envelope following injection of a "puff' of tracer gas (Sulfur Page 4 of 10

Hexafluoride, SF6) that raised the concentration of tracer gas in the envelope to a target value. Analysis of samples taken throughout the CRE was then performed to confirm the spatial uniformity of tracer gas concentrations in the envelope. The results from the analyses of these samples indicated that the CRE could be considered as a single zone. A constant injection flow of tracer gas was maintained after this "puff." The constant injection tracer gas flow that was used was based on an earlier Pitot tube traverse measurement of the outside airflow and the same target tracer gas concentration used for the "puff."

CRE inleakage tests were performed with CREVS Fan 11 and then with CREVS Fan 12 in operation on February 19, 2004. Using the constant tracer gas injection technique, when the concentration in the return air from the CRE was judged to be at equilibrium, a series of timed samples was taken. During normal mode operation, the return airflow from the control room (CR) was sampled for tracer gas concentration. During emergency mode operation, the CR return airflow and the outside airflow were sampled for tracer gas concentration. The flow rate of tracer gas injected into the CRE divided by the average CR return airflow concentration allowed the total inleakage to be calculated for the normal mode. For the emergency mode, the outside airflow (CREVS airflow) multiplied times the ratio of the average outside airflow tracer gas concentration to the average CR return airflow tracer gas concentration allow the total inleakage to be calculated. The difference between the total inleakage airflow and the CREVS airflow provided a measure of the unfiltered inleakage over this measurement period. Tracer gas leakage test results are summarized in the Table I below:

Table 1 Summary of Control Room Inleakage Test Results Mode Tested Unfiltered Inleakage Normal with AHU Fan Motor 11 0 scfm CREVS Fan 11 with AHU Fan Motor 12 32 scfm CREVS Fan 12 with AHU Fan Motor 11 45 scfm The NMP1 unfiltered inleakage assumed in the design basis radiological analysis for control room habitability is 30 scfm per our submittal to the NRC dated December 18, 1998 (NMP1L 1394). Through the Nine Mile Point Nuclear Station, LLC (NMPNS) corrective action program, an evaluation based upon margin in the existing design basis radiological analyses has been developed (per Generic Letter 91-18) that shows that the guidelines of GDC 19 will be met with up to 147 scfm unfiltered inleakage. Therefore, while the unfiltered inleakage into the CRE exceeds the current design basis, compensatory measures are not required as a result of the tracer gas test results. Revision of the design bases radiological analysis for control room habitability is discussed further in the response to Item 2.

Page 5 of 10

Requested Information 1(b)

Emphasis should be placed on confirming that the most limiting unfiltered inleakage into your CRE is incorporated into your hazardous chemical assessments. This inleakage may differ from the value assumed in your design basis radiological analyses. Also, confirm that the reactor control capability is maintained from either the control room or the alternate shutdown panel in the event of smoke.

NMP 1 Response On May 21, 1984, the NRC issued a safety evaluation report on control room habitability that closed NUREG-0737 Action Plan Item Ill.D.3.4 for NMP1. Action Plan Item III.D.3.4 required that licensees provide assurance that control room operators would be adequately protected against the effects of accidental releases of toxic and radioactive gases and that the nuclear power plant can be safely operated or shut down under design basis accident conditions. The NRC concluded that the planned modifications forNMP1 (subsequently completed), along with a commitment to provide additional SCBAs in the control room, were sufficient to meet the criteria of NUREG-0737 Action Plan Item III.D.3.4 and the NRC's single failure criterion.

NUREG-0737 recommended that toxic gas accident analyses be performed for all potential chemical releases occurring either on the site or within a five-mile radius of the plant site boundary in accordance with the guidance provided by Regulatory Guide (RG) 1.78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," June 1974. As part of the response to III.D.3.4, the NRC was provided with hazardous chemical survey data from an evaluation of potential on-site and off-site accidents involving releases of toxic substances for NMP1. The results of the evaluation confirmed that the release of any identified toxic chemical within a five-mile radius would have no impact on the control room atmosphere.

Additional control room habitability evaluations were conducted for NMP1 in 1998 due to changes in the normal CRAT system ventilation rate. New toxic and potentially hazardous chemicals within a five-mile radius of NMP1 were evaluated utilizing RG 1.78 guidelines and revised ventilation intake rates. The supporting analyses assumed no isolation of the control room normal ventilation. These analyses confirmed continued control room habitability at NMP1.

Potential sources of onsite hazardous chemicals are reviewed on a routine basis via the Material Safety Data Sheet program, and the engineering design change process.

Tracer gas testing of the NMP1 CRE was conducted in February 2004. The testing results confirmed zero air inleakage for the normal control room ventilation case. A normal ventilation rate of 2530 scfm (2250 scfm +/- 10% fresh air makeup plus 30 scfm Page 6 of 10

assumed unfiltered air inleakage, to which an additional 1% is added for conservatism) is used in the hazardous chemical analysis. Therefore, the measured inleakage is appropriately bounded by the analyses for hazardous chemical releases.

NMPNS also conducted a hazardous chemical review in December 2003 and further evaluation in September 2004. Offsite, onsite, and mobile sources of hazardous chemicals were reviewed and assessed using RG 1.78 criteria. As a result of this assessment, NMPNS confirms that no hazards exist for the NMP I control room personnel from postulated chemical releases from both onsite and offsite sources.

The potential effects of smoke on control room habitability were considered for NMP 1 as part of UFSAR Fire Hazards Analysis. Plant equipment is available to protect control room personnel in the event of smoke. In addition, control room personnel are trained to cope with the effects of smoke.

The primary systems, structures, and components that mitigate the propagation of smoke throughout the plant and associated control room areas include:

• HVAC and smoke removal systems

• Physical plant barriers and arrangements

• Redundant egress pathways

• Smoke detection and fire suppression systems

• Manual ventilation capabilities

• Locally accessible SCBA units to allow operators to remain in the control room or alternate panel locations if deemed necessary Qualitative smoke evaluations were performed for NMP 1. The evaluations assessed the effect of both external and internal smoke events on the capability to maintain reactor control from either the control room or remote shutdown panels. The evaluations considered various plant design and procedural criteria in accordance with the guidelines of RG 1. 196, "Control Room Habitability at Light-Water Nuclear Power Reactors," and Nuclear Energy Institute (NEI) document 99-03, "Control Room Habitability Guidance,"

Revision 1. The evaluations confirmed that egress pathways to and including the remote shutdown panels are served by ventilation systems independent of the control rooms and that no single smoke event could preclude the use of both the control room and remote shutdown areas.

Requested Information 1(c)

Emphasis should be placed on confirming that your technical specifications verify the integrity of the CRE, and the assumed inleakage rates of potentially contaminated air. If you currently have a differential pressure surveillance requirement to demonstrate CRE integrity, provide the basis for your conclusion that it remains adequate to demonstrate CRE integrity in light of the ASTM E74 1 testing results. If you conclude that your differential pressure surveillance requirement is no longer adequate, provide a schedule for: 1) revising the Page 7 of 10

surveillance requirement in your technical specification to reference an acceptable surveillance methodology (e.g., ASTM E471), and 2) making any necessary modifications to your CRE so that compliance with your new surveillance requirement can be demonstrated.

If your facility does not currently have a technical specification surveillance requirement for your CRE integrity, explain how and at what frequency you confirm your CRE integrity and why this is adequate to demonstrate CRE integrity.

NMPI Response NMUP1 Technical Specification 3.4.5/4.4.5, Control Room Air Treatment System, delineates the Limiting Condition for Operation (LCO) and Surveillance Requirements (SRs) pertaining to the control room air treatment system. The SRs include pressure drop tests across the HEPA filters and charcoal adsorber banks, cold DOP (dioctylphthalate) and halogenated hydrocarbon testing on the filters and adsorber banks, and demonstration that the control room air treatment system will automatically initiate, SR 4.4.5.g requires at least once per operating cycle, not to exceed 24 months, the control room air treatment system shall be shown to maintain a positive pressure of greater than 1/16 of an inch (water) relative to the areas adjacent to the control room.

A tracer gas test was performed in February 2004 to determine the unfiltered inleakage into the NMP1 control room. As discussed in detail in the response to Item 1(a), the results of the test indicated an actual unfiltered inleakage greater than the assumed design bases inleakage for the certain modes of control room air treatment system operation.

Although the inleakage was within system operability limits (no compensatory measures required), the test showed the inadequacy of the existing SR in assessing CRE integrity.

Accordingly, to resolve this deficiency, a license amendment request will be submitted within 6 months of NRC approval of the Technical Specifications Task Force (TSTF)

Improved Standard Technical Specifications Change Traveler 448, "Control Room Habitability," or if TSTF-448 is processed through the consolidated line item improvement process (CLIIP), within six months after the CLIIP is published in the Federal Register. Modifications will not be required to the CRE since adoption of alternate source term methodology will increase the design basis unfiltered inleakage allowance above that observed in the tracer gas test, as discussed in the response to Item 2.

Additionally, NMPNS is developing a control room integrity program for the NMP1 CRE consistent with the guidelines of RG 1.196, "Control Room Habitability at Light-Water Nuclear Power Reactors," RG 1.197, "Demonstrating Control Room Envelope Integrity at Nuclear Power Reactors," and NEI 99-03, "Control Room Habitability Guidance," Revision 1. The program will be implemented by September 30, 2005. The program will require self assessments three and six years after the baseline tracer gas test (February 2004) with the next tracer gas test six years after the baseline test. Based upon the results of the self assessments and subsequent tracer gas testing, intervals for Page 8 of 10

assessments and testing could be increased or decreased. This program will be modified as necessary upon implementation of the license amendment implementing TSTF-448.

Requested Information

2.

If you currently use compensatory measures to demonstrate control room habitability, describe the compensatory measures at your facility and the corrective actions needed to retire these compensatory measures.

NMPI Response The NRC issued NMP1 License Condition 2C(4) as part of TSA 161 on May 23, 1998.

The license condition requires KI to be available to the control room operators. Letter NMiPL 1323, dated May 23, 1998, stated that procedural controls exist to provide direction for the determination of need and administration of potassium iodide to the NMP1 control room operators and these procedural controls would remain in place.

The current licensing bases for control room radiological consequences for the design basis accidents are described in Attachment E to letter NMIP1L 1394, dated December 18, 1998, submitted in response to License Condition 2C(4). NMP1L 1394 is based on source term methodologies and assumptions derived from Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites." The potential to address satisfaction of the GDC 19 dose guidelines by alternative methods to those included in NMPL 1394 were discussed in NMP 1L 1528, dated August 23, 2000.

Alternative source term methodology, as defined in 10 CFR 50.67 and described in Regulatory Guide 1.183, "Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," will be used to demonstrate compliance with the guidelines of GDC 19 with the corresponding license amendment request submitted to the NRC by December 31, 2005. As stated above, procedural controls exist for KI administration, and KI is currently available to the control room operators and will continue to be until the license amendment revising the design basis methodology is approved and implemented.

Use of alternate source term (AST) methodology will eliminate the need for KI for control room habitability as required by License Condition 2C(4) and increase the design basis unfiltered inleakage into the CRE to a value larger than that observed in the February 2004 tracer gas testing. The revised value for unfiltered inleakage will be reflected in the control room integrity program discussed in the response to Item 1(c) upon approval of AST for NMP1 by the NRC.

Page 9 of 10

Requested Information

3.

If you believe that your facility is not required to meet either the GDC, the draft GDC, or the "Principal Design Criteria" regarding control room habitability, in addition to responding to 1 and 2 above, provide documentation (e.g., Preliminary Safety Analysis Report, Final Safety Analysis Report sections, or correspondence) of the basis for this conclusion and identify your actual requirements.

NMPI Response As discussed in the response to Item 1, NMP1 was not designed or constructed to the GDC. The NMP1 principal design criteria (Section I.A of the UFSAR) and a comparison to the GDC (from the 1972 Technical Supplement to Petition for Conversion from Provisional operating License to Full-Term Operating License) are included in to this submittal. The NMPI subsequent commitment to GDC 19 is discussed in the response to Item 1.

Page 10 of 10

ATTACHMENT 2 GENERIC LETTER 2003-01, CONTROL ROOM HABITABILITY RESPONSES TO REQUESTED INFORMATION NINE MILE POINT UNIT 2 Requested Information

1.

Provide confirmation that your facility's control room meets the applicable habitability regulatory requirements (e.g., GDC 1, 3, 4, 5, and 19) and that the control room habitability systems (CRHSs) are designed, constructed, configured, operated and maintained in accordance with the facility's design and licensing bases.

Nine Mile Point Unit 2 (NMP2) Response Design Function The control room envelope (CRE) at NMP2 consists of rooms and areas located on the main control room and relay room elevations of the control building. Included in the envelope are the main control room, relay room, instrument shop, training room, shift supervisor's office, lunch room, toilets, corridors, work release room, and heating, ventilation, and air conditioning (HVAC) system equipment rooms.

The control room emergency filtration (CREF) system provides a radiologically controlled environment from which the unit can be safely operated following a Design Basis Accident (DBA). The safety related function of the CREF system used to control radiation exposure consists of two independent and redundant high efficiency air filtration subsystems for treatment of recirculated air and outside supply air. Each subsystem includes a control room outdoor air special filter train (CROASFT), which consists of an electric heater, a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section, a second HEPA filter, a filter booster fan, and the associated ductwork and dampers. Prefilters and HEPA filters remove particulate matter that may be radioactive. The charcoal adsorbers provide a holdup period for gaseous iodine, allowing time for decay. Each subsystem also includes the necessary outside air intake(s) and two air conditioning (AC) units (fan portion only), one for the control room and one for the relay room. Each outside air intake is capable of providing 100% of the necessary makeup flow. The two required outside air intakes are common to both subsystems. The emergency pressurization mode of the CREF system is assumed to operate following a loss of coolant accident, main steam line break, fuel handling accident, and control rod drop accident. No single active failure will cause the loss of outside or recirculated air from the CRE.

The CROASFT portion of the safety related CREF system is normally in standby, but the remaining portions of the CREF system (the outside air intakes and fan portion of the AC Page 1 of 9

units) are operated to maintain the CRE environment during normal operation. Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to control room envelope personnel), the CREF system automatically switches to the emergency pressurization mode of operation to prevent infiltration of contaminated air into the CRE. A system of valves and dampers redirects all control room envelope outside air flow through the two CROASFTs. In addition, a portion of the control room air is recirculated through the CROASFTs. The AC units (fan portion only) maintain 1/8 inch positive pressure water gauge. The CROASFT filter tests are in accordance with Regulatory Guide 1.52, "Design, Testing, and Maintenance Criteria for Post Accident Engineered-Safety-Feature Atmosphere Cleanup System Air Filtration and Adsorption Units of Light-Water-Cooled Nuclear Power Plants," Rev. 2. The NMP2 Technical Specification 5.5.7 Ventilation Filter Testing Program includes testing HEPA filter performance, charcoal adsorber efficiency, system flow rate, and the physical properties of the activated charcoal.

The control room envelope AC portion of the HVAC system (hereafter referred to as the CRE AC System) provides temperature control for the CRE following its isolation. The CRE AC system consists of two independent redundant subsystems that provide cooling of recirculated and outside air makeup control room envelope air. Each subsystem consists of two AC units (one for the control room and one for the relay room), one control building chilled water subsystem (which provides cooling water to the cooling coils of the two AC units), ductwork, dampers, and instrumentation and controls to provide for CRE temperature control. Each air conditioning unit includes an air filter assembly, cooling coil, and fan. Each control building chilled water subsystem includes a hermetic centrifugal water chiller, chilled water pump, expansion tank, controls, piping, and valves.

The CRE AC system is designed to provide a controlled environment under both normal and accident conditions. A single subsystem provides the required temperature control to maintain a suitable CRE environment. The design conditions for the CRE environment are 750F and 50% relative humidity. The design basis of the CRE AC system is to maintain the control room envelope temperature for a 30 day continuous occupancy following isolation of the CRE. During emergency operation, the CRE AC system maintains a habitable environment. A single active failure of a component of the CRE AC system, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. The CRE AC system is designed in accordance with Seismic Category I requirements.

The control building ventilation system also provides for smoke removal from the control room and relay room. Upon manual actuation, the smoke removal fan inlet and outlet dampers open, the smoke removal and makeup air fans start, and the discharge damper opens to allow for venting of smoke.

Page 2 of 9

Licensing Basis NMP2 was designed to the General Design Criteria (GDC) of Appendix A to 10 CFR 50 as discussed in Sections 1.2.1.1 and 3.1.2 of the NMP2 Updated Safety Analysis Report (USAR). As such, the NMP2 control room and CRHSs were designed, constructed and configured in conformance with GDCs 1, 3, 4, 5 and 19. Conformance with Three Mile Island (TMI) Action Plan Item III.D.3.4 is discussed in Section 1.10 of the USAR.

Administrative programs for control of design changes, quality assurance and procedure revisions are in place to ensure that NMP2 is operated and maintained in accordance with its design and licensing basis.

As discussed further below, tracer gas testing results have shown that the NMP2 control room has not been maintained in accordance with its design and licensing basis and that corrective action, reanalysis of the radiological dose consequences to control room operators, is necessary. The Generic Letter 91-18 analyses developed after obtaining the tracer gas test results concludes that compensatory measures are not necessary.

Requested Information 1(a)

Emphasis should be placed on confirming that the most limiting unfiltered inleakage into your CRE (and the filtered inleakage if applicable) is no more than the value assumed in your design basis radiological analyses for control room habitability. Describe how and when you performed the analyses, tests, and measurements for this confirmation.

NMP2 Response Prior to tracer gas testing of the CRE, potential sources of inleakage were identified and evaluated. Items walked down and evaluated included door seals, pipe and conduit penetrations and seals, duct seams, dampers, heating ventilation and air conditioning system (HVAC) access doors and structural joints. As a result, door seals were adjusted and a duct seam was welded. In addition, several vent locks were installed to support the tracer gas testing. The CRE was also surveyed for positive pressure to ensure that the ventilation system was properly balanced.

The test methodology used for the tracer gas tests was the constant injection method of the American Society for Testing and Materials (ASTM) standard E741-00, "Standard Test Method for Determining Air Change in a Single Zone by Means of a Tracer Gas Dilution." For the constant injection method, a constant flow of tracer gas is injected into the CRE until the resulting concentration in the envelope reaches a steady state value.

This occurs when the amount of tracer gas entering the CRE is the same as the amount leaving the CRE. By injecting the tracer gas in the outside air flow used for pressurization of the envelope, an estimate of the filtered and unfiltered airflow that provides this pressurization airflow can be made by measuring the concentration of tracer gas in the outside airflow while at the same time measuring the steady state concentration Page 3 of 9

in the CRE. During performance of the in leakage tests, ingress and egress to/from the CRE was minimized.

A characterization test of the CRE with the Air Conditioning Units (ACUs) IA and 2B in operation in the normal mode was performed on August 18, 2004. The purpose of this test was to assure that the CRE could be treated as a single zone, a requirement for ASTM E741. This was accomplished by taking gas samples throughout the envelope following injection of a "puff' of tracer gas (Sulfur Hexafluoride, SF6) that raised the concentration of tracer gas in the envelope to a target value. Analysis of samples taken throughout the CRE was then performed to confirm the spatial uniformity of tracer gas concentrations in the envelope. The results from the analyses of these samples indicated that the CRE could be considered as a single zone. A constant injection flow of tracer gas was maintained after this "puff." The constant injection tracer gas flow that was used was based on an earlier Pitot tube traverse measurement of the outside airflow and the same target tracer gas concentration used for the "puff."

Constant injection inleakage tests were performed with ACU IA and 2B trains in operation in the normal mode, with Control Building Special Filter Train A in operation and the Special Filter Train B in operation. For the constant tracer gas injection technique, when the concentration in the return air from the CRE was judged to be at equilibrium, a series of samples were taken from the make-up (outside) air and the CRE return air. These concentrations along with the flow of tracer gas injected into the CRE provided a measure of the unfiltered inleakage over this measurement period. Tracer gas leakage test results are summarized in Table 1 below:

Table.1 Summary of Control Room Inleakage Test Results Mode Tested Unfiltered Inleakage Normal 0 scfm Special Filter A Train, Emergency 108 +/- 38 scfm Special Filter B Train, Emergency 174 +/- 30 scfm The NMP2 unfiltered inleakage assumed in the design basis radiological analysis for control room habitability is 0 scfm. Through the Nine Mile Point Nuclear Station, LLC (NMPNS) corrective action program, an evaluation has been developed per Generic Letter 91-18 using alternate source term (AST) methodology within the guidelines of the January 30, 2004, NRC letter to the Nuclear Energy Institute (NEI), "NET Draft White Paper, Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." The evaluation shows that the GDC 19 dose limits will not be exceeded with 225 scfm of unfiltered inleakage. The evaluation also credits the 15 scfh administrative assessment criteria for main steam isolation valve (MSIV) leakage utilized per NMP2 TS Bases 3.7.2, in lieu of the 24 scfh MSIV leakage limit of TS Surveillance Requirement (SR) 3.6.1.3.12. The administrative assessment requirement reflects actual MSIV leakage limits utilized for plant operation. Therefore, while the unfiltered inleakage into the CRE exceeds the current design basis, compensatory Page 4 of 9

measures are not required as a result of the tracer gas test results. Revision of the design bases radiological analysis for control room habitability is discussed further in the response to Item 2.

Requested Information 1(b)

Emphasis should be placed on confirming that the most limiting unfiltered inleakage into your CRE is incorporated into your hazardous chemical assessments. This inleakage may differ from the value assumed in your design basis radiological analyses. Also, confirm that the reactor control capability is maintained from either the control room or the alternate shutdown panel in the event of smoke.

NMP2 Response The application for an operating license for NMP2 was submitted on January 25, 1983.

The NRC completed its acceptance review and docketed the Final Safety Analysis Report for Unit 2 on April 12, 1983. Licensing requirements incorporating the lessons learned from the TMI-2 accident were reflected in the design and operation of NMP2. The NRC staff based its safety review on NUREG-0800, "Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Reactors, LWR Edition" (SRP). An audit review of each of the areas listed in the Areas for Review section of the SRP was performed and documented in NUREG-1047, "Safety Evaluation Report related to the operation of Nine Mile Point Nuclear Station, Unit No. 2."

The NRC staffs evaluation of control room habitability in the event of a toxic gas accident was provided in NUREG-1047 Sections 9.4 and 2.2. Section 9.4, "Heating, Ventilation, and Air Conditioning Systems," evaluated conformance with Regulatory Guide (RG) 1.78, "Assumptions for Evaluating the Habitability of a Nuclear Power Plant Control Room During a Postulated Hazardous Chemical Release," June 1974. Chlorine monitoring capability was found to be not required because chlorine is not stored at the site or transported in the site vicinity. Offsite and transportation threats to control room habitability posed by hazardous chemicals were reviewed and found to not adversely affect the NMP2 control room. The supporting analyses assumed no isolation of the control room normal ventilation.

Potential sources of onsite hazardous chemicals are reviewed on a routine basis via the Material Safety Data Sheet program, and the engineering design change process.

Tracer gas testing of the NMP2 CRE was conducted in August 2004. The testing results confirmed zero air inleakage for the normal control room ventilation case. The NMP2 hazardous chemical analysis assumed no isolation of the control room normal ventilation and no operation of the emergency filtration system. A total fresh air makeup rate of 1500 scfm was conservatively applied to the air space volume of the main control room Page 5 of 9

for the assessment, whereas 1167 scfm is the normal fresh air makeup for that volume.

Therefore, the measured inleakage is appropriately bounded by the analysis.

NMPNS also conducted a hazardous chemical review in December 2003 and further evaluation in September 2004. Offsite, onsite, and mobile sources of hazardous chemicals were reviewed and assessed using RG 1.78 criteria. As a result of this assessment, NMPNS confirms that no hazards exist for the NMP2 control room personnel from postulated chemical releases from either onsite or offsite sources.

The potential effects of smoke on control room habitability were considered for NMP2 as part of the USAR Fire Hazards Analysis. Plant equipment is available to protect control room personnel in the event of smoke. In addition, control room personnel are trained to cope with the effects of smoke.

The primary systems, structures, and components that mitigate the propagation of smoke throughout the plant and associated control room areas include:

• HVAC and smoke removal systems

• Physical plant barriers and arrangements

• Redundant egress pathways

• Smoke detection and fire suppression systems

• Manual ventilation capabilities

• Locally accessible self-contained breathing apparatuses (SCBA) to allow operators to remain in the control room or alternate panel locations if deemed necessary Qualitative smoke evaluations were performed for NMP2. The evaluations assessed the effect of both external and internal smoke events on the capability to maintain reactor control from either the control room or remote shutdown panels. The evaluations considered various plant design and procedural criteria in accordance with the guidelines of RG 1.196, "Control Room Habitability at Light-Water Nuclear Power Reactors," and NEI 99-03, "Control Room Habitability Guidance," Revision 1. The evaluations confirmed that egress pathways to and including the remote shutdown panels are served by ventilation systems independent of the control rooms and that no single smoke event could preclude the use of both the control room and remote shutdown areas.

Requested Information 1(c)

Emphasis should be placed on confirming that your technical specifications verify the integrity of the CRE, and the assumed inleakage rates of potentially contaminated air. If you currently have a differential pressure surveillance requirement to demonstrate CRE integrity, provide the basis for your conclusion that it remains adequate to demonstrate CRE integrity in light of the ASTM E741 testing results. If you conclude that your differential pressure surveillance requirement is no longer adequate, provide a schedule for: 1) revising the surveillance requirement in your technical specification to reference an acceptable Page 6 of 9

surveillance methodology (e.g., ASTM E471), and 2) making any necessary modifications to your CRE so that compliance with your new surveillance requirement can be demonstrated.

If your facility does not currently have a technical specification surveillance requirement for your CRE integrity, explain how and at what frequency you confirm your CRE integrity and why this is adequate to demonstrate CRE integrity..

NMP2 Response Improved Technical Specification Section 3.7.2, "Control Room Envelope Filtration (CREF) System," includes the SRs related to the CREF System. The Surveillance Requirements (SRs) require: 1) each CREF subsystem be operated for at least 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> every 31 days, 2) CREF System filter testing be performed in accordance with the Ventilation Filter Testing Program, and 3) verification that each CREF subsystem actuates on an actual or simulated initiation signal. SR 3.7.2.4 requires verification that all combinations of the CREF System can maintain a positive pressure of at least an 1/8 inch water gauge relative to outside atmosphere during the emergency pressurization mode of operation at an outside air intake flow rate of less than or equal to 1500 scfm.

The positive pressure test must be performed at least every 24 months.

A tracer gas test was performed in August 2004 to determine the unfiltered inleakage into the NMP2 control room. As discussed in the response Item 1(a), the results of the test indicated an actual inleakage greater than the assumed design bases inleakage for certain modes of control room envelope filtration system operation. Thus, the test showed the inadequacy of the existing SRs in assessing CRE integrity. Accordingly, to resolve this deficiency, a license amendment request will be submitted within 6 months of NRC approval of the Technical Specifications Task Force (TSTF) Improved Standard Technical Specifications Change Traveler 448, "Control Room Habitability," or if TSTF-448 is processed through the consolidated line item improvement process (CLIIP), within six months after the CLIIP is published in the Federal Register. Modifications will not be required to the CRE since adoption of alternate source term methodology will increase the design basis unfiltered inleakage allowance above that observed in the tracer gas test, as discussed in the response to Item 2.

Additionally, NMPNS is developing a control room integrity program for the NMP2 CRE consistent with the guidelines of RG 1.196, "Control Room Habitability at Light-Water Nuclear Power Reactors," RG 1. 197, "Demonstrating Control Room Envelope Integrity at Nuclear Power Reactors," and NEI 99-03, "Control Room Habitability Guidance," Revision 1. The program will be implemented by September 30, 2005. The program will require self assessments three and six years after the baseline tracer gas test (February 2004) with the next tracer gas test six years after the baseline test. Based upon the results of the self assessments and subsequent tracer gas testing, intervals for assessments and testing could be increased or decreased. This program will be modified as necessary upon implementation of the license amendment implementing TSTF-448.

Page 7 of 9

Requested Information

2.

If you currently use compensatory measures to demonstrate control room habitability, describe the compensatory measures at your facility and the corrective actions needed to retire these compensatory measures.

NMP2 Response The NMP2 CRE unfiltered inleakage tracer gas test results for Control Room Emergency Ventilation Modes exceeded the value assumed in the radiological DBA analyses as discussed in the response to Item 1(a).

The current licensing bases for radiological consequences for accidents are based on source term methodologies and assumptions derived from Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," and NUREG-0800. The design basis radiological analyses assumed 0 scfm total unfiltered inleakage. No unfiltered inleakage was assumed because, per Technical Specification 3.7.2, the control room is pressurized to prevent inleakage and credit for 0 scfm inleakage due to access/egress via double vestibule doors was assumed per NUREG-0800, SRP 6.4.

While no compensatory measures are required as a result of the observed inleakage value identified by the tracer gas test (see the response to Item 1(a)), revision of the design bases radiological analysis for control room habitability is required. AST methodology, as defined in 10 CFR 50.67 and described in Regulatory Guide 1.183, "Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," will be used to demonstrate compliance with the guidelines of GDC 19 with the corresponding license amendment request submitted to the NRC by June 30, 2006.

Use of AST will increase the design basis unfiltered inleakage into the CRE to a value larger than that observed in the tracer gas testing. The revised value for unfiltered inleakage will be reflected in the control room integrity program discussed in the response to Item 1 (c) upon approval of AST for NMP2 by the NRC.

In addition to the foregoing, NMPNS plans an aggressive program of investigating, identifying, and repairing significant sources contributing to the inleakage identified for the NMP2 CRE. Depending upon the results of this program and the availability of tracer gas testing vendors, a retest of the NMP2 CRE may be performed. Should a retest be conducted, NMPNS will submit the test results to the NRC by December 31, 2005.

• Page 8 of 9

Requested Information

3.

If you believe that your facility is not required to meet either the GDC, the draft GDC, or the "Principal Design Criteria" regarding control room habitability, in addition to responding to I and 2 above, provide documentation (e.g., Preliminary Safety Analysis Report, Final Safety Analysis Report sections, or correspondence) of the basis for this conclusion and identify your actual requirements.

NMP2 Response Not applicable. See the response to Item 1.

Page 9 of 9

ATTACHMENT 3 LIST OF REGULATORY COMMITMENTS The following table identifies those actions committed to by Nine Mile Point Nuclear Station, LLC, in this correspondence. Any other statements in this submittal are provided for information purposes and are not considered to be regulatory commitments. The listed regulatory commitments supercede any open regulatory commitments previously made in connection with Generic Letter 2003-01.

REGULATORY COMMITMENT DUE DATE Implement a control room integrity September 30, 2005 program at Nine Mile Point Unit 1 (NMP1) and Nine Mile Point Unit 2 (NMP2). :

Submit license amendment requests Within 6 months of NRC approval of (LARs) for both NMPI and NMP2 to adopt TSTF-448, or if TSTF-448 is processed TSTF-448.

through the consolidated line item improvement process (CLIIP), within six months after the CLIIP is published in the Federal Register.

Submit the alternate source term (AST)

December 31, 2005 LAR for NMP1.

Submit the AST LAR for NMP2.

June 30, 2006 Submit results of NMP2 control room December 31, 2005 envelope tracer gas retest, if performed.

Page I of 1

ATTACHMENT 4 NINE MILE POINT UNIT 1 PRINCIPAL DESIGN CRITERIA AND COMPARISON TO GENERAL DESIGN CRITERIA

Nine Mile Point Unit 1 UFSAR A. PRINCIPAL DESIGN CRITERIA The following paragraphs describing the principal design criteria are oriented toward. the twenty-seven criteria issued by the United States Atomic Energy Commission (USAEC) on November 22, 1965.(1)

The twenty-seven criteria represented proposed "General Design Criteria forNuclear Power Plant Construction Permits."

The twenty-seven criteria are presented here for historical reference and are followed by the Unit 1 principal design criteria.

Table I-1 provides historical information regarding an assessment of Unit 1 against criteria that were being used by the USAEC at the time of the Unit 1 application for. a full-term OL..

Fanj I ity Critprion 1

Those features of reactor facilities which are essential to the prevention of accidents or to the mitigation of their consequences must be designed, fabricated, and erected to:

(a) Quality standards that reflect the. importance of the safety function to be performed.

It should be recognized, in this..respect, that design codes commonly used for nonnuclear applications may not be adequate.

(b) Performance standards that will enable the facility to withstand, without-loss of the capability to protect.

the public, the additional forces imposed by the most severe earthquakes, flooding conditions, winds, ice, and other natural phenomena anticipated at the proposed site.

Cr;iteri on 2 Provisions must be included.to limit.the extent and the consequences of credible chemical reactions that could cause or materially augment the release of significant amounts 'of fission products from the facility.

Cryi t rion i

Protection must be provided against possibilities for damage of the safeguarding.features of the facility by missiles generated through equipment failures inside the containment.

F UFSAR Revision 18 I-2 October 2003

Nine'Mile Point Unit 1 UFSAR Reacstor Criitrrion 4 The reactor must be designed to accommodate, without fuel failure or primary system damage, deviations from steady state norm that might be occasioned by abnormal yet anticipated transient events such as tripping of the turbine generator and loss of power to the reactor recirculation system pumps.

Cri tepri on c;i The reactor must be designed so that power or process variable oscillations or transients that could cause fuel failure or primary system damage are not possible or can be readily suppressed.

Critprion A Clad fuel must be designed to accommodate throughout its design lifetime all normal and abnormal modes of anticipated reactor operation, including the design overpower condition, without experiencing significant cladding failures.

Unclad or vented fuels must be designed with the similar objective of providing.control over fission products.

For unclad and vented-solid fuels, normal and abnormal modes of anticipated reactor operation must be achieved without exceeding design release rates of fission products from the fuel over core lifetime.

rritirion 7

The maximum reactivity worth of control rods or elements and the rates with which reactivity can be inserted must be held to values such that no single credible mechanical or electrical control system malfunction could cause a reactivity transient capable of damaging the primary system or causing significant fuel failure.

Cr-itprion A.

Reactivity shutdown capability must be provided to make and hold the core subcritical from any credible operating condition with any one control element at its position of highest reactivity.

cTr; -or;on 9 Backup reactivity shutdown capability must be provided that is independent of normal reactivity control provisions.

This system must have the capability to shut down the reactor from any operating condition.

UFSAR Revision 17 I-3 October 2001

Nine Mile Point Unit 1 UFSAR cr-ri+ari nn 1in Heat removal systems must be provided which are capable of accommodating core decay heat under all anticipated abnormal and credible accident conditions, such as isolation from the main condenser and complete or partial loss of primary coolant from the reactor.

Components of the primary coolant and containment systems must be designed and operated so that no substantial pressure or thermal stress will be imposed on the structural materials unless the temperatures are well above the nil ductility temperatures.

For ferritic materials of the coolant envelope and the containment, minimum temperatures are NDT + 600F and NDT + 300F, respectively.

Crj -tri;,n 17 Capability for control rod insertion under abnormal conditions must be provided.

curit-rinn 1

The reactor facility must be provided with a control room from which all actions can be controlled or monitored as necessary to maintain safe operational status of the plant at all times.

The control room must be provided with adequate protection to permit occupancy under the conditions described in Criterion,17 below, and with the means to shut down the plant and maintain it in a safe condition if such accident were to be experienced.

Criterinn 14 Means must be included in the control room to show the relative reactivity status of the reactor such as position indication of mechanical rods or concentrations of chemical poisons.

A reliable reactor protection system must be provided to automatically initiate appropriate action to prevent safety limits from being exceeded.

Capability must be provided for testing functional operability of the system and for determining that no component or circuit failure has occurred.. For instruments and control systems-in vital areas where the potential consequences of failure require redundancy, the redundant channels must be independent and must be capable of being tested to determine that they remain independent.

Sufficient redundancy must be provided that failure or removal from service of a single component UFSAR Revision 17 I-4 October 2001

Nine Mile Point Unit 1 UFSAR or channel will not inhibit necessary safety action when required.

These criteria should, where applicable, be satisfied by the instrumentation associated with containment closure and isolation systems, afterheat removal and core cooling systems, systems 'to prevent cold-slug accidents, and other vital systems, as iwell as the reactor nuclear and process safety system.

Cri torion 1if;

'The vital instrumentation systems of Criterion 15 must be designed so that no credible combination of circumstances can interfere with the performance of a safety function when it is needed.

In particular, the effect of influences common to redundant channels which are intended to be independent must not negate the operability of a safety system.

The effects of gross disconnection of the system, loss of energy (electric power, instrument air), and adverse environment (heat from loss of instrument cooling, extreme cold, fire, steam, water, etc.) must cause the system to go into its safest state (fail-safe) or be demonstrably tolerable on some other basis.

Cri;tpr;in 17 The containment structure, including access openings and penetrations, must be designed and fabricated to accommodate or dissipate without failure the pressures and temperatures associated with the largest credible energy release including the effects of credible metal-water or other chemical reactions uninhibited by active quenching systems.

If part of the primary coolant system is outside the primary reactor containment, appropriate safeguards must be provided

• for that part if necessary, to protect the health and safety of the public, in case of an accidental rupture in that part of the system. The appropriateness of safeguards such as isolation valves, additional containment, etc., will depend on environmental and population conditions surrounding the site.

CrriptAion iR Provisions must be made for the removal of heat from within the containment structure as necessary to maintain the integrity of the structure under the conditions described in Criterion 17 above.

If engineered safeguards are needed to prevent containment vessel failure due to heat released under such conditions, at least two independent systems must be provided, preferably of different principles. Backup equipment (e.g., water and power systems) to such engineered safeguards must also be redundant.

UFSAR Revision 17 I-5 October 2001

Nine Mile Point Unit 1 UFSAR Crirterinn 1g The maximum integrated leakage from the containment structure under the conditions described in Criterion 17 above must meet the site exposure criteria set forth in 10CFR100.

The containment structure must be designed so that the containment can be leak tested at least to design pressure conditions after completion and installation of all penetrations, and the leakage rate measured over a suitable period to verify its conformance with required performance.

The plant must be designed for later tests at suitable pressures.

Critprion on All containment structure penetrations subject to failure such as resilient seals and expansion bellows must be designed and constructed so that leak-tightness can be demonstrated at design pressure at any time throughout operating life of the reactor.

tCri;tpri;n 21 Sufficient normal and emergency sources of electrical power must be provided to assure a capability for prompt shutdown and continued maintenance of the reactor facility in a safe condition under all credible circumstances.

Critor-i on 9

Valves and their associated apparatus that are essential to the containment function must be redundant and so arranged that no credible combination of circumstances can interfere with their necessary functioning.

Such redundant valves and associated apparatus must be independent of each other.

Capability must be provided for testing functional operability of these valves and associated equipment to determine that no failure has occurred and that leakage is within acceptable limits. Redundant valves and auxiliaries must be independent.

Containment closure valves must be actuated by instrumentation, control circuits and energy sources which satisfy Criterion 15 and 16 above.

crritp;rion 21 In determining the suitability of a facility for a proposed site the acceptance of the inherent and engineered safety afforded by the systems, materials and components, and the associated engineered safeguards built into the facility, will depend on their demonstrated performance capability and reliability and the extent to which the operability of such systems, materials, components, and engineered safeguards can be tested and inspected during the life of the plant.

UFSAR Revision 17 I-6 October 2001

Nine Mile Point Unit 1 UFSAR R ioact; vr;ty 4Control Critiprion 74 All fuel storage and waste handling systems must be contained if necessary to prevent the accidental release of radioactivity in amounts which could affect the health and safety of the public.

The fuel handling and storage facilities must be designed to prevent criticality and to maintain adequate shielding and cooling for spent fuel under all anticipated normal and abnormal conditions, and credible accident conditions.

Variables upon which health and safety of the public depend must be monitored.

Where unfavorable environmental conditions can be expected to require limitations upon the release of operational radioactive effluents to the environment, appropriate holdup capacity must be provided for retention of gaseous, liquid, or solid effluents.

critprion 77 The plant must be provided with systems capable of monitoring the release of radioactivity under accident conditions.

1.0 General The Station is intended as a high load factor generating facility.

The recirculation flow control system described in Section VIII contributes to this objective by providing a

.relatively fast means for adjusting the Station output over a preselected power range.

Overall reliability, routine and periodic test requirements, and other design considerations must also be compatible with this objective.

Careful attention has been given to fabrication procedures and adherence to Code requirements.

The rigid requirements of specific portions of various codes have been arbitrarily applied to some safety-related systems to ensure quality construction in such cases where the complete Code does not apply.

For piping, the ASA B31.1-1955 Code was used and where exceptions were taken, safety evaluations were performed to document that an adequate margin of safety was maintained.

UFSAR Revision 18 I-7 October 2003

Nine Mile Point Unit 1 UFSAR Periodic test programs have been developed for required engineered safeguards equipment.

These tests cover component testing such as pumps and valves and full system tests, duplicating as closely as possible the accident conditions under which a given system must perform.

2.0 Buildings and Structures The Station plot plan, design and arrangement of the various buildings and structures are described in Section III.

Principal structures and equipment which may serve either to prevent accidents or to mitigate their consequences are designed, fabricated and erected in accordance with applicable codes to withstand the most severe earthquake, flooding condition, windstorm, ice condition, temperature and other deleterious natural phenomena which can be expected to occur at the site.

3.0 Reactor

1.

A direct-cycle boiling water system reactor (BWR),

described in Section IV, is employed to produce steam (1030 psig in reactor vessel, 950 psig turbine inlet) for use in a steam-driven turbine generator.

The rated thermal output of the reactor is 1850 MWt.

2.

The reactor is fueled with slightly enriched uranium dioxide contained in Zircaloy clad fuel rods described in Section IV.

Selected fuel rods also incorporate small amounts of gadolinium as burnable poison.

3.

To avoid fuel damage, the minimum critical power ratio (MCPR) is maintained greater than or equal to the safety limit CPR.

4.

The fuel rod cladding is designed to maintain its integrity throughout the anticipated fuel life as described in Section IV.

Fission gas release within the rods and other factors affecting design life are considered for the maximum expected burnup.

5.

The reactor and associated systems are designed so that there is no inherent tendency for undamped oscillations.

A stability analysis evaluation is given in Section IV.

6.

Heat removal systems are provided which are capable of safely accommodating core decay heat under all credible circumstances, including isolation from the main condenser and loss of coolant from the reactor.

Each different system so provided has appropriate redundant features.

Independent auxiliary cooling means are provided to cool the reactor under a variety of conditions.

The UFSAR Revision 17 I-8 October 2001

Nine Mile Point Unit 1 UFSAR normal auxiliary cooling means during shutdown and refueling is the shutdown cooling system described in Section X-A.

A redundant emergency cooling system, described in Section V-E, is provided to remove decay heat in the event the reactor is isolated from the main condenser while still under pressure. Additional cooling capability is also available from the high-pressure coolant injection (HPCI) system and the fireprotection system.

Redundant and independent core spray systems are provided to cool the core in the event of a loss-of-coolant accident (LOCA).

Automatic depressurization is included to rapidly reduce pressure to assist with core spray operation (see Section VII-A).

Operation of the core spray system assures that any metal-water reaction following a postulated LOCA will be limited to less than 1 percent of the Zircaloy clad.

7.

Reactivity shutdown capability is provided to make and hold the core adequately subcritical,, by control rod action, from any point in the operating cycle and at any temperature down to room temperature, assuming that any one control rod is fully withdrawn and unavailable for use.

This capability is demonstrated in Section IV-B.

A physical description of the movable control rods is given in Section IV-B.

The control rod drive (CRD) hydraulic system is described in Section X-C.

The force available to scram a control rod is approximately 3000 lb at the beginning of a scram stroke.

This is well in excess of the 440-lb force required in the event of fuel channel pinching of the control rod blade during a LOCA, as discussed in Section XV.

Even with scram accumulator failure, a force of at least 1100 lb from reactor pressure acting alone is available with reactor pressures in excess of 800 psig.

8.

Redundant reactivity shutdown capability is provided independent of normal reactivity control provisions.

This system has the capability, as shown in Section VII-C, to bring the reactor to a cold shutdown condition, Keff <0.97, at any time in the core life, independent of the control rod system capabilities.

9.

A flow restrictor in the main steam line (MSL) limits coolant loss from the reactor vessel in the event of a MSL break (Section VII-F).

UFSAR Revision 17 1-9 October 2001

Nine Mile Point Unit 1 UFSAR 4.0 Reactor Vessel

1.

The reactor core and vessel are designed to accommodate tripping of the turbine generator, -loss of power to the reactor recirculation system and other transients, and maneuvers which can be expected without compromising safety and without fuel damage.

A bypass system having a design capacity of approximately 40 percent of turbine steam flow for the throttle valves wide open (VWO) condition partially mitigates the effects of sudden load rejection.

An actual bypass system test was performed and the results indicated a system bypass capacity of about 2,500,000 lb/hr.

This and other transients and maneuvers which have been analyzed are detailed in Section XV.

2.

Separate systems to prevent serious reactor coolant system (RCS) overpressure are incorporated in the design.

These include an overpressure scram, solenoid-actuated relief valves, safety valves and the turbine bypass system.

An analysis of the adequacy of RCS pressure relief devices is included in Section V-C.

,3. Power excursions which could result from any credible reactivity addition accident will not cause damage, either by motion or rupture, to the pressure vessel, or impair operation of required safeguards systems.

The magnitude of credible reactivity addition accidents is curtailed by control rod velocity limiters (Section VII-D), by a control rod housing support structure (Section VII-E), and by procedural controls supplemented by a rod worth minimizer (RWM) (Section VIII-C).

Power excursion analyses for control rod dropout accidents are included in Section XV.

4.

The reactor vessel will not be substantially pressurized until the vessel wall temperature is in excess of the nil ductility reference temperature (RTNDT) + 600F. The initial RTNDT of the reactor vessel material is no greater than 400F. The change of RTNDT with radiation exposure has been evaluated in accordance with Regulatory Guide (RG) 1.99 Revision 2 to determine an adjusted reference temperature (ART) for the most limiting vessel material.

Vessel material surveillance samples are located within the reactor vessel to permit periodic verification of material properties with exposure.

5.0 Containment

1.

The primary containment, including the drywell, pressure suppression chamber, and associated access UFSAR Revision 17

.I-10 October 2001

Nine Mile Point Unit 1 UFSAR openings andtpenetrations, is designed, fabricated and erected to accommodate, without failure, the pressures and temperatures resulting from or subsequent to the double-ended rupture (DER) or equivalent failure of any coolant pipe within the drywell.

The primary containment is designed to accommodate the pressures following a'LOCA, including the generation of hydrogen from a metal-water reaction.

Pressure transients, including hydrogen effects, are presented in Section XV.

The initial NDTT for the primary containment system is about -200F and is not expected to increase during the lifetime of the Station.

These structures are described in Sections VI-A, B and C. Additional details, particularly those related to design and fabrication, are included in Section XVI.

2.

Provisions are made for the removal of heat from within the primary containment, for reasonable protection of the containment from fluid jets or missiles, and such other measures as may be necessary to maintain the integrity of the containment system as long as necessary following a LOCA.

Redundant containment spray systems, described in Section VII, pump water from the suppression chamber through independent heat exchangers to spray nozzles, which discharge into the drywell and suppression chamber. Water sprayed into the drywell is returned by gravity to the suppression chamber to complete the cooling cycle.

Studies performed to verify the capability of the containment system to withstand potential fluid jets and missiles are summarized in Section XVI.

3.

Provision is made for periodic integrated leakage rate tests (ILRT) to be performed in accordance with 10CFR50 Appendix J.

Provision is also made for leak testing penetrations and access openings and for periodically demonstrating the integrity of the reactor building.

These provisions are all described in Section VI-F.

4.

The containment system and all other necessary engineered safeguards are designed and maintained such that offsite doses resulting from postulated accidents are below the values stated in 10CFR100.

The analysis results are detailed in Section XV.

B.

Double isolation valves are provided on most lines directly entering the primary containment freespace, or penetrating the primary containment and connected to UFSAR Revision 17 I-11 October 2001

Nine Mile Point Unit 1 UFSAR the RCS.

Lines which are not equipped with double isolation valves have been determined to be acceptable based upon the fact that the system reliability is not compromised, the system is closed outside containment, and a single active failure can be accommodated with only one isolation valve in the line.

Periodic testing of these valves will assure their capability to isolate at all times.

The isolation valve system is discussed in detail in Section VI-D.

6.

The reactor building provides secondary containment when the pressure suppression system is in service and serves as the primary containment barrier during refueling and other periods when the pressure suppression system is open or not required.

This structure is described in Section VI-C.

An emergency ventilation system (Section VII-H) provides a means for controlled release of halogens and particulates via filters from the reactor building to the stack under accident conditions.

6.0 Control and Instrumentation

1.

The Station is provided with a control room (Section III-B) which has adequate shielding and other emergency features to permit occupancy during all credible accident situations.

2.

Interlocks or other protective features are provided to augment the reliability of procedural controls in preventing serious accidents.

Interlock systems are provided which block or prevent rod withdrawal from a multitude of abnormal conditions.

The control rod block logic is shown on Figures VIII-6 and VIII-8, respectively, for the source range monitor (SRM) and intermediate range monitor (IRM) neutron instrumentation.

In the power range, average power range monitor (APRM1) instrumentation provides both control rod and recirculation flow control blocks, as shown on Figure VIII-14.

Reactivity excursions involving the control rods are either prevented or their consequences substantially mitigated by a control RWM (Section VIII-C.4.0) which supplements procedural controls in avoiding patterns of high rod worths, a local power range monitor (LPRM) neutron monitoring and alarm system (Section VIII-C.1.1.3), and a control rod position indicating system (Section IV-B.6.0), both of which enable the Operator to observe rod movement, thus verifying his actions. A control rod overtravel position light verifies that the blade is coupled to a withdrawn CRD.

UFSAR Revision 17 I-12 October 2001

Nine Mile Point Unit 1 UFSAR A refueling platform operation interlock is discussed in Section XV, Refueling Accident, which, along with other procedures and supplemented by automatic interlocks, serves to prevent criticality accidents in the refueling mode.

A cold water addition reactivity excursion is prevented by the procedures and interlocks described in Section XV, Startup of Cold Recirculation Loop (Transient Analysis).

Containment integrity is maintained through the use of strict procedural controls and is enforced by interlocking mechanisms at the airlock doors to the drywell and a local alarm system at the access openings of the reactor building.

3.

A reliable, dual-logic channel reactor protection system (RPS), described in Section VIII-A, is provided to automatically initiate appropriate action whenever various parameters exceed preset limits.

Each logic channel contains two subchannels with completely independent sensors, each capable of tripping the logic channel. A trip of one-of-two subchannels in each logic channel results in a reactor scram.

The trip in each logic channel may occur from unrelated parameters, i.e., high neutron flux in one logic channel coupled with high pressure in the other logic channel will result in a scram.

The RPS circuitry fails in a direction to cause a reactor scram in the event of loss of power or loss of air supply to the scram solenoid valves.

Periodic testing and calibration of individual subchannels is performed to assure system reliability.

The ability of the RPS to safely terminate a variety of Station malfunctions is demonstrated in Section XV.

4.

Redundant sensors and circuitry are provided for the actuation of equipment required to function under post-accident conditions.

This redundancy is described in the various sections of the text discussing system design.

7.0 Electrical Power Sufficient normal and standby auxiliary sources of electrical power are provided to assure a capability for prompt shutdown and continued maintenance of the Station in a safe condition under all credible circumstances. These features are discussed in Section IX.

8.0 Radioactive Waste Disposal

1.

Gaseous, liquid and solid waste disposal facilities are designed so that discharge of effluents is in UFSAR Revision 17 I-13 October 2001

Nine Mile Point Unit 1 UFSAR accordance wviith 10CFR20 and 10CFR50 Appendix I. The facility descriptions are given in Section XII-A while the development of appropriate limits is covered in Section II.

2.

Gaseous discharge from the Station is appropriately monitored, as discussed in Section VIII, and automatic isolation features are incorporated to maintain releases below the limits of 10CFR20 and IOCFR50 Appendix I.

9.0 Shielding and Access Control Radiation shielding and access control patterns are such that doses will be less than those specified in 10CFR20. These features are described in Section XII-B.

10.0 Fuel Handling and Storage Appropriate fuel handling and storage facilities which preclude accidental criticality and provide adequate cooling for spent fuel are described in Section X.

UFSAR Revision 17 I-14 October 2001

67*f') _'I 7/
/.

U. S. Atomic Energy Commission Docket 50-220 TECHN I CAL SUPPLEMENT TO PETITION FOR CONVERSION' FROM 'PROVISIONAL OPERATING LICENSE TO FULL-TERM OPERATING LICENSE Nine Mile Point Nuclear Station JULY 1972 Niagara Mohawk Power Corporation Syracuse, New York 13202

III.

ADEQUACY RELATIVE TO CURRENT STANDARDS*

A. COMPLIANCE WITH 10CFR50 APPENDICES

1.

Appendix A -

General Desiqn Criteria for Nuclear Power Plants The design bases of the nuclear system were evaluated against each of the six groups of criteria. In each group the current interpretation of the intent of the criteria is stated, and the Station design conformance to this interpretation is discussed.

a. Overall Requirements These criteria are intended to require that the quality control and assurance programs be identified, recorded, and justified in terms of their adequacy. These criteria are intended to apply to the design, fabrication, erection, and performance requirements of the facility's essential components and systems to ensure that there is protection against natural phenomena and environmental conditions.

In addition, these criteria are also intended to provide fire and ex-plosion protection for all equipment important to safety.

Criterion 1 - Quality Standards and Records Structures, systems, and components important to safety were designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety function to be performed.

To ensure a quality installation of Class I systems, the following doc-umentation was obtained, reviewed and filed.

Preoperational and opera-tional test procedures were also established and implemented. The following were performed or obtained in accordance with the applicable codes.

1) Specification, quotation, requisition, purchase requisition, purchase order, vendor's quote

2) Radiographs, heat treatment charts, etc.

3) Welding qualifications and procedures

4) All performed inspection reports

5) All performed test reports

6) Verification of compliance with design in terms of:

a) design rating b) specified codes c) miminum pressure drops d) seismic requirements e) flow path requirements f

operational tests g) internal cleaning

• Construction of the Nine Mile Point Nuclear Station was well along or already complete when many of the current standards were developed.

III-1

h) corrosion allowances i) all other items requested in specifications

7) Information on design and specification of motors

8) All certified drawings

9) Instructions for installation, operation, and maintenance of equipment

10)

Isometric drawings of all Class I systems A list of Class I components and structures appears in the FSAR.l* A quality assurance program for the operations phase was adopted and imple-mented to provide continuing assurance that these systems, structures, and components will satisfactorily perform their safety functions. This program is described in the Ninth Supplement to the FSAR.

Criterion 2 - Design Bases for Protection Against Natural Phenomena This criterion is met in all regards with the exception of limited tornado capability.

No tornadoes have been recorded in the Nine Mile Point area.

The ability of the Station to achieve a safe shutdown in the event of a tornado is discussed in Supplements to the FSAR.2,3 Criterion 3 -

Fire Protection The present design fully meets this criterion. Systems and structures are designed and located to minimize the probability and effect of fires and explosives.

Noncombustible and heat resistant materials were used throughout the unit.

All fire fighting systems were designed with large capacity and capability.

All systems were analyzed for earthquake effects and the combined stresses were well below present American National Standards Institute code B31.1 allowables.

For further information see the FSAR.4 Criterion 4 -

Environmental and Missile Design Bases This criterion is met is that the integrity of the containment was anal zed for missiles and discharging fluids. This was discussed in the FSAR.5,,7,8 All pipe systems important to safety (Class I) were adequately braced to prevent pipe whip in the event of a pipe break.

Criterion 5 - Sharing of Structures, Systems, and Components Structures, systems and components that are important to safety are not shared between the Nine Mile Point Nuclear Station and any other unit.

• References may be found at the end of Section III.

III-2

b. Protection by Multiple Fission Product Barriers These criteria are intended to ensure that designs provide the reactor unit with multiple barriers which remain intact during normal operations and all operational transients caused by a single operator error or equipment malfunction, and that adequate barriers are avail-able for design-basis accidents. In addition, these criteria are in-tended to identify and define the instrumentation and control systems, electrical power systems, and control room requirements necessary to maintain the Station in a safe operational status.

The Station containment barriers are the basic features that minimize the release of radioactive materials. The design provides six means of containing and/or mitigating the release of fission products: (1) the fuel barrier, consisting of high density ceramic U02 fuel sealed in high-integrity zircaloy cladding; (2) the reactor coolant pressure bound-ary, consisting of the vessels, pipes, pumps, tubes, and similar process components that contain the steam, water, gases, and radioactive materials, coming from, going to, or in communication with, the reactor core; (3) the drywell-suppression chamber primary containment; (4) the reactor building secondary containment; (5) the reactor building emergency ventilation system, which utilizes high-efficiency absolute and charcoal filters; and (6) the elevated release point.

Criterion 10 - Reactor Design The reactor core design, in combination with the Station equipment characteristics and nuclear safety systems, provides margins to ensure that fuel is not damaged during normal operation or as a result of abnor-mal operational transients.

The Hench-Levy correlation is used to determine the core safety limit.9'10 The maximum linear heat generation rate of 17.5 kilowatts per foot and a minimum critical heat flux ratio of 1.9 at the design rating of 1850 ther-mal megawatts is employed to ensure satisfactory fuel performance and to provide adequate margin to accommodate transient conditions without exceed-ing the core safety limit.

The general design bases employed for the core thermal and hydraulic design, taken in conjunction with the Station equipment characteristics, nuclear instrumentation, and the reactor protection system, are utilized to ensure that no fuel damage will occur during normal operation or anti-cipated transients caused-by single operator errors or equipment malfunc-tions.

Criterion 11 - Reactor Inherent Protection In accordance with the FSAR, 11 the reactor core provides a dynamic res-ponse which:

1) has a strong negative reactivity feedback under severe reactivity addition transients, III-3

2) contributes negative reactivity feedback consistent with the requirements of overall Station nuclear-hydrodynamic stability, and

3) has a reactivity response which regulates or damps changes in power level and spatial distribution of power production in the core to a level consistent with safe and efficient operation.

Therefore, this criterion is met.

Criterion 12 - Suppression of Reactor Power Oscillations The reactor core, coolant, control, and protection systems are designed to ensure that oscillations whi ch could cause conditions exceeding fuel design limits do not occur.1 0sl 3

Criterion 13 - Instrumentation and Control The fission process is monitored and controlled for all conditions from the source range through the power range. The neutron monitoring.system detects core conditions that could potentially threaten the overall in-tegrity of the fuel barrier due to excess power generation and provides a corresponding signal to the reactor protection system.

Fission cham-bers, located in the core, are used to sense neutron flux from the source range through the power range. The detectors are located to provide max-imum sensitivity to control-rod movement during startup and to provide optimum monitoring in the intermediate and power ranges.

Also, the reactor protection' system is provided to initiate automatically appropriate action whenever specific Station conditions reach established limits.

The protective system functions are tabulated in the Technical Specifications; The system is designed to mitigate the consequences of Station normal and accident transients, and operator errors, to ensure that core safety limits are not exceeded and to ensure the integrity of the reactor coolant boundary, containment and associated systems.

Instrumentation and control features of systems which can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems are

'described in detail in the FSAR.14 Also described there are instrumen-tation and control features of other systems associated with the reactor.

Supplementary instrumentation and control information is available in Supplements to the FSAR.l5,l6,l7,l8 The detailed information referenced above substantiates compliance with this criterion.

Criterion 14 - Reactor Coolant Pressure Boundary This criterion is met since these systems were designed and analyzed for all possible adverse conditions and the resultant stresses are very conservative when compared to the American National Standards Institute III-4

code B31.1 allowables. All code required tests, inspections and material certifications were Terformed.

For further information see the FSAR as supplemented. *t20,2l Criterion 15 -

Reactor Coolant System Design The reactor coolant system consists of the reactor vessel and appurten-ances, the reactor recirculation system, the solenoid-actuated relief system, the primary system safety valves, the emergency condenser, the core spray system and other piping systems up to and including the outer isolation valves.

The nominal operating pressure of the system is 1030 psig.

The reactor vessel design pressure of 1250 psig is determined by analysis of margins required to provide a reasonable range of maneuvering during operation, with additional allowance to accommodate transients above the operating pressure without actuation of the safety valves. Analyses presented in the FSAR, demonstrate the ability of the Station to withstand safely all anti-cipated disturbances with resultant pressures calculated to be well below 1250 psig.22,1l Overpressurization is prevented by a combination of automatic controls and pressure-relief devices.

Des-ign limits were selected to permit pos-sible rapid depressurization, with consequent temperature transients, as might be encountered :due to actuation of the solenoid-actuated relief valves.

The following redundant control and protection features are provided:

1) A dual fail-safe reactor protection system with two independent pressure switches in each logic channel is provided. This system is described in detail in the FSAR.14 A trip of one switch out of two in both logic channels will result in a reactor scram.

Therefore, a response failure of one sensor or. other component in each logic channel would not prevent a scram due to high pressure.

2) Also incorporated in the same manner in the reactor protection system are high neutron-flux scrams initiated by the APRM system.

There are a total of eight APRM signals, four in each logic channel.

The trip of one out of four in each channel will pro-duce a scram.

3) Six independently actuated relief valves are provided, any five of which will limit overpressure below the set point of the safety valves for the most rapid isolation incident.23

4) As is stated in the Technical Specifications,24 the opening of any combination of 16 safety and/or relief valves will limit the pressure to below the safety limit following the worst isolation situation. Sixteen safety valves and six relief III-5

valves are installed on the primary coolant system. For con-servatism, the emergency cooling system was not included in this analysis as a-pressure limiting device. The main purpose of this system is to ensure long-term core cooling during iso-lation situations while at the same time maintaining coolant inventory.

5) Backup systems are also provided.

a) The APRM trip, although primarily intended for core protec-tion, serves as backup protection for pressure transients.

b) The primary containment high pressure scram serves as a backup to the high reactor pressure scram in the event of lifting of the safety valves.

c) In the event of main-steam-line isolation-valve closure, reactor pressure will increase. A reactor scram is, there-fore, provided on main-steam-line isolation-valve position and anticipates the high reactor pressure scram trip.

d) A low condenser vacuum situation indicates potential loss of the main reactor heat sink, and which may, in turn, lead indirectly to an increase in pressure. The scram fea-ture provided here, therefore, anticipates the reactor high pressure scram.

Criterion 16 Containment Design A pressure-suppression containment system consisting of a drywell, sup-pression chamber (torus), and interconnecting vent piping is the primary containment for the main coolant system.

During normal operation, the reactor building, containing the pressure suppression system, provides a secondary containment barrier.

To ensure the integrity of the primary containment, integrated leak tests were performed prior to Station operation and periodically thereafter as provided in the Technical Specification. The results demonstrated that the containment met the design leak rate of 0.5 percent per day at a pres-sure of 35 psig and therefore, provides an essentially leaktight barrier.

The design basis loss-of-coolant accident was evaluated at the primary containment maximum allowable accident leak rate of 1.9 percent per day at 35 psig. The analysis demonstrates that the offsite doses from this accident would be well within the limits of 10CFR100.

Double-isolation valves are provided on lines penetrating the primary con-tainment and open to the free space of the containment.

Closure of one of these valves is sufficient to maintain integrity of the containment.

A containment spray system is provided, as described in the FSAR.25 The containment and associated equipment are designed to assure that conditions important to safety are not exceeded for as long as postulated accident conditions require.

III-6

Criterion 17 - Electrical Power Systems An on-site electrical power system and an off-site electrical power system are provided to permit functioning of structures, systems, and components important to safety.

The safety function for each system provides sufficient capacity and capability to ensure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

• Two completely independent and redundant emergency diesel-generator-systems are provided as well as two completely separate and independ-ent Station battery systems. The Station battery systems have suffi-cient redundancy to meet this criterion in that dual feeds, one from each battery, supply the control-board and power-board control buses.

Either feed can be selected by manual transfer at each terminus.

All high-voltage breakers (345-kv and 115-kv) have dual-trip circuits.

supplied, one from each battery.

Two 115-kv transmission lines from remote generating stations feed the 115-kv reserve bus at Nine Mile Point. The two lines occupy a common right-of-way for about six miles, but are physically separated and supported on independent structures to minimize the possibility of double-circuit outage.

The existing 115-kv line from Lighthouse Hill will be connected through the James A. FitzPatrick Nuclear Power Plant bus to the Nine Mile Point Nuclear Station Unit No. 1 bus. Under normal circumstances, there is more than adequate capacity from Lighthouse Hill/Bennetts Bridge and Oswego for any possible combination of normal shutdown or emergency loads for these two stations.

However, in the event of complete system blackout, two hydro units at Bennetts Bridge are reserved for the Nine Mile Point Nuclear Station Unit No. 1 HPCI power requirements.105 In the event of permanent fault on one line, the other line has the necessary capacity to supply all the power required to ensure that acceptable fuel and reactor coolant pressure boundary design limits are not exceeded during anticipated operational occurrences. This capacity is also available in the case of postulated accidents to ensure that the core is cooled, that containment integrity is maintained and that other vital functions are available.

Two physically independent circuits are provided from the 115-kv bus to the reserve station-service transformers lOlN and 101S.

Each of the on-site power systems are tested according to the Technical Specifications, to ensure their capability to perform their intended safety function.

Each system is also available, following a loss-of-coolant accident, in time to ensure that core cooling, containment integrity and other vital safety functions are maintained. This is discussed in the First Supplement to the FSAR.

Loss of power from one source will not cause loss of power from one of the other sources.

The Niagara Mohawk System is designed such that the III-7

115-kv transmission system will not be lost if Nine Mile Point Unit No. 1 goes off the line.

As described in the First Supplement to the FSAR, the emergency diesel generators are independent of the off-site power.

Criterion 18 -

Inspection and Testing of Electrical Power Systems The electrical power systems are designed with the capability of periodic testing for operability.

Components of the systems, e.g.,

onsite power sources, relays and switches are similarly capable of being periodically tested. Passive components such as wiring, con-nections, switchboards and buses are capable of periodic inspection.

Verification of compliance with this portion of the criterion is available in the FSAR.26 Verification of operability of the systems as a whole, including trans-fer of power among the nuclear power unit, the offsite power system and the standby diesel-generator system is available in the FSAR.1 4,26,27 Operability of the systems in accordance with design conditions was verified by preoperational testing.

Criterion 19 - Control Room The control room is installed with sufficient shielding to permit con-tinuous occupancy following any of the accidents analyzed.28,29 The roof contains eight inches of concrete, which is sufficient to reduce doses to within 10CFR20 (5 mr/hr) levels for the containment-design-basis loss-of-coolant accident. Because of this feature, it is not considered necessary to vacate the control room under any foreseeable circumstances.

However, the ability does exist to shut down the reactor and maintain it in a safe condition from locations other than the con-trol room.

This is described in the First Supplement to the FSAR.

c. Protection and Reactivity Control Systems These criteria are intended to identify and establish requirements for functional reliability, in-service testability, redundancy, physical and electrical independence and separation, and fail-safe design of the systems that are essential to the reactor protection functions. In addition, these criteria are intended to establish (1) the reactor core reactivity insertion and withdrawal rate limits, and (2) the means to control the reactor within these limits.

Criterion 20 - Protection System Functions A dual-redundant fail-safe reactor protection system, as described in the FSAR, is provided to initiate automatically appropriate action whenever specific Station conditions reach pre-established limits. 1 4 These limits assure that the core safety limits are not exceeded.

In addition, other protective instrumentation is provided to initiate actions which mitigate the consequences of an accident or operator error. The protective system functions are tabulated in the Technical Specifications.13 III-8

Criterion 21 - Protection System Reliability and Testability Sufficient redundancy and independence are designed into the reactor protection system to ensure that no single failure results in loss of the protective function.

The system is designed such that it will accommodate any single component failure and still perform its protec-tive function.

All protective instrumentation has the capability of being tested and calibrated.

Instrumentation which requires testing between reactor shutdowns has the capability for testing during normal operation.

All instrumentation has the capability for sensor checks'.

Detailed information verifying compliance with this criterion was published in the FSAR and Technical Specifications.3 0,31,l13 14 The protection system is designed to ensure that loss of protective function does not occur because of the effects of natural phenomena, normal operation or accident conditions.

Criterion 22 - Protection System Independence The reactor protection system is designed with diversity in component design and principles of operation.

For example, either a low-low reactor water level or high drywell pressure signal initiates core spray.

Each function is individually testable. Detailed information verifying compliance with this criterion was published in the FSAR. 32,13,14 Criterion 23 - Protection System Failure Modes The reactor protection system is designed to fail-safe upon disconnection of the system, loss of energy or if exposed to adverse environmental conditions.

Information verifying compliance with this criterion is.

available in the FSAR.32,33,14 Criterion 24 -

Separation of Protection and Control Systems The reactor protection system is physically and electrically separate from the control systems such that failure of any single control. com-ponent or channel, or removal from service, leaves the system satisfy-ing the reliability, redundancy, and independence requirements of the reactor protection system. Information verifying compliance with this criterion is available in the FSAR.34,35,14,16,2-Criterion 25 -

Protection System Requirements for Reactivity Control Malfunctions The reactor protection system is designed to ensure that the specified fuel design limits are not 5e ceeded for any single malfunction of the reactivity control systems.

These features are described in the FSAR and verify compliance with the criterion.13,14 Criterion 26 -

Reactivity Control System Redundancy and Capability The Station contains a control rod system and a liquid-poison system for the control of reactivity. These systems are based on different III-9

design principles and are independent. The control rod system, in conjunction with the use.of burnable poison in the fuel and reactor coolant recirculation system flow control, has the capability of controlling reactivity changes resulting from load changes, long-term reactivity changes, xenon burnout and fuel burnup.

Reactor shut-down by the control rod system, in conjunction with the reactor pro-tection system, is sufficiently rapid to prevent fuel damage limits from being exceeded during any anticipated operational transients. The con-trol.rod system is designed with a positive means of insertion and is capable of maintaining the reactor subcritical under hot or cold condi-tions with the highest worth control rod in the fully withdrawn position.

The liquid poison system is capable of bringing and maintaining the reactor core subcritical either in its hot or in its most reactive condition (cold, xenon-free) independent of the control rod system.37'10 The control rod system is described in thy FSAR.11 The liquid poison system is described in the same document. 0,25 Criterion 27 - Combined Reactivity Control Systems Capability As stated in the FSAR Volume I,Section VII, the liquid poison system is provided to bring the reactor to a cold shutdown condition at any 7 1 0 time in core life independent of the control rod system capabilities. 3 '

The most severe requirement imposed on the liquid poison system is to shut down the reactor from a full-power operating condition, assuming complete failure of the withdrawn control rods to respond to an insertion signal.

The rate of negative reactivity insertion provided by the liquid poison system is designed to exceed the rate of reactivity gain asso-ciated with reactor cooldown from the full power condition.

The liquid poison and the emergency core cooling systems are separate and independ-ent systems.

However, when operated simultaneously they accomplish.the dual function under postulated accident conditions of both controlling reactivity changes with appropriate margin for stuck rods and maintain-ing adequate core cooling.

Criterion 28 - Reactivity Limits The Station design incorporates a control-rod velocity limiter to limit the rate of reactivity addition in the event of a control-rod-drop acci-dent and a control-rod housing support to prevent the control-rod-ejection accident.

These engineered safeguards ensure that reactivity additions to the core will not result in damage to the reactor coolant system. The effects of these reactivity additions will not disturb the reactor core, its support structures, or other vessel internals sufficiently to impair core cooling.

A steam line-rupture results in a rapid reactor pressure decrease, an increase in voids, and a negative reactivity addition as discussed in the FSAR.11,

29 III-10

Pressure increases and cold water additions can result in positive reactivity additions. These are discussed in the FSAR.29 The effects of these transients are minimized by the reactor protection and control rod systems.38 Criterion 29 -

Protection Against Anticipated Operational Occurrences Protection and reactivity control systems are conservatively designed to ensure a high probability of accomplishing their safety functions.

A.

probabilistic reliability calculation was performed to predict the failure rate of a protection system. 39 The mathematical model employed was used to determine the testing and maintenance frequency of the pro-tection system which best ensures a reasonable system failure probabi-lity.

The revised calculational results are shown in Table III-1 and replace the table previously presented.J9

d. Fluid Systems These criteria are intended to: (1) identify those nuclear safety systems within the general category of fluid systems; (2) examine each one for capability, redundancy, testability, and inspectability; and (3) ensure that each safety feature's capability encompasses all the anticipated and credible phenomena associated'with'the operational transients or design basis accidents.

In addition, these criteria are intended to establish the design requirements for the reactor coolant pressure boundary and to identify the means for satisfying these design requirements.

Criterion 30 - Quality-of Reactor Coolant Pressure Boundary As discussed in the evaluation for Criterion 14 above, components which are part of the reactor coolant pressure boundary are designed and con-structed to the highest quality standards practical.

Drywell equipment and floor drains are monitored and sampled.

From analyses of-the sam-ples, the location of the source of reactor coolant leakage will be determined.

In addition, a continuous air monitor is employed to moni-tor rises in drywell atmosphere radioactivity which can be related to leakage.Section IV of this report and the FSAR discuss these systems.25 Criterion 31 -

Fracture Prevention of Reactor Coolant Pressure Boundary The reactor coolant pressure boundary was fabricated, inspected and tested in accordance with applicable codes (e.g., ASME Boiler and Pressure Vessel Code and the ASA Code for Pressure Piping) as described in Section III.A.7 of this report. These codes are intended to ensure that the boundary.

behaves in a non-brittle manner.

Also, a maximum nil-ductivity transition temperature for the vessel shell material was established. Conformance with the codes is described in the FSAR.40 Specimens of the vessel, weld material and heat affected zone are located within the core region to permit periodic monitoring of exposure and material properties relative to control samples.

III-11

Table III-l*

.Reactor Protection System Instrumentation Instrumentation System Reactor Pressure Drywell Pressure Reactor Water Level Scram Discharge Volume Water Level Condenser Vacuum Main-Steam-Line Isolation Valve Position Main-Steam-Line Radiation IRM APRM W

Functional Test Interval 1 Month 1 Month 1 Month 1 Month Operating Cycle 3 Months 1 Week 1 Week 1 Week Q

Calculated Failure Probability 6.0 x 10 9 6.0 x 10-9 6.0 x 10-9 6.0 x 10-9 3.4 x 10-6 5.4 x 10-8 1.88 x 10-8 3.2 x 10-16 3.2 x 10-16 M

N 1

2 1

2 1

2 1

2 1

2 1

2 1

2 1

4 1

4 U

Failures/hr.

1.3 x 10 7 1.3 x 10-7 1.3 x 10-7 1.3 x 10-7 1.3 x.10-7 1.3 1.0 1.0 1.0 x 10-7 x 10-6 x 10-6 x 10-6

• This is a revised page.to replace Table 7 shown on page 118 of FSAR.

the Fifth Supplement to the

Steady-state, and transient analyses are also presented in the FSAR.40 These analyses demonstrate that the design of the vessel exceeds the requirements of the applicable codes.

Periodic inspections ensure the continued integrity of the reactor coolant system.-

Criterion 32 -

Inspection of Reactor Coolant Pressure Boundary In-service inspections of the reactor coolant boundary and proposed methods and frequencies for performing these inspections were developed.4 The inspection program developed includes interpretation and 'analysis of the results employing the latest techniques available at the time of in-spection.

It is intended to consult periodically with non-destructive testing contractors formin-service inspections and to review the progress of development work under-way in the industry. A corrosion surveillance program for furnace-sensitized stainless steel is also presented in the FSAR.42,43 Criterion 33 - Reactor Coolant Makeup As discussed in the accident analysis presented in the FSAR, leaks from smaller coolant lines are detected by increa5ed drywell temperature or pressure, or by drywell sump level buildup.

For line breaks with an equivalent area less than 0.15 square feet, feedwater flow provides adequate core cooling. A control-rod-drive pump is continuously available for high-pressure inventory makeup, even if all offsite power is lost.

The control-rod-drive pump would deliver 50 gpm of makeup-to the reactor at operating pressure.

For breaks above the capacity of these systems, or in the event that neither system is available, a redundant core spray system is provided.

This system is discussed in the FSAR.44,25 Core spray coolant does not enter the reactor vessel until reactor pressure has dropped to 365 psig.

For break areas less than 0.15 square-feet, the reactor is depressurized by the redundant auto-relief system. This allows core spray operation and prevents significant clad damage.

As an additional means of accommodating small breaks a feedwater high pressure coolant injection system will be provided.45 The system consists of two redundant sets of motor-driven pumps.

The system will be capable of delivering 7,600 gpm into the reactor vessel at reactor pressure.

Condensate and feedwater-booster pumps are normally operating when the pri-mary system is'at pressure. The two motor-driven feedwater pumps would be automatically started on either a turbine trip or low reactor water level.

The system will use off-site power for operation and on-site power for the lubrication pump.

Installation of final wiring and electrical controls will make the system operable by the end of the first major refuel-ing outage. 46 III-13

Criterion 34 - Residual Heat Removal The Station is provided with a shutdown cooling system for normal shutdown as described in the FSAR.4 In addition, the emergency cooling system provides for decay heat removal from the reactor fuel in the event that reactor feedwater capability is lost and the main condenser is not available. This system was designed with double capacity based on 1850 thermal megawatts as full power output for times greater than 100 seconds after a scram. Safety analysis of the system demonstrates that fuel design limits and coolant pressure boundary design limits will not be exceeded during normal and anticipated transients.10'19 Each of the above systems is provided with redundant isolation valves as is described in the FSAR.47 Leak detection capability is provided to detect valving leakage in each system.48 Criterion 35 -

Emergency Core Cooling Two separate and independent core spray systems are provided as described in the FSAR to provide core cooling in the event of a loss-of-coolant accident.25 These two low-pressure core cooling systems are redundant.

Each system has two 100-percent capacity pump sets for additional redun-dancy. A set of pumps consists of one core spray pump and one topping pump.

The purpose of this system is to provide a highly effective heat sink to the core to remove stored and decay heat, thus preventing core damage. The system operates on either on-site or off-site power and is automatically actuated. It does not require operator action for initia-tion.

The core spray pumps start on either a low-low water level signal or a high drywell pressure signal.

Core spray water enters the core when reactor pressure drops below 365 psig. For breaks smaller than about 0.15 square feet system depressurization due to the break is too slow to allow the core spray system to become effective before an un-acceptably low coolant level is reached. Therefore, the system is de-pressurized by the redundant auto-relief system.

This allows core spray water to enter the core earlier and prevent significant clad damage.

A detailed discussion of the core spray system is presented in the FSAR.49,44 Criterion 36 -

Inspection of Emergency Core Cooling System Essential core spray system components are inspected periodically to ensure the integrity and capability of the system.

Included in the periodic inspection are the core spray nozzles, piping and sparger.

The type of inspection and frequency are specified.4 1 Criterion 37 - Testing of Emergency Core Cooling System The core spray and the auto-relief systems are designed to permit appro-priate periodic pressure and functional testing.

Pumps are periodically tested for flow, developed pressure and automatic initiation.50 Core spray valves are tested for operability and automatic initiation. Tests are also conducted to ensure that emergency cooling water is available to the core within specified time limits.

The testing program demonstrates III-14

that pumps and valves function, under simulated conditions, in the same manner in which the systems are required to operate under accident con-ditions.

The auto-relief system is also tested under simulated accident conditions.

The system is periodically tested by automatically actuating the relief valves as would occur during an accident. The tests are conducted at low pressure to minimize the stress on the reactor coolant system.

The parts of each of these systems which would experience reactor pres-sure during an accident either experience reactor pressure during normal operation or during periodic testing.

The integrity of the core spray piping within the pressure vessel is demonstrated by differential-pres-sure instrumentation. Thermocouples are installed downstream of the auto-relief valves and can monitor leakage from the valves.

Periodic testing of emergency power sources for core cooling is-performed.27 The power systems are tested for automatic pick-up of load required for the loss-of-coolant accident.

The testing simulates accident conditions.

Criterion 38 - Containment Heat. Removal Two separate and independent containment spray systems are provided to remove heat, reduce pressure and restore the pressure suppression system temperature following a loss-of-coolant accident.

Each system is capable of removing all the decay heat and in addition, the energy from any credible metal-water reaction at a rate which will prevent containment pressures and temperatures from exceeding their design values.

The power for the pumps is provided from redundant S~tation reserve-power supply systems or from one of two emergency diesel generators. One of the two spray systems is automatically actuated on the combined condition of high drywell pressure and low-low reactor water-level. The other sys-tem can be manually controlled from the main control room.

Criterion 39 - Inspection of Containment Heat Removal System Essential containment spray system components are inspected periodically to ensure the integrity and capability of the system.

The system and its inspection are described in the FSAR and the Technical Specifications.51'25 Criterion 40 - Testing of Containment Heat Removal System The containment spray system is designed to permit appropriate periodic pressure and functional testing.

Pumps are periodically tested for flow, developed pressure and automatic initiation.bl Containment spray valves are normally open and are not required to operate. The testing program demonstrates that pump sets function, under simulated conditions, in the same manner in which the systems are required to operate under accident conditions.

Periodic spraying of watle into the containment is not practical. There-fore, water is recycled back to the suppression pool during tests.

Air III-15

tests are used to determine nozzle and header flows. These are then correlated with design water-flows.

Testing of emergency power sources for containment cooling is periodically performed.27 The power systems are tested for automatic pick-up of load required for the loss-of-coolant accident. The testing simulates acci-dent conditions.

Criterion 41 - Containment Atmosphere Cleanup -

The Station design provides two containments which act as barriers to fission products, hydrogen, oxygen and other substances that may be released into the containments; Primary containment is provided by a pressure-suppression system. This system has a nitrogen inerting system as described in the FSAR.25 The nitrogen precludes combustion of hydrogen from metal-water reactions.

In addition, as described in Section IV.A.5 of this report, means will be employed to accomodate hydrogen and oxygen produced by radiolysis.

Secondary containment is provided by the reactor building. This build-ing is used for control and cleanup of fission products released during postulated accidents. This containment is maintained at sub-atmospheric pressure so that releases can be controlled and directed to the stack through the emergency ventilation system. This latter fission product cleanup system is-fully redundant and is discussed in Section IV.D.2 of this report. All electrical components have redundant power supplies, one on-site and the other off-site.

Criterion 42 -

Inspection of Containment Atmosphere Cleanup Systems The containment atmosphere cleanup systems are designed.to permit periodic inspection of important components and functions. An oxygen analyzer system is provided to monitor the nitrogen inerting system effectiveness.

The emergency ventilation system is also periodically inspected. The test and inspection programs for these systems are described in the Technical Specifications.52 Criterion 43 - Testing of Containment Atmosphere Cleanup Systems The containment atmosphere cleanup systems, described in Criterion 41, are designed to permit appropriate periodic pressure and functional test-ing.

Oxygen concentration in the primary containment is determined at least once per week. This ensures operability of the functional compo-nents of the containment inerting system The emergency ventilation sys-tem is periodically tested for system operability and filter efficiency.

The testing program for these systems and their emergency sources under simulated accident conditions is described in the Technical Specifi-cations. 52, 27 III-16

Criterion 44 -

Cooling Water The following systems are designed to transfer heat from structures, systems and components important to safety under normal and accident conditions:

1) Reactor building closed loop cooling system

2) Service water system

3) Emergency service water system

4) Containment spray system The design and safety features of these sy3 tems are described in the FSAR and the Technical Specifications. 3 As demonstrated in the references, suitable redundance of components and features exists and the -system safety function can be accomplished assuming a single failure.

Criterion 45 -

Inspection of Cooling Water System The cooling water systems described in Criterion 44 are designed to permit appropriate periodic inspection of important components to ensure integrity and capability of the systems. The inspection program for the containment spray system is outlined in the Technical Specifications.51 The inspection program for the other cooling water systems is included in the FSAR.4 Criterion 46 -

Testing of Cooling Water System The cooling water system described in Criterion 44 is designed to permit appropriate periodic pressure and functional testing to ensure structural and leaktight integrity of the components, operability and performance of the components, and the system as a whole.

The testing program for the containment spray system is discussed in Criterion 40 above.51 The testing program for the other cooling water systems is included in the FSAR.4

e. Reactor Containment These criteria are intended to establish the design requirements for the primary containment and to identify the means for satisfying these requirements including fracture prevention, leakage testing-,

containment testing, inspection and isolation.

Criterion 50 - Containment Design Basis The-reactor containment structure, penetrations, valves, access open-ings and the containment spray system are designed with margin to accom-modate the temperatures and pressures associated with the loss-of-coolant accident. The design bases and response of the containment system are described in the FSAR.54,47 The containment system is designed to accommodate temperature and pres-sure while maintaining the low leakage rate required by the Technical 11.I.

III-17

Specifications. Special precautions, such as double-sealed access ways and penetrations, are taken to minimize containment leakage.

As described in these references, the system is designed to accommodate large amounts of metal-water reaction which result from degraded emer-gency core cooling.

The calculational model and design parameters are conservatively based on testing.55 Criterion 51 - Fracture Prevention of Containment Pressure Boundary The reactor containment boundary is designed with margin to ensure that, under operating, maintenance, testing and postulated accident conditions, ferritic materials behave in a non-brittle manner, and the probability of a rapidly propagating failure is minimized.

The primary containment is designed in accordance with the 1965 ASME Boiler and Pressure Vessel Code,Section III. Transients for normal and accident conditions were evaluated and results appear in the FSAR.22,56,70 The an-alysis includes transients for the steel shell and for penetrations. The low stress'levels achieved allow adequate safety margins for uncertainty in determining exact material properties and stresses.

Criterion 52 - Capability for Containment Leakage Rate Testing The leakage-rate testing program for the primary containment and associated equipment is described in the Technical Specifications.57 Pre-operational tests were conducted at the design pressures of the containment and also at'the calculated initial accident pressures of 22 psig.

These tests established the leakage relationship to containment pressure.

Subsequent periodic leakage tests are conducted at the initial accident'pressure of 22 psig.

Criterion 53 -

Provisions for Containment Testing and Inspection The testing and inspection program for the reactor containment is des-cribed in the Technical Specifications.57 Accessible interior surfaces of the drywell are inspected during each operating cycle. Testable penetrations and bolted double-gasketed seals are tested at 35 psig during each refueling outage.

Criterion 54 - Piping Systems Penetrating Containment Piping systems which are open to the free space of the containment a4r provided with redundant isolation features as described in the FSAR.

Those'systems, for which isolation is important during the design basis accident, are provided with automatic' actuation.

The piping systems, including valves, are testable for leak tightness and operability. The test programs are described in the Technical Speci-fications.57 III-18

Criterion 55 -

Reactor Coolant Pressure Boundary Penetrating Containment All lines which are part of the reactor coolant pressure boundary and penetrate the primary reactor containment are provided with redun-dant isolation valves. As a general rule one of each pair of iso-lation valves in series is located inside the containment. The other valve is outside the containment. On the emergency cooling system supply and on the feedwater system where it was necessary to install both valves outside the containment, a guard pipe is installed between the line and the containment-vessel penetration sleeve. This sleeve is welded to the body of the first isolation valve outside the con-tainment. This in effect extends the containment to include the body of the first isolation valve. In addition, the two valve bodies are welded end to end for greater integrity.

Lines which are part of the reactor coolant boundary and may be required to have flow after an accident are provided with check valves. The con-trol rod drive and liquid poison systems have two check valves in series.

One valve is inside the containment. The feedwater system, as described above, has two valves outside the containment, one of which is a check valve.

The cleanup and shutdown cooling systems each have redundant isolation valves with one valve inside the containment. The outer valve is a check valve.

Instrument lines are provided with redundant valving-outside the contain-ment. Automatic flow check valves minimize loss of reactor coolant in the event of an instrument line break. Further discussion of-these lines is included in Section III.B.ll of this report.

The ability of external check valves to isolate under accident conditions is supported by analysis.58 All external isolation valves are located as close to the containment as possible.

Where guard pipes are used between the containment penetra-tion and the line, the outer valve is welded to the guard pipe. On low-temperature lines where no guard pipe is required, the outer valve is welded directly to the penetrations sleeve.

The isolation system for each line is designed to accomodate loss of power to an isolation valve.

Motor operated valves (ac or dc) are designed to fail in the mode in which they are when loss of power occurs. Air operated valves fail closed upon loss of power.

Different power sources for each valve in series ensure that the isolation function will not be defeated by single failure.

Failure of a single power source does not prevent isolation even where a normally open.motor operated valve fails open.

The other valve in series would isolate.

In the case of systems which are required to be open following an accident, valves are either normally open and fail open, are normally closed but fail open or are normally closed but fail closed (as is) but have a redundant valve path in parallel.

Criterion 56 -

Primary Containment Isolation All lines which connect directly to the containment atmosphere and III-19

penetrate the primary reactor containment are provided with redundant isolation valves.

Two normally closed valves outside the containment are provided for systems which are not required to function under accident conditions.

Each containment spray line which is required to be open under acci-dent conditions contains a check valve outside the containment. These check valves are installed-to minimize bypassing of pressure suppression during the initial pressure transient of the loss-of-cooalnt accident.

The oxygen sample return line and the nitrogen purge line for the trav-eling incore probes use two check valves in series outside the contain-ment.

All penetrations, isolation valves and containment spray system compo-nents are designed and fabricated as extensions of the primary contain-ment. The-systems are considered to be part of the containment.

All valves are located as close to the containment as possible.

The isolation system for each line is designed to. accomodate loss of power to an isolation valve.

Motor operated valves (ac or dc) are designed tb fail in the mode in which they are when loss of power occurs.

Air operated valves fail closed upon loss of power.

Different power sources for each valve in series ensure that-the isolation function will not be defeated by single failure.

Failure of a single power source does not prevent isolation even where a normally open motor operated valve fails open. Isolation is effected either by having a closed piping system which does not communicate with containment atmosphere or by having a redundant separately powered valve in series with the failed valve. In the case of systems which are required to be open following an accident, valves are normally open and fail open.

Criterion 57 - Closed System Isolation Valves Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere, has one isolation valve. The two systems covered by this description are the drywell cooling system and recir-culation pump cooling system.

These systems circulate cooling water in a closed system into and out of the containment. Each line carrying incoming cooling water is provided with a self-actuating check valve outside the containment.

Each line which carries water out of the con-tainment has a motor-operated valve which is actuated by remote manual control.

f. Fuel and Radioactivity Control These criteria are intended (1) to establish Station effluent release limits and to identify the means of controlling releases within these limits; (2) to define the radiation shielding, monitoring, and fission process controls necessary to effectively sense abnormal conditions and initiate required-safety systems; and (3) to establish requirements for safe fuel and waste storage systems and to identify the means to satisfy these requirements.

III-20

Criterion 60 -

Control of Releases of Radioactive Materials to the Environment The Station radioactive-waste control systems, which include the liquid, gaseous and solid radioactive waste sub-systems, are designed presently to limit the offsite radiation exposure to levels below those set forth in 10CFR20.

The air-ejector offgas system is designed with sufficient holdup capacity to prevent the controlled release of radioactive materials from exceeding the established release limits at the elevated Station stack during normal Station operation. The liquid waste system is also designed with holdup tanks to allow controlled release of liquid efflu-ents.

The existing waste treatment facilities are described in the FSAR.59 The facilities for gaseous and liquid control will be upgraded as descri-bed in Section III.A.9 of this report to meet the guide values of proposed Appendix I to 10CFR50.

Criterion 61 - Fuel Storage and Handling and Radioactivity Control The fuel storage and handling systems and the radioactive waste systems are designed to ensure safety under normal and accident conditions. The inspection and testing program for the fuel storage and handling systems are described in the FSAR.4 Procedures and interlocks used in fuel hand-ling are described in the Technical Specifications. 60 Shielding and residual heatiremoval systems are provided for fuel handling and storage and for the radioactive waste systems.4,59 The fuel handling and storage systems are in the reactor building, i.e.,

the secondary containment. The waste handling systems are in the leak-tight waste disposal building. Both of these buildings have filter sys-tems and serve as confinement for radioactivity.

Fuel storage coolant inventory is maintained under accident conditions.

A system of interlocks and energy-absorbing materials are used to main-tain the coolant inventory. This is discussed in Section.III.B.13 of this report.

Criterion 62 - Prevention of Criticality in Fuel Storage and Handling The spent-fuel storage system is geometrically designed such that keff is less than 0.9 as discussed in the FSAR.61,4 The new-fuel storage vault racks located inside the secondary containment are designed for top entry and to prevent an accidental critical array even in the event the vault becomes flooded.

Vault drainage is provided to prevent possible water accumulation.

Criterion 63 - Monitoring Fuel and Waste Storage Alarms in the control room are provided for high flow, low flow and temperature where essential to proper operation of the systems. The area radiation monitors, described in the FSAR, give warning of any abnormal radiation levels.59 III-21

Criterion 64 - Monitoring Radioactivity Releases Radioactivity releases which result from normal and gyticipated operational occurrences, are monitored as described in the FSAR.

Among these are:

1) Gaseous releases from the stack

2) Liquid discharge to the circulating water tunnel

3) Reactor building ventilation.

4)

Waste building ventilation In addition, the drywell containment atmosphere is monitored and on-site and off-site monitors are provided.

The monitors that would be used for accident conditions and the program for environmental monitoring are described in the FSAR.62,63,59 Semi-annual reports of operation are submitted to the Commission. These reports include specific information on the quantities of the principal radionuclides-released to the environs. This'is done within 60 days after each successive six-month operating period.64

2. Appendix B - Quality Assurance Criteria for Nuclear Power Plants The quality assurance program which was adopted for use at the Station is designed to ensure that continuing activities are conducted in accordance with the applicable requirements'of this Appendix. The procedures outlined in the FSAR apply to all equipment, structures, and systems designated as Class 1.65 An organiz tion is established to implement the program and is described in the FSAR.6 The quality assurance program is being implemented.

In addition, the Safety Review and Audit Board is employed to audit periodically the functions of the program.

3. Appendix C - A Guide For the Financial Data and Related Information Required to Establish Financial Qualifications for Facility Construction Permits and Operating Licenses The information required by this appendix accompanies this Technical Supplement.

It consists of Niagara Mohawk's 1971 Annual Report.

4. Appendix D -

Interim Statement of General Policy and Procedure:-

Implementation of the National Environmental Policy Act of 1969 The Applicant's Environmental\\Report accompanies this'application.

5. Appendix E -

Emergency Plans for Procedure and Utilization Facilities This Appendix defines minimum requirements of the applicant at both the construction permit and operating license stages regarding his plans for coping with emergencies: The minimum requirements include presentation of discussions of the organizations, procedures, contacts and arrangements to be implemented in the event an emergency occurs. Also required for III-22