ML072260472

Safety Evaluation Report, Supplement 3

ML072260472
Person / Time
Site:	Indian Point
Issue date:	04/30/1976
From:	Office of Nuclear Reactor Regulation
To:
References
FOIA/PA-2009-0166
Download: ML072260472 (37)

Text

ShefetyT U. S. Nuclear Ihvslinationm IleIlit F*egulatory Commission related to operation of Office of Nuclear Reactor Regulation Indian Point Nuclear Generating Docket No. 50-286 Unit No. 3 April 1976 Consolidated Edison Company of New York, Inc.

Supplement No. 3

April 5, 1976 SUPPLEMENT NO. 3 TO THE SAFETY EVALUATION REPORT BY THE OFFICE OF NUCLEAR REACTOR REGULATION U. S. NUCLEAR REGULATORY COMMISSION IN THE MATTER OF CONSOLIDATED EDISON COMPANY OF NEW YORK, INC.

AND THE POWER AUTHORITY OF THE STATE OF NEW YORK INDIAN POINT NUCLEAR GENERATING UNIT NO. 3 DOCKET NO. 50-286

TABLE OF CONTENTS PAGE

1.0 INTRODUCTION

.................... ................................ 1-1 2.0 SITE CHARACTERISTICS ............... ............................ .. 2-1 2.5 Geology, Seismology and Foundation Engineering ....... ........... 2-1 4.0 REACTOR ..................... .................................. 4-1 4.4 Thermal and Hydraulic Design .......... .................... .. 4-1 5.0 REACTOR COOLANT SYSTEM ............. ........................... .. 5-1 5.2 Integrity of the Reactor Coolant Pressure Boundary ............ .. 5-1 6.0 ENGINEERED SAFETY FEATURES ............. ......................... 6-1 6.2 Containment Systems ............. ......................... 6-1 6.2.3 Containment Isolation Systems ....... ................ 6-1 6.2.5 Leakage Testing Program ....... ................... .6-1 6.3 Emergency Core Cooling Systems .......... ................... .6-2 6.3.1 Design Bases .............. ........................ 6-2 6.3.1.1 Single Failure Criterion ..... .............. .6-2 6.3.1.1.1 Inadvertent or Spurious Actuation of Motor-Operated Valves ............. .. 6-3 6.3.1.1.2 Submerged Valves ..... ............ ..6-4 6.3.3 Performance Evaluation ........ ................... .. 6-7 6.3.3.1 Containment Pressure Analysis .... ........... .. 6-8 6.3.3.2 Long-Term Boron Concentration .... ........... .. 6-8 6.3.3.3 Local Power Spiking ...... ................ .. 6-9 6.3.4 Tests and Inspections ........... .................... 6-10 6.5 Fuel Densification .............. ......................... .. 6-11 i

TABLE OF CONTENTS (Continued)

PAGE 7.0 INSTRUMENTATION AND CONTROL SYSTEMS ........... ..................... 7-1 7.3 Initiation and Control of Engineered Safety Feature Systems ........ 7-1 7.6 Residual Heat Removal System Interlocks ........ ............... 7-5 8.0 ELECTRIC POWER ................... ............................... .. 8-1 8.3 Onsite Power ..... .......................... ............. 8-1 8.3.2 D-C Power Systems ............ ...................... .. 8-1 18.0 THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS).. . ..... .......... .. 18-1 18.11 Initial Limitation on Power Level ......... .................. .. 18-1 APPENDIX A CONTINUATION OF CHRONOLOGY. ............ ...................... A-1 ii

1.0 INTRODUCTION

The Nuclear Regulatory Commission's (Commission) Safety Evaluation Report in the matter of the application by Consolidated Edison Company of New York, Inc.

(Consolidated Edison) to operate the Indian Point Nuclear Generating Station Unit No. 3 (Indian Point 3 or the facility) was issued on September 21, 1973.

Supplement No. 1 to the Safety Evaluation Report was issued on January 16, 1975, and Supplement No. 2 was issued on December 12, 1975.

Supplement No. 2 was issued in support of our conclusions regarding the issuance of an operating license authorizing fuel loading and subcritical testing of Indian Point 3. On December 12, 1975, we issued Operating License DPR-64 to Consolidated Edison authorizing fuel loading and subcritical testing of the facility. On December 24, 1975 Operating License DPR-64 was amended to include the Power Authority of the State of New York (the Authority) as a colicensee in order to allow the Authority to purchase the facility. Our Safety Evaluation in support of our conclusions regarding the issuance of the license amendment was also issued on December 24, 1975. On December 31, 1975, the Authority purchased Indian Point 3. The Consolidated Edison Company of New York, Inc., and the Power Authority of the State of New York will hereafter be referred to as the licensees.

Supplement No. 2 included a discussion of those matters required to be resolved to assure safe operation of Indian Point 3 during fuel loading and subcritical testing. The remaining matters which were required to be resolved before a decision could be made regarding power operation were also discussed. We indicated that final resolution of these matters would be reported in another supplement to the Safety Evaluation Report prior to a decision regarding power operation of Indian Point 3. This supplemcnt is in support of our conclusions regarding a decision for issuance of a license authorizing power operation up to 91 percent of rated power.

Each of the sections in this supplement is numbered the same as the section of the Safety Evaluation Report and Supplements No. 1 and No. 2 that is being updated.

Appendix A is a continuation of the chronology of our principal actions related to the processing of the application.

We have reviewed the recommendations of the Office of Inspection and Enforcement and have concluded that all items of construction and testing (including the design modifications discussed in Sections 6.0 and 7.0 of this supplement) necessary for power operation up to 91 percent of rated power have been acceptably completed.

We have concluded that power operation up to 91 percent of rated power will not be inimical to the common defense and security, or to the health and safety of the public.

1-1

2.0 SITE CHARACTERISTICS 2.5 Geology, Seismology and Foundation Engineering This section presents our evaluation of the additional confirmatory information related to the age of faulting at the Indian Point site. In Supplement 2 to the Safety Evaluation Report, we concluded that the faults identified at the site are not capable within the meaning of Appendix A to 10 CFR Part 100. This conclusion was based on our review of the licensees' report (prepared by Dames and Moore),

"Supplemental Geological Investigation of the Indian Point Generating Station";

an onsite inspection; and meetings with the licensees' consultants, the licensees' geological review panel, and the New York State Geological Survey. Specifically, this conclusion was based on the determination of the age of most recent movement by the genetic association of these faults with the last known regional deformation, and the age of formation of nonbrecciated calcite crystals taken from cross-cutting faults.

We considered the data contained in the licensees' report to provide the reasonable assurance required to proceed with fuel loading. However, we considered some observations in the report to be inadequately supported and explained. We, there-fore, requested additional confirmatory data on several aspects of the geologic investigation. These aspects were discussed in Supplement 2 and in our letter to the licensees of January 8, 1976.

Our request for additional documentation concentrated on the following three areas of concern:

(1) Regarding the genetic association of onsite faults with regional faults, we were concerned that the fault cutting Pleistocene strata located about 12 miles northwest of the site could be of tectonic origin and might be related to regional bedrock faulting.

(2) We were also concerned that the seismic reflection profile anomalies in the Hudson River near the site might be caused by recent displacement of river bottom sediments.

(3) Although fluid inclusion analysis has been used for many years by the mining industry to make inferences about the genesis of ore bodies, we requested additional support and documentation for the site study because, in our opinion, the technique had not been sufficiently tested as a means of dating fault movements.

Two other items that were necessary for us to complete our review were: (1) a report by the licensees' geological review panel, and (2) a written statement by the licensees setting forth in what respects their July 1, 1975 report on regional faulting has been altered by the continuing mapping program.

2-1

The licensees responded to our requests for additional information by submitting the report of the geological review panel, a supplement to the original geological investigation report consisting of Appendices K, L, and M, and a preliminary report by Dr. N. Ratcliffe entitled "Paleozoic Age of 'Triassic' Border Fault at Northern End of Newark Basin in New York State." These documents were transmitted to us by letter dated January 19, 1976, from Mr. W. J. Cahill to Mr. D. B. Vassallo.

The following paragraphs present our conclusions regarding the above matters. In addition, we have discussed and provided our conclusions regarding new information that has come to our attention about earthquakes which might be correlated with the Ramapo Fault.

Site Faults The licensees' geological review panel, consisting of Drs. R. Price and D. Caotes, stated in their report that, although they do not agree with "a number of relatively minor aspects of the interpretation in the Dames and Moore report," they "are in substantial agreement with the main conclusion of the report." They concluded "from the uniformly high homogenization temperatures for primary fluid inclusions in undeformed calcite crystals which grew in faults at the site, that the last movements on the faults occurred many millions of years ago, and probably during the Late Triassic or Early Jurassic (more than 165 million years ago)."

In the licensees' letter dated January 11, 1976, Dr. Ratcliffe presented data from two localities which are supportive of a change from his earlier interpretation regarding the northeast extension of the Triassic Border Fault (Ratcliffe, 1971).

He now considers the NlO0 E, N40 0 E trending fault system extending from Thiells, New York, to Tomkins Cove to be of Paleozoic (pre-Triassic) age. This interpretation places the Ramapo Fault System more distant from the site than previously thought.

Appendix L to the geological investigation report presents arguments supporting a glacial origin for the four foot offset and soft sediment deformation anomalies found in Pleistocene soils exposed in an asphalt quarry 12 miles northwest of the site. We agree with the licensees' conclusion that these anomalies and the fault were most likely caused by nontectonic processes in loose, saturated soil deposits of a kame delta. These deposits represent a dynamic zone adjacent to a fluctuating glacier front. Therefore, it is not likely that the Pleistocene anomalies are related to recent bedrock fault displacements.

Seismic reflection and bathymetric profiling in the Hudson River near the plant site showed anomalies in the river bottom at several places. These reflection profiles were presented as graphic reproductions and discussed in Appendix M to the geological investigation report. In that submittal, the licensees advanced several possible explanations for the anomalies: (1) cultural causes such as dredging, dumping of construction wastes, or the anchoring of a moth ball fleet, 2-2

(2) natural causes such as faults, the contact between two dissimilar rock types, or bottom features caused by current action. The licensees have further suggested that these anomalies may in some manner reflect the overall geologic structural grain of the area. We considered these anomalies of potential significance because they appeared to allign with a major structural boundary which trends N38 0 E and passes along that part of the Hudson River nearest the plant. The licensees responded to our concern with an amendment to Appendix M to the geological investi-gation report. The amendment stated that while there is an apparent alignment with a wide fracture zone seen onshore that coincides with a major tectonic boundary, the seismic anomalies are not related to bottom structure. The seismic reflections are from soft river bottom mud and any recent offset of this material would not persist long because of the dynamic nature of the river environment. Furthermore, any recent faulting would disrupt cultural features onshore and would be easily identified.

We have examined the seismic reflection records and we agree with the licensees' conclusions. The precise nature of the anomalies cannot be determined from the profiles. We have concluded, however, based on our analysis of the data, that the anomalous seismic signatures are different from one another and appear to be irregularities at the water river-bottom interface and are probably attributable to erosion or debris rather than disruption of the upper reflection horizons by faulting. One profile does show an apparent offset of the river bottom near Lents Cove. Profiles in that area were taken at close spacing, separated by less than 1000 feet and show that the anomaly is localized. Subsequently, the licensees determined that dredging operations have been conducted in the river in the area of the anomaly. Because the apparent offset is confined and of limited extent, we consider it unlikely to be of geologic significance.

As discussed in Supplement 2 to our Safety Evaluation Report, the licensees determined the age of most recent movement of the onsite faults from the minimum age of formation of unbrecciated calcite crystals taken from crosscutting faults.

The determination of the age of crystal formation involves, in addition to an assessment of the temperature and pressure at which the crystals were formed, an evaluation of depth of burial and rates of erosion in the area. Photomicrographs of the unbrecciated crystals showing their relationship to the fault also have been produced. We concluded in Supplement 2 that the analyses performed and the conclusions of the licensees' consultants were valid but required additional supportive documentation as follows: (1) precise locations from which the samples were taken, (2) cross-reference between faults and the crystal samples tested in the laboratory, (3) additional photomicrographs of the unbrecciated crystals showing their relationship in and to the faults, (4) additional documentation to more fully define the location and age of the last regional thermal event to help support the conclusions regarding the temperature of formation of the unstrained calcite, (5) additional supportive documentation by other age dating.

processes, and (6) a more detailed discussion and documentation of the erosion rates in the region.

2-3

In Appendix K to the geological investigation report, the licensees demonstrated the crosscutting fault relationships and attempted to show the exact field locations of the crystal samples presented. Also provided in Appendix K were photomicrographs showing the relationships between the calcite crystals and the fault breccias and mylonites. Data were presented on nine samples taken from various faults and fractures around the site. Two of these samples were taken from the set of faults that has been shown by onsite mapping to have experienced the latest movement in the area (north-south and northeast faults with left lateral displacement). On March 22, 1976, we met with the licensees and their consultants and were shown results of additional fluid inclusion tests not presented in the report. The relative uniformity of homogenization temperatures of all samples that we have reviewed to date is supportive of a regional hydro-thermal event, the conditions for which have probably not existed in the area of the site since late Mesozoic or early Tertiary time (about 37 to 65 million years ago).

The lithostatic pressure and inferred depths of burial of the crystals during formation were calculated by the licensees' consultants using two methods.

Method 1 involves the determination of the minimum total pressure required to prevent water from boiling at the temperatures at which the fluid inclusions formed. Applying the assumed burial depths and erosion rates, it was determined that the undeformed crystals were at least several hundred thousand years old.

The second method employed a conservative geothermal gradient, calculated the required depth of burial and applied the same denudation rates as assumed for Method 1. The latter method indicates that the crystals were formed no later than Late Mesozoic time. We considered these analyses to be reasonable and to support the licensees' conclusions. Method 1 probably represents a very conservative upper limit for the age of formation of the crystals. Other age dating techniques were considered by the licensees but were discarded as being not feasible.

In Appendix K to the geological investigation report, the licensees discussed the methodology of the fluid inclusion technique and the potential sources of errors involved in this type of age dating and their effect on the final results. We have discussed the details of the fluid inclusion method with Dr. H. Barnes, the licensees' consultant. As a result of our review, we have concluded that the sampling, testing, and interpretation of results have been done in a careful and conservative manner.

At our request the licensees performed an extensive search of the literature regarding erosion rates. In making the calculations the greatest rate of erosion that appears in the literature (2.7 inches per 1000 years) was used. Also, it was assumed that 75 feet of material was removed during glaciation before the above rate was applied to the remaining material. We consider the denudation rate of 2.7 inches per 1000 years together with the assumption of 75 feet for glacial erosion to be conservative.

2-4

We have completed our review of the data provided by the licensees in response to our request for additional confirmatory data outlined in Supplement 2 to the Safety Evaluation Report and in our letter to Consolidated Edison dated January 8, 1976. These data support our conclusion stated in Supplement 2 that the faults at the Indian Point site are not capable within the meaning of Appendix A to 10 CFR Part 100.

Regional Faulting Many of the details of the regional geologic structure irithe vicinity of the Indi'an Point site are not completely known. The preponderence of the available evidence in the published literature and the data that have been obtained by the licensees' consultants during their investigations of the site and its vicinity indicates that the last significant tectonic activity probably occurred during the late Mesozoic era.

The major geologic structure in the region, commonly referred to as the Ramapo Fault, extends from Stony Point, New York, to Peapack, New Jersey, a distance of about 50 miles. The Ramapo Fault proper and its northern extension into the Hudson Highlands have been referred to collectively by Ratcliffe (1971) as the Ramapo Fault System. This fault system is considered to be a major, perhaps fundamental, structural feature of the region. Ratcliffe (1971) has interpreted it to have experienced recurrent movements from Precambrian through early Mesozoic time. Although a significant amount of mapping has been done on the fault system, portions of it remain poorly mapped.

Historic earthquake activity in the region of the Ramapo Fault System is generally low and no obvious clustering of activity along the fault system can be seen. It has been suggested, however (Page, et al, 1968, Davis, et al, 1974), that some earthquakes can be associated with the fault system.

Two focal mechanism solutions could be interpreted as indicating that the region generally may be under tensional stress, a condition that could be conducive to movement on the Ramapo Fault System. The first of these is a composite solution for a very shallow microearthquake swarm which evidently occurred on an inferred fault parallel to the Ramapo Fault some 12 miles to the northwest. The second solution is for a macroearthquake which occurred near Wilmington, Delaware, more than 100 miles from the above mentioned microearthquake swam. The Ramapo Fault trends between the locations of these two focal mechanism solutions.

We have recently been given new information concerning two earthquakes*which occurred near the Ramapo Fault. First, Dr. L. R. Sykes of Lamont-Dougherty Geological Observ-atory has relocated the 1951 Rockland County, New York, earthquake (Modified Mercali intensity V) and concluded that the epicenter probably was within one to two kilometers 2-5

of the Ramapo Fault. Second, an earthquake of Modified Mercali intensity IV-V occurred near the.Ramapo Fault on March 11, 1976. Dr.. Y. P. Agarwal, also of Lamont-Dougherty Geological Observatory, has determined the location to be within two kilometers of the fault. He has estimated the magnitude to be about 2.5 and determined a tentative focal mechanism solution which could be consistent with normal movement on the Ramapo Fault. Because of these observations, uncertainty continues to exist about possible earthquake activity on the Ramapo Fault System.

Direct determination of the structural history of this fault system is difficult because glaciation and erosion have removed most of the older deposits which might have provided definitive evidence of the age of most recent movement on the fault. Pleistocene deposits which do provide an upper limit on recency of last movement are not of sufficient age to definitively demonstrate that the fault system is not capable within the meaning of Appendix A to 10 CFR Part 100. Never-theless, investigation of some portions of this feature and a substantial amount of regional geologic mapping have been conducted by both the licensees' consultants and other recognized experts on the geology of this region. To date, no direct geologic evidence suggestive of geologically recent movement has been reported on any of the faults in this region.

We consider the lack of evidence of geologically young movement and the absence of any obvious clustering of historic earthquake activity along the Ramapo Fault System to support the conclusion that the fault is not capable within the meaning of Appendix A to 10 CFR Part 100. We, therefore, consider our original position, that the design of the units for the largest historic earthquake to have occurred randomly within the site's tectonic province, provides reasonable assurance that the plant will not be subjected to ground motion greater than that for which it was designed.

Nevertheless, because of the recent location of the two earthquakes near the fault, we consider a confirmatory program directed toward a more definitive determination of the age of most recent movement and a determination of the potential for earth-quake activity on the fault system to be necessary. Accordingly, we will condition the amendment to the operating license authorizing power operation to require the licensees to conduct the investigation program described below.

We consider the probability extremely remote that, during the period of investi-gation, the plants will experience an earthquake larger than that for which they were designed, even if our conclusion with regard to the capability of the Ramapo Fault should be incorrect.

Specifically,as a condition in the amendment to the operating license authorizing power operation of Indian Point Unit 3, we will require a program of geological and seismological investigations to provide additional information relevant to the following objectives:

2-6

(1) Geological mapping in sufficient scope and detail to accomplish the following:

(a) Definition of the main trace of the Ramapo Fault and associated faults of the Ramapo Fault System.

(b) Structural and tectonic relationship of the Ramapo Fault System with faults at the Indian Point site.

(c) Identification of crosscutting features and faults which might be used to determine the age of most recent movement on faults of the Ramapo system.

(d) Age dates of the fault along those sectors near the epicenters of the 1951 Rockland County, New York, earthquake and the 1976 Pompton Lakes, New Jersey, earthquake.

(2) Determination of the age of most recent movement on the Ramapo Fault and the Ramapo Fault System by appropriate age dating techniques and relationship to crosscutting features.

(3) Determination of the relationship of current and historic earthquake activity to the Ramapo Fault and Ramapo Fault System. The existing earthquake monitoring network is to be extended southward to include the Pompton Lakes, New Jersey epicenter area and northward to include the Fahnstock region. The density of the network should be sufficient to obtain precise locations and focal mechanism solutions. Velocity studies needed to obtain reliable earthquake locations and mechanism solutions should be conducted. This network is to be operated at least two full years following complete installation of all stations. These studies should be supplemented by stress measurements to define the current tectonic environment of the area.

(4) Additional geochronological age dates of most recent movements shall be obtained on those faults observed in the immediate vicinity of the plant, including each of the different fault sets. Fluid inclusion dates are to be confirmed by dating other mineral assemblages and/or by using other dating techniques.

The licensees are to provide a detailed work plan for completion of the above studies within sixty days from the date of the issuance of the amendment to the operating license authorizing power operation. The investigations under Conditions 1, 2, and 4 are to be completed and a final report of the findings submitted to the staff for review by April 1, 1977. The investigations under Condition 3 are to be completed within two years following the onset of operation of the complete seismic monitoring network, but in no case shall the completion of the investigations under Condition 3 extend beyond three years of the date of issuance of the amendment to the license authorizing power operation.

2-7

4.0 REACTOR 4.4 Thermal and Hydraulic Design Recent generic information provided to us by Westinghouse indicates that the effects of rod-to-rod bowing on the departure from nucleate boiling ratio (DNBR) and local power spiking should be considered in evaluating the thermal and hydraulic design and the emergency core cooling system performance. Our evaluation of the effect of rod-to-rod bowing on emergency core cooling system performance is presented in Section 6.3.3.3 of this supplement. Our evaluation of the effect of rod-to-rod bowing on DNBR is presented below.

Data made available from 15xl5 fuel assemblies at burnups up to 27,000 megawatt days per metric tonne uranium subsequent to the submittal of Westinghouse Topical Report WCAP-8346, "An Evaluation of Fuel Rod Bowing," show that the model pre-sented in that report underestimates the extent of rod bow. The 15xl5 fuel assembly rod bow data indicate that a penalty of approximately 4.4 percent in DNBR should be applied to the Indian Point 3 design to account for rod bowing up to 31.000 megawatt days per metric tonne uranium. We will require that a total penalty of 6.4 percent in DNBR be used to account for rod bowing. The additional two percent penalty will be required for conservatism pending the completion of our review of the Westinghouse approach for the 15xl5 fuel rod geometry. When our review is completed, the 6.4 percent penalty may be modified to conform to the data.

The Indian Point 3 core design offers approximately 3.3 percent margin in DNBR due to pitch reduction and 3.2 percent due to the continued use of a conservative Thermal Diffusion Coefficient of 0.019 in the 15xl5 design analyses. This provides sufficient design conservatism to offset the DNBR penalties due to rod bow.

4-1

5.0 REACTOR COOLANT SYSTEM 5.2 Integrity of Reactor Coolant Pressure Boundary In Supplement No. 2 to the Safety Evaluation Report we indicated that we had concluded that operation of Indian Point 3 with the steam generator channel heads in their present condition will not create undue risk to the health and safety of the public and is, therefore, acceptable. We also indicated, however, that prior to power operation the technical specifications would be revised to require performance of an inservice inspection program acceptable to the staff.

In a letter dated November 12, 1976, Consolidated Edison proposed an inservice inspection program which included the following:

(1) Visual examination of the interior surfaces of the head will be performed each of the first three refueling shutdowns.

(2) Specific sections of the internal weld surfaces of the head, which after visual examination require more definitive investigation, shall be evaluated by liquid penetrant testing. Additional non-destructive testing, including replication using RTV-l1 silicone rubber type material, will be employed where liquid penetrant results indicate that they are required.

(3) Monitoring of the existing cladding conditions shall be performed by ultra-sonic testing from the exterior surface.

We indicated in Supplement No. 2 to the Safety Evaluation Report that it was our position that the surface examinations discussed in (2) above be performed at each of the.first three refueling shutdowns rather than being conditional upon the results of the visual examination.

Upon reevaluation of our position we have concluded that Consolidated Edison's original proposal is acceptable provided that the visual examination is recorded on video tape. The technical specifications have been revised to include require-ments for inservice surveillance of the steam generator channel head cladding consistent with the proposed surveillance program described above. In addition, our requirement for recording the visual examination on video tape has-been included in the technical specifications. We conclude that this matter is acceptably resolved.

5-1

6.0 ENGINEERED SAFETY FEATURES 6.2 Containment Systems 6.2.3 Containment Isolation Systems As discussed in Section 6.3.1.1.2 of this supplement, the licensees have submitted an analysis which indicates that following a postulated loss-of-coolant accident, the maximum water level that could be expected inside containment would be at elevation 50 feet 1-1/2 inches. The licensees have identified two containment isolation valves (Valves 891B and D) which could be submerged should this water level be reached. These valves are located in the one-inch nitrogen supply lines to Accumulators 32 and 34, respectively. The valves are normally closed during plant operation and fail in the closed direction with loss of air or electrical power. However, since these valves have not been qualified for the submerged environment to which they may be subjected, we have required the licensees to relocate the solenoid operators for these two valves to an elevation above the flood level.

The licensees have evaluated the relocated operators in accordance with their commitments in the FSAR regarding seismic design analysis methods and criteria, and criteria for protection against the dynamic effects associated with postulated pipe breaks in high energy lines inside containmentand have found them to be acceptable.

We have concluded that relocation of the solenoid operators for the containment isolation valves to an environment for which they are qualified is an acceptable design change. The modified design is acceptable and provides assurance that the isolation valves will have the capability to perform their safety function.

6.2.5 Leakage Testing Program We indicated in Supplement No. 2 to our Safety Evaluation Report that the contain-ment integrated leak rate testing was acceptable subject to resolution of the frequency at which air lock tests will be conducted. We also stated that we would require that the air lock be tested at six-month intervals in conformance with Appendix J to 10 CFR Part 50.

In response to this requirement, the licensees have proposed to test the air locks at a frequency of every six months and have revised the technical specifi-cations proposed for power operation to include this requirement. We conclude that this matter is acceptably resolved since the testing conforms to Appendix J to 10 CFR Part 50.

6-1

6.3 Emergency Core Cooling System In Supplement No. 1 to the Safety Evaluation Report, we indicated that our evaluation of the emergency core cooling system performance in accordance with 10 CFR Section 50.46 of Appendix K to 10 CFR Part 50 would be reported in a future supplement to the Safety Evaluation Report. This supplement provides our evaluation of this matter in support of a license amendment authorizing power operation.

6.3.1 Design Bases 6.3.1.1 Single Failure Criterion Appendix K to 10 CFR Part 50 requires that the combination of emergency core cooling subsystems to be assumed operative shall be those available after the most damaging single failure of emergency core cooling equipment has occurred.

The worst single failure which would minimize the emergency core cooling equipment available to cool the core and which would provide maximum containment cooling was identified by Westinghouse in its generic studies as the loss of a low pressure pump (a residual heat removal pump). This single failure was assumed in the Indian Point 3 emergency core cooling systems analyses.

A review of the Indian Point 3 piping and instrumentation diagrams indicated that there were two types of single failures of emergency core coolings system components which were of concern.

These were:

(1) The inadvertent or spurious movement of any one of eleven motor-operated valves in the emergency core cooling subsystems which could represent single failures more limiting than the low pressure pump failure assumed in the Indian Point 3 analyses.

(2) The coincident failure of a number of valve motor operators which could become submerged (a duty for which they are not qualified) following a postulated loss-of-coolant accident. This type of single failure could result in a loss of the necessary capability for long-term cooling required by 10 CFR Section 50.46(b)(5).

A description of the modifications proposed by the licensees to assure that these two types of failures will not occur and our conclusions regarding them are pro-vided in Sections 6.3.1.1.1 and 6.3.1.1.2 below.

6-2

6.3.1.1.1 Inadvertent or Spurious Actuation of Motor-Operated Valves The following is a complete list of those motor-operated valves in the emergency core cooling systems identified by the licensees and/or the staff which did not satisfy the single failure criterion as a result of the potential for inadvertent or spurious movement of the valves from their preferred safety positions.

Valve Component Function Consequences of Failure 856B & G Isolate hot leg injection Opening of either valve during ECC lines injection and core reflood would allow injection into RCS hot legs and cause steam binding 1810 Isolates RWST from SI Loss of RWST flow to both SI pumps pumps 882 Isolates RHR System from Loss of RWST flow to RHR pumps RWST 744 Isolates RHR System from Reduction of ECC flow from RHR pumps RCS, Containment Spray header and SI pumps 894A, B Accumulator isolation Inadvertent closure of any one of C&D valves these valves would block flow from the affected accumulator 842 and Shutoff, SI pumps Damage or malfunction to SI pumps 843 miniflow during pump operation prior to alignment for recirculation The licensees were required to make appropriate technical specification and design changes to prevent the failure of any one of the valves listed above coincident with a loss-of-coolant accident. Specifically, the licensees have agreed to the following to protect against the potential consequences of these postulated failures:

(1) During power operation, a-c power will be removed from Valves 856 B & G, 1810, 882, and 744 by racking out of power at their motor control centers.

Valves 1810, 882, and 744 will be in the open position. Valves 856 B & G will be in the closed position.

6-3

(2) During power operation, a-c power will be removed from Valves 894A, B, C, and D by racking out of power at their motor control centers. These valves will be in the open position.

(3) During power operation, a-c power will be removed from Valves 842 and 843.

These valves will be in the open position. Design modifications have been made to provide the capability to restore power from within the control room prior to switchover from the injection to the recirculation mode of operation following a loss-of-coolant accident. This modification is required to provide added assurance that radioactive sump water will not inadvertently be transferred to the refueling water storage tank during the recirculation mode of operation.

The technical specifications will require that these valves be de-energized in the preferred safety positions described above.

Based on our review of the emergency core cooling system design, we have concluded that locking out of power to the motor-operated valves listed in their preferred safety positions is an acceptable method of satisfying the single failure criterion for emergency core cooling systems. In implementing power lockout in the system design, we have required that the electrical components of the affected valves meet the criteria specified in Branch Technical Position EICSB-18, "Application of the Single Active Failure Criterion to Manually-Controlled Electrically-Operated Valves," in Appendix 7A to Chapter 7.0 of the Commission's Standard Review Plan (NUREG 75/087). Our evaluation of the conformance of the Indian Point 3 design to these criteria is presented in Section 7.3 of this supplement.

6.3.1.1.2 Submerged Valves At our request the licensees have submitted an analysis which indicates that following a postulated loss-of-coolant accident, the maximum water level that could be expected inside containment would be at elevation 50 feet 1-1/2 inches.

In a letter dated November 5, 1975, and in subsequent communications with the licensees, we requested that the licensees identify all remotely operated valves and electrical equipment that would be submerged should this water level be reached.

The licensees responded to our requests by letters to us dated November 12, 1975, March 11, 1976, and April 1, 1976 (the March 11, 1976 letter contains a complete list and evaluation of the valves and electrical equipment that could become submerged).

6-4

This section presents our evaluation and conclusions regarding those valves in the emergency core cooling systems which could become submerged following a postulated loss-of-coolant accident. Section 6.2.3 presents our evaluation and conclusions regarding two containment isolation valves which could become submerged. The remaining valves and electrical equipment identified in the licensees' letter of March 11, 1976, are discussed in Section 7.3 of this supplement.

With regard to the emergency core cooling systems, the licensees have identified 11 remotely operated valves which could be submerged following a postulated loss-of-coolant accident.

Valve No. Description 856A HPSI to loop 1 cold leg 856D HPSI to loop 2 cold leg 856F HPSI to loop 3 cold leg 856K HPSI to loop 4 cold leg 856E HPSI to loop 1 cold leg 856J HPSI to loop 2 cold leg 856H HPSI to loop 3 cold leg 856C HPSI to loop 4 cold leg 856B HPSI to loop 4 hot leg 856G HPSI to loop 1 hot leg 894C Accumulator 33 Isolation Valve Appropriate positioning and/or operation of the eleven valves listed above are required for proper short and long-term functioning of the emergency core cooling system. During normal power operation the cold leg injection valves (856A, C, D, E, F, H, J, and K) are open and the hot leg injection valves (856B and G) are closed so that following a postulated loss-of-coolant accident, sufficient flow (as calculated by the emergency core cooling system analysis assuming a single failure) is delivered to the core.

In addition, at approximately 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> following a loss-of-coolant accident, the emergency core cooling system will be transferred to simultaneous hot and cold leg recirculation to prevent excessive boric acid buildup in the reactor vessel (see Section 6.3.3.2). The Indian Point 3 emergency operating procedures specify that simultaneous hot and cold leg recirculation will be established in each of the high pressure safety injection trains by closing two of the four cold leg injection valves and opening the hot leg injection valve. To establish the realignment, Valves 856B, C, E, G, H, and J must be operable and the four remaining cold leg valves, though possibly submerged, must remain open. To assure that these valves are properly aligned and/or operable as required the licensees have proposed to:

6-5

(1) Relocate the motor operators on Valves 856 B, C, E, G, H, and J by elevating them such that the bottom of the lowest valve operator is at elevation 52 feet - 7/8 inch, approximately two feet above the maximum calculated water level.

(2) De-energize and deactivate the control logic to Valves 856A, D, F, and K by disconnecting all wiring to the valves in their normally open position.

These valves will become passive components and, therefore, will not be susceptible to movement from their preferred safety position as a result of submergence.

We have reviewed the licensees' proposed modifications and have concluded that such modifications provide assurance that the potential for submergence of electrically motor-operated valves following a postulated loss-of-coolant accident will not result in loss of necessary capability for short or long-term core cooling, even in the event of a single failure. Accordingly, we have concluded that the design modifications described above are acceptable.

The valves with relocated motor-operators discussed in (1) above will be operated via positive mechanical drive arrangements (linkage assemblies). The licensees have evaluated the relocated motor-operators and their associated supports and linkage assemblies in accordance with their commitments in the FSAR regarding seismic design analysis methods and criteria and the criteria for protection against the dynamic effects associated with postulated pipe breaks in high energy lines inside containment and have found them to be acceptable.

Based on our review of these evaluations, we have concluded that the designs of the relocated motor-operators, linkage assemblies and motor-operator supports are capable of withstanding the loads associated with the upset, emergency, or faulted conditions without gross loss of structural integrity and, therefore, are acceptable.

Further, the licensees conducted a three-day submergence test of the valve linkage assemblies under loss-of-coolant accident temperature, pressure, and chemistry conditions to verify their suitability for the submerged environment. We have reviewed the test results and concur with the licensees that the submergence tests verify the suitability of the valve linkage assemblies for the submerged environ-ment in which they may be required to function.

Valve 894C is an isolation valve in the discharge line from Accumulator 33. As indicated in Section 6.3.1.1.1 above, power will normally be removed from this valve with the valve in the open position. As indicated in Section 7.3, to meet Branch Technical Position EICSB 18, redundant position indication will be provided 6-6

for this valve. Since the valve operator for Valve 894C could become submerged following a loss-of-coolant accident, the licensees have proposed to disconnect the position indication circuits from the motor-operator and reconnect them to limit switches mounted on the valve stem above the calculated water level.

Based on our review of the modifications, we have concluded that submergence of the valve operator will neither result in movement of the valve from its preferred safety position nor compromise the position indication system for the valve. Accordingly, we have concluded that the modifications are acceptable.

6.3.3 Performance Evaluation The licensees have submitted an evaluation of emergency core cooling system per-formance pursuant to the requirements of the Commission's regulations in 10 CFR Section 50.46. The analyses submitted were performed utilizing the approved Westinghouse emergency core cooling evaluation model. Our evaluation and approval of the Westinghouse model is presented in "Status Report by the Directorate of Licensing in the Matter of Westinghouse Electric Company ECCS Evaluation Model Conformance to 10 CFR 50 Appendix K," dated October 15, 1974, and in a letter from D. B. Vassallo to C. Eicheldinger, "NRC Staff Review of the Westinghouse ECCS Evaluation Model," dated May 30, 1975.

The large break loss-of-coolant accident analysis presented in the Indian Point 3 FSAR was limited to a spectrum of four guillotine breaks which were specific for the Indian Point 3 design. To supplement this analysis, the licensees referenced Westinghouse Topical Reports WCAP-8356, "Westinghouse ECCS-Plant Sensitivity Studies,"

WCAP-8399, "ECCS Acceptance Criteria Analysis, Indian Point Nuclear Generating Station, Unit 2," and WCAP-8559, "Westinghouse ECCS-Four Loop Plant (15 x 15)

Sensitivity Studies," which demonstrated that the guillotine breaks represent the worst cases for this plant type.

The analyses submitted identified the worst break size as the double-ended cold leg guillotine break with a Moody multiplier of 0.8. The calculated peak clad temperature was 21680F, which is within the 2200°F limit specified in 10 CFR Section 50.46(b)(1). In addition, the calculated maximum local metal/water reaction of 7.9 percent and total core-wide metal/water reaction of less than 0.3 percent were well below the allowable limits of 17 percent and 1 percent, respectively. The analyses were performed assuming a total peaking factor (FQ) of 2.32 at 102 percent of the rated power of 3025 megawatts thermal and a peak linear power density of 14.5 kilowatts per foot.

6-7

The licensees' submittal of a small break loss-of-coolant accident analysis included a spectrum of four breaks which were specific for the Indian Point 3 design. In addition, the licensees submitted by reference a generic Westinghouse topical report (WCAP-8356 - Westinghouse ECCS Plant-Sensitivity Studies, July 1974) which documented additional hreak analyses. The small break analysis, which identified the six-inch pipe break as the limiting small break with a cal-culated peak clad temperature of 1765 0 F demonstrates that the postulated small break loss-of-coolant accident is less severe than the large break accident.

Therefore, we find that the results of the emergency core cooling system analyses for Indian Point 3 are acceptable and that the analyses were performed with an acceptable evaluation model.

6.3.3.1 Containment Pressure Analysis The containment pressure calculations used in the evaluation of emergency core cooling system performance for Indian Point 3 were performed using the Westinghouse emergency core cooling system evaluation model. We have reviewed the Westinghouse model for calculating containment pressure and have found it acceptable for evaluation of emergency core cooling system performance. We required, however, that justification of the plant dependent input parameters used in the containment pressure analysis be submitted for our review for each plant. This information was submitted for Indian Point 3 in the FSAR and by letter dated April 15, 1975. The licensees reevaluated the containment net free volume, the passive heat sinks, and operation of the containment heat removal systems in a conservative manner with regard to emergency core cooling system performance.

This evaluation was based on equipment inventories and structural drawings to which additional margin was added. The containment heat removal systems were assumed to operate at their maximum capacities. Minimum operational values for the spray water and service water temperatures were assumed.

Based on our review of this information, we have concluded that the plant dependent information used for the emergency core cooling system containment pressure analysis for Indian Point 3 is conservative and that the containment pressures are calculated in accordance with Appendix K to 10 CFR Part 50 of the Commission's regulations.

6.3.3.2 Long-Term Boron Concentration We have reviewed the proposed emergency procedures and the design provisions for preventing excessive boric acid buildups in the reactor vessel during the long-term cooling period following a postulated loss-of-coolant accident. During the long-term cooling period the licensees have proposed to switch from cold leg recirculation 6-8

to simultaneous hot and cold leg recirculation. This mode of operation will be established by closing two of the four cold leg injection lines and opening the hot leg injection line in each train of the high head safety injection system.

(See Section 6.3.1.1.2). This configuration will assure that there will be sufficient flow through the core region to limit boric acid concentration in the reactor vessel even in the event of a single failure.

In addition, to prevent the safety injection pumps from exceeding their maximum flow limit (runout), the licensees have proposed to modify the valve control logic in each of the high head safety injection trains to assure that when switching to simultaneous hot and cold leg recirculation, the hot leg injection valves (856G or B) cannot be opened until the two associated cold leg injection valves (856C and E or 856 H and J) have been closed.

The licensees originally proposed to switch from cold leg recirculation to simultaneous hot and cold leg recirculation approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following a loss-of-coolant accident. However, at our request the licensees have modified the emergency operating procedures to reduce this switchover time to 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />.

This shorter time will assure that for cold leg breaks, the concentration of boric acid will not exceed 23.5 weight-percent, which is four weight-percent below the boric acid solubility limit of 212 0 F. We believe that this four weight-percent margin should be maintained because concentration of boric acid in the reactor vessel cannot be predicted with a sufficient degree of accuracy.

We have reviewed the system design and we find that it permits the implementation of the proposed procedures and operation in a manner that will comply with the single failure criterion. (See Section 6.3.1.1.2.) Accordingly, we have con-cluded that there is reasonable assurance that boric acid buildup in the core region following a loss-of-coolant accident will not result in a loss of the necessary capability for long-term core cooling required by 10 CFR Section 50.46(b)(5).

6.3.3.3 Local Power Spiking Recent generic information provided to us by Westinghouse indicates that the effects of rod-to-rod bowing on local power spiking should be considered in evaluating the performance of the emergency core cooling system.

In a letter to us dated January 29, 1976, from W. Cahill to D. B. Vassallo, the licensees provided their analysis of the effects of rod bowing on emergency core cooling system performance. The licensees have stated, and we agree, that the maximum effect of rod bow on local power spike has been conservatively estimated 6-9

at approximately four percent in the second span between fuel grids. The licensees have also stated that the four percent penalty need not be applied explicitly to the total peaking factor, FQ, for reasons supported in Westinghouse Topical Report WCAP-8691, "Fuel Rod Bowing." Since we have not yet completed the review of this document, we are unable to concur with the licensee's conclusions at this time. However, initial operation of the Indian Point 3 reactor will be restricted to 91 percent of rated power. Any local power density increase associated with fuel rod bowing is readily accommodated by the 9 percent margin between the authorized power level of 91 percent and the 100 percent power level for which the analysis of emergency core cooling system performance was performed.

We have concluded that operation of the reactor at 91 percent of rated power is acceptable since there is adequate margin available. Resolution of how to treat the penalty will be required before the reactor will be authorized to operate at 100 percent of rated power (with the exception of the authorization for full power startup testing discussed below). There are accepted ways of reducing FQ, which can be utilized should we find it necessary to impose a penalty based on the results of our review of the Westinghouse rod bow topical report, prior to authorizing power operation at 100 percent of rated power.

We have considered the effects of fuel rod bowing for limited 100 percent power operation, which the license amendment will authorize for the purpose of completing startup testing only. Fuel rod bowing (and the attendant local power increases) is a direct function of burnup with the bowing effects of power reaching a maximum of 5 percent only after three fuel cycles of operation. Rod bowing is not a problem for unexposed fuel. Since the fuel exposure will be negligible during startup testing, negligible fuel rod bowing is expected during the short time period we W171 authorize full power operation for startup testing. Accordingly, we have concluded that it is not necessary to include an explicit fuel rod bowing power penalty during the full power startup testing phase of Indian Point 3.

6.3.4 Tests and Inspections Valves 856A, C, D, E, F, H, J, and K are motor-operated valves in the high pressure safety injection lines to the cold leg loops of the reactor coolant system. These valves are adjusted during preoperational flow tests to provide a balanced flow split to the reactor coolant system. Recent operating experience has indicated that there is a potential for these valves to become maladjusted during normal operation. Accordingly, we have required that the following surveillance require-ments be incorporated in the Indian Point 3 technical specifications.

For the eight flow distribution valves, verification of the valve mechanical stop adjustments will be performed periodically as noted below to provide assurance that the high head safety injection flow distribution is in accordance with the flow values assumed in the emergency core cooling system analyses.

6-10

The technical specifications require the licensees to:

(1) Conduct a flow test of the high head safety injection system after any modification is made to either its piping and/or valve arrangement.

(2) Verify that the mechanical stops on Valves 856A, C, D, E, F, H, J, and K are set at the position measured and recorded during the most recent emer-gency core cooling system operational flow test or flow test conducted in accordance with (1) above. This surveillance procedure shall be performed following any maintenance on these valves or their associated motor operators and at a convenient outage if the position of the mechanical stops have not been verified in the preceeding three months.

6.5 Fuel Densification At the time our Safety Evaluation Report for Indian Point 3 was issued, only a preliminary report, filed by Consolidated Edison on April 2, 1973, was available addressing the effects of fuel densification on the facility accident analyses.

This report considered the effects of fuel densification on over power transient limits, on the departure from nucleate boiling limits, and the postulated cold leg break loss-of-coolant accident using the then applicable Interim Acceptance Criteria limits for evaluating emergency core cooling system performance. The results were found to be acceptable. The preliminary report did not address, however, a spectrum of primary system breaks, the loss-of-flow transient, a steam line rupture, control rod ejection, and other accidents and transients.

Accordingly, our Safety Evaluation Report stated that when the final fuel densification report was submitted containing these additional analyses we would review it to verify that these other transients and accidents would not result in peak linear heat generation rates more limiting than that established by the cold leg break analysis.

The final fuel densification report, WCAP-8146, indicated, as we had anticipated, that these other transients and accidents were less limiting than the postulated cold leg break loss-of-coolant accident. The final fuel densification report utilized a total peaking factor, FQ, of 2.56. As a result of the emergency core cooling system performance analysis performed in accordance with 10 CFR Section 50.46 and Appendix K to 10 CFR Part 50 (discussed in Section 6.3 of this supplement), the technical specifications will require that the facility be operated such that a total peaking factor of 2.32 or less is maintained. The use of constant axial offset control will assure that this value is not exceeded during normal plant operation.

6-11

The reduction in the total peaking factor for normal operation, as a result of the emergency core cooling system analysis provides additional margin with regard to the effects of fuel densification. Accordingly, our conclusions above regarding the final fuel densification report are conservative with regard to operation of the facility within the more restrictive limitations on total peaking factor now required by the technical specifications.

6-12

7.0 INSTRUMENTATION AND CONTROLS 7.3 Initiation and Control of Engineered Safety Feature Systems In Section 6.3.1.1.1 of this supplement we identified eleven motor-operated valves in the emergency core cooling subsystems for which removal of power (power lockout) is required to prevent inadvertent or spurious movement of the valves from their preferred safety positions. Such inadvertent or spurious movement for any one of these valves could represent a single failure more limiting than the single failure assumed in the evaluation of emergency core cooling system performance. We also indicated that in implementing the removal of power for these valves, the electrical components must meet the requirements of Branch Technical Position EICSB-18.

Specifically, the requirements for electrical components are to (1) provide a positive means of power removal, (2) provide redundant position indication for each valve in the main control room (the position indication should, itself, meet the single failure criterion), and (3) provide the capability of restoring power from the cointrol room when required (Valves 842 and 843).

In addressing the requirements of Branch Technical Position EICSB-18, the licensees proposed several design modifications. These design modifications included (1) providing a positive means of power removal at the motor control center for each valve, (2) providing an additional position indication switch and a separate power source for the position indication, (3) maintaining physical separation between the position indication circuits by routing cables in dedicated conduit separate from the existing raceway system, and (4) providing the capability of restoring power to Valves 842 and 843 from the control room by adding a control switch for each valve that breaks the hot leg and neutral leg of the control power source.

We have reviewed the proposed design modifications and the associated electrical schematics to confirm that they have been implemented appropriately. Based on our review we have concluded that the implementation of removal of power for the electrical components of those valves listed in Section 6.3.1.1.1 has been carried out in accordance with Branch Technical Position EICSB-18 and, therefore, is acceptable.

In Section 6.3.1.1.2 of this supplement we indicated that certain remotely operated valves and electrical equipment could become submerged following a postulated loss-of-coolant accident. The specific valves and electrical equipment concerned are identified in the licensees' letter to us dated March 11, 1976. Specifically, in the letter the licensees identified the valves and electrical equipment, their function, their operational status(normal/post-LOCA), their effect on plant safety, the time after safety injection to reach submergence, their power sources, and fault protection. The licensees have also provided an analysis of the effects of equipment failure as a result of submergence on plant safetyand proposed 7-1

design modifications where the failure of the equipment was found to be unacceptable. The identified equipment that could be subjected to submergence is divided into two categories: safety related equipment and non-safety related equipment.

Safety Related Equipment The safety related equipment which could be submerged following a loss-of-coolant accident consists of electrically controlled valves, flow transmitters, and con-tainment electrical penetrations. The electrically operated valves utilized in the emergency core cooling system, the design modifications and their acceptability are discussed in Section 6.3.1.1.2 of this supplement. Two additional safety related valves (Valves 891B and b) are utilized for containment isolation. The design modifications proposed for these valves and their acceptability are dis-cussed in Section 6.2.3 of this supplement.

The safety related flow transmitters that could become submerged as the result of a loss-of-coolant accident are FT 946A and B. These transmitters provide high pressure safety injection system flow information allowing the operator to determine whether to establish high head or low head recirculation during the switchover from the injection to the recirculation mode of operation following a loss-of-coolant accident. To assure that the flow transmitters have the capability of providing the safety related information to the operator when required, the licensees have relocated the transmitters to an elevation above the calculated water level. Flow transmitters FT 946C and D, although above the calculated water level, have also been relocated to the same elevation as transmitters FT 946A and B.

We have concluded that the relocation of the transmitters to an environment for which they are qualified is an acceptable design change. The modified design pro-vides assurance that the instruments will have the capability to perform their safety related functions.

Nine electrical containment penetrations (H 58, 59, 67, 69, 70, 71, 72, 73, and

74) could be submerged in approximately 12 minutes after a safety injection signal.

None of the penetrations provide a path for electrical power to safety related Class IE electrical equipment or components. Four of the penetrations (H 58, 59, 70, and 74) are de-energized by a reactor trip, a safety injection signal or an undervoltage signal. However, penetration H 70, which provides power for contain-ment lighting, has a backup source of power from the d-c power distribution system.

The backup power source is protected from fault conditions by a Class IE circuit breaker and individual fuse protection. In addition to the fault protection, the circuit breaker will be locked in the open position during normal and accident 7-2

conditions. This backup source of power will be utilized only when the primary power is unavailable, the containment is accessible to personnel, and lighting is required.

Three of the penetrations (H 71, 72, and 73) which provide power to the pressurizer heaters are de-energized on a reactor trip or a safety injection signal. Pene-tration H-69 is de-energized during normal plant operation and is utilized only during containment leak rate testing. Penetration H-67 provides instrument power for the fixed incore detectors. These detectors are utilized during normal plant operation and provide no signals for initiating a safety action nor provide safety related post-accident information. The power is supplied by Instrument Bus 31.

Fault protection is provided by a Class IE circuit breaker, individual fused cir-cuits, and the externally located power supplies are current limited in the milliampere range.

The licensees have provided a design for those penetrations that may become sub-merged as the result of a loss-of-coolant accident that (1) provides no electrical power to Class IE electrical circuits or components, (2) de-energizes the electrical power to the penetrations or (3) provides coordinated fault protection utilizing Class IE circuit breakers, individual circuit fusing and current limited power sources. Based on our evaluation of the licensees design, we have concluded that the submergence of the electrical containment penetrations, as described above, will not affect their capability to maintain containment integrity.

Non-Safety Related Equipment The non-safety related equipment which could become submerged as the result of a loss-of-coolant accident consists of electrically operated valves, pump motors, and instrumentation. The licensees have identified 23 non-safety related elec-trically controlled valves in this category. All of the valves are electrically controlled/air operated and fail in the desired system mode (open or closed) upon loss of electrical power or air. These valves could become submerged within 7 to 45 minutes following a loss-of-coolant accident. Fifteen of the valves are de-energized for both the normal plant operation and post-accident conditions.

Eight of the valves are energized for normal plant operation. The position or failure mode of any of the 23 valves (open or closed) has no adverse effect on plant safety during normal or accident conditions.

All valves powered from a Class IE power source are protected by Class IE circuit breakers. The licensees have also provided fuse protection for all individual 7-3

components or circuits. The original design did not include this feature for five of the valves; however, the additional fuse protection was included for the five valves as an added measure of safety.

We required the licensees to evaluate all the loads associated with the branch circuits supplied from Class IE power sources to the electrically controlled valves discussed above. The analysis encompassed approximately 200 circuits and included identification of the primary and backup protection, assuming failure of the primary fault protection (fuse) and clearing by the backup protection (circuit breaker). The loss of all associated loads on the branch circuit was assumed and the safety significance reviewed and evaluated. The results of the analysis indicate that (1) the loss of the associated branch circuit loads has no adverse effect on plant safety and (2) the fuse sizing and circuit breaker ratings are coordinated with the load requirements of the specific components or circuits.

As the result of our evaluation of the analysis and information documented by the licensees, we have concluded that failure of the non-safety related electrically controlled valves, that could become submerged as the result of a loss-of-coolant accident, will have no adverse effect on plant safety during or subsequent to a loss-of-coolant accident.

Four non-safety pump motors (Reactor Coolant Drain Tank Pumps 31 and 32 and Waste Disposal System Sump Pumps 313 and 314) were identified as submerged components, Pumps 31 and 32 could be submerged in 20 minutes and Pumps 313 and 314 could be submerged in seven minutes. The circuits are individually fused with backup circuit breaker fault protection. The four motors are de-energized by a safety injection or undervoltage signal.

We have concluded that de-energizing the motors is an acceptable design feature and the flooding of the motors will have no adverse effect on plant safety during or subsequent to a loss-of-coolant accident.

The licensees have identified the following non-safety related instrumentation which may become submerged following a loss-of-coolant accident:

INSTRUMENTS DESCRIPTION Rack-14 Weld channel and penetration pressurization system indicating lights.

TE-122 Chemical and volume control system excess letdown heat exchanger temperature.

7-4

INSTRUMENTS DESCRIPTION TE-126 Chemical and volume control system regen-erative heat exchanger temperature.

TT-1058 Waste disposal system reactor coolant drain tank temperature.

LT-1133 through Waste disposal system condensate collection 1137 system containment fan cooler level indication.

Rack 14 contains indicating lights for the weld channel penetration and pressuri-zation system and is de-energized by a safety injection or an undervoltage signal.

The other instruments are fault protected by a Class IE circuit breaker and individual instrument fuse protection (3/8 amperes). In addition to the fault protection, the externally located instrument power supplies are current limited in the milliampere range when the instrument is subjected to a faulted condition.

We have concluded that (1) de-energizing Rack 14 is an acceptable design feature and (2) as a result of our evaluation of the analysis and information documented by the licensees, the failure of the non-safety related instrumentation due to submergence will have no adverse effect on plant safety duringor subsequent to a loss-of-coolant accident.

7.6 Residual Heat Removal System Interlocks In Section 7.6 of our Safety Evaluation Report we indicated that we required additional protection of the low pressure residual heat removal system from possible overpressurization. More specifically we indicated that the design shall include (1) automatic closure of residual heat renmval system suction line Valves 730 and 731 whenever primary system pressure exceeds the residual heat removal system design pressure and (2) independent interlocks to prevent these valves from opening whenever the primary system pressure exceeds the residual heat removal system design pressure. Both the automatic closure and the pressure interlocks for these valves were to be designed to meet the single failure criterion.

Consolidated Edison responded to our requirements and we reviewed the criteria for the proposed modifications and found them acceptable. We indicated in the Safety Evaluation Report that we would confirm the implementation of the design modifications prior to issuance of an operating license.

Accordingly, we have reviewed the electrical schematics for the valves identified above. As a result of our review, we required the licensees to remove the proposed 7-5

interlock to prevent automatic closure, which was to be operative whenever the reactor coolant system pressure is below the residual heat removal system pressure set point. This interlock could negate the automatic close signal from completing its safety function as required by Section 4.16 of IEEE Standard 279-1968.

We also required the licensees to modify the interlock relays which provide per-missive signals to the suction valves of the residual heat removal pumps when Valves 730 and 731 are in the full open position. The proposed design did not meet the single failure criterion and could have prevented the residual heat removal isolation valves from performing'their safety function.

We have verified that the licensees' design criteria have been implemented in the design in an acceptable manner. Accordingly, we have concluded that the design of the residual heat removal system interlocks meets our requirements and is acceptable.

7-6

8.0 ELECTRIC POWER 8.3 Onsite Power 8.3.2 D-C Power System In Section 8.3.2 of our Safety Evaluation Report, we indicated that Consolidated Edison originally proposed two d-c power systems and automatic transfer devices to supply power to the three engineered safety feature load groups. We concluded that the proposed design could compromise redundant safety systems and was unacceptable. Consolidated Edison modified the design to include a third d-c power system and eliminated the automatic transfer functions. We concluded that the modified design is compatible with the a-c power system, meets the recom-mendations of Regulatory Guide 1.6 and is acceptable.

We also indicated that as a result of the design changes to the onsite d-c power system identified above, the instrument power supplies would also require modifi-cation. We stated our requirement that the implementation of these design changes to the instrument power supplies must meet the requirements of IEEE Standard 279-1968 and, that we would verify compliance with this requirement prior to the issuance of an operating license.

The 120 volt a-c instrument power supplies consist of four vital bus distribution systems. Three of .the vital buses (Buses 31, 32, and 33) are fed from inverters, which in turn are supplied from separate 125 volt d-c batteries (Batteries 31, 32, and 33, respectively). The remaining 120 volt a-c vital bus is supplied by a constant voltage transformer which in turn is fed from a 480 volt engineered safety feature bus (Bus 6A). A backup 120 volt a-c supply from the lighting switchgear is available to be manually connected to an instrument bus should its inverter or constant voltage transformer be out of service. We have reviewed the drawings of the modified design and have concluded that the design meets the requirements of IEEE Standard 279-1968 and, therefore, is acceptable.

8-1

18.0 THE ADVISORY COMMITTEE ON REACTOR SAFEGUARDS 18.1 Initial Limitation on Power Level In its letter dated November 14, 1973 (Appendix B to Supplement No. 1 of our Safety Evaluation Report), the Advisory Committee on Reactor Safeguards recommended that initial operation be limited to power levels no greater than 2760 megawatts thermal (91 percent of rated power) and that further review by the Committee is appropriate before higher power levels are permitted. This limitation was based on the Committee's concerns regarding the limited operating experience with very large high power density reactors.

Although our evaluations and conclusions regarding the Indian Point 3 plant would permit operation at power levels greater than 91 percent of rated power, initial operation of the facility will be limited to 91 percent in accordance with the recommendations of the Committee.

We will, however, authorize 100 percent power operation for the purpose of completing startup testing only. Operation of the facility at 100 percent of power for the limited period of time necessary to complete startup testing will have no effect on plant safety (see Section 6.3.3.3) and will provide valuable information relative to the Committee's concerns referred to above.

18-1

APPENDIX A CONTINUATION OF CHRONOLOGY OF RADIOLOGICAL REVIEW OF INDIAN POINT NUCLEAR GENERATING UNIT NO. 3 December 12, 1975 Issuance of Facility Operating License No. DPR-64 authorizing fuel loading and subcritical testing December 24, 1975 Issuance of Amendment No. 1 to License No. DPR-64 to permit PASNY to purchase and acquire title to Indian Point 3 December 24, 1975 Letter to licensees concerning certain language of License No. DPR-64 January 5, 1976 Letter from licensees concerning licensees' consultant's participa-tion in Dames & Moore report on investigation of faults January 8, 1976 Letter to licensees requesting additional information relative to onsite faulting January 9, 1976 Letter from licensees concerning submerged valves and transmitting final mechanical and electrical design drawings January 16, 1976 Letter to licensees' attorney advising that correspondence submitted on October 14,-1975 will be placed in public document rooms and that electrical drawings will be made available to the public January 19, 1976 Letter from licensees transmitting Dames & Moore report "Supplemental Geological Investigation of the Indian Point Generating Station" January 21, 1976 Letter from licensees transmitting information concerning plant security January 21, 1976 Letter to licensees requesting ECCS information January 22, 1976 Letter from licensees transmitting proposed technical specifications for full power operation January 23, 1976 Meeting with licensees to discuss technical specifications A-1

January 29, 1976 Letter from licensees providing information on ECCS January 29, 1976 Letter from licensees transmitting information on the effects of rod bowing on fuel assemblies February 2, 1976 Meeting with licensees to discuss supplement report on geological investigation February 4, 1976 Letter from licensees providing information relative to preopera-tional test on valves February 10, 1976 Letter from licensees transmitting revision to security plan February 11, 1976 Letter from licensees transmitting supplemental information to January 19, 1976 submittal February 13, 1976 Meeting with licensees to discuss investigation of faulting in the vicinity of the Indian Point site February 20, 1976 Letter to licensees concerning implementation of Appendix I February 23, 1976 Letter to licensees transmitting draft Regulatory Guides relative to Appendix I February 25, 1976 Letter from licensees providing information relative to submittal of December 5, 1975 February 27, 1976 Meeting with licensees to discuss several items in electrical and instrumentation area March 3, 1976 Letter to licensees transmitting copy of petition, dated February 6, 1976 by Public Interest Research Group, and related Federal Register notice March 8, 1976 Letter from licensees concerning schedule for future submittals March 8, 1976 Letter from licensees transmitting electrical schematics and providing information in response to request of January 21, 1976 A-2

March 8, 1976 Letter from licensees concerning redundant position indication for de-energized valves and providing list of electrical schematics affected March 10, 1976 Letter from licensees concerning gaseous flows from primary auxiliary building March 11, 1976 Letter from licensees providing information concerning investigation of submerged electrical components inside containment March 15, 1976 Letter from licensees transmitting finalized versions of certain safety-related drawings and listing of drawings March 25, 1976 Letter to licensees concerning meeting to be held to discuss Appendix I March 30, 1976 Meeting with licensees to discuss geology and seismology April 1, 1976 Letter from licensees supplementing the responses given in letter of March 8, 1976 regarding redundant position indication for de-energized valves April 1, 1976 Letter from licensees supplementing letter dated March 11, 1976 A-3