ML11356A152

From kanterella
Jump to navigation Jump to search
State of New York (NYS) Pre-Filed Evidentiary Hearing Exhibit NYSR0013G, UFSAR, Rev. 20, Indian Point Unit 3 (Submitted with License Renewal Application) (2007) (IP3 UFSAR, Rev. 20)
ML11356A152
Person / Time
Site: Indian Point  Entergy icon.png
Issue date: 12/22/2011
From:
State of NY, Office of the Attorney General
To:
Atomic Safety and Licensing Board Panel
SECY RAS
Shared Package
ML11356A150 List:
References
RAS 21610, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML11356A152 (210)
v • d • e


Text

NYSR0013G Revised: December 22, 2011 IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF:

ENGINEERED SAFETY FEATURES, CONTAINMENT AND STEAM LINE ISOLATION & AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS in that steam generator

12) Low-low steam generator water level 2/3, per loop
13) High intermediate range nuclear flux Y" manual block permitted by P-1 0 Manual block and automatic reset
14) High source range nuclear flux Y" manual block permitted by P-6, block Manual block and automatic reset of P-6; maintained by P1 0 manual reset of P-1 0 CONTAINMENT ISOLATION ACTUATION
15) Safety Injection Signal (Phase A) See Item 9 Actuates all non-essential service containment isolation trip valve and actuates Isolation Valve Seal Water System
16) Containment pressure (Phase B) Coincidence of two sets of 2/3 containment Actuates all essential service containment pressure (High-high pressure [energize to isolation trip valves actuate], same signal which actuates containment spray), or manual 2/2
17) Containment ventilation (High Y, high activity signal, from air particulate detector This additional signal closes containment containment activity) or radiogas detector or containment isolation purge supply, exhaust ducts and pressure phase "A" signal, or spray actuation signal relief duct only ENGINEERED SAFETY FEATURES ACTUATION
18) Safety injection signal (S) See Item 9
19) Containment spray signal (P) Coincidence of two sets of 2/3 containment pressure (high-high pressure); or manual 2/2 (Note: Bistables are energize-to-operate)
20) Spray additive valves Coincidence of two sets of 2/3 contaiment pressure (high-high pressure, same signal which actuates containment spray (Note: Bistables are energize-to-operate)
21) Containment air recirculation cooling Safety injection signal initiates starting of all fans and filtration signal in accordance with the safety injection starting sequence, 2/3 high containment pressure or

"'U manual Y, m 22) Isolation valve seal water signal Safety injection signal

()

"'U o m o oo o eN o 01 37 of 108 o0) 00 (J)

(J1 CD

......

(J)

--"

IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF:

ENGINEERED SAFETY FEATURES, CONTAINMENT AND STEAM LINE ISOLATION & AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS STEAM ISOLATION ACTUATION

23) Steam flow After time delay (maximum 6 seconds) with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines
24) Containment pressure Coincidence of two sets of 2/3 Containment pressure (high-high pressure)

(Note: Bistables are energize-to-operate)

25) Manual 1/1 per steam line AUXILIARY FEED WATER ACTUATION
26) Turbine driven pump Coincidence of 2/3 low level in two steam generators; or a non-SI blackout sequence signal from 480 volt buses 3A or 6A; or manual 'h; or AM SAC Actuation
27) Motor driven pumps 2/3 low level in any steam generator; or trip of 'h main feedwater pump turbines; or safety injection signal; or manual 'h; or a non-SI blackout sequence signal from 480 volt bus 3A to start pump 31; or a non-SI blackout sequence signal from 480 volt bus 6A to start pump 33; or AM SAC Actuation MAIN FEEDWATER ISOLATION
28) Close main feedwater control valves, Any safety injection signal (See Item 9)

(including associated MOVs) trip main feedwater pumps

"'U m

()

"'U o m o oo o eN o 01 38 of 108 o0) 00 (J)

(J1 CD tv (J)

N

IP3 FSAR UPDATE TABLE 7.2-2 INTERLOCK AND PERMISSIVE CIRCUITS Number Function Input for Blocking 1+ Prevent rod withdrawal on  % high nuclear flux (power overpower range) or Yz high nuclear flux (intermediate range or %

overtemperature LH or %

overpower t::. T 2 Auto-rod withdrawal stop at Low MWe load signal low power 3+ Auto-rod withdrawal stop on  % rapid decrease of nuclear rod drop flux (power range) or 1/1 rod bottom indication 4* [BLANK - See Note]

5+ Steam dump interlock Turbine trip signal 6 Manual block of source range  % high intermediate range level trip flux allows manual block, 2/2 low intermediate range defeats block 7 Permissive power (block  % low-low nuclear flux (power various trips required only at range) and 2/2 low turbine power) impulse chamber pressure signal 8 Block single primary loop loss % low nuclear flux (power of flow trip and Block Reactor range)

Trip on Turbine Trip 9*

10 Manual block of low setpoint 2/4 high nuclear flux allows trip (power range) and manual block, % low nuclear intermediate range trips flux (power range) defeats manual block NOTE:

  • not applicable to this plant

+ alarmed 39 of 108 IPEC00035863 IPEC00035863

IP3 FSAR UPDATE TABLE 7.2-3 ROD STOPS Rod Stop Actuation Signal Rod Motion to be blocked

1. Rod Drop  % rapid power range nuclear Automatic Withdrawal flux decrease or any rod Actuation of rod stop (Item 1) bottom signal initiates a turbine load reduction above a given power level
2. Nuclear Overpower  % high power range nuclear Automatic and Manual flux or % high intermediate Withdrawal range nuclear flux
3. High t.T*  % overpower t.T or % Automatic and Manual overtemperature t.T Withdrawal
4. Low Power Low turbine first stage (inlet) Automatic Withdrawal pressure load signals
5. Tavg Deviation  % Tavg deviation from average Automatic Withdrawal Tavg
  • NOTE: Actuation of rod stop (Item 3) initiates a load cutback at any power level.

40 of 108 IPEC00035864 IPEC00035864

W I-

<<0 ex:>

0 C0o... ..-

Q:::J .....

0 0::: ..-

<<

(f) "'"

LL IPEC00035865 IPEC00035865

W I-

<<0 ex:>

0 C0o... ..-

Q:::J .....

0 0::: ('\J

<<

(f) "'"

LL IPEC00035866 IPEC00035866

W I-

<<0 ex:>

0 C0o... ..-

Q:::J .....

0 0::: C0

<<

(f) "'"

LL IPEC00035867 IPEC00035867

W I-

<<0 ex:>

0 C0o... ..-

Q:::J .....

0 0:::

<<

(f)

"'"'""

LL IPEC00035868 IPEC00035868

IP3 FSAR UPDATE 7.3 REGULATING SYSTEMS 7.3.1 Design Basis The Reactor Control System is designed to limit nuclear plant transients for prescribed design load perturbations, under automatic control, within prescribed limits to preclude the possibility of a reactor trip in the course of these transients.

Overall reactivity control is achieved by the combination of chemical shim and 53 control rod clusters of which 29 are in 4 control banks and 24 are in 4 shutdown banks. Long-term regulation of core reactivity is accomplished by adjusting the concentration of boric acid in the reactor coolant. Short-term reactivity control for power changes or reactor trip is accomplished by movement of control rod clusters.

The primary function of the Reactor Control System is to provide automatic control of the rod clusters during power operation of the reactor. The system uses input signals including neutron flux; coolant temperature and pressure; and plant turbine load. The Chemical and Volume Control System (Chapter 9) serves as a secondary reactor control system by the addition and removal of varying amounts of boric acid solution.

There is no provision for a direct continuous visual display of primary coolant boron concentration. When the reactor is critical, the best indication of reactivity status in the core is the position of the control group in relation to plant power and average coolant temperature.

There is a direct, predictable, and reproducible relationship between control rod position and power and it is this relationship which establishes the lower insertion limit calculated by the rod insertion limit monitor. There are two alarm setpoints to alert the operator to take corrective action in the event a control bank approaches or reaches its lower limit. Rod position is also a function of core life.

Any unexpected change in the position of the control banks when under automatic control or a change in coolant temperature when under manual control provides a direct and immediate indication of a change in the reactivity status of the reactor. In addition, periodic samples of coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion.

The Reactor Control System is designed to enable the reactor to follow load changes automatically when the plant output is above 15% of nominal power. Control rod positioning may be performed automatically when plant output is above this value, and manually at any time.

Overriding the rod stop and turbine runback signals from the Overpower or Overtemperature b.T circuitry, or from the Power Range Nuclear Instrument Dropped Rod circuitry has no impact on the prevention of automatic control rod withdrawal below 15% of nominal power. Overriding one channel of these signals has no impact on reactor protection in the event of an approach to an overpower condition in as much as the reactor trips associated with such a condition remains unaffected. Additionally, since only one channel at a time is permitted to be affected, the other three channels remain available for rod stop and turbine run back on either Overpower or Overtemperature b.T, or on Power Range Nuclear Instrument Rod Drop signals.

45 of 108 IPEC00035869 IPEC00035869

IP3 FSAR UPDATE The system enables the nuclear plant to accept the following transients without reactor trip subject to possible xenon limitations:

a) Step load increases to 10% within the load range of 15% to 90% of full power b) Step load reduction of 10% within the load range of 100% to 25% of full power c) A 5% per minute ramp load change within the load range of 15% to 100% of full power.

The operator is able to select any single bank of rods (shutdown or control) for manual operation. Using a single switch, he may not select more than one bank from these two functions. He may also select automatic reactor control, in which case, the control banks can be moved only in their normal sequence with some overlap as one bank reaches its full withdrawal position and the next bank begins to withdraw. Interlocks are provided to preclude simultaneous withdrawal of more than two banks of control rods or shutdown rods.

The control system is capable of restoring coolant average temperature to within the programmed temperature deadband, following a scheduled or transient change in load.

The reactor plant can be placed under automatic control in the power range between 15 percent of load and full load and will accept the following design transients while in automatic control:

a) Step load increases of 10% within the load range of 15% to 90% of full power (without turbine bypass) b) Step load reductions of 10% within the load range of 100% to 25% of full power (without turbine bypass) c) A 5% per minute ramp load change within the load range - 15% to 100% of full power (without turbine bypass) d) A -10% to -50% change in load, at a maximum turbine unloading rate of 200% per minute, from approximately 100% load with steam dump (load rejection capability depends on full power Tavg; see Section 7.3.2) (with turbine bypass).

A programmed pressurizer water level as a function of Tav9 is provided to minimize the requirements of the Chemical and Volume Control and Waste Disposal Systems resulting from coolant density changes during loading and unloading from full power to zero power.

Following a reactor and turbine trip, sensible heat stored in the reactor coolant is removed without actuation of steam generator safety valves by means of controlled steam bypass to the condenser and by injection of feedwater to the steam generators. Reactor Coolant System temperature is reduced to the no load condition. This no load coolant temperature is maintained by steam bypass to the condensers to remove residual heat.

The control system is designed to operate as a stable system over the full range of automatic control throughout core life without requiring operator adjustment of set points other than normal calibration procedures.

7.3.2 System Design 46 of 108 IPEC00035870 IPEC00035870

IP3 FSAR UPDATE A block diagram of the Reactor Control System is shown in Figure 7.3-1.

Rod Control There are 53 total RCC assemblies. The assemblies are grouped into (1) 4 shutdown banks having rod clusters of 8, 8, 4, 4, rod clusters and (2), 4 control banks 8, 4, 8 and 9 rod clusters.

Figure 3.2-1 shows the location of the RCC assemblies in the core. The four control banks are the only rods that can be manipulated under automatic control. The banks are divided into groups to obtain smaller incremental reactivity changes. All RCC assemblies in a group are electrically paralleled to step simultaneously. Position indication for each RCC assembly type is the same.

Control Group Rod Control The Reactor Control System is capable of restoring programmed average temperature following a scheduled or transient change in load. The coolant average temperature is programmed to increase linearly from zero power to the full power conditions.

The control system will also compensate initially for reactivity changes caused by fuel depletion and/or xenon transients. Final compensation for these two effects is periodically made with adjustments of boron concentration. The control system then readjusts the control rods in response to changes in coolant average temperature resulting from changes in boron concentration.

The coolant average temperatures are measured from the hot leg and the cold leg in each reactor coolant loop. The average of the four measured average temperatures is the main control signal. This signal is sent to the control rod programmer through a proportional plus rate compensation unit. The control rod programmer commands the direction and speed of control rod motion. A compensated pressurizer pressure signal, and a power-load mismatch signal are also employed as control signals to improve the plant performance. The power-load mismatch channel takes the difference between nuclear power (average of all four power range channels) and a signal of turbine load (first stage (inlet) turbine pressure), and passes it through a high-pass filter such that only a rapid change in flux or power causes rod motion. The pressure compensation and the power-load mismatch compensation serve to speed up system response and to reduce transient peaks.

The control bank rods are divided into four banks comprising 8, 4, 8 and 9 RCC assemblies respectively, to follow load changes over the full range of power operation. Each control rod bank is driven by a sequencing, variable speed rod drive control unit. The assemblies in each control bank are divided into two groups. The groups are moved sequentially one step at a time. The sequence of motion is reversible, that is, a withdrawal sequence is the reverse of the insertion sequence. The variable speed sequential rod control affords the ability to insert a small amount of reactivity at low speed to accomplish fine control of reactor coolant average temperature about a small temperature deadband. Any reactor trip signal causes the rods to drop by gravity into the core.

Manual control is provided to manually move a control bank in or out at a preselected fixed speed.

47 of 108 IPEC00035871 IPEC00035871

IP3 FSAR UPDATE Proper sequencing of the RCC assemblies is assured: first, by fixed programming equipment in the Rod Control System, and second, through administrative control of the reactor plant operator. Startup of the plant is accomplished by first manually withdrawing the shutdown rod banks to the full out position. This action requires that the operator select the SHUTDOWN BANK position on a control board mounted selector switch and then position the IN-HOLD-OUT level (which is spring return to the HOLD position) to the OUT position.

RCC assemblies are then withdrawn under manual control of the operator by first selecting the MANUAL position on the control board mounted selector switch and then positioning the IN-HOLD-OUT LEVER to the OUT position. In the MANUAL selector switch position, the rods are withdrawn (or inserted) in a predetermined programmed sequence by the automatic programming equipment.

When the reactor power reaches approximately 15% of rated power, the operator may select the AUTOMATIC position, where the IN-HOLD-OUT lever is taken out of service, and rod motion is controlled by the Reactor Control and Protection Systems. A permissive interlock limits automatic control to reactor power levels above 15%. In the AUTOMATIC position, the rods are again withdrawn (or inserted) in a programmed sequence by the automatic programming equipment.

Programming is set so that as the first bank out (control bank A) reaches a preset position, the second bank out (control bank B) begins to move out simultaneously with first bank. When control bank A reaches the top of the core, it stops, and control bank B continues until it reaches a preset position near the top of the core where control bank C motion beings, etc. The withdrawal sequence continues until the plant reaches the desired power level. The programmed insertion sequence is the opposite of the withdrawal sequence, i.e., the last control bank out is the first control bank in.

With the simplicity of the rod program, the minimal amount of operator selection, and two separate direct position indications available to the operator, there is very little possibility that rearrangement of the control rod sequencing could be made.

Shutdown Rod Control The shutdown rods together with the control rods are capable of shutting the reactor down.

They are used in conjunction with the adjustment of chemical shim to provide shutdown margin of at least one percent following reactor trip with the most reactive control rod in the fully withdrawn position for all normal operating conditions. The shutdown banks are manually controlled during normal operation and are moved at a constant speed with staggered stepping of the groups within the banks. Any reactor trip signal causes them to drop by gravity into the core. They are fully withdrawn during power operation and are withdrawn first during startup.

Criticality is always approached with the control rods after withdrawal of the shutdown banks.

Four shutdown banks with a total of 24 clusters are provided.

Interlocks The rod control group is used for automatic control and is interlocked with measurements of turbine-generator load to prevent automatic control rod withdrawal below 15% of nominal power.

The manual and automatic controls are further interlocked with measurements of neutron flux, ET and rod drop indication to prevent approach to an overpower condition.

48 of 108 IPEC00035872 IPEC00035872

IP3 FSAR UPDATE Rod Drive Performance The control banks are driven by a sequencing, variable speed rod drive programmer. In each control bank of RCC assemblies, two groups (each containing a small number of RCC assemblies) are moved sequentially in a cycle such that both groups are maintained within one step of each other.

The sequence of motion is reversible, that is, withdrawal sequence is the reverse of the insertion sequence. The sequencing speed is proportional to the control signal from the Reactor Control System. This provides control group speed control proportional to the demand signal from the control system.

The output of two paralleled motor generator (M-G) sets provides power to the rod drive mechanism coils through a solid state control system. Two reactor trip breakers are placed in series with the output of the M-G sets. To permit on-line testing, a bypass breaker is provided across each of the two breakers.

RCCA Position Indication Two separate systems are provided to sense and display control rod position as described below:

a) Analog System - An analog signal is produced for each individual rod by a linear position transmitter.

An electrical coil stack is located above the stepping mechanisms of the control rod magnetic jacks, external to the pressure housing, but concentric with the rod travel.

When the associated control rod is at the bottom of the core, the magnetic coupling between the primary and secondary coil winding of the detector is small and there is a small voltage induced in the secondary. As the control rod is raised by the magnetic jacks, the relatively high permeability of the lift rod causes an increase in magnetic coupling. Thus, an analog signal proportional to rod position is obtained.

Direct, continuous readout of every control rod is presented to the operator on individual indicators.

A deviation monitor alarm is actuated if an individual rod position deviates from its relative bank position by a preselected distance.

Lights are provided for rod bottom positions for each rod. The lights are operated by bistable devices in the analog system.

b) Digital System - The digital system counts pulses generated in the rod drive control system. One counter is associated with each group of control and shutdown rods.

Readouts of the digital system are in the form of electromechanical add-subtract counters reading the number of steps of rod movement with one display for each group. These readouts are mounted on the control panel.

The digital and analog systems are separate systems; each serves as backup for the other.

Operating procedures require the reactor operator to compare the digital and analog readings upon recognition of any apparent malfunction. Therefore, a single failure in rod position 49 of 108 IPEC00035873 IPEC00035873

IP3 FSAR UPDATE indication does not in itself lead the operator to take erroneous action in the operation of the reactor.

Full Length Rod Drive Power Supply The full length control rod drive power supply concept, using a single trip bus system, has been successfully employed on all Westinghouse PWR Plants. Potential fault conditions with a single trip bus system are discussed in this section. The unique characteristics of the latch type mechanisms with its relatively large power requirements makes this system with the redundant series trip breakers particularly desirable.

The solid state rod control system is operated from two parallel connected 438 kVA generators which provide 260 volt line to line, three phase, four wire power to the rod control circuits through two series connected reactor trip breakers.

This AC power is distributed from the trip breakers to a line-up of identical solid state power cabinets and a DC holding cabinet using a single overhead run of enclosed bus duct which is bolted to and therefore comprises part of the power cabinet arrangement. Alternating current from the motor-generator sets is converted to a pulsed direct current by the power cabinet and is then distributed to the mechanism coils. Each complete rod control system includes a single 125/70 volt DC power supply which is used for holding the mechanisms in position during maintenance of normal power supply.

This 125/70 volt supply, which receives its input from the AC power source downstream of the reactor trip breakers, is distributed to each power cabinet and permits holding mechanisms in groups of four by manually positioning switches located in the power cabinets. The 70140 ampere output capacity limits the holding capability to eight rods.

Reactor Trip Current to the mechanisms is interrupted by opening either of the reactor trip breakers. The 125/70 volt DC maintenance supply will also be interrupted since this supply receives its input power through the reactor trip breakers.

Trip Breaker Arrangement The trip breakers are arranged in the reactor trip switchgear in individual metal enclosed compartments. The 1000 ampere bus work, making up the connections between trip breakers are separated by metal barriers to prevent the possibility that any conducting objects could short circuit, or bypass, trip breaker contacts.

Maintenance Holding Supply The 125/70 volts DC holding supply and associated switches have been provided to avoid the need for bringing a separate DC power source to the rod control system during maintenance on the power cabinet circuits. This source is adequate for holding a maximum of five mechanisms and satisfies all maintenance holding requirements.

Control System Construction 50 of 108 IPEC00035874 IPEC00035874

IP3 FSAR UPDATE The rod control system equipment is assembled in enclosed steel cabinets. Three phase power is distributed to the equipment through a steel enclosed bus duct, bolted to the cabinets. DC power connections to the individual mechanisms are routed to the reactor head from the solid state cabinets through insulated cables, enclosed junction boxes, enclosed reactor containment penetrations, and sealed connectors. In view of this type of construction, an accidental connection of either an AC or DC power source, either internal or external to the cabinets, is not considered credible.

AC Power Connections The three phase four wire supply voltage required to energize the equipment is 260 volts line to line, 58.2 Hz, 438 kVA capacity, zig-zag connected. It is unlikely that any power supply, and in particular one as unusual as this four wire power source could be accidentally connected, in phase, in the required configuration. Also it should be noted that this requires multiple connections, not single connections. The closest outside sources available in the plants are 480 volt auxiliary power source and 208 volt lighting source.

Connections of either a 480 or 208 volt, 60 Hz source to the single AC bus supplying the rod control system causes currents to flow between the sources due to an out of phase condition.

These currents flow until the generator accelerates to a speed synchronous with the 60 Hz outside source, a time sufficient to trip the generator breakers. The out-of-phase currents for an unlimited capacity outside source, an outside source with a capacity equivalent to the normal generator kVA, and for either one or two M-G sets in service are tabulated below:

Out of Phase Currents (Amperes)

One M-G Set Two M-G Sets in Service In Service 480 volts Unlimited Capacity 25,000 50,000 438 kVA Capacity 12,000 25,000 208 volts Unlimited Capacity 16,000 32,000 438 kVA Capacity 8,000 16,000 All of the foregoing currents are sufficiently high to trip out the generator breakers on either overcurrent or reverse current. This trip-out is detectable by annunciation in the Control Room.

If the outside power source trips, the connection is of no concern.

Each solid state power cabinet is tied to the main AC bus through three fused disconnect switches; one for the stationary gripper coil circuits, one for the movable gripper coil circuits, and one for the lift coil circuits. Reference voltage to operate the control circuits for all three coil circuits must be in phase with the supply to all coil circuits for proper operation of the system. If the outside power source were brought into an individual cabinet, nine (9) normal source connections would have to be disconnected and the outside source would have to be tied in phase to the proper nine (9) points plus one (1) neutral point to allow movement of the rods.

This is not considered credible.

51 of 108 IPEC00035875 IPEC00035875

IP3 FSAR UPDATE Connection of a single phase AC source (i.e., one line to neutral) is also considered improbable.

This would again require a high capacity source which would have to be connected in-phase with the non-synchronous M-G set supply. Again, more than one connection is needed to achieve this condition. Each power cabinet contains three alarm circuits (stationary, movable and lift) that would annunciate the condition to the operator. In addition, calculations show that a single phase source of 208 volts, 260 volts, or 480 volts will not supply enough current to hold the rods. Therefore, a jumper across two trip circuit breaker contacts in series which results in a single phase remaining closed would not provide sufficient current to hold up the rods.

The normal source generators are connected in a zig-zag winding configuration to eliminate the effects of direct current saturation of the machines resulting from the direct currents that flow in the half wave bridge rectifier circuits. If this connection were not used, the generator core would saturate and loss of generating action would occur. This condition would also occur in a transformer. An outside source not having the zig-zag configuration would have to have a large capacity (400 kVA) to avoid the loss of transformer action from saturation.

Most of the components in the equipment are applied with a 100% safety factor. Therefore, the possibility exists that the system will operate at 480 volts with a source of sufficient capacity.

The system will definitely operate at 208 volts with a source of sufficient capacity.

The connection of an outside source of AC power to one rod control system would first require a need for this source. No such need exists since two power sources (M-G sets) are already provided to supply the system. If the source were connected in spite of the need, extreme measures would have to be taken by the intruder to complete the connection. The outside source would have to be a large capacity (400 kVA) one. The currents that flow would require the routing of large conductors or bus bars, not the usual clip leads. Then the disassembly of switchgear or enclosed bus duct would be required to expose the single AC bus. Large bolted cable or bus bar terminations would have to be completed. A total of four conductors would have to be connected in phase with a non-synchronous source. To expect that a connection could be completed with the equipment either energized or de-energized in view of the obstacles which would prevent such a connection is incredible.

However, even if the connection were completed, the outside source connection would be detectable by the operator through the tripping of the generator breakers.

DC Power Connections An external DC source could, if connected inside the power cabinet, hold the rods in position.

This would require a minimum supply voltage of 50 volts. Since the holding current for each mechanism coil is 4 amperes, the DC current capacity would have to be approximately 180 amperes to hold all rods. Achieving this situation would require several acts - bringing in a power source which is not required for any type of operation in the rod control system, preferentially connecting it into the system at the correct points, and actuating specific holding switches so as to interconnect all rods. Closure of twelve switches in four separate cabinets would be required to hold all rods. One switch could hold as many as four rods.

The application of a DC voltage to an individual rod external to the power cabinet would affect only a single rod connection with other rods in the group being prevented by the blocking diodes in the power circuits.

52 of 108 IPEC00035876 IPEC00035876

IP3 FSAR UPDATE Should an external DC source be connected to the system, the system is provided with features to permit its detection.

Each solid state power cabinet contains circuitry which compares the actual currents in the stationary and movable gripper coils with the reference signals from the step sequencing unit (slave cycler). In taking a single step, the current to the stationary gripper coil will be profiled from the holding value to the maximum, to zero and return to holding level. Correspondingly, the movable gripper coil must change from zero to maximum and return to zero. The presence of an external DC source on either the stationary or movable would prevent the related currents from returning to zero.

This situation would be instantaneously annunciated by way of the comparison circuit.

Therefore, any rod motion would actuate an alarm indicating the presence of an external DC source. In addition, an external DC source would prevent rods from stepping. Thus, an external source could be detected by the rod position indication system indicating failure of the rod(s) to move.

Connection of an external DC power source to the output lines of the 125/70 volt DC power supply can be detected by opening the three phase primary input of the supply and checking the output indication lights.

Evaluation Summary In view of the preceding discussion, the postulated connection of an external power source (either AC or DC) or occurrence of short circuits that could prevent dropping of the rods is not considered credible.

Specifically:

a) The need for an outside power source has been eliminated by incorporating built-in holding sources as part of the rod control system and by providing two M-G sets.

b) The equipment is contained within enclosed steel cabinets precluding the possibility of an accidental connection of either AC or DC power in the cabinets.

c) AC power distribution is accomplished using steel enclosed bus duct. The high capacity (438 kVA) AC power source is unique and not readily available. Multiple connections are required.

d) DC power is distributed to the individual mechanisms through insulated cables and enclosed electrical connections precluding the accidental connection of an outside DC source external to the cabinets. The high capacity DC source required to hold rods is not readily available in the rod control system, would require multiple connections, and would require deliberate positioning of switches within the enclosed cabinets.

e) Provisions are made in the system to permit detection of an external DC source which could preclude a rod release.

The total capacity of the system including the overload capability of each motor generator set is such that single set out of service does not cause limitations in rod motion during normal plant 53 of 108 IPEC00035877 IPEC00035877

IP3 FSAR UPDATE operation. In order to minimize reactor trip as a result of a unit malfunction, the power system is normally operated with both units in service.

Turbine Bypass A turbine bypass system is provided to accommodate a reactor trip with turbine trip and in conjunction with automatic reactor control can accommodate a load rejection without reactor and turbine trip. The maximum load rejection that can be accommodated without reactor and turbine trip depends on the full load Tavg. A maximum of a 10% load rejection can be accommodated for the minimum acceptable full load Tavg of 550.6°F. As the full load Tavg is increased, larger load rejections can be accommodated. For full load Tavg values of 565 OF or higher, load rejections of 50% can be accommodated, The turbine bypass system removes steam to reduce the transient imposed upon the reactor coolant system so that the control rods can reduce the reactor power to a new equilibrium value without allowing overte mperature, overpressure conditions in the Reactor Coolant System.

The steam dump is actuated by an electrical load decrease rate greater than a preset value.

This signal supplies air to the dump valves, which then allows them to open and close according to the temperature error signal, a compensated (Tav9 - T ref) signal. The dump valves modulate open proportionally to this temperature error signal with a stroke time of approximately 20 seconds. For large temperature errors the valves will trip open in two banks as required for fast response with a stroke time of about three seconds. Upon reduction of the error signal below the trip-open setpoints, the respective valve groups return to modulating control.

The steam dump decreases proportionally as the control rods act to reduce the coolant average temperature. The artificial load is therefore removed as the coolant average temperature is restored to its programmed value. When steam dump is no longer required, the air supply to the valves may be manually removed.

Since the steam dump valves exhaust into the condenser, all steam dump is blocked when the condenser in unavailable.

The turbine bypass steam system is described in Section 10.2. The bypass flows to the main condenser.

Feedwater Control Each steam generator is equipped with two three element feedwater control systems (one for the main regulator valve and the second for the low flow regulator valve) which maintain a programmed water level as a function of load on the secondary side of steam generator. The three element feedwater control system continuously compares actual feedwater flow with steam flow compensated by steam pressure with a water level set point to regulate the feedwater valve opening. The individual steam generators are operated in parallel, both on the feedwater and on the steam side.

Continued delivery of feedwater to the steam generator is required as a sink for the heat stored and generated in the coolant following a reactor trip and turbine trip. A reactor trip signal provides an override signal to the feedwater control system. After a trip, all feedwater valves open fully thereby insuring the full supply of feedwater following a reactor trip and turbine trip.

Another override signal then closes the feedwater valves when the coolant average temperature 54 of 108 IPEC00035878 IPEC00035878

IP3 FSAR UPDATE falls below a preset temperature value or when the respective steam generator level rises to a preset value. Manual override of the feedwater control systems is also provided.

Pressure Control The reactor coolant system pressure is maintained at constant value by using heaters in the water region and spray in the steam region of the pressurizer. Electrical immersion heaters are located near the bottom of the pressurizer. A portion of the heater groups are proportional heaters and are used for small pressure variation control and to compensate for heat losses and the smaller continuous spray. Up to three sets of backup heaters may be turned on manually and operated continuously. The remaining (backup) heaters are turned on either when the pressurizer pressure controller signal is below a preset value or when the pressurizer level exceeds the programmed level setpoint by a preset amount.

The spray valves for the pressurizer are located near their respective RCS cold legs, and the spray nozzle is located at the top of the pressurizer. Spray is initiated when the pressure controller signal is above a preset set point. Spray rate increases proportionally with increasing pressure until it reaches the maximum spray capacity.

Steam condensed by spray reduces the pressurizer pressure. A small continuous spray is normally maintained to reduce thermal stress and thermal shock when the spray valves open and help maintain uniform water chemistry and temperature in the pressurizer.

Two power operated relief valves (PORVs), PCV-455C and PCV-456, prevent the RCS pressure from exceeding the Technical Specifications limits of 10 CFR 50 Appendix "G" during low temperature, low pressure and water solid modes of operation. The PORVs are armed below a preset temperature of 319°F, and will open at a programmed pressure which is set to prevent exceeding the Appendix "G" curves. The two PORVs are supplied with nitrogen. The instrument N2 system for the PORVs is tapped from the N2 supply line to the four safeguards accumulators. The accumulators are sized to provide for 200 valve operating cycles. The actual take-off point for this N2 system is downstream of the pressure regulator valve NNE-863.

The PORV accumulators individually hold 6 cu ft of N2 at a minimum pressure of 550 psig.

During low temperature shutdown operations, the Overpressure Protection System requires an N2 supply of sufficient capacity which, in case of loss of main N2 supply, can support the number of PORV cycles resulting from an overpressure event of 10 minute duration. This N2 supply is provided by one Safety Injection Accumulator having its associated N2 fill valve blocked open.

One PORV is operated on the pressurizer pressure controller signal, the other one is operated on the actual pressure signal. A separate interlock is provided for each so that if a second pressure channel indicates abnormally low, are the time the relief valve operation is called for by the other channel, the valve activation is blocked. The logic for each is thus basically two out of two. However, during normal operation at normal pressure, the interlock is not actuated and only the operating signals are required to actuate the valve. The interlock is set above normal operating pressure to prevent spurious operation.

Three spring-loaded safety valves limit system pressure to 2750 psia following a complete loss of load without direct reactor trip or actuation of turbine bypass.

Reactor coolant flow to the residual heat removal loop is from the hot leg of Loop 2 through two motor operated valves (No. 731 and 730). Valves 731 and 730 are pressure interlocked to prevent opening should reactor coolant pressure go above 450 psig. This arrangement 55 of 108 IPEC00035879 IPEC00035879

IP3 FSAR UPDATE prevents inadvertent pressurization of the residual heat removal loop when the Reactor Coolant System is above 450 psig. These valves will be opened when RCS pressure is lower than 450 psig. Valve position indication lights and position selector switches for both valves are provided in the control room. These valves are closed during power operation to preclude RHRS over-pressurization. To open the valve, the switch is held over to the Open position and if RCS pressure is less than 450 psig, the valve will open. If these valves are open and RCS pressure increases to 550 psig, they will auto-close. A narrow range pressure recorder with an operator controlled alarm point, which actuates warning lights and audible device, has been added to instrument loop for PT-402. This is designed to attract the operators attention to a potential overpressure transient in progress, to allow him to take necessary action to minimize the magnitude of overpressure event while the RCS is operating at low pressure. The system is not required for safe shutdown of the reactor, and the operator may deactivate the recorder and alarms, which removes the potential for distracting alarms when a normal RCS pressure.

To prevent inadvertent isolation of the RHR loop when the Reactor Coolant System is below 200 degrees, depressurized, and vented to an equivalent opening of greater than two (2) square inches AC-MOV-730 and 731 may be de-energized open.

These valves are also interlocked with containment sump valves 885A and B. To open valves 885A and B, the RH R suction valves 730 and 731, respectively, must be closed. This prevents the reactor coolant water from being drained to the contained sump. High Head SI Suction Valves 888A and B are also interlocked with valves 730 and 731, respectively. A valve 884A and B will not open if 730 and 731, respectively, are opened.

SI-MOV-883 is interlocked with AC-MOV-730 and AC-MOV-731 so that the valve can only be opened if both MOV-730 and MOV-731 are fully closed. If valve SI-MOV-883 is open and valve AC-MOV-730 or AC-MOV-731 leave their closed limit seats, valve SI-MOV-883 will auto-close.

The interlock prevents inadvertent opening of valve SI-MOV-883 during cool down and subsequent diversion of reactor coolant to the RWST or over pressurization of a lower pressure SI piping system.

Valves AC-MOV-730 and -731 may be de-energized during cold shutdown if the RCS is depressurized and vented through a minimum equivalent opening of two (2) square inches. De-energizing these valves while the RHR pumps are in service prevents inadvertent isolation of the RHR pump suction supply, which could potentially cause pump failure. De-energizing these valves will also cause a loss of all of the interlock protection associated with AC-MOV-730 and -

731. When AC-MOV-730 and -731 are de-energized, administrative controls are established to replace the protective functions of these interlocks. These administrative controls prevent unanticipated communication of reactor coolant with the containment sump and the RWST.

These controls also prevent overpressurization of the RHR and SI system piping and components.

7.3.3 System Design Evaluation Plant Stability The control system is designed to maintain a stable reactor coolant average temperature within acceptable limits. Continuous oscillation at a low frequency and small amplitude is expected.

Proper adjustment of the control loop static and dynamic gains (with respect to the process response) can reduce this oscillation almost to zero and will also avoid instability induced by the control system itself. Because stability is more difficult to maintain at low power under 56 of 108 IPEC00035880 IPEC00035880

IP3 FSAR UPDATE automatic control, no provision is made to provide automatic control below 15 percent of full power.

The control system is designed to operate as a stable system over the full range of automatic control throughout core life.

Step Load Changes Without Turbine Bypass A typical reactor power automatic control requirement is to restore equilibrium conditions without a plant trip, following 10 percent step load demand increases within the range of 15 to 90 percent of full power and 10% step load demand reductions within the range of 100% to 25% of full power. The design was necessarily based on conservative conditions and a greater transient capability is expected for actual operating conditions. A load demand greater than full power is inhibited by the turbine control load limit devices in response to input from the Reactor Protection System. Although turbine bypass is provided for added control after large load decreases, it will not be necessary during the 10% load changes.

The function of the control system is to minimize the reactor coolant average temperature deviation during the transient within an acceptable value and to restore average temperature to the programmed set point within an acceptable time. Excessive pressurizer pressure variations are prevented by using spray and heaters in the pressurizer.

The margin to over-temperature ~T reactor trip is of primary concern for the step load changes.

This margin is influenced by nuclear flux, pressurizer pressure, and reactor coolant average temperature and temperature rise across the core.

Ramp Loading and Unloading Ramp loading and unloading is provided over the 15 to 100 percent power range under automatic control. The function of the control system is to maintain the coolant average temperature and the secondary steam pressure as functions of turbine-generator load within acceptable deviation from the programmed values. The minimum control rod speed provides a sufficient reactivity rate to compensate the reactivity changes resulting from the moderator temperature coefficient and the power coefficient.

The coolant average temperature is increasing during loading and there is a continuous in-surge to the pressurizer resulting from coolant expansion. The sprays limit the resulting pressure increase. Conversely, as the coolant average temperature is decreasing during unloading, there is a continuous out-surge from the pressurizer resulting from coolant contraction. The heaters limit the resulting system pressure decrease. The pressurizer level is programmed such that the water level has an acceptable margin above the low level heater cutout set point during the loading and unloading transients.

The primary concern for the loading is to limit the overshoot in coolant average temperature to provide sufficient margin to the over-temperature liT trip.

The automatic load controls are designed to safely adjust the unit generation to match load requirements within the limits of the unit capability and licensed rating.

Loss of Load With Turbine Bypass 57 of 108 IPEC00035881 IPEC00035881

IP3 FSAR UPDATE The Reactor Control System is designed to accept a 10% to 50% (depending on full power Tavg; see Section 7.3.2) loss of load accomplished as a turbine runback at a maximum rate of 200% per minute without requiring a reactor trip. The automatic turbine bypass system is able to accommodate this abnormal load rejection by reducing the thermal transient imposed upon the reactor coolant system. The reactor power is reduced at a rate consistent with the capability of the rod control system. The reducing of the reactor power is automatic down to 15 percent of full power. Manual control is used when the power is below this value. The steam bypass is removed as fast as the control rods are capable of inserting negative reactivity.

The pressurizer relief valves might be actuated for the most adverse conditions, e.g., the most negative Doppler coefficient, and the minimum incremental rod worth. The relief capacity of the power operated relief valves is sized large enough limit the system pressure to prevent actuation of high pressure reactor trip for the most adverse conditions.

Turbine-Generator Trip With Reactor Trip Turbine-generator unit trip is accompanied by reactor trip. With a secondary system design pressure of 1100 psia, the plant is operated with a programmed average temperature as a function of load, with the full load average temperature significantly greater than the saturation temperature corresponding to the steam generator safety valve set point. This, together with the fact that the thermal capacity in the Reactor Coolant System is greater than that of the secondary system, requires a heat sink to remove heat stored in the reactor coolant to prevent actuation of steam generator safety valves for turbine and reactor trip from full power.

This heat sink is provided by the combination of controlled release of steam to the condenser and by makeup of cold feedwater to the steam generators. The turbine bypass system is controlled from the reactor coolant average temperature signal whose reference set point is reset upon trip to the no load value. Turbine bypass actuation must be rapid to prevent steam generator safety valve actuation. With the bypass valves open the coolant average temperature starts to reduce quickly to the no load set point. The automatic control of reactor coolant average temperature acts to proportionally close the valves and thus minimize the total amount of steam bypassed.

Following turbine trip, the steam voids in the steam generators will collapse and the fully opened feedwater valves will provide sufficient feedwater flow to restore water level in the downcomer.

The feedwater flow is cut off if the reactor coolant average temperature decreases below a preset temperature value or if the steam generator water level reaches a preset high set point.

Additional feedwater makeup may then be controlled manually to restore and maintain steam generator level while maintaining the reactor coolant at the no load temperature. Long term residual heat removal is maintained by the steam generator pressure controller (manually selected) which controls the steam pressure (and thus, indirectly, the temperature) by adjusting the amount of turbine bypass to the condensers. The controller operates the same bypass valves to the condensers which are controlled by coolant average temperature during the initial transient following turbine and reactor trip.

The pressurizer pressure and water level fall very fast during the transient resulting from the coolant contraction. If heaters become uncovered following the trip, the Chemical and Volume Control System will provide full charging flow to restore water level in the pressurizer. Heaters are then turned on to heat up pressurizer water and restore pressurizer pressure to normal.

58 of 108 IPEC00035882 IPEC00035882

IP3 FSAR UPDATE The turbine bypass and feedwater control systems are designed to prevent the coolant average temperature falling below the programmed no load temperature following the trip to ensure adequate reactivity shutdown margin.

59 of 108 IPEC00035883 IPEC00035883

IP3 FSAR UPDATE 7.4 EXCORE NUCLEAR INSTRUMENTATION 7.4.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the basis for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Fission Process Monitors and Controls Criterion: Means shall be provided for monitoring or otherwise measuring and maintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations in reactivity of the core. (GDC 13 of 7/11/67)

The excore Nuclear Instrumentation System is provided to monitor reactor power from source range, through intermediate range and power range, up to 120 percent of full power. The system provides indication, control and alarm signals for reactor operation and protection.

Additionally, per Regulatory Guide 1.97 requirements, an Excore Neutron Flux Monitoring System (NFMS) (see Plant Drawing 9321-LL-96553 [Formerly Figure 7.4-4]) consisting of two detectors has been installed to provide reactor power indication from source range through power range. The Regulatory Guide 1.97 excore Neutron Flux Monitoring System provides local indication elsewhere in the plant, in addition to indication only provided to the control room via QSPDS and CFMS. These other indication locations are in the upper electrical tunnel and at the charging station in the PAB for use during shutdown from outside the control room.

The operational status of the reactor is monitored from the Control Room. When the reactor is subcritical (i.e., during cold or hot shutdown, refueling and approach to criticality) the relative reactivity status (neutron source multiplication) is continuously monitored and indicated by proportional counter detectors located in instrument wells in the primary shield adjacent to the reactor vessel. Two source range detector channels are provided for supplying information on multiplication while the reactor is subcritical. A reactor trip is actuated from either channel if the neutron flux level becomes excessive. This system is checked prior to operations in which criticality may be approached. This is accomplished by the use of an incore source to provide a meaningful count rate even at the refueling shutdown condition. Any appreciable increase in the neutron source multiplication is slow enough to give ample time to start corrective action (boron dilution stop and/or emergency boron injection) to prevent the core from becoming critical When the reactor is critical, means for showing the relative reactivity status of the reactor are:

1) Rod Position
2) Source, Intermediate and Power Range Detector Signals 60 of 108 IPEC00035884 IPEC00035884

IP3 FSAR UPDATE

3) Qualified Safety Parameters Display System (QSPDS)
4) Boron Concentration
5) Hot Leg Temperatures The position of the control banks is directly related to the reactivity status of the reactor when at power, and any unexpected change in the position of the control banks under automatic control or change in the hot leg coolant temperature under either manual or automatic control provides a direct and immediate indication of a change in the reactivity status of the reactor. Periodic samples of the coolant boron concentration are taken. The variation in concentration during core life provides a further check on the reactivity status of the reactor including core depletion.

High nuclear flux protection is provided both in the power and intermediate ranges by reactor trips, actuated from either range, if the neutron flux level exceeds trip set-points. When the reactor is critical, the best indication of the reactivity status in the core (in relation to the power level and average coolant temperature) are the control room display of the rod control group position and the boron concentration in the coolant.

7.4.2 System Design Nuclear Instrumentation System (NIS)

The three instrumentation ranges of the Nuclear Instrumentation System (NIS) overlap so that continuous readings are available during transition from one range to another. The sensitivities of the neutron detectors are illustrated on Figure 7.4-1. The Nuclear Instrumentation System diagram is shown on Figure 7.4-2.

Detectors The excore system consists of twelve independent detectors in six instrument wells located around the reactor, as shown in Figure 7.4-3. The six assemblies provide the following instrumentation:

1. Power Range This range consists of four independent, long, uncompensated ionization chamber assemblies. Each assembly is made up of two sensitive lengths. One sensitive length covers the upper half of the core, and the other length covers the lower half of the core.

In effect the arrangement provides a total of eight separate ionization chambers approximately one-half the core height. The eight uncompensated (guard-ring) ionization chambers sense thermal neutrons in the range from 5.0 x 102 to 1.0 X 1011 neutrons per sq cm per sec.

Each chamber initially had a nominal sensitivity of 3.1 x 10-13 amperes per neutron per sq cm (see Figure 7.4-1). The four long ionization chamber assemblies are located in vertical instrument wells adjacent to the four "corners" of the core. The 61 of 108 IPEC00035885 IPEC00035885

IP3 FSAR UPDATE assembly is manually positioned in the assembly holders and is electrically isolated from the holder by means of insulated standoff rings.

Due to redesign of the Nuclear Core (low leakage core design) and resultant decrease in thermal neutrons at the detectors, new Power Range Moderators have been installed on the four (4) Power Range uncompensated ionization chambers.

The Power Range Moderators increase the normal sensitivity of the chambers by approximately 700%.

2. Startup Range (Intermediate and Source)

There are two separate startup range assemblies. Each assembly contains one compensated ionization detector (intermediate range) and one proportional counter detector (source range).

The source range neutron detectors are proportional counters with an initial nominal sensitivity of 10 counts per sec per neutron per sq cm per sec (see Figure 7.4-1).

The detectors sense thermal neutrons in the range from 10-1 to 5. X 105 neutrons counts per second. The range of the source range channel is 100 to 106 counts per second.

The Source Range detectors are positioned in detector assembly containers by means of a linear, high density moderator insulator. The detector and insulator units are packaged in a housing which is inserted into the detector wells. The detector assembly is electrically isolated from the detector well by means of insulated stand-off rings.

The intermediate range neutron detectors are compensated ionization chambers that sense thermal neutrons in the range form 2.5 x 102 to 2.5 x 1010 neutrons per sq cm per sec and initially had a nominal sensitivity of 4 x 10-14 amperes per neutron per sq cm per second (see Figure 7.4-1). They produce a corresponding direct current of 10-11 to 10-3 amp. These detectors are located in the same detector assemblies as the proportional counters for the source range channels.

Other than the source range pre-amplifier, which is located in containment, the electronic components for each of the source, intermediate and power range channels for the NIS are contained in a draw-out- panel mounted in racks in the Control Room.

Power Range Channel There are three sets of power range measurements. Each set utilizes four individual currents as follows:

a) Four currents directly from the lower sections of the long ionization chambers b) Four currents directly from the upper sections c) Four total currents of (a) and of (b), equivalent to the average of each section.

For each of the four currents in (a) and (b), the current measurement is indicated directly by a microammeter, and isolated signals are available for control console indication and recording.

An analog signal proportional to individual currents is transmitted through buffer amplifiers to the 62 of 108 IPEC00035886 IPEC00035886

IP3 FSAR UPDATE overtemperature 11T channel and provides automatic reset of the trip point for these protection functions. The total current, equivalent to the average, is then applied through a linear amplifier to the bistable trip circuits. The amplifiers are equipped with gain and bias controls for adjustment to the actual output corresponding to 100 percent of rated reactor power.

Each of the four amplifiers also provides amplified isolated signals to the main control board for indication and for use in the Reactor Control System. Each set of bistable trip outputs is operated as a two-out-of-four coincidence to initiate a reactor trip. Bistable trip outputs are provided at low and high power set points depending on the operating power. To provide more protection during startup operation the low range power bistable is used. This trip is manually blocked after a permissive condition is obtained by two of four power range channels. The high power trip bistable is always active.

The overpower trip is set so that, with the maximum instrumentation and bistable set point error, the maximum reactor overpower condition will be limited to 118 percent. This limit is accomplished by the use of solid state instrumentation and long ionization chambers, which permit an integration of the flux external to the core over the total length of the core, thereby reducing the influence of axial flux distribution changes due to control rod motion.

The ion chamber current of each detector is measured by sensitive meters with an accuracy of 0.5 percent. A shunt assembly and switch in parallel with each meter allow selection of one of four meter ranges. The available ranges are 0-100, 0-500, 0-1,000 and 0-5,000 microamperes.

The shunt assemblies are designed in such a manner that they will not disconnect the detector current to the summing assembly upon meter failure or during switching. An isolation amplifier provides an analog signal proportional to ion chamber current for recording, data logging and delta flux indication. A test calibration unit provides necessary swtiches and signals for checking and calibrating the power range channels.

The linear amplifier accepts the output currents from each of the two chamber sections and derives a nuclear power signal proportional to the summed direct currents. This unit amplifies the currents and converts the normal current signal to a voltage signal suitable for operation of associated components such as bistables and isolation amplifiers.

Multiple power supplies furnish necessary positive and negative voltages for the individual channels and detector power.

Mounted on the front panel of each power range channel drawer are the ion chamber current meters, the shunt selector switches with appropriate positions, and the nuclear power indicator (0 to 120 percent of full power).

The isolated nuclear power signals are available for recording by the nuclear instrumentation system recorder. An isolated nuclear power signal is available for recording overpower conditions up to 200% of full power.

Alarm signals for dropped-rod-rod stop, overpower-rod stop, overpower (low and high range)-

reactor trips, and channel tests are annunciated on the main control board. Control signals which are sent to the reactor control and protection system include dropped-rod-rod stop, overpower-rod stop, overpower-reactor trip, and permissive circuit signals. These are described in Section 7.2 63 of 108 IPEC00035887 IPEC00035887

IP3 FSAR UPDATE Over-riding the turbine runback and rod stop signals from a Power Range Nuclear Instrument Dropped Rod circuit in a single channel, or over-riding any turbine runback signal alone has no impact on reactor safety.

Intermediate Range Channels There are two intermediate range channels which utilize two compensated ionization chambers.

Direct current from the ion chambers is transmitted through triaxial cables to transistor logarithmic current amplifiers in the nuclear instrumentation equipment.

The logarithmic amplifier derives a signal proportional to the logarithm of the current as received from the output of the compensated ion chamber. The output of the logarithmic amplifier provides an input to the level bistables for reactor protection purposes and source range cutoff.

The bistable trip units are similar to those in the other ranges. The trip outputs can be manually blocked after receiving a permissive signal from the power range channels. On decreasing power, the intermediate range trips for reactor protection are automatically inserted when the power range permissive signal is not present.

Low voltage power supplies contained in each drawer furnish the necessary positive and negative voltages for the channel electronic equipment. Two medium voltage power supplies, one in each channel, furnish compensating voltage to the two compensated ion chambers. The high voltage for the compensated ion chambers is supplied by separate power supplies also located in the intermediate range drawers.

Neutron (log N) flux level indicators are mounted, one each, on the front panel of the intermediate range channel cabinet and on the control board. These indicators are calibrated in terms of ion chamber current (10- 11 to 10-3 amp).

Isolated neutron flux level signals are available for recording and startup rate computation. The startup rate for each channel is indicated at the main control board in terms of decades per minute over the range of -0.5 to 5.0 DPM.

Channel test, high flux level rod stop, and reactor trip signals are alarmed on the main control board annunciator. The latter signal is sent to the Reactor Protection System.

Source Range Channels There are two source range channels utilizing proportional counter detectors. Neutron flux, as measured in the primary shield area, produces current pluses in the detectors. These preamplified pulses are applied to transistor amplifiers and discriminators located in the racks.

Triaxial cable is used for all interconnections from the detector assemblies to the instrumentation in the racks. The preamplifiers are located inside the Reactor Containment.

These channels indicate the source range neutron flux and startup rate. They provide high flux level reactor trip and alarm signals to the Reactor Control and Protection Systems. The reactor trip signal is manually blocked when a permissive signal from the intermediate range is available. These channels are also used at shutdown to provide audible alarms in the Reactor Containment and Control Room of any inadvertent increase in reactivity. An audible count rate signal is used during initial phases of startup and is audible in both the Reactor Containment and Control Room.

64 of 108 IPEC00035888 IPEC00035888

IP3 FSAR UPDATE Amplifiers are used to obtain a high level signal prior to elimination of noise and gamma pulses by the discriminator. The discriminator output is shaped for use by the log integrator.

The log integrator generates an analog signal proportional to the logarithm of the number of pulses per unit time as received from the output of the previous unit. This unit performs log integration of the pulse rate to determine the count rate, and a linear amplifier amplifies the log integrator output for indication, recording, control, and rate computation through isolation amplifiers.

Each source range channel contains two bistable trip units. Both units trip on high flux level, but one is used during shutdown to alarm reactivity changes and the other provides overpower protection during shutdown and startup. The shutdown alarm unit is blocked manually prior to startup or can serve as a startup alarm. When the input to either unit below its set point, the bistable is in its normal position and assumes a "fully-on" status. When an input from the log amplifier reaches or exceeds the set point, the unit reverses its condition and goes "fully-off."

The output of the reactor trip unit controls relays in the Reactor Protection System.

Power supplies furnish the protective and negative voltages for the transistor circuits, the alarm lights, and the adjustable high voltage for the neutron detector.

A test calibration unit can insert selected test or calibration signals into the preamplifier channel input or the log amplifier input. A set of precalibrated level signals are provided to perform channel tests and calibrations. An alarm is registered on the main control board annunciator whenever a channel is being tested or calibrated. A trip bypass switch is also provided to prevent a reactor trip during channel test under certain reactor conditions.

The neutron detector high-voltage cutoff assembly receives a trip signal when a one-out-of-two matrix, controlled by intermediate range channel flux level bistables, and manual block condition are present. The cutoff assembly disconnects the voltage from the source range channel high voltage power supply to prevent operation of the proportional counter outside its design range.

High voltage and reactor trip circuits are reactivated automatically when two of the intermediate range signals are below the permissive trip setting.

Mounted on the front panel of the source range channel is a neutron flux level indicator calibrated in terms of count rate level (100 to 106 cps). Mounted on the control board is a neutron count rate level indicator (100 to 106 cps). Isolated neutron flux signals are available for recording by the Nuclear Instrumentation System recorder and for startup rate computation.

The startup rate for each channel is indicted at the main control board in terms of decades per minute over the range of -0.5 to +5.0 DPM. The isolation network for these signals prevents any electrical malfuncton in the external circuitry from affecting the signal being supplied to the flux level bistables. The signals for the channel test, high neutron flux at shutdown, and source range reactor trip are alarmed on the main control board annunciator.

Excore Neutron Flux Monitoring System The Excore Neutron Flux Monitoring System consists of two redundant trains, each with a Wide range flux detector, locally mounted amplifier and processor, local indications and dedicated penetration feedthroughs and cabling (see Plant Drawing 9321-LL-96553 [Formerly Figure 7.4-4]). Detector sensitivities are illustrated on Figure 7.4-1).

65 of 108 IPEC00035889 IPEC00035889

IP3 FSAR UPDATE Each of the detectors are fission chambers consisting of two aluminum electrodes electroplated with uranium, insulators and fill gas all included in a titanium assembly. The detectors are located at the 90' and 270' instrument wells and replace the back-up source range detectors that were originally located there. (See Figure 7.4-3)

The amplifiers and microprocessors are located outside the Containment Building in the electrical penetration area in local panels. Redundant trains are powered by redundant instrument bus power supplies. Through isolation devices the Excore Neutron Flux Monitoring System provides the 10 CFR 50, Appendix R, and Reg. Guide 1.97 required shutdown signal.

Although both channels provide local and control room (via QSPDS & CFMS) indication, only the detector at the 270' location has the alternate electrical feed capability for Appendix R.

The magnitude of the neutron flux in the reactor core is proportional to the fission power in the reactor. The number of neutron pulses per unit time from the detector is proportional to the magnitude of the neutron flux at the detector and since this magnitude is proportional to the neutron flux in the core, the detector pulse rate is therefore proportional to reactor power.

The number of pulses from the detector is monitored and the mean square value of the variance signal from the detector is measured. This mean square value is proportional to the average rate of neutron pulses. The signal processor takes this signal and processes it into a measure of the logarithm of the countrate, the rate of change of countrate, the logarithm of reactor power and the rate of change of reactor power. It provides analog voltage outputs for each of these signals and also provides the isolated outputs as required.

Auxiliary Equipment Comparator Channel The comparator channel compares the four nuclear power signals of the power range channels with one another. A local alarm on the channel is actuated when any two channels deviate from one another by a preset adjustable amount. During full power operation, the comparator serves to sense and annunciate channel failures and/or deviations.

Dropped rod Protection As backup to the primary protection for the dropped RCC accident, i.e., the rod bottom signal, independent detection is provided by means of the out-of-core power range nuclear channels.

The dropped-rod sensing unit contains a difference amplifier, which compares the instantaneous nuclear power signal with an adjustable power lag signal and responds with a trip signal to the bistable amplifier when the difference exceeds a preset adjustable amount. Above a given power level, the signal blocks automatic rod withdrawal and initiates protective action in the form of a turbine load cutback. No credit is taken in the dropped rod accident analysis for turbine runback.

Audio Count Rate Channel The auto count rate channel provides audible source range information during refueling operations in both the Control Room and the Reactor Containment. In addition, this channel signal is fed to a scaler-timer assembly which produces a visual display of the count rate for an adjustable sampling period.

66 of 108 IPEC00035890 IPEC00035890

IP3 FSAR UPDATE Recorders One large, two-pen strip chart recorder is mounted on the main control board for recording the complete range of the source and intermediate channels. It is also possible to record any two power range channels as linear signals. Variable chart speeds have been provided.

Switching of inputs to the recorders does not cause any spurious signals that would initiate false alarms or reactor trips.

Two two-pen recorders are provided to record the flux level from each of the four nuclear power range quadrants.

Power Supply The Nuclear Instrumentation System is powered by four 120 volts AC independent vital bus circuits. (See Chapter 8) 7.4.3 System Evaluation Loss of Power The nuclear instrumentation draws its primary power from vital instrument buses discussed in Chapter 8.

Loss of nuclear instrumentation power would result in the initiation of all reactor trips associated with the channel power failure. In addition, all trips which were blocked prior to loss would be unblocked and initiated.

Reliability and Redundancy The requirements established for the reactor protective system apply to the nuclear instrumentation. All channel functions are independent of every other channel.

Safety Factor The relations of the power range channels to the Reactor Protective System has been described in Section 7.2. To maintain the desired accuracy in trip action, the total error from drift in the power range channels is held to +/-1 percent of full power. Routine tests and recalibration ensure that this degree of deviation is not exceeded. Bistable trip set points of the power range channels are also held to an accuracy of +/-1 percent of full power. The accuracy and stability of the equipment were verified by vendor tests.

Overpower Trip Set Point The overpower trip set point for the Indian Point 3 Reactor is 109%. This trip set point was selected to provide adequate assurance that spurious reactor trips would not occur during normal operation. Table 7.4-1 lists the factors which make up the maximum overpower level of 118% based upon a trip set point of 109%.

67 of 108 IPEC00035891 IPEC00035891

IP3 FSAR UPDATE TABLE 7.4-1 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS NUCLEAR OVERPOWER TRIP CHANNEL Set Poi nt and Error Estimated Instrument Allowances: Errors:

(% of rated power) (% of rated power)

Nominal Set Point 109 Calorimetric Error 2 1.55 Axial power distribution effects on total ion chamber current 5 3 Instrumentation channel drift and set point reproductibility 2 1.0 Maximum overpower trip point assuming all individual errors are simultaneously in the most adverse direction 118 68 of 108 IPEC00035892 IPEC00035892

IP3 FSAR UPDATE 7.5 PROCESS INSTRUMENTATION 7.5.1 Design Bases The non-nuclear process instrumentation measures temperatures, pressures, flows, and levels in the Reactor Coolant System, Steam System, Reactor Containment and Auxiliary Systems.

Process variables required on a continuous basis for the startup, operation, and shutdown of the unit are indicated, recorded and controlled from the Control Room. The quantity and types of process instrumentation provided ensure safe and orderly operation of all systems and processes over the full operating range of the plant.

Certain controls which require a minimum of operator attention, or are only in use intermittently, are located on local control panels near the equipment to be controlled. Monitoring of the alarms of such control systems are provided in the Control Room.

Certain process variable indications for normal operation and post accident conditions are made available in the Control Room and the emergency response facilities through the Critical Function Monitoring System (CFMS).

7.5.2 System Design Much of the process instrumentation provide din the plant has been described in the Reactor Control System, the Reactor Protection System and the Nuclear Instrumentation System descriptions (see Sections 7.2, 7.3 and 7.4, respectively). The most important instrumentation used to monitor and control the plant have been described in the above systems descriptions.

The remaining portion of the process instrumentation is generally shown on the respective systems process flow diagrams.

Condensate pots and wet legs are used to prevent process temperatures from actually reaching the transmitters.

Reactor Vessel Level Indicating System (RVLlS)

The Reactor Vessel Level Indicating System (RVLlS) provides a means to monitor the water level in the reactor vessel during a postulated accident. It is designed to function under all normal, abnormal, accident and post-accident conditions concurrent with seismic events. The RVLlS consists of two redundant trains, with redundant power supplies, which automatically compensate for variations in fluid density as well as for the effects of reactor coolant pump operation.

The level instrumentation is divided into the full range (L'lPF) and the dynamic range (L'lPF) in order to measure level under all conditions. The full range gives level indication from the bottom of the reactor vessel to the top of the reactor head during natural circulation conditions. The dynamic range gives indication of reactor vessel liquid level for any combination of running RCP's. Comparison of indicated dip against an algorithm derived L'lP gives a relative void content of the coolant in the core. (See Figure 7.5-2)

The RVLlS utilizes RCS penetrations to manual isolation valves. At the valves are sealed capillary impulse lines (two at the reactor head and two at the seal table) which transmit pressure measurements to dip transmitters located outside the Containment Building in the in 69 of 108 IPEC00035893 IPEC00035893

IP3 FSAR UPDATE the Primary Auxiliary Building. The capillary impulse lines are sealed at the RCS end and at the penetrations (inside Containment) with sensor bellows which serve as hydraulic couplers. The impulse lines extend through the Containment wall to hydraulic isolators which seal and isolate the lines as well as provide hydraulic coupling to capillary tubes going to the dip transmitters.

Inside the Containment Building, strap-on RTD's are utilized for vertical runs of impulse lines to correct the reference leg density contributions to the dip measurement. (See Figure 7.5-2)

Engineered Safety Features The following instrumentation ensures coverage of the effective operation of the engineered safety features:

Containment Pressure The containment pressure is transmitted to the main control board for post accident monitoring.

Six transmitters, two in each of three safety channels, are installed outside the containment to prevent potential missile damage. The pressure is indicated (all six measurement loops) on the main control board; the range is -5 psig to 75 psig.

The six measurement loops, monitoring containment pressure, reflect the effectiveness of engineered safety features.

Separate from the above, a continuous record of containment pressure is provided in a separate recorder panel in the Control Room. Two redundant and separately channeled safety related, Containment Building pressure measurements are transmitted to and recorded in the Control Room; their range is -5 psig to +200 psig. Each pressure measurement loop consists of a pressure transmitter, a pressure recorder and the necessary signal conditioning equipment, including a power supply, located in the Control Room. Each measurement loop is powered from a separate safety related 118 volts AC instrument bus. (See Section 5.5)

Containment Building Hydrogen Concentration Indication of hydrogen in the Containment Building during and after a postulated accident is available from redundant sample conditioners and analyzers. The concentration is continually recorded by 2 recorders located in the Control Room.

Containment Building and Sump Water Level There are measuring loops for monitoring water level in the Containment Sump, Recirculation Sump and the Containment Building. Each loop consists of a sensor and transmitter located in the Containment Building and a power supply and recorder in the Control Room.

In addition, to alert the operator in the event of a flooding incident, a reactor pit water level alarm provides indication in the Control Room; and a water level sensing probe and remote control unit provide containment sump overflow indication to the Control Room.

Refueling Water Storage Tank Level Two redundant channels indicate that Safety Injection and Containment Spray Systems have removed water from the storage tank. One level indication and two low level alarms are transmitted from the tank to the control board.

70 of 108 IPEC00035894 IPEC00035894

IP3 FSAR UPDATE Safety Injection Pumps Discharge Pressure These channels show that the safety injection pumps are operating. The transmitters are outside the Containment.

Safety Injection System Flows Flow indication is provided to the control board for the high and low head injection lines, the recirculation phase containment spray lines, and the spray additive rank outlet line.

Pump Energization All pump motor power feed breakers indicate that they have closed by energizing indicatng lights on the control board.

Valve Position All engineered safety features valves have position indication on the control board to show proper positioning of the valves. Air operated and solenoid operated valves are selected so as to move in a preferred direction on the loss of air or power. Motor-operated valves remain in the position they held at the time of loss of power to the motor.

Residual Heat Exchangers Individual exit flows are indicated, plus combined inlet temperature and individual exit temperatures are recorded, on the control board to monitor operation of the residual heat exchangers.

Service Water Individual service water pump flows are monitored through the use of an annubar flow measurement system. This system provides flow indication at the service water pump location.

Air Coolers Local flow indication is provided outside containment for service water flow to each cooling unit.

Abnormal flow alarms are provided in the Control Room. Service water common inlet temperatures, and all outlet temperatures are displayed at the critical function monitoring system (CFMS). A Control Room alarm is actuated if the flow is low coincident with a safety injection signal. The transmitters are outside the Reactor Containment. In addition, the exit flow is monitored for radiation and alarmed in the Control Room if high radiation should occur. This is a common monitor and the faulty cooler can be located by manually blocking the flow to each unit in turn with locally operated valves.

Alarms Visual and audible alarms are provided to call attention to abnormal conditions. The alarms are of the individual acknowledgment type; that is, the operator must recognize and silence the audible alarm for each alarm point. For most control systems, the sensing device and circuits for the alarms are independent, or isolated from, the control devices.

71 of 108 IPEC00035895 IPEC00035895

IP3 FSAR UPDATE In addition to the above, the following local instrumentation is available:

a) Containment spray test lines total flow b) Safety injection test line pressure and flow Monitoring Systems A Safety Parameter Display System (SPDS) is provided to the Control Room which continuously displays information from which plant status can be assessed. Information on the following functions is provided:

a) Reactivity Control b) Reactor core cooling and heat removal from the primary system c) Reactor coolant system integrity d) Radioactivity control e) Containment conditions The SPDS consists of the Critical Functions Monitoring System (CFMS) and the Qualified Safety Parameters Display System (QSPDS). The CFMS displays and alarms of critical safety functions (set of actions, which preserve integrity of one or more physical barriers against radiation) are indicated in the Control Room (CR) and the three emergency response facilities Technical Support Center (TSC), Emergency Operations Facility (EOF) and Alternate Emergency Operations Facility (AEOF). The CFMS is a redundant computer system not designed to seismic and electrical class 1E criteria. The QSPDS is a backup display system to the CFMS that is qualified to seismic and electrical class 1E standards.

The QSPDS design and display is based on NRC Regulatory Guide 1.97 criteria. The CFMS provides for historical data storage and retrieval capability (HDSR). The HDSR system will record, store, recall and display historical information either as graphs and trends or printed logs.

The CFMS/QSPDS receive signals from various plant equipment. The CFMS receives signals from safety related and non-safety related sources, and adequate electrical separation is maintained by use of fiber optic links.

In order to comply with the requirements of Regulatory Guide 1.97, additions to the original plant design parameters were made. Transmitters monitoring many process variables were installed and the CFMS is utilized to alarm and display these parameters. In some cases local indicators are also provided to facilitate local operation needs. Besides additions, replacement of existing components were made to upgrade them to meet the requirements.

7.5.3 System Evaluation Redundant instrumentation has been provided for all inputs to the protective system and vital control circuits.

Where wide process variable ranges and precise control are required, both wide range and narrow range instrumentation is provided.

All electrical and electronic instrumentation required for safe and reliable operation is supplied from four redundant instrumentation buses.

72 of 108 IPEC00035896 IPEC00035896

IP3 FSAR UPDATE 7.5.4 Instrument Required Table 7.5-1 identifies the instruments used to demonstrate compliance with NRC Regulatory Guide 1.97. Exemptions to compliance are noted in the table.

The Technical Specifications establish required actions and completion times for Regulatory Guide 1.97 Type A and Category 1 instrument channels.

In addition, inoperability of the following associated recorders is limited to 14 days: Containment Pressure, Containment Water Level, Recirculation Sump Water Level, Containment Hydrogen Monitor, Steam Generator Water level (Wide Range), RCS Pressure (Wide Range), Cold Leg Temperature (Wide Range), Hot Leg Temperature (Wide Range), Pressurizer Water Level, RCS Subcooling Monitor.

Surveillance requirements for Regulatory Guide 1.97 Type A and Category 1 instruments are established in the Technical Specifications. In addition, a Channel Operational Test is required, as follows, for alarms that are associated with Type A and Category 1 instruments, but which have no Regulatory Guide function:

  • Gross Failed Fuel Detector (R63), Quarterly
  • Containment Hydrogen Monitor, Monthly 73 of 108 IPEC00035897 IPEC00035897

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 101A A1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 101B A1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 102A A1 Primary Coolant Temperature, Hot Leg Loop No.1 T413A P 102B A1 Primary Coolant Temperature, Hot Leg Loop No.2 T423A P 102C A1 Primary Coolant Temperature, Hot Leg Loop No.3 T433A P 1020 A1 Primary Coolant Temperature, Hot Leg Loop No.4 T443A P 103A A1 Primary Coolant Temperature, Cold Leg Loop No.1 T413B P 103B A1 Primary Coolant Temperature, Cold Leg Loop No.2 T423B P 103C A1 Primary Coolant Temperature, Cold Leg Loop No.3 T433B P 1030 A1 Primary Coolant Temperature, Cold Leg Loop No.4 T443B P 104A A1 Steam Generator 31 Level, Wide Range L417D K 104B A1 Steam Generator 31 Level, Narrow Range L417A K 104C A1 Steam Generator 31 Level, Narrow Range L417B K 1040 A1 Steam Generator 31 Level, Narrow Range L417C K 104E A1 Steam Generator 32 Level, Wide Range L427D K 104F A1 Steam Generator 32 Level, Narrow Range L427A K 104G A1 Steam Generator 32 Level, Narrow Range L427B K 104H A1 Steam Generator 32 Level, Narrow Range L427C K 1041 A1 Steam Generator 33 Level, Wide Range L437D K 104J A1 Steam Generator 33 Level, Narrow Range L437A K 104K A1 Steam Generator 33 Level, Narrow Range L437B K 104L A1 Steam Generator 33 Level, Narrow Range L437C K 104M A1 Steam Generator 34 Level, Wide Range L447D K 104N A1 Steam Generator 34 Level, Narrow Range L447A K 1040 A1 Steam Generator 34 Level, Narrow Range L447B K 104P A1 Steam Generator 34 Level, Narrow Range L447C K 105A A1 Pressurizer Level, Channel I L459 "U 105B A1 Pressurizer Level, Channel II L460 m 105C A1 Pressurizer Level, Channel III L461

()

-u o m o oo o eN o 01 74 of 108 o0) 00 (J1 <D CD 00 CD CD

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 106B A1 Containment Wide Range Pressure, Channel I P1421 0 106C A1 Containment Wide Range Pressure, Channel II P1422 0 107A A1 Steam Generator 31 Pressure, Channel I P419A 107B A1 Steam Generator 31 Pressure, Channel II P419B 107C A1 Steam Generator 31 Pressure, Channel IV P419C 1070 A1 Steam Generator 32 Pressure, Channel I P429A 107E A1 Steam Generator 32 Pressure, Channel II P429B 107F A1 Steam Generator 32 Pressure, Channel IV P429C 107G A1 Steam Generator 33 Pressure, Channel I P439A 107H A1 Steam Generator 33 Pressure, Channel II P439B 1071 A1 Steam Generator 33 Pressure, Channel IV P439C 107J A1 Steam Generator 34 Pressure, Channel I P449A 107K A1 Steam Generator 34 Pressure, Channel II P449B 107L A1 Steam Generator 34 Pressure, Channel IV P449C 108A A1 Refueling Water Storage Level, Alarm L920 N Tank 108B A1 Refueling Water Storage Level, Alarm L921 N Tank 109A A1 Containment Water Level L1253 L 109B A1 Containment Water Level L1254 L 111A A1 Containment Radiation, Area, High Range R25 111 B A1 Containment Radiation, Area, High Range R26 112A A1 Secondary Cooling Radiation, Main Steam R62 SS 113A A1 Primary Coolant Temperature, Core Exit CE-T-*** TT 114A A1 Condensate Storage Tank Water Level L1128 Level 114B A1 Condensate Storage Tank Water Level L1128A "U Level m 115A A1 Primary Coolant Temperature, Degrees of RCS Subcooling QSPDS-A M

()

-u o m o oo o eN o 01 75 of 108 o0) 00 (J1 <D CD <D CD CD

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 115B A1 Primary Coolant Temperature, Degrees of RCS Subcooling QSPDS-B M 201A B1 Neutron Flux Excore Radiation, Intermediate Range Channell N38 201B B1 Neutron Flux Excore Radiation, Intermediate Range Channel II N39 202A B3 Control Rods Position N/A 203A B3 Primary Coolant Sampling, Soluble Boron Concentration N/A Grab Sample 204A B3 Primary Coolant Temperature, Cold Leg, Loop No.1 T413B P 204B B3 Primary Coolant Temperature, Cold Leg, Loop No.2 T423B P 204C B3 Primary Coolant Temperature, Cold Leg, Loop No.3 T433B P 2040 B3 Primary Coolant Temperature, Cold Leg. Loop No.4 T433B P 205A B1 Primary Coolant Temperature, Hot Leg, Loop No.1 T413A P 205B B1 Primary Coolant Temperature, Hot Leg, Loop No.2 T423A P 205C B1 Primary Coolant Temperature, Hot Leg, Loop No.3 T433A P 2050 B1 Primary Coolant Temperature, Hot Leg, Loop No.4 T443A P 206A B1 Primary Coolant Temperature, Cold Leg, Loop No.1 T413B P 206B B1 Primary Coolant Temperature, Cold Leg, Loop No.2 T423B P 206C B1 Primary Coolant Temperature, Cold Leg, Loop No.3 T433B P 2060 B1 Primary Coolant Temperature, Cold Leg, Loop No.4 T443B P 207A B1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 207B B1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 208A B3 Primary Coolant Temperature, Core Exit CE-T-*** TT 209A B1 Primary Coolant Level, Reactor RVLlS TR-A & B 210A B2 Primary Coolant Temperature, Degrees of Subcooling QSPDS-A 210B B2 Primary Coolant Temperature, Degrees of Subcooling QSPDS-B 211A B1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 211B B1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 212C B2 Containment Level, Containment Sump Water Channel I L1255 L "U 2120 B2 Containment Level, Containment Sump Water Channel II L1256 L m 212E B1 Containment Level, Wide Range Channel I L1253 L

()

-u o m o oo o eN o 01 76 of 108 o0) <D (J1 o CD o o

o

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 212F B1 Containment Level, Wide Range Channel II L1254 L 2121 B2 Containment Level, Wide Range Redundant Channel: L1251 L Recirculation Sump Level-Channel I 212J B2 Containment Level, Wide Range Redundant Channel: L1252 L Recirculation Sump Level-Channel II 213B B1 Containment Pressure, Channel I P1421 0 213C B1 Containment Pressure, Channel II P1422 0 214A B1 Containment Position, Isolation valve N/A Y 215B B1 Containment Pressure, Channel I P1421 0 215C B1 Containment Pressure, Channel II P1422 0 301A C1 Primary Coolant Temperature, Core Exit CE-T-*** TT 302A C1 Primary Coolant Radiation, Radioactivity Concentration R-63A&B 303A C1 Primary Coolant Radiation, Gamma Spectrum N/A W 304A C1 Primary Coolant Pressure, Reactor Coolant System Loop 4 P402 J 304B C1 Primary Coolant Pressure, Reactor Coolant System Loop 1 P403 J 305B C1 Containment Pressure, Channel I P1421 0 305C C1 Containment Pressure, Channel II P1422 0 306C C2 Containment Level, Containment Sump Water Channel I L1255 L 3060 C2 Containment Level, Containment Sump Water Channel II L1256 L 306E C1 Containment Level, Wide Range Channel I L1253 L 306F C1 Containment Level, Wide Range Channel II L1254 L 3061 C1 Containment Level, Wide Range Redundant Channel: L1251 L Recirculation Sump Level-Channel I 306J C1 Containment Level, Wide Range Redundant Channel: L1252 L Recirculation Sump Level-Channel II 307A C3 Containment Radiation, Area R25 "U 307B C3 Containment Radiation, Area R26 m 308A C3 Cond Air Removal Sys Radiation, Effluent Noble Gas R15

()

-u o m o oo o eN o 01 77 of 108 o0) <D (J1 o

......

CD o

--"

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES Exhaust 309A C1 Primary Coolant Pressure, Reactor Coolant System, Loop 1 P402 J 309B C1 Primary Coolant Pressure, Reactor Coolant System, Loop 4 P403 J 310B C1 Containment Air Sampling, Hydrogen Concentration Channel I HCMC-A 310C C1 Containment Air Sampling, Hydrogen Concentration Channel II HCMC-B 311B C1 Containment Pressure, Channel I P1421 0 311C C1 Containment Pressure, Channel II P1422 0 312A C2 Containment Radiation, Effluent, Noble Gas, Penetration Area R12 AA 314B C2 Penetration Area Radiation, Area, Electrical Tunnel In N/A BB Area of Electrical Penetration 314C C2 Penetration Area Radiation, Area, 83' Personnel Airlock Area N/A BB 3140 C2 Penetration Area Radiation, Area, Containment Purge Valve Area N/A BB Between Containment & Fan House 314E C2 Penetration Area Radiation, Area, 95' Personnel & Equipment N/A BB Hatch Area 314F C2 Penetration Area Radiation, Area, Fuel Transfer Area Between N/A BB Containment & Fuel Storage Buildings 314G C2 Fuel Storage Building Radiation, Area, Penetration Area, In Area of Fuel R5 BB Transfer Tube 314H C2 PAB 34' FL EL Radiation Area, Piping Tunnel In Area of N/A BB Containment Sump Drain Pent 314J C2 PAB 54' FL EL Radiation, Area, Piping Tunnel in Area of Piping N/A BB Penetrations 401A 02 Residual Heat Removal Flow Rate, Header 31 F638 401B 02 Residual Heat Removal Flow Rate, Header 32 F640 401C 02 Residual Heat Removal Flow Rate, Loop 4 FT946A 4010 02 Residual Heat Removal Flow Rate, Loop 3 FT946B "U 401E 02 Residual Heat Removal Flow Rate, Loop 2 FT946C m 401F 02 Residual Heat Removal Flow Rate, Loop 1 FT9460

()

-u o m o oo o eN o 01 78 of 108 o0) <D (J1 o CD tv o

N

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 402A 02 Residual Heat Removal Temperature, Heat Exchanger 31 Outlet T639 402B 02 Residual Heat Removal Temperature, Heat Exchanger 32 Outlet T641 403A 02 Safety Injection Level, Accumulator Tank 31 L934A Z 304B 02 Safety Injection Level, Accumulator Tank 32 L934B Z 403C 02 Safety Injection Level, Accumulator Tank 33 L934C Z 4030 02 Safety Injection Level, Accumulator Tank 34 L9340 Z 403E 02 Safety Injection Pressure, Accumulator Tank 31 P937A Z 403F 02 Safety Injection Pressure, Accumulator Tank 32 P937B Z 403G 02 Safety Injection Pressure, Accumulator Tank 33 P937C Z 403H 02 Safety Injection Pressure, Accumulator Tank 34 P9370 Z 404A 02 Safety Injection Pressure, Accumulator Tank 31 Isolation Valve N/A HH 894A 404B 02 Safety Injection Pressure, Accumulator Tank 32 Isolation Valve N/A HH 894B 404C 02 Safety Injection Pressure, Accumulator Tank 33 Isolation Valve N/A HH 894C 4040 02 Safety Injection Pressure, Accumulator Tank 34 Isolation Valve N/A HH 8940 405A 02 Safety Injection Flow, Boric Acid Charging F128 H 406A 02 Safety Injection Flow, High Head, Cold Leg Loop I F926 406B 02 Safety Injection Flow, High Head, Cold Leg Loop I F924A 406C 02 Safety Injection Flow, High Head, Cold Leg Loop 2 F981 4060 02 Safety Injection Flow, High Speed, Cold Leg Loop 2 F925 406E 02 Safety Injection Flow, High Speed, Cold Leg Loop 3 F980 406F 02 Safety Injection Flow, High Speed, Cold Leg Loop 3 F926A 406G 02 Safety Injection Flow, High Speed, Cold Leg Loop 4 F982 "U 406H 02 Safety Injection Flow, High Speed, Cold Leg Loop 4 F927 m 407A 02 Safety Injection Flow, Low Head F638

()

-u o m o oo o eN o 01 79 of 108 o0) <D (J1 o CD eN o0)

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 407B 02 Safety Injection Flow, Low Head F640 408A 02 Safety Injection Level, Refueling Water Storage Tank L920 409A 03 Primary Coolant Status, Reactor Coolant Pump 31 N/A 409B 03 Primary Coolant Status, Reactor Coolant Pump 32 N/A 409C 03 Primary Coolant Status, Reactor Coolant Pump 33 N/A 4090 03 Primary Coolant Status, Reactor Coolant Pump 34 N/A 410A 02 Primary Coolant Position, Safety Relief Valve, Power Operated N/A Acoustica Relief Valve 455C I Monitor At Valve 410B 02 Primary Coolant Position, Safety Relief Valve, Power Operated N/A Acoustica Relief Valve 456 I Monitor At Valve 410C 02 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 464 I Monitor At Valve 4100 02 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 466 I Monitor At Valve 410E 02 Primary Coolant Position, Safety Relief Valve, ASME Code Safety N/A Acoustica Valve 468 I Monitor At Valve 411A 01 Primary Coolant Level, Pressurizer Channel I L459 411B 01 Primary Coolant Level, Pressurizer Channel II L460 411C 01 Primary Coolant Level, Pressurizer Channel III L461 412A 02 Primary Coolant Status, Pressurizer Heater - Control Group N/A U 412B 02 Primary Coolant Status, Pressurizer Heater - Back-up Group 31 N/A U 412C 02 Primary Coolant Status, Pressurizer Heater - Back-up Group 32 N/A U "U

4120 02 Primary Coolant Status, Pressurizer Heater - Back-up Group 33 N/A U m 413A 03 Primary Coolant Level, Pressurizer Relief Tank 31 L470

()

-u o m o oo o eN o 01 80 of 108 o0) <D (J1 o

.j:::o.

CD o

.j::>.

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 414A 03 Primary Coolant Temperature, Pressurizer Relief Tank 31 T471 415A 03 Primary Coolant Pressure, Pressurizer Relief Tank 31 P472 416A 01 Secondary Cooling Level, Steam Generator 31 L4170 K 416B 01 Secondary Cooling Level, Steam Generator 32 L4270 K 416C 01 Secondary Cooling Level, Steam Generator 33 L4370 K 4160 01 Secondary Cooling Level, Steam Generator 34 L4470 K 417A 02 Secondary Cooling Pressure, Steam Generator 31, Channel I P419A 417B 02 Secondary Cooling Pressure, Steam Generator 32, Channel I P429A 417C 02 Secondary Cooling Pressure, Steam Generator 33, Channel I P439A 4170 02 Secondary Cooling Pressure, Steam Generator 34, Channel I P449A 418A 02 Secondary Cooling Flow, Main Steam From Steam Generator 31 F419A&B 418B 02 Secondary Cooling Flow, Main Steam From Steam Generator 32 F429A&B 418C 02 Secondary Cooling Flow, Main steam From Steam Generator 33 F439A&B 4180 02 Secondary Cooling Flow, Main Steam From Steam Generator 34 F449A&B 419A 03 Secondary Cooling Flow, Main Feedwater To Steam Generator 31 F418A&B 419B 03 Secondary Cooling Flow, Main Feedwater To Steam Generator 32 F428A&B 419C 03 Secondary Cooling Flow, Main Feedwater To Steam Generator 33 F438A&B 4190 03 Secondary Cooling Flow, Main Feedwater To Steam Generator 34 F448A&B 420A 02 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 31 F1200R 420B 02 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 32 F1201R 420C 02 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 33 F1202R 4200 02 Secondary Cooling Flow, Auxiliary Feedwater To Steam Generator 34 F1203R 421A 01 Secondary Cooling Level, Condensate Storage Tank Water L1128 G 421B 01 Secondary Cooling Level, Condensate Storage Tank Water L1128A G 422A 02 Containment Flow, Spray From Residual Heat Removal Heat F945B II Exchanger 31 422B 02 Containment Flow, Spray From Residual Heat Removal Heat F945A II "U Exchanger 32 m 423A 02 Containment Flow, Heat Removal By System-Service Water F1121

()

-u o m o oo o eN o 01 81 of 108 o0) <D (J1 o CD 01 o(J1

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES RCFC 31 423B 02 Containment Flow, Heat Removal By system-Service Water F1122 RCFC 32 423C 02 Containment Flow, Heat Removal By System-Service Water F1123 RCFC 33 4230 02 Containment Flow, Heat Removal By System-Service Water F1124 RECF 34 423E 02 Containment Flow, Heat Removal By System-Service Water F1125 RCFC 35 423F 02 Containment Temperature, Heat Removal By System-Service T-1415-1 Water Oiff RCFC 31 423G 02 Containment Temperature, Heat Removal By System-Service T-1415-2 Water Oiff RCFC 32 423H 02 Containment Temperature, Heat Removal By System-Service T-1415-3 Water Oiff RCFC 33 423J 02 Containment Temperature, Heat Removal By-System-Service T-1415-4 Water Oiff RCFC 34 423K 02 Containment Temperature, Heat Removal By System-Service T-1415-5 Water Oiff RCFC 35 424A 02 Containment Temperature, Atmosphere T1203 425A 02 Containment Temperature, Sump Water NONE I 426A 02 Chemical & Volume Flow, Make-up In F128 Control 427A 02 Chemical & Volume Flow, Letdown Out F134 B Control 428A 02 Chemical & Volume Level, Volume Control Tank L112 C Control 429A 02 Component Cooling Temperature, Component Cooling Heat T602A 0 "U

m Exchanger 31 Output

()

-u o m o oo o eN o 01 82 of 108 o0) <D (J1 o CD m o(J)

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 429B 02 Component Cooling Temperature, Component Cooling Heat T602B 0 Exchanger 32 Output 430A 02 Component Cooling Flow, Component Cooling Heat Exchanger 31 F601A E Output 430B 02 Component Cooling Flow, Component Cooling Heat Exchanger 32 F601B E Output 431A 03 Radwaste Level, High-Level Radioactive Waste Hold-up L1001 Tank 31 431B 03 Radwaste Level, High-Level Radioactive Waste Hold-up L168 JJ Tank 32 (3HBT01A) 431C 03 Radwaste Level, High-Level Radioactive Waste Hold-up L170 JJ Tank 33 (3HBT01 B) 432A 03 Radwaste Pressure, Large Radioactive Gas Decay Tank 31 P1036 KK 432B 03 Radwaste Pressure, Large Radioactive Gas Decay Tank 32 P1037 KK 432C 03 Radwaste Pressure, Large Radioactive Gas Decay Tank 33 P1038 KK 4320 03 Radwaste Pressure, Large Radioactive Gas Decay Tank 34 P1039 KK 432E 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 31 P1052 KK 432F 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 32 P1053 KK 432G 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 33 P1054 KK 432H 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 34 P1055 KK 432J 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 35 P1056 KK 432K 03 Radwaste Pressure, Small Radioactive Gas Decay Tank 36 P1057 KK 433A 02 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG Damper A & B 433B 02 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG Damper A & B 433C 02 Ventilation Position, Reactor Containment Fan Cooler 31 N/A GG "U

Damper 0 & Blow-in Door m 4330 02 Ventilation Position, Reactor Containment Fan Cooler 32 N/A GG

()

-u o m o oo o eN o 01 83 of 108 o0) <D (J1 o CD -...J o

-....J

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES Damper A & B 433E 02 Ventilation Position, Containment Fan Cooler 32 Damper C N/A GG 433F 02 Ventilation Position, Reactor Containment Fan Cooler 32 N/A GG Damper 0 & Blow-in Door 433G 02 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper A & B 433H 02 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper C 433J 02 Ventilation Position, Reactor Containment Fan Cooler 33 N/A GG Damper 0 & Blow-in Door 433K 02 Ventilation Position, Reactor Containment Fan Cooler 34 N/A GG Damper A & B 433L 02 Ventilation Position, Reactor Containment Fan Cooler 34 N/A GG Damper C 433M 02 Ventilation Position, Reactor Containment Fan cooler 34 N/A GG Damper 0 & Blow-in Door 433N 02 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper A & B 433P 02 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper C 433R 02 Ventilation Position, Reactor Containment Fan Cooler 35 N/A GG Damper 0 & Blow-in Door 433S 02 Ventilation Position, Fuel Storage Building Forced Air Unit 31 N/A GG Emergency Damper 433T 02 Ventilation Position, Fuel Storage Building Forced Air Unit 32 N/A GG Emergency Damper 433U 02 Ventilation Position, Fuel Storage Building Normal Airflow N/A GG Top Damper "U

m 433V 02 Ventilation Position, Fuel Storage Building Normal Airflow N/A GG

() Bottom Damper

-u o m o oo o eN o 01 84 of 108 o0) <D (J1 o CD 00 o

CD

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 433W 02 Ventilation Position, Fuel Storage Building Emergency Airflow N/A GG Filter Intake Damper 433X 02 Ventilation Position, Fuel Storage Building Emergency Airflow N/A GG Filter Exhaust Damper 433Y 02 Ventilation Position, Primary Auxiliary Building Exhaust N/A GG Charcoal Damper - Face 433Z 02 Ventilation Position, Primary Auxiliary Building Exhaust N/A GG Charcoal Damper - Bypass 434A 02 Emergency Power Current, AC Bus 31 N/A 434B 02 Emergency Power Current, AC Bus 32 N/A 434C 02 Emergency Power Current, AC Bus 33 N/A 4340 02 Emergency Power Current, AC Bus 34 N/A 434E 02 Emergency Power Voltage, AC Bus 31 N/A 434F 02 Emergency Power Voltage, AC Bus 32 N/A 434G 02 Emergency Power Voltage, AC Bus 33 N/A 434H 02 Emergency Power Voltage, AC Bus 34 N/A 4341 02 Emergency Power Current, DC Bus 31 N/A F 434J 02 Emergency Power Current, DC Bus 32 N/A F 434K 02 Emergency Power Current, DC Bus 33 N/A F 434L 02 Emergency Power Current, DC Bus 34 N/A F 434M 02 Emergency Power Voltage, DC Bus 31 N/A 434N 02 Emergency Power Voltage, DC Bus 32 N/A 4340 02 Emergency Power Voltage, DC Bus 33 N/A 434P 02 Emergency Power Voltage, DC Bus 34 N/A 434Q 02 Emergency Power Current, Diesel 31 N/A 434R 02 Emergency Power Current, Diesel 32 N/A 434S 02 Emergency Power Current, Diesel 33 N/A "U 434T 02 Emergency Power Voltage, Diesel 31 N/A m 434U 02 Emergency Power Voltage, Diesel 32 N/A

()

-u o m o oo o eN o 01 85 of 108 o0) <D (J1 o CD <D o

CD

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 434V 02 Emergency Power Voltage, Diesel 33 N/A 434W 02 Emergency Air Supply Pressure, Instrument Air Receiver Tank P1207 434X 02 Emergency Air Supply Pressure, Diesel 31 Starting Air Receiver Tank N/A 434Y 02 Emergency Air Supply Pressure, Diesel 32 Starting Air Receiver Tank N/A 434Z 02 Emergency Air Supply Pressure, Diesel 33 Starting Air Receiver Tank N/A 501A E1 Containment Radiation, Area, High Range R25 501B E1 Containment Radiation, Area, High Range R26 502A E3 Central Control Room Radiation, Area R1 MM,CC,X 502B E3 PAB 80' Radiation, Area, Charging Pump Room R4 DO 502C E3 Fuel Storage Building Radiation, Area R5 5020 E3 PAB 55' Radiation, Area, Sampling Room (North Wall) R6 X 502E E2 Containment Radiation, Area, (AT Seal Table) In-core R7 X, DO Instrument Room 502F E2 PAB 55' Radiation, Area, Drumming Station R8 X, DO 502G E2 Aux Boiler Feed Pump Radiation, Area, (West Wall Opposite Main Steam NONE X Bldg Penetrations 31 & 32) 502H E2 PAB 55' Radiation, Area, On Column Across From Sample R64 Room 502J E2 PAB 73' Radiation, Area, Entrance Way To Volume N/A X Control Tank 502K E2 PAB 73' Radiation, Area, Hall Next To NPO Office R65 502L E2 PAB 41' Radiation, Area, South Wall Area Of Refueling N/A X Water Purification Pumps 502M E2 PAB 41' Radiation, Area, Hall On Column Next To N/A X Containment Spray Pumps "U 502N E2 PAB 34' Radiation, Area, Hall Near Entry To Safety R66 m Injection Pumps

()

-u o m o oo o eN o 01 86 of 108 o0) <D (J1

......

CD o

--"

o

IP3 FSAR UPDATE TABLE 7.S-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES S02P E2 PAB 41' Radiation, Area, Pipe Tunnel In Area Of R67 Chemistry Post Accident Sampling Station S02Q E2 PAB 1S' Radiation, Area, On North Wall Adjacent To RHR R68 Valve Gallery S02R E2 RAB 1S' Radiation, Area, Hall On Wall At Entry To Filter N/A X Cell S02S E2 PAB S4' Radiation, Area, Within The Doorway On The R69 Wall, Pipe Penetration S02T E2 PAB 67' Radiation, Area, Above Pipe Penn In Area Of N/A X Hydrogen Recombiner Panels S02U E2 Fan Building 92' Radiation, Area, In Area Of 4 Channel Iodine R70 Monitors S02V E2 Fan Building 72' Radiation, Area, Outside Plenum In Area Of R70 Differential Pressure Instruments S03A E2 Containment Radiation, Effluent, Noble Gas R27 Via Plant Vent S04A E2 Reactor Shield Building Radiation, Effluent, Noble Gas N/A Annulus SOSA E2 Auxiliary Building Radiation, Effluent, Noble Gas, Or Others R27 Via Plant Containing Primary System Gases Vent S06A E2 Cond Air Removal Sys Radiation, Effluent, Noble Gas R1S NN Exhaust S06B E2 Cond Air Removal Sys Radiation, Effluent, Noble Gas - Flow Rate R1S Exhaust S07 A E2 Common Plant Vent Radiation, Effluent, Noble Gas R27 SS S07B E2 Common Plant Vent Radiation, Effluent, Flow Rate R27 SS S08A E2 Steam Generator Radiation, Effluent, Noble Gas From Safety Relief R62 FF Valves Or Atm Dump Valves "U

m S09A E2 Admin Bldg Exhaust Vent Radiation, Effluent, Noble Gas From 4th Floor R46 OO,CC

()

-u 0 m 0 0 0 0 eN 0 01 87 of 108 0 <D

0) ......

(J1 CD

......

--"

--"

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 509B E2 Admin Bldg Exhaust Vent Radiation, Effluent, Flow Rate, 4th Floor NONE 00 509C E2 Radioactive Machine Radiation, Effluent, Noble Gas R59 Shop Exhaust Vent 5090 E2 Radioactive Machine Radiation, Effluent, Flow Rate FT-1776 Shop Exhaust Vent 509E E2 Steam Generator Radiation, Effluent R19 Blowdown 509F E2 Steam Generator Radiation, Effluent, Flow Rate F538 Blowdown 510A E3 Common Plant Vent Radiation, Effluent, Particulates N/A EE, SS 510B E3 Common Plant Vent Radiation" Effluent, Halogens N/A EE, SS 510C E3 Common Plant Vent Radiation, Effluent, Flow Rate R27 5100 E3 Admin Bldg Exhaust Vent Radiation, Effluent, Particulates From The 4th N/A 00,00 Floor 510E E3 Admin Bldg Exhaust Vent Radiation, Effluent, Halogens From The 4 tn Floor N/A 00,00 510F E3 Admin Bldg Exhaust Vent Radiation, Effluent, Flow Rate, 4th Floor NONE 00,00 510G E3 Radioactive Machine Radiation, Effluent, Particulates N/A CC Shop Exhaust Vent 510H E3 Radioactive machine Radiation, Effluent, Halogens NONE CC shop exhaust vent 510J E3 Radioactive machine Radiation, Effluent, Flow Rate FT-1776 shop exhaust vent 511A E3 Environs Radiation, Exposure Rate N/A RR 512A E3 Environs Radiation, airborne radiohalogens and N/A portable particulates instrum.

513A E3 Environs Radiation, photons N/A portable instrum.

"U 513B E3 Environs Radiation, beta and low energy photons N/A portable m instrum.

()

-u o m o oo o eN o 01 88 of 108 o0) <D (J1

......

CD tv

--"

N

IP3 FSAR UPDATE TABLE 7.5-1 Regulatory Guide 1.97 Instruments Required REG GUIDE 1.97 STATUS OF COMPLIANCE INDEX I TYPE CAT VARIABLE ONE VARIABLE TWO INST LOOP NOTES 514A E3 Environs Radioactivity, multi channel gamma-ray N/A spectrometer 515A E3 Meteorological Met, wind direction N/A 516A E3 Meteorological Met, wind speed N/A 517A E3 Meteorological Met, atmospheric stability N/A 518A E3 Sampling Primary coolant and containment sump water N/A W,R analysis - gross activity 518B E3 Sampling Primary coolant and containment sump water N/A W,R analysis - gamma spectrum 518C E3 Sampling Primary coolant and containment sump water N/A W,R analysis - boron content "U

m

()

-u 0 m 0 0 0 0 eN 0 01 89 of 108 0 <D 0)

(J1

......

CD eN

--"

0)

IP3 FSAR UPDATE Table 7.5-1 Regulatory Guide 1.97 Instruments Required NOTES General Notes that apply to all items have an

  • as an identifier.

NOTE A: DELETED NOTE B: The letdown flow is controlled by opening a remote operated valve, which allows flow through fixed orifice plates. The maximum CVCS letdown flow allowed administratively is limited to 120 gpm. It is the Authority's position that the indicated range (0-125 gpm) is adequate.

NOTE C: The existing level (18% to 82%) transmitter range is adequate. The modification necessary to obtain the additional level (0%-100%) required by 1.97 is not warranted based on manrem exposure and cost versus benefit.

NOTE D: The existing range indication for component cooling heat exchanger temperature is adequate for all modes of normal operation of off-normal modes of operation. The temperature of the component cooling system to date has not decreased below the existing range of 50 8 F. In addition, in the event of a major accident the temperature would be expected to increase as opposed to decrease, further assuring that the temperature would not decrease below the low range of the temperature system.

NOTE E: The existing range indication for component cooling heat exchanger flow is adequate for all modes of normal operation or off-normal modes of operation. The component cooling flow indication during normal operation may decrease below the existing range however; this condition does not cause any concern warranting a modification.

The pump can be assured that it is functioning via low pressure and pump breaker status alarms. The components that are being cooled have local flow devices that are used to regulate the flow; therefore, minimum pump flow conditions can be met. In addition, in the event of a major accident, the flow would increase as opposed to decrease.

NOTE F: It is the Authority's position that sufficient indication to D.C. bus status is provided to the operators such that during post accident conditions, the operators will be aware of the operability of the D.C. buses.

NOTEG: Condensate storage tank level is currently monitored by two-(2) independent qualified transmitters. Diverse indication of CST level can be derived by auxiliary feedwater suction pressure indication. It is the Authority's position that the existing monitoring of CST level complies with the requirements of Regulatory Guide 1.97.

"U NOTE H: Boric acid flow to the RCS is monitored by the high-pressure injection (HPI) flow transmitters. Refer to index number m 406 A-H which meets Reg. Guide 1.97 requirements.

()

-u 0 m 0 0 0 0 eN 0 01 90 of 108 0 <D 0)

(J1

......

.j:::o.

CD

--"

.j::>.

IP3 FSAR UPDATE NOTE I: Based on conversations with the NRC staff, the intent of this variable may be satisfied by the indication of several other variables. IP-3 has indication of RHR outlet temperature, containment spray flow and containment temperature which provides adequate indication of containment heat removal capability.

NOTE J: Adequate diverse measurement to PT-402 and PT-403 is obtained from pressure transmitters used to monitor pressurizer pressure (PT-455, 456, 457 and 474) for the range of 1700-2500 psig. Additionally, R.C.S. pressure, 0-3000 psig is indicated on a pressure gauge located in an area accessible to plant operators.

NOTE K: Each Steam Generator contains four (4) transmitters to indicate steam generator water level Three (3) transmitters per steam generator indicate narrow range level which is a span that begins at the top of the tube bundles to the moisture separator. The remaining level transmitter covers the span from the bottom tube sheet up to the moisture separator.

Based on above, diversity exists from the top portion of the steam generator. Two (2) auxiliary feedwater flow indicators provide a diverse indication for the steam generator. In addition, since two of our four steam generators are required for heat removal, redundant wide range level for each generator is deemed not necessary.

NOTEL: Two (2) redundant level transmitters (LT-1253 & 1254) provide containment water level indication to the Central Control Room (CCR) operators. In addition, the containment sump and recirculation sump each contain (2) qualified level transmitters. The refueling water storage tank provides a diverse measurement for the containment water level.

NOTE M: Diversity is met via a third system which records saturation pressure margin and also use of steam tables.

NOTE N: Containment water level provides a diverse method to determine refueling water storage tank level.

NOTE 0: Additional Containment pressure instrumentation exists (PT 948A, B & C and PT 949A, B & C) to provide a diverse means of establishing containment pressure.

NOTE P: Redundancy for the Hot Leg Reactor Coolant Temperature will be by the use of the core exit thermocouples (Diverse Variable). Redundancy for the Cold Leg Reactor Coolant Temperature is provided by the steamline pressure instrument PT 419 A, B & C; PT 429 A, B, & C; PT 439 A, B, & C and PT 449 A, B, & C (Diverse Variable).

NOTE Q: DELETED NOTE R: DELETED NOTE S*: On March 4, 1983, the NRC conducted a workshop in Chicago, Illinois in order to clarify the technical requirement of NUREG-0737, Supplement I. The handout distributed by the NRC at this workshop states that with respect to seismic "U qualification requirement for operating reactors, it will suffice to state that instrumentation systems comply with the m seismic qualification program which was the basis for plant licensing. Accordingly, the seismic requirement is indicated

()

-u o m o oo o eN o 01 91 of 108 o0) <D (J1

......

CD 01

--"

(J1

IP3 FSAR UPDATE in Enclosure B as being satisfied if that instrumentation complies with the licensing basis for seismic qualification.

[GENERAL NOTE]

NOTE T*: As noted in Regulatory Guide 1.97, Revision 3, Category 1 and 2 instrumentation should be qualified in accordance with Regulatory Guide 1.89, "Qualification of Class 1E Equipment for Nuclear Power Plants," and the methodology described in NUREG-0588, "Interim Staff Position on Environmental Qualification of Safety-Related Electrical Equipment."

Enclosure B reflects this requirement for all Category 1 and 2 instrumentation. However, certain Category 1 and 2 instrumentation are located in mild post-accident environments and therefore are not within the scope of Regulatory Guide 1.89. For the sake of convenience, the Category 1 and 2 instrumentation located in a mild post-accident environment are noted as meeting Environmental Qualification (E.Q.) requirement. Hence, that instrumentation noted in Enclosure B as satisfying the E.Q. requirement either satisfy the requirements of 10 CFR 50.49 or are located in a mild post-accident environment.

NOTE U: Since the purpose of Pressurizer Heater Status is to ensure that they do not overload a diesel, adequate diesel generator loading information is available to the operators. The heaters are supplied by a safety related electrical bus and are stripped from that bus in the event of a Safety Injection Signal. They must be manually placed in service by the control room operator and procedures are in place that provide the guidance to ensure the diesels are not overloaded.

In addition, heater electrical breaker status lights are available. The pressurizer pressure and temperature response also provides verification that the heaters are operational.

NOTE V: DELETED NOTE W: The Authority concurred with the NRC approach to post-accident sampling capability review. The deviations are beyond the scope of the Regulatory Guide 1.97 submittal and are best addressed via our submittal to NuReg-0737, Item II.B.3 NOTE X: Portable survey meters are the primary source of data on the radiation exposure rates inside buildings. These portable instruments are used to 1) verify the indication of the existing installed radiation monitors, and 2) determine exposure rates where there are no installed radiation monitors. It is Entergy's opinion that the portable survey meters meet the intent of the Guide.

NOTEY: The automatic containment isolation valves at the facility meet all of the requirements of the Regulatory Guide on position indication. Non-automatic containment isolation valves are not provided with position indication. Valves that "U are considered essential and non-automatic are maintained in the open position and are closed after the initial phases m of an accident. Approved emergency procedures are utilized to control the closing of these valves. Non-essential

()

-u o m o oo o eN o 01 92 of 108 o0) <D (J1

......

CD m

--"

(J)

IP3 FSAR UPDATE containment isolation valves are maintained in the closed position and may be opened, if necessary, for plant operation and for only as long as necessary to perform the intended function, as required by Indian Point 3 Technical Specifications. These valves are additionally administratively controlled in the following manner:

1. Shift Manager approval for opening a non-automatic containment isolation valve is required.
2. An operator must be dedicated to the operation of these valves as long as they are in the open position.
3. Operator must have communications established with the Central Control Room, and
4. Operators first response to any emergency condition while the valve is open is to insure that the valve is returned to the closed position.

NOTE Z: Since the accumulators will discharge immediately when RCS pressure drops below accumulation pressure, these variables are unnecessary following an accident. Since power to the isolation valves is locked out at the circuit breaker, the operator would not be able to utilize these variables for manual actions, except for events in which the RCS pressure is decreasing very slowly. For such events, the present indicators are expected to function properly. Letter from NRC (N.

F. Conicella) to R. Beedle, dated 9/28/92, entitled "REGULATORY GUIDE 1.97 - INSTRUMENTATION TO FOLLOW THE COURSE OF AN ACCIDENT FOR INDIAN POINT GENERATING UNIT NO.3 (TAC No. MS1099)", relaxed the requirement for Accumulator Pressure and Level Instrumentation and deleted the commitment for upgrading Accumulator Pressure and Level Instrumentation.

NOTE AA: The original radiation monitor used to monitor containment effluent radioactivity (R-12) is located in a non-harsh environmental area. Therefore, the environmental qualification requirements of the regulatory guide are satisfied. The combination of R-12 and an additional environmentally qualified effluent radiation monitor (R-27) sufficiently meets the range requirements of the Regulatory Guide.

NOTE BB: Radiation exposure rates inside buildings or areas in direct contact with primary containment where penetrations and hatches are located can be sufficiently monitored by portable radiation monitoring detectors.

NOTE CC: The existing sampler or radiation monitors for these areas do not meet the range requirements of the Regulatory Guide, however, it is Entergy's position that the indicated range is sufficient for the highest levels that are postulated for these areas.

"U NOTE DD: The existing area radiation monitors for these areas do not meet the range requirements of the Regulatory Guide, m however, it is Entergy's position that these areas need not be monitored for the mitigation of an accident.

()

-u 0 m 0 0 0 0 eN 0 01 93 of 108 0 <D 0)

(J1

......

CD -...J

--"

-....J

IP3 FSAR UPDATE NOTE EE: To accommodate the range requirements of these radiation detectors, Entergy will use the Post Accident Sampling System.

NOTE FF: The plant computer will record the steam release duration and mass flow rate.

NOTE GG: Damper indication status is provided via red-green indicating lamps in the control room. The lamps are illuminated by a single limit switch, which is toggled when the damper is in the opened or closed position.

The Containment Fan Cooler units are provided with flow switches, which will cause an annunciation in the control room if low flow exists. In addition, a Weir system exists to quantify the cooling and condensing features of the ventilation unit.

Since failure of dampers are rare and it is improbable that the limit switch or some diverse variable would not detect the failure, it is Entergy's position that no modifications are warranted.

NOTE HH: The white lights used to satisfy Index 404A, B, C, and D are on when the valves are fully open and off when not fully open. These lights are always operable.

The valves are opened and the power and control circuits are de-energized when the RCS pressure is above 1000 psi.

When these circuits are energized, each valve has red and green indicator lights which tell the operator whether the valve is full open, full closed or at some intermediate position.

NOTE II: The containment spray system consists of 4 spray headers. Two headers are used during the initial phase of the accident and the other two headers are used later in the accident. Manual operator action based on spray system flow rates is required in the later phase of the accident. As such, the spray flow indications described in Enclosure Bare provided by the two headers used later in the accident only.

NOTE JJ: The existing level represents approximately 94% of the tank range. Since the tanks are horizontal cylindrical, the level actually monitors greater than 94% of its volume. These tanks are back up to 31 Waste HOld-Up tanks.

NOTE KK: The range that is required by the Guide, 0 to 165 psig, exceeds the tank design pressure and the tank safety valve setting, i.e., 150 psig. As additional status of tank pressure, an alarm is actuated when tank pressure reaches 110 psig.

It is therefore concluded that the actual range of tank pressure is acceptable and meets the intent of the Regulatory "U Guide.

m

()

-u o m o oo o eN o 01 94 of 108 o0) <D (J1

......

CD 00

--"

CD

IP3 FSAR UPDATE NOTE LL: DELETED - Monitor R-10 has been removed from the plant.

NOTE M M: The control room monitor's range is considered adequate. The operators would evacuate the control room prior to fields reaching the upper range prescribed in Reg. Guide 1.97.

NOTE NN: This possible atmospheric release point is designed to divert into the containment at relatively low levels. In addition, prior to reaching 1.97 levels, you would have to have fuel damage, steam generator tube failures and failure of the diversion to containment feature, which are highly improbable. Main steam radiation monitors are capable of detecting activity that would escape from condenser air ejectors. It is Entergy's position that the existing monitor is adequate to monitor the release point.

NOTE 00: The monitor is located and provides radiation level in an area that is not considered part of the plant proper. No radioactivity materials are expected to be brought into this area that would warrant any increase in the range of the existing monitors or the addition of flow monitoring devices.

NOTE PP*: As per Regulatory Guide 1.97 Rev. 3, seismic qualification is not required for Category II variables. [GENERAL NOTE]

NOTE QQ: DELETED NOTE RR: No longer required as per Rev. 3 of Regulatory Guide 1.97.

NOTE 55: If the plant vent sampling capability, the wide-range vent monitor, or the main steam line radiation monitor is inoperable in MODES 1, 2, or 3, initiate a preplanned alternate sampling / monitoring capability as soon as practical, but no later than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after identification of the failure.

NOTE TT: The present list of qualified Core Exit Thermocouples is:

K-11, L-12, K-13, C-12, F-12, E-10, 0-9, A-11, B-3, B-6, E-5, F-5, G-4, R-10, P-13, H-5, K-3, J-7, N-2, & L-1 "U

m

()

-u 0 m 0 0 0 0 eN 0 01 95 of 108 0 <D 0)

(J1

......

CD <D

--"

CD

IP3 FSAR UPDATE 7.6 IN-CORE INSTRUMENTATION 7.6.1 Design Basis The in-core instrumentation is designed to yield information on the neutron flux distribution and fuel assembly outlet temperatures at selected core locations. Using the information obtained from the in-core instrumentation system, it is possible to confirm the reactor core design parameters and calculated hot channel factors. The system provides means for acquiring data and performs no operational plant control.

7.6.2 System Design The in-core instrumentation system consists of thermocouples, positioned to measure fuel assembly coolant outlet temperature at preselected locations; and flux thimbles, which run the length of selected fuel assemblies to measure the neutron flux distribution within the reactor core.

The data obtained from the in-core temperature and flux distribution instrumentation system, in conjunction with previously determined analytical information, can be used to determine the fission power distribution in the core at any time throughout core life. This method is more accurate than using calculational techniques alone. Once the fission power distribution has been established, the thermal power distribution and the thermal and hydraulic limitations determine the core capability and maximum power output.

The in-core instrumentation provides information which may be used to calculate the coolant enthalpy distribution, the fuel burnup distribution, and an estimate of the coolant flow distribution.

Both radial and azimuthal symmetry of power may be evaluated by comparing the detector information from quadrant to quadrant.

Thermocouples Chromel-alumel thermocouples are passed through into guide tubes that penetrate the reactor vessel head through seal assemblies, and terminate at the exit flow end of the fuel assemblies.

The thermocouples are provided with two primary seals, a conoseal and swage type seal from conduit to head. The thermocouples are enclosed in stainless steel sheaths within the above tubes to allow replacement if necessary. Thermocouple readings are obtainable via the plant computer and at a manually selected display unit in the control room. The support of the thermocouple guide tubes in the upper core support assembly is described in Chapter 3.

Moveable Miniature Neutron Flux Detectors Mechanical Configuration Six fission chamber detectors (employing U3 0 S , which is 93 percent enriched in U23S ) can be remotely positioned in retractable guide thimbles to provide flux mapping of the core. Maximum chamber dimensions are 0.188-inch in diameter and 2.10 inches in length. The stainless steel detector shell is welded to the leading end of the helical wrap drive cable and the stainless steel sheathed coaxial cable. Each detector is designed to have a minimum thermal neutron sensitivity of 1.5 x 10-17 amps/nv and a maximum gamma sensitivity of 3 x 10-14 amps/R/hr.

96 of 108 IPEC00035920 IPEC00035920

IP3 FSAR UPDATE Maximum thermal neutron flux for these detectors is 5 x 10 13 nv. Other miniature detectors, such as gamma ionization chambers and boron-lined neutron detectors, can also be used in the system. The basic system for the insertion of these detectors is shown in Figures 7.6-2 to 7.6-4. Retractable thimbles into which the miniature detectors are driven are pushed into the reactor core through conduits which extend from the bottom of the reactor vessel down through the concrete shield area and then up to a thimble seal zone.

The thimbles will be closed at the leading ends, are dry inside, and serve as the pressure barrier between the reactor water pressure and the atmosphere. Mechanical seals provided on the retractable thimbles and on the conduits are shown on Figure 7.6-4.

During reactor operation, the retractable thimbles are stationary. They are extracted downward from the core during refueling to avoid interference within the core. A space above the seal line is provided for the retraction operation.

The drive system for the insertion of the miniature detectors consists basically of six drive assemblies, six 5-path rotary group selector assemblies and six 10-path rotary selector assemblies, as shown in Figures 7.6-2 and 7.6-3. The drive system pushes hollow helical-wrap drive cables into the core with the miniature detectors attached to the leading ends of the cables and small diameter sheathed coaxial cables threaded through the hollow centers back to the ends of the drive cables. Each drive assembly generally consists of a gear motor which pushes a helical-wrap drive cable and detector through a selective thimble path by means of a special drive box and includes a storage device that accommodates the total drive cable length.

Further information on mechanical design and support is described in Chapter 3.

Control and Readout Description The control and readout system provides means for inserting the miniature neutron detectors into the reactor core and withdrawing the detectors at a selected speed while plotting a level of induced radioactivity versus detector position. The control system consists of two sections, one physically mounted with the drive units, and the other contained in the control room. Limit switches in each path provide feedback of path selection operation. Each gear box drives an encoder for position feedback. One 5-path group selector is provided for each drive unit to route the detector into one of the flux thimble groups. A 10-path rotary transfer assembly is a transfer device that is used to route a detector into anyone of up to ten selectable paths.

Manually operated isolation valves allow free passage of the detector and drive wire when open, and prevents steam leakage from the core in case of a thimble rupture, when closed. A common path is provided to permit cross calibration of the detectors.

The control room contains the necessary equipment for control, position indication, and flux recording. Panels are provided to indicate the core position of the detectors, and for plotting the flux level versus the detector position. Additional panels are provided for such features as drive motor controls, core path selector switches, plotting and gain controls. A "flux-mapping" consists, briefly, of selecting (by panel switches) flux thimbles in given fuel assemblies at various core quadrant locations. The detectors are driven or inserted to the top of the core and stopped automatically. A x-y plot (position vs. flux level) is initiated with the slow withdrawal of the detectors through the core from top to a point below the bottom. In a similar manner other core locations are selected and plotted.

The system that will be used to monitor the distribution of power in the X-Y plane is described in WCAP-7669, "Topical Report - Nuclear Instrumentation System."

97 of 108 IPEC00035921 IPEC00035921

IP3 FSAR UPDATE Operational limits due to a quadrant power tilt are given in the Technical Specifications.

The calibration of the Nuclear Instrumentation System by the movable incore detector system is made in accordance with the Technical Specifications. As noted in the Technical Specifications, the movable incore detector system shall be used to confirm power distribution.

After the excore system is calibrated initially, recalibration is performed periodically to compensate for changes in the core, due for example to fuel depletion, and for changes in the detectors.

If the recalibration is not performed, the mandated power reduction assures safe operation of the reactor as it will compensate for an error of 10% in the excore protection system.

Experience at Beznau No. 1 and R. E. Ginna plants has shown that drift due to changes in the core or instrument channels is very slight. Thus the 10% reduction is considered to be very conservative.

The reactor trip functions (Section 7.2) provide core protection at the safety limits prescribed in the Technical Specifications. Those trip functions derived from the Nuclear Instrumentation System are described in WCAP-7669.

Each detector provides axial flux distribution data along the center of a fuel assembly. Various radial positions of detectors are then compared to obtain a flux map for a region of the core 7.6.3 System Evaluation The thimbles are distributed throughout the core as shown in Figure 7.6-1. The positions have been chosen to provide symmetry checks and sufficient coverage, taking symmetry into account, to construct a full core three-dimensional power shape. With this number and location of thimbles the measurement accuracy for the peak to average rod in an x-y plane is 3.65% and for the peak to average pellet, including axial peaking, is 4.58%. These accuracies include the flux thimble to hot rod calculational uncertainty and instrumentation repeatability. They represent a 95% confidence level in a probability of fewer than 5% of cases lying above this error allowance. This confidence level and accuracy is consistent with the interpretation of DNB criteria.

The derivation and justification of these uncertainties is given in WCAP-7308-L, "Evaluation of Nuclear Hot Channel Factor Uncertainties."

7.6.4 System Operation A. A minimum of 2 thimbles per quardrant and sufficient movable incore detectors shall be operable during recalibration of the excore axial offset detection system.

B. During the incore / excore calibration procedure, full core flux maps will be made only when at least 38 of the movable detector guide thimbles are operable.

98 of 108 IPEC00035922 IPEC00035922

IP3 FSAR UPDATE 7.7 OPERATING CONTROL STATIONS 7.7.1 Station Layout The principal criteria of control station design and layout is that all controls, instrumentation displays and alarms required for the safe operation and shutdown of the plant are readily available to the operators in the Control Room.

During other than normal operating conditions, other operators will be available to assist the operators in the Control Room. Plant Drawings 9321-F-30523 and -33833 [Formerly Figure 7.7-1 and 7.7-2] show the Control Room layout and sections for the unit. The control board is divided into relative areas to show the location of control components and information display pertaining to various subsystems.

7.7.2 Information Display and Recording Alarms and annunciators in the Control Room provide the warning to the operators of abnormal plant conditions which might lead to damage of components, fuel or other unsafe conditions.

Other displays and recorders are provided for indication of routing plant operating conditions and for the maintenance of records.

Consideration is given to the fact that certain systems normally require more attention from the operator. The control system is therefore centrally located on the three section board.

On the left section of the control board, individual indicators present a direct, continuous readout of every control rod position. Fault detectors in the rod drive control system are used to alert the operator should an abnormal condition exist for any individual or group of control rods.

Displayed in this same area are limit lights for each control rod group and all nuclear instrumentation information required to start up and operate the reactor. Control rods are manipulated from the left section.

Subsequent to periods of rod motion, when thermal equilibrium is being established in the rod position indicator coil stacks, temporary drifting of the indicators can be expected. During such time if indicated RCCA position differs from bank demand more than allowed by the Technical Specifications, the rod is treated as potentially misaligned under Technical Specification 3.1.4.

Rod position is confirmed via a digital voltage meter applied to the rod position control racks. In addition, the operators will continue to monitor the affected rod position indicators on the main control board (and on the plant computer, if available and in agreement with the digital voltage meter reading) to check for increased deviation.

Variables associated with operation of the secondary side of the station are displayed and controlled from the control board. These variables include steam pressure and temperature, feedwater flow, electrical load, and other signals involved in the plant control system. The control board also contains provisions for indication and control of the reactor coolant system.

Redundant indication is incorporated in the system design since pressure and temperature variables of the Reactor Coolant System are used to initiate safety features. Control and display equipment for station auxiliary systems is also located here.

The Engineered Safety Features Systems are controlled and monitored from a vertical panel to the left of the control board. Valve position indicating lights are provided as a means of verifying the proper operation of the control and isolation valves following initiation of the engineered safety features. Control switches located on this panel allow manual operation or test of individual units.

99 of 108 IPEC00035923 IPEC00035923

IP3 FSAR UPDATE Also located on this section are the control switches, indicating lights, and meters for fans and pumps required for emergency conditions. Also mounted on this section are auxiliary electrical system controls required for manual switching between the various power sources described in Section 8.2.2.

Controls and indications for all ventilation systems, the containment isolation valves, and the Isolation Valves Seal Water System are located on a vertical panel. Radiation monitoring information is indicated immediately behind and to the left of the main control board.

Audible Reactor Building alarms are initiated from the radiation monitoring system and from the source range nuclear instrumentation. Audible alarms will be sounded in appropriate areas throughout the station if high radiation conditions are present.

7.7.3 Emergency Shutdown Control The Control Room, its equipment and furnishings were designed so that the likelihood of fire or other conditions which could render the Control Room inaccessible even for a short time is extremely small. For details on the fire protection features, refer to Section 9.6.2.

A criterion of the station design and layout was that all controls, instrumentation displays and alarms required for the safe operation and shutdown of the plant are readily available to the operators in the Control Room.

It was design policy that the functional capacity of the Control Room should be maintained at all times inclusive of accident conditions, such as a Maximum Credible Accident or a fire; the following features were incorporated in the design to ensure that this criterion was met.

Structural and finish materials for the Control Room and the cable spreading room below were selected on the basis of fire resistant characteristics. Structural floors are concrete reinforced.

Interior partitions are metal paneling jOints. The Control Room ceiling covering is fire retardant egg crate diffusers. Door frames and doors are metallic. Wooden trim is not used.

The Control Room is equipped with portable fire extinguishers sized and located in accordance with National Fire Code and National Fire Protection Association specifications. Extinguishers carry the Underwriter's Laboratory label of approval and are electrical shock resistant.

Fire protection features of the cable spreading room and safe shutdown capability in the event of a fire in the cable spreading room are discussed in Section 9.6.2.

The Control Room ventilation consists of a system having a large percentage of recirculated air.

The fresh air intake can be closed to control the intake of airborne activity if monitors indicate that such action is appropriate. Redundant control room toxic gas monitors are provided to alert the operators in the event that toxic gases exceed the short-term exposure limit (STEL).

Control cables used throughout the installation have been selected on the basis of flame testing described in Chapter 8 and have superior flame retardant capability. In addition, electrical circuits in the Control Room are limited to those associated with lighting, instrumentation and control. Lighting circuits operate on 120 volts, instrumentation and control circuits operate at either 120 volt AC, 125 volt DC or at millivolt level. All 120 and 125 volt circuits are protected 100 of 108 IPEC00035924 IPEC00035924

IP3 FSAR UPDATE against both overload and short circuits by either fuses or circuit breakers. The power levels on the millivolt circuits are so low that it is inconceivable that short circuits in these could become a fire hazard.

No process fluids, combustible or otherwise, are carried into the Control Room.

Cables that penetrate the Control Room floor pass through sealing devices to minimize fume and flame transmission from possible fire sources external to the Control Room.

All internal wiring in switchboards and instrument racks has excellent resistance to propagation of flame. As a result of the design criterion discussed above the amount of combustible material in the Control Room is of such small quantity that a fire of the magnitude that would require evacuation of the Control Room is not credible.

As a further measure to assure safety, provisions have been made so that plant operators can shut down and maintain the plant in a safe condition by means of controls located outside the Control Room. During such a period of Control Room inaccessibility the reactor will be tripped and the plant maintained in a hot shutdown condition. If the period extends for a long time, the Reactor Coolant System can be borated to maintain shutdown as xenon decays.

Local controls are located so that the stations to be manned and the times when attention is needed are within the capability of the plant operating staff. The plant intercom system and other communication equipment provide for a flow of information among the personnel so that operation of the facility can be coordinated.

The functions for which local control provisions have been made are listed below along with the type of control and its location in the plant. Transfer to these local controls is annunciated in the Control Room.

Reactor Trip If the Control Room should be evacuated suddenly without any action by the operators, the reactor can be tripped by any of the following actions:

1) Open rod control breakers in the control building
2) Actuate the manual turbine trip at the control standard in the turbine building, only if above P-8 setpoint 35%
3) Manually trip the rod drive Motor-Generator set in the Control Building Following evacuation of the Control Room, the following systems and equipment are provided to maintain the plant in a safe shutdown condition from outside the Control Room:

a) Residual heat removal b) Reactivity control, i.e., boron injection to compensate for fission product decay c) Pressurizer pressure and level control 101 of 108 IPEC00035925 IPEC00035925

IP3 FSAR UPDATE d) Electrical System as required to supply the above systems e) Other equipment, as described a) Residual Heat Removal Following a normal plant shutdown, an automatic steam dump control system bypasses steam to the condenser and maintains the reactor coolant temperature at its no load value. This implies the continued operation of the steam dump system, condensate circuit, condenser cooling water, feedwater pumps and steam generator instrumentation.

Failure to maintain water supply to the steam generators would result in steam generator dry out after some 34 minutes and loss of the secondary system for decay heat removal.

Redundancy and full protection where necessary is built into the system to ensure the continued operation of the steam generators. If the automatic steam dump control system is not available, independently controlled relief valves downstream of each steam generator maintain the steam pressure. These relief valves are further backed up by code safety valves downstream of each steam generator. Numerous calculations, verified by start-up tests, have shown that with the steam generator safety valves operating alone the Reactor Coolant System maintains itself close to the nominal no load condition. The steam relief capability is adequately protected by redundancy and local protection.

For decay heat removal it is only necessary to maintain control on one steam generator.

For the continued use of the steam generators for decay heat removal, it is necessary to provide a source of water, a means of delivering that water and, finally, instrumentation for pressure and level indication.

The normal source of water supply is the secondary feedwater circuit. This implies satisfactory operation of the condenser, air ejector, condenser cooling circuit, etc. In addition to the normal feedwater circuit the plant may fall back on:

1) The condensate storage tanks
2) The city water storage tank
3) The city water supply Feedwater may be supplied to the steam generators by the two electrical auxiliary feedwater pumps or by the steam driven auxiliary feedwater pump. These pumps and associated valves have local controls.

b) Reactivity Control Following a normal plant shutdown to hot shutdown condition soluble poison is added to the primary system to maintain sub-critically. For boron addition the Chemical and Volume Control System is used. Routine boration requires the use of:

Changing pumps and volume control tank with associated piping. Boric Acid transfer pumps with tanks and associated piping. Letdown station, non-regenerative heat exchanger and associated equipment, Component Cooling and Service Water Systems.

Compressed air for valve operation - manual could be adopted if necessary.

102 of 108 IPEC00035926 IPEC00035926

IP3 FSAR UPDATE It is worthy of note that with the reactor held at hot shutdown conditions, boration of the plant is not required immediately after shutdown. The xenon transient does not decay to the equilibrium level until at least 9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br /> after shutdown and a further period would elapse before the reactivity shutdown margin provided by the full-length control rods had been canceled. This delay would provide useful time for emergency measures.

c) Pressurizer Pressure and Level Control Following a reactor trip, the primary temperature will automatically reduce to the no-load temperature condition as dictated by the steam generator temperature, reducing the primary water volume and, if continued pressure control is to be maintained, primary water makeup is required.

The pressurizer level is controlled in normal circumstances by the Chemical and Volume Control System. This requirement implies the charging pump duty referred to for boration plus a guaranteed borated water supply. The facility for boration is provided as described above; it is only necessary to supply water for makeup. Water may readily be obtained from normal sources, i.e., the volume control tank.

Startup of Other Equipment Although not directly related to plant operation, certain ultimate heat sink safety analyses assume the air temperature inside containment is kept below 130°F. For this reason, the containment air recirculation fan coolers should continuously be in operation. If they have stopped, at least one should be restarted within five minutes, with the others started later as required. Similarly, the nuclear service water pumps will be checked and at least one of them restarted if none are already operating. The fan coolers and the service water pump remote controls are located in the switchgear room.

Electrical Systems Offsite or onsite emergency power must be available to supply the above systems and equipment for the hot shutdown condition.

Indication and Controls Provided Outside the Control Room The specific indication and controls provided outside the Control Room for the above capability are summarized as follows:

Indication

1) Level Indication for the Individual Steam Generators One set visible from the auxiliary feedwater pumps One set visible from the main feedwater control valves
2) Pressure Indication for the Individual Steam Generators One set visible from power operated atmospheric dump valve control stations.

One set visible from the auxiliary feedwater pumps

3) Pressurizer Level and Pressure Indicators One set visible from the auxiliary feedwater pumps 103 of 108 IPEC00035927 IPEC00035927

IP3 FSAR UPDATE One set visible from the charging pump local control point

4) RCS Temperature Indication Loop #31 Thot and Tcold visible from the auxiliary feedwater pumps
5) RCS Flux Indication Source range visible from the charging pump local control point
6) RCS Pressure One set visible from the auxiliary feedwater pumps One set visible from the charging pump local control point All instruments at the auxiliary feedwater pumps are grouped on a local gauge board.

Alternate Power Supplies Alternate Power Supplies have been provided for the following:

1) Component Cooling Water Pump 21
2) Charging Pump 31 or Charging Pump 32
3) Containment Safe shutdown instrument isolation cabinet The alternate power supplies for items 1, 2, and 3 consist of manual transfer switches located near its respective load that can transfer the load from its normal power supply to the alternate power source - motor control center 312A located in the turbine building. Operation of the manual transfer switches to alternate power will give an annunciator alarm in the control room.

Backup Service Water Pump 38 was removed from its normal supply (Bus 3A) and placed on MCC 312A as the normal supply.

Controls Local stop/start pushbutton motor controls with a selector switch are provided at each of the motors for the equipment listed below. The selector switch will transfer control of the switchgear from the Control Room to local at the motor. Placing the local selector switch in the local operating position will give an annunciator alarm in the Control Room and will turn out the motor control position lights on the Control Room panel. The equipment consists of:

1) The Motor Driven Auxiliary Feedwater Pumps
2) The Charging Pumps
3) The Boric Acid Transfer Pumps Remote stop/start pushbutton motor controls with a selector switch are provided for each of the motors for the equipment listed below. These controls are grouped at one point in the switchgear room convenient for operation. The selector switch will transfer control of the switchgear form the Control Room to the remote point. Placing the selector switch to local operation will give an annunciator alarm in the Control Room and will turn out the motor control position lights on the Control Room panel. The equipment consists of:
1) The Service Water Pumps 31 thru 36 104 of 108 IPEC00035928 IPEC00035928

IP3 FSAR UPDATE

2) The Containment Air Recirculation Fans
3) The Control Room Air Handling Unit Including Control for the Air Inlet Dampers Key operated control switches located on MCC 312A provided local control for:
1) Component Cooling Water Pump 32
2) Charging Pump 31 or Charging Pump 32
3) Backup Service Water Pump 38 when utilizing the alternate power capabilities for items 1 and 2. Alternate motor control pOints are not required for the following:
1) The Component Cooling Water Pumps (Automatically restarted on a blackout once the diesel generators are operating)
2) The instrument Air Compressors and Cooling Pumps (These will start automatically on low pressures in the air and water services once the diesel automatically energizes the bus and the motor control centers are manually energized. The control point is local to the compressors.)

Isolation Switch Cabinets Switching cabinets have been provided to permit local operation of Diesel Generator No. 31, its associated 480V load centers and to permit local indication of containment safe shutdown instrumentation (steam generator level, pressurizer level, RCS loop 31 temperature, RCS pressure and pressurizer pressure), independent of the effects of a cable spreading room fire.

See Section 9.6.2.4.

Speed Control Speed control is provided locally for:

1) The turbine Driven Auxiliary Feedwater Pump
2) The Charging Pump Valve Control Local valve control is provided at:
1) The Main Feed Regulators
2) The Auxiliary Feed Control Valves (These valves are located local to the auxiliary feedwater pumps)
3) The Atmospheric Dump (Auto control normally at hot shutdown)
4) All other valves requiring operation during hot standby
5) The Letdown orifice isolation valves locally to the charging pumps Local stop and start buttons with selector switch and position lamp are provided.

105 of 108 IPEC00035929 IPEC00035929

IP3 FSAR UPDATE Pressurizer Heater Control Stop and start buttons with selector switch and position lamp locally to the charging pumps for one 555 kW backup heater group are provided.

Lighting Emergency lighting is provided in all operating areas as defined by the foregoing.

Communications The communication network provides communications between the area of the auxiliary feedwater pumps and the charging pumps, boric acid transfer pumps, diesel generators, and the outside exchange without requiring the Control Room.

7.7.4 Cold Shutdown from Outside the Control Room Hot shutdown is a stable plant condition, automatically reached following a plant shutdown. The hot shutdown condition can be maintained for an extended period of time. In the unlikely event that access to the Control Room is restricted, the plant can be safely kept at hot shutdown until the Control Room can be re-entered by the use of the monitoring indicators and the controls listed in Section 7.7.3. It is noted that these indicators and controls are provided outside as well as inside the Control Room.

By the use of appropriate equipment and procedures, the reactor can be brought to a cold shutdown condition from locations outside the Control Room if occupancy of the main Control Room should become untenable. The equipment systems that can be made available for a cold shutdown are as follows:

a) Auxiliary feedwater pumps b) Boric acid transfer pumps c) Charging pumps d) Service water pumps e) Containment fans f) Component cooling pumps g) Residual heat removal pumps h) Controlled steam release equipment (e.g., steam dump valve) and feedwater supply i) Equipment furnishing a boration capability j) Safety injection pumps k) Nuclear Instrumentation:

1) Excore neutron flux detector channel associated with App R alternate capability 106 of 108 IPEC00035930 IPEC00035930

IP3 FSAR UPDATE

2) Alternate Power supply if instrumentation power is lost I) Reactor coolant inventory control equipment (Charging and letdown) m) Pressurizer, pressure control equipment (heater and spray) including opening control for pressurizer relief valves n) Certain motor control center and switchgear sections which supply power to the above equipment In addition, the safety injection signal trip circuit must be defeated and the accumulator isolation valves closed.

Detailed procedures to be followed in achieving cold shutdown from outside the Control Room are best determined by plant personnel at the time of a postulated incident. This is because an assessment of plant conditions can be made on a long term basis (a week or more) to establish procedures for making the necessary physical modifications to instrumentation and control equipment in order to attain a cold shutdown. During such time, the plant could be safely maintained at hot shutdown condition. The reactor plant design does not preclude attaining the cold shutdown condition from outside the Control Room.

107 of 108 IPEC00035931 IPEC00035931

IP3 FSAR UPDATE 7.8 MAXIMUM SAFETY SYSTEM SETTINGS AND MINIMUM CONDITIONS FOR OPERATION Table 7.2-1 lists the reactor protection and engineered safety features actuation systems and Table 7.2-2 lists the associated interlocks. Maximum permissible settings for safe operation for these functions are given in the Technical Specifications.

7.9 SURVEILLANCE REQUIREMENTS The requirements for periodic testing of instruments are listed in the Technical Specifications, Technical Requirements Manual, the FSAR, and the ODCM. The type of test action (i.e.,

channel calibration, channel operational test, etc.) to be taken and the minimum testing frequency (i.e., 31 days, 92 days, 24 months, etc.) for the indicated instruments are provided within the above-mentioned documents.

As indicated, the instrumentation channels which are covered include, for example, nuclear, reactor coolant temperature and flow, pressurizer pressure and level, and auxiliary process channels; or components necessary to assure that facility operation is maintained within the safe limits.

108 of 108 IPEC00035932 IPEC00035932

IP3 FSAR UPDATE CHAPTER 8 ELECTRICAL SYSTEMS 8.1 DESIGN BASES The main generator feeds electrical power at 22 kV through an isolated phase bus to two half-sized main power transformers. The bulk of the power required for station auxiliaries during normal operation is supplied by an auxiliary transformer connected to the isolated phase bus.

This practice has been proven highly satisfactory. Deviations from past practices are reflected in the provisions for stand-by or emergency power which have been included to further ensure the continuity of electrical power for critical loads.

The function of the Auxiliary Electrical System is to provide reliable power to those auxiliaries required during any normal or emergency mode of plant operation.

The design of the system is such that sufficient independence or isolation between the various sources of electrical power is provided in order to guard against concurrent loss of all auxiliary power.

The Authority is engaged in a program to perform a detailed evaluation of safety related electrical equipment to ensure that the equipment will perform their safety functions during and following the postulated accident. The scope of the program includes safety concerns and qualification criteria.

The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

An additional diesel generator has been installed to comply with 10 CFR 50 Appendix "R" requirements; also supports compliance with Station Blackout (SBO). The diesel generator is considered non-safety related.

8.1.1 Principal Design Criteria Performance Standards Criterion: Those systems and components of reactor facilities which are essential to the prevention or to the mitigation of the consequences of nuclear accidents which could cause undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that will enable such systems and components to withstand, without undue risk to the health and safety of the public, the forces that might reasonably be imposed by the occurrence of an extraordinary natural phenomenon such as earthquake, tornado, flooding condition, high wind or heavy ice. The design bases so established shall reflect: (a) appropriate 1 of 31 IPEC00035933 IPEC00035933

IP3 FSAR UPDATE consideration of the most severe of these natural phenomena that have been officially recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design. (GDC 2 of 7/11/67)

All electrical systems and components vital to plant safety, including the emergency diesel generators, are designed as Class I so that their integrity is not impaired by the maximum potential earthquake, wind, storms, floods or disturbances on the external electrical system.

Power, control and instrument cabling, motors and other electrical equipment required for operation of the engineered safety features are suitably protected against the effects of either a nuclear system accident or of severe external environment phenomena in order to assure a high degree of confidence in the operability of such components in the event that their use is required.

Emergency Power Criterion: An emergency power source shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this capacity assuming a failure of a single component. (GDC 39 and GDC 24 of 7/11/67)

Independent alternate power systems are provided with adequate capacity and testability to supply the required engineered safety features and protection systems.

The plant is supplied with normal, standby and emergency power sources as follows:

1) The normal sources of auxiliary power during plant operation are both the generator and offsite power.
2) Offsite power is supplied from Buchanan Substation (approximately % mile from the plant) by 138kV and 345kV feeders, and two underground 13.8kV feeders. The Buchanan Substation has two 345kV and two 138kV circuits to Millwood Substation and a 345Kv circuit to Ladentown Substation which interconnects with the PJM system. Millwood Substation has ties to Pleasant Valley Substation which is the interconnection point between Consolidated Edison Company, Niagara Mohawk and Connecticut Light and Power systems. In addition, there are 1-25.4 MW and 1-16.9 MW combustion turbine generators at Buchanan Substation and a 21 MW combustion turbine generator located at the Indian Point site. 138Kv feeders are connected to the 6.9 KV buses through the station auxiliary transformer, 13.8 kV feeders and combustion turbines are connected to the 6.9kV buses through autotransformers. 480 volt engineered safety features are connected to the 6.9kV buses through station auxiliary transformers.
3) Three diesel generators are each connected to their respective engineered safety features buses to supply emergency shutdown power in the event of loss of all other AC auxiliary power. There are no automatic ties between the buses associated with each diesel generator.

Each diesel will be started automatically on a safety injection signal or upon the occurrence of under voltage on its associated 480 volt bus. Any two diesels have 2 of 31 IPEC00035934 IPEC00035934

IP3 FSAR UPDATE adequate capacity to supply the engineered safety features for the hypothetical accident concurrent with loss of outside power. This capacity is adequate to provide a sage and orderly plant shutdown in the event of loss of outside electrical power.

The diesel generator units are capable of being started and sequence load begun within 10 seconds after the initial signal.

The three diesel-generators are located adjacent to the control building and are connected to three (3) of the four (4) separate 480 volt auxiliary system buses. The fourth 480 volt bus is automatically connected to the third bus during diesel generator operation, and the two buses are operated as a unit from a single diesel generator for this mode of operation only.

4) Emergency power supply for vital instruments, control, and emergency lighting is from the four 125 volt DC station batteries.
5) A 2500 KW diesel generator capable of providing on-site power for safe shutdown loads has been installed in compliance with 10 CFR 50 Appendix "R"; also support compliance with SBO requirements.

8.2 ELECTRICAL SYSTEM DESIGN 8.2.1 Network Interconnection The offsite transmission system provides two basic functions for the station; namely, it provides auxiliary power as required for startup and normal shutdown and transmits the output of the station.

Electrical energy generated at 22 kV is raised to 345 kV by the two main generator transformers and delivered to the Buchanan 345 kV Switching Station via 345 kV, 3000 Amp, 25,000 MVA synchronizing circuit breakers. The Buchanan Substation has two 345 kV and two 138 kV circuits to Millwood Substation and a 345 kV circuit to Ladentown Substation which interconnects with the PMJ system. Millwood Substation has ties to Pleasant Valley Substation which is the interconnection point between Consolidated Edison Company and Niagara Mohawk and Connecticut Light and Power System. The Buchanan 138 kV Substation has connections to Lovett Station.

Offsite (standby) power is supplied from Buchanan Substation (approximately % mile from the plant) by 138 kV and 345 kV feeders, and two underground 13.8 kV feeders. In addition, there is 1-25.4 MWand 1-16.9 MW combustion turbine generators at Buchanan substation connected to the 13.8 kV feeders and a 21 MW combustion turbine generator located at the Indian Point Site. The 13.8 kV feeders are connected to the 6.9 kV buses through autotransformers. The 480 volt engineered safety feature buses are connected to the 6.9 kV buses through station auxiliary transformers.

Single-Line Diagram A single-line diagram, showing the connections of the main generator to the power system grid and to standby power source is shown on Plant Drawing 9321-F-33853 [Formerly Figure 8.2-1].

3 of 31 IPEC00035935 IPEC00035935

IP3 FSAR UPDATE Reliability Insurance There are four independent sources of emergency power available to Indian Point 3. They are the 138 kV and 345 kV ties from Buchanan and the two 13.8 kV feeders from Buchanan. In addition, there are three combustion turbine generators, one located on the Indian Point site and the others connected to 13.8 kV feeders at Buchanan, providing a completely independent supply from the rest of the offsite transmission system. The 138 kV supply from the Buchanan bus with its connections to the Consolidated Edison Company system and Orange & Rockland County provide a dependable source of station auxiliary power.

An analysis of the 1971 system demonstrated that the interconnected power system remained stable for the loss of the largest unit, Ravenswood NO.3 (1000 Mwe). Since the transmission system is as strong after the installation of Indian Point 3, and since Indian Point 3 is not as large capacity wise, this analysis can be applied to confirm the stability of the interconnected system for the sudden loss of the largest unit. In addition, a 2500 kw self-contained diesel generator is available to provide on-site power for safe shutdown loads having alternate feed capability.

8.2.2 Station Distribution System The Auxiliary Electrical System was designed to provide a simple arrangement of buses requiring the minimum of switching to restore power to a bus in the event that the normal supply to that bus is lost.

The relays that are used for bus clearing and sequencing of safeguards components on the four 480 volt buses have been physically located in the 480 volt switchgear and the circuitry has been developed on an individual, independent bus scheme. That is, each bus has its own set of bus clearing and load sequencing relays physically located within its own line-up, independent of the other bus sections. Diesel generator No. 31 is connected to bus No. 2A and bus No. 2A is then connected to bus No. 3A in the event of a diesel requirement. Buses No. 2A and 3A together form one of the three 480 volt safeguards power trains with buses No. 5A and 6A used for the remaining two power trains.

In addition, Indian Point 3 has a five-battery DC System. Each of the three 480 volt safeguards power trains and associated circuitry receives its DC control power from its own individual battery (Nos. 31, 32 and 33). Battery No. 36 feeds power panel No. 36. Battery No. 34 feeds instrument bus No. 34.

Batteries 31, 32, 33, and 34 are safety batteries which supply DC power to safe shutdown systems. Battery 36 is a non-safety battery which supplies DC power to non-essential loads.

Single Line Diagrams The basic components of the station's electrical system are shown on the electrical one line diagrams, Plant Drawings 617F645, 617F643, 617F644, 9321-F-30063, -30083, 9321-H-36933, and 9321-F-39893 [Formerly Figures 8.2-2 through 8.2-6, 8.2-8 and 8.2-9]. which include the 6900 volt, the 480 volt, the 120 volt AC instrument, and the 125 volt DC bus systems.

Unit Auxiliary, Station Auxiliary and Station Service Transformers Unit Auxiliary Transformer 4 of 31 IPEC00035936 IPEC00035936

IP3 FSAR UPDATE The unit auxiliary transformer is a three phase, two winding, forced oil/air type. During unit operation, it transforms 22 kV power from the main generator bus to 6.9 kV and, through appropriate switching, supplies four of the six 6900 volt auxiliary buses. These four buses supply virtually all of the unit 6900 volt auxiliaries and approximately 50% of the 480 volt auxiliaries.

Station Auxiliary Transformer The station auxiliary transformer is a three phase, two winding forced oil/air type. It transforms 138 kV power from the offsite network to 6.9 kV and, through appropriate switching, supplies the remaining two of the six 6900 volt auxiliary buses. During unit operation it supplies the 6900 and 480 volt auxiliary loads that are not supplied by the Unit Auxiliary Transformer.

When the Unit Auxiliary Transformer is not available, such as during unit trip, unit downtime, or startup, the four buses normally supplied by this transformer are reconnected to the two remaining buses, and the Station Auxiliary Transformer supplies all auxiliary loads.

Station Service Transformers The seven station service transformers are three phase, two winding, air insulated, dry type.

Insulation material is fire resistant and non-explosive. Solid insulation in the transformers consists of inorganic materials such as porcelain, mica, glass or asbestos, in combination with a sufficient quantity of high temperature binder to impart the necessary mechanical strength to the insulation structure. This insulation is defined by ASA standards as Group III material. The Station Service Transformers transform 6.9 kV power form the 6900 volt buses to 480 volts to supply low voltage auxiliary loads.

The above transformers were designed and constructed in accordance with the applicable standards of ASA, lEE and NEMA. During normal operation and auto engineered safeguards loading, these transformers will not be loaded beyond their rating. However, during peak accident loading scenarios, these transformers are allowed to be loaded up to 3600 amps, for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. This short time overload capability is necessary to support the 480V buses 2A, 3A, SA, and 6A loading requirements during the manual recovery phase of a design basis accident. Manufacturer shop tests of the transformers were conducted in accordance with the latest revision of American Standard Test Code C 57.12.90. This series of tests consisted of the following:

1) Resistance measurements of all windings,
2) Ratio tests,
3) Polarity and phase relation tests,
4) No-load losses,
5) Exciting current,
6) Impedance and load loss,
7) T em perature test,
8) Applied potential tests, and
9) Induced potential tests.

5 of 31 IPEC00035937 IPEC00035937

IP3 FSAR UPDATE 6900 Volt System The 6900 volt system is divided into seven buses. These buses supply 6900 volt auxiliaries directly and 480 volt auxiliaries via the station service transformers. Two buses, numbers 5 and 6, are connected to the 138 kV system via bus main breakers and the Station Auxiliary Transformer. An alternate connection is available to the 13.8 kV gas turbine and/or the 13.8 kV off-site power network via a step-down auto transformer. Buses No.1, 2, 3, and 4 are connected to the generator leads via bus main breakers and the Unit Auxiliary Transformer.

Buses No. 1 and 2 can be tied to Bus No.5 and Buses No.3 and 4 can be tied to Bus No.6 via bus tie breakers to provide auxiliary power during unit down time. These bus tie connections are automatically initiated, in the event of unit trip, to assist continuity of service. BUS 3NBY01 is connected to the 13.8 kV off-site power network via a step-down auto transformer.

480 Volt System The 480 volt system consists of seven buses, each supplied from a 6900 volt bus via a station service transformer. Four of these Buses, No. 2A, 3A, SA and 6A, supplied from Buses No.2, 3, 5, and 6 respectively, comprise the safety related 480 volt system. The required safeguards equipment circuits are dispersed among these buses. These buses are provided with diesel generator back-up in the event of voltage failure, and are protected against a sustained undervoltage condition, which could cause mis-operation of, or damage to, safeguards equipment. 480V Buses 2A, 3A, SA and 6A are each rated 3200 amps continuous. However, during peak accident loading scenarios, these buses can be loaded up to 3600 amps for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, based on a maximum ambient switchgear room temperature of 40°C. For Buses 2A and 3A, this short time limit applies to the combined loading, when these buses are tied together and powered from a single station service transformer. (Buses 2A and 3A are considered a single safeguards bus.)

480 Buses 2A, 3A, SA and 6A load breakers are rated to interrupt up to 50kA short circuit current. Maximum short circuit current at the 480V load breakers during emergency diesel generator testing parallel to the system, was initially and conservatively calculated to be slightly greater than 50kA. However, taking into account cable and raceway construction, and establishment of "safe zone" areas during diesel testing (CAT I areas), the maximum fault current was analyzed to be less than the 50kA rating which would allow the breaker to safely interrupt a fault if it occurs.

The three remaining 480 volt buses, Buses No. 312, 313, and 3NGY01 are supplied from 6900 volt Buses No.1, 3 and 3NBY01 respectively, and supply auxiliary power to additional plant facilities installed subsequent to the initial installation. A tie breaker between Buses 312 and 313 permit one bus to serve as a backup for the other. Interlocking prevents the cross connecting of the two 6.9 kV sources to Buses 312 and 313 through the 480 volt system. The interlock can be defeated temporarily for performing a live transfer of 480 volt buses 312 and 313 when both 6.9 kV supply buses are fed from the same 6.9 kV power source.

The 480 volt feeders for the Fire Protection System are from the 480 Volt Buses No. 312 and 313 to the 480 volt Motor Control Center G and H, respectively. Buses No. 312 and 313 are located in the Turbine Hall and Motor Control Centers G and H are located in the Fire Pump House. The motor driven fire pump normal feed is Bus No. 312 and the emergency feed is 480 volt Bus No. SA. These feeders run through the manual transfer switch which is used to manually transfer the feeders to the motor driven fire pump from the normal feed to the emergency feed and from the emergency feed to normal feed. The electrical feeds to the 6 of 31 IPEC00035938 IPEC00035938

IP3 FSAR UPDATE remaining equipment installed as part of the additional facilities program are supplied through individual breakers.

The normal source for Buses No. SA and 6A is the 138 kV system, via the station auxiliary transformer and 6900 volt Buses No.5 and 6. The normal source for Buses No. 2A and 3A is the main generator, via the unit auxiliary transformer and 6900 volt Buses No.2 and 3. When the unit is not operating, Buses No. 2A and 3A are supplied from the 138 kV system, via switching at the 6900 volt level. The normal source for Bus No. 3NGY01 is the 13.8 kV system via an autotransformer and 6900 volt Bus 3NBY01.

The relays that are used for bus clearing and sequencing of safeguards components on the four safety related 480 volt buses have been physically located in the 480 volt switchgear, and the circuitry has been developed on an individual, independent bus scheme. That is, each bus has its own set of bus clearing and load sequencing relays physically located within its own lineup, independent of the other bus sections.

Two independent sets of under-voltage protective relays are installed on each bus: one set to initiate load stripping, diesel generator start, bus transfer, and sequencing of safeguards loads upon bus voltage failure; the other set to initiate bus disconnection from the offsite power source upon the occurrence of a sustained period of voltage low enough to cause mis-operation of, or damage to, safeguards equipment.

Coordination between 480V Buses 2A, 3A, SA and 6A supply breakers and their downstream load breakers ensures that an entire bus will not be lost due to a fault on any feeder circuit.

One emergency diesel-generator set is connected to bus No. SA, one to 6A and the third to the combination of Bus No. 2A and Bus 3A. Each diesel generator is automatically started upon under-voltage on its associated 480 volt bus.

Interlocks are provided so that a fault on any bus locks out all possible sources of power to that bus. Interlocks are also provided to prevent circuit breakers connecting emergency diesel generator No. 31, 32 and 33 to Buses No. 2A, 6A and SA from automatically closing ifthere is a voltage on the bus. The power for the safeguards valve motors is supplied from two motor control centers which in turn are supplied from the safety related 480 volt system. Each motor control center can be supplied by an emergency diesel generator.

Each of the four 480 volt switchgear bus sections which supply power to the safeguards equipment receives DC control power from its associated battery source. Batteries No. 31, 32, and 33 supply DC control power to 480 volt bus No. SA, 6A and 2A/3A, respectively.

125 Volt DC System The 125 volt DC system is divided into five buses with one battery and battery charge (supplied from the 480 volt system) serving each. The battery chargers supply the normal DC loads as well as maintaining proper charges on the batteries.

One battery charger is available to each battery so that the five batteries are maintained at full charge in anticipation of loss-of-AC power incident. This ensures that adequate DC power is available for starting the emergency generators and other emergency uses.

Battery chargers 31, 32, and 33 are also relied upon to support the continued operation of systems and components required to either mitigate the consequences of a design basis 7 of 31 IPEC00035939 IPEC0003S939

IP3 FSAR UPDATE accident or provide post-accident monitoring subsequent to depletion of Batteries No. 31, 32, and 33.

The DC system is redundant from battery source to actuation devices which are powered from the batteries. Five batteries feed five DC power panels, which in turn feed major loads, such as instrument bus inverters, switchgear control circuits and DC motors. Two of the DC power panels sub-feed DC distribution panels, which in turn feed relaying and instrumentation loads.

Redundant safeguards relays and devices which use DC as a power source receive their power from one of three DC distribution buses.

Bus ties exist between Power Panels 31 and 32 and between Power Panels 33 and 34. These bus ties are administratively controlled open when the plant is in any condition above cold shutdown, to preserve the 125 VDC system independence. During cold shutdown, only one of these bus ties, either between Power Panel 31 and 32, or between Power Panels 33 and 34 can be closed. The bus tie feature is provided to allow maintenance, and / or removal of one of the four Station batteries. The remaining battery on the two cross connected buses has adequate capacity to supply DC power for the tied Power Panel loads for a minimum of two hours during a loss of AC power design basis event.

Safeguards pump controls which are DC actuated receive power from their associated DC distribution buses.

The physical locations of the DC system equipment is such as to minimize vulnerability of vital circuits to physical damage and prevent concurrent loss of all power as a result of accidents.

The DC system is designed such that a single random failure will not result in the loss of redundant DC power and/or Distribution Panels due to a common mode electrical failure.

Major loads with their appropriate operating times on each battery are listed in Table 8.2-2.

120 Volt AC System The 120 volt AC instrument supply is split into four buses. All four buses are fed by inverters which are in turn supplied from separate 125 volt DC buses. In addition, an alternate power supply is provided for the fourth bus consisting of a constant voltage transformer connected to a 480 volt safeguards motor control center No. 36B. In the event that inverter 34 or the constant voltage transformer is taken out of service, a backup source consisting of a second constant voltage transformer connected to a different 480 volt safeguards MCC is available to feed the associated bus.

Inverters 31, 32, and 33 have manual bypass switches which can bypass the inverter and supply the associated instrument bus from a backup constant voltage transformer connected to a 480 volt MCC. In addition, inverters 31, 32, and 33 have automatic static transfer switches which will transfer to the backup constant voltage transformer supply in the event of loss of inverter voltage, loss of DC voltage, inverter circuit failure, electrical fault or inverter undervoltage.

Inverters 31, 32, and 33, each have a harmonic filter installed to maintain voltage total harmonic distortion (VT HD) within design limits. This reduces instrumentation biases to VT HD sensitive instruments to acceptable limits.

Evaluation of Layout and Load Distribution 8 of 31 IPEC00035940 IPEC00035940

IP3 FSAR UPDATE The physical locations of the electrical distribution system equipment are such as to minimize vulnerability of vital circuits to physical damage as a result of accidents.

Station and unit auxiliary transformers, and the main transformer are located outdoors and are physically separated from each other.

Lightning arresters are used where applicable for lightning protection. All oil filled transformers are covered by automatic spray systems to extinguish oil fires quickly and prevent the spread of fire. Transformers are spaced to minimize their exposure to fire, water and mechanical damage.

The 6900 volt switchgear and 480 volt load centers are located in areas which minimize their exposure to mechanical, fire and water damage. This equipment is properly coordinated electronically to permit safe operation of the equipment under normal and short circuit conditions.

The 480 volt motor control centers are located in the areas of electrical load concentration.

Those associated with the turbine-generator auxiliary system in general are located below the turbine-generator operating floor level. Those associated with the nuclear steam supply system are located in the Primary Auxiliary Building.

Non-segregated, metal-enclosed 6900 volt buses are used for all major bus runs where large blocks of current are to be carried. The routing of this metal-enclosed bus is such as to minimize its exposure to mechanical fire and water damage.

The application and routing of control, instrumentation and power cables are such as to minimize their vulnerability to damage from any source. All cables are designed using conservative margins with respect to their current carrying capacities, insulation properties and mechanical construction. Power cable insulation in the Reactor Building has fire resistant sheathing, selected to minimize the harmful effects of radiation, heat and humidity.

Appropriate instrumentation cables are shielded to minimize induced voltage and magnetic interference. Wire and cables related to engineered safeguard and reactor protective systems are routed and installed to maintain the integrity of their respective redundant channels and protect them from physical damage.

The following design and construction procedures were followed to assure a safe and adequate design:

Redundancy and separation requirements were initiated by the cognizant electrical or mechanical design engineer. These were then reviewed by the designers of the electrical system installation, thus providing a check. The work of the designer, who prepared the applicable circuit schedule sheet (which designates the cable routing and termination), was spot checked by the cognizant electrical engineer.

The construction group installed the cable as directed by the circuit schedule sheet. The installations were verified by WEDCO field engineers and spot checks of circuit installations were made to further ensure that the installation was in accordance with the design.

Consolidated Edison spot checked the installation.

9 of 31 IPEC00035941 IPEC00035941

IP3 FSAR UPDATE Cable loading of trays and consequently heat dissipation of cable throughout the plant has been carefully studied and controlled to ensure no overloading. The criteria for electrical loading has been developed using IPCEA Standard P-46-426, manufacturer recommendations and good engineering practice.

Derating factors for cables in trays without maintained spacing were taken from Table VIII of the IPCEA publication. Derating factors for the maximum ambient temperature existing in any area of the plant were also taken from the IPCEA publication. These factors were applied against capacities selected from appropriate tables in other portions of the standard.

For physical loading of trays, the following criteria was followed: 6.9 kV power, one horizontal row of cables with spacing was allowed in a tray; 480 volt power, two horizontal rows of cables were allowed in a tray (if derating requirements did not dictate less); for control and instrumentation, the tray was filled to a point just below the top (the total cable area for this configuration is 60% of tray cross-sectional area). A computer program was used to monitor cable routing and tray loading.

Cables which do not require channeling may be run in any tray or conduit; however, once it entered a tray or raceway containing a channeled cable, it does not leave this channel and enter another tray containing a cable from a different channel.

To assure that only fire retardant cables were used throughout the plant, a careful study of cable insulation systems was undertaken early in the design. Insulation systems that have superior flame retardant capability were selected and manufacturers were invited to submit cable sample for testing. An extensive flame testing program took place which included ASTM vertical flame testing and Consolidated Edison Company vertical flame and bonfire tests as described below.

These flame tests were used as one of the means of qualifying cables and specifications were written on the basis of the results from the tests.

The following tests were made to determine the flame resistant qualities of the covering and insulation of various types of cables for Indian Point 3:

1) Standard Vertical Flame Test - made in accordance with ASTM-D-470-59T, "Test for Rubber and Thermalplastic Insulated Wire and Cable."*
2) Five-Minute Vertical Flame Test - made with cable held in vertical position and 1750 F flame applied for five minutes.
3) Bonfire Test - Consisting of exposing, for five minutes, bundles of three or six cables to flame produced by igniting transformer oil in 12-inch pail. The cable was supported horizontally over the center of the pail, the lowest cable three inches above the top of the pail. The time to ignite the cable and the time the cable continued to flame after the fire was extinguished were noted.

On the basis of these tests, the cables were selected for the Reactor Containment Building for Indian Point 3.

  • NOTE: This Standard has since been revised and the provIsions of the currently approved version (ASTM-D-470-71) are less restrictive than the requirements of Tests 2) and 3). Therefore, cable procured by Consolidated Edison and the Authority after 1971 10 of 31 IPEC00035942 IPEC00035942

IP3 FSAR UPDATE is qualified in accordance with the more stringent requirements of the Five-Minute Vertical Flame Test and the Bonfire Test.

Cables are protected in hostile environments by a number of devices. Running the cable in rigid, galvanized conduit is the most frequently of used method protection. For underground runs, PVC heavy wall conduit encased in a concrete envelope provides maximum protection.

When cable is run in a tray, peaked covers are used in areas where physical damage to cables may result from falling objects or liquids. In addition, covers are provided on horizontal cable trays which are exposed to the sun.

Fire protection measures to prevent propagation of flame are discussed in Section 9.6-2. Fire detection is provided for areas where there are large groupings of cables in stacked cable trays.

The plant has a protective signaling system that transmits fire alarm and supervisory signals to the Control Room where audible and visual alarms are provided. The system includes signals for actuation of fire detectors, and automatic sprinkler, water spray, foam and C02 systems.

Electrical supervisory signals are received from tamper switches on fire water system control valves.

Cables and wireways are marked by means of metal tags attached at each end. These tags are embossed to conform with the identification given in the Conduit and Cable Schedule. At each multiple conductor cable termination, a plastic covering is attached which as been premarked to indicate the terminal designation of each conductor. In addition, cable trays are marked at frequent intervals to indicate the channel number and voltage level of the tray. Color coding is discussed in Section 7.2.

In areas where missile protection could not be provided (such as near the Reactor Coolant System) redundant instrument impulse lines and cables were run by separate routes. These lines were kept as far apart as physically possible, or were protected by heavy (1/4") metal plates interposed where inherent missile protection could not be provided by spacing.

8.2.3 Emergency Power Sources Description Standby power required during plant startup, shutdown and after turbine trip is supplied from one 345kV feeder and one 138 kV feeder from the Buchanan Substation (approximately 3/4 mile from the plant) which as connections to the Millwood Substation and the Lovett Station of the Orange and Rockland system. These connections are made through the station auxiliary transformer.

In addition, there are two underground 13.8 kV feeders from the Buchanan Substation. There is also 1-25.4 MW and 1-16.9 MW combustion turbine generator at Buchanan connected to these 13.8 kV underground feeders, and a 21 MW combustion turbine generator located on the Indian Point site. The 13.8 kV feeders are connected to the 6.9 kV buses via autotransformers. If these sources should fail, the on-site sources of emergency power are three emergency diesel generator sets, each consisting of an Alco model 16-251-E engine coupled to a Westinghouse 2188 KVA, 0.8 power factor, 900 rpm, 3 phase, 60 cycle, 480 volt generator. Each unit has a 2000 hour0.0231 days <br />0.556 hours <br />0.00331 weeks <br />7.61e-4 months <br /> and a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> rating of 1950 kW and a 1750 kW continuous rating. There is also a vendor stated maximum Y2 hour rating of 2000 kW. This is not an operational limit but an area of additional margin for handling power surges and spikes which may occur during testing. In addition, an alternate on-site source of power for safe shutdown loads is available from the 11 of 31 IPEC00035943 IPEC00035943

IP3 FSAR UPDATE Appendix "R" Diesel Generator which consists of an ALCO model 251 engine coupled to a KATO model 8P103600 3125 KVA, 0.8 power factor, 900 rpm, 3 phase, 60 cycle, 6900 volt Generator.

On July 21, 1988, 10 CFR 50 was amended to include a new Section 50.63 entitled, "Loss of All Alternating Current Power," (Station Blackout). The Station Blackout (SBO) Rule requires that each light-water-cooled nuclear power plant be able to withstand and recover from an SBO of specified duration.

The Authority submitted to the NRC its response to the SBO rule. The NRC responded by issuing a Safety Evaluation dated December 23, 1991 and a Supplemental Safety Evaluation dated June 8, 1992. Based on these safety evaluations, and IPN-94-127, dated October 13, 1994, the following SBO-related items are resolved:

1) Habitability of the areas from which the AFW flow control valves and steam generator PORVs are operated during the first hour after the onset of an SBO event was evaluated and determined acceptable.
2) In order to address the effects of loss of ventilation of the control room, control room cabinet doors will be opened within 30 minutes of the onset of an SBO event.
3) The containment Isolation Valve design and operation meets the intent of the guidance described in Regulatory Guide 1.155. Specific containment isolation valves which cannot be excluded based on the 5 criteria given in Regulatory Guide 1.155 are documented to justify their exclusion and ensure that containment integrity will be maintained during an SBO event.
4) All equipment required for response to an SBO shall be classified (at least) Category M, and included in the QA Program.
5) The EDG reliability program follows the guidance and meets the intent of Regulatory Guide 1.155. This program includes monitoring of EDG reliability, surveillance and testing of the EDGs, maintenance program, an information and data collection system and management oversight.
6) The coping duration categorization of IP3 has been revised from four to eight hours.

Any two emergency diesel generator units, as a backup to the normal standby AC power supply are capable of sequentially starting and supplying the power requirement of one minimum required set of safeguards equipment. The three units are located in a seismic Class I structure located near the Control Building.

Each emergency diesel is automatically started by two redundant air motors, each unit having a complete 53 cu ft air storage tank and compressor system powered from a 480 volt motor. The piping and the electrical services are arranged so that manual transfer between units is possible. Each air receiver has sufficient storage for 4 starts. The diesel will consume, however, only enough air for one automatic start during any particular power failure. This is due to the engine control system which is designed to shutdown and lock out any engine which did not start during the initial try.

12 of 31 IPEC00035944 IPEC00035944

IP3 FSAR UPDATE The emergency units are capable of being started and sequence load begun within 10 seconds after the initial signal. The starting system is completely redundant for each diesel generator.

The units have the capability of being fully loaded within 30 seconds after the initial starting signal.

To ensure rapid start the units are equipped with water jacket and lube oil heating and pre-lube pump for circulation of lube oil when the unit is not running. The units are located in heated rooms.

An audible and visual alarm system is located in the main control room and will alarm off-normal conditions of jacket water temperature, lube oil temperature, fuel oil level, and starting air pressure.

The abnormal conditions that can shut down the diesel generator during an accident are:

1) overcranking
2) low oil pressure
3) overs peed An auto shutdown alarm system provided three alarms in the Control Room; one for each emergency Diesel Generator. The alarm annunciates when a shutdown, lock out, control switch off auto or loss of DC power condition occurs. These alarms, located in the Control Room, will identify the diesel generator that has been tripped or is prevented from starting, because of a lock-out shutdown condition or loss of DC power.

Each emergency diesel generator was designed to start and come up to speed within ten seconds after initiation of the starting signal. Failure of the engine to start within the timing period of the overcrank time indicates a malfunction. The overcrank relays have a setpoint (approximately 15 seconds) that allows the diesel engine enough time to start and at the same time, does not allow the air tank to deplete itself. Shutdown conserves the starting air supply so that the engine can be subsequently started after the malfunction is corrected. Low oil pressure indicated by two out of three oil pressure switches shuts down the diesel generator, since the engine cannot run without proper lubrication. Shutdown permits corrective action to be taken before the engine is damaged, and the diesel generator can then be returned to normal operation.

An overspeed condition causes improper generator output and therefore the diesel generator should be shut down for corrective action to be taken to restore the generator output to normal.

For operator indication that one or more emergency diesel generators have been disabled for test or maintenance purposes there is an annunciator window labeled "SAFEGUARDS EQUIPMENT LOCKED OPEN." This alarm is initiated on signals from various safeguards components including the diesels. From anyone of the three diesels the following signals would actuate the alarm:

1) Main Control Board Generator Breaker Control Switch in pull-out position
2) Local Generator Breaker Control Switch in pull-out position
3) Local Diesel Control Switch in off or manual position.

Fuel oil for the emergency diesel generators is stored in three 7,700 gallon underground storage tanks located on the south side of the Diesel-Generator Building. There is one common truck hose connection and a 4-inch fill line for all three tanks, complete with a four-inch shutoff valve at each tank. The overflow from any tank will cascade into an adjacent tank. Each tank is 13 of 31 IPEC00035945 IPEC00035945

IP3 FSAR UPDATE equipped with a single vertical fuel oil transfer pump that discharges to either a normal or emergency header. Each header independently supplies the day tank at each diesel. An alarm will sound in the control room if the level in any underground storage tank approaches the level equivalent of the minimum total required inventory identified below less the indicating uncertainty. Administrative action will be taken to refill the tank. In addition, there is a low-level pump cutout switch located on each tank to prevent damage to the fuel oil transfer pump. Each tank is also equipped with a sounding connection and a level indicator. Decrease in level in a day tank to approximately 115 gallons (65% full) will cause the transfer pump in the corresponding underground storage tank to start. Once started, the pump will continue to run until the day tank is filled. When the tank is filled, a level switch will initiate closing of the day tank inlet valve and discontinue operation of the fuel oil transfer pump.

The minimum required usable inventory for each of the three storage tanks is specified in the Technical Specifications. The safety design criteria are based on the need to provide adequate fuel to support forty-eight (48) hour operation of minimum safeguards equipment following a design basis accident. The minimum required inventory (gallons) for fulfillment of the safety design criterion is based on the following:

31 Tank 32 Tank 33 Tanks Calculated consumption (TS Required 5,365 5,365 5,365 Usable)

Margin reduction due to re-coating 20 20 20 Level indication uncertainty 50 50 50 Unusable (pump cutoff worst case 915 915 956 drift)

Total minimum required Inventory 6,350 6,350 6,396 No credit is taken in the above tabulation for the inventory of oil in the EDG day tanks. Each emergency diesel is equipped with a 175-gallon day tank. The transfer pump start and fill valve open function is initiated when the level in the tank approaches (decreases toward) 65% (of nominal full) level, approximately 115 gallons. The 32 fuel oil storage tank was re-coated during R010. A conservative estimate of the volume reduction of the tank was made and the required inventory for fulfillment of the safety design criterion adjusted accordingly.

Fuel flows by gravity to the engine, insuring a static head of fuel oil on the injection manifolds.

Excess fuel oil is collected in a drip tank located in the base of the diesel engine. A manually operated drain pump is provided so that the drip tank can be emptied. The diesel fuel oil storage and transfer system diagram is shown in Plant Drawing 9321-F-20303 [Formerly Figure 8.2-7].

A usable amount of 37556 gallons of fuel oil is required to operate two emergency diesels at minimum safeguards load continuously for 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />. An assumed 10730 gallons is available assuming the unlikely event that one underground storage tank is unavailable. Based on No.2 diesel fuel oil with a minimum density of 6.91 Ibs/gallon and an average consumption rate of 0.363 Ibs/hp-hr, this capacity is sufficient to operate two diesels at minimum safeguards for at least 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. An additional minimum usable storage of 26,826 gallons is necessary to assure continuous operation of two diesels at minimum safeguards load for a total of 168 hours0.00194 days <br />0.0467 hours <br />2.777778e-4 weeks <br />6.3924e-5 months <br />. This reserve is in addition to the storage requirements for other plants at the site. The usable amount of 37,556 gallons of fuel oil is necessary to operate two diesels for seven days to maintain the unit in a cooldown condition concurrent with a loss of offsite power.

14 of 31 IPEC00035946 IPEC00035946

IP3 FSAR UPDATE The Technical Specifications require 26,826 gallons of fuel as minimum usable storage available for Indian Point 3 usage in other normal supply tanks on site or at the Buchanan Substation. Also, additional supplies of diesel fuel oil are available locally.

There are two 30,000 gallon seismic Class III tanks located in the Indian Point 1 Superheater Building and a 200,000 gallon seismic Class III tank in the Buchanan Substation located immediately across Broadway. These tanks contain fuel oil for operation of combustion turbines that is compatible for use with the diesels. Each tank has a level indicator and a capacity check is made weekly. When the combustion turbines are being operated, the dispatcher will be notified to start oil deliveries and to keep the tanks filled. The gas turbines consume approximately 2000 gallons per turbine per hour. A truck with hose connections compatible with the underground storage tanks will be provided. If the diesels require the reserves in these tanks, the contents of these tanks would be transported by truck to the underground diesel storage tanks. Additional supplies of diesel oil are available locally. Under normal conditions, 25,000 gallons can be delivered on a one or tWO-day notice. Additional supplies are also maintained in the region (about 40 miles from the plant) and are available for use during emergencies, subject to extreme cold weather conditions (increased domestic heating usage) and available transportation.

All components of the emergency diesel fuel oil supply system are seismic Class I and as such were designed in accordance with the criteria of Section 16.1. In addition, all components of the diesel fuel oil supply system are tornado protected and as such are able to withstand the design tornado and the tornado driven missiles delineated in Section 16.2. These components are also protected against the turbine missiles described in Appendix 14A of Chapter 14. The power supply and control system for the diesel fuel oil transfer system were designed in accordance with IEEE-279, meeting fully the single failure criteria specified therein.

Fuel oil for the emergency diesel generators is stored in three buried storage tanks. Each tank is equipped with a single vertical fuel oil transfer pump that discharges oil into either of two headers according to the manual valving arrangement selected. Both of these headers connect to a 175-gallon day tank mounted on each of the three diesel engines.

Decrease in level in anyone of the three day tanks to the 65 percent level automatically starts its associated fuel oil transfer pump (local manual controls are also available). The fuel oil transfer pumps are powered from motor control centers 36C, 36D, and 36E. Since each pump is capable of supplying fuel oil to all three diesels, this arrangement assures the availability of fuel oil to each diesel.

Each day tank is provided with AC normal level and low level indicating lights. In addition, each day tank has a DC low-low alarm on its respective diesel generator control panel which also annunciates a common Diesel Generator Trouble Alarm on the supervisory panels in the Control Room.

Diesel-Generator Separation The emergency diesel generators are located in a tornado-proof reinforced concrete building immediately adjacent to the Control Building. The diesel generators are arranged on 13'-0" centers, parallel to each other with approximately 10'-0" between engine components. The structure is provided with internal walls to separate the three diesel generators and their associated cabling and control panels from each other for fire protection. Fire protection and detection systems for the diesel generators are discussed in Section 9.6.2.

15 of 31 IPEC00035947 IPEC0003594 7

IP3 FSAR UPDATE Each control panel contains relays and metering equipment for its diesel generator. In the event of an electrical fire the event is annunciated in the main control room. With the compartmentalized diesel generator separation design, and the fire protection systems provided, spread of fire from one unit and its associated equipment to the other units is minimized.

Each emergency diesel generator has its own small fuel storage (day) tank that feeds the fuel oil pump on the engine. All day tanks are automatically filled during engine operation from three separate underground storage tanks outside the diesel generator building. Each storage tank has its own supply pump mounted in a manhole opening in the top of the tank above oil level. It is therefore unlikely that a fire associated with anyone of the small fuel oil storage (day) tanks would prevent oil from being supplied to the remaining two diesels.

Loading Description Each unit is to be started on the occurrence of either of the following incidents:

1) Initiation of safety injection operation;
2) Undervoltage on its own bus.

On occurrence of undervoltage without safety injection the engines are started and connected to their respective bus.

If there is coincident or subsequent requirement for engineered safeguards, automatic sequencing is initiated as follows:

1) Emergency diesel No. 31 is connected to and capable of supplying bus No. 3A in addition to bus No. 2A (via a bus tie between buses No. 2A and 3A) in the event of a safeguards system requirement.
2) All 480 volt breakers, except those feeding the motor control centers numbers 36A, 36B, 36C, 36D, 311 and 36E are tripped and all automatically operated non-safeguards' feeders are locked out. All engineered safeguards motors are operated from the 480 volt buses.
3) Connect the diesel generators to their respective buses.
4) Magnitude of loads for each emergency diesel generator is given in Table 8.2-1A.

If a diesel fails to start or a bus fault occurs, the loads as indicated on the associated bus will not start. The remaining loads on the unaffected buses meet the minimum safeguards requirements.

The recirculation phase is manually initiated by control switches on the supervisory panel in the main control room. As the sequence switches are operated, the bus loads are modified to give those shown in Reference 1 for the respective Design Basis Accidents.

Emergency Diesel Generator Loading 16 of 31 IPEC00035948 IPEC00035948

IP3 FSAR UPDATE The following "minimum safeguards" equipment is required and assumed to be operating for a design basis event at Indian Point Unit 3:

2 of 3 Safety Injection (SI) Pumps 1 of 2 Residual Heat Removal (RHR) Pumps 1 of 2 Motor Driven Auxiliary Feedwater (AFW) Pumps 1 of 2 Recirculation Pumps 3 of 5 Containment Recirculation (CR) Fans 1 of 2 Containment Spray (CS) Pumps 1 of 3 Nonessential Service Water (NE SW) Pumps 2 of 3 Essential Service Water (ESW) Pumps 1 of 3 Component Cooling Water (CCW) Pumps Due to interactions between systems, minimum requirements for safety vary with the loss of any one diesel generator. See Chapter 14.3 for details.

This configuration is based on the assumptions of a single active failure of an emergency diesel generator and that 1 CCW and 1 NE SW pump may be out of service at the time of the accident. In addition to the required equipment listed above, the operator may manually load other equipment during the recovery process as instructed by the Emergency Operating Procedures (EOPs) or System Operating Procedures (SOPs).

The maximum steady state power requirements for equipment that is either automatically or manually loaded in the emergency diesel generators following a loss of offsite power and SI actuation have been conservatively calculated in Reference 1. The diesel generator loading in each of the following design base accidents; large break loss of coolant, small break loss of coolant, main steam line break, and steam generator tube rupture are evaluated in Reference 1 for the actual sequence of loading that the control room operators would initiate as they respond to a DBA. In the initial stage for the worst case accident, the peak load is less than 1950 kW.

As the plant approaches steady state (accident stabilized) conditions the EDG loading is less than the unit 1750 kW continuous rating. The maximum steady state power requirements for equipment loading in the emergency diesel generators following a reactor trip without engineered safeguard actuation (SI) with loss of offsite power have been conservatively calculated in Reference 2. Similar to the SI accident scenarios, at the initial stage of the accident the peak load is less than 1950 kW. At steady state, the diesel load is less than 1750 kW. Equipment loading range on the EDG's for both the SI and Non-SI accidents is summarized in Table 8.2-1A.

The worst case transient loading histories were computed assuming the possibilities of a diesel failure combined with equipment out of service.

Design basis events which do not actuate the safety injection system will result in lower emergency diesel loading than those that do.

Testing To verify that the emergency power system will respond within the required time limit and when required, the following tests shall be performed periodically.

a) Manually initiated demonstration of the ability of the diesel generators to start and deliver power up to nameplate rating when operating in parallel with other power 17 of 31 IPEC00035949 IPEC00035949

IP3 FSAR UPDATE sources. Normal plant operation will not be affected. The duration of the test is at least one hour to at least 50% of continuous rating.

b) Demonstration of the readiness of the system and the control systems of vital equipment to automatically start or restore to operation particular vital equipment by simulating a loss of all normal AC station service power supplies. This test is conducted as required by the Technical Specifications.

The starting of the diesel generator sets can be tested from the Diesel Generator Building. The ability of the units to start within the prescribed time and to carry intended loads are checked periodically. (See Section 8.5).

In addition, each diesel generator shall be inspected and maintained following the manufacturer's recommendations for this class of standby service.

Batteries and Battery Chargers Lead acid station Batteries No. 31, 32, 33, and 34 have been sized to carry their expected shutdown loads following a plant trip and a loss of all AC power for a period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> without battery terminal voltage falling below its minimum required voltage. Lead acid station Battery No. 36 has been sized to carry its load for a period of 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> without falling below 105 volts.

Major loads with their approximate operating times on each battery are listed in Table 8.2-2.

The five battery chargers have been sized to recharge the above partially discharged batteries within 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> while carrying its normal load. Battery chargers 31, 32, and 33 are also relied upon to support the continued operation of systems and components required to either mitigate the consequences of a design basis accident or provide post-accident monitoring subsequent to depletion of Batteries No. 31, 32, and 33.

Battery Charger 35 is an installed spare charger which can be utilized as a replacement for any one of Battery Chargers 31, 32, 33, or 34. Battery Charger 35 can be supplied from either MCC

-36C, -36D, or -36E via a plug / receptacle arrangement. This arrangement will allow BC 35 to be supplied from the same source as the Battery Charger it is being used to replace, or in the case when it is replacing BC 34, a more reliable source. This will allow BC35 to be supplied from the proper train for its intended use.

The battery system consists of four batteries (No. 31, 32, 33, and 34), each of which generates hydrogen during a floating charge or an equalizing charge. For batteries No. 31, 32, and 34 with the worst case assumptions of the exhaust fan out of service and no natural ventilation, or for battery No. 33 with no exhaust systems or any natural ventilation in effect, with temperatures as high as 104°F, the time to accumulate a hydrogen buildup to four percent under various charging conditions is:

Battery No. 31 floating charge >23 hours equalizing charge >3 hours Battery No. 32 floating charge >30 hours equalizing charge >3 hours Battery No. 33 floating charge >77 hours equalizing charge >7.7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> Battery No. 34 floating charge >11.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 18 of 31 IPEC00035950 IPEC00035950

IP3 FSAR UPDATE equalizing charge >3.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Battery No. 36 floating charge >17 hours equalizing charge >7.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> The ventilation system for Battery Rooms No. 31, 32, 34 and 36 operate continuously, to preclude any hydrogen build-up. (Station Battery No. 33 is located in Diesel Generator Room No. 31 and does not require forced ventilation.) Loss of the battery room ventilation is annunciated in the Control Room; loss of diesel operating room ventilation is detected by supervisory personnel observations and/or normal operating maintenance procedures.

Normally the batteries are on continual floating charge. They are placed on a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> equalizing charge every quarter or after an emergency battery discharge. (Manual actuation is required at the battery chargers to place the batteries on equalizing charge.)

There is one (1) annunciator window labeled "Battery Charger Trouble." This alarm is set off on the following signals from battery chargers as indicated:

SIGNAL CHARGERS

1) Low DC Voltage 31, 32, 33, 34, 35, & 36
2) Ground Detection 31, 32, 33, 34, 35, & 36
3) AC Power Failure 31,32,33,34,35
4) High-Low AC Voltage 36
5) Over Temp 31,32,35 & 36
6) High DC Voltage 36
7) High DC Voltage Shutdown 31,32, & 35
8) Battery Discharge 31, 32, 35 & 36
9) Charger Failure 36 Each individual signal can be isolated on each individual charger listed. Indication is provided at each charger when at any signal is isolated on that charger.

Reliability Assurance The electrical system equipment is arranged so that no single contingency can inactivate enough safeguards equipment to jeopardize the plant safety. The 480-volt safeguards equipment is arranged on 4 buses. The 6900-volt equipment is supplied from 7 buses.

The plant auxiliary equipment is arranged electrically so that multiple items receive their power from the two different sources. The charging pumps are supplied from the 480 volt buses No.

3A, 5A and 6A. The nine service water pumps and the five containment fans are divided among five of the 480-volt buses. Valves are supplied from motor control centers, No. 36A and 36B, which are supplied from buses No. 5A and 6A.

The outside source of power is adequate to run all normal operating equipment. The 138 kV -

6.9 kV station transformer can supply all the auxiliary loads.

The bus arrangements specified for operation ensure that power is available to an adequate number of safeguards auxiliaries.

19 of 31 IPEC00035951 IPEC00035951

IP3 FSAR UPDATE Minimum engineered safeguards can be carried by any two diesel generators. These safeguards can adequately cool the core and maintain containment pressure within the design value for the Design Basis Accident.

One battery charger is available to each battery so that the four batteries will always be at full charge in anticipation of loss-of-AC power incident. This ensures that adequate DC power will be available for starting emergency generators and other emergency uses.

8.2.4 Engineered Safeguards Components The initiation, control and sequencing design of engineered safeguards components, Auxiliary Feedwater System, and Component Cooling Water System is as shown on the schematics listed on Table 8.2-3.

References

1) Calculation IP3-CALC-ED-00207, 480V Bus 2A, 3A, 5A & 6A and EDGs 31,32 & 33 Accident Loading.
2) Calculation IP3-CALC-ED-00358, Electrical Load Study 480 Volt Safeguard Bus Loading Reactor Trip / No SI, and Loss of Feedwater Transient / No SI, with Offsite Power Available.

20 of 31 IPEC00035952 IPEC00035952

IP3 FSAR UPDATE TABLE 8.2-1A LOAD SCHEDULE FOR DIESEL GENERATORS Loads on Bus SA (Emergency Diesel Generator 33)

Automatic Loads Manual/Optional Loads Equipment Load Range (KW) Equipment Load Range (KW)

SI Pump 31 327-330 CR Pump 31 294-296 (3)

CS Pump 31 324-332 NE SW Pump 31 276-281 CR Fan 31 157-160 CCWPump 31 219-224 CR Fan 33 157-160 ESWPump 34 276-280 MCC 39 116-131 MCC 36A 93-145 (1) Chg Pump 31 149-150 Przr Htrs 33 208-485 MCC 38 (CRDM Fans) 77-83 MCC 311 75-600 (4) MCC 311 75-600 (5)

Loads on Bus 2A/3A (Emergency Diesel Generator 31)

Automatic Loads Manual/Optional Loads Equipment Load Range (KW) Equipment Load Range (KW)

SI Pump 32 327-330 NE SWPump 32 276-281 RHR Pump 31 315-317 (2) CCWPump 32 219-224 AFW Pump 31 361-367 MCC 32 104-116 CR Fan 32 157-160 MCC 35 60-63 CR Fan 34 157-160 Chg Pump 32 149-150 ESWPump 35 276-280 Przr Htrs 31 208-555 MCC 36C 38-96 Przr Htrs 32 208-485 PAB Vent Fan 31 86-123 MCC 34 46-62 Loads on Bus SA (Emergency Diesel Generator 32)

Automatic Loads Manual/Optional Loads Equipment Load Range (KW) Equipment Load Range (KW)

SI Pump 33 327-330 CR Pump 32 294-296 (3)

CS Pump 32 324-332 NE SWPump 33 276-281 RHR Pump 32 315-317 (2) CCWPump 33 219-224 AFWPump 33 361-367 MCC 37 65-211 CR Fan 35 157-160 Chg Pump 33 149-150 ESWPump 36 276-280 PAB Vent Fan 32 86-123 MCC 36B 76-104 (1) Przr Htrs Cntl Group 277 (1) Does not include transient MOV Loads (2) This load is reduced to 182 KWwhen RHR pump is in mini-flow (3) This load is reduced to 200 KWon High-head recirculation (4) Auto Closure loads on MCC 311 (BFD 90-1 through 90-4 and BFD 5-1 through 5-4) are transient loads 21 of 31 IPEC00035953 IPEC00035953

IP3 FSAR UPDATE (5) Manual Load MCC 311 as required by EOP to restore Feedwater to faulted Steam Generator 22 of 31 IPEC00035954 IPEC00035954

IP3 FSAR UPDATE TABLE 8.2-2 MAJOR BATTERY LOADS Battery No. 31 Inverter No. 31 (25 KVA) 2 Hours Emergency Lighting & Control Power (17 KW) 2 Hours Battery No. 32 Inverter No. 32 (25 KVA) 2 Hours Emergency Lighting & Control Power (23 KW) 2 Hours Battery No. 33 Control Power (1.8 KW) 2 Hours Inverter No. 33 (25 KVA) 2 Hours Battery No. 34 Inverter No. 34 (7.5 KVA) 2 Hours Battery No. 36 Turbine Generator Emergency Oil Pump (60hp) 3 Hours Boiler Feed Pump Emergency Oil Pump (15 hp) 3 Hours Air Side Seal Oil Back-up Pump (25 hp) 3 Hours PCE LCI Drives (10.875kW) 2 Hours 23 of 31 IPEC00035955 IPEC00035955

IP3 FSAR UPDATE TABLE 8.2-3 ENGINEERED SAFEGUARDS COMPONENTS, AUXILIARY FEEDWATER AND COMPONENT COOLING SYSTEMS INITIATION, CONTROL & SEQUENCING SCHEMATICS LIST Drawing No. Sheet No. Revision No.

5008971 5 3 6 1 7 2 9 3 10 2 11 8 12 4 13 4 14 4 27 7 28 7 29 9 31 8 32 7 33 8 34 7 37 6 40 8 42 7 44 6 45 8 46 7 47 6 48 6 51 4 70 7 75 10 76 7 78 7 79 4 85 4 89 9 90 6 91 10 92 5 93 7 94 3 95 7 96 9 96A 2 968 o 97 5 98 10 99 9 24 of 31 IPEC00035956 IPEC00035956

IP3 FSAR UPDATE TABLE 8.2-3 (Cant.)

ENGINEERED SAFEGUARDS COMPONENTS, AUXILIARY FEEDWATER AND COMPONENT COOLING SYSTEMS INITIATION, CONTROL & SEQUENCING SCHEMATICS LIST Drawing No. Sheet No. Revision No.

105 8 106 10 107 4 108 6 110 15 111 11 112 15 113 13 114 10 115 6 116 9 117 15 117A 1 1178 1 119 7 119A 1 120 4 121 3 122 5 123 9 124 2 124A 1 1248 1 124C 1 1240 3 124E o 125 3A 125A 4 1258 4 126 5 127 5 128 4 129 5 130 6 131 7 132 7 132A o 133 6 134 7 135 4 136 6 137 8 138 8 139 8 140 8 25 of 31 IPEC00035957 IPEC00035957

IP3 FSAR UPDATE TABLE 8.2-3 (Cant.)

ENGINEERED SAFEGUARDS COMPONENTS, AUXILIARY FEEDWATER AND COMPONENT COOLING SYSTEMS INITIATION, CONTROL & SEQUENCING SCHEMATICS LIST Drawing No. Sheet No. Revision No.

141 7 152 3 153 5 154 5 155 4 160 7 183 9 209 1 210 1 211 2 113 E 301 4 7 5 7 113 E 302 1 13 2 10 3 7 113 E 303 1 21 2 6 3 9 4 20 5 10 6 11 7 13 8 8 9321-LL-31313 10 13 13 4 15 8 15A 9 9321-LL-31343 3 14 7 14 9321-LL-31333 1 3 2 5 3 4 4 4 6 6 9 4 11 3 14 5 15 4 26 of 31 IPEC00035958 IPEC00035958

IP3 FSAR UPDATE TABLE 8.2-3 (Cant.)

ENGINEERED SAFEGUARDS COMPONENTS, AUXILIARY FEEDWATER AND COMPONENT COOLING SYSTEMS INITIATION, CONTROL & SEQUENCING SCHEMATICS LIST Drawing No. Sheet No. Revision No.

9321-LL-31173 1 9 2 9 3 12 4 10 5 14 6 12 68 o 7 8 8 11 10 5 12 5 13 10 14 12 18 7 19 5 20 1 9321-LL31183 1 5 2 9 3 10 4 12 5 16 6 7 7 9 11 4 12 6 15 5 16 3 17 9 18 9 27 of 31 IPEC00035959 IPEC00035959

IP3 FSAR UPDATE 8.3 MINIMUM OPERATING CONDITIONS The minimum operating conditions for electrical systems are given in Sections 3.8.1 and 3.8.10 of the Technical Specifications.

8.4 CABLE AND PENETRATION SEPARATION The reactor protection and engineered safety system cable circuits are divided into as many channels as is required to preserve the basic redundancy and independence of the systems.

Channel separation is maintained as indicated below and is continuous from the sensors to the entrance to the receiver racks, logic cabinets, and actuation devices in such a manner that failure within a single channel is not likely to cause the loss of the basic protection system or cause a failure which would prevent actuation of the minimum safeguards devices when called for.

In general, this requires the use of four (4) protection system instrumentation channels (Section 7.2), three (3) heavy power channels, two (2) medium power channels and four (4) control channels. In addition to such channels of separation, cables are assigned to individual routing systems, in accordance with their voltage level, size and function, by means of a three digit circuit code identification.

The circuit code is broken down as follows:

FI RST CHARACTER - Voltage level B = heavy 6900V C = heavy 480V or DC D = control, misc. 120V ACIDC F = medium AC or DC power G = vibration pick-up H = rod control J = instrumentation SECOND CHARACTER - Channel A = Channell B = Channel II C = Channel III D = Channel IV E = Channel V THIRD CHARACTER - Category - cables required to be in a particular channel to provide separation of redundant circuits are assigned a circuit code whose description includes the channel identification. Non-vital cables of the same voltage level, which are routed in the same channel, are assigned one of the remaining circuit codes (e.g., a safety injection pump would be assigned CA 1, while a pressurizer heater would be assigned CA2. Both cables would be routed in the same tray where their paths are parallel).

There is no mixing of vital cables of the above categories in the same tray or conduit, except inside the containment building, where due to space limitations it becomes necessary to mix D and F (first character) cables of the same channel in the same tray. For the most part, these F cables are for valve motors which are less than ten (10) horsepower, and are energized only intermittently.

28 of 31 IPEC00035960 IPEC00035960

IP3 FSAR UPDATE Conduit fill for all systems is based on standard National Electric Code recommendations.

Tray fill for 6900 volt power cables is limited to one (1) layer of cables. Tray fill for heavy 125 volt DC power cables, heavy 480 volt AC (over 100 hp) power cables, lighting panel feeders and medium power (greater than No. 12 AWG wire size) 480 volt AC cables is limited to two (2) layers of cables. Cables included for control and light power are 120 volt AC and DC control and power cables, alarm, communication, instrument transformer, and 480 volt AC power cables. In most cases, these cables are a maximum of No. 12 AWG wire size. Tray fill limitation for control and small power cables is that total cross sectional area of cables will not exceed 60% of the tray's cross sectional area. Exceptions occur where a larger wire size has been used to limit voltage drop on long runs.

Separation of channels is established throughout the plant by the use of separate trays or conduit (exceptions are documented and justified in Reference 1). In addition, whenever in a heavy power tray is located less than three (3) feet beneath any tray of a different channel a transite or marinite fire barrier is installed between the trays. A vertical barrier is installed where trays of different channels are installed less than one (1) foot apart, horizontally.

Additionally, a horizontal barrier is installed where trays (other than heavy power) are installed less than one (1) foot beneath any tray of a different channel.

Fire retardant barriers have been installed between cable trays carrying cables for safety related pumps. Isolating switches are provided for fire protection of the control circuits of Diesel Generator No. 31, the control circuits for feeder breakers to 480 volt buses 2A and 3A and the tie breaker between the two buses. Safety related instrumentation have isolation switches and alternate power supplies for fire protection.

In some areas of the turbine-generator building, separation between D, F, and J cables of the same channel is by means of a 16-gauge sheet metal barrier, 4" high, within the tray. The barriers are used as a means of providing a continuous identifiable route of a given voltage level. Raceways in the turbine hall were laid out and installed specifically for the Low Pressure Steam Dump System. Among the cables in these raceways are those associated with the overspeed protection systems. The bypass system was designed to nuclear protection system criteria of redundancy, separation and reliability.

The electrical tunnels, which run from the control building past the primary auxiliary building, to the containment penetration vault, consist of two (2) concrete conduits located one above the other. Both the upper and lower tunnels are eight feet wide by eight feet high.

Channel separation in the tunnel is maintained by placing all Channel 1 trays on the left hand side of the upper tunnel (as viewed when facing north), and Channel 2 trays on the right hand side. Channel 3 and 4 trays are located on the left and right side of the lower tunnel respectively.

In the lower tunnel, two (2) 480 volt power feeders from bus 5A (to MCC 38 and to the Pressurizer Heater Backup Group 33) run with redundant cables from bus 2A. Also, one (1) 480 volt power feeder from bus 6A (to the Pressurizer Heater Control Group) runs with redundant cables from bus 3A. These feeders are not redundant and may be run in any channel provided they remain in that channel throughout their route.

The electrical penetrations are in a single area, comprised of some sixty-four assemblies (including spares). The main group of assemblies (penetration canisters) are arranged four rows high, with each row separated from another row by three (3) feet. Each assembly in a row is spaced on approximately three (3) foot centers. Each assembly contains only one category of circuit, except D and F cables previously noted as running in the same tray will 29 of 31 IPEC00035961 IPEC00035961

IP3 FSAR UPDATE also be in the same assembly. The various penetration canisters consist of units of #12 AWG, shielded twisted pairs, shielded twisted quads, #8 AWG, #2 AWG, 250 MCM, 350 MCM, triax and coax.

The penetrations are capable to withstand short circuit currents under worst case operating conditions, and to maintain their pressure boundary integrity until either the primary protection (for safety related circuits) or backup protection (for safety or non-safety related circuits) protective devices operate.

As may be seen on Plant Drawing 9321-F-30533 [Formerly Figure 8.4-1], the canisters are arranged according to separation channels, and those canisters identified by a given channel will carry only cables whose entire route are of the same channel.

In general, the separation between redundant or channelized circuits is expected to be greater than the spacing between two adjacent assemblies. However, some channels are in adjacent units and free air spacing can be expected to be twenty-eight inches or more at the face of the penetration. The control, instrument, and small power assemblies are furnished with factory installed pigtails. The cable spreading and penetration areas are in a concrete vault.

The four (4) channels of nuclear instrumentation sensor cables are in individual conduits, which are supposed from the ceiling of the two tunnels, above the trays of the same channel.

Fire Protection for the electrical system is as described in Sections 8.22 and 9.6.2.

References

1) NSE 94-3-124 ED. Revision 0, "Evaluation of Cable Channelization Deficiencies."

8.5 TESTS AND INSPECTIONS The tests discussed in this Section are designed to demonstrate that the Diesel Generators will provide power for operation of equipment. They also assure that the emergency generator system controls and the control systems for safeguards equipment will function automatically in the event of a loss of all normal 480 volt AC station service power.

The testing frequency dictated by the Technical Specifications provides for testing often enough to identify and correct deficiencies to systems under test before they can result in a system failure. The fuel supply and starting circuits and controls are continuously monitored and any faults are indicated by alarms. An abnormal condition in these systems would be signaled without having to place the Diesel Generators themselves on test.

To verify that the emergency power system does respond properly and within the required time limit when required, the following tests are performed periodically:

a) Manually initiated demonstration of the ability of the Diesel Generators to start, and deliver power up to name plate rating, when operating in parallel with other power sources. Normal plant operation will not be affected. The duration of the test shall be at least one hour to at least 50% of continuous rating.

b) Demonstration of the readiness of the system and control systems of vital equipment to automatically start or restore to operation particular vital equipment by initiating an actual loss of all normal AC station service power supplies. This test is conducted as dictated by the Technical Specifications.

30 of 31 IPEC00035962 IPEC00035962

IP3 FSAR UPDATE The starting of the diesel-generator sets can be tested from the Diesel Generator Building.

The ability of the units to start within the prescribed time and to carry intended loads is checked periodically.

To verify that the 480 V safeguards bus undervoltage alarms operate properly they shall be tested monthly and calibrated every 24 months.

In addition, each diesel generator shall be inspected and maintained following the manufacturer's recommendations for this class of standby service.

31 of 31 IPEC00035963 IPEC00035963

IP3 FSAR UPDATE CHAPTER 9 AUXILIARY AND EMERGENCY SYSTEMS 9.1 GENERAL DESIGN CRITERIA The General Design Criteria which apply to specific auxiliary and emergency systems are discussed in the appropriate system design section presented in this Chapter. The criteria which apply primarily to systems described in other Chapters of the FSAR are only stated, and cross-references are provided to identify the specific Chapter where the system is described and the general design criteria discussed.

The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Part 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

9.1.1 Related Criteria Reactivity Control Systems Malfunction Criterion: The reactor protection systems shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits. (GDC 31 of 7/11/67)

As described in Chapter 7, and justified in Chapter 14, the Reactor Protection Systems are designed to limit reactivity transients to the applicable DNBR limit due to any single malfunction in the deboration controls.

Engineered Safety Features Performance Capability Criterion: Engineered Safety Features such as the emergency core cooling system and the containment heat removal system shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public. (GDC 41 of 7/11/67)

Each of the auxiliary cooling systems which serve an emergency function provide sufficient capability in the emergency operational mode to accommodate any single failure of an active component and still function in a manner to avoid undue risk to the health and safety of the public.

Containment Heat Removal Systems 1 of 176 IPEC00035964 IPEC00035964

IP3 FSAR UPDATE Criterion: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure this system shall perform its required function, assuming failure of any single active component. (GDC 52 of 7/11/67)

Each of the auxiliary cooling systems which serves an emergency function to prevent exceeding containment design pressure, provides sufficient capability in the emergency operational mode to accommodate any single failure of an active component and still perform its required safety function.

9.2 CHEMICAL AND VOLUME CONTROL SYSTEM The Chemical and Volume Control System performs the following functions: 1) adjusts the concentration of the chemical neutron absorber for chemical reactivity control, 2) maintains the proper water inventory in the Reactor Coolant System, 3) provides the required seal water flow for the reactor coolant pump shaft seals, 4) maintains the proper concentration of corrosion inhibiting chemicals in the reactor coolant and 5) maintains the reactor coolant and corrosion product activities to within design levels. The system is also used to fill and hydrostatically test the Reactor Coolant System.

During normal operation, this system also has provisions for supplying the following chemicals:

a) Regenerant chemicals to the deborating demineralizers b) Hydrogen to the volume control tank c) Nitrogen as required for purging the volume control tank d) Hydrazine and Lithium Hydroxide, as required, via the chemical mixing tank to the charging pumps suction.

9.2.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has since completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Redundancy of Reactivity Control Criterion: Two independent reactivity control systems, preferably of different principles, shall be provided. (GDC 27 of 7/11/67) 2 of 176 IPEC00035965 IPEC00035965

IP3 FSAR UPDATE In addition to the reactivity control achieved by the Rod Cluster Control (RCC), as detailed in Chapter 7, reactivity control provided by the Chemical and Volume Control System which regulates the concentration of boric acid solution neutron absorber in the Reactor Coolant System. The system is designed to prevent, under anticipated system malfunction, uncontrolled or inadvertent reactivity changes that might cause system parameters to exceed design limits.

Reactivity Hold-Down Capability Criterion: The reactivity control systems provided shall be capable of making the core subcritical under credible accident conditions with appropriate margins for contingencies and limiting any subsequent return to power such that there will be no undue risk to the health and safety to the public. (GDC 30 of 7/11/67)

Normal reactivity shutdown capability is provided by control rods, with boric acid injection used to compensate for the long term xenon decay transient and for plant cooldown. Any time that the plant is at power, the quantity of boric acid retained in the boric acid tanks and ready for injection will always exceed that quantity required for the normal cold shutdown. This quantity will always exceed the quantity of boric acid required to bring the reactor to hot shutdown and to compensate for subsequent xenon decay.

The boric acid solution is transferred from the boric acid tanks by boric acid pumps to the suction of the charging pumps which inject boric acid into the reactor coolant. Any charging pump and boric acid transfer pump can be operated from diesel generator power on loss of offsite AC power. Using either one of the two boric acid transfer pumps, in conjunction with any of the three charging pumps, the RCS can be borated to hot shutdown even with the control rods fully withdrawn. Additional boration would be used to compensate for xenon decay. At a minimum CVCS design boration rate of 132 ppm/hr, the boron concentration required for cold shutdown can be reached well before xenon decays below its pre-shutdown level.

The RWST is a suitable backup source for emergency boration. When two charging pumps are used to transfer borated water from the RWST to the reactor coolant, the boron concentration required for cold shutdown can be reached before xenon decays below its full-power pre-shutdown level.

On the basis of the above, the injection of boric acid is shown to afford backup reactivity shutdown capability, independent of control rod clusters which normally serve this function in the short term situation. Shutdown for long term and reduced temperature conditions can be accomplished with boric acid injection using redundant components.

Reactivity Hot Shutdown Capability Criterion: The reactivity control system provided shall be capable of making and holding the core subcritical from any hot standby or hot operating condition. (GDC 28 of 7/11/67)

The reactivity control systems provided are capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes.

The maximum excess reactivity expected for the core occurs for the cold, clean condition at the beginning of life of the initial core. The full length Rod Cluster Control (RCC) assemblies are divided into two categories comprising a control group and shutdown groups.

3 of 176 IPEC00035966 IPEC00035966

IP3 FSAR UPDATE The control group, used in combination with chemical shim provides control of the reactivity changes of the core throughout the life of the core at power conditions. This group of RCC assemblies is used to compensate for short term reactivity changes at power that might be produced due to variations in reactor power requirements or in coolant temperature. The chemical shim control is used to compensate for the more slowly occurring changes in reactivity throughout core life such as those due to fuel depletion and fission product buildup and decay.

Reactivity Shutdown Capability Criterion: One of the reactivity control systems provided shall be capable of making the core subcritical under any anticipated operating condition (including anticipated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margin should assure subcriticality with the most reactive control rod fully withdrawn. (GDC 29 of 7/11/67)

The reactor core, together with the reactor control and protection systems, is designed so that the minimum allowable DNBR is above the applicable limit located in the Core Operating Limits Report (COLR) and there is no fuel melting during normal operation including antiCipated transients.

The shutdown groups of RCC assemblies are provided to supplement the control group of RCC assemblies to make the reactor at least 1.3% subcritical (keff<O.99) following trip from any credible operating condition to the hot, zero power condition assuming the most reactive RCC assembly remains in the fully withdrawn position Sufficient shutdown capability is also provided to maintain the core subcritical for the most severe anticipated cooldown transient associated with a single active failure, e.g., accidental opening of a steam bypass or relief valve. This is achieved with a combination of control rods and automatic injection of borated water from the Refueling Water Storage Tank (RWST) by the Safety Injection System with the most reactive rod assumed to be fully withdrawn. Manually controlled boric acid addition is used to maintain the shutdown margin for the long term conditions of xenon decay and plant cooldown.

Codes and Classifications All pressure retaining components (or compartments of components) which are exposed to reactor coolant, comply with the following codes:

a) System pressure vessels - ASME Boiler and Pressure Vessel Code,Section III, Class C, including paragraph N-2113 b) System valves, fittings and piping - USAS B31.1, including nuclear code cases.

System integrity was ensured by conformance to applicable code listed in Table 9.2-1, and by the use of austenitic stainless steel or other corrosion resistant materials in contact with both reactor coolant and boric acid solutions.

The regenerative heat exchanger and the tube side of the excess letdown heat exchanger were designed as per ASME III, Class C. This designation is based on the following considerations:

4 of 176 IPEC00035967 IPEC00035967

IP3 FSAR UPDATE a) Two fail-closed air operated valves are installed in the line between the Reactor Coolant System and the regenerative heat exchanger shell side. Each of these valves are provided with an independent signal to trip closed on pressurizer low level.

b) Two fail-closed air operated valves are installed in the line between the Reactor Coolant System and the excess letdown let exchanger.

9.2.2 System Design and Operation The Chemical and Volume Control System, shown in Plant Drawings 9321-F-27363 and -27373

[Formerly Figures 9.2-1 and 92.. 2], provides a means for injection of control poison in the form of boric acid solution, chemical additions for corrosion control, and reactor coolant cleanup degasification. This system also adds makeup water to the Reactor Coolant System, reprocesses water letdown from the Reactor Coolant System, and provides seal water injection to the reactor coolant pumps.

Overpressure protective devices are provided for system components whose design pressure and temperature are less than the Reactor Coolant System design limits.

System discharges from overpresssure protective devices (safety valves) and system leakages are directed to closed systems. Effluents removed from such closed systems are monitored and discharged under controlled conditions.

The system design enables post-operational hydrostatic testing to applicable code test pressures. The relief valves are gagged during hydrostatic testing. The relief valves in systems that are hydrostatically tested after refueling operations are set at the system design pressure.

During plant operation, reactor coolant flows through the letdown line from the reactor coolant loop cold leg on the suction side of the pump and is returned to the same cold leg on the discharge side of the pump via a charging line. An alternate charging connection is provided to the hot leg of another loop. An excess letdown line is also provided.

Each of the connections to the Reactor Coolant System has an isolation valve located close to the loop piping. In addition, a check valve is located downstream of each charging line isolation valve. Reactor coolant entering the Chemical and Volume Control System flows through the shell side of the regenerative heat exchanger, where its temperature is reduced. The coolant then flows through a letdown orifice that reduces coolant pressure. The cooled, low pressure water leaves the Reactor Containment and enters the Primary Auxiliary Building where it undergoes a second temperature reduction in the tube side of the non-regenerative heat exchanger followed by a second pressure reduction by the low pressure letdown valve. After passing through one of the mixed bed demineralizers, where ionic impurities are removed, coolant flows through the reactor coolant filters and enters the volume control tank through a spray nozzle. This would be the preferred normal in-service line-up. However, temporary isolation of the inservice demineralizers not greater than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to support plant operation is acceptable provided that chemistry is maintained within acceptable parameters.

Hydrogen is automatically supplied, as determined by pressure control, to the vapor space in the volume control tank, which is predominantly hydrogen and water vapor. The hydrogen within this tank is, in turn, the supply source to the reactor coolant. Fission gases are 5 of 176 IPEC00035968 IPEC00035968

IP3 FSAR UPDATE periodically removed from the system by venting the volume control tank to the Waste Disposal System prior to a cold or refueling shutdown.

During normal operation, the volume control tank gas space will contain approximately 85-96 volume percent H2 (remainder is water vapor) and the holdup tank gas space from 0 to a maximum of 100 volume percent H2 the remainder is N2 and small amount of water vapor). The CVCS volume control tank, CVCS holdup tanks, and associated piping were all designed to accommodate up to 100% hydrogen in the vapor space. Flammable mixtures are precluded by excluding oxygen. The gas analyzer samples these vapor spaces automatically and alarms any sample point where an oxygen concentration of 2% is detected. Exclusion of O2 is accomplished by leak tight construction of tanks and piping systems and by always maintaining a positive pressure inside these tanks and piping systems.

From the volume control tank, the coolant flows to the charging pumps which raise the pressure above that in the Reactor Coolant System. The coolant then enters the Containment, passes through the tube side of the regenerative heat exchanger, and is returned to the Reactor Coolant System.

Demineralizer(s) loaded with Cation located downstream of the mixed bed demineralizers is used intermittently to control Cesium activity in the coolant and also to remove excess Lithium which is formed from BlO (n, ex) Li7 reaction.

Boric acid is dissolved in hot water in the batching tank to a concentration of approximately 12 percent by weight. The lower portion of the batching tank is jacketed to permit heating of the batching tank solution with low pressure steam. A transfer pump is used to transfer the batch to the boric acid tanks. Small quantities of boric acid solution are metered from the discharge of an operating transfer pump for blending with makeup water, as makeup for normal leakage, or for increasing the reactor coolant boron concentration during normal operation. Electric immersion heaters maintain the temperature of the boric acid tank solution high enough to prevent precipitation.

During plant startup, normal operation, load reductions and shutdowns, liquid effluents containing boric acid flow from the Reactor Coolant System through the letdown line and are collected in the holdup tanks. As liquid enters the holdup tanks, the nitrogen cover gas is displaced to the gas decay tanks in the Waste Disposal System through the waste vent header.

The concentration of boric acid in the holdup tanks varies throughout core life from the refueling concentration to essentially zero at the end of the core cycle. A recirculating pump is provided to transfer liquid from one holdup tank to another.

There are three identical CVCS holdup tanks. The liquid contents of one tank are normally being process by the Waste Disposal System while another tank is being filled. The third tank is normally kept empty to provide additional storage capacity when needed. Liquid effluent in the holdup tanks is processed as a batch operation. This liquid is pumped by the gas stripper feed pumps to the waste disposal system where it is processed and transferred to the monitor tanks for sampling.

Valves on all tanks leading to a common header are normally locked open to insure continuous venting. No provision is made to control the percentage of gases evolving from the liquid solution. However, an automatic gas analyzer is provided to monitor the concentrations of oxygen and hydrogen in the cover gas of tanks discharging to the radiogas vent header. Upon indication of a high oxygen level, an alarm sound to alert the operator.

6 of 176 IPEC00035969 IPEC00035969

IP3 FSAR UPDATE Subsequent handling of the monitor tanks is dependent on the results of sample analysis.

Discharge from the monitor tanks may be pumped to the primary water storage tank, returned to the holdup tanks for reprocessing or discharged to the environment with the condenser circulating water when within the allowable activity concentration as discussed in Chapter 11. If the sample analysis of the monitor tank contents indicates that it may be discharged safely to the environment, two valves must be opened to provide a discharge path. As the effluent leaves, it is continuously monitored by the Waste Disposal System liquid effluent monitor. If an unexpected increase in radioactivity is sensed, one of the valves in the discharge line to the condenser circulating water closes automatically and an alarm sounds in the Control Room.

The deborating demineralizer(s) can be used intermittently to control Cesium and Lithium during normal plant operation or Boron toward end of core life depending on the type of Resin resident within the demineralizer(s). For Cesium and Lithium control, the affected demineralizer will be loaded with Cation Resin. For Boron control, the affected demineralizer will be loaded with Anion resin. When the deborating demineralizers are in operation, the letdown stream passes from the mixed bed demineralizers and then through the deborating demineralizers and into the volume control tank after passing through the reactor coolant filter.

During plant cooldown, when the residual heat removal loop is operating and the letdown orifices are not in service, a flow path is provided to remove corrosion impurities and fission products. A portion of the flow leaving the residual heat exchangers passes through the non-regenerative heat exchanger, mixed bed demineralizers, reactor coolant filter and volume control tank. The fluid is then pumped, via the charging pump, through the tube side of the regenerative heat exchanger into the Reactor Coolant System.

Expected Operating Conditions Tables 9.2-2, 9.2-3, and 9.2-5 list the system performance requirements data for individual system components and reactor coolant equilibrium activity concentration. Table 9.2-4 supplements Table 9.2-5.

Reactor Coolant Activity Concentration The parameters which were used in the calculation of the reactor coolant fission product inventory, including pertinent information concerning the expected coolant cleanup flow rate and demineralizer effectiveness, are presented in Table 9.2-4. The results of the calculations are presented in Table 9.2-5. In these calculations defective fuel rods are assumed to be present at initial core loading and uniformly distributed throughout the core through the use of fission product escape rate coefficients.

The fission product activity in the reactor coolant during operation with small cladding defects* in 1% of the fuel rods was computed using the following differential equations:

For parent nuclides in the coolant, dNWi

--=D9 (

i NC i - I i+Rhi +

B' JNwi dt Bo-tB' for daughter nuclides in the coolant, 7 of 176 IPEC00035970 IPEC00035970

IP3 FSAR UPDATE dNwj ( . B' )

--= Dg f Nc f - I ] + Rh f + N wf + liN wi dt Bo-tB' where:

N = population of nuclide D = fraction of fuel rods having defective cladding R = purification flow, coolant system volumes per second

  • NOTE: fuel rods containing pinholes or fine cracks Bo = initial boron concentration, ppm B' = boron concentration reduction rate by feed and bleed, ppm per second h = removal efficiency of purification cycle for nuclide

= radioactive decay constant v = escape rate coefficient for diffusion into coolant Subscript C refers to core Subscript w refers to coolant Subscript i refers to parent nuclide Subscript j refers to daughter nuclide Tritium is produced in the reactor from ternary fission in the fuel, irradiation of boron in burnable absorbers and irradiation of boron, lithium and deuterium in the coolant. The parameters used in the calculation of tritium production rate are presented in Table 9.2-6.

Reactor Makeup Control The reactor makeup control consists of a group of instruments arranged to provide a manually pre-selected makeup composition to the charging pump suction header or the volume control tank. The makeup control functions are to maintain desired operating fluid inventory in the volume control tank and to adjust reactor coolant boron concentration for reactivity and shim control.

The boric acid batch integrator is one part of this instrument loop that consists of the flow transmitter, a flow-signal-to-pulse converter and the integrator itself. The integrator "counts" the flow pulses on a non-resettable digital register for all 12% boric acid solution handled by the reactor makeup control system ("automatic makeup" and "borate" modes of operation). Each one-tenth of a gallon is counted and registered. During the "borate" mode of operation, an additional register is active. This additional register counts the same flow pulses, compares them to a preset quantity, and stops the boration when the preset quantity is reached.

8 of 176 IPEC00035971 IPEC00035971

IP3 FSAR UPDATE The accuracy, in terms of total boric acid addition, is somewhat variable beyond the instrument accuracies because of the tolerance allowed in mixing the nominal 12% solution (i.e., 11-2/3%

to 13%). However, the absolute accuracy is unimportant since the first operating check on the reactor coolant boron concentration is the control rod position with final verification achieved through chemical analysis. The operation of the integrator is not intended to keep an accurate inventory of boron in the Reactor Coolant System. It merely provides relative indication as a guide to changes which are made between periodic chemical analysis of samples.

The boric acid blend system is furnished as a convenience for the operator and has no safety functions. The system is not required to operate during or following an accident. In the event of boric acid integrator malfunction, there are no safety related consequences.

Makeup for normal plant leakage is regulated by the reactor makeup control, which is set by the operator to blend water from the primary water storage tank with concentrated boric acid to match the reactor coolant boron concentration.

The makeup system also provides concentrated boric acid or primary water to increase or decrease the boric acid concentration in the Reactor Coolant System. To maintain the reactor coolant volume constant, an equal amount of reactor coolant at existing reactor coolant boric acid concentration is letdown to the holdup tanks. Should the letdown line be out of service during operation, sufficient volume exists in the pressurizer to accept the amount of boric acid necessary for cold shutdown. Additionally, the Reactor Coolant System volume "shrinks" by approximately 25% upon cooling down from the hot operating conditions to cold shutdown.

Makeup water to the Reactor Coolant System is provided by the Chemical and Volume Control System from the following sources:

a) The primary water storage tank, which provides water for dilution when the reactor coolant boron concentration is to be reduced b) The boric acid tanks, which supply concentrated boric acid solution when reactor coolant boron concentration is to be increased c) The refueling water storage tank, which supplies borated water for emergency makeup d) The chemical mixing tank, which is used to inject small quantities of solution when additions of hydrazine or pH control chemical are necessary.

The reactor makeup control is operated form the Control Room by manually preselecting makeup composition to the charging pump suction header or the volume control tank in order to adjust the reactor coolant boron concentration for reactivity control. Makeup is provided to maintain the desired operating fluid inventory in the Reactor Coolant System. The operator can stop the makeup operation at any time in any operating mode by remotely closing the makeup stop valves.

One primary water makeup and one boric acid transfer pump are normally aligned for operation on demand from the reactor makeup control system.

9 of 176 IPEC00035972 IPEC00035972

IP3 FSAR UPDATE A portion of the high pressure charging flow is injected into the reactor coolant pumps between the thermal barrier and the shaft seal so that the seals are not exposed to high temperature reactor coolant.

Part of the flow is the shaft seal leakage flow and the remainder enters the Reactor Coolant System through a labyrinth seal on the pump shaft. Parts of the shaft seal injection flow cools the lower radial bearing, and part passes through the seals and is cooled in the seal water heat exchanger, filtered, and returned to the volume control tank.

Seal water injection to the Reactor Coolant System requires a continuous letdown of reactor coolant to maintain the desired inventory. In addition, bleed and feed or reactor coolant are required for removal of impurities and adjustment of boric acid in the reactor coolant.

Automatic Makeup The "automatic makeup" mode of operation of the reactor makeup control provides boric acid solution preset to match the boron concentration in the Reactor Coolant System. The automatic makeup compensates for minor leakage of reactor coolant without causing significant changes in the coolant boron concentration.

Under normal plant operating conditions, the mode selector switch and makeup stop valves are set in the "Automatic Makeup" position. A preset low level signal from the volume control tank level controller causes the automatic makeup control action to open the makeup stop valve to the charging pump suction, open the concentrated boric acid control valve and the primary water makeup control valve. The flow controllers then blend the makeup stream according to the present concentration. Makeup addition to the charging pump suction header causes the water level in the volume control tank to rise. At a preset high level point, the makeup is stopped; the primary water makeup control valve closes, the concentrated boric acid control valve closes and the makeup stop valve to charging pump suction closes.

Dilution The "dilute" mode of operation permits the addition of a preselected quantity of primary water makeup at a preselected flow rate to the Reactor Coolant System. The operator sets the makeup stop valves to the volume control tank and to the charging pumps suction in the closed position, the mode selector switch to "dilute", the primary water makeup flow controller set point to the desired flow rate, and the primary water makeup batch integrator to the desired quantity.

If the dilution flow deviates +5 gpm from the preset flow rate, an alarm indicates the deviation.

Makeup water is added to the volume control tank by opening a makeup stop valve. Water in the volume control tank then goes to the charging pump suction header. Excessive rise of the volume control tank water level is prevented by automatic actuation (by the tank level controller) of a three-way diversion valve, which routes the reactor coolant letdown flow to the holdup tanks. When the preset quantity of primary water makeup has been added, the batch integrator causes the primary water makeup control valve to close.

For a discussion of the level of borated water in the Safety Injection System accumulators, sampling capabilities, and instrumentation, see Section 6.2.

Boration 10 of 176 IPEC00035973 IPEC00035973

IP3 FSAR UPDATE The "borate" mode of operation permits the addition of a pre-selected quantity of concentrated boric acid solution at a preselected flow rate to the Reactor Coolant System. The operator sets the makeup stop valves to the volume control tank and to the charging pump suction in the closed position, the mode selector switch to "borate," the concentrated boric acid flow controller set point to the desired flow rate, and the concentrated boric acid batch integrator to the desired quantity. Opening the makeup stop valve to the charging pumps suction shifts the selected boric acid transfer pump to fast pump speed, and the concentrated boric acid is added to the charging pump suction header. The total quantity added in most cases is so small that it has only a minor effect on the volume control tank level. When the preset quantity of concentrated boric acid solution has been added, the batch integrator causes the boric acid transfer pump to return to the slow speed and the concentrated boric acid control valve to close.

The operation of the boric acid transfer pumps and the transfer of concentrated boric acid from the boric acid tanks to the suction of the charging pumps is checked by flow meter FT-110 and/or the boric acid tank levels LT-106, LlT-106 for tanks No. 31 and LT-102, LlT-102 for tank No. 32.

The delivery of concentrated boric acid to the reactor coolant by the charging pumps is checked by flow meter FT-128 in the main charging line and the local flow indicators FI-115, 116, 143, 144 in the seal water supply line.

FT-110 is a magnetic flow meter operating on the "Hall Effect" principle. Instrument power is necessary for its operation. Its signal is both indicated and recorded in the Control Room.

The Boric Acid Storage tanks have been provided with the following instrument systems:

1. LT-1 02 and LT-1 06 llP transmitters using Nitrogen Bubbler for providing differential pressure that is proportional to Level in the tanks.
2. LE-102/ LlT-102 and LE-106 / LlT-106 Radar level measuring instrument. Signal from these devices are the same as from the llP transmitters.

Both systems produce the same level signal for local and CCR indication and therefore the indication and control/alarm function remains unchanged.

Although the preferred instrument will be the Radar level instrument system, either of the above two level instrument systems (i.e., Nitrogen llP instrument of the Radar level instrument) can be used for day-to-day operation. The llP instrument could also be used at the operator's discretion.

FT-128 is an electronic transmitter sensing flow by means of the differential pressure generated across an orifice. Instrument power is required for its operation. Two indicators are provided, one in the Control Room and one near the charging pumps.

F1-115, 116, 143 and 144 are the local differential pressure gauges sensing flow by means of the differential pressure generated across an orifice. These indicators are located outside the Containment and are self actuated (i.e., no power required).

The capability to add boron to the reactor coolant is sufficient so that no limitation is imposed on the rate of cooldown of the reactor upon shutdown. The maximum rates of boration and the equivalent coolant cooldown rates are given in Table 9.2-2. One set of values is given for the addition of boric acid from a boric acid tank with one transfer and one charging pump operating.

The other set assumes the use of refueling water but with two of the three charging pumps 11 of 176 IPEC00035974 IPEC00035974

IP3 FSAR UPDATE operating. The rates are based on full operating temperature at the end of the core life when the moderator temperature coefficient is most negative.

Administrative controls require that if one boric acid tank is out of service, the other boric acid tank must contain sufficient boric acid to bring the plant to a cold shutdown condition. In the event that one boric acid tank would have to be taken out of service, the operator would, prior to taking the one tank out of service, make certain that the remaining tank contained sufficient boric acid to meet cold shutdown requirements.

If unable to comply with administrative controls, the unit could then be placed in cold shutdown condition following normal cool down procedures as described in the plant operating instructions.

Alarm Functions The reactor makeup control is provided with alarm functions to call the operator's attention to the following conditions:

a) Deviation of primary water makeup flow rate from the control set point b) Deviation of concentrated boric acid flow rate from the control set point c) Low level (makeup initiation point) in the volume control tank when the reactor makeup control selector is not set for the automatic makeup control mode.

Charging Pump Control Three positive displacement, variable speed drive charging pumps are used to supply charging flow to the Reactor Coolant System.

The speed of each pump can be controlled manually or automatically. During normal operation, only one of the three pumps is automatically controlled. During normal operation, only one charging pump is operating and the speed is modulated in accordance with pressurizer level.

During load changes, the pressurizer level set point is varied automatically to compensate partially for the expansion or contraction of the reactor coolant associated with the Tavg changes.

Tavg compensates for power changes by varying the pressurizer level set points in conjunction with pressurizer level for charging pump control.

The level set points are varied between 20 and 60 percent of the adjustable range depending on the power level. Charging pump speed does not change rapidly with pressurizer level variations due to the reset action of the pressurizer level controller.

If the pressurizer level increases, the speed of the pump decreases; likewise, if the level decreases, the speed increases. If the charging pump on automatic control reaches the high speed limit, an alarm is actuated and a second charging pump is manually started. The speed of the second pump is manually regulated. If the speed of the charging pump on automatic control does not decrease and the second charging pump is operating at maximum speed, the third charging pump can be started and its speed manually regulated. If the speed of the charging pump on automatic control decreases to its minimum value, an alarm is actuated and the speed of the pumps on manual control is reduced.

12 of 176 IPEC00035975 IPEC00035975

IP3 FSAR UPDATE Components A summary of principal component design data is given in Table 9.2-3.

Regenerative Heat Exchanger The regenerative heat exchanger was designed to recover the heat from the letdown stream by reheating the charging stream during normal operation. This exchanger also limits the temperature at the letdown orifices during periods when letdown flow exceeds charging flow by a greater margin than at normal letdown conditions.

The letdown stream flows through the shell of the regenerative heat exchanger and the charging stream flows through the tubes. The unit is made of austentic stainless steel, and is of all-welded construction. The exchanger is designed to withstand 2000 step changes (instantaneous changes from initial to the final condition) in shell side fluid temperature from 130 F to 552.2 F during the design life of the unit.

Temperature gradients that exist as a result of the step change in fluid conditions were determined, and the design and stresses that result from this condition were considered.

Fatigue analysis results showed a usage factor much less than the 1.0 allowed by the ASME Code. The design considerations that minimize the effects of this service condition were proper design analysis and elimination of unnecessary excess metal thickness in various locations through the heat exchanger.

The in-service inspection program for verifying the equipment condition is discussed in Section 4.5.

Letdown Orifices One of the three letdown orifices controls the flow of the letdown stream during normal operation and reduces its pressure to a value compatible with the non-regenerative heat exchanger design. Two of the letdown orifices were designed to pass normal letdown flow.

The other orifice was designed to be used in conjunction with one normal letdown flow orifice for maximum purification flow at normal Reactor Coolant System operating pressure. The orifices are placed in and taken out of service by manual operation of their respective isolation valves.

One or both of the standby orifices may be used in parallel with the normally operating orifice in order to increase letdown flow when the Reactor Coolant System pressure is below normal.

This arrangement provides a full standby capacity for control of letdown flow. Each orifice is an austenitic pipe containing a bored corrosion and erosion resistant insert.

Non-Regenerative (Letdown) Heat Exchanger The non-regenerative heat exchanger cools the letdown stream to the operating temperature of the mixed bed demineralizers. Reactor coolant flows through the tube side of the exchanger while component cooling water flows through the shell. The letdown stream outlet temperature is automatically controlled by a temperature control valve in the component cooling water outlet stream. The unit is a multiple-tube pass heat exchanger. All surfaces in contact with the reactor coolant are austenitic stainless steel, and the shell is carbon steel.

13 of 176 IPEC00035976 IPEC00035976

IP3 FSAR UPDATE The letdown heat exchanger was designed in accordance with the ASME code requirements given in Table 9.2-1. The design parameters given in Table 9.2-3 and 9.2-4 were based on the following operating parameters:

Operating Parameter Normal Letdown Plant Heatup Shell Side Flow (Ibs/hr) 203,000 492,000 Tin (F) 95 95 Tout (F) 125 125 Tube Side Flow (Ibs/hr) 37,050 59,280 Tin (F) 295 371 Tout (F) 130 130 The consequences of a tube side rupture in this heat exchanger cannot have greater nuclear safety significance than the release of the contents of the volume control tank. The volume control tank safety significance is addressed in Chapter 14.

A shell break, resulting in loss of component cooling water, will require operator action to shut off the letdown flow after the volume control tank high temperature alarm is activated. An alternate letdown path from the Reactor Coolant System is provided in the event that the normal letdown path is inoperable. When the normal letdown line is not available, the normal purification path is also not in operation.

Therefore, this alternate condition would allow continued power operation for limited periods of time dependent on Reactor Coolant System chemistry and activity.

Monitors R-17a and R-17b* continuously monitor the component cooling loop for radiation indicative of a leak of reactor coolant from the components being cooled by component cooling water.

Mixed Bed Demineralizers Two flushable mixed bed demineralizers maintain reactor coolant purity. A Lithium-7 or hydrogen form cation resin and a hydroxyl form anion resin are initially charged to the demineralizers. Both forms of resin remove fission and corrosion products, and in addition, the reactor coolant causes the anion resin to be converted to the borate form. The resin bed in designed to reduce the concentration of ionic isotopes in the purification stream, except for cesium, yttrium, and molybdenum, by a minimum factor of 10.

Each demineralizer was sized to accommodate the maximum letdown flow. One demineralizer serves as a standby unit for use if the operating demineralizer becomes exhausted during operation.

The demineralizer vessels are made of austenitic stainless steel, and are provided with suitable connections to facilitate resin replacement when required. Local sample points are provided at the effluent pipe of each demineralizer. The vessels are equipped with a resin retention screen.

The resin retention screens were designed to withstand a differential pressure of 25 psi. Each 14 of 176 IPEC00035977 IPEC00035977

IP3 FSAR UPDATE demineralizer has sufficient capacity to enable refueling after operation for one core cycle with one percent defective fuel rods.

Failure of a mixed-bed demineralizer shell is not considered credible due to the following design features:

1) A pressure relief valve is located on the letdown line at a point upstream of the mixed-bed demineralizers. This relief valve has a relief set point of 200 psig
2) The mixed-bed demineralizers have a design pressure of 200 psig
3) The mixed-bed demineralizers were designed to ASME B&PV Code,Section III, Class C, which results in a significant margin of safety in the design.

However, should the very unlikely rupture of the shell occur as postulated, the contents of the demineralizer would be released to the shielded demineralizer room. Any radioactive gases thus introduced into this compartment are directed to the plant ventilation system and plant vent radiation monitors, thus providing indication to the control room personnel of the level of activity released from the plant. For conditions of high activity signaled from the stack gas monitor, additional air flow is provided for dilution purposes to reduce the concentration in the plant vent discharge (Section 9.8). Any liquids or solids released from the ruptured shell would be routed to the building sump tank through the installed floor drains. For this condition, the activity released from the ruptured shell is retained within the Waste Disposal System. Refer to Chapter 11 for a description of the Waste Disposal System and the installed shielding.

Recovery procedures would be dependent on the extent of shell rupture but, in all cases, releases from the plant are first sampled and analyzed prior to discharge.

  • NOTE: The measurement range of these monitors are given in Section 11.2 Cation Bed Demineralizer A flushable cation resin bed in the hydrogen form is located downstream of the mixed bed demineralizers and is used intermittently to control the concentration of Uthium-7 that builds up in the coolant from the B10 (n, a) U 7 reaction. The demineralizer also has sufficient capacity to maintain the Cesium-137 concentration in the coolant below 1.0 /-lc/cc with one percent defective fuel. The demineralizer would be used intermittently to control cesium.

The demineralizer is made of austenitic stainless steel and is provided with suitable connections to facilitate resin replacement when required. A local sample point is provided at the demineralizer effluent pipe. The vessel is equipped with a resin retention screen, designed to withstand a 25 psi differential pressure.

For the mixed-bed, cation-bed and deborating demineralizers, an upper limit for allowable pressure drop is, based on manufacturer recommendations, approximately 35 psi. This limit is required to preclude resin bed compaction and bead fracture. A maximum operating differential pressure of approximately 17 psi is specified to allow sufficient margin below this upper limit. A design differential pressure of 25 psi for the screens is considered adequate margin above the maximum operating pressure.

At the beginning of resin life, the pressure drop across the demineralizer at design flow is approximately 13 psi. The design basis was that resin bed fouling, and increased pressure drop 15 of 176 IPEC00035978 IPEC00035978

IP3 FSAR UPDATE occurs very slowly and that resin replacement, due to depletion (low DF) or high radioactivity, is required well before the maximum operating pressure is reached.

The resin retention screen is not a part of any system pressure boundary, its failure would not result in any radioactive release to the environment. The only result of such a failure would be the loss of resin from the demineralizer vessel. It is standard design practice to provide a filter downstream of any demineralizer to collect any resin that might be flushed out of the demineralizer. Therefore, even in the unlikely event of a failure of the resin retention screen, there would be no safety hazard.

Deborating Demineralizers If desired, one of the two deborating demineralizer(s) can be loaded with Cation Resin to support control of Cesium and Lithium within the Reactor Coolant System (RCS). As plant operation reaches end of core life condition, the deborating demineralizers may then be loaded with Anion Resin to support removal of boric acid from the RCS fluid.

The demineralizers are provided for use near the end of a core cycle, but can be used at any time. Hydroxyl form ion-exchange resin is used to reduce Reactor Coolant System boron concentration by releasing a hydroxyl ion when a borate ion is absorbed. Facilities are provided for regeneration. When regeneration is no longer feasible, the resin is flushed to the spent resin storage tank.

Each demineralizer is sized to remove the quantity of boric acid that must be removed from the Reactor Coolant System to maintian full power operation near the end of core life should the holdup tanks be full. A local sample point is provided at the demineralizer effluent pipe.

Resin Fill Tank The resin fill tank is used to charge fresh resin to the demineralizers. The line from the conical bottom of the tank is fitted with a dump valve and may be connected to anyone of the demineralizer fill lines. The demineralized water and resin slurry can be sluiced into the demineralizer by opening the dump valve. The tank, designed to hold approximately one-third the resin volume of one mixed bed demineralizer, is made of austenitic stainless steel.

Reactor Coolant Filter The reactor coolant filter is located downstream of the deborating demineralizers. This filter is located inside a shielded compartment, and a shield wall is also provided for maintenance personnel during filter cartridge change operations. Filter disassembly and cartridge handling tools were designed to limit personnel exposures to within the limits of 10 CFR 20.

The filter collects resin fines and particulates larger than 25 microns from the letdown stream.

The vessel is made of austenitic stainless steel and is provided with connections for draining and venting. Design flow capacity of the filter is equal to the maximum purification flow rate.

Disposable synthetic filter elements are used. Indications that determine when the reactor coolant filter should be replaced are: (1) a high pressure differential across the filter, (2) a set time limit after which the filter will be replaced, and (3) a portable radiation monitor reading that shows radiation in excess of established limits.

Volume Control Tank 16 of 176 IPEC00035979 IPEC00035979

IP3 FSAR UPDATE The volume control tank collects the reactor coolant surge water volume resulting from a change from zero power to full power that is not accommodated by the pressurizer. It also receives the excess coolant release caused by the dead band in the reactor control temperature instrumentation. Overpressure of hydrogen gas is maintained in the volume control tank to control the hydrogen concentration in the reactor coolant at 25 to 35 cc per kg of water (standard conditions).

A spray nozzle is located inside the tank on the inlet line from the reactor coolant filter. This spray nozzle provides intimate contact to equilibrate the gas and liquid phases. A remotely operated vent valve discharging to the Waste Disposal System permits removal of gaseous fission products that are stripped from the reactor coolant and collected in this tank.

The volume control tank also acts as a head tank for the charging pumps and a reservoir for the leakage from the reactor coolant pump controlled leakage seal. The tank is constructed of austenitic stainless steel.

Hydrogen is supplied to the volume control tank for the purpose of maintaining the reactor coolant hydrogen concentration, 25 to 35 cc/kg @ STP. Normal consumption was estimated to be less than 100 scf/day; startup from cold conditions will require 600 to 800 scf.

The source of hydrogen for the volume control tank is the hydrogen supply manifold (discussed in Chapter 11). A pressure reducing valve at the manifold reduces the hydrogen pressure to 100 psig (note that the hydrogen supply header has a relief valve sized to pass full flow from the manifold if the pressure reducing valve fails open) in the supply header. The supply header to the volume control tank is also equipped with a pressure regulator to control downstream pressure to 15 psig.

Leakage of hydrogen from the hydrogen supply manifold and rupture of the manifold piping is prevented by the following design features:

a) Use of class 152 piping (Schedule 40) which has a design pressure of 150 psig at 500 F in a system that operates at 15 to 100 psig and a maximum temperature of 127 F b) All-welded construction. Pneumatic or hydrostatic tests were performed on the completed system with a thorough examination for leaks. No other special tests were considered necessary c) All manual valves are bellows sealed and all pressure regulators are self-contained thereby eliminating any packing leaks.

In the unlikely event of any very small leakage of hydrogen into the volume control tank cubicle, buildup of hydrogen gas is prevented by the ventilation system in the building.

Leakage into the hydrogen piping is prevented by the fact that the pressure inside the piping is always greater than atmospheric.

Charging Pumps Three charging pumps inject coolant into the Reactor Coolant System. The pumps are the variable speed positive displacement type, and all parts in contact with the reactor coolant are 17 of 176 IPEC00035980 IPEC00035980

IP3 FSAR UPDATE fabricated of austenitic stainless steel or other material of adequate corrosion resistance. These pumps have mechanical packing followed by a leakoff to collect reactor coolant before it can leak to the outside atmosphere. Pump leakage is piped to the drain header for disposal. The pump design prevents lubricating oil from contaminating the charging flow, and the integral discharge valves act as check valves. A recirculation line from the discharge of the charging pumps to the volume control tank is provided. This recirculation line enables warmup running of the pumps against low discharge pressure prior to full load operation.

Warm-up running allows for any air that has accumulated in the pumps to be bled out and all internal gearing and bearings to be fully lubricated.

Each pump was designed to provide the normal charging flow and the reactor coolant pump seal water supply during normal seal leakage. Each pump is designed to provide rated flow against a pressure equal to the sum of the Reactor Coolant System normal maximum pressure (existing when the pressurizer power operated relief valve is operating) and the piping, valve and equipment pressure losses at the design charging flows. The capacity of the three charging pumps permits operation at normal charging line flow with one reactor coolant pump shaft seal operating normally while other reactor coolant pumps are operating with floating ring seal flow.

To reduce the hydraulic pulsations created by the positive displacement pumps, a pulsation stabilizer/separator is installed in the pump suction lines. The discharge line of the No. 33 charging pump is provided with a pulsation dampener to further reduce hydraulic pulsations.

Anyone of the three charging pumps can be used to hydrotest the Reactor Coolant System.

Chemical Mixing Tank The primary use of the chemical mixing tank is in the preparation of caustic solutions for pH control and hydrazine for oxygen scavenging.

The capacity of the chemical mixing tank was determined by the quantity of 35 percent hydrazine solution necessary to increase the concentration in the reactor coolant by 10 ppm.

This capacity is more than sufficient to prepare solution of pH control chemical for the Reactor Coolant System.

The chemical mixing tank is made of austenitic stainless steel.

Excess Letdown Heat Exchanger The excess letdown heat exchanger cools reactor coolant letdown flow until the flow rate is equal to the nominal injection rate through the reactor coolant pump labyrinth seal, if letdown through the normal letdown path is blocked. The unit is designed to reduce the letdown stream temperature from the cold leg temperature to 195 F. The letdown stream flows through the tube side and component cooling water is circulated through the shell side. All surfaces in contact with reactor coolant are austenitic stainless steel and the shell is carbon steel. All tube joints are welded. The unit was designed to withstand 2000 step changes in the tube fluid temperature from 80 F to the cold leg temperature.

Seal Water Heat Exchanger 18 of 176 IPEC00035981 IPEC00035981

IP3 FSAR UPDATE The seal water heat exchanger removes heat from two sources: reactor coolant pump seal water returning to the volume control tank and reactor coolant discharge from the excess letdown heat exchanger. Reactor coolant flows through the tubes and component cooling water is circulated through the shell side.

The tubes are welded to the tube sheet because leakage could occur in either direction, resulting in undesirable contamination of the reactor coolant or component cooling water. All surfaces in contact with reactor coolant are austenitic stainless steel and the shell is carbon steel.

The unit was designed to cool the excess letdown flow and the seal water flow to the temperature normally maintained in the volume control tank if all the reactor coolant pump seals are leaking at the maximum design leakage rate.

Seal Water Filter The filter collects particulates larger than 25 microns from the reactor coolant pump seal water return and from the excess letdown heat exchanger flow. The filter is designed to pass the sum of the excess letdown flow and the maximum design leakage from the reactor coolant pump floating ring seals. The vessel is constructed of austenitic stainless steel and is provided with connections for draining and venting. Disposable synthetic filter elements are used.

Seal Water Injection Filters Two filters are provided in parallel, each sized for the injection flow. They collect particulates larger than 5 microns from the water supplied to the reactor coolant pump seal.

Boric Acid Filter The boric acid filter collects particulates larger than 25 microns from the boric acid solution being pumped to the charging pump suction line. The filter is designed to pass the design flow of two boric acid pumps operating simultaneously. The vessel is constructed of austenitic stainless steel and the filter elements are disposable synthetic cartridges. Provisions are available for venting and draining the filter.

Boric Acid Tanks The boric acid tank capacities are sized to store sufficient boric acid solution for a cold shutdown shortly after full power operation is achieved following a refueling shutdown. The most reactive RCC is assumed completely withdrawn. One tank supplies boric acid for reactor coolant makeup while recycled solutions form the concentrates holding tank is accumulated in the other tank.

The concentration of boric acid solution in storage is maintained between 11.5 and 13% by weight. Periodic manual sampling and corrective action are provided, if necessary, to ensure that these limits are maintained. Therefore, measured quantities of boric acid solution can be delivered to the reactor coolant to control the chemical poison concentration. The combination overflow and breather vent connection has a water loop seal to minimize vapor discharge during storage of the solution. The tank is constructed of austenitic stainless steel.

19 of 176 IPEC00035982 IPEC00035982

IP3 FSAR UPDATE For cold shutdown purposes, there must be a minimum of 6100 gallons of boric acid solution available in the boric acid tank. The operator is alerted to an approach to the cold shutdown level in either tank by a low level alarm in each tank corresponding to 45% level (about 3800 gallons). It is, however, optional whether the operator chooses to operate normally above the low level alarm in both tanks.

The Boric Acid Storage tanks have been provided with the following instrument systems:

1. LT-102 and LT-106 llP transmitters using Nitrogen Bubbler for providing differential pressure that is proportional to Level in the tanks.
2. LE-102/L1T-102 and LE-106/L1T-106 Radar level measuring instrument. Signal from these devices are the same as from the llP transmitters.

Both systems produce the same level signal for local and CCR indication and therefore the indication and control I alarm function remains unchanged.

Although the preferred instrument will be the Radar level instrument system, either of the above two level instrument systems (i.e., Nitrogen llP instrument of the Radar level instrument) can be used for day-to-day operation. The llP instrument could also be used at the operator's discretion.

This indication is provided on the Chemical and Volume Control System supervisory panel in the Control Room.

The low level condition is audibly annunciated in the Control Room with the annunciator drop located on the same panel.

Boric Acid Tank Heaters Each boric acid tank has two 100% capacity electric heaters that are connected in parallel and controlled from a single controller, a single temperature sensing controller and a single temperature sensing device (TIC-107 in tank No. 31 and TIC-103 in tank No. 32). They are powered by a single source. The heaters maintain the boric acid solution at 170°F (temperature range of 165°F to 175°F), thus ensuring a temperature in excess of the solubility limit (for 20,000 ppm boron this is 130°F). The heaters are shielded in austenitic stainless steel.

TIC-107 (and TIC-103) are "filled system" temperature devices. The instrument mechanism is connected to the thermal bulb in the tank by a capillary. Thermal expansion of the full fluid is converted into a motion that:

1) Controls the local indicating pOinter directly
2) Controls an electronic transmitter
3) Controls the contacts used for controlling the tank heaters.

The local indicating pointer operates independently of any power source.

The electronic transmitter provides a signal to a control board indicator and to an alarm unit that provides audible and visual low alarm in the Control Room.

The contacts which control the heaters operate through an internal relay. Loss of instrument power will cause a low alarm and turn the heaters on and will cause the remote indicator to give minimum temperature readings. Since the meter is calibrated from 50 to 200°F, an erroneous reading is obvious to the operator.

20 of 176 IPEC00035983 IPEC00035983

IP3 FSAR UPDATE Batching Tank The batching tank is used to prepare solutions of boric acid for filling the boric acid tanks. The tank is provided with a steam jacket for heating the tank contents and an agitator to improve mixing during operations. The steam jacket was designed to heat a batch (approximately 300 gallons) of 12 weight percent boric acid from 32°F to 165°F in 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. Steam is supplied at 250°F and 15 psig. Although no design code applies, the jacket and tank were both fabricated by code-qualified welders (ASM E Section IX).

The batching tank was sized to hold one week's makeup supply of boric acid solution for the boric acid tank. The basis for makeup was a reactor coolant leakage of Yz gpm at beginning of core life. The tank may also be used for solution storage, and a transfer system for accumulator makeup is provided from this tank. Refer to Section 6.2 for details of this makeup system. A local sampling point is provided for verifying the solution concentration prior to transferring it to the boric acid tank or for draining the tank. The tank manway is provided with a removable screen to prevent entry of foreign particles.

Boric Acid Transfer Pumps Two 100% capacity, 2-speed centrifugal pumps are used to circulate or transfer chemical solutions. Redundancy is thus provided for the pumps to permit maintenance during operation of the plant. The pumps circulate boric acid solution through the boric acid tanks at the slow pump speed and inject boric acid into the charging pump suction header at the fast pump speed.

Although one pump is normally used for boric acid batching and transfer and the other for boric acid injection, either pump may function as standby for the other. At fast speed, each pump is capable of delivering boric acid to the charging pump suction header at flow rates that exceed the minimum required boration rate of 132 ppm/hr. All parts in contact with the solutions are austenitic stainless steel or other adequate corrosion-resistant material. When on slow speed, the pump continuously circulates boric acid within the transfer system to provide mixing of the boric acid.

The RWST is a suitable backup source for emergency boration. When two charging pumps are used to transfer borated water from the RWST to the reactor coolant, the boron concentration required for cold shutdown can be reached before xenon decays below its full-power pre-shutdown level.

The transfer pumps are operated either automatically or manually from the Control Room or from a local control center. The reactor makeup control operates one of the pumps automatically when boric acid solution is required for makeup or boration. Current indicators in the Control Room monitor each pump fast speed motor operation.

The pumps are covered by a well-insulated easily removable heated enclosure.

Thermostatically controlled electric strip heaters maintain a temperature well above the solubility limit of the 12% boric acid solution and prevent pump rotor biding form boric acid crystals.

The Boric Acid Transfer are tested quarterly to ensure their ability to function in the emergency boration mode. Flow indicator FI-916 was used prior to implementation of Reference 3 to provide indication of flow during quarterly operability testing. However, Reference 3 valved off 21 of 176 IPEC00035984 IPEC00035984

IP3 FSAR UPDATE the recirculation line (between the Boron Injection Tank and the Boric Acid Tanks), which contains FI-916, retiring it in place. Instead, Reference 3 installed ultrasonic flow transducer pair FE-197A and FE-197B in the common discharge header of the Boric Acid Transfer Pumps, to permit operability testing to continue. Testing entails recirculating concentrated boric acid from/to the Boric Acid Storage Tanks (BASTs). The flow transducers interface with microprocessor-based portable electronic equipment to provide flow indication during testing.

Boric Acid Blender The boric acid blender promotes thorough mixing of boric acid solution and reactor makeup water from the reactor coolant makeup circuit. The blender consists of a conventional pipe fitted with a perforated tube insert. The inner pipe carries the boric acid solution and the outer pipe transports the primary water. These pipes are manufactured and assembled in accordance with ANSI B16.11-1966. The design pressure and temperature are 150 psig and 250 F and the normal operating pressure and temperature are approximately 75 psig and 175 F. All material is austenitic stainless steel. The blender decreases the pipe length required to homogenize the mixture for taking a representative local sample.

Recycle Process Holdup Tanks Three holdup tanks contain the radioactive liquid that enters the tanks from the letdown line.

The liquid is released from the Reactor Coolant System during startup, shutdowns, load changes and from boron dilution to compensate for burnup. The contents of one tank are normally being processed by the Waste Disposal System while another tank is being filled. The third tank is normally kept empty to provide additional storage capacity when needed. Adequate protection against an internal vacuum condition in the tanks has been verified by the installation of pressure switches and actuation circuitry.

A level indicating system is provided for each CVCS holdup tank. Pneumatic differential pressure transmitters are mounted in a pipe loop external to the tanks.

The total liquid storage sizing basis for the holdup tanks is given in Table 9.2-3. The tanks are constructed of austenitic stainless steel.

Holdup Tank Recirculation Pump The recirculation pump is used to mix the contents of a holdup tank or transfer the contents of a holdup tank to another holdup tank. The wetted surface of this pump is constructed of austenitic stainless steel.

Gas Stripper Feed Pumps The two gas stripper feed pumps transfer water from the holdup tanks to the waste disposal system for processing. These canned centrifugal pumps are constructed of austenitic stainless steel.

Monitor Tanks 22 of 176 IPEC00035985 IPEC00035985

IP3 FSAR UPDATE Two monitor tanks are provided for storage of water processed by the Waste Disposal System.

When one tank is filled, the contents are analyzed and either reprocessed, discharged to the Waste Disposal System, or pumped to the primary water storage tank. Water from the Waste Holdup Tanks can be pumped to the demineralizer system. The demineralizer system consists of a shielded pre-filter/roughing demineralizer, a shielded main demineralizer, and a pump to deliver water to the monitor tanks. These tanks are stainless steel construction and contain a bladder in the air space above the stored liquid. (For a discussion of the Waste Disposal System refer to Section 11.1).

The bladder in the monitor tanks is made of nylon reinforced Buna-N. The expected shelf life (limiting factor) is approximately 10 years.

The most probable causes of failure are the following:

1) Overpressurization of the bladder caused by improper system operation. If air is not removed from the tank before initial filling and kept out of the liquid during operation, as with improper venting, several psi gas pressure under the bladder could conceivably cause failure of the bladder and/or tank.
2) Tank internals causing mechanical failure of the bladder. Improper design of internals could cause interference, and possible tearing of the bladder.

Failure of the bladder for any reason results in air contaminated primary makeup water. Fatigue failure, that is, cracking from folding and unfolding as the water level changes, is not expected.

The manufacturer stated that with greater than 10 years experience using this material for tank diaphragms, including use at several nuclear stations, there had been no reported failures from fatigue.

Although it is considered unlikely that the bladder material would fail in a manner that would generate pieces; if this were the case, clogging would occur in the tank outlet line, in a valve, or in the pump suction. However, there would be no significant impact on the plant's safety or operation since there are duplicate tanks and pumps. Clogging is detected by observation of no flow output from the monitor tank pump.

The monitor tank manways are moved periodically to allow for diaphragm inspection.

Monitor Tank Pumps Two monitor tank pumps discharge water from the monitor tanks. The pumps are sized to empty a monitor tank in approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The pumps are constructed of austenitic stainless steel.

Primary Water Storage Tank The primary water storage tank is used to store makeup water that is supplied from the monitor tanks and the water treatment plant. Makeup water form the tank discharges to the suction of the primary water makeup pumps. The tank is stainless steel, operates at atmospheric pressure and has a volume of 165,000 gallons.

23 of 176 IPEC00035986 IPEC00035986

IP3 FSAR UPDATE The primary water storage tank is insulated and freeze-protected by the auxiliary steam system.

The primary water storage tank lines which are exposed to the environment are electrically heat traced to protect them from freezing.

A tank high and low level alarm is provided for the storage tank.

These alarms have no control over level and are used only to inform the operator of tank conditions.

Primary Water Makeup Pumps Two primary water makeup pumps discharge from either the monitor tanks or the primary water storage tank. These pumps are used to feed dilution water to the boric acid blender and are also used to supply makeup water for intermittent flushing of equipment and piping.

Each pump is sized to match the maximum letdown flow. One pump operates continuously while the other pump is available for use on an as-needed basis. These pumps are constructed of austenitic stainless steel.

Electrical Heat Tracing Electrical heat tracing is installed under the insulation on all piping, valves, line-mounted instrumentation, and components normally containing concentrated boric acid solution. The heat tracing was designed to prevent boric acid precipitation due to cooling, by compensating for heat loss.

Exceptions are:

1) Lines that may transport concentrated boric acid but are subsequently flushed with reactor coolant or other liquid of low boric acid concentration during normal operation
2) The boric acid tanks, which are provided with immersion heaters
3) The batching tank, which is provided with a steam jacket
4) Boron injection tank (SIS) which is provided with immersion heaters. References 2 through 5 de-energized these heaters since they are no longer required because the concentrated boric acid contained in the tank heretofore, was replaced by refueling water, with nominally 2,500 ppm boron concentration.
  • NOTE: Technical Specifications Amendment 139 eliminates the requirement to maintain a boron injection tank and related heat tracing. (For a discussion of the Safety Injection System boron injection tank, refer to Section 6.2.)

All boric acid piping is provided with primary and redundant electrical tracings, in conjunction with insulation, to maintain the concentrated solution within a temperture range above the precipitation point and below 212°F when subjected continuously to an ambient temperature of D

40 F in still air.

Either tracing (primary of redundant) is capable of supplying enough heat to maintain these temperatures.

24 of 176 IPEC00035987 IPEC00035987

IP3 FSAR UPDATE The normal source of power for the tracing on the boric acid piping totaling 60 kW, is 480 volt motor control center No. 36A. This motor control center is powered from Diesel Generator No.

33 on loss of offsite power. In addition, all circuits can be manually switched to motor control center No. 36B, which is supplied, from Diesel Generator No. 32 under the same condition. The electric tank heaters in the boric acid tanks are supplied from motor control center No. 37, which can be manually switched to Diesel Generator No. 32 on power loss. The boron injection tank heaters (6 kW each) were supplied from motor control centers No. 36A and No. 36B.

Reference 3 de-energized those heat trace circuits on piping, which will no longer convey concentrated boric acid, notably those associated with the Boron Injection Tank (BIT).

Each individual pipe tracing circuit (excluding the boric acid storage tank overflow lines, boric acid storage tank sample lines and the instrumentation tubing associated with the boric acid transfer pumps and boric acid filter) has a local control cabinet containing operating and alarm devices as follows:

1) Operating Thermostat - A line thermostat with remote bulb temperature sensor. The bulb is strapped on the pipe underneath the insulation. This thermostat energizes the tracing when the pipe temperature falls below the low temperature operating set point and de-energizes the circuit on a temperature rise to the high temperature operating set point (these set pOints are lower than the desired temperature range because of the difference in temperature between the pipe exterior and the fluid inside the pipe).
2) Alarm Thermostat - A two-stage thermostat with remote bulb sensing device strapped on the pipe in the same area as the operating thermostat bulb. It is used to monitor the pipe temperature. A high-high temperature condition (i.e., above the high temperature operating set point but within 212°F) or a low-low temperature condition (i.e., below the low temperature operating set point but above the precipitation point) on any tracing circuit is indicated on a local annunciator panel in the Primary Auxiliary Building. In addition, this condition is alarmed on the main annunciator in the Control Room, as is loss of power to the local annunciator.
3) Test Circuit - A manually operated circuit consisting of test switch, current relay, and indicating light is used to monitor and insure the integrity of the de-energized redundant tracing, and to check the status of the operating tracing. Power for this circuit is supplied from the same source as the heat tracing circuit.

Failure of the operating tracing associated with the piping will result in a decrease in pipe temperature, and will alarm in the Control Room. Redundant tracing can be used to restore affected flow path. If temperature of the affected line decreases to less than 145°F, then this line will be deemed inoperable until either the primary or redundant system is placed in service with line temperature restored. Likewise, failure of any operating device in the local control cabinet will result in an alarm.

Spares are available so that any defective device can be replaced within one hour.

Heat tracing associated with the boric acid storage tank overflow lines are continuously energized and contain a test and alarm device as follows:

1) Alarm Thermostat - A thermostat with remote bulb sensing device strapped to the piping underneath the insulation. It is used to monitor the pipe temperature for a low temperature condition and is indicated on a local annunciator panel in the Primary 25 of 176 IPEC00035988 IPEC00035988

IP3 FSAR UPDATE Auxiliary Building. In addition, this condition is alarmed on the main annunciator in the Control Room.

2) Test Circuit - A manually operated circuit consisting of a test switch and an indication light is used to monitor and ensure the integrity of the de-energized redundant tracing, and to check the status of the operating tracing. Power for this circuit is supplied from the same source as the heat tracing circuit.

Failure of the operating tracing associated with the overflow lines will result in a decrease in pipe temperature, and will alarm in the Control Room. Redundant tracing can be used to restore affected flow path. If temperature of the affected line decreases to less than 145°F, then this line will be deemed inoperable until either the primary or redundant system is placed in service with line temperature restored.

Heat tracing associated with the boric acid storage tank sample lines and the instrumentation tubing associated with the boric acid transfer pumps and boric acid filter is continuously energized and contains an indication light to verify the operation of the heat tracing. The indication light issued to check the status of the operating tracing only.

Failure of the operating tracing associated with the boric acid storage tank sample lines and the instrumentation tubing of the boric acid transfer pumps and the boric acid filter will be detected by plant operators through observation of the heat trace indication lights and the response of the instrumentation. A failure of the heat tracing on any of these sample lines or pressure indicators does not impact any boric acid flow path necessary for the safe shutdown of the reactor.

Connection of the redundant tracing can be made once the failure is detected.

Valves Valves that perform a modulating function are equipped with two sets of packing and an intermediate leakoff connection that discharges to the Waste Disposal System. All other valves have stem leakage control. Globe valves are installed with flow over the seats when such an arrangement reduces the possibility of leakage. Basic material of construction is stainless steel for all valves except the batching tank steam jacket valves, which are carbon steel.

Isolation valves are provided at all connections to the Reactor Coolant system. Lines entering the Reactor Containment also have check valves inside the Containment to prevent reverse flow from the Containment. For a description of the valves, their identification numbers and a malfunction analysis refer to Table 9.2-7.

Relief valves are provided for lines and components that might be pressurized above design pressure by improper operation or component malfunction. Pressure relief for the tube side of the regenerative heat exchanger is provided by a spring loaded check valve installed around CH~AOV-204B which is designed to crack open when pressure under the seat exceeds reactor coolant pressure by 75 psi and fully open when pressure under the seat exceeds reactor coolant pressure by 200 psi.

For the active failure analysis of the Safety Injection System, the single failure analysis of the Containment Spray System, and the malfunction analysis of the Chemical and Volume Control System, see Section 6.2 and 6.3 and Table 9.2-7, respectively.

EiQLQg 26 of 176 IPEC00035989 IPEC00035989

IP3 FSAR UPDATE All chemical and Volume Control System piping handling radioactive liquid is austenitic stainless steel. All piping joints and connections are welded, except where flanged connections are required to facilitate equipment removal for maintenance and hydrostatic testing. Piping, valves, equipment and line-mounted instrumentation, which normally contain concentrated boric acid solution, are heated by electrical tracing to ensure solubility of the boric acid. Reference 3 permanently de-energized those heat trace circuits on piping and valves that will no longer convey concentrated boric acid, notably those associated with the BIT.

9.2.3 System Design Evaluation Availability and Reliability A high degree of functional reliability is assured in the CVCS by providing standby components where performance is vital to safety and by assuring fail-safe response to the most probable mode of failure.

Special provisions include duplicate heat tracing with alarm protection of lines, valves, and components normally containing concentrated boric acid.

The system has three high pressure charging pumps, each capable of supplying the normal reactor coolant pump seal and makeup flow.

The electrical equipment of the Chemical and Volume Control System is arranged so that multiple items receive their power from various 480 volt buses (see Plant Drawing 617F644

[Formerly Figure 8.2-4]). Each of the three charging pumps are powered from separate 480 volt buses. The two boric acid transfer pumps are also powered from separate 480 volt buses. One charging pumps and one boric acid transfer pump are capable of meeting cold shutdown requirements shortly after full-power operation. In cases of loss of AC power, a charging power and a boric acid transfer pump can be placed on the emergency diesels, if necessary.

Control of Tritium The Chemical and Volume Control System is used to control the concentration of tritium in the Reactor Coolant System. Essentially all of the tritium is in chemical combination with oxygen as a form of water. Therefore, any leakage of coolant to the containment atmosphere carries tritium in the same proportion as it exists in the coolant. Thus, the level of tritium in the containment atmosphere, when it is sealed from outside air ventilation, is a function of tritium level in the reactor coolant, the cooling water temperature at the cooling coils, which determines the dew point temperature of the air, and the presence of leakage other than reactor coolant as a source of moisture in the containment air.

There are two major considerations with regard to the presence of tritium:

1) Possible plant personnel hazard during access to the Containment. Leakage of reactor coolant during operation with a closed containment causes an accumulation of tritium in the containment atmosphere. It is desirable to limit the accumulation to allow containment access for two hours per week for incore instrumentation maintenance.
2) Possible public hazard due to release of tritium to the environment.

Neither of these considerations is limiting for Indian Point 3.

27 of 176 IPEC00035990 IPEC00035990

IP3 FSAR UPDATE Leakage Prevention Quality control of the material and the installation of the Chemical and Volume Control System valves and pipings that are designated for radioactive service is provided in order to eliminate leakage to the atmosphere. The components designated for radioactive service are provided with welded connections to prevent leakage to the atmosphere. However, flanged connections are provided in each charging pump suction and discharge, on each boric acid pump suction and discharge, on the relief valves inlet and outlet, on three-way valves and on the flow meters to permit removal for maintenance.

The positive displacement charging pumps stuffing boxes are provided with leakoffs to collect reactor coolant before it can leak to the atmosphere. All valves that are larger than 2 inches and that are designated for radioactive service at an operating fluid temperature above 212°F are provided with a stuffing box and lantern leakoff connections. Leakage to the atmosphere is essentially zero for these valves. All control valves are either provided with stuffing box and leakoff connections or are totally enclosed. Leakage to the atmosphere is essentially zero for these valves.

Diaphragm valves are provided where the operating pressure and the operating temperature permit the use of these valves. Leakage to the atmosphere is essentially zero for these valves.

Incident Control The letdown line and the reactor coolant pumps seal water line penetrate the Reactor Containment. The letdown line contains air-operated valves inside the Reactor Containment and two air-operated valves outside the Reactor Containment that are automatically closed by the containment isolation signal.

The reactor coolant pumps seal water return line contains one motor-operated isolation valve outside the Reactor Containment that is automatically closed by the containment isolation signal.

The four seal water injection lines to the reactor coolant pumps and the normal charging line are inflow lines penetrating the Reactor Containment. Each line contains double check valves inside the Reactor Containment to provide isolation if a break occurs in these lines outside the Reactor Containment.

Malfunction Analysis To evaluate system safety, failure or malfunctions were assumed concurrent with a Loss-of-Coolant Accident, and the consequences were analyzed and are presented in Table 9.2-7. As a result of this evaluation, it was concluded that proper consideration was given to station safety in the design of the system.

If a rupture were to take place between the reactor coolant loop and the first isolation valve or check valve, this incident would lead to an uncontrolled loss of reactor coolant. The analysis of Loss-of-Coolant Accidents is discussed in Chapter 14.

Should a rupture occur in the Chemical and Volume Control System outside the Containment, or at any point beyond the first check valve or remotely operated isolated valve, actuation of the valve would limit the release of coolant and assure continued functioning of the normal means 28 of 176 IPEC00035991 IPEC00035991

IP3 FSAR UPDATE of heat dissipation from the core. For the general case of rupture outside the Containment, the largest source of radioactive fluid subject to release is the contents of the volume control tank.

The consequences of such a release are considered in Chapter 14.

When the reactor is subcritical, i.e., during cold or hot shutdown, refueling and approach to criticality, the relative reactivity status (neutron source multiplication) is continuously monitored and indicated by FB3 counters and count rate indicators. Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate (approximately 480 ppm/hr), is slow enough to give ample time to start a corrective action (boron dilution stop and/or emergency boron injection) to prevent the core form becoming critical. The maximum dilution rate was based on the abnormal condition of two charging pumps operating at full speed delivering unborated makeup water to the Reactor Coolant System at a particular time during refueling when the boron concentration is at the maximum valve and the water volume in the system is at a minimum.

At least two separate and independent flow paths are available for reactor coolant boration, i.e.,

either of the charging line, or the reactor coolant pumps labyrinths. The malfunction or failure of one component will not result in the inability to borate the Reactor Coolant System. An alternate supply path is always available for emergency boration of the reactor coolant. As backup to the boration system, the operator can align the refueling water storage tank outlet to the suction of the charging pumps.

On loss of seal injection water to the reactor coolant pump seals, seal water flow may be re-established by manually starting a standby charging pump. Even if the seal water injection flow is not re-established, the plant can be operated indefinitely, since the thermal barrier cooler has sufficient capacity to cool the reactor coolant flow that would pass through the thermal barrier cooler and sealleakoff from the pump volute.

Boration during normal operation, to compensate for power changes, is indicated to the operator from two sources: (a) the control rod movement and (b) the flow indicators in the boric acid transfer pump discharge line. When the emergency boration path is used, two indications to the operator are available. The charging line flow indicator indicates boric acid flow since the charging pump suction is aligned to the boric acid transfer pump suction for this mode of operation. The change in boric acid tank level is another indication of boric acid injection.

Galvanic Corrosion The only types of materials that are in contact with each other in borated water are stainless steels, Inconel, Stellite valve materials and Zircaloy fuel element cladding. These materials have been shown(1) to exhibit only an insignificant degree of galvanic corrosion when coupled to each other.

For example, the galvanic corrosion of Inconel versus type 304 stainless steel resulting from high temperature tests (575°F) in lithiated, boric acid solution was found to be less than -20.9 mg/dm 2 for the test period of 8 days.

Further galvanic corrosion would be trivial since the cell currents at the conclusion of the tests were approaching polarization. Zircaloy versus type 304 stainless steel was shown to polarize at 180°F in lithiated boric acid solution in less than 8 days with a total galvanic attack of -3.0 mg/dm 2 .

29 of 176 IPEC00035992 IPEC00035992

IP3 FSAR UPDATE Stellite versus type 304 stainless steel was polarized in 7 days at 575°F in lithiated boric acid solution. The galvanic corrosion for this couple was -0.97 mg/dm 2 .

As can be seen from the tests, the effects of galvanic corrosion are insignificant to systems containing borated water.

9.2.4 Minimum Operating Conditions Minimum operating conditions are specified in plant administrative controls to assure adequate boration flow paths are available.

9.2.5 Tests and Inspections The minimum frequencies for testing, calibrating, and/or checking instrument channels for the Chemical and Volume Control System as well as the Boric Acid Transfer Pumps operability testing are dictated by administrative controls.

References

1) Sammarone, D. G., "The Galvanic Behavior of Materials in Reactor Coolants," WCAP 1844, August 1961.
2) Revised Feasibility Report for BIT Elimination for Indian Point Unit 3, dated July 1988 (Westi ng house).
3) Modification MOD 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I. "
4) Nuclear Safety Evaluation No. NSE 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I."
5) Classification CLAS 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I."
6) DELETED 30 of 176 IPEC00035993 IPEC00035993

IP3 FSAR UPDATE TABLE 9.2-1 CHEMICAL AND VOLUME CONTROL SYSTEM CODE REQUIREMENTS Regenerative heat exchanger ASME 111*, Class C Non-Regenerative heat exchanger ASME III, Class C, tube side ASM E VIII, shell side Mixed bed demineralizers ASME III, Class C Reactor coolant filter ASME III, Class C Volume control tank ASME III, Class C Seal water heat exchanger ASME III, Class C, tube side ASM E VIII, shell side Excess letdown heat exchanger ASME III, Class C, tube side ASM E VIII, shell side Chemical mixing tank ASME VIII Deborating demineralizers ASME III, Class C Cation bed demineralizers ASME III, Class C Seal water injection filters ASME III, Class C Holdup tanks ASME III, Class C Boric acid filter ASME III, Class C Piping and valves USAS B31.1**

NOTE:

  • ASME III - American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section III, Nuclear Vessels.
    • USAS B31.1 - Code for Pressure Piping, and special nuclear cases, where applicable.

31 of 176 IPEC00035994 IPEC00035994

IP3 FSAR UPDATE TABLE 9.2-2 CHEMICAL AND VOLUME CONTROL SYSTEM PERFORMANCE REQUIREMENTS (1)

Plant design life, years 40 Seal water return flow rate, gpm 12 Normal letdown flow rate, gpm 75 Maximum letdown flow rate, gpm 120 Normal charging pump flow (one pump), pgm 87 Normal seal injection flow to reactor coolant pumps, gpm 32 Normal charging line flow, gpm 55 Maximum rate of boration with one transfer and one charging pump, ppm/min 24 Equivalent cooldown rate to above rate of boration, of/min 7.0 Maximum rate of boron dilution (maximum design letdown rate), ppm/hour 300 Two-pump rate of boration (using refueling water), ppm/min 7.4 Equivalent cooldown rate to above rate of boration, of/min 2.1 Temperature of reactor coolant entering system at full power, of 555.0 Temperature of coolant return to Reactor Coolant System at full power, of 505.0 Normal coolant discharge temperature to holdup tanks, of 127.0 Amount of 12% boric acid solution required to meet cold shutdown requirement 6100 shortly after full Power operation, gallons NOTE:

(1) Volumetric flow rates in gpm are based on 12rF and 15 psig.

Reactor coolant water quality is given in Table 4.2-2.

32 of 176 IPEC00035995 IPEC00035995

IP3 FSAR UPDATE TABLE 9.2-3 CHEMICAL AND VOLUME CONTROL SYSTEM PRINCIPAL COMPONENT DATA

SUMMARY

Design Heat Letdown Letdown Design Design Transfer Flow I Pressure TemQerature Quantity Btu/hr 1b/hr F psig, shell/tube :£ shell/tube Heat Exchangers 6

Regenerative 1 10.35 x 10 37050 249 2485/2735 650/650 Letdown 1 14.74 x 106 37050 253 150/500 200/400 Seal Water 1 2.88 x 106 159,000 14 150/150 200/250 Excess Letdown 1 3.8 x 106 9880 355 150/2485 200/650 Design Design CaQacity Head ft Pressure Temperature Quantity ~ 92!!! or psi ~ of Pumps Charging 3 Pos. Displ. 98 2500 psi 3000 250 Boric acid transfer 2 Centrifugal 75 235 ft 150 250 Hold up tank reci rculation 1 Centrifugal 500 195 ft 150 150 Primary water makeup 2 Centrifugal 150 235 ft 150 250 Monitor tank 2 Centrifugal 120 200 ft 150 150 Gas stri pper feed 2 Canned 25 320 ft 150 150 Design Design Pressure Temperature Quantity IvQg Volume Jllig of Tanks Volume control 1 Vertical 400 fe 75/15 250 Boric acid 2 Vertical 7000 gal atmos. 250

"'U Chemical mixing 1 Vertical 5.0 gal 150 250 m Batching 1 Jacket 400 gal atmos. 250

()

"'U o m o oo o eN o 01 33 of 176 o0) <D (J1 <D CD m CD (J)

IP3 FSAR UPDATE Btm.

Holdup 3 Vertical 8,500 fe 15 200 Primary water storage 1 Vertical 165,000 gal atmos. 150 Monitor 2 Diaphragm 10,000 gal atmos. 150 Resin Fill 1 Open 8 cu. ft.

Resin Design Design Volume Pressure Temperature Quantity IYQg fe Flow osia 01=

Demineralizers Mixed Bed 2 Flushable 30 120 200 250 Cation Bed 1 Flushable 12.0 40 200 250 Deborating 2 Flushable 30 120 200 250

"'U m

()

"U o m o oo o eN o 01 34 of 176 o0) <D (J1 <D CD -...J CD

-...,J

IP3 FSAR UPDATE TABLE 9.2-4 PARAMETERS USED IN THE CALCULATION OF REACTOR COOLANT FISSION PRODUCT ACTIVITIES

1. Core thermal power (maximum calculated), MWt 3280.3
2. Fraction of fuel containing clad defects 0.01
3. Reactor coolant liquid volume, fe 10,520
4. Reactor coolant average temperature, F 572
5. Purification flow rate (normal, minimum), gpm 45
6. Effective cation demineralizer flow, gpm 4
7. Volume control tank volumes
a. Vapor, fe 270
b. Liquid, fe 130
8. Fission product escape rate coefficients:
a. Noble gas isotopes, sec- 1 6.5 X 10-8
b. Br, I and Cs isotopes, sec- 1 1.3 X 10-8
c. Te isotopes, sec- 1 1.0 X 10-9
d. Mo, Te, and Ag isotopes, sec- 1 2.0 X 10-9
e. Sr and Ba isotopes, sec- 1 1.0x10-11
f. Y, Zr, Nb, Ru, Rh, La, Ce and Pr isotopes, sec- 1 1.6 X 10-12
9. Mixed bed demineralizer decontamination factors:
a. Noble gases and CS-134, 136, and 137 1.0
b. All other isotopes 10.0
10. Cation bed demineralizer decontamination factor

-u for Cs-134, 137, andRb-86 10.0 m

() 11. Volume control tank noble gas stripping fraction

-u o m o oo o eN o 01 35 of 176 o0) <D (J1 <D CD 00 CD CD

IP3 FSAR UPDATE (closed system):

Isotope Stripping Fraction Kr-83m 8.7E-01 Kr-85 1.3E-04 Kr-85m 7.5E-01 Kr-87 9.0E-01 Kr-88 8.1E-01 Kr-89 1.0E-01 Xe-131m 2.9E-02 Xe-133 6.4E-02 Xe-133m 1.4E-01 Xe-135 4.8E-01 Xe-135m 9.7E-01 Xe-137 9.9E-01 Xe-138 9.7E-01 "U

m

()

-u o m o oo o eN o 01 36 of 176 o0) <D (J1 <D CD <D CD CD

IP3 FSAR UPDATE TABLE 9.2-5 REACTOR COOLANT SYSTEM EQUILIBRIUM ACTIVITIES (572°F)

Activation Products uCi/g Cr-51 5.50E-03 Mn-54 1.60E-03 Mn-56 2. 00 E..,02 Fe-55 2.00E-03 Fe-59 5.20E-04 Co-58 1.56E-'02 Co-60 1.98E";03 Non-Volatile Fission Products (Continuous Full Power Operation) uCi/g uCi/g uCi/g Br-83 1.10E~01 Sr-90 4.90E-04 Te-127m 6.4BE-03 Br-84 5.10E-02 Sr-91 7.34E-03 Te-127 2.16E-02 Br-85 5.86E-03 Sr-92 1.43E-03 Te-129m 1.96E-02 1-129 1.45E~07 Y-90 1.68E-04 Te-129 2.08E-02 1-130 9.60E~02 Y-91m 4.09E-03 Te-131m 3.BOE-02 1-131 4.67E+OO Y-91 9.91E-04 Te-131 1.67E-02 1-132 3.18E+OO Y-92 1.36E-03 Te-132 4.68E-01 1-133 6.2BE+OO Y-93 4.B7E-04 Te-134 3.2BE-02 1-134 6.82E-01 Zr-95 1.09E-03 Ba-137m 4.19E+00 1-135 3.05E+OO Nb-95 1.09E-03 Ba-140 7.14E-03 Cs-134 8.82E+OO Mo-99 1.23E+00 La-140 2.95E-03 Cs-136 5.46E+OO Tc-99m 1.15E+00 Ce-141 1.10E-03 Cs-137 4.43E+OO Ru-103 1.09E-03 Ce-143 7.48E-04 Cs-138 1.08E+OO Rh-103m 1.0BE-03 Pr-143 1.07E-03 Rb-86 6.92E~02 Ru-106 5.71E-04 Ce-144 4.92E-04 Rb-88 4.48E+OO Rh-106 5.71E-04 Pr-144 4.92E-04 "U Rb-89 2.06E-01 Ag-110m 8.70E-03 m Sr-89 7.43E~03 Te-125m 2.01E-03

()

-u o m o oo o eN o (J) 37 of 176 o0) o (J) o o o o

o

IP3 FSAR UPDATE Gaseous Fission Products uCi/g Kr-83m 5.04E-01 Kr-85m 2.03E+OO Kr-85 1.37E+01 Kr-87 1.30E+OO Kr-88 3.81E+OO Kr-89 1.03E..,01 Xe-131 m 3.23E+OO Xe-133m 3.52E+OO Xe-133 2.4BE+02 Xe-135m 6.25E";01 Xe-135 9.56E+OO Xe-137 1.97E-01 Xe-138 7. 14E..,01 "U

m

()

-u 0 m 0 0 0 0 eN 0 (J) 38 of 176 0 0 0) 0 (J) 0

......

0

-"

IP3 FSAR UPDATE TABLE 9.2-6 CALCULATED TRITIUM PRODUCTION BASIC ASSUMPTIONS-Plant Parameters:

1. Core thermal power, Mwt 3216
2. Coolant water volume, fe 10,690
3. Core water volume, fe 684.5
4. Core water mass (grams) 1.45E+07
5. Plant full power operating times
a. Initial cycle 60 weeks (14 months)
b. Equilibrium 98 weeks (22.5 months)
6. Boron Concentrations (Peak hot full power equilibrium Xe)
a. Initial cycle, ppm 890
b. Equilibrium cycle, ppm 1,240
7. Burnable poison boron content (total-all rods), Ib 17.6
8. Fraction of tritium in core (ternary fission + burnable boron) diffusing thru clad Initial Cycle 0.30 (design value)

"U Equilibrium Cycle 0.10 (design value) m Equilibrium Cycle 0.02 (expected value)

()

-u o m o oo o eN o (J) 39 of 176 o0) o (J) o o tv o

N

IP3 FSAR UPDATE

9. Ternary fission yield 8 x 10-5 atoms/fission TRITIUM PRODUCTION AND RELEASE VALUES Design Expected Equilibrium Equilibrium A. Tritium from Core (Curies) Initial Cycle Cycle Value Cycle Value
1. Ternary Fission 11,450 22,280 22,280
2. B 10 (n, 2 a)1' (in 800 1,045 1,045 poison rods)
3. BIO(n, a) L/ 1,500 3,200 3,200 (n, na) T (in poison rods)
4. Release fraction xO.30 xO.10 xO.02
5. Total release to Coolant 4,125 2,653 531 B. Tritium from Coolant (Curies)
1. B IO (n,2a)T 1,130 1,013 1,013
2. Li 7 (n, na) T (limit 8.8 36.6 36.6 3.5 ppm Li, decreasing with Core Burnup for pH control)
3. Li 6 (n, a) T (purity of 8.8 286 286 "U Li7 = 99.9%)

m

()

-u o m o oo o eN o (J) 40 of 176 o0) o (J) o o eN o0)

IP3 FSAR UPDATE

4. Release Fraction (1.0)
5. Total Release to Coolant 1147.6 1,341 1,341 C. Total Tritium in Coolant (Curies) 5273 3,994 1,872 "U

m

()

-u o m o oo o eN o (J) 41 of 176 o0) o (J) o

.j:::o.

o o

.j::>.

IP3 FSAR UPDATE TABLE 9.2-7 MALFUNCTION ANALYSIS OF CHEMICAL AND VOLUME CONTROL SYSTEM Component Failure Comments and Consequences

1) Letdown line Rupture in the line inside The remote air-operated valves the Reactor Containment (LCV-459 & LCV-460) located near the main coolant loop are closed on low pressurizer level to prevent supplementary loss of coolant through the let down line rupture.

The containment isolation valves (201 & 202) in the letdown line outside the Reactor Containment and also the orifice block valves (200A, 200B, & 200C) are automatically closed by the containment isolation signal initiated by the concurrent Loss-of-Coolant Accident. The closure of these valves prevents any leakage of the reactor containment atmosphere outside the Reactor Containment.

2) Normal and alternate See above The check valves 21 OA & 201 B charging lines located near the main coolant loops prevent supplementary loss of coolant through the line rupture.

The check valve (374) located at the boundary of the Reactor Containment prevents any leakage of the reactor containment atmosphere outside the Reactor "U Containment.

m

()

-u o m o oo o eN o (J) 42 of 176 o0) o (J) o (J1 o

o(J1

IP3 FSAR UPDATE

3) Seal water return line See above The motor-operated isolation valve (222) located outside the Containment is manually closed or is automatically closed by the containment isolation signal initiated by the concurrent Loss-of-Coolant Accident. The closure of that valve prevents any leakage of the reactor containment atmosphere outside the Reactor Containment.

The safety analyses allow for failure of MOV-222 to close, due to the single failure of its associated electrical Bus on a Containment Isolation signal. In such a case, the accident analysis assumes leakage of 1.6 gph from Containment into the Primary Auxiliary.Building (PAB) for the first 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> of the accident.

This allows the operators time to manually close one of the other shutoff valves on the same line:

"U m

()

"U o m o oo o eN o (J) 43 of 176 o0) o (J) o (J) o o(J)

IP3 FSAR UPDATE 9.3 AUXILIARY COOLANT SYSTEM 9.3.1 Design Basis The Auxiliary Coolant System consists of three loops, as shown in Plant Drawings 9321-F-27203, and -27513 [Formerly Figures 9.3-1, 9.3-2A and 9.3-2B]; the component cooling loop, the residual heat removal loop, and the spend fuel pit cooling loop.

Performance Objectives Component Cooling Loop The component cooling loop was designed to remove residual and sensible heat from the Reactor Coolant System via the residual heat removal loop during plant shutdown, to cool the letdown flow to the Chemical and Volume Control System during power operation, and to provide cooling to dissipate waste heat from various primary plant components.

Active loop components which are relied upon to perform the cooling function are redundant.

Redundancy of components in the process cooling loop does not degrade the reliability of any stem which the process loop serves.

In order to ensure the long-term functioning of the Component Cooling Water System following a Loss-of-Coolant Accident, the system was designed to accommodate a single failure which may be either active or passive. The Component Cooling Water System is provided with two main headers. The cooling loads are divided between the two headers in such a manner as to ensure that each header is capable of supplying the necessary service to enable continued containment sump and core recirculation following a LOCA. To meet this requirement, one residual heat exchanger, one residual heat removal pump, one recirculation pump, and at least one high head pump are supplied from each header. Isolation valves are furnished to allow each loop to be isolated and operated as an independent component cooling loop. The loop design provides for detection of radioactivity entering the loop from the Reactor Coolant System and also provides for means for isolation.

Residual Heat Removal Loop The residual heat removal loop was designed to remove residual and sensible heat from the core and to reduce the temperature of the Reactor Coolant System during the second phase of plant cooldown. During the first phase of cooldown, the temperature of the Reactor Coolant System is reduced by transferring heat from the Reactor Coolant System to the Steam and Power Conversion system. All active loop components which are relied upon to perform their function are redundant.

The loop design provides means to detect radioactivity migration to the ultimate heat sink environment and includes provisions which permit adequate action for continued core cooling, when required, in the event that radioactivity limits are exceeded.

The loop design precludes any significant reduction in the overall design reactor shutdown margin when the loop is brought into operation for decay heat removal or for emergency core cooling by recirculation.

44 of 176 IPEC00036007 IPEC00036007

IP3 FSAR UPDATE The loop design includes provisions which enable periodic hydrostatic testing to applicable code test pressures.

Loop components, whose design pressure and temperature are less than the Reactor Coolant System design limits, are provided with overpressure protection devices and with redundant means of isolation. It is permissible to de-energize these devices with proper administrative controls to prevent inadvertent loss of RHR.

Spend Fuel Pit Cooling Loop The spent fuel pit cooling loop was designed to remove, from the spent fuel pit, the heat generated by stored spent fuel elements. Loop design incorporates redundant active components. Loop piping is so arranged that failure of any pipeline does not drain the fuel pit below the top of the stored fuel elements. The thermal design basis for the loop provides for a full core offload preceded by storage within the pool of 6 cores.

Design Characteristics Component Cooling Loop Two pumps and two component cooling heat exchangers are normally operated to provide cooling water for the components located in the Primary Auxiliary Building and the Containment Building. The water is normally supplied to all components being cooled even though one of the components may be out of service.

Primary makeup water is provided to the CCW Surge Tanks via the Primary Water System by manually opening valves AC-831A and AC-831 B as required. The boundary is at the upstream side of these isolation valves.

The operation of the loop is monitored with the following instrumentation:

a) Pressure detector on the lines between the component cooling pumps and the component cooling heat exchangers b) Temperature and flow indicators in the outlet line from the heat exchangers c) Radiation monitors in the outlet lines from the heat exchangers d) Temperature indicators on the main inlet lines to the component cooling pumps.

Residual Heat Removal Loop Two pumps and two residual heat exchangers perform the decay hat cooling functions for the reactor. After the Reactor Coolant System temperature and pressure have been reduced to between 250°F and 350°F and 400 psig, respectively, decay heat cooling is initiated by aligning the pumps to take suction from one reactor hot leg and discharge through the heat exchangers into the reactor cold legs. If only one pump and one heat exchanger are available, reduction of reactor coolant temperature is accomplished at a lower rate.

the equipment utilized for decay heat cooling is also used for emergency core cooling during Loss-of-Coolant Accident conditions as described in Section 6.2 45 of 176 IPEC00036008 IPEC00036008

IP3 FSAR UPDATE Spent Fuel Pit Cooling Loop The spent fuel pit pump and heat exchanger will handle the decay heat load from a partial core offload (which is defined as an offload which maintains the Spent Fuel Pit feat load below 17 x 106 BTU/hr) while maintaining the spent fuel pit water temperature below 150°F. With a full core discharge the water temperature is maintained below 200°F.

Codes and Classifications Those portions of the Component Cooling Water System 9including the system pumps and heat exchangers) shown on Plant Drawings 9321-F-27203 AND -27513 [Formerly Figures 9.3-1,9.3-2A and 9.3-28] which serve the residual heat removal pumps, recirculation pumps, residual heat exchangers and the high head safety injection pumps are considered safety related.

For an emergency shutdown situation (non LOCA), component cooling water is also required for the charging pumps. The charging pumps are needed to borate the reactor coolant and shutdown the reactor.

All piping and components of the Auxiliary Coolant System were designed tot he applicable codes and standards listed in Table 9.3-4. The component cooling loop water contains a corrosion inhibitor to protect the carbon steel piping. Austenitic stainless steel piping is used in the remaining piping systems which contain borated water without a corrosion inhibitor.

9.3.2 System Design and Operation Component Cooling Loop Component cooling is provided for the following heat sources:

a) Residual heat exchangers (Auxiliary Coolant System, ACS) b) Reactor coolant pumps (Reactor Coolant System, RCS) c) Non-regenerative heat exchanger (Chemical and Volume Control System CVCS) d) Excess letdown heat exchanger (CVCS) e) Seal water heat exchanger (CVCS) f) Sample heat exchangers (Sampling System and Radiation Monitoring) g) Waste gas compressors (WDS) h) Reactor vessel support pads i) Residual heat removal pumps (ACS) j) Safety injection pumps (Safety Injection System, SIS) k) Recirculation pump motors (SIS) 46 of 176 IPEC00036009 IPEC00036009

IP3 FSAR UPDATE I) Spent fuel pit heat exchanger (ACS) m) Charging pumps (CVCS).

At the reactor coolant pump, component cooling water removes heat from the bearing oil and the thermal barrier. Since the heat is transferred from the component cooling water to the service water, the component cooling loop serves as an intermediate system between the reactor coolant pump and service water cooling system. This double barrier arrangement reduces the probability of leakage of high pressure, potentially radioactive coolant to the Service Water System.

During normal, full power operation, two component cooling pumps and two component cooling heat exchangers accommodate the heat removal loads. One standby pump provides 50%

backup and a heat exchanger provides 100% backup during normal operation provided that service water flow is increased to the operating heat exchanger. Three pumps and two heat exchangers are utilized to remove the residual and sensible heat during plant shutdown. if one of the pumps or one of the heat exchangers is not operable, safe shutdown of the plant is not affected; however, the time for cooldown is extended.

Two surge tanks, one for each header, accommodate expansion, contraction and inleakage of water, and ensure a continuous component cooling water supply until a leaking cooling line can be isolated. The tanks are vented to the waste holdup tanks, and a high radiation alarm actuates in the control room in the unlikely event of gross inleakage to the component cooling system.

A non-Chromate based corrosion inhibitor is added to the Component Cooling water system.

This inhibitor contains a compound for corrosion control on non-ferrous materials.

The fluorides are kept below 0.15 ppm each, chlorides are kept below 150 ppm, and the makeup is of reactor coolant water quality. Experience at other operating plants has shown that sodium molybdate corrosion inhibitors as a whole are effective in controlling corrosion of carbon, alloy and stainless steel.

Assurance of proper component cooling water chemistry is provided through periodic sampling.

The Component Cooling Water is sampled and analyzed at least monthly for gross activity, corrosion inhibitor and pH. The maximum time between analyses is 45 days.

Residual Heat Removal Loop The residual heat removal loop, as shown in Plant Drawing 9321-F~27363and -27513 [Formerly Figures 9.2-1 and 9.3-2A] consists of heat exchangers, pumps, piping and the necessary valves and instrumentation. During plant shutdown, coolant flows from the Reactor Coolant System to the residual heat removal pumps, through the tube side of the residual heat exchangers and back to the Reactor Coolant System. The inlet line to the residual heat removal loop starts at the hot leg of one reactor coolant loop and the return line connects to the Safety Injection System piping. The residual heat exchangers are also used to cool the water during the latter phase of Safety Injection System operation. These duties are defined in Chapter 6. The heat loads are transferred by the residual heat exchangers to the component cooling water.

47 of 176 IPEC00036010 IPEC00036010

IP3 FSAR UPDATE During plant shutdown, the cooldown rate of the reactor coolant and the component cooling water heat exchanger outlet temperature are controlled by regulating the flow through the tube side of the residual heat exchangers. Two remotely operated control valves, downstream of the residual heat exchangers, are used to control flow. Manual throttle valves are used to control component cooling water flow to the residual heat removal heat exchangers and service water flow to the component cooling water heat exchangers.

Double, remotely operated valving is provided to isolate the residual heat removal loop from the Reactor Coolant System. Whenever the reactor coolant system pressure exceeds the design pressure of the residual heat removal loop, separate reactor coolant system pressure channel interlocks will automatically close these valves. Inn addition, the interlocks also prevent the valves from opening until a predetermined set point is reached. Two remotely operated valves and one check valve isolate each line to the Reactor Coolant System cold legs from the residual heat removal loop.

Recirculation lines that branch off from the RHR pump discharge piping upstream of the discharge check valves have been installed to ensure a minimum pump recirculation flow of 300 gpm. This recirculation line configuration also eliminates the possibility of "dead heading" an RHR pump during dual pump operation by effectively separating the two pump discharge lines.

Spent Fuel Pit Cooling Loop The spent fuel pit cooling loop removes residual heat from fuel stored in the spent fuel pit. The loop is normally required to handle the heat load from 88 freshly discharged fuel assemblies from the reactor, but it can safely accommodate the heat load from all of the 1345 assemblies for which there is storage space available.

The spent fuel is placed in the pit during refuelings for long-term storage. The spent fuel pit capacity allows for storage of 6 cores while retaining enough capacity for a full core unload.

The spent fuel pit is located outside the Reactor Containment and is not affected by any Loss-of-Coolant Accident in the Containment. During refueling, the water in the pit is connected to that in the refueling canal by the fuel transfer tube. Only a very small amount of water interchange occurs as fuel assemblies are transferred.

The spent fuel pit cooling loop consists of pumps (main and standby), heat exchanger, filters, demineralizer, piping and associated valves and instrumentation. The operating pump draws water from the pit, circulates it through the heat exchanger and returns it to the pit. Component cooling water cools the heat exchanger. A second pumping system is used to circulate refueling water through the demineralizer and filter for purification. This is permitted under administrative controls (i.e., an operator familiar with the operational restrictions of the RWST Purification System who is in contact with the control room). Redundancy of this equipment is not required because of the large heat capacity of the pit and the slow heat up rate as shown in Table 9.3-3. However, connections are provided for an additional future heat exchanger. In the event of a failure of the spent fuel pump, the standby pump can be put into operation immediately from a local startup push button station.

In addition, reactor cavity filter tie-ins have been added to the spent fuel pit cooling loop to assist in purifying refueling water as it is drained from the reactor cavity to minimize the concentration of particulates in the refueling water storage tank.

48 of 176 IPEC00036011 IPEC00036011

IP3 FSAR UPDATE The clarity and purity of the spent fuel pit water are maintained by passing approximately 5 percent of the loop flow through a filter and demineralizer. The spent fuel pit pump suction line, which is used to drain water from the pit, penetrates the spent fuel pit wall above the fuel assemblies. The penetration location prevents loss of water as a result of a possible suction line rupture.

Component Cooling Loop Components Component Cooling Heat Exchangers The two component cooling heat exchangers are of the shell and straight tube type. Service water circulates through the tubes while component cooling water circulates through the shell side. The outlet water temperature of the component cooling heat exchangers is controlled manually by throttling the service water throttle valves. Design parameters are presented in Table 9.3-1.

Component Cooling Pumps The three component cooling pumps which circulate component cooling water through the component cooling loop are horizontal, centrifugal units. The pump casings were made from cast iron (ASTM 48) based on the corrosion-erosion resistance and the ability to obtain sound castings. The material thickness is indicated by high quality casting practice and ability to withstand mechanical damage and, as such, was substantially overdesigned from a stress level standpoint. Design parameters are presented in Table 9.3-1.

Auxiliary Component Cooling Pumps A minimum of two of the four auxiliary component cooling pumps are automatically started during the injection phase to protect the internal recirculation pump motors from the containment atmosphere. A booster pump is also connected to the motor shaft of each safety injection pump to cool the safety injection pump bearings. The auxiliary component cooling water pumps are located outside the Containment and are seismic Class I. For further discussion of the auxiliary component cooling pump refer to Section 6.2.2. Design parameters are presented in Table 9.3-1.

Component Cooling surge Tanks The component cooling surge tanks, which accommodate changes in component cooling water volume, were constructed of carbon steel. Design parameters are presented in Table 9.3-1. In addition to piping connections, the tanks have a flanged opening at the top for the addition of the chemical corrosion inhibitor to the component cooling loop.

The internals of the relief valves have been removed to provide a direct path to the Waste Holdup Tanks to prevent a potential overpressurization of the component cooling system.

Component Cooling Valves The valves used in the component cooling loop are standard commercial valves constructed of carbon steel with bronze or stainless steel trim. Since the component cooling water is not normally radioactive, special features to prevent leakage to the atmosphere are not provided.

49 of 176 IPEC00036012 IPEC00036012

IP3 FSAR UPDATE Self-actuated spring loaded relief valves are provided for lines and components, that could be pressurized to their design pressure by improper operation or malfunction.

Component Cooling Piping All component cooling loop piping is carbon steel with welded joints and connections except at components which might need to be removed for maintenance.

Residual Heat Removal Loop Components Residual Heat Removal Heat Exchangers The two residual heat removal heat exchangers located within the Containment are of the shell and U-tube type with the tubes welded to the tube sheet. Reactor coolant circulates through the tubes, while component cooling water circulates through the shell side. The tubes and other surfaces in contact with reactor coolant are austenitic stainless steel and the shell is carbon steel.

Residual Heat Removal Pumps The two residual heat removal pumps are vertical, centrifugal units with special seals to prevent reactor coolant leakage to the atmosphere. All pump parts in contact with reactor coolant are austenitic stainless steel or equivalent corrosion resistant material.

The residual heat removal pump seal heat exchangers and stuffing boxes are cooled from the Component Cooling Water System. A backup cooling water supply is provided from the city water system in the event the component cooling water loop is out of service. The residual heat removal pumps can be operated for an unlimited length of time, providing the supply of city water is uninterrupted. The residual heat removal pumps can operate without cooling for up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in the event of an emergency.

Residual Heat Removal Valves The valves used in the residual heat removal loop are constructed of austenitic stainless steel or equivalent corrosion resistant material.

Stop valves are provided to isolate equipment for maintenance. Throttle valves are provided for remote and manual control of the residual heat exchanger tube side flow. Check valves prevent reverse flow through the residual heat removal pumps.

Two remotely operated series stop valves at the inlet with independent pressure interlocks isolate the residual heat removal loop from the Reactor Coolant System. The residual heat removal loop is isolated from the Reactor Coolant System by one check valve and two remotely operated stop valves on the outlet line. Overpressure in the residual heat removal loop is relieved through relief valves to the pressurizer relief tank. In addition, Technical Specification Section 3.4.12 restricts operation of the SI pumps when the RCS average cold leg temperature is below the OPS enable temperature. These restrictions help to preclude RHR overpressurization.

Valves that perform a modulating function are equipped with two sets of packing and an intermediate leakoff connection that discharges to the Waste Disposal System.

50 of 176 IPEC00036013 IPEC00036013

IP3 FSAR UPDATE Manually operated valves have backseats to facilitate repacking. Valve backseats are capable of limiting the stem leakage when used.

Residual Heat Removal Piping All residual heat removal piping is austenitic stainless steel. The piping is welded with flanged connections at the pumps.

Spent Fuel Pit Loop Components Spent Fuel Pit Heat Exchanger The spent fuel pit heat exchanger is of the shell and U-tube type with the tubes welded to the tube sheet. Component cooling water circulates through the shell, and spent fuel pit water circulates through the tubes. The tubes are austenitic stainless steel and the shell is carbon steel.

Spent Fuel Pit Pumps The spent fuel pit pumps (main and standby) circulate water in the spent fuel pit cooling loop.

All wetted surfaces of the pumps are of austenitic stainless steel or equivalent corrosion resistant material. The pumps are operated manually from a local station.

Refueling Water Purification Pump The refueling water purification pump circulates water in a loop between the Refueling Water Storage Tank and the spent fuel pit demineralizer and filter. All wetted surfaces of the pump are austenitic stainless steel. The pump is operated manually from a local station.

Spent Fuel Pit Filter The spent fuel pit filter removes particulate matter larger than 5 microns from the spent fuel pit water. The filter cartridge is synthetic fiber and the vessel shell is austenitic stainless steel.

Spent Fuel Pit Strainer A stainless steel strainer is located at the inlet of the spent fuel pit loop suction line for removal of relatively large particles which might otherwise clog the spent fuel pit demineralizer.

Spent Fuel Pit Demineralizer The demineralizer was sized to pass 5% of the loop circulation flow in order to provide adequate purification of the fuel pit water for unrestricted access to the working area, and to maintain optical clarity.

Spent Fuel Pit Skimmer A skimmer pump, strainer and filter are provided for surface skimming of the spent fuel pit water.

Spent fuel Pit Valves 51 of 176 IPEC00036014 IPEC00036014

IP3 FSAR UPDATE manual stop valves are used to isolate equipment and lines, and manual throttle valves provide flow control. Valves in contact with spent fuel pit water are austenitic stainless steel or equivalent corrosion resistant material.

Reactor Cavity Filter System This system is discussed in Section 9.5.

Spent Fuel Pit Piping All piping in contact with spent fuel pit water is austenitic stainless steel. The piping is welded except where flanged connections re used at the pump, heat exchanger and filter to facilitate maintenance.

9.3.3 System Evaluation Availability and Reliability Component Cooling Loop For component cooling of the reactor coolant pumps, the excess letdown heat exchanger and the residual heat exchangers inside the Containment, most of the piping, valves, and instrumentation are located outside the primary system concrete shield at an elevation above the water level in the bottom of the Containment at post-accident conditions. (The exceptions are the cooling lines for the reactor coolant pumps and reactor supports, which can be secured following the accident.) In this location the systems in the Containment are protected against credible missiles and from being flooded during post-accident operations. Also, this location provides shielding which allows for maintenance and inspections to be performed during power operation.

Outside the Containment, the residual heat removal pumps, the spent fuel heat exchanger, the component cooling pumps and heat exchangers, and associated valves, piping and instrumentation are maintainable and inspectable during power operation. Replacement of one pump or one heat exchanger is possible while the other units are in service.

Several of the components in the component cooling loop were fabricated from carbon steel.

The component cooling water contains a corrosion inhibitor to protect the carbon steel. Welded joints and connections are used except where flanged closures are employed to facilitate maintenance. At least 10% of the component cooling line welds inside the Containment are 100% radiographed. The entire system is seismic Class I and is housed in structures of the same classification, with the exception of the piping and components which serve the Spent Fuel Pit Heat Exchanger. Analysis has demonstrated that the CCW safety function will be retained following natural phenomena. See Sections 16.1 and 16.2. The components were designed to the codes given in table 9.3-4. In addition, the components are not subjected to any high pressures (see Table 9.3-1) or stresses. Hence, a rupture or failure of the system is very unlikely.

During the recirculation phase following a Loss-of-Coolant Accident, the component cooling water pumps are required to deliver flow to the shell side of the residual heat exchangers. To ensure operability, system flow must be maintained within the maximum flow capacity of a 52 of 176 IPEC00036015 IPEC00036015

IP3 FSAR UPDATE single component cooling water pump. This has been accomplished by establishing fixed component throttle valve positions for power operation. In addition, the cooling water flow to the nonregenerative heat exchanger is required to be manually isolated prior to the start of a component cooling water pump during the switchover to the recirculation phase. These pumps are supplied by an emergency power source when required. However the component cooling water pumps are not started during the injection phase combined with a blackout following a LOCA. During this time the only heat removal requirement is for the bearings on the safety injection pumps and motor cooling for the recirculation pumps.

Since the component cooling pumps are not running during this injection phase, the water volume of the Component Cooling Water System is used as a heat sink. The temperature rise of the fluid is discussed in Section 6.2.2.

Residual Heat Removal Loop Two pumps and two heat exchangers are utilized to remove residual and sensible heat during plant cooldown. If one of the pumps and/or one of the heat exchangers is not operative, safe operation or safe cooldown of the plant is not affected; however, the time for cooldown is extended. The function of this equipment following a Loss-of-Coolant Accident is discussed in Chapter 6.

Spent Fuel Pit Cooling Loop This manually controlled loop may be shutdown safely for reasonable time periods, as shown in Table 9.3-3, for maintenance or replacement of malfunctioning components.

The Backup Spent Fuel Pool Cooling system has been installed to operate in parallel with the Normal SFP Cooling System to improve pool conditions during refueling activities. The BSFPCS is a manual system served by an independent cooling water source (demineralized water). A primary loop handles the SFP water and consists of two 100% capacity pumps, a plate heat exchanger, associated piping, and local instrumentation. A secondary loop is the heat sink for the system, and includes two, open-circuit evaporative cooling towers, two 100 %

capacity feed pumps, associated piping, and local instrumentation. Make-up and fill for the secondary loop is normally provided by demineralized water, with an alternate, emergency source available through the Fire Protection System.

Power for all equipment is supplied from the 480 VAC MCCs E1 and E2. For greater availability of power, and reliability of the cooling function, the BSFPCS includes a transfer switch that allows alignment to either the normal power sources MCC E1 and E2, or a rental diesel generator unit (with Engineering discretion). This feature allows an alternate power source in the event the MCCs become inoperable.

Leakage Provisions Component Cooling Loop Water leakage from piping, valves, and equipment in this system inside the Containment is not considered to be generally detrimental unless the leakage exceeds the makeup capability. With respect to water leakage from piping, valves, and equipment outside the Containment, welded construction is used where possible to minimize the possibility of leakage. The component cooling water could become contaminated with radioactive water due to a leak in any heat 53 of 176 IPEC00036016 IPEC00036016

IP3 FSAR UPDATE exchanger tube in the Chemical and Volume Control, Sampling, or Auxiliary Coolant Systems, or due to a leak in the thermal barrier cooling coil for the mechanical seal on a reactor coolant pump.

Tube or coil leaks in components being cooled would be detected during normal plant operation by the leak detection system described in Sections 4.2 and 6.7. Such leaks are also detected anytime by the radiation monitors located on the main cooling lines downstream of the component cooling heat exchangers.

Leakage from the component cooling loop can be detected by a falling level in the component cooling surge tanks. The rate of water level fall and the area of the water surface in the tanks permit determination of the leakage rate. To assure accurate determinations, the operator would check that temperatures are stable.

The component which is leaking can be located by sequential isolation or inspection of equipment in the loop. If the leak is in a component cooling water heat exchanger, it can be detected by a radiation monitor which monitors the Service Water Return line from the CCW Heat Exchangers sand the leaking heat exchanger can be isolated for repairs. System heat loads can be accommodated by one heat exchanger provided that service water flow is increased. Overall leakage within the Containment is limited to the value given in the Technical Specifications.

Should a large tube-side-to-shell-side leak develop in a residual heat exchanger, the water level in the component cooling surge tanks would rise, and the operator would be alerted by a high water alarm. The tanks are vented to the waste hold-up tanks, therefore any gross inleakage would overflow to these tanks. Additionally, a radiation alarm would actuate in the control room.

The severance of a cooling line serving an individual reactor coolant pump cooler would result in substantial leakage of component cooling water. This small bore (1 to 3") piping inside the missile shield (which is susceptible to missile damage) will however leak more slowly than larger piping (up to 12"), which is missile protected. Therefore, the water stored in the surge tank after a low level alarm, together with makeup flow, provides ample time for the closure of the valves external to the Containment to isolate the leak before cooling is lost to the essential components in the component cooling loop.

Should there be a tube rupture of the reactor coolant pump thermal barrier cooling coil, the water level in the component cooling surge tanks would rise, and the operator would be alerted by a high water alarm. The tanks are vented to the waste hold-up tanks; therefore, any gross inleakage would overflow to these tanks. A high flow signal from the RCP Thermal Barrier HX CCW return indicating flow switch FIC-625 closes RCP Thermal Barrier HX CCW return isolation valve AC-FCV-625. Piping and components downstream of the thermal barrier, inside containment are designed for RCS pressure.

The relief valves on the cooling water lines downstream from the sample, excess letdown, seal water, non-regenerative, spent fuel pit and residual heat exchangers were sized to relieve the volumetric expansion occurring if the exchanger shell side is isolated when cool, and high temperature coolant flows through the tube side. The set pressure equals the design pressure of the shell side of the heat exchangers.

The relief line to the waste hold-up tanks from the component cooling surge tanks is sized to relieve the maximum flow rate of water which enters the surge tank following a rupture of a reactor coolant pump thermal barrier cooling coil.

54 of 176 IPEC00036017 IPEC00036017

IP3 FSAR UPDATE Should a tornado missile cause the rupture of small bore piping on the CCW line to the Spent Fuel Pit Heat Exchanger, low level in the surge tank would alert the control room to the leakage from the line and an operator could be dispatched to investigate. The CCW pumps would be stopped at a low low surge tank level until corrective action allowing refilling of the system from the Primary Water Storage Tank. Isolation is not critical to system function because CCW is not immediately required for plant shutdown and cooling water to the RHE heat exchangers can be interrupted 30 days or more after an accident.

Residual Heat Removal Loop During reactor operation all equipment of the residual heat removal loop is idle and the associated isolation valves are closed. During the Loss-of-Coolant Accident condition, water from the recirculation sump is recirculated through a loop inside the Containment using the recirculation pumps and the residual heat exchangers. The residual heat removal pumps (which are located outside of the Containment) serve as backup to the internal recirculation pumps.

Each of the two residual heat removal pumps is located in a shielded compartment with a floor drain. Piping conveys the drain water to an external sump which is capable of handling the flow which would result from the failure of a residual heat removal pumps seal. A 50 gpm sump pump discharges to the Waste Holdup Tanks.

Spent Fuel Pit Cooling Loop Whenever a leaking fuel assembly is transferred from the fuel transfer canal to the spent fuel storage pool, a small quantity of fission products may enter the spent fuel cooling water. A small purification loop is provided for removing these fission products and the contaminants from the water.

The probability of inadvertently draining the water from the cooling loop of the spent fuel pit is exceedingly low. The only means is through actions such as opening a valve on the cooling line and leaving it open when the pump is operating. In the unlikely event of the cooling loop of the spent fuel pit being drained, the spent fuel storage pit itself cannot be drained and no spent fuel is uncovered since the spent fuel pit cooling connections enter near the top of the pit.

Temperature and level indicators in the spent fuel pit warn the operator of the loss of cooling.

No movement of irradiated fuel in the reactor shall be made until the reactor has been subcritical for at least 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />. The 84 hour9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> decay time and the 23 feet of water above the top of the reactor pressure vessel flange are consistent with the assumptions used in the dose calculation for the fuel handling accident.

As irradiated fuel is added to the Spent Fuel Pit, the pit bulk temperature will begin to increase with increasing decay heat load. The thermal-hydraulic analysis for the maximum density Spent Fuel Pit racks has determined that, for a decay heat load no greater than 17.6 x 106 BTU/hr, the Spent Fuel Pit bulk temperature shall not exceed 150°F with the Spent Fuel Pit Cooling System in service. During normal Spent Fuel Pit operation, the decay heat load is below 17.6 x 106 BTU/hr. The maximum allowable decay heat load is 35 x 106 BTU/hr, which will ensure that the bulk temperature does not exceed 200°F with the Spent Fuel Pit Cooling System in service.

55 of 176 IPEC00036018 IPEC00036018

IP3 FSAR UPDATE The thermal-hydraulic analysis for the maximum density Spent Fuel Pit racks has established default cooling times for core offload. A full-core offload completed no earlier than 254 hours0.00294 days <br />0.0706 hours <br />4.199735e-4 weeks <br />9.6647e-5 months <br /> subcritical will ensure that the pit bulk temperature will not exceed 200°F.

This time limit may be relaxed for any core offload, provided that it can be shown that the heat load in the Spent Fuel Pit will not exceed 35 x 106 BTU/hr and that the Spent Fuel Pit bulk temperature shall not exceed 200°F at any time. This must be proven in a formal calculation, which shall determine Spent Fuel Pit heat load in accordance with the requirements of Branch Technical Position ASB 9-2 of the USNRC Standard Review Plan. (1)

For example, a partial core offload of 88 assemblies (conservatively assumed to be transferred instantaneously to the Spent Fuel Pit at 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> subcritical) would provide a heat load of 30 x 106 BTU/hr, which is below the 35 x106 BTU/hr limit. It should be noted that the use of auxiliary Spent Fuel Pit cooling can significantly reduce pit temperature. Although auxiliary cooling is not credited in the Spent Fuel Pit thermal-hydraulic analysis, it is a useful tool for maintaining working conditions in the vicinity of the Spent Fuel Pit and. for keeping the pit temperature below 150°F during partial and full-core offloads.

Spent Fuel Pit bulk temperature is calculated assuming one of the two Spent Fuel Pit coolant pumps is in service, with a Component Cooling Water temperature of 100°F in the one available heat exchanger. No credit is taken for heat loss to the pool liner, slab, concrete walls or the air, nor is credit taken for heat loss through evaporation.

During normal Spent Fuel Pit operation, with an equilibrium bulk temperature of 150°F, a complete loss of cooling will result in a temperature increase of 7.30°F/hr. In this case, 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> are available to reestablish pool cooling before boiling occurs. For the partial off load in the above example, pool boiling occurs in 4.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, presuming an initial pit temperature of 150°F. For the full-core offload case, with an equilibrium bulk temperature of 200°F, a complete loss of cooling will result in a temperature increase of 14.6°F/hr. In this case, 49.2 minutes are available to reestablish pool cooling before boiling occurs.

The results of the Spent Fuel Pit thermal-hydraulic analysis are shown on Table 9.3-3.

The primary source of makeup water to the spent fuel pool is the Primary Water Storage Tank.

Additional makeup water may be provided from the Refueling Water Storage tank or the city water supply.

Incident Control Component Cooling Loop Should the break occur outside the Containment the leak could either be isolated by valving or the broken line could be repaired, depending on the location in the loop at which the break occurred.

Once the leak is isolated or the break has been repaired, makeup water is supplied form the reactor makeup water tank by one of the primary makeup water pumps. If the loop drains completely before the leakage is stopped, it can be refilled by a primary makeup water pump in less than two hours.

56 of 176 IPEC00036019 IPEC00036019

IP3 FSAR UPDATE If the break occurs inside the Containment, on a cooling water line to a reactor coolant pump, the leak can be isolated. The cooling water supply line to the reactor coolant pumps contains a check valve inside containment and remotely operated valves outside the containment wall.

Each return line has remote operated valves outside the containment wall. The cooling water supply line to the excess letdown heat exchanger contains a check valve inside the containment wall and both supply and return lines have automatic isolation valves outside the containment wall which are open during normal operation.

Should the break occur inside the Containment, and the leak cannot be isolated locally, the main header feeding the break is isolated. Component cooling is still provided in the remainder of the system by the second main header. The cooling loads are divided between the two headers in such a manner as to ensure continued containment sump and core recirculation following a Loss-of-Coolant Accident.

Flow indication is provided on the component cooling return lines from the safety injection and residual heat removal pumps. Each of the component cooling supply lines to the residual heat exchangers contains a check valve; each return line has a remotely operated valve (normally closed) outside the containment wall. If one of the valves fails to open at initiation of long-term recirculation, the valve which does open supplies a heat exchanger with sufficient cooling to remove the heat load.

The equipment vent and drain lines outside the Containment have manual valves which are normally closed unless the equipment is being vented or drained for maintenance or repair operations.

A failure of pumps, heat exchangers, and valves for the Component Cooling Water System is presented in Table 9.3-5.

Residual Heat Removal Loop The residual heat removal loop is connected to one reactor hot leg on the suction side and to the reaction cold legs on the discharge side. On the suction side, the connection is through two electric, motor-operated gate valves in series. Each valve is independently interlocked with reactor coolant system pressure. On the discharge side, the connection is through two electric, motor-operated gate valves and one check valve for each reactor cold leg. The motor-operated valves are open whenever the reactor is in MODES 1, 2, or 3, in accordance with Technical Specification requirements.

Spent Fuel Pit Cooling Loop The most serious failure of this loop is complete loss of water in the storage pool. To protect against this possibility, the spent fuel storage pool cooling connections enter near the water level so that the pool cannot be either gravity-drained or inadvertently drained. For this same reason, care was exercised in the design and installation of the fuel transfer tube. The water in the spent fuel pit below the cooling loop connections could be removed by using a portable pump.

9.3.4 Minimum Operating Conditions Minimum operating conditions for the Auxiliary Coolant System are given in the Technical Specifications.

57 of 176 IPEC00036020 IPEC00036020

IP3 FSAR UPDATE 9.3.5 Tests and Inspections The residual heat removal pumps flow instrument channels are calibrated during each refueling operation.

The check valves on the lines from the residual heat removal loop to the cold legs of the Reactor Coolant System are leak tested every time the plant is shutdown and the reactor coolant system has been depressurized to 700 psig or less. This test is also performed following valve maintenance, repair or other work which could unseat these check valves.

The portion of the Residual Heat Removal System outside containment shall be tested for leakage at least every 24 months as follows:

1. The portion of the Residual Heat Removal System that is outside the containment shall be tested either by use in normal operation of hydrostatically tested at 350 psig.
2. The piping between the residual heat removal pumps suction and the containment isolation valves in the residual heat removal pump suction line from the containment sump shall be hydrostatically tested at no less than 100 psig.
3. Visual inspection shall be made for excessive leakage during these tests from components of the system. Any significant leakage shall be measured by collection and weighing or by another equivalent method.
4. The maximum allowable leakage from the Residual Heat Removal System components and Safety Injection System components, located outside of the containment and used during the recirculation phase of design basis accident, shall not exceed two gallons per hour.
5. Repairs of isolation shall be made as required to maintain leakage within the acceptance criterion.

Reference

1) Branch Technical Position ASB 9-2, USNRC Standard Review Plan, "Residual Decay Energy for Light-Water Reactors for Long-Term Cooling".

58 of 176 IPEC00036021 IPEC00036021

IP3 FSAR UPDATE TABLE 9.3-1 COMPONENT COOLING LOOP COMPONENT DATA ComQonent Cooling PumQs Quantity 3 Type Horizontal, Centrifugal Rated capacity (each), gpm 3600 Rated head, ft H2 O 220 Maximum flow rate, gpm 5500 Motor horsepower, hp 250 Casing Material Case iron Design pressure, psig 150 Design temperature, of 200 ComQonent Cooling Heat Exchangers Quantity 2 Type Vertical shell and straight tube Heat exchanged, Btu/hr 31.4 x 106 Fouled transfer rate, Btu/hr-oF-ff 298 Clean transfer rate, Btu/hr-°F-ff 600 Surface area, ff 8569 Overall heat transfer coefficienf'), Butlhr- of 2.55 x 10b (1) Fouled transfer rate multiplied by the design surface area.

59 of 176 IPEC00036022 IPEC00036022

IP3 FSAR UPDATE TABLE 9.3-1 (Cant.)

COMPONENT COOLING LOOP COMPONENT DATA Comgonent Cooling Heat Exchangers Design Conditions*

Parameter Tube Side Shell Side Pressure, psig 150 150 Temperature, of 200 200 Flow,1b/hr 4.55 x 106 2.66 X 106 Inlet Temperature, of 95 116.9 Outlet Temperature, of 101.9 105 Material Admiralty Carbon steel Comgonent Cooling Surge Tanks Quantity 2 Volume, gal. 2000 Normal water volume, gal. 1000 Design pressure, psig 100 Design temperature, of 200 Construction material Carbon steel Auxilia!y Comgonent Cooling Puml2s (Recirculation Pump Motor Coolers)

Quantity 4 Type Vertical, centrifugal Rated capacity, gpm 80 Rated head, ft H2 O 100 Motor Horsepower, hp 3 Casing material Cast iron Design pressure, psig 150 Design temperature, OF 200

  • NOTE: Excluding the RCP thermal barrier heat exchanger.

60 of 176 IPEC00036023 IPEC00036023

IP3 FSAR UPDATE TABLE 9.3-1 (Cant.)

COMPONENT COOLING LOOP COMPONENT DATA Auxiliary Component Cooling Pumps (SI Pump Coolers)

Quantity 3 Design pressure, psig 150 Design temperature, of 200 Design flow rate, gpm 40 Design head, ft 102 Type Centrifugal Component Cooling Loop Valves Design pressure, psig 150 Design temperature, OF 200 Component Cooling Loop Piping Design Pressure, psig 150 Design Temperature, of 500 Component Cooling RCP Thermal Barrier Heat Exchanger Design Pressure, psig 2500 Design Temperature, of 650 61 of 176 IPEC00036024 IPEC00036024

IP3 FSAR UPDATE TABLE 9.3-2 RESIDUAL HEAT REMOVAL LOOP COMPONENT DATA Cooldown parameter I Normal Appendix R Reactor core power, MWt 13216 3216 Component cooling water heat exchanger performance Number 2 2 Heat transfer coefficient(1) (each), 2A3x 1rf 1. 77 x 105(2)(3)

Btu/hr-oF Tube side inlet temperature, of 95 95 b b Tube side flow (each), Ib/hr 4.55 x 10 1.42 X 10 Shell side flow (each, Ib/hr 2.66 x 105 1.15 x 106 Residual heat removal heat exchanger l2erformance Number 2 1 6 1.07 x 106(2)

Heat transfer coefficient(1) (each, 1.16x10 Btu'/hr-oF Tube side flow (each, Ib/hr 1.44 x 10b 1.44 x 10° Shell side flow (each), Ib/hr 2.46 x 106 1.74 X 106 6

Auxiliary heat loads at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after 27.3 x 10 18.9 X 106 plant shutdown, Btu/hr Auxiliary heat loads at 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after 20.2 x 106 18.4 X 10 6

plant shutdown, Btu/hr Reactor coolant temperature at 350 350 initiation of cooling loop, OF Maximum reactor coolant cooldown 50 50 rate, °F/hr Maximum component cooling water 120 125 supply temperature, OF NOTE:

(1) Surface area reduced by 5% to allow for tube plugging.

(2) Fouled transfer rate reduced for flow less than design. ("Corrected UA")

(3) Other Appendix R cases evaluated had different "Corrected" heat transfer coefficients.

62 of 176 IPEC00036025 IPEC00036025

IP3 FSAR UPDATE TABLE 9.3-2 (Cant.)

RESIDUAL HEAT REMOVAL LOOP COMPONENT DATA Normal Al2l2endix R Time after plant shutdown cooling loop initiated, 5 29 hr Time after plant shutdown to reach cold 21 72 shutdown condition (200°F), hr Time after plant shutdown to reach refueling 105 condition (140°F), hr Refueling water storage temperature, of Ambient Decay heat generation at 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> after plant 71.2 x 10(15) shutdown, Btu/hr Reactor cavity fill time, hr 1 H3B03 concentration in refueling water storage 2000-2600 tank, ppm boron Residual Heat Removal PumQs Refer to Table 6.2-5 Residual Heat Removal Heat Exchangers Refer to Table 6.2-6 Residual Heat Removal LooQ PiQing and Valves

1. Isolated loop Design pressure, psig 600 Design temperature, ° F 400
2. Loop Isolation Design pressure, psig 2485 Design temperature, ° F 650 63 of 176 IPEC00036026 IPEC00036026

IP3 FSAR UPDATE TABLE 9.3-3 SPENT FUEL COOLING LOOP COMPONENT DATA Spent Fuel Pit Heat Exchanger Number 1 Type Shell and U-tube 6

Heat Exchanged, Btu/hr 7. 96 x 10 Fouled transfer rate, Btu/hr-oF-ft2 310 Clean transfer rate, Btu/hr-°F-ft2 468 Surface area, ft2 2000 Overall heat transfer coefficient(1), Btu/hr-oF 0.62 x 106 Design Conditions:

Parameter Tube Side Shell Side Pressure, psig 150 150 Temperature, of 200 200 Flow,lb/hr 1.1 X 106 1.4 X 106 Inlet Temperature, of 120 100 Outlet Temperature, of 112.8 105.7 Material Stainless steel Carbon steel System Cooling Capability Spent fuel pit heat load, Btu/hr Normal SFP Operation <17.6 x106 Partial Offload (88/193 core), 84 hr discharge Full Core Offload Component cooling water heat exchanger performance Number 2 Heat Transfer coefficient (each), Btu/hr-oF 2.43 X 106 NOTE:

(1) Fouled transfer rate multiplied by the design surface area.

64 of 176 IPEC00036027 IPEC00036027

IP3 FSAR UPDATE TABLE 9.3-3 (Cont.)

SPENT FUEL COOLING LOOP COMPONENT DATA Tube side inlet temperature, of 95 Tube side flow (each), Ib/hr 4.55 x 106 Shell side flow (each), Ib/hr 2.66 X 106 Spent fuel pit heat exchanger performance Heat transfer coefficient(1 l , Btu/hr-oF 0.59 X 106 Tube side flow, Ib/hr 1.1 X 106 Shell side flow, Ib/hr 1.4 X 106 Pit water inertia, no heat removal(2) (3)

Time to heat from 150°F to 212°F, normal SFP operation 8.5 Time to heat from 150°F to 212°F, 88 spent fuel assembly discharged, hr 4.9 Time to heat from 200°F to 212°F, full core, min 49.2 Spent Fuel Pit Skimmer Pump Quantity 1 Type Horizontal, Centrifugal Rated Capacity, gpm 100 Rated head, ft H20 50 Design pressure, psig 50 Design temperature, ° F 200 Casing Material Stainless steel Refueling Water Purification Pump Quantity 1 Type Horizontal, Centrifugal Rated capacity, gpm 100 NOTE:

(1) Overall heat transfer coefficient reduced by 5% to allow for tube plugging 65 of 176 IPEC00036028 IPEC00036028

IP3 FSAR UPDATE (2) The initial temperatures are maximum calculated equilibrium, temperatures with cooling system operati ng.

(3) If SFP level is presumed to be reduced to 88' 0" due to a hypothetical loss of SFP volume, the heat up times are reduced by about 19%, to 6.9 hours1.041667e-4 days <br />0.0025 hours <br />1.488095e-5 weeks <br />3.4245e-6 months <br />, and 40.2 minutes, respectively.

TABLE 9.3-3 (Cant.)

SPENT FUEL COOLING LOOP COMPONENT DATA Rated head, ft H2 0 150 Design pressure, psig 150 Design temperature, F 200 Casing Material Stainless steel Spent Fuel Pit Cooling Loop Piping and Valves Design pressure, psig 150 Design temperature, F 200 Spent Fuel Pit Skimmer Loop Piping and Valves Design pressure, psig 100 Design temperature, F 200 Refueling Water Purification Loop Piping and Valves Design pressure, psig 150 Design temperature, F 200 Spent Fuel Pit Pump Quantity 2 Type Horizontal, Centrifugal Casing Material Stainless steel Rated capacity, gpm 2300 Rated head, ft H2 0 125 Design pressure, psig 150 66 of 176 IPEC00036029 IPEC00036029

IP3 FSAR UPDATE TABLE 9.3-3 (Cant.)

SPENT FUEL COOLING LOOP COMPONENT DATA Design temperature, F 200 Motor horsepower 100 Spent Fuel Storage Pool Volume, fe 37,300 Boron concentration, ppm boron 2000 to 2500 Spent Fuel Pit Filter Quantity 1 Internal design pressure of housing, psig 200 Design temperature, F 250 Rated flow, gpm 100 Maximum differential pressure across filter element at rated flow (clean cartridge), psi 5 Maximum differential pressure across the filter element prior to removing, psi 20 Filtration requirement 98% retention of particles down to 5 micron Spent Fuel Pit Strainer Quantity 1 Rated flow, gpm 2300 Maximum differential pressure across the strainer element at rated floor (clean), psi 1 Perforation, inches Approximately 0.2" 67 of 176 IPEC00036030 IPEC00036030

IP3 FSAR UPDATE TABLE 9.3-3 (Cant.)

SPENT FUEL COOLING LOOP COMPONENT DATA Spent Fuel Pit Demineralizer Type Flushable Design pressure, psig 200 Design temperature, F 250 Flow rate, gpm 100 Resin volume, fe 15 to 25 Spent Fuel Pit Skimmers Quantity 2 Flow per unit, gpm 50 Vertical fluctuation range:

Floating, inch 4 Manual adjustment, feet 2 Spent Fuel Pit Skimmer Strainer Quantity 1 Type Basket Rated flow, gpm 100 Design pressure, psig 50 Design temperature, F 200 Maximum differential pressure across strainer at rated flow, psi 1 Perforation, inch 1/8 68 of 176 IPEC00036031 IPEC00036031

IP3 FSAR UPDATE TABLE 9.3-3 (Cant.)

SPENT FUEL COOLING LOOP COMPONENT DATA Spent Fuel Pit Skimmer Filter Quantity 1 Type Replaceable Internal design pressure, psig 200 Design temperature, F 250 Rated flow, gpm 100 Maximum differential pressure across filter at rated flow (clean), psi 5 Maximum differential pressure across filter prior to replacement, psi 20 Filtration requirement 98% retention of particles above 5 microns 69 of 176 IPEC00036032 IPEC00036032

IP3 FSAR UPDATE TABLE 9.3-4 AUXILIARY COOLANT SYSTEM CODE REQUIREMENTS Component Code Component cooling heat exchangers ASME VIII Component cooling surge tank ASME VIII Component cooling loop piping and valves USAS B31.1 Residual heat exchangers ASME III, Class C, tube side ASM E VIII, shell side Residual heat removal piping and valves USAS B31.1 Spent fuel pit filter ASME III, Class C Spent fuel heat exchanger ASME III, Class C, tube side ASM E VIII, shell side Spent fuel pit loop piping and valves USAS B31.1 70 of 176 IPEC00036033 IPEC00036033

IP3 FSAR UPDATE TABLE 9.3-5 FAILURE ANALYSIS OF PUMPS, HEAT EXCHANGERS, AND VALVES Components Malfunction Comments and Consequences

1. Component cooling water Rupture of a The casing and shell are designed for 150 psi and 200°F which exceed maximum pump pump casing operating conditions. Pump is inspectable and protected against credible missiles.

Rupture is not considered credible. However, each unit is isolatable. One of the three pumps is capable of meeting system flow requirements.

2. Component cooling water Pump fails to One operating pump supplies sufficient water for emergency cooling.

pumps start

3. Component cooling water Manual valve This is prevented by pre-startup and operational checks. Further, during normal pumps on a pump operation, each pump is checked on a periodic basis which would show if a valve is suction line closed.

closed

4. Component cooling water Normallyopen The valve is checked open during periodic operation of the pumps during normal valve valve operation.
5. Component cooling heat Tube or shell Rupture is considered improbable because of the low operating pressures. Each unit exchanger rupture is isolatable. Second unit can carry total heat load for normal operation provided service water flow is increased.
6. Demineralized water Sticks open The check valve is backed up by the manually operated valve. Manual valve is makeup line check valve normally closed.
7. Component cooling heat Left open This is prevented by pre-startup and operational checks. On the operating unit such a exchanger vent or drain situation is readily assessed by makeup requirements to system. On the second unit such a situation is ascertained during periodic testing.
8. Component cooling water Fails to open There is one valve on each outlet line from each heat exchanger: One heat inlet valve to residual heat exchanger remains in service and provides adequate heat removal during long tern exchanger recirculation. During normal operation the cooldown time is extended.

"U m

()

-u o m o oo o eN o (J) 71 of 176 o0) o (J) eN

.j:::o.

o0)

.j::>,.

IP3 FSAR UPDATE 9.4 SAMPLING SYSTEM 9.4.1 Sampling During Normal Operation 9.4.1.1 Design Basis Performance Requirements This system provides samples for laboratory analysis to evaluate reactor coolant, feedwater, steam systems, and other reactor auxiliary systems chemistry during normal operation. This system is normally isolated at the containment boundary.

Sampling system discharge flows are limited under normal and anticipated fault conditions (malfunctions or failure) to preclude any fission product releases beyond the limits of 10 CFR

20. The Sampling System can also be used for removing fluid from any individual SI Accumulator as described in Section 6.2.

Design Characteristics The system is capable of obtaining reactor coolant samples during reactor operation and during cooldown. Access is not required to the containment for operation for the sampling system.

Sampling of other process coolants, such as from tanks in the Waste Disposal System, is accomplished locally. Equipment for sampling secondary and non-radioactive fluids are separated from the equipment provided for reactor coolant samples. Leakage and drainage resulting from the sampling operations are collected and drained to tanks located in the Waste Disposal System.

Two types of samples are obtained by the system: high temperature - high pressure Reactor Coolant System and steam generator blowdown samples that originate inside the reactor containment, and low temperature - low pressure samples from the Chemical and Volume Control and Auxiliary Coolant Systems.

High Pressure - High Temperature Samples A sample connection is provided from each of the following:

a) The pressurizer steam space - RCS b) The pressurizer liquid space - RCS c) Hot legs of loops 1 and 3 - RCS d) Secondary steam blowdown from each steam generator - SGBDS Low Pressure - Low Temperature Samples A sample connection is provided from each of the following:

a) The mixed bed demineralizer inlet header - CVCS 72 of 176 IPEC00036035 IPEC00036035

IP3 FSAR UPDATE b) The mixed bed demineralizer outlet header - CVCS c) The residual heat removal loop, just downstream of the heat exchangers - ACS d) The volume control tank gas space - CVCS e) The accumulators - SIS f) The recirculation pump discharge - SIS / Accident Operating Temperatures The high pressure, high temperature samples and the residual heat removal loop samples leaving the sample heat exchangers are held to a temperature of 130F to minimize the generation of radioactive aerosols.

Codes and Standards System component code requirements are given in Table 9.4-1.

9.4.1.2 System Design and Operation The Sampling System, shown in Plant Drawings 9321-F-27453 [Formerly Figure 9.4-1],

provides the representative samples for laboratory analysis. Analysis results provide guidance in the operation of the Reactor Coolant, Auxiliary Coolant, Steam and Chemical and Volume Control Systems. Analyses show both chemical and radiochemical conditions. Typical information obtained includes: reactor coolant boron and chloride concentrations; fission product radioactivity level; hydrogen, oxygen, and fission gas content; corrosion product concentration, and chemical additive concentration.

The information is used in regulating boron concentration adjustments, evaluating fuel element integrity and mixed bed demineralizer performance, and regulating additions of corrosion controlling chemicals to the systems. The Sampling System is designed to be operated manually. Samples can be withdrawn under conditions ranging from full power to cold shutdown.

Reactor coolant liquid and steam sample lines, which are normally inaccessible or which require frequent sampling, are sampled by means of permanently installed tubing leading to the sampling room.

Sampling System equipment is located inside the auxiliary building in the sampling room. The delay coil and sample lines with remotely operated valves are located inside the Reactor Containment.

Reactor coolant hot leg liquid, pressurizer liquid and pressurizer steam samples originating inside the Reactor Containment flow through separate sample lines to the sampling room. The hot leg sample lines are of sufficient length to provide at least a 40-second transit time within the containment and an additional 20 seconds from the Containment to the sample hood to minimize personnel exposure. Each of these connections to the Reactor Coolant System has a remote operated isolation valve located close to the sample source. The samples are passed through the Reactor Containment to the auxiliary building, and into the sampling room, where 73 of 176 IPEC00036036 IPEC00036036

IP3 FSAR UPDATE they are cooled (pressurizer steam samples are condensed and cooled) in the sample heat exchangers. The sample stream pressure is reduced by a manual throttling valve located upstream of the quick connection for a temporary sample pressure vessel. The sample stream is purged to the volume control tank in the Chemical and Volume Control System until sufficient purge volume has passed to permit collection of a representative sample. Pressurized samples are collected by purging a portion of the sample stream through the temporary sample pressure vessel to the sample sink. After sufficient purging, the sample pressure vessel is isolated and analyzed.

Depressurized liquid samples may be collected by bypassing the sample pressure vessels.

After sufficient purge volume has passed to permit collection of a representative sample, a portion of the sample flow is diverted to the sample sink where the sample is collected.

The reactor coolant sample originating from the residual heat removal loop of the Auxiliary Coolant System has two remotely operated, normally closed isolation valves located close to the sample source outside the Containment. The sample line from this source is connected into the sample line coming from the hot leg at a point ahead of the sample's heat exchanger.

Samples from this source can be collected either in the sample vessels or at the sample sink as with hot leg samples.

Liquid samples originating at the Chemical and Volume Control System letdown line at demineralizer inlet and outlet pass directly through the purge line to the volume control tanf.

Samples are obtained by diverting a portion of the flow to the sample sink. The sample li1~

from the gas space of the volume control tank delivers gas samples to the volume control tank sample pressure vessel in the sampling room. Purge flow for these samples is discharged to the vent header in the Waste Disposal System.

Samples of the steam generator liquid are obtained from the blowdown lines. These sample lines are routed by separate lines from the steam generator into the sample room. These lines are missile protected within containment and are equipped with a remote operated valve.

These blowdown lines are then routed on to the plant blowdown flash tank. The sample lines are taken off at an intermediate point inside the Containment and routed to the sample room where the liquid is cooled and the pressure reduced. The sample lines are equipped with remotely operated isolation valves. Each individual sample is then split into two routes: one goes to the sample sink to provide periodic samples for chemical analysis, the second goes to a conductivity cell, a radiation monitor and then to the blowdown flash tank. This second line handles a continuous flow for a constant reading of conductivity and a constant monitoring for radiation.

An interconnection between the 4" SGBD lines and the 3/8" SGBD Sample tubing was installed during R09. This interconnection allows for the 4" SGBD lines to be filled from the Sample System. This modification was installed to prevent water hammer during SGBD restart above cold shutdown.

Liquid samples originating at each of the accumulators in the Safety Injection System run directly to the sample sink; no heat exchanger or sample vessel required. Samples are obtained by sampling the flow at the sample sink. These sample lines have air operated isolation valves located close to the accumulators.

74 of 176 IPEC00036037 IPEC00036037

IP3 FSAR UPDATE The Sampling System can also be used for removing fluid from any individual SI Accumulator in a process similar to sample line purging. Refer to Section 6.2 for information on the potential reasons and frequencies of this operation.

The sample sink, which is contained in the laboratory bench as a part of the sampling hood, contains a drain line to the Waste Disposal System.

Local instrumentation is provided to permit manual control of sampling operations and to ensure that the samples are at suitable temperatures and pressures before diverting flow to the sample sink.

Components A summary of principal component data is given in Table 9.4-2.

Sample Heat Exchangers Ten sample heat exchangers reduce the temperature of samples from the pressurizer steam space, the pressurizer liquid space, each steam generator and the reactor coolant system liquid to 130°F or less before samples reach the sample vessels and sample sink. The tube side of the heat exchangers is austenitic stainless steel, the shell side is carbon steel.

The inlet and outlet tube sides have socket-weld joints for connections to the high pressure sample lines. Connections to the component cooling water lines are socket-weld joints. The samples flow at 0.42 gpm through the tube side, and component cooling water from the Auxiliary Coolant System circulates through the shell side.

Delay Coil The high pressure reactor coolant sample line is designed to be of sufficient length to provide at least a 40 seconds sample transit time within the Containment and an additional 20 seconds transit time from the Reactor Containment to the sampling hood. This allows for decay of short lived isotopes to a level that permits normal access to the sampling room.

Sample Sink The sample sink is located in a hooded enclosure that is equipped with an exhaust ventilator.

The work area around the sink and the enclosure is large enough for sample collection and for storage of radiation monitoring equipment. The sink perimeter has a raised edge to contain any spilled liquid. The enclosure is penetrated by sample lines from the reactor plant, a demineralized water line, and steam system lines, all of which discharge into the sink. The sink and work areas are stainless steel.

Piping and Fittings All liquid and gas ample lines are austenitic stainless steel tubing and are designed for high pressure service. Compression fittings and socket welded joints are used throughout the Sampling System. Lines are so located as to protect them from accidental damage during routine operation and maintenance.

Valves 75 of 176 IPEC00036038 IPEC00036038

IP3 FSAR UPDATE Remotely operated stop valves are used to isolate all sample points and to route sample fluid flow inside the reactor containment. Manual stop valves are provided for component isolation and flow path control at all normally accessible Sampling System locations. Manual throttle valves are provided to adjust the samples flow rate as indicated on Plant Drawings 9321-F-27453 [Formerly Figure 9.4-1].

Appropriate valves and administrative controls prevent gross reverse flow of gas from the volume control tank into the sample sink.

All valves in the system are constructed of austenitic stainless steel or equivalent corrosion resistant material.

Isolation valves are provided outside the Reactor Containment; they trip closed upon a containment isolation signal.

9.4.1.3 System Evaluation Availability and Reliability Neither automatic nor operator action is required for the Sampling System during an emergency or to prevent an emergency condition (with the exception of the closure of the containment of the containment isolation valves). The system is therefore designed in accordance with standard practices of the chemical processing industry.

Leakage Provisions Leakage of radioactive reactor coolant from this system within the Containment is evaporated to the containment atmosphere and removed by the cooling coils of the Recirculation Air Heating and Cooling System. Leakage of radioactive material from the most likely places outside the Containment is collected by placing the entire sampling station under a hood provided with an offgas vent to the building exhaust. Liquid leakage from the valves in the hood is drained to the chemical drain tank.

Incident Control The system operates under administrative manual control.

Malfunction Analysis To evaluate system safety, the failures or malfunctions are assumed concurrent with a Loss-of-Coolant Accident, and the consequences analyzed. The results are presented in Table 9.4-3.

From this evaluation it is concluded that proper consideration has been given to station safety in the design of the system.

9.4.1.4 Minimum Operating Conditions Minimum operating conditions are specified in the Technical Specifications, Technical Requirements Manual, FSAR and ODCM.

9.4.1.5 Tests and Inspections 76 of 176 IPEC00036039 IPEC00036039

IP3 FSAR UPDATE Examples for frequency of sample analyses are as follows:

a) Reactor coolant - radiochemical analysis - every seven days.

b) Reactor coolant - boron concentration - 2 days per week, Maximum 5 days between analyses.

c) Refueling water - storage tank water - boron concentration - monthly.

9.4.2 Post-Accident Sampling System 9.4.2.1 Post-Accident Reactor Coolant Sampling System Under post-accident conditions, the radioactivity of the primary coolant may be increased by several orders of magnitude. Access into the primary sample room is prohibited by extremely high exposure rates. The post-accident reactor coolant sampling system (shown in Plant Drawing 9321-F-27453 [Formerly Figure 9.4-2]) provides a safe and accurate method of obtaining a pressurized coolant sample and a means for analyzing the sample of dissolved gases, hydrogen, isotopic content, chloride, and boron. Samples of the recirculation pump discharge and the residual heat removal system can also be taken.

To obtain a primary coolant sample in a post-accident condition, temporary diversion of a representative sample stream of primary coolant is made into a shielded compartment outside the sample room. The primary coolant is diverted downstream of the sample coolers through quick disconnect couplings to a sample cask in the lower portion of the shielded compartment.

The shielded compartment consists of three connected compartments with hinged doors; walls and doors are steel-encased lead, with a minimum thickness of 1-1/2 inch. Channels of poured lead are installed internally at any seam areas of the compartment, and reach rods are provided from remote operation of valves.

The sample is directed into the shielded portable cask so that a nominal 62-mi sample can be safely collected and transported to the analysis apparatus. Streaming is minimized by offsetting the openings in the cask from the direct line of sample and by use of a shielded cap during transport. Dose is minimized procedurally by use of a special hand tool to disconnect the cask from the system.

After the sample is collected in the cask, it is transported and positioned under the analysis equipment behind a shielded door. The cask is connected to the analysis system via flexible tubing of minimum volume, and the sample is pumped into a modified closed loop gas expansion rig. The cask with connections, in fact, forms part of the closed loop for gas expansion. The gas expansion rig has been modified to fit into a shielded box 50cm x 35cm x 35cm ID. The box is steel-encased lead, with a minimum thickness of 3 in., with a lead glass viewing window. The apparatus uses all solennoid-operated valves to preclude high personnel exposure. The box is ventilated into the Primary Auxiliary Building's ventilation system via an in-line vaneaxial fan.

The sample is recirculated through the gas expansion rig, which contains 30 mls of demineralized water for analysis of dissolved total gas and hydrogen. A gas sample is withdrawn by syringe through a septum for hydrogen analysis by gas chromatography. A second gas sample is withdrawn and injected into a glass bulb for isotopic analysis on the gamma spectroscopy system. On completion of the gas analyses, the diluted (1: 1.5) degassed 77 of 176 IPEC00036040 IPEC00036040

IP3 FSAR UPDATE liquid is pumped to a beaker within the shielded box. Samples of the diluted liquid in the breaker are withdrawn for liquid radioisotopic, boron and chloride analyses. An undiluted sample can be obtained within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and analyzed for chlorides within 30 days. The radioisotopic and boron samples may be diluted again as necessary to limit personnel dose. On completion of all analyses, the sample left in the beaker is pumped to a waste cask for disposal.

The system can then be flushed with water. The capabilities are listed in Table 9.4-4.

The primary method of pH measurement would be the use of an inline sensor mounted in a shielded cask. The sample is obtained in the same manner as the initial pressurized reactor coolant sample. A pH measurement can be obtained by taking a second sample and performing a pH analysis with the analysis system prepared without dilution water. The undiluted, second sample would be pumped into a beaker within the shielded box containing a pH electrode. On completion of the analysis, the sample is pumped to a waste cask for disposal. The system can then be flushed with water.

9.4.2.2 Containment Atmosphere and Plant Vent Post - Accident Sampling System The post-accident containment atmosphere and plant vent sampling system is designed to obtain representative samples of the containment air and stack for isotopic analysis. The system is designed to be utilized when the normal sampling system is inaccessible during periods of abnormally high release rates.

The containment atmosphere and plant vent sampling lines are electrically heat traced in order to prevent moisture condensation. The heat trace cable provided is of the self-regulating type selected to maintain the containment atmosphere sample line at 250°F and the plant vent stack sample line at 120°F. Two thermostats are provided per heat tracing zone: one for temperature regulation, the other for a low temperature alarm.

The basic system consists of containment air and stack sample shielded compartments located on the 41 foot elevation of the Primary Auxiliary Building. The containment air sample system consists of three lead shielded compartments with hinged doors. One compartment contains the sample collection cartridges for iodine and particulate. Another compartment houses the gas sampling cylinder and minimal tubing. The third compartment houses most associated tubing and a sample pump. The plant vent system is similar but all tubing, sample media and a pump are housed in one shielded compartment.

A noble gas sample is withdrawn by syringe through a port in the shielded compartment and analyzed for hydrogen by gas chromatography and for activity by gamma spectroscopy. A silver zeolite cartridge and a millifilter are used to collect iodine and particulate samples. Bottled gas is purged through the system after collecting the sample to reduce personal exposure during removal and transport of the sample media. The samples are then analyzed for iodine and particulate on the gamma spectrometer.

If this sampling capability (sample line common with retired monitor R-13) is determined to be inoperable when the reactor is in MODES 1, 2, 3 or 4, then it shall be restored to operable status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> or perform the following:

a) initiate a pre-planned alternate sampling / monitoring capability as soon as practical but no later than 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after identification of failures. If the capability is not restored to operable status within 7 days, then, 78 of 176 IPEC00036041 IPEC00036041

IP3 FSAR UPDATE b) submit a special report to the USNRC within 14 days following the event outlining the action taken, the cause of the inoperability and the plans and schedule for restoring the system.

In addition, the sample line common with retired monitor R-13 shall be tested every 18 months to ensure a representative sample can be drawn. This test is governed by Plant Procedures.

9.4.2.3 Main Steam Post-Accident Sampling System The post-accident main steam sampling system is designed to collect a condensed liquid sample of the main steam during accident conditions to verify steam generator integrity.

Upstream isolation valves are opened on the steam generator side of the main steam isolation valves. The normal operation sample root valve is shut and the accident cross-connect valve is opened. A sample is obtained from the main steam sample sink isolation valve in the secondary laboratory on the 15 foot elevation of the turbine building.

An isotopic analysis of the main steam sample is performed using the gamma spectroscopy system.

79 of 176 IPEC00036042 IPEC00036042

IP3 FSAR UPDATE TABLE 9.4-1 SAMPLING SYSTEM CODE REQUIREMENTS Sample heat exchanger ASME 111*, Class NC, tube side ASM E VIII, shell side Piping and valves USAS B31.1**

NOTE:

  • ASME III - American Society of Mechanical Engineers, Boiler and Pressure Vessel Code,Section III, Nuclear Vessels.
    • USAS B31.1 - Code for Pressure Piping and special nuclear cases where applicable.

80 of 176 IPEC00036043 IPEC00036043

IP3 FSAR UPDATE TABLE 9.4-2 SAMPLING SYSTEM COMPONENTS Sample Heat Exchanger Number 10 Type Coiled tube in shell Heat exchanged (each), Btu/hr 2.14 X 105 Surface area (each), ft2 3.73 Design Conditions:

Parameter Tube Side Shell Side Pressure, psig 2485 150 Temperature, of 680 350 Flow,lb/hr 209 20,000 (1)

Inlet Temperature, of 668 (2) 105 Outlet Temperature, of 127 130 Material Stainless Steel Carbon steel NOTE:

(1) Nominal cooling water flow is approximately 17 gpm.

(2) Saturated steam.

81 of 176 IPEC00036044 IPEC00036044

IP3 FSAR UPDATE TABLE 9.4-3 MALFUNCTION ANALYSIS OF SAMPLING SYSTEM Sample Chains Malfunction Comments and Consequences Pressurizer steam space Remote operated Diaphragm - operated valve sample, pressurizer liquid sampling valve inside outside the reactor containment space sample, or hot leg reactor containment fails closes on containment isolation sample to close signal Any sample chain Sample line break inside Same as above containment 82 of 176 IPEC00036045 IPEC00036045

IP3 FSAR UPDATE Table 9.4-4 POST-ACCIDENT REACTOR COOLANT SAMPLING SYSTEM ANALYTICAL CAPABI LlTI ES ANALYTE RANGE ACCURACY Gross Radioactivity 1 uCi/ml to 10 Ci Iml factor of 2 Isotopic not specified factor of 2 Boron 130 to 6000 ppm +1-15%

Chloride (Note 1) 0.10 to 20 ppm + 1-40%

Dissolved Hydrogen 0.3 to 200 cc/kg + 1-21%

Dissolved Oxygen 2 to 200 ppm + 1- 0.05 ppm or 10%

whichever is greater pH 1 to 13 + 1- 0.3 pH units NOTE 1: Initial chloride sample is diluted 1 to 1.5. The sampling system can obtain an undiluted sample for chloride within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for later analysis.

83 of 176 IPEC00036046 IPEC00036046

IP3 FSAR UPDATE 9.5 FUEL HANDLING SYSTEM The Fuel Handling System provides a safe effective means of transporting and handling fuel from the time it reaches the plant in an unirradiated condition until it leaves the plant after post-irradiation cooling.

The system was designed to minimize the possibility of mishandling or mal-operations that cause fuel damage and potential fission product release.

The Fuel Handling System consists of:

a) The reactor cavity, which is flooded only during plant shut-down for refueling b) The spent fuel pit, which is kept full of water and is always accessible to operating personnel c) The fuel Transfer System, consisting of an underwater conveyor that carries the fuel through an opening between the areas listed in the discussion of plant containment in Chapter 5.

In lieu of maintaining a monitoring system capable of detecting a criticality as described in10 CFR70.24, Indian Point 3 has chosento comply with the following seven (7) criteria of 10CFR 50.68(b}:

1) Plant procedures shall prohibitthe handling and storage at anyone time of more fuel assemblies than have been determined to be safely subcritical under the most adverse moderation conditions feasible by unborated water.
2) The estimated ratio of neutron production to neutron absorption and leakage (k-effective) of the fresh fuel in the fresh fuel storage racks shall be calculated assuming the racks are loaded with fuel of the maximum fuel assembly reactivity and flooded with unborated water and must not exceed 0.95, at a 95% probability, 95% confidence level. This evaluation need not be performed if administrative controls and/or design features prevent such flooding or if fresh fuel storage racks are not used.
3) If optimum moderation of fuel in the fresh fuel storage racks occurs when the racks are assumed to be loaded with fuel of the maximum fuel assembly reactivity and filled with low-density hydrogenous fluid, the k-effective corresponding to this optimum moderation must not exceed 0.98, at a 95 percent probability, 95 percent confidence level. This evaluation need not be performed if administrative controls and/or design features prevent such moderation or if fresh fuel storage racks are not used,
4) If no credit for soluble boron is taken, the k-effective of the spent fuel storage racks loaded with fuel of the maximum fuel assembly reactivity must not exceed 0.95, at a 95% probability, 95% confidence level, if flooded with unborated water. If credit is taken for soluble boron, thek-effective of the spent fuel storage racks loaded with fuel of the maximum fuel assembly reactivity must not exceed 0.95, at a 95% probability, 95%

confidence level, if flooded with borated water, and the k-effective must remain below 1.0 (subcritical), at a 95% probability, 95% confidence level, if flooded with unborated water.

84 of 176 IPEC00036047 IPEC0003604 7

IP3 FSAR UPDATE

5) The quantity of Special Nuclear Material (SNM), other than nuclear fuel, is less than the quantity necessary for a critical mass.
6) Radiation monitors are provided in storage and associated handling areas when fuel is present to detect excessive radiation levels and initiate appropriate safety actions.
7) The maximum nominal U-235 enrichment of the fresh fuel assemblies is limited to five (5) percent by weight.

9.5.1 Design Basis The General Design Criteria presented and discussed in this section are those that were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NCR) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Prevention of Fuel Storage Criticality Criterion: Criticality in the new and spent fuel storage pits shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls (GDC 66 of 7/11/67)

During reactor vessel head removal and while loading and unloading fuel from the reactor, boron concentration is maintained at not less than that required to shutdown the core to a kef! =

0.95. This shutdown margin maintains the core at kefr<0.99, even if all control rods are withdrawn from the core. Weekly checks of refueling water boron concentration ensure the proper shutdown margin.

The new and spent fuel storage racks were designed so that it is impossible to insert assemblies in other than the prescribed locations. The new and spent fuel storage pits have accommodations as defined in Table 9.5-1. Additionally, the spent fuel pit has the required spent fuel shipping area. Borated water is used to fill the spent fuel storage pit at a concentration to match that used in the reactor cavity and refueling canal during refueling operations. The spent fuel pit design assures a keff<0.99.

Detailed instructions have been issued for use by refueling personnel. These instructions, the minimum operating conditions, and the design of the fuel handling equipment, incorporating built-in interlocks and safety features, provide assurance that no incident could occur during refueling operations resulting in a hazard to public health and safety.

Fuel and Waste Storage Decay Heat 85 of 176 IPEC00036048 IPEC00036048

IP3 FSAR UPDATE Criterion: Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities and to waste storage tanks that could result in radioactivity release which would result in undue risk to the health and safety to the public. (GDC 67 of 7/11/67)

The refueling water provides a reliable and adequate cooling medium for spent fuel transfer.

Heat removal from the spent fuel pit is provided for by an auxiliary cooling system.

Design Codes and Criteria The general controlling standard for the design, fabrication, installation and testing of the Fuel Storage 8uilding fuel cask crane is the Electric Overhead Crane Institute (EOCI), Inc.,

Specification No. 61.

The crane, bridge, trolley and hoist are controlled by EOCI No. 61. Specifications for the following organizations are referenced therein:

1) American Gear Manufacturers Association
2) American Institute of Steel Construction
3) Association of Iron and Steel Engineers
4) American National Standards Institute
5) American Society for Testing and Material
6) American Welding Society
7) National Electrical Code, National Fire Protection Association
8) National Electric Manufacturers Association The crane rail and structural steel supporting structures were controlled by the American Institute of Steel Construction, "Manual of Steel Construction" 1964. All structural steel is ASTM A-36. The crane rail is in accordance with Manufacturers Standards and ASTM A-1. Design of the cables was controlled by the EOCI No. 61 code. In addition, the following are applicable to cables:
1) RRW-40-C, which is a Federal Standard for wire rope representing the industry standard
2) ANSI 830.2.0 for Overhead and Gantry Cranes.

The lifting hooks were purchased, fabricated and load tested to manufacturers standards. The hooks were ultrasonically tested to detect any flaws. These hooks are again tested at specified periods prior to all lifts.

The hooks are inspected, tested, and maintained in accordance with ANSI 830.2-1976.

Overhead and Gantry Cranes. When the crane hooks are inactive for a period of time longer 86 of 176 IPEC00036049 IPEC00036049

IP3 FSAR UPDATE than a specified inspection, test, or maintenance frequency, the inspection, test, or maintenance activity should be performed prior to their use. [NCR letter dated February 13, 1985, Control of Heavy Loads (Phase 1)]

The manipulator crane structure was designed in accordance with Electric Overhead Crane Specification No. 61. The design load was specified as 5626 Ibs (the weight of three fuel assemblies at 1575 Ibs each plus the weight of the gripper tube at 900 Ibs). All loading supporting members were designed with a 5 to 1 safety factor on this design load. The crane was pre-operational load tested with 6000 Ibs. Normal operating load for the crane is 2475 Ibs although emergency procedures for removing stuck fuel assemblies may require occasional loading up to 6000 Ibs. Seismic loads used for design were based on 0.5 g horizontal and 1.0 g vertical accelerations which are greater than the accelerations at the installed location. To resist design basis earthquake forces, the equipment was designed to limit the stress in the load bearing parts to 0.9 times the ultimate stress for a combination of normal working load plus design basis earthquake forces.

The structural material for the spent fuel pit bridge and hoist was designed to ASTM-A373. The design load was specified as 2000 Ibs on the hoist and 250 Ibs per square foot on the bridge.

All load supporting members were designed with a 5 to 1 safety factor at these design loads.

The hoist was pre-operational load tested with 2500 Ibs while the normal operating load will be 1750 Ibs (fuel assembly plus fuel handling tool). Seismic loads used for design were based on 0.5 g horizontal and 1.0 g vertical accelerations, which are greater than the accelerations at the installed location. To resist design basis earthquake forces, the equipment was designed to limit the stress in the load bearing parts to 0.9 times the ultimate stress for a combination of normal working load plus design basis earthquake forces.

For seismic considerations of the Fuel Storage Building spent fuel cask crane, the fuel crane bridge was evaluated to determine the potential for the trolley to lift off the crane bridge rails or for the crane bridge to lift off its track support in the event of a seismic disturbance. The crane bridge and trolley were analyzed for the design basis earthquake both loaded and unloaded for various positions of the trolley using response spectra modal analysis with 2% damping. It was determined that the downward force due to gravity exceeds the maximum upward seismic wheel load due to combined vertical and horizontal accelerations by a factor of 1.2.

As this is the only potential for bridge or trolley lift-off or overturning, no potential hazard exists to any seismic Class 1 function, and vertical restraints were not required.

The wheels of the bridge and trolley are shaped such that sliding perpendicular to the rail would not be possible. The lateral load from an earthquake on the trolley crane rail is about 50%

greater than the lateral loads from impact that the AISC Code specifies for design within working stress limits. The stresses on the crane rail are low due to the earthquake load. For this reason, no failure of the crane rail is anticipated. The design load rating of this crane is anticipated. The design load rating of this crane is 40 tons with a 5 ton auxiliary hook.

Other pre-operational test loads on components of the FHS were:

a) 125% of design rating on spent fuel cask crane b) Functional check-out for operability using a dummy fuel assembly that approximates 100% of the operational load to be handled.

87 of 176 IPEC00036050 IPEC00036050

IP3 FSAR UPDATE Test loads used throughout the plant life shall be equal to or greater than the maximum load to be assumed by the hoist crane during refueling operations.

9.5.2 System Design and Operation The reactor is refueled with equipment designed to handle the spent fuel underwater from the time it leaves the reactor vessel until it is placed in a cask for shipment from the site. Boric acid is added to the water to ensure subcritical conditions during refueling.

The Fuel Handling System may be divided into two areas: the reactor cavity, which is flooded only during plant shutdown for refueling, and the spent fuel pit, which is kept full of water and is always accessible to operating personnel. These two areas are connected by the Fuel Transfer System consisting of an underwater conveyor that carries the fuel through an opening in the plant containment. (See Figure 9.5-1)

The reactor cavity is flooded with borated water from the Refueling Water Storage Tank. In the reactor cavity, fuel is removed from the reactor vessel, transferred through the water and placed in the fuel transfer cart by a manipulator crane. In the spent fuel pit, the fuel is removed from the transfer system and placed in storage racks with a long manual tool suspended from an overhead hoist. The fuel can be removed from storage and loaded into a shipping cask for shipment from the site.

New fuel assemblies are received and stored in racks in the new fuel storage area. The new fuel storage area is sized for storage of the fuel assemblies and control rods normally associated with the replacement of 72 fuel assemblies.

Major Structures, Systems and Components Required for Fuel Handling Reactor Cavity The reactor cavity is a reinforced concrete structure that forms a pool above the reactor when it is filled with borated water for refueling. The cavity is filled to a depth that limits the radiation at the surface of the water to 2.0 milliroentgens per hour during fuel assembly transfer.

The cavity is large enough to provide storage space for the reactor upper and lower internals, the control cluster drive shafts, and miscellaneous refueling tools. The floor and sides of the reactor cavity are lined with stainless steel.

The reactor vessel flange is sealed to the cylindrical side walls of the reactor refueling cavity by either a Presray inflatable seal or a rigid, segmented seal. This inflatable seal design utilizes gas pressurization to inflate and uniformly compress an oval cross-section reinforced synthetic rubber (EPDW) envelope structure to effect a seal. The required inflation pressure is specified at 31 psig (equivalent head of water to be sealed plus 20 psig). This seal is installed and inflated after reactor cooldown but prior to flooding the cavity for refueling operations.

The wedge shape at the top of the device is designed to effect a pressure tight seal by virtue of the hydrostatic head of water even if pneumatic inflation pressure were to be lost.

The Presray seal design includes two independent gas inflation connections that are in simultaneous use during service. Each gas connection point at the seal is equipped with a fixed orifice device that limits seal deflation to a minimum of 10 psig should either one of the inflation 88 of 176 IPEC00036051 IPEC00036051

IP3 FSAR UPDATE sources malfunction. Both inflation sources are monitored by on-line "air supply to seal" pressure gauges. The difference in indicated delivery pressure will indicate a gas source malfunction or the failure of a gas connection. Any inflation gas leak into the refueling pool volume will be revealed by gas bubbles appearing at the surface of the pool.

As an alternate to the Presray seal, a rigid, segmented seal design, may be used. This seal relies on mechanical forces to effect the seal. The segmented seal is comprised of a stepped rectangular EPDM rubber compression seal split into five (5) equal circumferential segments.

The segmented joint is achieved by means of a beveled or skive overlap joint on the segment ends. The segmented design can be installed in approximately one (1) hour, compared to the Presray design which takes about approximately four (4) hours to install. This reduces outage time and radiation dose.

Reactor Cavity Filtration System The Reactor Cavity Filtration System provides the capability of filtering the water in the reactor cavity whenever the cavity is filled. This filtration system maintains water clarity and removes suspended radioactive particles.

The system consists of a skid carrying four stainless steel filter units, associated piping, and valving mounted the 95' floor elevation against the northwest face of the shielding around Steam Generator No. 33. It is enclosed on its three exposed sides by shielding. A separate skid supports a motor driven centrifugal pump. Flexible hoses and hard piping connects both suction and discharge of the filter package with the refueling canal. All surfaces in contact with refueling water are either stainless steel or synthetic hose and filter medium. At present, the Reactor Cavity Filtration system is partially disassembled and is not used. All disassembled equipment can be reinstalled at a future date if it is desired to use the system. Filtration of the reactor cavity water can be performed using the Spent Fuel Pool Cooling System or a temporary augmented system, as described below.

When the Reactor Cavity Filtration System is not operable, temporary submersible filtration units are placed in the reactor cavity when it is filled with water. These units use plant power and are secured to the walls of the reactor cavity during their operation. They are removed prior to draining down the reactor cavity. The Reactor Cavity Filtration System is not required for safety.

Refueling Canal The refueling canal is a passageway extending from the reactor cavity to the inside surface of the Reactor Containment. The canal is formed by two concrete shielding walls that extend upward to the same elevation as the reactor cavity. The floor of the canal is at a lower elevation than the reactor cavity to provide the greater depth required for the fuel transfer system tipping device and the control cluster changing fixture located in the canal. The transfer tube enters the Reactor Containment and protrudes through the end of the canal. The canal wall and floor linings are similar to those for the reactor cavity.

Fuel Pool Enclosures A controlled leakage building designed for a negative pressure of 0.50 inches of water minimum, permanently encloses the fuel pool. The design features of the fuel handling building that provide this leak tightness are as follows:

89 of 176 IPEC00036052 IPEC00036052

IP3 FSAR UPDATE

1) Special sealing features at joints that include:

a) Sealing off all edges and ends of the walls with a combination of caulking and relatively soft neoprene strip, b) Installation of necessary additional closure flashing at the extremities and at openings, c) Supplying additional caulking in vertical and horizontal joints of liner panels, d) Furnishing liner panels in sufficient thickness to seat well on girt spacings and resist flexing in addition to withstanding the normal design wind loads, and e) Providing additional fastening for liner panels.

2) Personnel and rolling steel truck doors that seal by means of inflatable air seals.

These seals are inflated upon a high radiation alarm from R-5, although R-5 operability does not require this function.

3) Motor operated dampers designed to fail closed are installed on the discharge side of the two supply fans.

Prior to handling operations, when irradiated fuel is within the Fuel Handling Building, tests are performed to verify the filtration leak tightness. A negative pressure greater than or equal to 0.125 inch water gauge shall be maintained with respect to atmospheric pressure during emergency refueling mode of operation. Fuel handling operations are performed in accordance with the Technical Specifications.

Refueling Water Storage Tank The normal duty of the Refueling Water Storage Tank is to supply borated water to the refueling canal for refueling operations. In addition, the tank provides borated water for delivery to the core following either a Loss-of-Coolant or a steam line rupture accident. This is described in Chapter 6. The capacity of the tank was based upon the requirement for filling the reactor cavity and refueling canal.

The water in the tank is borated to a concentration that assures reactor shutdown by at least 5%

~k/k when all Rod Cluster Control assemblies are inserted and when the reactor is cooled down for refueling. Heating is provided to maintain the temperature above freezing.

The tank design parameters are given in Chapter 6.

Spent Fuel Storage Pit The spent fuel storage pit was designed for the underwater storage of spent fuel assemblies and fuel assembly inserts after their removal from the reactor. A pumping system recirculates the water in the pool at a flow rate of 230 gpm through four stainless steel filter units, to reduce the burden of radioactive crud.

90 of 176 IPEC00036053 IPEC00036053

IP3 FSAR UPDATE The Backup Spent Fuel Pool Cooling system has been installed to operate in parallel with the Normal SFP Cooling System to improve pool conditions during refueling activities. The BSFPCS is a manual system served by an independent cooling water source (demineralized water). A primary loop handles the SFP water and consists of two 100% capacity pumps, a plate heat exchanger, associated piping, and local instrumentation. A secondary loop is the heat sink for the system, and includes two, open-circuit evaporative cooling towers, two 100%

capacity feed pumps, associated piping, and local instrumentation. Make-up and fill for the secondary loop is normally provided by demineralized water, with an alternate, emergency source available through the Fire Protection System.

Power for all equipment is supplied from 480 VAC MCCs E1 and E2. For greater availability of power, and reliability of the cooling function, the BSFPCS includes a transfer switch that allows alignment to either the normal power sources MCC E1 and E2, or a rental diesel generator unit (with Engineering discretion). This feature allows an alternate power source in the event the MCCs become inoperable.

The pit accommodations are listed in Table 9.5-1 and the layout of the Fuel Storage Building is shown on Plant Drawing 9321-F-25143 [Formerly Figure 9.5-2]. In 1990, the high density racks shown on Plant Drawing 9321-F-25143 [Formerly Figure 9.5-2] were replaced with maximum density racks containing 1345 cells (see Figure 9.5-2A). The Technical Specifications provide limitations on fuel storage in Regions 1 and 2 of the spent fuel pit to ensure keff<0.95 while taking no credit for boron in the water (Figures 9.5-2B and 9.5-2C).

Spent fuel assemblies are handled by a long-handled tool suspended from an overhead hoist and manipulated by an operator standing on the movable bridge over the pit.

The spent fuel storage pit is constructed of reinforced concrete having thick walls and is Class I seismic design. The entire interior basin face and transfer canal is lined with stainless steel plate. Hence, the probability of rupture of the pit is exceedingly low.

The structural steel and metal siding building surrounding the spent fuel pit is seismic Class III, as is the Fuel Storage Building crane.

The design tornado missiles will not penetrate the walls of the spent fuel pit. Should a missile hit the surface of the spent fuel pit water, by the time it reached the top of the spent fuel assemblies its velocity would be reduced so that it would not damage the spent fuel.

For a discussion of spent fuel pit dewatering as a result of a tornado, refer to Section 16.4.

The ventilation system in the Fuel Storage Building enclosing the spent fuel pit was designed so that there is a slight negative pressure inside the building during normal refueling operations.

Whenever the ventilation system is required to be in operation, the bypass dampers around the charcoal filter must be manually closed and leak tested to assure that it is properly sealed. On a high radiation alarm, the following actions automatically take place:

1) Building ventilation supply fans are secured,
2) Dampers at ventilation supply fans close,
3) If open, rolling door closes,
4) inflatable seals on main doors and truck doors are actuated (R-5 operability does not require this function, however), and
5) Exhaust fan continues to run.

91 of 176 IPEC00036054 IPEC00036054

IP3 FSAR UPDATE Under these conditions, the maximum calculated in-leakage to the building (caused by the operation of the exhaust fan) would be 20,000 cfm with a one-half inch of water negative pressure inside the building. Thus, following the release of radioactivity in the Fuel Storage Building, there will be zero air leakage from the building proper, and the entire exhaust from the building will pass through roughing, HEPA, and charcoal filters before going up the plant vent.

Technical Specifications (TS) require charcoal and HEPA filter testing to demonstrate operability any time a fire, chemical release or work done on the filters could alter integrity. TS surveillance testing is based upon a maximum flow of 20,000 cfm giving a minimum safety factor of 2 for methyl iodide removal efficiency while allowing 1% bypass. NSE 98-3-017 HVAC demonstrates, for the purpose of TS implementation, that welding is not a fire, a chemical release or work that could alter filter integrity. The NSE also demonstrates that organic components from painting and similar activities could not alter filter integrity until the organic components are above 10 % by weight and concludes that filter testing shall be performed when the organic components are greater than or equal to 2.5 % by weight organics. Administrative controls are required to evaluate the percent (%) by weight of organics when activities that could generate organics are conducted.

A pushbutton switch is provided adjacent to the 95' elevation door leading to the Fan House.

This switch allows the Fuel Storage Building Exhaust Fan to be momentarily shut down and air removed from the door seal thereby allowing the door to be opened. The fan will automatically restart and the door is resealed after a preset time has elapsed (approximately 30 seconds).

The handling of irradiated fuel in the Fuel Storage Building or movement of the spent fuel cask or cask crane over the Spent Fuel Pit are prohibited when the fuel storage building emergency ventilation system is inoperable.

Since the spent fuel cask must be loaded in the spent fuel pit, the crane must carry a heavy load, namely the cask, over the pit. The bases for the acceptability of this design are:

1) During normal fuel handling operations, heavy loads (above 2000 Ibs) cannot be carried over spent fuel, and
2) Even in the event that the spent fuel cask is dropped over the pit, the loss of water from the resulting failed liner plate and cracked concrete base is inconsequential.

Loss of water in the spent fuel pit and the resultant uncovering of the spent fuel by way of drains and permanently connected system cannot take place for the following reasons:

1) The suction of the spent fuel pit pump is taken from a point approximately six (6) feet below the top of the pool wall; therefore this pump cannot be used to uncover the fuel, even accidentally.
2) The spent fuel pit pump discharge pipe terminates in the pool at elevation 74' - 4 %".

This elevation is approximately five (5) feet above the top of the spent fuel assemblies; therefore this pipe could not accidentally become a siphon to uncover the fuel.

3) The skimmer pump takes suction from, and discharges to the surface of the pool; therefore it could not accidentally or otherwise uncover the spent fuel.

92 of 176 IPEC00036055 IPEC00036055

IP3 FSAR UPDATE

4) There are no drains on the bottom or side walls of the spent fuel pit. Draining would have to be done deliberately by a temporary pump.
5) The spent fuel pit cooling loop was designed to seismic Class II and the cleanup equipment loop was designed to seismic Class III criteria; however, their failure could not result in the uncovering of the spent fuel, as explained above.

A radiation monitor (R-5) is located in the Fuel Storage Building. The monitor provides continuous indication of the radiation level with high radiation alarm given both locally and in the Control Room. The air filtration system for the Fuel Storage Building is automatically actuated on high radiation signal. Radiation levels in the spent fuel storage area shall be monitored continuously whenever there is irradiated fuel stored therein. If the monitor is inoperable, a portable monitor may be used. Equipment is also provided to monitor spent fuel pit water level with low level annunciated in the Control Room. (See Section 11.2)

The primary source of makeup water to the spent fuel pit is the Primary Makeup Water Storage Tank, which is a seismic Class I component. The pumps and most of the piping associated with this tank are also seismic Class I. The makeup water loop to the spent fuel pit is seismic Class II, as is the spent fuel pit cooling loop. The cleanup equipment and skimmer loops are seismic Class III. Additional backup can be provided through a temporary connection from the plant demineralizers or from the Fire Water Tank.

In addition, there is a second spent fuel pool cooling system pump to provide standby capacity.

There is also a provision for adding a portable cooling pump.

Storage racks provided to hold spent fuel assemblies were erected on the pit floor. The racks were designed so that it is impossible to insert fuel assemblies in other than the prescribed locations (there is insufficient space between the rack assembly and the SFP wall), thereby ensuring the necessary spacing between assemblies. Control rod clusters or other inserts are stored inside the spent fuel assemblies.

The spent fuel storage racks consist of twelve freestanding welded honeycomb arrays of type 304 stainless steel boxes that have no grid frame structure. The storage racks are arranged and categorized in two regions based on fuel assembly enrichment and burn-up. The nominal pitch for Region I is 10.76 inches. The nominal pitch for Region II is 9.075 inches. All storage cells are bounded on four sides by boral poison sheets, except on the periphery of the pool rack array.

Each of the twelve maximum density racks are supported and leveled on four screw pedestals which bear directly on the pool floor. These freestanding racks are free to move horizontally.

However, with only a 0.2 friction factor, there is no wall impact even assuming five (5) OBE and one (1) SSE earthquake event all added up in the same direction. Additionally, there is no rack-to-rack impact since the maximum density racks were designed to be installed with essentially no gap between the racks. The strong hydrodynamic coupling between the racks causes the racks to move together even when a full and empty rack are adjacent to each other.

Major Equipment Required for Fuel Handling Reactor Vessel Stud Tensioner 93 of 176 IPEC00036056 IPEC00036056

IP3 FSAR UPDATE The stud tensioner is a hydraulically operated (oil is the working fluid) device provided to permit preloading and unloading of the reactor vessel closure studs at cold shutdown conditions. Stud tensioners were chosen in order to minimize the time required for the tensioning or unloading operations. Three tensioners are provided and they are applied simultaneously to three studs 120 apart. One hydraulic pumping unit operates the tensioners that are hydraulically 0

connected in parallel. The studs are tensioned to their operational load in two steps to prevent high stresses in the flange region and unequal loadings in the studs. Relief valves are provided on each tensioner to prevent over- tensioning of the studs due to excessive pressure. Charts indicating the stud elongation and load for a given oil pressure are included in the tensioner operating instructions. In addition, micrometers are provided to measure the elongation of the studs after tensioning.

Reactor Vessel Head Lifting Device The reactor vessel head lifting device consists of a welded and bolted structural steel frame with suitable rigging to enable the crane operator to lift the head and store it during refueling operations.

Three vertical legs and a platform assembly are permanently attached to the reactor vessel head lifting lugs. The sling assembly is attached to the three vertical legs and is used when installing and removing the reactor vessel head. During plant operations, the sling assembly is removed and the three vertical legs and platform assembly remain attached to the reactor vessel head. The total estimated weight of the reactor vessel head with lifting rig is 150 tons.

(See Figure 9.5-8)

The maximum drop height of the reactor vessel head is approximately 54 feet assuming that the crane hook is at the maximum possible hook elevation over the mating surface of the reactor vessel flange. No features of the crane and its controls are necessary to limit this drop height to a lesser value.

Reactor Internals Lifting Device The reactor internals lifting device is a structural frame providing the means to grip the top of the reactor internals package (upper or lower) and to transfer the lifting load to the crane. The device is lowered onto the guide tube support plate of the internals and is manually bolted to the support plate by three bolts. The device may be lowered onto the lower internals package and is manually bolted to the core barrel by the same three bolts. The bolts are controlled by long torque tubes extending up to an operating platform on the lifting device. Bushings on the fixture engage guide studs mounted on the vessel flange to provide close guidance during removal and replacement of the internals package.

This fixture is a three legged structural frame device that connects the main crane hook to the upper support plate or core barrel for handling operations. It connects to the internals flanges by means of screw threads (See Detail A of Figure 9.5-6). The total estimated weight of the lifting rig and upper internals is 67 tons. The estimated weight of the upper internals is 59 tons.

The maximum drop height of the core barrel assembly is 60 feet.

Manipulator Crane The manipulator crane is a rectilinear bridge and trolley crane with a vertical mast extending down into the refueling water. The bridge spans the reactor cavity and runs on rails set into the 94 of 176 IPEC00036057 IPEC00036057

IP3 FSAR UPDATE floor along the edge of the reactor cavity. The bridge and trolley motions are used to position the vertical mast over a fuel assembly in the core. A long tube with a pneumatic gripper on the end is lowered down out of the mast to grip the fuel assembly. The gripper tube is long enough so that the upper end is still contained in the mast when the gripper end contacts the fuel. A winch mounted on the trolley raises the gripper tube and fuel assembly up into the mast tube.

The fuel is transported while inside the mast tube to its new position.

All controls for the manipulator crane are mounted in a console on the trolley. The bridge, trolley, and main hoist are equipped with encoders for position readout on the console. Bridge and trolley position may also be read directly from position scales near the bridge and trolley rails. Drives for the bridge, trolley, and main hoist are variable speed.

The suspended weight on the gripper tool is monitored by an electric load cell indicator mounted on the control console and by the Control System. Under normal operating modes, when loaded, hoist lower motion is permitted in the Core zone, Upender zone, or RCC change basket only. When unloaded, hoist lower motion is permitted in the same areas as hoist loaded, and also from "hoist full up" to "hoist inside mast" in any area. Hoist raise is permitted in any area, loaded or unloaded. Raising of the guide tube is not permitted if the gripper is unlatched and the load monitor indicates a load above normal gripper weight. Hoist raise is not permitted if the load is more than 150 lb. above the selected fuel and insert type, unless the hoist elevation is in a load bypass zone where that overload is set at + 200 lb. In all zones including load bypass zones, there is a backup overload set at +250 lb. Hoist lower is not permitted if the load is more than the 150 Ibs. below the setting per fuel type unless the hoist elevation is in the bypass zone.

If it is in this zone, a slack cable and / or encorder value interlock would stop motion. The gripper is interlocked electrically (through an electric load cell in conjunction with hoist encoder position) and also a mechanical spring lock so that it cannot be opened when supporting a fuel assembly.

Safety features incorporated in the system are as follows:

a) Boundary zone control provided by the Control System in conjunction with encoders on each axis preclude the possibility of violating the boundaries established for safe operation of this system. In normal operation, traverse of the trolley and bridge is limited to the areas of the Core, RCC basket location, Upender location, or the Test fixture location and a clear path connecting those areas. Operation of the bridge or trolley outside the boundary system will not be permitted unless the bypass mode has been selected. Existing stops in the bridge and trolley rails will inhibit motion beyond designed limits when in the bypass mode of operation.

b) Simultaneous motion of the bridge and trolley will be permitted. A mapping program within the Control System allows the operators to specify safe operation zones. In addition, isolated obstructions can also be identified. Operation of the hoist will not be permitted when the bridge or trolley are in operation.

c) When the gripper is loaded, the Manipulator Crane will not traverse (between the Core and the Upender, Text fixture, or RCC change basket) unless the guide tube (inner mast) is at full up. The refueling bridge can traverse within the Core Zone with the gripper loaded and not at full up. The traverse speeds will be restricted during this scenario. When the gripper is unloaded, the Manipulator Crane will not traverse (between the Core and the Upender, Test fixture, or RCC change basket) unless the guide tube (inner mast) is protected in the mast. The Manipulator Crane can traverse within the Core zone with the gripper unloaded and not inside the mast. The traverse 95 of 176 IPEC00036058 IPEC00036058

IP3 FSAR UPDATE speeds will be restricted during this scenario. The Manipulator Crane can traverse a small distance when an unloaded gripper is extended outside the inner mast at a RCC basket location, Upender location, or the Test fixture location for the fine positioning to aid in withdrawing or inserting a fuel bundle. In normal operation, traverse of the trolley and bridge is limited to the areas of the Core, RCC basket location, Upender location or the Test fixture location and a clear path connecting those areas whether the hoist is loaded or unloaded.

d) An electrical interlock that prevents opening of a solenoid valve in the air line to the gripper disengage cylinder has been incorporated into this system, which takes into account hoist load, hoist position, and system air pressure. The fuel gripper must be in its down position in the Core, or in the Fuel Transfer System or RCC change basket, or Test fixture with a slack cable, and the air pressure interlock is not tripped in order to unlatch. The spring operated mechanical backup will prevent operation of a loaded gripper even if air pressure is applied to the operating cylinder.

e) Hoist raise is not permitted if the load is more than 150 lb. above the selected fuel and insert type, unless the hoist elevation is in a load bypass zone where the overload is set at + 200 lb. In all zones including load bypass zones, there is a backup overload set at

+ 250 lb.

f) Interlocks on all drive circuits prevent operation if there is a gripper failure where both limits for the gripper are made at the same time or both limits are not made at the same time.

g) The bridge and trolley drives are interlocked to prevent the manipulator crane from going outside the secure zone. In normal operation, traverse of the trolley and bridge is limited to the areas of the Core, RCC basket location, Upender location, or the Text fixture location and a clear path connecting those areas whether the hoist is loaded or unloaded. The bridge or trolley will not be able to challenge limits of a particular boundary. In bypass mode of operation, there will be no boundary limits except for hard stops on bridge and trolley rails; however, the bridge and trolley will be restricted to slow speed.

Suitable restraints are provided between the bridge and trolley structures and their respective rails to prevent derailing and the manipulator crane is designed to prevent disengagement of a fuel assembly from the gripper in the event of a maximum potential earthquake.

Only core components or tools required for the placement or removal of core components are handled over an open reactor vessel.

Any time the reactor vessel is open, the following precautions are taken to assure that foreign materials do not inadvertently get into the reactor vessel:

1) All personnel tape the cuffs, pockets, buttons, etc. of their "anti-contamination clothing"
2) A barrier is established surrounding the reactor cavity to prevent unnecessary movement in the area 96 of 176 IPEC00036059 IPEC00036059

IP3 FSAR UPDATE

3) Only the minimum number of people required to safely perform the job are allowed in the area
4) All facets of the Quality Assurance Plan are in effect and enforced
5) The cranes are visually inspected before the reactor vessel is opened
6) Prior to lifting of the head, an NDT of the hook is performed.

All fuel handling operations, including core alterations, are performed under the supervision of an individual holding either a Senior Reactor Operator license or a Senior Reactor Operator license limited to fuel handling, as established in 10 CFR 50.54 (m) (2).

Discussions of the effects of the seismic Class III Fuel Storage Building crane on seismic Class I functions are found in Section 16.4 The manipulator crane bridge and trolley are restrained on the rails by the following means:

(See Figure 9.5-3)

1) Horizontally - by guide rollers (cam follower) at each wheel on one truck only. The rollers are attached to the bridge truck at the wheels and contact the vertical faces of the rail to prevent horizontal movement.
2) Vertically - by anti-rotation bars, in the vicinity of each wheel at all 4 wheel locations.

The anti-rotation bars are carbon steel bars bolted to the truck and extending under the rail flange, to prevent lifting of any wheel from the rail.

Polar Crane The containment building polar crane is utilized to remove and replace heavy loads during refueling operations. These include:

1) Control rod drive missile shield
2) Reactor vessel head
3) Reactor internals All standard modes of failure were considered in the design of the polar crane. These modes of failure were provided for by utilization of a minimum safety factor of 5 based on the ultimate strength of the material used in the design of cables, shafts and keys, gear teeth and brakes.

All crane equipment was sized to handle the single heaviest load realized during plant operation. All lifts are made by qualified personnel. The equipment is properly maintained and periodically inspected by qualified personnel. An analysis of impact loading on the reactor vessel due to dropping the reactor vessel head is provided in Section 9.5.3.

Fuel Storage Building Crane The fuel storage building crane is utilized to move loads not exceeding 2000 Ibs during normal refueling operations. These loads include:

1) Irradiated specimens
2) Neutron source 97 of 176 IPEC00036060 IPEC00036060

IP3 FSAR UPDATE

3) Crane load block
4) Burnable poison rod and handling tool.

Mechanical stops incorporated on the bridge rails of the fuel storage building crane make it impossible for the bridge of the crane to travel further north than a point directly over the spot in the spent fuel pit that is reserved for the spent fuel cask. Therefore, it will be impossible to carry any object over the spent fuel storage areas north of the spot in the pit that is reserved for the cask with either the 40 or 5-ton hook of the fuel storage building crane.

It is possible to use the fuel storage building crane to carry objects over the spent fuel storage areas that are directly east of the spot in the pit that is reserved for the cask. However, FSAR requirements and plant procedures prohibit any object weighing more than 2,000 pounds from being moved over any region of the spent fuel pit when the pit contains spent fuel, unless a technical analysis has been performed consistent with the requirements of NUREG-0612 establishing the necessary controls to assure that a load drop accident could damage no more than a single fuel assembly. Administrative and procedural controls to protect fuel and fuel racks may include path selection to prevent loads from passing over or near fuel. For cases in which very heavy loads (>30,000 pounds) are transported over the spent fuel pit, the loads cannot under any circumstances pass over fresh or irradiated fuel. In all cases where loads

>2,000 pounds are carried over the pit, the ventilation system must be operable.

The mechanical stops may be removed under administrative controls and the crane moved over spent fuel storage areas, provided that the fuel storage building ventilation system is operable, the spent fuel pit boron concentration is at least 1000 ppm and there is no heavy load carried.

This allows operations over the spent fuel pit with the 5-ton hoist. The 40-ton hoist may not carry any load over the SFP since the load block is a one-ton load and has not been fully evaluated for heavy loads.

All standard modes of failure have been considered in the design of the fuel storage building crane. These modes of failure were provided for by utilization of a minimum safety factor of 5 based on the ultimate strength of the material used in the design of cables, shafts and keys, gear teeth and brakes.

All crane equipment was sized to handle the single heaviest load realized during plant operation. All lifts are made by qualified personnel. The equipment is properly maintained and periodically inspected by qualified personnel. An analysis of impact loading of the spent fuel cask into the spent fuel storage pool is provided in Section 9.5.3 Spent Fuel Pit Bridge The spent fuel pit bridge is a wheel-mounted walkway spanning the spent fuel pit that carries an electric monorail hoist on an overhead structure. Fuel assemblies or inserts are moved within the spent fuel pit by means of a longhandled tool suspended from the hoist. The hoist travel and tool length were designed to limit the maximum lift of a fuel assembly to a safe shielding depth.

Fuel Transfer System The fuel transfer system, shown in Figure 9.5-1, is a motor winch driven conveyor car that runs on tracks extending from the refueling cavity through the transfer tube and into the spent fuel pit.

The conveyor car received a fuel assembly in the vertical position from the manipulator crane.

98 of 176 IPEC00036061 IPEC00036061

IP3 FSAR UPDATE The fuel assembly is lowered to a horizontal position for passage through the tube, and then is raised to a vertical position in the spent fuel pit.

During plant operation, the conveyor car is stored in the refueling canal. A blind flange is bolted on the transfer tube to seal the Reactor Containment.

Rod Cluster Control Changing Fixture A fixture is mounted on the reactor cavity wall for removing rod cluster control (RCG) elements from spent fuel assemblies and inserting them into new fuel assemblies. The fixture consists of two main components: a guide tube mounted to the wall for containing and guiding the RCC element, and a wheel-mounted carriage for holding the fuel assemblies and positioning fuel assemblies under the guide tube. The guide tube contains a pneumatic gripper on a winch that grips the RCC element and lifts it out of the fuel assembly.

By repositioning the carriage, a new fuel assembly is brought under the guide tube and the gripper lowers the RCC element and releases it. The manipulator crane loads and removes the fuel assemblies into and out of the carriage.

Refueling Procedure Refueling requirements and procedures are contained in the Technical Specifications and in this FSAR section.

Preparation a) The reactor is shut down, cooled to T avg, < 140 OF and boron concentration is checked b) A radiation survey is made and the containment vessel is entered c) The control rod drive mechanism (CRDM) missile shield is removed to storage d) CRDM cables and cooling air ducts are disconnected from CRDM and removed to storage e) Reactor vessel head insulation and instrument leads are removed f) The reactor vessel head nuts are loosened with the hydraulic tensioners g) The reactor vessel head studs are removed to storage h) The canal drain holes are plugged and the fuel transfer tube flange is removed i) Checkout of the fuel transfer device and manipulator crane is started j) Guide studs are installed in either two or three holes and the remainder of the stud holes are plugged k) The reactor vessel to cavity seal (either inflatable "Presray" seal, or rigid segmented seal) is in place 99 of 176 IPEC00036062 IPEC00036062

IP3 FSAR UPDATE I) Final preparation of underwater lights and tools is made. Checkout of manipulator crane and fuel transfer system is completed m) The reactor vessel head is unseated, raised, and placed on the storage pedestal n) The reactor cavity is filled with water. The water is pumped into the reactor cavity by the residual heat removal pumps from the Refueling Water Storage Tank through the reactor vessel. The normal Residual Heat Removal System inlet valves from the Reactor Coolant System are closed. (See alternate method described below)

Subsequent to cavity fill, the water may be purified via the Reactor Coolant Drain Tank (RCDT) and associated pumps

0) When the reactor cavity is filled, restore Residual Heat Removal System to normal operation p) The control rod drive shafts are unlatched q) The reactor vessel internals lifting rig is lowered into position by the plant crane and latched to the support plate r) The reactor vessel internals are lifted out of the vessel, inspected to ensure no core component is hanging from the upper core plate and placed in the underwater storage rack s) The core is now ready for refueling.

Also provided is an alternate method of filling the reactor cavity without the necessity of the water having to pass through the reactor vessel and thereby dislodge crud that could cloud the water and delay refueling operations.

At the time of reactor cavity fill, flanged spool pieces are removed from the containment spray lines and replaced with tee-spool pieces. One end of the tee-spool pieces is blanked off to prevent fluid from entering the containment spray headers. The alternate fill line is connected to one of the tees via a length of high pressure metal hose. Should the pump in the system feeding the alternate fill line experience trouble, the metal hose can be disconnected and attached to the other tee for completion of the fill operation. Valves for pump startup are included with each spool piece. Additionally, each spool piece contains a vent valve, pressure gauge and pressure gauge isolation valve. The alternate fill line contains three orifice plates that limit pump discharge to its design flow rate of 2600 gpm. (See Plant Drawings 9321-F-20238, and -27353 [Formerly Figure 9.5-9])

Refueling The refueling sequence is started with the manipulator crane. Steps a through d may be performed in any order as is most efficient for the core loading process. Alternatively, the entire core may be removed to the spent fuel pit. The strategy for fuel assembly shuffle is as follows:

a) Spent fuel is removed from the core and placed into the fuel transfer system for removal to the spent fuel pit.

100 of 176 IPEC00036063 IPEC00036063

IP3 FSAR UPDATE b) The remaining spent fuel is shuffled to new positions as identified in the core loading pattern.

c) Fuel assembly inserts such as burnable assemblies and control rod assemblies are shuffled as identified in the core loading pattern.

d) New fuel assemblies are brought in and loaded into the designated locations.

e) Alternatively, the entire core may be unloaded into the spent fuel pit, the inserts shuffled as needed and the new core returned to the reactor vessel.

f) Whenever new fuel is added to the reactor core, a reciprocal curve of source neutron multiplication (inverse count rate ratio) is recorded to verify the subcriticality of the core.

Reactor Reassembly a) The fuel transfer car is parked and the fuel transfer tube gate valve closed b) The reactor vessel internals package is picked up by the plant crane and replaced in the vessel. The reactor vessel internals lifting rig is removed to storage c) The control rod drive shafts are relatched to the RCC elements d) The manipulator crane is parked e) The old seal rings are removed from the reactor vessel head, the grooves cleaned and new rings installed f) The refueling cavity is drained using either the Residual Heat Removal (RHR) system or the refueling cavity drain pump. If necessary, any water remaining in the cavity after normal RHR pump drain down can be drained via the Reactor Coolant Drain Tank (RCDT) and associated pumps g) The reactor vessel flange surface is manually cleaned h) The reactor vessel head is picked up by the polar crane, positioned over the reactor vessel and lowered i) The reactor vessel head is seated j) The reactor vessel to cavity seal ("Presray" inflatable seal, or rigid, segmented seal) is removed k) The guide studs are removed to their storage rack. The stud hole plugs are removed I) The head studs are replaced and retorqued m) The canal drain holes are unplugged and the fuel transfer tube flange is replaced 101 of 176 IPEC00036064 IPEC00036064

IP3 FSAR UPDATE n) Electrical leads and cooling air ducts are reconnected to the CRDMs

0) Vessel head insulation and instrumentation leads are replaced p) The CRDM missile shield is picked up with the plant crane and replaced q) Equipment and personnel access doors are closed and sealed r) A hydrostatic test is performed on the reactor vessel s) Control rod drives are checked t) Pre-operational tests are performed 9.5.3 System Evaluation Underwater transfer of spent fuel provides essential ease and corresponding safety in handling operations. Water is an effective, economic and transparent radiation shield and reliable cooling medium for removal of decay heat.

Basic provisions to ensure the safety of refueling operations are as follows:

a) Gamma radiation levels in the Containment and fuel storage areas are continuously monitored. These monitors provide an audible alarm at the initiating detector indicating an unsafe condition. Continuous monitoring of reactor neutron flux provides immediate indication and alarm in the Control Room of an abnormal core flux level b) Violation of containment integrity is not permitted when the reactor vessel head is removed unless the shutdown margin is maintained greater than 5% 8k/k c) Whenever new fuel is added to the reactor core, a reciprocal curve of source neutron multiplication (inverse count rate ratio) is recorded to verify the subcriticality of the core d) Direct communication between the Control Room and the refueling cavity manipulator crane is available whenever changes in core geometry are taking place. This provision allows the Control Room operator to inform the manipulator crane operator of any impending unsafe condition detected from the main control board indicators during fuel movement.

Malfunction Analysis An analysis is presented in Chapter 14 concerning damage to one complete outer row of fuel rods in an assembly. This accident is assumed as a conservative limit for evaluating environmental consequences of a fuel handling incident.

Any suspected defective fuel assembly can be placed in a can designed to contain failed fuel and sealed to provide an isolated chamber for testing for the presence of fission products.

102 of 176 IPEC00036065 IPEC00036065

IP3 FSAR UPDATE The failed fuel cans are typically stainless steel cylinders with lids that can be bolted in place remotely. An internal gas space in the lid provides for water expansion and for collection and sampling of fission product gases. Various remotely operable quick-disconnect fittings permit connection of the can to sampling loops for continuous circulation through the can.

If sampling shows the presence of fission products indicative of a cladding failure, the sampling lines are closed off by valves on the can and the fuel assembly is removed to the spent fuel storage racks to await shipment. Design of the failed fuel test cans complies with 10 CFR 72.

Failed fuel can also be detected through the use of the in-mast sipping system (which is essentially a version of the sipping can that is permanently attached to the fuel handling equipment) and the poolside ultrasonic failed fuel detector, which uses a probe to examine each fuel rod for entrained water.

Fuel assemblies containing suspected top nozzle spring screw failures may be inspected in the Spent Fuel Pit using a spring scale test to determine whether an imposed tension of approximately five pounds results in visible deflection of any of the nozzle's springs [Reference NSE 00-3-008 RCS].

Drop of Spent Fuel Element Cask Into Spent Fuel Storage Pool As indicated in Section 9.5-2, administrative controls and / or the presence of mechanical stops on the crane rails ensure that the cask or other heavy loads are not transported above fuel assemblies, hence, under no circumstances can the fuel assemblies be in jeopardy from the cask. However, the event that the cask would drop into the pool has been analyzed; the basic assumptions for analysis were as follows:

a) The drop would be from the cask's highest position which is 5 feet above the water surface and 43 feet above the bottom of the pool b) The cask is fully loaded and weight 40 tons.

The results of the analysis indicate that the cask would hit the bottom of the pit with a velocity of approximately 40 ftlsec, assuming a conservative drag coefficient of 0.5. In comparison, the cask would have reached a velocity of 52 ftlsec if dropped through 43 feet in the air.

Using the Ballistic Research Laboratories formula for the penetration of missiles in steel, the depth of penetration of the cask into the 1-inch wear plate covering the Y2-inch pit liner plate would be 0.32-inch, assuming the cask struck the wear plate while in a perfectly vertical position. In the event that the cask falls through the water at an angle, its terminal velocity would be somewhat less because of the increased drag. However, the cask would strike the wear plate with an initial line contact and would penetrate the wear plate and the pit liner plate, causing some cracking of the concrete below. This reinforced concrete is a minimum of 3'-7" thick and rests on solid rock.

Water would initially flow through the punctured liner plate and fill the cracks in the concrete. As the pit is founded on solid rock and much of the bottom of the pit is below the surrounding grade, very little water can be lost from the pit. The capacity of the makeup demineralized water supply to the pit is 150 gpm. In addition, the spent fuel pit cooling system piping includes a 4" blind flange connection for temporary cooling.

103 of 176 IPEC00036066 IPEC00036066

IP3 FSAR UPDATE Since the bottom of the spent fuel pit is an average 24 feet below grade and since no equipment areas are in the vicinity, there can be no flooding of other areas outside the Fuel Storage Building and subsequent damage to equipment.

Siding Panel as a Missile Analysis has been made for the drop of a 32-1/2 ft long by 19 ft wide by 2 in thick insulated siding panel missile weighing 1860 Ibs through 50 ft of free fall onto the water surface of the spent fuel pit. Although such a missile would logically be expected to plane in the water and impact the side walls of the storage pool, the analysis shows that even with the highly conservative assumption that it penetrates the water in a guillotine fashion, such that drag is based on the 19 ft x 2 in minimum cross sectional area, the drag and buoyancy forces prevent fuel damage.

The missile kinetic energy required to damage the fuel assembly cladding if 6900 ft-Ibs. The missile kinetic energy variation with water depth is computed from:

D(KE)/dY= W-(zi2g)(2KE)(Wjg'j lCoA - zA y where KE = missile kinetic energy W = missile weight z = missile cross sectional area = 3.2 ft2 z = water density = 62.4 Iblfe CD = drag coefficient = 1.0 g = gravity constant - 32.2 fUsec2 y = depth of water penetrated Since the fuel storage pool is 40 ft deep with an excess of 23 ft of water over the top of the fuel assemblies, the postulated missile will be buoyed up before it strikes the fuel storage racks and fuel. Should it be postulated that tornado winds reduced the water level by 6 ft, the missile would impact the storage cell, with a striking impact energy of 2875 ft-Ib per cell. However, there would be substantial margin to fuel clad failure.

The equivalent analysis was made for a 12-ft x 12-in x 4-in wooden plant striking the water vertically with a velocity of 90-mph. After 23 ft of water penetration, the plank kinetic energy is 4784 ft-Ibs under the minimum drag area assumption. This would be insufficient to cause fuel failure even if the plant were to miss the storage rack and impact the top end of a stored fuel assembly. In order to illustrate the effect of planing, which would result from unsymmetrical impact of this missile on the water surface, a three dimensional model was analyzed.

Figure 9.5-4 shows calculated motion when the missile axis and missile velocity are in alignment with each other but impact is 5 degrees of vertical. Figure 9.5-5 shows the motion when the missile axis and initial velocity are misaligned by 5 degrees. It is seen that quite small deviations from a perfectly symmetrical water impact results in rotation of the missile, significantly reducing its penetration depth.

The effect of an automobile weighting 4000 Ibs, entering the pool at 17 mph with 25 sq. ft contact area, was also analyzed. Due to the slower speed and the much larger drag area, the 104 of 176 IPEC00036067 IPEC00036067

IP3 FSAR UPDATE automobile will have an impact energy of 3133 ft-Ib per cell, far less than the energy required for clad damage (see NSE 00-3-039 SFPC for details on missile analysis).

It is concluded that the storage pool water and storage cells provide effective protection against tornado missiles and that the chance of fuel damage by such missiles is low. Considering this, the low probability of a strong tornado striking the site, the fact that radioactive iodine in a stored fuel assembly is less than 10% of the shutdown value except of 6% of the year (first 2.3 half-lives), and the unstable and dispersive meteorological conditions accompanying a tornado, further protection is not needed.

Uplift for CRS The individual spent fuel racks were not designed to withstand uplift forces, as a force applied to one cell will be distributed to the entire array of fuel cells (racks) in the pit. This occurs because the racks are not attached to the bottom liner of the pit but rather are interconnected.

The dead weight of adjacent fuel cells (racks) and fuel elements relieves any uplift force on the rack support members.

No force of significant magnitude can be applied to the fuel racks when removing a fuel assembly as the inside face of each rack opening was fabricated free of all burrs and rough edges and is smooth and clean.

Reactor Impact Loads The worst case of impact loading, that of dropping the reactor vessel head onto the reactor vessel was evaluated. A weight of 300,000 Ibs, was assumed to drop from the maximum possible height of 54 feet above the reactor vessel flange. The total impact load was calculated to be 74.5 x 106 1bs or 18.6 x 106 Ibs acting on each vessel support.

Using this load, the maximum stress at the nozzle-to-shell juncture occurs on the outlet nozzle and is 62,600 psi. This compares favorable with the allowable stress of 84,000 psi (faulted condition). The maximum calculated direct shear stress on the nozzles of 14,300 psi, which is less than the allowable of 33, 600 psi (faulted condition). The shear stress calculated by driving the nozzle support pad through the nozzle is 28,000 psi, which is less than the yield stress (44,500 psi).

All stresses are within allowable limits, and therefore, the structural integrity of the nozzle and nozzle supports is maintained.

No reduction in dynamic load was taken due to the dampening effect of the head falling through 23 feet of water.

Therefore, it is considered very unlikely that the dropping of the reactor vessel head (or core barrel assembly or missile shield) will disrupt the flow of coolant to and from the reactor vessel and refueling canal. Some local yielding of the nozzles (supports) may occur that could cause relative displacement between the vessel seal ledge and concrete seal support ring that could cause water seal failure. However, loss of all refueling water down through the annulus between vessel and concrete is not a safety-related item. Any water lost in this manner would merely drain to the containment sump.

105 of 176 IPEC00036068 IPEC00036068

IP3 FSAR UPDATE 9.5.4 Minimum Operating Conditions Minimum operating conditions are specified in the Technical Specifications, FSAR Sections 1.3.6, 9.5.2 and 9.5.5, and plant procedures.

9.5.5 Tests and Inspections Upon completion of core loading and installation of the reactor vessel head, certain mechanical and electrical tests were performed prior to initial criticality. The electrical wiring for the rod drive circuits, the rod position indicators, the reactor trip circuits, and the incore thermocouples, were tested at the time of installation. The tests were repeated on these electrical items before initial plant operation.

The following tests shall be performed on cranes or hoists utilized in irradiated fuel movement prior to fuel movement:

  • Dead-load test (weight must be equal to or greater than the maximum load assumed by crane or hoist).
  • Thorough visual inspection after dead-load test.
  • Test of interlocks and overload cutoff devices, prior to movement of fore components.

9.5.6 Crane Operator Qualifications A qualification program for crane operators was established requiring the following:

a) Certification by a company physician that the crane operator met the physical standards set forth in USAS 830.2.0-1967, Article 2.3.1.2 b) Successful completion of an oral and practical examination given by a designated experienced Crane Instructor c) Certification by the crane operator that he has read, understands and will comply with the operational and safety requirements set forth by OSHA and USAS 830.2.0-1967.

This qualification program meets the requirements of Chapter 2-3 of ANSI 8 30.2-1967, "Operation - Overhead and Gantry Cranes", as developed by the American National Safety Code for Cranes, Derricks, Hoists, Jacks and Slings.

The crane operator qualification program is one component of a defense-in-depth approach used to properly manage the lifting of heavy loads near spent fuel and safe shutdown systems in accordance with NUREG-061; "Control of Heavy Loads at Nuclear Power Plants," dated July 1980. Other components include use of safe load paths and load handling procedures. In addition, affected cranes and lifting devices are subject to industry standards for design, testing, inspection and maintenance. Specific requirements stated in the Authority's responses to NUREG-0612 are summarized in the NRC's Safety Evaluation Report dated February 13, 1985, as modified by 50.59 Evaluation Number 05-0294-PR-00-RE which relaxed the Reactor Head Lifting Rig and Upper Intemals Lifting Rig inspection interval for NDE and dimensional examination from 12 months, or prior to use, to 5 year intervals.

106 of 176 IPEC00036069 IPEC00036069

IP3 FSAR UPDATE TABLE 9.5-1 FUEL HANDLING DATA New Fuel Storage Pit Core storage capacity, equivalent cores (approximately) 1/3 Equivalent fuel assemblies 72 Center-to-center spacing of assemblies, inches 20%

Maximum keffwith unborated water for any degree of 0.95 interspersed moderation Spent Fuel Storage Pit Core storage capacity, equivalent cores 6.96 Equivalent fuel assemblies 1345 Number of space accommodations for failed o fuel cans Number of space accommodations for spent fuel 1 shipping casks Center-to-center spacing of assemblies, inches Region I 10.76 Region II 9.075 Maximum keffwith unborated water 0.95 Maximum effwith unborated water for any degree of 0.95 interspersed moderation Miscellaneous Details Width of refueling canal, ft 3 Wall thickness for spent fuel storage pit, ft 3 to 6 Weight of fuel assembly with RCC (dry), Ib (approximately) 1606 Capacity of refueling water storage tank, gal 355,200 Minimum contents of refueling water storage tank for 342,200 Safety Injection System or Containment Spray System operability, gal Quantity of water required for refueling, gal 342,000 107 of 176 IPEC00036070 IPEC00036070

Retrieved from "https://kanterella.com/w/index.php?title=ML11356A152&oldid=2108501"