ML12335A425

Official Exhibit - NYSR0013A-00-BD01 - UFSAR, Rev. 20, Indian Point Unit 3 (Submitted with License Renewal Application) (2007) (IP3 UFSAR, Rev. 20)

ML12335A425
Person / Time
Site:	Indian Point
Issue date:	12/22/2011
From:	State of NY, Office of the Attorney General
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
RAS 21609, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML12335A425 (210)

Text

United States Nuclear Regulatory Commission Official Hearing Exhibit NYSR0013A Entergy Nuclear Operations, Inc.

In the Matter of:

(Indian Point Nuclear Generating Units 2 and 3) Revised: December 22, 2011 u....~p..p. REG(J~)- ASLBP #: 07-858-03-LR-BD01

!~~  :"

Docket #: 05000247 l 05000286

~ 0 Exhibit #: NYSR0013A-00-BD01 Identified: 10/15/2012

~ ~

I./l I ' ~

Admitted: 10/15/2012 Withdrawn:

~ ~

~1-:

" .*..... ,-

0- Rejected:

Other:

Stricken:

IP3 FSAR UPDATE CHAPTER 1 INTRODUCTION AND

1.1 INTRODUCTION

The Final Safety Analysis Report for Indian Point 3 (as supplemented and amended -

Supplements 1 through 32) was submitted by Consolidated Edison Company of New York (Con Ed) as part of an application for a license to operate this facility (Docket No. 50-286, Construction Permit #CPPR-62). This report provided pertinent technical information in accordance with the requirements of Section 50.34 of 10 CFR Part 50, in effect at the time of the application for operating license. Facility Operating License No. DPR-64 which authorized fuel loading and subcritical testing of Indian Point 3 was issued to Con Ed on December 12, 1975.

Westinghouse Electric Corp. was the primary contractor and had turnkey responsibility for the design, construction, testing and initial start-up of the facility. Westinghouse contracted the services of United Engineers and Constructors Inc. as architect-engineer to provide engineering assistance in the design and construction of the plant.

After completion of construction, preoperational tests, and initial start-up, Con Ed assumed responsibility for the operation of the plant on a commercial basis.

Concurrent with NRC review of the Con Ed Application for Operating License, Con Ed and the Power Authority of the State of New York (the Authority) filed an application on April 25, 1975 which requested that any operating license issued to Con Ed for operation of Indian Point 3 be amended to make the Authority a co-holder of the license. The amendment sought to permit the Authority to purchase and acquire title to Indian Point 3. However, Con Ed would retain complete responsibility for the operation of the facility in a safe manner and in accordance with Nuclear Regulatory Commission (NRC) requirements. In response to this application, NRC issued, on December 24, 1975, Amendment No. 1 to Facility Operating License No. DPR-64, which authorized the Authority to own but not operate Indian Point 3. On December 31, 1975, the Authority purchased the facility from Con Ed, while Con Ed retained complete responsibility for operation of Indian Point 3 under contract with the Authority. Services contracted for included: operation (including quality assurance),

engineering, maintenance and training services, health physics, water chemistry, environmental monitoring, plant and site security and construction management.

On March 11, 1977, the Authority and Con Ed filed an application (supplemented by letters dated August 9, 1977, October 27, 1977 and December 14 and 20, 1977) which sought to provide the Authority with the sole responsibility for operation of Indian Point 3. Amendment No. 12 to Facility Operating License DPR-64, issued by NRC on March 8, 1978 and effective at 12:01 A. M., March 10, 1978, licensed the Authority to own, use and operate the facility. Since the date of effectiveness of this amendment, the Authority has had the sole responsibility for operation of Indian Point 3.

On June 11, 1990, the Authority filed an application (supplemented by letters dated June 18, 1991, February 11, 1992, and May 13, 1992) to extend the expiration date of the Indian Point 3 Operating License, from August 13, 2009 to December 12, 2015. Amendment No.

1 of 119 IPEC00034601 IPEC00034601

IP3 FSAR UPDATE 124 to Facility Operating License (FOL) DPR-64, issued by the NRC on July 15, 1992, extended the expiration date of the FOL to midnight, December 12, 2015.

The Authority and Entergy Nuclear Operations, Inc., filed an application under cover letters dated May 11 and May 12, 2000, as supplemented on June 13 & 16, July 14, September 21, October 26, and November 3, 2000, which sought to provide Entergy Nuclear Incorporated with the sole responsibility for operation of Indian Point 3. Amendment No.

203 to Facility Operating License DPR-64, issued by NRC and effective on November 21, 2000, licensed Entergy to own, use and operate the facility. Since the date of effectiveness of this amendment, Entergy has had the sole responsibility for operation of Indian Point 3.

In accordance with the requirements of Section 50.71 (e) of 10 CFR Part 50, Entergy Nuclear Northeast, as licensee for the Indian Point 3 facility, submits this updated Final Safety Analysis Report. The information presented herein describes the as-built condition of the facility and reflects the current operating conditions of Indian Point 3, effective April 07, 2005.

The following paragraphs contain a summary of the report's content:

The facility employs a pressurized water reactor (PWR) and nuclear steam supply system (NSSS) which was furnished by Westinghouse Electric Corporation. It is similar in design to several plants now in operation as discussed in Section 1.4.

As prescribed in Amendment No. 17 to Facility Operating License DPR-64, issued by NRC on August 18, 1978, the Authority (now Entergy) is authorized to operate the facility at reactor core power levels not in excess of 3025 megawatts thermal (100 % of rated power).

This thermal power level corresponds to a turbine - generator output of 965 MWe net.

The plant heat removal systems were designed for the turbine guaranteed rating of 3083 Mwt and the portions of the safety analysis dependent on heat removal capacity of plant and safeguards systems assumed the higher, maximum calculated power of 3216 MWt, as did the evaluations of activity release and radiation exposure for the unlikely event of a design basis accident (DBA).

Chapter 2 contains a description and evaluation of the site and environs, supporting the suitability of the site for a reactor of the size and type described. Chapters 3 and 4 describe and evaluate the Reactor and Reactor Coolant System; Chapter 5, the Containment System; Chapter 6, the Engineered Safety Features; Chapter 7, Plant Instrumentation and Control; Chapter 8, the Electrical Systems; Chapter 9, the Auxiliary and Emergency Systems; Chapter 10, the Steam and Power Conversion System; Chapter 11, Radioactive Wastes and Radiation Protection. Chapter 12 and 13 are Conduct of Operations and Initial Tests and Operation, respectively. They describe plant organization, training programs, and start-up administrative procedures. Chapter 14 is a safety evaluation summarizing the analyses which demonstrate the adequacy of the reactor protection system and the containment and engineered safety features, and show that the consequences of various postulated accidents are within the guidelines set forth in 10 CFR 100. Chapter 15 references the facility's Technical Specifications. The design criteria for structures and equipment are summarized in Chapter 16. The Entergy Quality Assurance Program Manual 2 of 119 IPEC00034602 IPEC00034602

IP3 FSAR UPDATE provides a description of Entergy's Quality Assurance organization for operation of the facility.

The design of Indian Point 3 is essentially the same as Indian Point 2 which was licensed for operation by NRC (FOL DPR-26) and is located at the same site as Indian Point 3. All functional and safety systems for Indian Point 3 are independent of the other units on the site, except for the following:

1) The common discharge canal, outfall structure and associated instrumentation and sampling systems,

2) Electrical supplies and interties,

3) Station air intertie,

4) Demineralized water, condensate makeup and hydrogen interties,

5) City water and fire protection interties,

6) Diesel fuel oil supply (dedicated service of No.2 fuel oil) system,

7) Sewage treatment facility,

8) Chlorine supply system,

9) Carbon dioxide supply system,

10) Auxiliary steam system intertie,

11) Service boiler fuel oil (No.6) supply system,

12) Liquid SGSD radwaste processing and discharge (to Indian Point 1) facilities,

13) Chemistry facilities and equipment,

14) Instrumentation and control facilities and equipment, and

15) Environmental monitoring services.

Rules governing the use of these shared facilities have been mutually agreed on by the Authority and Consolidated Edison, which are now Indian Point Energy Center (lPEC) of Entergy Nuclear Northeast.

1.2

SUMMARY

PLANT DESCRIPTION 1.2.1 Site 3 of 119 IPEC00034603 IPEC00034603

IP3 FSAR UPDATE Indian Point 3 is located adjacent to and south of Indian Point 1 on a site of approximately 235 acres of land on the east bank of the Hudson River at Indian Point, Village of Buchanan in upper Westchester County, New York. The Indian Point 2 plant is adjacent to and north of Indian Point 1. The site is about 24 miles north of the New York City boundary line. The nearest city is Peekskill, 2.5 miles northeast of Indian Point. An aerial photograph, Figure 1.2-1, shows the site and about 58 square miles of the surrounding area.

Meteorology Meteorological conditions in the area of the site were determined during a two-year test program (1955 to 1957). The validity of these conclusions was verified by a test program completed in October 1970. The meteorological analysis also includes data from periods of November 26, 1969 through October 1, 1970, and January 1, 1970 through December 31, 1971. These data were used in evaluating the effects of gaseous discharges from the plant during normal operations and during the postulated loss-of-coolant accident. In addition, data supplied by the U.S. Weather Bureau at the Bear Mountain Station, regarding the meteorological conditions during periods of precipitation, were used to evaluate the rainout of fission gases into surface water reservoirs following the postulated loss-of-coolant accident. The evaluations indicated that the site meteorology provides adequate diffusion and dilution of any released gases.

Geology and Hydrology Geologically, the site consists of a hard limestone formation in a jointed condition which provides a solid bed for the plant foundation. The bedrock is sufficiently sound to support any loads which could be anticipated up to 50 tons per square foot, which is far in excess of any load which may be imposed by the plant. Although it is hard, the jointed limestone formation is permeable to water. Thus, if water from the plant should enter the ground (an improbable event since the plant is designed to preclude any leakage into the ground) it would percolate to the river rather than enter any ground water supply. Additional studies and examination of soil borings have confirmed the above conclusion. (See Section 2.7)

In the Hudson River, about 80,000,000 gallons of water flow past the plant each minute during peak tidal flow. This flow provides additional mixing and dilution for liquid discharges from the facility. In fact, this aspect is superfluous since the assumption in the plant design is to treat the river water as if it were used for drinking and to reduce concentrations of radioactive discharges by dilution with ordinary plant effluents to concentrations that would be tolerable for drinking water. There is no danger of flooding at the site as discussed in Section 2.5.

Seismology Seismic activity in the Indian Point area is rare and no damage has resulted therefrom. As stated in Section 2.8, the site is "practically non-seismic" and is "as safe as any area at present known." Not withstanding such assurance, the safety related equipment, components and structures of the plant were designed to withstand an earthquake of the highest intensity which can reasonably be predicted from geologic and seismic evidence developed for the site.

4 of 119 IPEC00034604 IPEC00034604

IP3 FSAR UPDATE Environmental Radiation Monitoring Environmental radioactivity has been measured at the site and surrounding area in association with the operation of Indian Point 1, 2 and 3. These measurements are continued and reported as required by the Technical Specifications. The radiation measurements of fallout, water samples, vegetation, marine life, etc. have shown no significant post-operative increase in activity. Noticeable increases in fallout have coincided with weapons testing programs and appear to be related almost entirely to those programs.

The New York State Department of Health in an independent two-year post-operative study, see Section 2.9, found that environmental radioactivity in the vicinity of the site is no higher than anywhere else in the State of New York.

Conclusions Consideration of all the items mentioned above, plus the containment design and the engineered safety features included in the plant design, lead to the conclusion of appropriate suitability of the site for safe operation of the Indian Point 3 nuclear power plant.

Accident analyses presented in Chapter 14 verify that the maximum expected doses at or beyond the site boundary are well within the 10 CFR 100 suggested guidelines.

1.2.2 Plant Description The unit incorporates a closed-cycle pressurized water nuclear steam supply system, a turbine-generator and the necessary auxiliaries. A radioactive waste disposal system, fuel handling system and all auxiliaries, structures, and other on-site facilities required for a complete and operable nuclear power plant are provided for the unit.

The general layout and profile of the plant are shown on Figures 1.2-1, 1.2-2, 1.2-4 and plant drawing 9321-F-64513 [Formerly Figure 1.2-3);

Nuclear Steam Supply System The nuclear steam supply system consists of a pressurized water reactor, Reactor Coolant System, and associated auxiliary fluid systems. The Reactor Coolant System is arranged as four closed reactor coolant loops, each containing a reactor coolant pump and a steam generator, connected in parallel. An electrically heated pressurizer is connected to the loop associated with Steam Generator 34.

The reactor core is composed of uranium dioxide pellets enclosed in Zircaloy or Zirlo '

tubes with welded end plugs. The tubes are supported in assemblies by a spring clip grid structure. The mechanical control rods consist of clusters of stainless steel clad absorber rods Zircaloy or Zirlo and guide tubes located within the fuel assembly. The core was initially loaded in three regions of different enrichments. At successive refuelings fuel not designated for the next core is removed from the core and discharged to the spent fuel storage facility. The fuel elements that remain are arranged in accordance with the new core design, and new fuel is introduced.

5 of 119 IPEC00034605 IPEC00034605

IP3 FSAR UPDATE The steam generators, which were installed during the cycle 6/7 refueling outage are vertical U-tube units employing Inconel 690 tubes. Integral separating equipment reduces the moisture content of the steam leaving the steam generators to 0.10 percent or less.

The reactor coolant pumps are vertical, single stage, centrifugal pumps equipped with controlled leakage shaft seals.

Auxiliary systems are provided to perform the following functions:

1) Change the reactor coolant system

2) Add makeup water

3) Purify reactor coolant water

4) Provide chemicals for corrosion inhibition and reactor control

5) Cool system components

6) Remove residual heat when the reactor is shutdown

7) Cool the spent fuel storage pool

8) Sample reactor coolant water

9) Provide for emergency core cooling

10) Collect reactor coolant drains

11) Provide containment spray

12) Provide containment ventilation and cooling

12) Dispose of gaseous and solid wastes.

Reactor and Plant Control The reactor is controlled by a coordinated combination of chemical shim and mechanical control rods. The control system allows the unit to accept step load changes of.+/-. 10 % and ramp load changes of.+/-. 5% per minute over the load range of 15% to, but not exceeding, 100% power under normal operating conditions subject to xenon limitations.

Turbine and Auxiliaries The turbine is a tandem-com pound-unit, comprising one high pressure and three low pressure cylinders which rotate at 1800 rpm. The unit is equipped with 44 inch exhaust blading in the low pressure cylinders. Six combination moisture separator-reheater units are employed to dry and superheat the steam between high and low pressure turbine cylinders.

The turbine-generator is capable of sustaining a 50% loss of external electrical load without turbine or reactor trip. The turbine auxiliaries include surface condensers, steam jet air ejector, turbine driven main feed pumps, motor driven condensate pumps, six stages of feedwater heating, and moisture preseparators.

The turbine generator was designed for a guaranteed capability of 1,021,793 Kw at 1.5 in.

HG absolute exhaust pressure with zero percent make up and six stages of feedwater heating.

Electrical System 6 of 119 IPEC00034606 IPEC00034606

IP3 FSAR UPDATE The main generator feeds electrical power through an isolated phase bus to half-sized main power transformers.

The Auxiliary Electrical System provides power to those auxiliary components which are required to operate during any of the plant's normal emergency conditions of operation.

Standby power required for plant start-up and for plant operation following a reactor trip, and auxiliary power are supplied by a 138 kV system from the Buchanan substation through an auxiliary transformer.

Station auxiliaries receive power during normal operation from the auxiliary transformer connected to the isolated phase bus and from the auxiliary transformer connected to the 138kV system.

Emergency power supply for vital instruments and controls is from four 125 volt DC station batteries.

The system design provides sufficient independence, isolation capability, and redundancy between the different power sources to avoid complete loss of auxiliary power.

Control Room (CR)

The plant is provided with a reactor and turbine-generator control room, designed under seismic and tornado criteria, and which contains all the necessary instrumentation for the plant's operation under normal and accident conditions.

Adequate shielding and air conditioning facilities permit occupancy during all normal operating and accident conditions.

Diesel Generators Three diesel generator sets supply emergency power for plant shutdown and essential safeguards operation in the event of the loss of all other AC auxiliary power.

Waste Disposal System The Waste Disposal System (WDS) collects liquid, gaseous and solid wastes from plant operation and processes gaseous and solid wastes for discharge or removal from the plant site.

The WDS also provides the hydrogen and nitrogen required by the primary system during normal plant operation. All shipments of solid waste from the site are made in accordance with government guidelines.

Fuel Handling System The fuel handling system provides the ability to fuel and refuel the reactor core. Carefully established administrative procedures plus the design of the system minimize the probability of potential fission product release during the refueling operation.

7 of 119 IPEC00034607 IPEC00034607

IP3 FSAR UPDATE The system also includes the following features:

1) Safe accessibility for operating personnel.

2) Provisions for preventing fuel storage criticality.

3) Visual monitoring of the refueling process at all times.

Engineered Safety Features The Engineering Safety Features for this plant have sufficient redundancy in component and power sources such that under the conditions of a hypothetical loss-of-coolant accident, the system can, even when operating with partial effectiveness, maintain the integrity of the containment and keep the exposure of the public below the limits of 10 CFR 100.

The major engineered safeguards systems are as follows:

1) The Containment System which incorporates continuously pressurized and monitored penetrations and liner weld channels; and a seal water injection system which provides a highly reliable, essentially leak-tight barrier against the escape of radioactivity which might be released to the containment atmosphere.

2) The Safety Injection System (which constitutes the Emergency Core Cooling System) which provides borated water to cool the core in the event of a loss of coolant accident.

3) The Containment Air Recirculation Cooling and Filtration System which provides a heat sink to cool the containment atmosphere and provides filtration of the containment atmosphere to remove airborne particulate and halogen fission products which form the source for potential public exposure.

4) The Containment Spray System which provides a spray of cool, chemically treated, borated water to the containment atmosphere as a backup heat sink, and iodine removal capability for the Containment Air Recirculation Cooling and Filtration System.

Structures The major structures are the reactor containment building, the auxiliary building, the control building, the turbine building, the administration building, the outage support building, the training building and the Condensate Polisher Building. General layouts and interior component arrangement of the reactor containment structure are shown in Section 5.1. General layouts and interior components arrangement of the auxiliary building, spent fuel pit building, and holdup tank building are shown in Plant Drawings 9321-F-25153, -25113, -25143, and -

25173 [Formerly Figures 1.2-5 through 1.2-8]. The general arrangement of the turbine building is shown in Section 10.2. General layout and component arrangement of the Control Room is presented in Section 7.7.1.

The reactor containment is a steel lined reinforced concrete cylinder with a hemispherical dome and a flat base. The containment is designed to withstand the internal pressure accompanying a loss-of-coolant accident. It is virtually leaktight and provides adequate radiation shielding for both normal operation and accident conditions.

8 of 119 IPEC00034608 IPEC00034608

IP3 FSAR UPDATE Continuously pressurized double containment is provided at nearly all liner seams and penetrations including access openings and ventilation ducts.

When required, the containment isolation valve seal water system permits automatic rapid sealing of pipes which penetrate the containment so that, in the event of any loss-of-coolant accident, there will be no leakage from containment to the environment.

Ground accelerations for the operational basis earthquake used for containment design purposes and for all Seismic Class I structures (Chapter 16) are 0.1 g applied horizontally and 0.05g applied vertically. In addition, ground accelerations for the design basis earthquake of 0.15g horizontal and 0.10g vertical were used to analyze the no loss-of-function concept.

The primary auxiliary building, the spent fuel pit and control building are Seismic Class I structures. The turbine building is a Seismic Class III structure modified in accordance with the design basis earthquake criteria to preclude collapse or other damage to nearby Class I structures.

1.3 GENERAL DESIGN CRITERIA The General Design Criteria establish the necessary design, fabrication, construction, testing and performance requirements for structures, systems, and components important to safety; that is structures, systems and components that provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. These General Design Criteria establish minimum requirements for the principal design criteria for water-cooled nuclear power plants.

The General Design Criteria presented and discussed in specific sections of the FSAR (which describe systems, structures, equipment and components important to safety) are those which were in effect at the time when Indian Point 3 was designed and constructed.

The General Design Criteria which formed the bases for the Indian Point 3 design were published by the Atomic Energy Commission in the Federal Register of July 11, 1967 and subsequently made part of 10 CFR 50.

The Authority completed a study of the method by which the Indian Point 3 facility complied with the safety rules and regulations, in particular those contained in 10 CFR Parts 20 and 50, that were in effect at the time of the study. The study was conducted in accordance with the provisions of NRC Confirmatory Order of February 11, 1980 and were submitted to the NRC on August 11, 1980. The NRC audit of submittal indicated that the Indian Point 3 design and operation meet the applicable regulations. The following sections provide the results of the compliance study, updated to reflect changes made to the configuration since the study was completed.

1.3.1 Overall Requirements (Criteria 1 to 5)

Quality Standards and Records (Criterion 1) 9 of 119 IPEC00034609 IPEC00034609

IP3 FSAR UPDATE Criterion: Structures, systems and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed. Where generally recognized codes and standards are used, they shall be identified and evaluated to determine their applicability, adequacy, and sufficiency and shall be supplemented or modified as necessary to assure a quality product in keeping with the required safety function. A quality assurance program shall be established and implemented in order to provide adequate assurance that these structures, systems and components will satisfactorily perform their safety functions. Appropriate records of the design, fabrication, erection, and testing of structures, systems and components important to safety shall be maintained by or under the control of the nuclear power plant licensee throughout the life of the unit.

The following list of Indian Point 3 FSAR Sections detail the quality standards used in the design, fabrication, erection and testing of structures, systems and components important to safety.

Each section identifies those specific codes and standards used, including the scope of each, and any supplements or modifications.

Section Title 3.3.3.1 Fuel Quality Assurance 4.1.2 Reactor Coolant System, General Design Criteria -

Quality Standards, and Records Requirements 4.1.7 Reactor Coolant System, Codes and Classifications 4.3.1 Reactor Coolant System, Safety Factors - Reactor Coolant Pump Flywheel, Methods of Quality Assurance 4.5 Reactor Coolant System, Inspections and Tests 5.1.1.1 Containment System Structures, Principal Design Criteria - Quality Standards and Records Requirements 5.1.1.5 Containment System Structures, Codes and Classifications 6.2.1 Safety Injection System, Design Basis - Codes and Classifications 6.3.1 Containment Spray System, Design Basis - Codes and Classifications 6.3.5 Containment Spray System, Inspections and Tests 6.8.4 Hydrogen Recombination System, Inspections and Tests 9.2.1 Chemical and Volume Control System, Design Basis -

Codes and Classification 9.2.5 Chemical and Volume Control System, Tests and Inspections 9.3.1 Auxiliary Coolant System, Design Basis - Codes and Classifications 9.3.5 Auxiliary Coolant System, Tests and Inspections 9.5.5 Fuel Handling System, Tests and Inspections 13 Initial Tests and Operation 10 of 119 IPEC00034610 IPEC00034610

IP3 FSAR UPDATE 16.1.1 Definition of Seismic Design Classifications 16.1.4 Class I Design Criteria for Vessels and Piping IP3's Quality Assurance Program is described in the Entergy Quality Assurance Program Manual.

The Quality Assurance Requirements for Protective Coatings Applied to Water-Cooled Nuclear Plant (Regulatory Guide 1.54, June 1973)

The Quality Assurance requirements for protective coatings comply with Regulatory Guide 1.54, with the following exceptions:

In lieu of the inspection defined in Section 6.2.4 of ANSI N101.4-1972, inspection is in accordance with ANSI N5.12-1974 Section 10, Inspection for Shop and Field Work.

Regarding the extent of coverage, the following offers clarification of paragraph 1.2.4 of ANSI N 101.4-72:

Regulatory Guide 1.54 will be applied as follows:

a) Surfaces within the primary containment liner boundary:

i) For large surface area components, the documents shall be retained by Entergy as required by ANSI N 101.4-72. These components include such items as the reactor building crane, containment, structural steel (including miscellaneous steel and handrails), concrete, ductwork, uninsulated pipe, exterior of uninsulated tanks and vessels, and major equipment supports.

ii) For manufactured equipment such as pumps, motors, pipe hanger and supports, the documentation required by ANSI N 101.4-72 shall be maintained in the Seller's files for the complete duration of the contract warranty/guarantee period. A certificate of compliance signed by responsible management personnel shall be furnished by the Seller.

b) Other surfaces where coating failure could compromise the design function of equipment or components intended to prevent or mitigate the consequences of postulate accidents which could affect the public health or safety.

Because of the impracticability of imposing the Regulatory Guide requirements on the standard shop process used in painting valve bodies, handwheels, electrical cabinetry and control panels, loud speakers, emergency light cases and like components, the Regulatory Guide will not be invoked for these items since the total surface are for which the requirements will be imposed.

The reference substitution of ANSI N5.12 as the basis for inspection, rather than ANSI N5.9 reflects a revision to a standard referenced in the basis document, ANSI N 101.4.

Design Bases for Protection Against Natural Phenomena (Criterion 2) 11 of 119 IPEC00034611 IPEC00034611

IP3 FSAR UPDATE Criterion: Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. The design bases for these structures, systems and components shall reflect: (1) appropriate consideration of the most severe of the natural phenomena that have been historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and (3) the importance of the safety functions to be performed.

Seismic Class I structures were designed to maintain within the allowable stress limit a combination of primary steady state stresses with seismic stresses resulting from the application of seismic motion with a maximum ground acceleration of 0.05 g acting in the vertical and 0.1 g acting in the horizontal planes simultaneously.

Also, primary steady state stresses when combined with seismic stresses resulting from the application of seismic motion with a maximum ground acceleration of 0.10 g acting in the vertical and 0.15 g acting in the horizontal planes simultaneously, were limited so that the function of the component system or structure shall not be impaired as to prevent a safe and orderly shutdown of the plant.

The plant is safeguarded from tornadoes by the combined use of buildings and structures, designed to withstand tornadoes, and redundancy of components. All seismic Class I buildings and structures were designed to withstand tornado winds corresponding to 300 mph tangential velocities, traverse velocities of 60 mph and a differential pressure drop of 3 psi in 3 seconds with no loss of function. The exceptions to this include areas without safety related equipment or redundant equipment as discussed in FSAR Section 16.2-2.

Furthermore, using a Probable Maximum Hurricane at the Battery of 130 mph and an inland reduction factor of 0.7, a wind speed of 90 mph due to hurricane was derived for use in the design at Indian Point.

From the evaluation of flooding conditions at Indian Point, done by Environmental Science and Engineering Consultants (Section 2.5), it was concluded that the maximum elevation of water at Indian Point due to flooding and wave runup is 15 feet or less. The consultants arrived at the above conclusion after assuming a critical set of simultaneous occurrences of the following three severe conditions:

1) Probable maximum precipitation over the Ashokan Reservoir resulting in a dam failure

2) Runoff generated by standard project precipitation over the Hudson Basin

3) Peak storm surge resulting from standard project hurricane for the New York Harbor area.

12 of 119 IPEC00034612 IPEC00034612

IP3 FSAR UPDATE Although the simultaneous occurrence of the above three conditions is extremely remote, using the above conditions or various other conditions described in Chapter 2, the flood effects were not governing in the design of the plant. The combination of the elevation of the plant structures, the load-bearing capacity of the intake structure and the Technical Requirements Manual (TRM) requirements on plant operation and service water pump protection, result in acceptable conditions to protect the plant against flooding.

From the total group of meteorological conditions using a wind speed of 30 mph, an effective fetch length of 5.2 miles and an average water depth of 25 feet, the significant wave height at the site will be 2.8 feet with a significant wave period of 5.9 sec. Maximum wave height will be 5.0 feet. (Section 2.6)

During a probable maximum hurricane condition with a wind speed of 90 mph, a water depth of 35 feet, and a fetch of 5.2 miles the wave height at the site will be 9.1 feet. (Section 2.6)

From the above, it is evident that design loads due to the effects of tornadoes, hurricanes and flood were determined after considering the most severe of the natural phenomena that have been historically reported for the site and surrounding area. It is also evident that sufficient margin for limited accuracy, quantity, and period of time in which historical data have been accumulated was appropriate for each phenomenon.

The earthquake response spectra were developed from the average acceleration velocity displacement curves presented in TID-7024, Nuclear Reactors and Earthquake, for large-magnitude earthquakes at moderate distances from the epicenter. As such, the curves are made up of the combined normalized response spectrum determined from components of four strong-motion ground accelerations: EI Centro, California, December 30, 1934; EI Centro, California, May 18, 1940; Olympia, Washington, April 13, 1949; and Taft, California, July21,1952.

In investigating the overall and local structural effects, the following appropriate combinations of the effects of normal and accident conditions with effects of the natural phenomena were made:

The maximum tornado wind load was combined with missile load, dead load and live load, or with 3 psi negative pressure, and missile loads yielding the most conservative load combination and/or the highest stress condition.

Tornado loads act independently of other severe loads, and were found to be small by comparison to seismic loading.

With the exception of the Containment, all other seismic Class I structures used the following load combinations:

1) Primary steady state stresses were combined with the seismic stress resulting from the application of seismic motion with a maximum ground acceleration of 0.05g acting in the vertical and 0.1 g acting in the horizontal planes simultaneously.

Under this combination the stresses were maintained within the allowable stress limits accepted as good practice and, where applicable, set forth in the appropriate 13 of 119 IPEC00034613 IPEC00034613

IP3 FSAR UPDATE design standards; e.g., ASME Boiler and Pressure Vessel Code, USAS B31.1, "Code for Pressure Piping," ACI 318 "Building Code Requirements for Reinforced Concrete," and AISC," Specifications for the Design and Erection of Structural Steel for Buildings."

2) Primary steady state stresses were combined with the seismic stress resulting from the application of seismic motion with a maximum ground acceleration of 0.10g acting in the vertical and 0.15g acting in the horizontal planes simultaneously. Under this combination, the stresses were limited so that the function of the component, system or structure shall not be impaired as to prevent a safe and orderly shutdown of the plant.

In the case of the Containment the following load combinations were made:

a) The dead load of structure was increased or decreased by 5 percent and each separate result was added to the accident pressure which was increased by 50 percent and to load due to maximum temperature and load exerted by the liner based upon temperatures associated with 1.5 times accident pressure.

Or, C = 1.0 D +/-. 0.05 D +1.5 P + 1.0 (T + TL) b) As in 'a)', the dead load was added to the accident pressure which was increased by 25 percent and to the load due to maximum temperature gradient through the concrete shell and mat based upon temperatures associated with 1.25 times the accident pressure and to the load exerted by the liner based upon temperatures associated with 1.5 times the accident pressure, and to the load resulting from operational basis earthquake increased by 25 percent.

Or, C = 1.0 D +/-. 0.05 D + 1.25 P + 1.0 (T ' + TL') + 1.25 E c) As in 'a)', the dead load was added to the accident pressure load, to the load due to maximum temperature gradient through the concrete shell and mat based upon temperature associated with the accident pressure, to the load exerted by the liner based upon temperatures associated with the accident pressure, to the load exerted by the liner based upon temperatures associated with the accident pressure and to the load resulting from design basis earthquake.

Or, C = 1.0 D +/-. 0.05 D + 1.0 P + 1.0 (T" + TL" ) + 1.0 E '

d) As in 'a)', the dead load was added to tornado wind load and to pressure drop effect.

Or, C = 1.0 D+/-.O. 05 D + 1.0 W '

14 of 119 IPEC00034614 IPEC00034614

IP3 FSAR UPDATE Symbols used in the above formula are defined as follows:

C = Required load capacity section D = Dead load of structure and equipment loads P = Accident pressure load as shown on pressure -

temperature transient curves T = Load due to maximum temperature gradient through the concrete shell and mat based upon temperature associated with 1.5 times accident pressure TL = Load exerted by the liner based upon temperatures associated with 1.5 times accident pressure T' = Load due to maximum temperature gradient through the concrete shell and mat based upon temperatures associated with 1.25 times accident pressure TL' = Load exerted by the liner based upon temperatures associated with 1.25 times accident pressure E = Load resulting from operational basis earthquake E' = Load resulting from design basis earthquake T" = Load due to maximum temperature gradient through the concrete shell, and mat based upon temperature associated with the accident pressure TL" = Load exerted by the liner based upon temperatures associated with the accident pressure W = Tornado wind load and the pressure drop effect Electrical All electrical systems and components vital to plant safety, including the emergency diesel generators were designed as seismic Class I so that their integrity is not impaired by the maximum potential earthquake, windstorms, floods or disturbances on the external electrical systems. Power, control and instrument cabling, motors and other electrical equipment required for operation of the engineered safety features are suitably protected against the effects of either a nuclear system accident or of external environment phenomena order to assure a high degree if confidence in the operability of such components in the event that their use is required. (Section 8.1)

The physical locations of electrical distribution system equipment is such as to minimize vulnerability of vital circuits to physical damage as a result of accidents. The 6990 volt switchgear and 480 volt load centers are located in areas which minimize their exposure to mechanical, fire and water damage. The 480 volt motor control centers associated with the nuclear steam supply system are located in the Primary Auxiliary Building. (Section 8.2)

The diesel generator units are located in a seismic Class I structure located near the Control Building.

Mechanical Systems and components important to safety either were designed to withstand the effects of, or measures were taken in the plant design to protect against, earthquakes, high winds, 15 of 119 IPEC00034615 IPEC00034615

IP3 FSAR UPDATE sudden barometric pressure changes, flooding and other natural phenomena. This is applicable to all components except those specifically exempted (in accordance with the requirements of NUREG-0800) which serve exclusively as redundant components.

Chapter 16 discusses the systems and components important to safety which were designed to withstand the effects of earthquakes without loss of function. Seismic design criteria are provided in Sections 16.1 and 16.3.

Appropriate load combinations of the effect of normal and accident conditions with the effects of an earthquake are provided in Section 16.1.

System and components important to safety are protected from the effects of tornadoes by either being housed in structures designed to withstand such loadings or by providing sufficient systems and equipment redundancy. Section 16.2 describes the method of protection for these systems and components.

Flooding at the site would have to reach 15'-3" above mean sea level before it would seep into the lowest elevation of any of the buildings and thereby possibly affect safety related systems and components. Different flooding conditions governing the maximum flooding elevation at the site were investigated. Results confirmed the maximum water elevation to be lower than the critical elevation noted above (Section 2.5).

Fire Protection (Criterion 3)

Criterion: Structures, systems, and components important to safety shall be designed and located to minimize, consistent with other safety requirements, the probability and effect of fires and explosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in locations such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the adverse effects of fires on structures, systems and components important to safety. Firefighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capability of these structures, systems, and components.

The Authority conducted a review of the Indian Point 3 Fire Protection Program in response to a NRC request dated June 10, 1976. This review compared the existing fire protection provisions at Indian Point 3 with the guidelines set forth in Standard Review Plan 9.5.1, "Fire Protection," dated May 1, 1976. This review further described the implementation of modifications or changes underway to meet the guidelines, and deviations from these guidelines and the basis thereof. As a result of this report and associated correspondence, the Commission issued Amendment No. 24 on March 6, 1979 to the Indian Point 3 Operating License which included a Fire Protection Safety Evaluation Report. The SER was later supplemented to resolve open items in the original issuance.

Section 2.0 of the March 6, 1979 SER entitled "Fire Protection Guidelines of the IP3 Fire 16 of 119 IPEC00034616 IPEC00034616

IP3 FSAR UPDATE Protection SER" cites GDC-3 as the basic criterion for fire protection and "Appendix A" of Branch Technical Position 9.5-1 as guidance for the implementation of GDC-3. The conclusion of the Commission's SER, as amended on May 2, 1980, states, in part, that the provisions of section 2.0 are satisfied.

On February 17,1981,10 CFR 50.48 and Appendix R became effective. Appendix R to 10 CFR 50 established fire protection features required to satisfy Criterion 3 of Appendix A to 10 CFR 50 with respect to certain generic issues related to nuclear power plants licensed to operate prior to January 1, 1979. As a minimum, 10 CFR 50.48 required all licensees to conform to the requirements of Section III.G, III.J, and 111.0, of Appendix R which address fire protection of safe shutdown capability, emergency lighting, and reactor coolant pump oil collection systems, respectively. Other sections of Appendix R apply to those licensees who had open items remaining from the BTP 9.5-1, Appendix A review. The review of Indian Point 3 to BTP 9.5-1, Appendix A, was completed, as documented in the NRC Safety Evaluation Reports dated March 6,1979 and May 2,1980.

A re-evaluation of Indian Point 3 against the requirements of Section III.G of Appendix R to 10 CFR 50 was completed in August 1984. The report submitted to the NRC on August 16, 1984 described the bases on which Indian Point 3 conformed to Section III.G of Appendix R.

The report provided a historical chronology of correspondence between the NRC and the Authority on Appendix R compliance by summarizing all pertinent documentation submitted to the NRC in response to 10 CFR 50.48 and Appendix R through August 1984. A new report was issued in May 1995, which supersedes the August 1984 report. The new report will be maintained by periodic updates.

Environmental and Missile Design Bases (Criterion 4)

Criterion: Structures, systems, and components important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing and postulated accidents including loss-of-coolant accidents. These structures, systems and components shall be appropriately protected against dynamic effects including the effects of missiles, pipe whipping and discharging fluids that may result from equipment failures and from events and conditions outside the nuclear power unit.

All piping, components and supporting structures of the Reactor Coolant System were designed as seismic Class I equipment and therefore are capable of withstanding:

1) The Operational Basis Earthquake acceleration within code allowable working stresses.

2) The Design Basis Earthquake acceleration acting in the horizontal and vertical direction simultaneously with no loss of function.

The Reactor Coolant System is located in the Containment Building. In addition to being a seismic Class I structure, the design of the containment structure also considered accidents 17 of 119 IPEC00034617 IPEC00034617

IP3 FSAR UPDATE and other applicable natural phenomena. Details of the containment design are given in Chapter 5.

The dynamic effects during blowdown following a Loss-of-Coolant Accident were evaluated during the detailed layout and design of the high pressure equipment and barriers which afford missile protection. Support structures were designed with consideration given to fluid and mechanical thrust loadings.

The Indian Point 3 steam generators are supported, guided and restrained in a manner which prevents rupture of the steam side of a generator, the steam lines or the feedwater piping as a result of forces created by a Reactor Coolant System pipe rupture. These supports, guides and restraints also prevent rupture of the primary side of a steam generator as a result of forces created by a steam or feedwater line rupture.

The mechanical consequences of a pipe rupture are restricted by design features so that the functional capability of the engineered safety features is not impaired. (Section 4.1)

Reactor Coolant System components are surrounded by a 3-foot thick concrete wall which serves as a missile and partial radiation shield. A 2-foot thick reinforced concrete floor covers the Reactor Coolant System.

There is a reinforced concrete missile shield wall around the pressurizer above the operating floor. The original design is to protect the containment steel liner from postulated valve piece or instrument missiles connected to the pressurizer. Currently these missiles have been shown not to be credible.

In 1986, a NRC SER stated, "The dynamic effects associated with postulated pipe breaks in the primary coolant system (hot legs, cold legs, cross over legs) need not be a design basis." (NRC SER dated March 10, 1986).

A structure is provided over the control rod drive mechanism to block any missiles generated from fracture of the mechanism.

Systems and components containing hot pressurized fluids which might affect the engineered safeguards components were carefully checked against the possibility of being missile sources. Provisions were taken, when necessary, against the generation of missiles rather than allow missile formation and try to contain their effects.

Once the requirement that the above systems are not sources of missiles was set forth, the identification of potential deficiencies and the generation of corrective design modifications was initiated through the Quality Assurance Program. (Section 5.1)

Incoming and outgoing lines which penetrate the Reactor Containment are normally or intermittently open during reactor operation, and are connected to closed systems inside the Containment and protected from missiles throughout their length. (Section 5.2) 18 of 119 IPEC00034618 IPEC00034618

IP3 FSAR UPDATE Sharing of Structures, Systems and Components (Criterion 5)

Criterion: Structures, systems and components important to safety shall not be shared among nuclear power units unless it can be shown that such sharing will not significantly impair their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cool down of the remaining units, The only structure important to safety that is shared by the nuclear units at the site is the cooling water discharge canal which carries the safety related Service Water System discharge to the river, Since this channel is of sufficient capacity to handle the discharge flow from both operating units, sharing of this structure will in no way impair the ability of safety related systems in either of the nuclear units to perform their safety functions, There are no safety related systems shared by the nuclear units at the site, However, there are three gas turbine generators provided which are shared by the two operating units and which can be used to supply the safeguard power requirements, Two of these are located near the Buchanan Substation, while the third is at the Indian Point site, The gas turbines are connected to the distribution system at 13,8kV, The 13,8 kV feeders and the gas turbines are connected to the 6.9 kV buses via autotransformers. While each of the 13.8 kV feeders is normally assigned to one unit, interties at the substation permit the cross feeding from any line to any unit. (See Sections 8.1 and 8.2)

The city water supply system provides a backup source of water to the Condensate Water Storage Tank for the Auxiliary Feedwater System of Indian Point 3.

The Fire Protection Systems formerly shared between Indian Point 1, 2 and 3 have been separated to provide independent fire protection capability. Details of the system modification are addressed in Section 9.6.

The only components important to safety that are shared by the two operating nuclear units (Indian Point 2 and 3) are the backup fuel oil storage tanks for the emergency diesel generators. The fuel oil storage tanks dedicated to Indian Point 3 have a capacity sufficient to assure continuous operation of two of the three Indian Point 3 diesels at minimum safeguards load for a total of 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. The additional fuel oil required for continuous operation for a minimum of seven days can be transported by truck from the 200,000 gallon fuel oil storage tank at the Buchanan Substation located immediately across Broadway and/or from other local oil supplies (Section 8.2).

1.3.2 Protection by Multiple Fission Product Barriers (Criteria 10 to 19)

Reactor Design (Criterion 10)

Criterion: The reactor core and associated coolant, control, and protection systems shall be designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.

19 of 119 IPEC00034619 IPEC00034619

IP3 FSAR UPDATE The reactor core, with its related control and protection system, was designed to function throughout its design lifetime without exceeding acceptable fuel damage limits. The core design, together with reliable process and decay heat removal systems, provides for this capability under all expected conditions of normal operation with appropriate margins for uncertainties and anticipated transient situations, including the effects of the loss of reactor coolant flow, trip of the turbine generator, loss of normal feedwater and loss of all offsite power.

The Reactor Control and Protection System was designed to actuate a reactor trip for any anticipated combination of plant conditions, when necessary, to ensure a minimum Departure from Nucleate Boiling (DNB) ratio equal to or greater than the applicable limit for the analyzed accidents.

The integrity of fuel cladding is ensured by preventing excessive clad heating, excessive cladding stress and strain. This was achieved by designing the fuel rods so that the following conservative limits are not exceeded during normal operation or any anticipated transient condition:

1) Minimum DNB ratio equal to or greater than the applicable limit;

2) Fuel center temperature below melting point of U02 ;

3) Internal gas pressure less than the nominal external pressure (2250 psia) even at the end of life;

4) Clad stresses less than the Zircaloy and ZIRLO' yield strengths;

5) Clad strain less than 1%;

6) Cumulative strain fatigue cycles less than 80% of design strain fatigue life.

The ability of the fuel, when designed and operated according to these criteria, to withstand postulated normal and abnormal service conditions as shown by analyses described in Chapter 14 has been ensured. These analyses have been and will be amended as necessary for each cycle by the corresponding reload safety evaluations.

The Indian Point 3 Technical Specifications establish reactor criticality limits on moderator temperature coefficient and minimum temperature.

Doppler and Power Coefficients The Doppler coefficient is defined as the change in neutron multiplication per degree change in fuel temperature. The coefficient is obtained by calculating neutron multiplication as a function of effective fuel temperature.

In order to know the change in reactivity with power, it is necessary to know the change in the effective fuel temperature with power as well as the Doppler coefficient. It is very difficult to predict the effective temperature of the fuel using a conventional heat transfer model 20 of 119 IPEC00034620 IPEC00034620

IP3 FSAR UPDATE because of uncertainties in predicting the behavior of the fuel pellets. Therefore, an empirical approach was taken to calculate the power coefficient, based on operating experience of existing Westinghouse cores. Section 3.2 provides the power coefficient as a function of power obtained by this method. The results presented do not include any moderator coefficient even though the moderator temperature changes with power level.

Reactor Inherent Protection (Criterion 11)

Criterion: The reactor core and associated coolant system shall be designed so that in the power operating range the net effect of the prompt inherent nuclear feedback characteristics tends to compensate for a rapid increase in reactivity.

Prompt compensatory reactivity feedback effects are assured when the reactor is critical by the negative fuel temperature effect (Doppler effect) and by the non-positive operational limit on the moderator temperature coefficient of reactivity. The negative Doppler coefficient of reactivity is assured by the use of low enrichment fuel, the non-positive moderator temperature coefficient of reactivity is assured by keeping the dissolved absorber concentration below a certain limit through the use of burnable poison.

The response of the reactor core to plant conditions or operator adjustments during normal operation, as well as the response during abnormal or accidental transients, was evaluated by means of a detailed plant simulation. In these calculations, reactivity coefficients were required to couple the response of the core neutron multiplication to the variables which are set by conditions external to the core. Since the reactivity coefficients change during the life of the core, a range of coefficients was established to determine the response of the plant throughout life and to establish the design of the Reactor Control and Protection Systems.

The moderator temperature coefficient in a core controlled by chemical shim is less negative than the coefficient in an equivalent rodded core. One reason is that control rods contribute a negative increment to the coefficient and, in a chemical shim core, the rods are only partially inserted. Also, the chemical poison density is decreased with the water density upon an increase in temperature. This is directly proportional to the amount of reactivity controlled by the dissolved poison.

In order to insure a negative moderator temperature coefficient, burnable poison is incorporated in the core design. The result is a reduction in dissolved poison requirements so that changes in the coolant density will have less effect on the density of poison and the moderator temperature coefficient will remain negative.

The burnable poison is in one of three forms: 1. borated pyrex glass rods clad in stainless steel; 2. annular pellets of boron carbide aluminum oxides contained within two concentric Zircaloy tubings; or 3. integral boron coatings ZrB2 applied directly to the fuel pellets themselves. The moderator temperature coefficient is negative at operating conditions with burnable poison rods installed.

The effect of burnup on the moderator temperature coefficient was calculated and the coefficient becomes more negative with increasing burn up. This is due to the buildup of fission products with burnup and dilution of the boric acid concentration with burn up. The 21 of 119 IPEC00034621 IPEC00034621

IP3 FSAR UPDATE reactivity loss due to equilibrium xenon is controlled by boron and as xenon builds up, boron is taken out.

The Reactor Coolant Pumps provided for the plant are supplied with sufficient rotational inertia to maintain an adequate flow coastdown and prevent core damage in the event of a simultaneous loss of power to all pumps.

In the unlikely event of a turbine trip from full power without an immediate reactor trip, the subsequent reactor coolant temperature increase and volume insurge to the pressurizer results in a high pressurizer pressure trip and thereby prevents fuel damage for this transient. A loss of external electrical load of 50% of full power or less is normally controlled by rod cluster insertion together with a controlled steam dump to the condenser to prevent a large temperature and pressure increase in the Reactor Coolant System, and thus prevent a reactor trip. In this case, the overpower, overtemperature protection would guard against any combination of pressure, temperature and power which could result in a DNB ratio less than the applicable limit during the transient.

In neither the turbine trip nor the loss of flow events do the changes in coolant conditions provoke a nuclear power excursion because of the large system thermal inertia and relatively small void fraction. Protection circuits, actuated directly by the coolant conditions identified with core limits, are therefore effective in preventing core damage.

Suppression of Reactor Power Oscillations (Criterion 12)

Criterion: The reactor core and associated coolant, control, and protection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified acceptable fuel design limits are not possible or can be reliably and readily detected and suppressed.

The potential for possible spatial oscillations of power distribution for this core has been reviewed. It was concluded that low frequency xenon oscillations may occur in the axial dimension. Part length rods, originally supplied, were removed from Indian Point 3; axial xenon oscillations can be controlled with full length rods. The core is stable to xenon oscillations in the X-Y dimension. Out-of-core instrumentation is provided to obtain necessary information concerning power distribution. This instrumentation is adequate to enable the operator to monitor and control xenon induced oscillations. Extensive analysis, with confirmation of methods by spatial transient experiments at Haddam Neck, has shown that any induced radial or diametral xenon transients would die away naturally" (Incore instrumentation is used to periodically calibrate and verify the information provided by the out-of-core instrumentation.)

Instrumentation and Control (Criterion 13)

Criterion: Instrumentation shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can effect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate 22 of 119 IPEC00034622 IPEC00034622

IP3 FSAR UPDATE controls shall be provided to maintain these variables and systems within prescribed operating ranges.

The plant is equipped with Nuclear, Process, and Incore Instrumentation Systems to monitor variables and systems for normal operation and accident conditions to assure safety.

Controls are provided to maintain these variables and systems within prescribed operating ranges.

Additionally, two independent systems provide Reactor Coolant System (RCS) water level indication during reduced RCS inventory conditions. These systems have been installed in response to NRC Generic Letter 88-17, Loss of Decay Heat Removal. Two additional independent indicators have been added to provide RCS water level during reduced RCS inventory conditions that are also qualified to function if the RCS is in a vacuum condition, such as RCS vacuum refill. These twp independent indicators are used with hand held UT devices to comply with the requirements of Generic Letter 88-17.

The Nuclear Instrumentation System is provided to monitor the reactor power from source range, through the intermediate range and power range, up to 120 percent of full power.

The System consists of eight independent detectors in six instrument wells located around the reactor with associated equipment designed to provide indication and control in the Control Room for reactor operation and protection. (Section 7.4)

The source range neutron detectors (two) are proportional counters with a nominal sensitivity of 10 counts per sec per neutron per sq cm per second.

The detectors sense thermal neutrons in the range from 10-1 to 5x 104 neutrons per sq cm per sec.

The intermediate range neutron detectors (two) are compensated ionization chambers that sense thermal neutrons in the range from 2.5 x 102 to 2.5 X 1010 neutrons per sq cm per sec and have a nominal sensitivity of 4 x 10-14 amperes per neutron per sq cm per second.

These detectors are located in the same detector assemblies as the proportional counters for the source range channels.

The power range consists of four independent long uncompensated ionization chamber assemblies. Each assembly is made up of two sensitive lengths. One sensitive length covers the upper half of the core, and the other length covers the lower half of the core. The arrangement provides in effect a total of eight separate ionization chambers approximately one-half the core height. The eight uncompensated (guard-ring) ionization chambers sense thermal neutrons in the range from 5 x 102 to 1 X 1011 neutrons per sq cm per sec. Each has a nominal sensitivity of 3.1 x 10-13 amperes per neutron per sq cm per sec. The four long ionization chamber assemblies are located in vertical instrument wells adjacent to the four "corners" of the core. The assembly is manually positioned in the assembly holders and is electrically isolated from the holder by means of insulated stand-off rings.

The electronic equipment for each of the source, intermediate and power range channels is contained in draw-out panels mounted in racks in the Control Room.

Additionally, an Excore Neutron Flux Detection System has been installed per Regulatory Guide 1.97 requirements. The system consists of two redundant trains providing full scale 23 of 119 IPEC00034623 IPEC00034623

IP3 FSAR UPDATE (10-6 to 100% full power) flux indication only in the Control Room via the Qualified Safety Parameters Display System (QSPDS). The detectors are high-sensitivity fission chambers sensing thermal neutrons in the range from 10-2 to 1010 neutrons per sq cm per sec and are located at the 90 0 and 270 instrument wells. (Refer to section 7.4.2).

C

• WCAP-7407-LK, "Power Maldistribution Investigations," R. F. Barry (1970)

The Process Instrumentation System measures temperature, pressure, flow, and level in the Reactor Coolant System, steam system, Reactor Containment, and auxiliary systems.

Process variables required on a continuous basis for the startup, operation, and shutdown of the unit are indicated, recorded, and controlled from the Control Room. The quantity and types of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operating range of the plant.

Certain controls which require a minimum of operator attention, or are only in use intermittently, are located on local control panels near the equipment to be controlled.

Monitoring of the alarms of such control systems is provided for the Control Room.

Redundant instrument channels are provided for all safety systems. Where wide process variable ranges and precise control are required, both wide range and narrow range instrumentation are utilized. Visual and audible alarms are provided in the Control Room to annunciate off-normal and abnormal conditions.

The incore instrumentation yields information on the neutron flux distribution and fuel assembly coolant outlet temperatures at selected core locations. The system provides a means for acquiring data and performs no operational plant control, although it is used for excore detector calibration and to insure that power peaking factors are within limits.

The Incore Instrumentation System consists of thermocouples, positioned to measure fuel assembly coolant outlet temperature at preselected locations; and flux thimbles, which run the length of selected fuel assemblies to measure the neutron flux distribution within the reactor core.

The data obtained from the incore temperature and flux distribution instrumentation system, in conjunction with previously determined analytical information, can be used to determine the fission power distribution in the core at any time throughout core life. This method is more accurate than using calculational techniques alone. Once the fission power distribution has been established, the maximum power output is primarily determined by thermal power distribution and the thermal and hydraulic limitations determine the maximum core capability.

The incore instrumentation provides information which may be used to calculate the coolant enthalpy distribution, the fuel burnup distribution, and an estimate of the coolant flow distribution.

Both radial and azimuthal symmetry of power may be evaluated by combining the detector and thermocouple information from the one quadrant with similar data obtained from the other three quadrants.

During reduced inventory conditions, RCS level indication is provided by two independent 24 of 119 IPEC00034624 IPEC00034624

IP3 FSAR UPDATE indications. One system, the mid-loop level monitoring system, upgrades a previously existing tygon tube level indication system. The upgraded system consists primarily of two parallel level columns which are vented to the pressurizer through a common line, a video camera located inside Containment, and a video monitor located in the Control Room. The system provides Operators in the Control Room with continuous indication of RCS water level.

The second system, the mid loop Ultrasonic Level Measuring System (ULMS), consists of a sensor, preamp/pulsar module and signal processing module. When used, the ULMS output will be connected to a recorder located in the Control Room panel SFF, and an audible alarm will be installed prior to the start of the Cycle 8/9 refueling outage.

A third system, the Mansell Level Monitoring System (MLMS) provides two independent differential pressure sensing level indication loops which provides ReS level indication on computer monitors as well as LCD displays. Each level indication loop*useshand held UT devices during RCS mid-loop operation to increase the range of level indication to the bottom of the hot leg pipe and to comply with Generic Letter 88-17 requirements.

These systems can be used to monitor RCS water level during mid-loop operation. All systems provide indication. The ULMS and MLMS system also provide audible alarms.

Reactor Coolant Pressure Boundary (Criterion 14)

Criterion: The reactor coolant pressure boundary shall be designed, fabricated, erected, and tested so as to have an extremely low probability of abnormal leakage, of rapidly propagating failure, and of gross rupture.

The Reactor Coolant System in conjunction with its control and protection provisions was designed to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated system interactions, and to maintain stresses within applicable code stress limits.

Fabrication of the components which constitute the pressure retaining boundary of the Reactor Coolant System was carried out in strict accordance with applicable codes. In addition, there are areas where equipment specifications for Reactor Coolant System components go beyond the applicable codes in order to assure design conservatism.

Details are given in Section 4.5.1.

The materials of construction of the pressure retaining boundary of the Reactor Coolant System are protected, by control of coolant chemistry, from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetime.

System conditions resulting from anticipated transients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions so that continued safe operation is possible.

The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASM E Boiler and Pressure Vessel Code.

Isolatable sections of the system are provided with overpressure relieving devices 25 of 119 IPEC00034625 IPEC00034625

IP3 FSAR UPDATE discharging to closed systems such that the system code allowable relief pressure within the protected section is not exceeded. (Section 4.1)

The Reactor Coolant Pressure Boundary was designed to reduce to an acceptable level the probability of a rapidly propagating type failure.

Assurance of adequate fracture toughness in the reactor vessel material was provided by compliance insofar as possible with the requirements for fracture toughness testing included in the Summer 1972 Addenda to Section III of the ASME Pressure Vessel and Boiler Code.

In cases where it was not possible to perform all tests in accordance with these requirements, conservative estimates of material fracture toughness were made using information available.

Assurance that the fracture toughness properties remain adequate throughout the service life of the plant, is provided by a radiation surveillance program.

Safe operating heatup and cooldown limits are established using methodology similar to 1996 Section III, ASME Pressure Vessel and Boiler Code, Appendix G.

Changes in fracture toughness of the core region plates, weldments, and associated weld heat affected zone due to radiation damage are monitored by a surveillance program based on ASTM E-185, Recommended Practice for Surveillance Tests for Nuclear Reactor Vessels. The evaluation of the radiation damage in this surveillance program is based on pre-irradiation testing by Charpy V-notch, dropweight test, and tensile specimens and post-irradiation testing of Charpy V-notch, tensile, and wedge opening loading specimens carried out during the lifetime of the reactor vessel. Specimens are irradiated in capsules located near the core mid-height and removed from the vessel at specified intervals.

All pressure-containing components of the Reactor Coolant System were designed, fabricated, inspected and tested in conformance with applicable codes.

The NRC has concluded that the current IP3 leakage detection system capability is adequate to continue to support the technical bases cited in the NRC's March 10, 1986, SE approving Leak Before Break (LBB) for the IP3 Primary Coolant Loop piping. This position was further clarified in the IP3 Supplement to Safety Evaluation re: Leakage Detection Systems (TAC No. MB3328, dated 01/30/02).

Reactor Coolant System Design (Criterion 15)

Criterion: The reactor coolant system and associated auxiliary, control, and protection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during any condition of normal operation, including anticipated operational occurrences.

The Reactor Coolant System design and operating pressure, together with the safety, power relief and pressurizer spray valves set points and the protection system set point pressures, are listed in Table 4.1-1. The design pressure allows for operating transient pressure changes. The selected design margin considers core thermal lag, coolant transport times and pressure drops, instrumentation and control response characteristics, and system relief 26 of 119 IPEC00034626 IPEC00034626

IP3 FSAR UPDATE valve characteristics. The design pressures and data for the respective system components are listed in Tables 4.1-2 through 4.1-6. Table 4.1-7 gives the design pressure drop of the system components.

The design temperature for each component was selected to be above the maximum coolant temperature in that component under all normal and anticipated transient load conditions. The design and operating temperatures of the respective system components are listed in Tables 4.1-2 through 4.1-6.

All components in the Reactor Coolant System were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. These cyclic loads are introduced by normal unit load transients, reactor trip, and startup and shutdown operation.

The number of thermal and loading cycles used for design purposes and the bases thereof are given in Table 4.1-8. During unit startup and shutdown, the rates of temperature and pressure changes are limited as indicated in Section 4.4.1. The cycles were estimated for equipment design purposes (40 year life) and are not intended to be an accurate representation of actual transients of actual operating experience.

To provide the necessary high degree of integrity for the equipment in the Reactor Coolant System, the transient conditions selected for equipment fatigue evaluation were based on a conservative estimate of the magnitude and frequency of the temperature and pressure transients resulting from normal operation, normal and abnormal load transients. To a large extent, the specific transient operating conditions considered for equipment fatigue analyses were based upon engineering judgment and experience. Those transients were chosen which are representative of transients to be expected during plant operation and which are sufficiently severe or frequent to be of possible significance to component cyclic behavior.

The following cyclic loads were considered in the design of reactor coolant system components:

1) Heatup and Cooldown

2) Unit Loading and Unloading

3) 10% Step Load Increase and Decrease

4) Large Step Decrease in Load

5) Reactor Trip from Full Power

6) Hydrostatic Test Conditions

7) Loss of Load Without Immediate Turbine Reactor Trip

8) Loss of Flow Over the range from 15% of full power to and including but not exceeding 100% of full 27 of 119 IPEC00034627 IPEC00034627

IP3 FSAR UPDATE power, the Reactor Coolant System and its components were designed to accommodate

+10% of full power step changes in plant load and + 5% of full power per minute ramp changes without reactor trip. The Reactor Coolant System can accept a complete loss of load from full power with reactor trip. In addition, the turbine bypass and steam dump system makes it possible to accept a step load decrease of 50% of full power without reactor trip.

The service life of Reactor Coolant System pressure components depends upon the end-of-life material radiation damage, unit operational thermal cycles, quality manufacturing standards, environmental protection, and adherence to established operating procedures.

The reactor vessel is only component of the Reactor Coolant System which is exposed to a significant level of neutron irradiation and it is therefore the only component which is subject to material radiation damage effects.

The NDTT shift of the vessel material and welds, due to radiation damage effects, is monitored by a radiation damage surveillance program which conforms with ASTM E-185 standards.

Reactor vessel design was based on the transition temperature method of evaluating the possibility of brittle fracture of the vessel material, as a result of operations such as leak testing and plant heatup and cooldown.

To establish the service life of the Reactor Coolant System components as required by Section III of the ASME Boiler and Pressure Vessel Code for Class "A" vessels, the unit operating conditions were established for the 40 year design life. These operating conditions include the cyclic application of pressure loadings and thermal transients.

The number of thermal and loading cycles used for design purposes are listed in Table 4.1-8.

All pressure containing components of the Reactor Coolant System were deSigned, fabricated, inspected and tested in conformance with the applicable codes listed in Table 4.1-9.

The Reactor Coolant System is classified as Class I for seismic deSign, requiring that there will be no loss of function of such equipment in the event of the assumed maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously, when combined with the primary steady state stresses.

Containment Design (Criterion 16)

Criterion: Reactor containment and associated systems shall be provided to establish an essentially leaktight barrier against the uncontrolled release of radioactivity to the environment and to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require.

The Reactor Containment completely encloses the entire reactor and the Reactor Coolant 28 of 119 IPEC00034628 IPEC00034628

IP3 FSAR UPDATE System and ensures that essentially no leakage or radioactive materials to the environment would result even if a design basis Loss-of-Coolant Accident were to occur. The liner and penetrations were designed to prevent any leakage through the Containment. The structure provides biological shielding for both normal and accident situations.

The Reactor Containment was designed to safely withstand several conditions and their credible combinations. The major loading conditions were: (Section 5.1) a) Occurrence of a gross failure of the Reactor Coolant System which creates a high pressure and temperature condition within the Containment.

b) Coincident failure of Reactor Coolant System, an earthquake or wind.

The design basis accident pressure load is discussed in Section 5.1. The design value is at least 5 percent in excess of the maximum calculated containment pressure as discussed in Section 14.3.6.

The design basis accident containment temperature induces loads in the concrete shell as the concrete acts to restrain liner thermal expansion. This thermal load effect on the liner is combined with pressure load effects to develop design basis accident design load requirements as a function of time. Accident temperature induced thermal gradients through the wall were not a factor in concrete shell design since the accident temperature effect penetrates approximately 10 percent of the containment wall thickness during the significant overpressure phase of the accident and the cracking of the concrete shell due to containment pressurization acts to relieve secondary stresses induced by thermal gradient effect. (Appendix 5A)

Quality standards of material selection, design, fabrication, and inspection of features (which are essential to the prevention, or mitigation of the consequences, of nuclear accidents) conform to the applicable provisions of recognized codes and good nuclear practice. The concrete structure of the Reactor Containment conforms to the applicable portions of ACI-318-63. These components are considered ASME Section XI Class or CC components and any repair or replacement activities shall be performed in accordance with ASME Section XI Subsections IWE and IWL of the ASME Code, 1992 Edition with certain exceptions whenever specific relief is granted by the NRC. Further elaboration on quality standards of the Reactor Containment is given in Section 5.1.

All components and supporting structures of the Reactor Containment were designed so that there is no loss of function of such equipment in the event of design basis ground acceleration acting in the horizontal and vertical directions simultaneously. The dynamic response of the structure to ground acceleration, based on the site characteristics and on the structural damping, was included in the design analysis.

Penetrations are equipped with double seals which are continuously pressurized above accident pressure. Large access openings, such as the Equipment Hatch and Personnel Air Locks, are equipped with double gasketed doors and flanges with the space between the gaskets connected to the pressurization system. The system utilizes a supply of clean, dry, compressed air which places the penetrations under an internal pressure above the peak calculated accident pressure.

29 of 119 IPEC00034629 IPEC00034629

IP3 FSAR UPDATE A permanently piped monitoring system is provided to continuously measure leakage from all penetrations. Leakage from the monitoring system is checked by continuous measurement of the integrated makeup air flow. In the event excessive leakage is discovered, each penetration can then be checked at any time. Capability is provided for testing the functional operability of valves and associated apparatus during periods of reactor shutdown.

Section 14.3.6 provides details of the analysis conducted to assure the integrity of the Reactor Containment Building for the duration of a postulated major Reactor Coolant System pipe rupture.

The OEH is designed to accommodate transportation of large equipment in and out of the Containment Building expeditiously during outage, and shall provide an essentially leak-tight barrier against the uncontrolled release of radioactivity to the environment due to events postulated during refueling accident conditions.

The roll-up door is an alternate device that is capable of rapid closure. It is effectively an airtight, but not pressure~resistant, door that when closed preventsditect communication between the containment atmosphere and the outside atmosphere.

Subsequent to a loss RHR cooling as defined in ITS 3.9.4 and 3.9.5, the roll-up door provides rapid containment closure until either cooling is restored, or the main equipment hatch (or OEH) may be installed within four hours.

Electrical Power Systems (Criterion 17)

Criterion: An onsite electric power system and an offsite electrical power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that:

1) Specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences.

2) The core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents.

The onsite electrical power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure.

Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on separate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simultaneous failure under 30 of 119 IPEC00034630 IPEC00034630

IP3 FSAR UPDATE operating and postulated accident and environmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limit and design limit and design conditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a Loss-of-Coolant Accident to assure that the core cooling, containment integrity, and other vital safety functions are maintained.

Provisions shall be included to minimize the probability of losing electric power from any of the remaining supplies as a result of, or coincident with, the loss of power generated by the nuclear power unit, the loss of power from the transmission network, or the loss of power from the onsite electric power supplies.

Independent alternate power systems are provided with adequate capacity and testability to supply the required Engineered Safety Features and protection systems. The plant is supplied with normal, standby (offsite) and emergency (onsite) power sources as follows:

1. The normal source of auxiliary power during plant operation is supplied from both the plant's generator and offsite power.

2. Offsite power is supplied from Buchanan Substation (approximately % mile from the plant) by 138kV and 345 kV feeders, and two underground 13.8 kV feeders. The Buchanan Substation has two 345kV and two 138 kV circuits to Millwood Substation and a 345kV circuit to Ladentown Substation which interconnects with the PJM system.

Millwood Substation has ties to Pleasant Valley Substation which is the interconnection point between Consolidated Edison Co. and Niagara Mohawk and Connecticut Light and Power system. In addition, there is 1-25.4 MW and 1-16.9 MW combustion turbine generator at Buchanan Substation connected to the 13.8kV feeders from Buchanan Substation and a 21 MW combustion turbine generator located at the Indian Point site. The 138kV feeders are connected to the 6.9 kV buses through the station auxiliary transformer, the 13.8 kV feeders and combustion turbines are connected to the 6.9 kV buses through autotransformers. The 480 volt engineered safety features buses are connected to the 6.9 kV buses through station auxiliary transformers.

3. Three diesel generators are each connected to their respective engineered safety features buses to supply emergency shutdown power in the event of loss of all other AC auxiliary power. There are no automatic ties between the buses associated with each diesel generator. Each diesel will be started automatically on a safety injection signal or upon the occurrence of under voltage on its associated 480 volt bus. Any two diesels have adequate capacity to supply the engineered safety features for the hypothetical accident concurrent with loss of outside power. This capacity is adequate to provide a safe and orderly plant shutdown in the event of loss of outside electrical power. The diesel generator units are capable of being started and sequence load begun within 10 seconds after the initial signal. Interlocks are provided so that a fault on any bus will lock out all possible sources of power to that bus. Interlocks are provided to prevent circuit 31 of 119 IPEC00034631 IPEC00034631

IP3 FSAR UPDATE breakers connecting emergency diesel generators No. 31, 32, and 33 to buses No. 2A, 6A, and 5A from automatically closing if there is a voltage on the bus. (Chapter 8)

Each of the four 480 volt switchgear bus sections which supply power to the safeguards equipment receives DC control power from its associated battery source. Batteries No. 31, 32, and 33 supply DC control power to 480 volt buses No. 5A, 6A and 2A/3A respectively.

The 125 volt DC system is divided into five buses with one battery and battery charger (supplied from the 480 volt system) serving each. The battery chargers supply the normal DC loads as well as maintaining proper charges on batteries. Battery chargers 31, 32 and 33 are also relied upon to support the continued operation of systems and components required to either mitigate the consequences of a Design Basis Accident or provide post-accident monitoring subsequent to depletion of batteries No. 31, 32 and 33. The DC system is redundant from battery source to actuation devices which are powered from the batteries.

There are five station batteries which feed five DC power panels, two of which (PP-31 and

32) in turn feed six DC distribution panels. Four of the main distribution power panels feed four relay and instrument DC buses. Redundant safeguards relays which use DC as a power source receive their power from one of the three buses. The 120 volt AC instrument supply is split into four buses, all are fed by inverters which are in turn supplied from separate 125 volt DC buses.

The Electrical Systems, under single failure conditions with necessary automatic switching, can still provide necessary power for the safeguard equipment in order to maintain plant safety functions. The plant auxiliary equipment is arranged electrically so that multiple items receive their power from different sources. (Section 8.2)

Inspection and Testing of Electrical Power System (Criterion 18)

Criterion: Electric power systems important to safety shall be designed to permit appropriate periodic inspection and testing of important area and features, such as wiring, insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their components. The systems shall be designed with a capability to test periodically:

a) The operability and functional performance of the components of the systems such as onsite power sources, relays, switches, and buses.

b) The operability of the systems as a whole and, under conditions as close to design as practical, the full operational sequence that brings the systems into operation, including operation of applicable portions of the protection system, and the transfer of power among the nuclear power unit, the offsite power system and the onsite power system.

Electric power systems important to safety were designed as described below in order that the above mentioned aspects of the system can be periodically tested.

The Electrical Systems, under single failure conditions with necessary automatic switching, can still provide necessary power for the safeguard equipment to maintain plant safety 32 of 119 IPEC00034632 IPEC00034632

IP3 FSAR UPDATE functions. The 480 volt equipment is arranged on 4 buses. The 6900 volt equipment is supplied from 6 buses. The bus arrangements specified for operations ensure that power is available to an adequate number of safeguards auxiliaries.

Any two of the three diesel generators, the station auxiliary transformer or the separate 13.8 to 6.9 kv transformers are each capable of supplying the minimum safeguards loads and therefore provide separate sources of power immediately available for operation of these loads (see the Technical Specifications). The presence of these independent supply sources and redundant equipment allows periodic testing of anyone supply and associated equipment without falling below minimum requirements.

The minimum testing and surveillance performed on the emergency power system are detailed in the Technical Specifications.

Control Room (Criterion 19)

Criterion: A control room shall be provided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant accidents.

Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 Rem whole body, or its equivalent to any part of the body, for the duration of the accident.

Equipment at appropriate locations outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures.

The plant is equipped with a Control Room which contains those controls and instrumentation necessary for operation of the reactor and turbine generator under normal and accident conditions, including Loss-of-Coolant Accidents.

The principal criteria of control station design and layout were that all controls, instrumentation displays and alarms required for the safe operation and shutdown of the plant are readily available to the operators in the Control Room.

Alarms and annunciators in the Control Room provide the operators with warning of abnormal plant conditions which might lead to damage of components, fuel or other unsafe conditions.

Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.

The non-nuclear regulating process and containment instrumentation measures temperatures, pressure, flow, and levels in the Reactor Coolant System, Steam Systems, 33 of 119 IPEC00034633 IPEC00034633

IP3 FSAR UPDATE Containment and other Auxiliary Systems. Process variables required on a continuous basis for the startup, power operation, and shutdown of the plant are controlled and indicated or recorded from the Control Room, access to which is supervised. The quantity and type of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operating range of the plant.

Consideration was given to the fact that certain systems normally require more attention from the operator. The control system therefore is centrally located on a three section board.

Sufficient shielding, distance, and containment integrity is maintained to assure that control room personnel shall not be subjected to radiation doses, under postulated accident conditions, during occupancy of, ingress to and egress from the Control Room which, in the aggregate, would exceed the limits in 10 CFR 100.

All doors into the Control Room lead to enclosed areas like the Turbine Building and Control Building stairwell, and not to the outside. The Control Room was constructed of concrete with all openings around cables sealed airtight with a fireproof compound; hence the infiltration and exfiltration through walls, floor and ceiling is negligible. The fresh air intake for the control room air conditioning system is located in the east wall of the control building below the electrical tunnel between elevations 30'-0" and 18'-0". This is sheltered by an enclosure formed by the electrical tunnel floor above and the concrete walls on the south and east sides.

Since the Control Building is physically separate from the Containment and Primary Auxiliary Building, there are no sources of contaminated leakage which could result in airborne concentrations in the Control Building, Turbine Building or at the Control Room fresh air intake in excess of those associated with containment and auxiliary building releases. Also, should it become necessary, the Control Room was provided with self-contained breathing apparatus.

All fresh air entering the Control Room passes through a filter system consisting of a roughing filter, a one inch charcoal filter and a HEPA filter.

The charcoal filters were replaced on June 16, 1980 with a more efficient type of charcoal filter.

The installed Nuclear Grade Activated Charcoal is tested in accordance with ASTM 03803-1989, per the IP3 response to Generic Letter 99-02.

Separate chlorine, anhydrous ammonia, and carbon dioxide diffusion type probes will detect the presence of these gases in the control room outside the air intake duct. Upon a toxic gas detection alarm, the operator will be able to place the control room air conditioning system in the 100% recirculation mode to stop the intake of outside air. An additional toxic gas detection system indicates the oxygen, chlorine, and anhydrous ammonia levels in the control room atmosphere.

As a further measure to assure safety, provisions were made so that plant operators can shutdown and maintain the plant in a safe condition by means of controls located outside 34 of 119 IPEC00034634 IPEC00034634

IP3 FSAR UPDATE the Control Room. During such a period of control room inaccessibility the reactor will be tripped and the plant maintained in a hot shutdown condition. If the period extends for a long time, the Reactor Coolant System can be borated to maintain shutdown as xenon decays.

Local controls are located so that the stations to be manned and the times when attention is needed are within the capability of the plant operating staff. The plant intercom system will provide communication among the personnel so that the operation can be coordinated.

If the Control Room should have to be evacuated suddenly and no control room operator action is possible, the reactor can be tripped by either of the following actions:

1) Open rod control breakers in the Cable Spreading Room of the Control Building.

2) Actuate the manual turbine trip at the control station in the Turbine Building.

Following evacuation of the Control Room, the following systems and equipment are provided to maintain the plant in a safe shutdown condition from outside the Control Room:

a) Residual heat removal b) Reactivity control, i.e., boron injection to compensate for fission product decay c) Pressurizer pressure and level control d) Electrical system as required to supply the above systems e) Other equipment, as described below:

Level indication for each steam generator Pressure indication for each steam generator Level indication for the pressurizer Pressure indication for the pressurizer Auxiliary Feedwater Pump controls Charging Pump controls Boric Acid Transfer Pump controls Service Water Pump controls Containment Air Recirculation Fan controls Control Room Air Handling Unit controls Control Room Air Inlet Damper controls Main Feedwater controls Turbine Driven Auxiliary Feed Pump speed control Auxiliary feedwater controls Atmospheric dump controls Pressurizer Heater backup controls All other valves required for hot stand-by Local STOP/START Motor Controls with a selector switch are provided at each of the motors for the above mentioned equipment. Placing the local selector switch in the local 35 of 119 IPEC00034635 IPEC00034635

IP3 FSAR UPDATE operating position gives an annunciation alarm in the Control Room and turns out the motor control position lights on the control room panel.

Following a normal plant shutdown an automatic steam dump control system bypasses steam to the condenser and maintains the reactor coolant temperature at its no load value.

This implies the continued operation of the steam dump system, condensate circuit, condenser cooling water, feed pumps and steam generator instrumentation. Failure to maintain water supply to the steam generators would result in steam generator dry out after some 34 minutes and loss of the secondary system for decay heat removal. Redundancy and full protection, where necessary, was built into the system to ensure the continued operation of the steam generator units. If the automatic steam dump control system is not available, independently controlled relief valves on each steam generator units maintain the steam pressure. These relief valves are further backed up by ASME Code safety valves on each steam generator. Numerous calculations, verified by startup tests on the Connecticut-Yankee and San Onofre Power Plants have shown that with the steam generator safety valves operating alone the Reactor Coolant System maintains itself close to the nominal no load condition. The steam relief facility is adequately protected by redundancy and local protection. For decay heat removal it is only necessary to maintain control on one steam generator.

For the continued use of the steam generators for decay heat removal, it is necessary to provide a source of water, a means of delivering that water and, finally, instrumentation for pressure and level indication.

For plant shutdown the normal source of water supply is the auxiliary feed circuit; this implies satisfactory operation of the condenser, air ejector, condenser cooling circuit etc. In addition to the normal feed circuit the plant may fall back on:

1) The condensate storage tanks

2) The city water storage tank

3) The city water supply Auxiliary feedwater may be supplied to the steam generators by the motor driven auxiliary feed pumps or by the steam driven auxiliary feed pump; these pumps and associated valves have local controls.

1.3.3 Protection and Reactivity Control Systems (Criteria 20 to 29)

Protection System Functions (Criterion 20)

Criterion: The protection system shall be designed (1) to initiate automatically the operation of appropriate systems including the reactivity control systems to assure that specified acceptable Fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of systems and components important to safety.

36 of 119 IPEC00034636 IPEC00034636

IP3 FSAR UPDATE The basic reactor tripping philosophy is to define a region of power and coolant temperature conditions allowed by the primary tripping functions, the overpower ~ T trip, the overtemperature ~ T trip and the nuclear overpower trip. The allowable operating region within these trip settings is provided to prevent any combination of power, temperatures and pressure which would result in DNB with all reactor coolant pumps in operation. Additional tripping functions such as a high pressurizer pressure trip, low pressurizer pressure trip, high pressurizer water level trip, low primary coolant flow trip, steam and feedwater flow mismatch trip, steam generator low-low water level trip, turbine trip, safety injection trip, source and intermediate range trips, and manual trip are provided to back up the primary tripping functions for specific accident conditions and mechanical failures.

A dropped rod signal blocks automatic rod withdrawal and also provides a turbine load cutback if above a given power level. The dropped rod is indicated from individual rod position indicators or by a rapid flux decrease on any of the power range nuclear channels.

Overpower ~ T, overtemperature ~ T, and Tavg deviation rod stops prevent abnormal power conditions which could result from excessive control rod withdrawal initiated by a malfunction of the Reactor Control System or by operator violation of administrative procedures.

Instrumentation and controls provided for the protective systems were designed to trip the reactor, when necessary, to prevent or limit fission product release from the core and to limit energy release; to signal containment isolation; and to control the operation of engineered safety features equipment.

The Engineered Safety Feature Systems are actuated by the engineered safety features actuation channels. Each coincidence network energizes an engineered safety features actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. The channels were designed to combine redundant sensors and independent channel circuitry, coincident trip logic and different parameter measurements so that a safe and reliable system is provided. The Engineered Safety Features Instrumentation System actuates (depending on the severitiy of the condition) the Safety Injection System, the Containment Isolation System, the Containment Air Recirculation System or the Containment Spray System.

The passive accumulators of the Safety Injection System do not require signal or power sources to perform their function. The actuation of the active portion of the Safety Injection System is described on Section 7.2.

The containment air recirculation coolers are normally in use during plant operation and would therefore not normally require an initiating signal. These units are, however, in the automatic sequence which actuates the Engineered Safety Features upon receiving the necessary actuating signals indicating an accident condition.

Containment spray is actuated by coincident and redundant high containment pressure signals.

37 of 119 IPEC00034637 IPEC00034637

IP3 FSAR UPDATE The Containment Isolation System provides the means of isolating the various pipes passing through the containment walls as required to prevent the release of radioactivity to the outside environment in the event of a Loss-of-Coolant Accident. The actuation of containment isolation is by coincident and redundant containment high pressure signals.

Protection System Reliability and Testability (Criterion 21)

Criterion: The protection system shall be designed for high functional reliability and inservice testability commensurate with the safety functions to be performed.

Redundancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated.

The protection system shall be designed to permit periodic testing of its functioning when the reactor is in operation, including a capability to test channels independently to determine failures and losses of redundancy that may have occurred.

The reactor uses the high speed version of the Westinghouse magnetic-type control rod drive mechanisms. Upon a loss of power to the coils, the rod cluster control (RCC) assemblies with full length absorber rods are released and fall by gravity into the core.

The reactor internals, fuel assemblies, RCC assemblies and drive system components were designed as seismic Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube.

Furthermore, the RCC assemblies are never fully withdrawn from their guide thimbles in the fuel assembly. Due to this and the flexibility designed into the RCC assemblies, abnormal loadings and misalignments can be sustained without impairing operation of the RCC assemblies.

The Rod Cluster Control assembly guide system is locked together with pins throughout its length to ensure against misalignments which might impair control rod movement under normal operating conditions and credible accident conditions. An analogous system successfully underwent 4132 hours0.0478 days <br />1.148 hours <br />0.00683 weeks <br />0.00157 months <br /> of testing in the Westinghouse Reactor Evaluation Center during which about 27,200 feet of step-driven travel and 1461 trips were accomplished with test misalignments in excess of the maximum possible misalignment that may be experienced when installed in the plant.

All primary reactor trip protection channels required during power operation were supplied with suffiicient redundancy to provide the capability for channel calibration and test at power.

Removal of one trip circuit is accomplished by placing that circuit in a tripped mode; i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Reliability and independence were obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate 38 of 119 IPEC00034638 IPEC00034638

IP3 FSAR UPDATE primary sensors. Each channel is continuously fed from its own independent electrical source. Failure to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event. (Section 7.2)

The Reactor Protection Systems were designed so that the most probable mode of failure (loss of voltage, relay failure) in each protection channel result in a signal calling for the protective trip. Each protection system design combines redundant sensors and channel independence with coincident trip philosophy so that a safe and reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant trip, or violate reactor protection criteria.

Channel independence was carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions are fully isolated, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel.

This approach was used for pressurizer pressure and water level channels, steam generator water level, Tavg and ,1 T channels, steam flow-feedwater flow and nuclear instrumentation channels.

The engineered safety features equipment is actuated by one or the other of the engineered safety features actuation channels. Each coincidence network actuates an engineered safety actuation device that operates the associated engineered safety features equipment, motor starters and valve operators.

In the Reactor Protection System, two reactor trip breakers are provided to interrupt power to the full length i drive mechanisms. The breaker main contacts are connected in series (with power supply) so that opening either breaker interrupts power to all full length mechanisms, permitting them to fall by gravity into the core.

In summary, reactor protection was designed to meet all presently defined reactor protection criteria and is in accordance with the IEEE "Standard for Nuclear Plant Protection Systems 323".

The analog equipment of each protection channel in service at power is capable of being tested and tripped independently by simulated analog input signals to verify its operation.

The trip logic circuitry includes means to test each logic channel through the trip breakers.

Thus, the operability of each trip channel can be determined conveniently and without ambiguity.

Testing of the diesel generator starting may be performed from the diesel generator control board. The generator breaker is not closed automatically after starting during this testing.

The generator may be manually synchronized to the 480 volt bus for loading. Complete testing of the starting of diesel generators can be accomplished by tripping the associated 480 volt under- voltage relays or providing a coincident simulated safeguards signal. The ability of the units to start within the prescribed time and to carry load can be periodically checked. (The Electrical Systems are discussed in detail in Section 8.2.3) 39 of 119 IPEC00034639 IPEC00034639

IP3 FSAR UPDATE Protection System Independence (Criterion 22)

Criterion: The protection system shall be designed to assure that the effects of natural phenomena, and of normal operating, maintenance, testing, and postulated accident conditions on redundant channels do not result in loss of the protection function, or shall be demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity in component design and principles of operation, shall be used to the extent practical to prevent loss of the protection function.

The basic reactor tripping philosophy was to define a region of power and coolant temperature conditions allowed by the primary tripping functions, the overpower DT trip, the overtemperature DT trip and the nuclear over-power trip. The allowable operating region within these trip settings was provided to prevent any combination of power, temperatures and pressure which would result in DNB with all reactor coolant pumps in operation.

Additional tripping functions such as high pressurizer pressure trip, low pressurizer pressure trip, high pressurizer water level trip, low reactor coolant flow trip, steam and feedwater flow mismatch trip, steam generator low-low water level trip, turbine trip, safety injection trip, nuclear source and intermediate range trips, and manual trip are provided to back up the primary tripping functions for specific accident condition and mechanical failures. (Section 7.2)

The Engineered Safety Features Systems are actuated by the engineered safety features actuation channels. Each coincidence network energizes an engineered safety features actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. The channels were designed to combine redundant sensors and independent channel circuitry, coincident trip logic and different parameter measurements so that a safe and reliable system is provided in which a single failure will not defeat the protective function.

All primary reactor trip protection channels required during power operation are supplied with sufficient redundancy to provide the capability for channel calibration and test at power.

Removal of one trip circuit is accomplished by placing that circuit in a tripped mode; i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip condition exists in a concurrent channel.

Reliability and independence are obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical source.

Failure to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.

The Reactor Protection Systems were designed so that the most probable modes of failure (loss of voltage, relay failure) in each protection channel result in a signal calling for the protective trip. Each protection system design combines redundant sensors and channel independence with coincident trip philosophy so that a safe and reliable system is provided 40 of 119 IPEC00034640 IPEC00034640

IP3 FSAR UPDATE in which a single failure will not defeat the channel function, cause a spurious plant protection system trip, or violate reactor protection criteria.

The Engineered Safety Features Systems and the Reactor Protection System have a seismic classification of Class I and were designed in accordance with the Seismic Class I criteria set forth in Section 16.1.3.

In addition to the environmental design bases listed in IEEE-279 (1968), the Engineered Safety Features Systems and Reactor Protection System met the environmental requirements listed in Appendix 6F.

The components of the protection system were designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.

Separation of redundant analog protection channels originates at the process sensors and continues back through the field wiring and containment penetrations to the analog protection racks. Physical separation was used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring was achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Redundant analog equipment was separated by locating redundant components in different protection racks. Each redundant channel is energized from a different AC instrument bus.

Each reactor trip circuit was designed so that trip occurs when the circuit is de-engerized; therefore, loss of channel power causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on all drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

The engineered safety features actuation circuits were designed on the "energy to operate" principle unlike the reactor trip circuits which utilize the "de-engerize to operate" principle.

The physical arrangement of all elements associated with the protective system reduces the probability of a single physical event impairing the vital functions of the system.

System equipment was distributed between instrument cabinets so as to reduce the probability of damage to the total system by some single event.

Wiring between vital elements of the system outside of equipment housing was routed and protected so as to maintain the true redundancy of the systems with respect to physical hazards.

41 of 119 IPEC00034641 IPEC00034641

IP3 FSAR UPDATE The same channel isolation and separation criteria as described for the reactor protection circuits were applied to the engineered safety features actuation circuits.

Protection System Failure Modes (Criterion 23)

Criterion: The protection system shall be designed to fall into a safe state or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water, pain, and radiation) are experienced.

Each reactor trip circuit was designed so that trip occurs when the circuit is de-energized; therefore, loss of channel power causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on all drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

The engineered safety features actuation circuits were designed on the "energize to operate" principle unlike the reactor trip circuits which utilize the "de-engergize to operate" principle.

The steam line isolation signal on high-high containment pressure, which uses the same circuitry as the containment spray actuation signal, was also designed on the "engergize to operate" principle. The three high-high containment pressure instrument channels are powered from three separate independent sources (one channel from Instrument Bus No.

31 powered from Battery No. 31, the second channel from Instrument Bus No. 33 powered from Battery No. 33, and the third channel from Instrument Bus No. 34 powered from Battery No. 34). This assures operation of these containment pressure instruments in the event of a power failure to one of the instrument channels.

Automatic starting of the emergency diesel generators is initiated by under-voltage on any of the 480 volt buses or by the safety injection signal. Engine cranking is accomplished by a stored energy system supplied solely for the associated diesel generator. The undervoltage relay scheme was designed so that loss of 480 volt power does not prevent the relay scheme from functioning properly. (Section 7.2)

Separation of Protection and Control Systems (Criterion 24)

Criterion: The protection system shall be separated from control systems to the extent that failure of any single control system component or channel, or failure or removal from service of any single protection system component or channel which is common to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and independence requirements of the 42 of 119 IPEC00034642 IPEC00034642

IP3 FSAR UPDATE protection system. Interconnection of the protection and control systems shall be limited so as to assure that safety is not significantly impaired.

Channel independence is maintained throughout the protection system extending from the sensor to the relay actuating the protection function. The protection and control functions are fully isolated, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel. This approach is used for all reactor trip channels.

The design basis for the control and protection system permits the use of a detector for both protection and control functions. Where this is done, all equipment common to both the protection and control circuits are classified as part of the protection system. Isolation amplifiers prevent a control system failure from affecting the protection system. In addition, where failure of a protection system component can cause a process excursion which requires protective action, the protection system can withstand another, independent failure without loss of function. Generally, this is accomplished with two-out-of-four trip logic. Also, wherever practical, provisions are included in the protection system to prevent a plant outage because of a single failure of a sensor.

In summary, reactor protection was designed to meet all presently defined reactor protection criteria and is in accordance with the IEEE "Standard for Nuclear Plant Protection Systems 279" (Section 7.2).

Protection System Requirements for Reactivity Control Malfunctions (Criterion 25)

Criterion: The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods.

Reactor shutdown with rods is completely independent of the normal control functions since the trip breakers completely interrupt the power to the full length rod mechanisms regardless of existing control signals. Effects of continuous withdrawal of a rod control assembly and of deboration are described in Sections 7.3.1 and 7.3.2, and in Chapters 9 and 14.

The control rod drive mechanisms are wired into preselected banks, and these bank configurations are not altered during core life. The assemblies are therefore physically prevented from being withdrawn in other than their respective banks. Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time.

The control rod drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed in the detailed analysis assuming the simultaneous withdrawal of the combination of the two banks of the maximum combined worth at maximum speed.

Should a continuous control rod assembly withdrawal be initiated from a subcritical condition, the transient will be terminated by the following automatic safety features:

1) Power range flux level trip (low setting) 43 of 119 IPEC00034643 IPEC00034643

IP3 FSAR UPDATE

2) Power range control rod stop

3) Power range flux level trip (high setting)

Termination of the startup incident by the above protection channels prevents core damage.

In addition, the reactor trip from high reactor pressure serves as a backup to terminate the incident before an overpressure condition could occur. (Section 14.1.1)

Taking into account the conservative assumptions under which the incident has been analyzed, it is concluded that in the unlikely event of a control rod assembly withdrawal incident, the core and Reactor Coolant System are not adversely affected, since the thermal power reached is only 84 percent of the nominal value and the core water temperature reached is 556.6 F for the nominal conditions.

This combination of thermal power and core water temperature results in a DNBR well above the applicable limit (per table 14.1-0). The peak average clad temperature of 590°F is less than the nominal full power of 647.5°F and thus there is no clad damage.

The automatic features of the Reactor Protection System which prevent core damage in a control rod assembly withdrawal incident at power include the following:

1) Nuclear power range instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint

2) Reactor trip is actuated if any two out of four iI. T channels exceed an overtemperature iI.

T setpoint

3) Reactor trip is actuated if any two out of four iI. T channels exceed an overpower iI. T setpoint

4) A high reactor coolant system pressure reactor trip

5) A high pressurizer water level reactor trip

6) In addition to the above listed reactor trips, there are the following control rod assembly withdrawal blocks:

a) High nuclear flux (one out of four) b) Overpower iI. T (one out of four) c) Overtemperature iI. T (one out of four).

In the unlikely event of a control rod assembly withdrawal incident during power operation, the core and Reactor Coolant System are not adversely affected since the minimum value of DNBR reached is in excess of the applicable limit for all control rod assembly reactivity rates. Protection is provided by the high nuclear flux and the overtemperature iI. T trips.

Section 14.1.2 describes the effectiveness of these protection channels.

The opening of the primary water makeup control valve provides the only supply of makeup water to the Reactor Coolant System which can dilute the reactor coolant. Inadvertent dilution can be readily terminated by closing this valve.

44 of 119 IPEC00034644 IPEC00034644

IP3 FSAR UPDATE Information on the status of reactor coolant makeup is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of pumps in the Chemical and Volume Control System. Alarms are actuated to warn the operator if boric acid or makeup water flow rates deviate from preset values as a result of system malfunction.

To cover all phases of unit operation, boron dilution during refueling, startup, and power operation were considered in the analysis presented in Section 14.1.5.

Because of the procedures involved in the dilution process, an erroneous dilution is considered incredible. Nevertheless, if an unintentional dilution of boron in the reactor coolant does occur, numerous alarms and indications are available to alert the operator to the condition. The maximum reactivity addition due to the dilution is slow enough to allow the operator to determine the cause of the addition and take corrective action before excessive shutdown margin is lost.

Reactivity Control System Redundancy and Capability (Criterion 26)

Criterion: Two independent reactivity control systems of different design principles shall be provided. One of the systems shall use control rods preferably including a positive means for inserting the rods, and shall be capable of reliably controlling reactivity changes to assure that under conditions of normal operation, including anticipated operational occurrences, and with appropriate margin for malfunctions such as stuck rods, specified acceptable fuel design limits are not exceeded. The second reactivity control system shall be capable of reliably controlling the rate of reactivity changes resulting from planned, normal power changes (including xenon burnout) to assure acceptable fuel design limits are not exceeded. One of the systems shall be capable of holding the reactor core subcritical under cold conditions.

One of the two reactivity control systems employs rod cluster control assemblies to regulate the position of Ag-In-Cd neutron absorbers within the reactor core. The other reactivity control system employs the Chemical and Volume Control System to regulate the concentration of boron (neutron absorber) in the Reactor Coolant System.

The concentration of boric acid is varied as necessary during the life of the core to compensate for: (1) changes in reactivity which occur with change in temperature of the reactor coolant from cold shutdown to the hot operating, zero power conditions; (2) changes in reactivity associated with changes in the fission product poisons xenon and samarium; (3) reactivity losses associated with the depletion of fissile inventory and buildup of long-lived fission product poisons (other than xenon and samarium); and (4) changes in reactivity due to burnable poison burn up.

The control rods provide reactivity control for: (1) fast shutdown; (2) reactivity changes associated with changes in the average coolant temperature above hot zero power (core average coolant temperature is increased with power level); (3) reactivity associated with any void formation; (4) reactivity changes associated with instantaneous load changes.

45 of 119 IPEC00034645 IPEC00034645

IP3 FSAR UPDATE Control Rod Requirements Neutron-absorbing control rods provide reactivity control to compensate for more rapid variations in reactivity. The rods are divided into two categories according to their function.

Some rods compensate for changes in reactivity due to variations in operating conditions of the reactor such as power or temperature. These rods comprise the control group of rods.

The remaining rods, which provide shutdown reactivity, are termed shutdown rods. The total shutdown worth of all the rods is specified to provide shutdown with sufficient margin with the most reactive rod stuck out of the core.

Control rod reactivity requirements at the beginning and end of life are recalculated for each reload.

Excess Reactivity Insertion Upon Reactor Trip The control requirements are based on providing a 1.3% shutdown margin at hot, zero power conditions with the highest worth rod stuck in its fully withdrawn position and to prevent return to criticality following a credible steam-line break.

Calculated Rod Worths The complement of 53 full length control rods arranged in the pattern shown in Figure 3.2-1 meets the shutdown requirements. Table 3.2-3 lists the calculated worths of this rod configuration for beginning of life, first cycle and end of life, first cycle.

In order to be sure of maintaining a conservative margin between calculated and required rod worths, an additional amount has been added to account for uncertainties in the control rod worth calculations. The calculated reactivity worths listed were decreased in the design by 10 percent to account for any errors or uncertainties in the calculation. This worth was established for the condition that the highest worth rod is stuck in the fully withdrawn position in the core.

A comparison between calculated and measured rod worths in operating reactors shows the calculation to be well within the allowed uncertainty of 10 percent. The second reactivity control system is capable of reliably controlling the rate of reactivity changes resulting from planned, normal power changes (including xenon burnout) to assure acceptable fuel design limits are not exceeded.

Chemical Shim Control Control to render the reactor subcritical at temperatures below the operating range is provided by a chemical neutron absorber (boron). The boron concentration during refueling was established as shown in Table 3.2-1, line 30. This concentration, together with the control rods, provides approximately 5 percent shutdown margin for these operations. For cold shutdown, at the beginning of core life, a concentration is sufficient for 1.3 percent shutdown with all but the highest worth rod inserted. The boron concentration during operation is well within solubility limits at ambient temperature. A boron concentration, 46 of 119 IPEC00034646 IPEC00034646

IP3 FSAR UPDATE sufficient to prevent dilution during refueling, is maintained in the spent fuel pit since the pit is directly connected with the refueling canal. This prevents dilution in the reactor cavity when the cavity is connected to the spent fuel pit.

The initial full power boron concentration with and without equilibrium xenon and samarium is calculated for each reload.

This initial boron concentration is that which permits the withdrawal of the control banks to their operational limits. The xenon-free hot, zero power shutdown with all but the highest worth rod inserted, can be maintained with a cycle specific boron concentration. This concentration is less than the full power operating value with equilibrium xenon.

Combined Reactivity Control System Capability (Criterion 27)

Criterion: The reactivity control systems shall be designed to have a combined capability, in conjunction with poison addition by the emergency core cooling system, of reliably controlling reactivity changes to assure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained.

The reactor core, together with the Reactor Control and Protection Systems, was designed so that the minimum DNBR is greater than the applicable limit (Table 14.1-0) and there is no fuel melting during normal operation, including anticipated transients.

Sufficient shutdown capability is also provided to maintain the core subcritical assuming the most reactive rod to be in the fully withdrawn position for the most severe anticipated cooldown transient associated with a single active failure, e. g., accidental opening of a steam bypass, or relief valve, or safety valve stuck open. This is achieved by the combination of control rods and automatic boric acid addition via the emergency core cooling system.

Manually controlled boric acid addition is used to maintain the shutdown margin for the long term conditions of xenon decay and plant cooldown. Redundant equipment is provided to guarantee the capability of adding boric acid to the Reactor Coolant System (Section 3.1).

Normal reactivity shutdown capability is provided within two seconds following a trip signal by control rod actuation. Boric acid injection is used to compensate for long term xenon decay transient and for plant cooldown. The shutdown capability prevents return to critical as a result of the cooldown associated with a primary/secondary safety valve stuck fully open.

Any time that the reactor is at power, the quantity of boric acid retained in the boric acid tanks and ready for injection always exceeds that quantity required for the normal cold shutdown. This quantity always exceeds the quantity of boric acid required to bring the reactor to hot shutdown and to compensate for subsequent xenon decay. Boric acid is pumped from the boric acid tanks by one of two boric acid transfer pumps to the suction of one of three charging pumps which inject boric acid into the reactor coolant. Any charging pump and either boric acid transfer pump can be operated form diesel generator power on 47 of 119 IPEC00034647 IPEC0003464 7

IP3 FSAR UPDATE loss of station power. Using either one of the two boric acid transfer pumps, in conjunction with anyone of the three charging pumps, the RCS can be borated to hot shutdown even with the control rods fully withdrawn. Additional boration would be used to compensate for xenon decay. At a minimum CVCS design boration rate of 132 ppm/hr, the boron concentration required for cold shutdown can be reached well before xenon decays below its pre-shutdown level. The RWST is a suitable backup source for emergency boration.

When two charging pumps are used to transfer borated water from the RWST to the reactor coolant, the boron concentration required for cold shutdown can be reached before xenon decays below its full-power pre-shutdown level.

Limits, which include considerable margin, are placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the Reactor Coolant Pressure Boundary or (b) disrupt the core, its support structures, or other vessel internals so as to lose capability to cool the core.

For any rupture of a steam pipe and the associated uncontrolled heat removal from the core, the Safety Injection System adds shutdown reactivity so that with a stuck rod, no offsite power and minimum engineered safety features, there is no consequential damage to the Reactor Coolant System and the core remains in place and intact (Section 6.2).

Reactivity Limits (Criterion 28)

Criterion: The reactivity control system shall be designed with appropriate limits on the potential amount and rate of reactivity increase to assure that the effects of postulated reactivity accidents can neither (1) result in damage to the reactor coolant pressure boundary greater than limited local yielding nor (2) sufficiently disturb the core, its support structures or other reactor pressure vessel internals to impair significantly the capability to cool the core. These postulated reactivity accidents shall include consideration of rod ejection (unless prevented by positive means), rod dropout, steam line rupture, changes in reactor coolant temperature and pressure, and cold water addition.

Limits, which include considerable margin, are placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the Reactor Coolant Pressure Boundary or (b) disrupt the core, its support structures, or other vessel internals so as to lose capability to cool the core.

The Reactor Control System employs control rod clusters. A portion of these are designated shutdown rods and are fully withdrawn during power operation. The remaining rods comprise the control groups which are used to control load and reactor coolant temperature.

The rod cluster drive mechanisms are wired into preselected groups, and are therefore prevented from being withdrawn in other than their respective groups. The rod drive mechanism is of the magnetic latch type and coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate was analyzed in the detailed plant analysis assuming two of the highest worth groups to be accidentally withdrawn at maximum speed yielding reactivity insertion rates no greater than 75 pcm/sec, which is well within the 48 of 119 IPEC00034648 IPEC00034648

IP3 FSAR UPDATE capability of the overpower-overtemperature protection circuits to prevent core damage.

No single credible mechanical or electrical control system malfunction can cause a rod cluster to be withdrawn at a speed greater than 80 steps per minute (- 50 inches per minute).

The Reactor is capable of meeting the performance objectives throughout core life under both steady state and transient conditions without violating the integrity of the fuel elements.

Thus the release of unacceptable amounts of fission products to the coolant is prevented.

The limiting conditions for operation established in the Technical Specifications specify the functional capacity of performance levels permitted to assure safe operation of the facility.

The control system and the operational procedures provide adequate control of the core reactivity and power distribution. The following control limits are met:

a) A minimum hot shutdown margin as shown in the Technical Specifications is available assuming a 10% uncertainty in the control rod calculation (Section 3.2) b) This shutdown margin is maintained with the most reactive RCCA in the fully withdrawn position c) The shutdown margin is maintained at ambient temperature by the use of soluble poison (Section 3.1)

The reactor coolant boundary is shown in Section 14.2.6 to be capable of accommodating, without further rupture, the static and dynamic loads imposed as a result of a sudden reactivity insertion such as a rod ejection.

Even on the most pessimistic basis, the rod ejection accident analysis indicated that the fuel and clad limits were not exceeded. It was concluded that there was no danger of sudden fuel dispersal into the coolant. The pressure surge was shown to be insufficient to exceed 3000 psia, and it was concluded that there was no danger of consequential damage to the primary circuit. The amount of fission products released as a result of clad rupture during DNB is considerably less than in the case of the double ended main coolant pipe break (the design basis accident), and therefore within the guidelines of 10 CFR 100.

Protection Against Anticipated Operational Occurrence (Criterion 29)

Criterion: The protection and reactivity control systems shall be designed to assume an extremely high probability of accomplishing their safety functions in the event of anticipated operational occurrences.

The Reactor uses the high speed version of the Westinghouse magnetic-type control rod drive mechanisms. Upon a loss of power to the coils, the rod cluster control assemblies with full length absorber rods are released and fall by gravity into the core.

49 of 119 IPEC00034649 IPEC00034649

IP3 FSAR UPDATE The reactor internals, fuel assemblies, RCC assemblies and drive system components were designed as seismic Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into guide tube. Furthermore, the RCC assemblies are never fully withdrawn from their guide thimbles in the fuel assembly. Due to this and the flexibility designed into the RCC assemblies, abnormal loadings and misalignments can be sustained without impairing operation of the RCC assemblies.

The Rod Cluster Control (RCC) assembly guide system is locked together with pins throughout its length to ensure against misalignments which might impair control rod movement under normal operating conditions and credible accident conditions. An analogous system successfully underwent 4132 hours0.0478 days <br />1.148 hours <br />0.00683 weeks <br />0.00157 months <br /> of testing in the Westinghouse Reactor Evaluation Center during which about 27,200 feet of step-driven travel and 1461 trips were accomplished with test misalignment in excess of the maximum possible misalignment that may be experienced when installed in the plant.

The Reactor Protection System was designed so that the most probable modes of failure (loss of voltage, relay failure) in each protection channel result in a signal calling for the protective trip. Each protection system design combines redundant sensors and channel independence with a coincident trip philosophy so that a safe and reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant protection system trip, or violate reactor protection criteria.

Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions are fully isolated, control being derived form the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel.

This approach is used for pressurizer pressure and water level channels, steam generator water level, Tavg and ,1 T channels, steam flow-feedwater flow and nuclear instrumentation channels.

In the Reactor Protection System, two reactor trip breakers are provided to interrupt power to the full length rod drive mechanisms. The breaker main contacts are connected in series (with power supply) so that opening either breaker interrupts power to all full length rod mechanisms, permitting them to fall by gravity into the core.

The components of the protection system were designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.

Separation of redundant analog protection channels originates at the process sensors and continues back through the field wiring and containment penetrations to the analog protection racks. Physical separation was used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring was achieved using separate wireways, cable trays, conduit, runs and containment penetrations for each redundant channel. Redundant analog equipment is separated by locating redundant components in different protection racks. Each redundant channel is energized from a different AC instrument bus (Section 7.2).

50 of 119 IPEC00034650 IPEC00034650

IP3 FSAR UPDATE Each reactor trip circuit was designed so that trip occurs when the circuit is de-energized; therefore, loss of channel power causes the system to go into trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

Reactor trip is implemented by interrupting power to the magnetic latch mechanism on all drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

The engineered safety features actuation circuits are designed on the "energize to operate" principle unlike the reactor trip circuits which utilize the "de-energize to operate" principle.

A loss of power in the Reactor Protective System causes the affected channel to trip. All bistables operate in a normally energized state and go to a de-energized state to initiate action. Loss of power thus automatically forces the bistables into the tripped state.

Availability of power to the engineered safety features instrumentation is continuously indicated. The loss of instrument power to the sensors, instruments, logic or actuating devices in the engineered safety features instrumentation, starts the engineered safety features equipment associated with affected channels, except for containment spray which requires instrument power for actuation. Steam line isolation on high-high containment pressure, which utilizes the same actuation circuitry as the containment spray actuation, also required power to actuate. The three high-high containment pressure instrument channels are powered from three separate, independent sources to assure operation in the event of a power failure to one of the instrument channels.

The Engineering Safety Features Systems are actuated by the engineered safety features actuation channels. Each coincidence network energizes an engineered safety features actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. The channels were designed to combine redundant sensors, and independent channel circuitry, coincident trip logic and different parameter measurements so that a safe and reliable system is provided in which a single failure will not defeat the protective function. The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isolation System, the Containment Air Recirculation System and Containment Spray System.

The passive accumulators of the Safety Injection System do not require signal or power sources to perform their function.

The core protective systems, in conjunction with inherent plant characteristics, were designed to prevent anticipated abnormal conditions from fuel damage exceeding limits established in Chapter 3, or Reactor Coolant System damage exceeding effects established in Chapter 4. In addition, the systems were designed to ensure that limits for energy release to the Containment and for radiation exposure (as in 10 CFR 100) are not exceeded.

51 of 119 IPEC00034651 IPEC00034651

IP3 FSAR UPDATE Thus, due to the high quality of the components, system separation and redundancy, along with the inherent characteristics of the design, these systems have a very high probability of accomplishing their safety function in the event of anticipated operational occurrences.

1.3.4 Fluid Systems (Criterion 30 to 46)

Quality of Reactor Coolant Pressure Boundary (Criterion 30)

Criterion: Components which are part of the reactor coolant pressure boundary shall be designed, fabricated, erected, and tested to the highest quality standards practical. Means shall be provided for detecting and, to the extent practical, identifying the location of the source of reactor coolant leakage.

The Reactor Coolant System is of primary importance with respect to its safety function in protecting the health and safety of the public.

Quality standards of material selection, design, fabrication and inspection conform to the applicable provisions of recognized codes and good nuclear practice (Section 4.1.7).

Details of the quality assurance programs, test procedures and inspection acceptance levels are given in Sections 4.3 and 4.5. Particular emphasis was placed on the assurance of quality of the reactor vessel to obtain material whose properties are uniformly within tolerances appropriate to the application of design methods of the code.

The Reactor Coolant System in conjunction with its control and protective provisions was designed to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated system interactions, and maintain the stresses within applicable code stress limits.

Fabrication of the components which constitute the pressure retaining boundary of the Reactor Coolant System was carried out in strict accordance with the applicable codes. In addition, there are areas where equipment specifications for Reactor Coolant System components go beyond the applicable codes. Details are given in Section 4.5.1.

The material of construction of the pressure retaining boundary of the Reactor Coolant System are protected by control of coolant chemistry from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetimes. System conditions resulting from anticipated transients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions so that continued safe operation is possible.

The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASM E Boiler and Pressure Vessel Code.

Isolatable sections of the system are provided with overpressure relieving devices discharging to closed systems such that the system code allowable relief pressure within the protected section is not exceeded. (Section 4.1) 52 of 119 IPEC00034652 IPEC00034652

IP3 FSAR UPDATE All pressure containing components of the Reactor Coolant System were designed, fabricated, inspected and tested in conformance with applicable codes (Section 4.1).

The Reactor Coolant System is classified as Class I for seismic design, requiring that there will be no loss of function of such equipment in the event of the assumed maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously, when combined with the primary steady state stresses.

The NRC has concluded that the current IP3 leakage detection system capability is adequate to continue to support the technical bases cited in the NRC's March 10, 1986, SE approving Leak Before Break (LBB) for the IP3 Primary Coolant Loop piping. This position was further clarified in the IP3 Supplement to Safety Evaluation re: Leakage Detection Systems (TAC No. MB3328, dated 01/30/02).

Positive indications in the Control Room of leakage of coolant from the Reactor Coolant System to the Containment are provided by equipment which permits continuous monitoring of containment air activity and humidity, and of runoff from the condensate collecting pans under the cooling coils of the containment air recirculation units. This equipment provides indication of normal background which is indicative of a basic level of leakage from primary systems and components. Any increase in the observed parameters is an indication of change within the Containment, and the equipment provided is capable of monitoring this change. The basic design criterion was the detection of deviations from normal containment environmental conditions including air particulate activity, radiogas activity, humidity, condensate runoff. In addition, assuming no operator action, the liquid inventory in the process systems and containment sump can be used for gross indication of leakage.

However, sensitivity of the processing systems and containment sump system can be improved with incorporation of a CR alarm (VC Sump Pump running) or operator actions to increase monitoring of the processing system (i.e. sump flow monitor once every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />).

(Section 4.1)

The existence of leakage from the Reactor Coolant System to the Containment, regardless of the source of leakage, is detected by one or more of the following conditions:

1) The containment sump pump system with incorporation of a CR alarm (VC Sump Pump running) or operator actions to increase monitoring of the processing system (i.e. sump flow monitor once every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />), provides the capability of detecting a 1 gpm leak within four hours.

2) Two radiation sensitive instruments provide the capability for detection of leakage from the Reactor Coolant System. The containment air particulate monitor is quite sensitive to low leak rates. The containment radiogas monitor is much less sensitive but can be used as a backup to the air particulate monitor.

3) A third instrument used in leak detection is the humidity detector. This provides a means of measuring overall leakage from all water and steam systems within the containment but furnishes a less sensitive measure.

53 of 119 IPEC00034653 IPEC00034653

IP3 FSAR UPDATE

4) A leakage detection system is included which determines leakage losses from all water and steam systems within the containment including that from the Reactor Coolant System. This system collects and measures moisture condensed from the containment atmosphere by the cooling coils of the main recirculation units. It relies on the principle that all leakages up to sizes permissible with continued plant operation will be evaporated into the containment atmosphere. This system provides a dependable and accurate means of measuring integrated total leakage, including leaks from the cooling coils themselves which are part of the containment boundary.

This method provides a backup to the radiation monitoring methods.

5) An increase in the amount of coolant makeup water which is required to maintain normal level in the pressurizer; an increase in containment sump level; or the coolant inventory balance are alternate means of detecting leakage.

Leakage detection methods are described in detail and evaluated in Chapter 6.

Fracture Prevention of Reactor Coolant Pressure Boundary (Criterion 31)

Criterion: The reactor coolant pressure boundary shall be designed with sufficient margin to assure that when stressed under operating, maintenance, testing, and postulated accident conditions (1) the boundary behaves in a nonbrittle manner and (2) the probability of rapidly propagating fracture is minimized.

The design shall reflect consideration of service temperatures and other conditions of the boundary material under operating, maintenance, testing, and postulated accident conditions and the uncertainties in determining (1) material properties, (2) the effects of irradiation on material properties, (3) residual, steady state and transient stresses, and (4) size of flaws.

The Reactor Coolant System, in conjunction with its control and protective provisions, was designed to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated system interactions, while maintaining stresses within applicable code stress limits.

Fabrication of the components which constitute the pressure retaining boundary of the Reactor Coolant System was carried out in strict accordance with the applicable codes. In addition, there are areas where equipment specifications for Reactor Coolant System components go beyond the applicable codes to insure conservative design. Details are given in Chapter 4.

The material of construction of the pressure retaining boundary of the Reactor Coolant System are protected by control of coolant chemistry from corrosion phenomena which might otherwise reduce the system structural integrity during its service lifetime.

System conditions resulting from anticipated transients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system conditions so that continued safe operation is assured.

54 of 119 IPEC00034654 IPEC00034654

IP3 FSAR UPDATE The system is protected from overpressure by means of pressure relieving devices, as required by Section III of the ASM E Boiler and Pressure Vessel Code.

Isolatable sections of the system are provided with overpressure relieving devices discharging to closed systems such that the system code allowable relief pressure within the protected section is not exceeded.

The Reactor Coolant Pressure Boundary was designed to reduce the probability of a rapidly propagating type failure to an acceptable level.

Assurance of adequate fracture toughness in the reactor vessel material is provided by compliance insofar as possible with the requirements for fracture toughness testing included in the Summer 1972 Addenda to Section III of the ASME Boiler and Pressure Vessel Code.

In cases where it was not possible to perform all tests in accordance with these requirements, conservative estimates of material fracture toughness have been made using available information.

Assurance that the fracture toughness properties remain adequate throughout the service life of the plant is provided by a radiation surveillance program.

Deterministic analyses based on advanced fracture mechanics techniques demonstrated that detection of small cracks in the reactor coolant system piping would occur before the cracks could grow to critical or unstable sizes which could lead to large break areas, such as the double-ended guillotine break or its equivalent. These analyses demonstrated that the probability of breaks occurring in the reactor coolant system main loop piping is sufficiently low that these breaks need not be considered as a design basis for requiring installation of pipe whip restraints or jet impingement shields.

Safe operating heatup and cooldown limits are established according to Section III, ASME Boiler and Pressure Vessel Code, Appendix G 2000, Protection Against Nonductile Failure, issued in the Summer 1972 Addenda.

Changes in fracture toughness of the core region plates, weldments, and associated weld heat affected zone due to radiation damage are monitored by a surveillance program based on ASTM E-185, Recommended Practice for Surveillance Tests for Nuclear Reactor Vessels. The evaluation of the radiation damage in this surveillance program is based on pre-irradiation testing by Charpy V-notch, tensile, and wedge opening loading specimens carried out during the lifetime of the reactor vessel. Specimens are irradiated in capsules located near the core mid-height and removed from the vessel at specified intervals.

Further details are given in Chapter 4. All pressure containing components of the Reactor Coolant System were designed, fabricated, inspected and tested in conformance with the applicable codes. Further details are given in Section 4.1.7.

All components in the Reactor Coolant System were designed to withstand the effects of cyclic loads due to reactor system temperature and pressure changes. These cyclic loads are introduced by normal unit load transients, reactor trip, and startup and shutdown operation. The number of thermal and loading cycles used for design purposes and the bases thereof are given in Table 4.1-8.

55 of 119 IPEC00034655 IPEC00034655

IP3 FSAR UPDATE To provide the necessary high degree of integrity for the equipment in the Reactor Coolant System, the transient conditions selected for equipment fatigue evaluation were based on a conservative estimate of the magnitude and frequency of the temperature and pressure transients resulting from normal operation, normal and abnormal load transients.

The criteria adopted for allowable stresses and stress intensities in vessels and piping subjected to normal loads plus seismic loads are defined in Appendix 4B. These criteria assure the integrity of the Reactor Coolant System under seismic loading. (Section 4.1)

Each of the materials used in the Reactor Coolant System was selected for the expected environment and service conditions. The major component materials are listed in Table 4.2-1.

All Reactor Coolant System materials which are exposed to the coolant are corrosion resistant. They consist of stainless steels and Inconel, and they were chosen for specific purposes at various locations within the system for their superior compatibility with reactor coolant.

The chemical composition of the reactor coolant is maintained within the specification given in Table 4.2-2. Reactor coolant chemistry is further discussed in Section 4.2.8.

The reactor vessel is the only component of the Reactor Coolant System exposed to a significant level of neutron irradiation and it is therefore the only component subject to material radiation damage effects.

The NDTT shift of the vessel material and welds, due to radiation damage effects is monitored by a radiation damage surveillance program which conforms with ASTM E-185 standards.

Reactor vessel design was based on the transition temperature method of evaluating the possibility of brittle fracture of the vessel material as a result of operations such as leak testing and plant heatup and cooldown.

To establish the service life of the Reactor Coolant System components as required by the ASME (Section III) Boiler and Pressure Vessel Code for Class "A" vessels, the unit operating conditions have been established for the 40 year design life. These operating conditions include the cyclic application of pressure loadings and thermal transients.

The Reactor Coolant System is classified as Class I for seismic design, requiring that there will be no loss of function of such equipment in the event of the assumed maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously, when combined with the primary steady state stresses. (Section 4.1.4)

The heatup and cooldown curves for the plant are based on the actual measured fracture toughness properties of the vessel materials. Maximum allowable pressures as a function of the rate of temperature change and allowable pressures as a function of the rate of temperature change, and the actual temperature, are established according to the methods 56 of 119 IPEC00034656 IPEC00034656

IP3 FSAR UPDATE given in Appendix G, Protection Against Non-Ductile Failure, published in the 1972 Summer Addenda of Section III the ASME Pressure Vessel and Boiler Code. The original RCS heatup and cooldown curves for up to 9.26 effective full power years (EFPYs) of reactor operation were developed from the analysis of capsule T. Subsequent analyses of capsules Y and Z did not require that changes be made to these curves until a new methodology to predict the effect of neutron radiation on reactor vessel materials was presented by Generic Letter 88-11. Consequently, new heatup and cooldown curves for 9 EFPYs based on the analysis of capsule Z in accordance with the methodology of Regulatory Guide 1.99, Revision 2, "Radiation Embrittlement of Reactor Vessel Materials." With increasing years of service, these curves were revised for 11, 13.3 and 16.2 EFPYs. These curves are given in the IP3 Technical Specifications. (Further details are given in Chapter 4.)

Inspection of Reactor Coolant Pressure Boundary (Criterion 32)

Criterion: Components which are part of the reactor coolant pressure boundary shall be designed to permit (1) periodic inspection and testing of important areas and features to assess their structural and leak-tight integrity, and (2) an appropriate material surveillance program for the reactor pressure vessel.

Post-operational examinations as set forth in ASME Section XI are performed to the fullest extent practical at the required intervals.

The structural integrity of the Reactor Coolant System is maintained at the level required by the original acceptance standards throughout the life of the plant. Any evidence, as a result of the inspections required by 10 CFR 50.55a(g), that potential defect implications have initiated or enlarged shall be investigated, including evaluation of comparable areas of Reactor Coolant System.

Nondestructive test methods, personnel, equipment and records conform to the requirements of ASME B&PV Code,Section XI.

The use of conventional nondestructive, direct visual and remote visual test techniques can be applied to the inspection of all primary loop components except for the reactor vessel.

The reactor vessel presents special problems because of the radiation levels and remote underwater accessibility to this component. Because of these limitations on access to the reactor vessel, several steps were incorporated into the design and manufacturing procedures in preparation for nondestructive test techniques. These are:

1) Shop ultrasonic examinations were performed on all thermally clad surfaces to an acceptance and repair standard to assure an adequate cladding bond to allow later ultrasonic testing of the base metal. Size of cladding bonding defect allowed is %" x

%".

2) The design of the reactor vessel shell in the core area is a clean, uncluttered cylindrical surface to permit future positioning of test equipment without obstruction.

3) Selected areas of the reactor vessel were ultrasonic tested and mapped during the manufacturing stage to facilitate the in-service inspection program by establishing baselines for later testing. The areas selected for ultrasonic testing mapping are:

57 of 119 IPEC00034657 IPEC00034657

IP3 FSAR UPDATE a) Vessel flange radius, including the vessel flange to upper shell weld b) Middle shell course c) Lower shell course above the radial core supports d) Exterior surface of the closure head from the flange knuckle to the cooling shroud e) Nozzle to upper shell weld f) Middle shell to lower shell weld g) Upper shell to middle shell weld The preoperational ultrasonic testing of these areas was performed after hydrostatic testing of the reactor vessel. A qualified inspector employed by an insurance company authorized to write boiler and pressure vessel insurance certified all examinations.

Access to areas to be inspected is limited by the design of the plant, having been designed before the In-Service Inspection Code was developed. However, wherever possible, modifications have been made to components and insulation to facilitate the inspection program and allow easy access for examinations.

The data and results of the preoperational examinations serve as base line data for the in-service inspection program to determine if new indications have appeared or old indications have enlarged. (See Section 4.5.4)

Reactor Coolant Makeup (Criterion 33)

Criterion: A system to supply reactor coolant makeup for protection against small breaks in the reactor coolant pressure boundary shall be provided. The system safety function shall be to assure that specified acceptable fuel design limits are not exceeded as a result of reactor coolant loss due to leakage from the reactor coolant pressure boundary and rupture of small piping or other small components which are part of the boundary. The system shall be designed to assure that for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished using the piping, pumps, and valves used to maintain coolant inventory during normal reactor operation.

Makeup to the Reactor Coolant System is provided by the Chemical and Volume Control System.

Makeup for normal plant leakage is regulated by the reactor makeup control which is set by the operator to blend water from the Primary Water Storage Tank with concentrated boric acid to match the reactor coolant boron concentration. One primary makeup water pump 58 of 119 IPEC00034658 IPEC00034658

IP3 FSAR UPDATE and one boric acid transfer pump are normally aligned for operation on demand from the reactor makeup control system.

The "automatic makeup" mode of operation of the reactor makeup control provides boric acid solution preset to match the boron concentration in the Reactor Coolant System. The automatic makeup compensates for minor leakage of reactor coolant without causing significant changes in the coolant boron concentration. (Section 9.2)

Rupture of small cross section will cause expulsion of the coolant at a rate which can be accommodated by the charging pumps which would maintain an operational water level in the pressurizer permitting the operator to execute an orderly shutdown. The coolant which would be released to the Containment contains the fission products existing in it. (Section 14.3)

Should a break occur which is larger than the capacity of the charging pumps depressurization of the Reactor Coolant System causes fluid to flow to the Reactor Coolant System from the pressurizer resulting in a pressure and level decrease in the pressurizer.

Reactor trip occurs when the pressurizer low pressure trip or overtemperature ~ T setpoint is reached. The Safety Injection System is actuated when the appropriate pressurizer low pressure setpoint is reached. Reactor Trip and Safety Injection System actuation are also initiated by a high containment pressure signal. The consequences of the accident are limited in two ways:

1) Reactor trip and borated water injection supplement void formation in causing rapid reduction of nuclear power to the residual power level corresponding first to delayed fission and ultimately to fission product decay.

2) Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperature.

A high degree of functional reliability was assured in the Chemical and Volume Control System by providing standby components where performance is vital to safety and by assuring fail-safe response to the most probable mode of failure. Special provisions include duplicate heat tracing with alarm protection of lines, valves, and components normally containing concentrated boric acid.

The system has three high pressure charging pumps, each capable of supplying the normal reactor coolant pump seal and makeup flow.

The electrical equipment of the Chemical and Volume Control System is arranged so that multiple items receive their power from various 480 volt buses. Each of the three charging pumps are powered from separate 480 volt buses. The two boric acid transfer pumps are also powered from separate 480 volt buses. One charging pump and one boric acid transfer pump are capable of meeting cold shutdown requirements shortly after full-power operation.

In cases of loss of AC power, a charging pump and a boric acid transfer pump can be placed on the emergency diesels if necessary. (Section 9.2)

Three charging pumps inject coolant into the Reactor Coolant System. The pumps are the variable speed positive displacement type, and all parts in contact with the reactor coolant 59 of 119 IPEC00034659 IPEC00034659

IP3 FSAR UPDATE were fabricated of austenitic stainless steel or other material of adequate corrosion resistance. These pumps have mechanical packing followed by a leakoff to collect reactor coolant before it can leak to the outside atmosphere. Pump leakage is piped to the drain header for disposal. The pump design prevents lubricating oil from contaminating the charging flow, and the integral discharge valves act as check valves.

Each pump was designed to provide the normal charging flow and the reactor coolant pump seal water supply during normal seal leakage. Each pump was designed to provide rated flow against a pressure equal to the sum of Reactor Coolant System normal maximum pressure (existing when the pressurizer power operated relief valve is operating) and the piping, valve and equipment pressure losses at the design charging flows.

At least two separate and independent flow paths are available for reactor coolant boration; i.e., either the charging line or the reactor coolant line. The malfunction or failure of one component will not result in the inability to borate the Reactor Coolant System. An alternate supply path is always available for emergency boration of the reactor coolant. As backup to the boration system, the operator can align the Refueling Water Storage Tank outlet to the suction of the charging pumps.

On loss of seal injection water to the reactor coolant pump seals, seal water flow may be re-established by manually starting a standby charging pump. Even if the seal water injection flow is not re-established, the plant can be operated indefinitely since the thermal barrier cooler has sufficient capacity to cool the reactor coolant flow which would pass through the thermal barrier cooler and seal leakoff from the pump volute.

Boration during normal operation to compensate for power changes will be indicated to the operator from two sources: (a) the control rod movement and (b) the flow indicators in the boric acid transfer pump discharge line. When the emergency boration path is used, two indications are available to the operator. The charging line flow indicator will indicate boric acid flow since the charging pump suction is aligned to the boric acid transfer pump suction for this mode of operation. The change in boric acid tank level is another indication of boric acid injection.

Residual Heat Removal (Criterion 34)

Criterion: A system to remove residual heat shall be provided. The safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded.

Suitable redundancy in components and features, and suitable interconnections, leak detection, and isolation capability shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available), the system safety function can be accomplished, assuming a single failure.

60 of 119 IPEC00034660 IPEC00034660

IP3 FSAR UPDATE Systems have been provided to remove residual heat from the reactor core and to cool down the reactor as follows:

During the first phase of cooldown, the reactor coolant system temperature is reduced by transferring decay heat and sensible heat to the Steam and Power Conversion System.

From hot standby conditions, residual heat removal requirements are normally satisfied by steam bypass to the condensers (see Section 10.2.1). Core decay heat can be continuously dissipated via the steam bypass to the condenser as feedwater in the steam generator is converted to steam by heat absorption. Normally, the capability to feed the steam generator is provided by operation of the turbine cycle feedwater system. In the unlikely event of complete loss of electrical power to the station, decay heat removal would be assured by the availability of the safety grade Auxiliary Feedwater System and steam discharge to the atmosphere via the main steam safety valves and atmospheric relief valves. The steam-driven auxiliary feedwater pump can supply sufficient feedwater for removal of decay heat from the core and reduce the reactor coolant system temperature.

The above systems/equipment are used for residual heat removal until the reactor coolant system temperature and pressure are reduced to between 250 0 and 350 0 F and 400 to 425 psig. At this point, the residual heat removal loop of the Safety Injection System is placed into service to remove the decay heat and sensible heat from the Reactor Coolant System.

Normally, two pumps and two heat exchangers are used for residual heat removal by taking suction from the Reactor Coolant System and discharging through the heat exchangers back into the Reactor Coolant System. All active loop components which are relied upon to perform their function are redundant. Only one pump and one heat exchanger are needed to accomplish the decay heat removal and reduce the reactor coolant system temperature, but this will occur at a reduced rate. Cooling water for the residual heat removal heat exchangers is supplied by the Component Cooling Water System. The Component Cooling Water System (CCWS), described in Section 9.3, is a closed system which serves as an intermediate system between the reactor coolant and the Service Water System. This double barrier arrangement reduces the probability of leakage of radioactive reactor coolant to the Service Water System. Radiation monitors are provided in the component cooling water system to detect reactor coolant leakage. Active loop components which are relied upon to perform the cooling function are redundant. Three CCWS pumps exist and two are normally initialized to remove heat during plant shutdown. Two CCWS heat exchangers are normally utilized to remove the residual heat during plant shutdown. If one of the pumps or one of the heat exchangers is not operable, safe shutdown is not affected. However, the cooldown time is extended. Components of the CCWS required for residual heat removal can be supplied by the onsite emergency power system.

Cooling water for the CCWS is provided by the Service Water System described in Section 9.6.1.

Sufficient redundancy of active and passive components is provided to ensure that cooling is maintained for vital heat loads for short and long periods in accordance with the single failure criteria. The system consists of two independent supply headers with each header being supplied by three pumps. Either of the two headers can be used to supply cooling for the essential loads. Either one of the two sets of three service water pumps can be powered by the emergency diesels. (See Section 9.6.1) 61 of 119 IPEC00034661 IPEC00034661

IP3 FSAR UPDATE Emergency Core Cooling (Criteria 35)

Criterion: A system to provide abundant emergency core cooling shall be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts.

Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

Adequate emergency core cooling is provided by the Safety Injection System (which constitutes the Emergency Core Cooling System) whose components operate in three modes. These modes are delineated as passive accumulator injection, active safety injection and residual heat removal recirculation.

The system assures that the core will remain intact and in place with its essential heat transfer geometry preserved following a rupture in the Reactor Coolant System. It also assures that the extent of metal-water reaction is limited such that the amount of hydrogen generated from this source, in combination with that from other sources, is tolerable in the Containment. This capability is provided during the simultaneous occurrence of a Design Basis Earthquake. This protection is afforded for:

1) All pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends

2) A loss of coolant associated with the rod ejection accident

3) A steam generator tube rupture.

The primary function of the Emergency Core Cooling System for the ruptures described above, is to remove the stored and fission product decay heat from the core such that fuel damage, to the extent that would impair effective cooling of the core, is prevented. This implies that the core remain intact and in place, with its essential heat transfer geometry preserved. To assure effective cooling of the core, limits on peak clad temperature and local metal-water reaction will not be exceeded. It has been demonstrated in the Westinghouse Rod Burst Program that for conditions within the area of safe operation, fuel rod integrity is maintained.

To limit the production of hydrogen in the Containment, the overall metal water reaction is limited to 1%.

62 of 119 IPEC00034662 IPEC00034662

IP3 FSAR UPDATE In evaluating the ECCS performance, consideration is given to core geometry distortion caused by swelling or fuel rod bursting.

For any rupture of a steam pipe and the associated uncontrolled heat removal from the core, the Safety Injection System adds shutdown reactivity so that with a stuck rod, no offsite power and minimum Engineered Safety Features, there is no consequential damage to the Reactor Coolant System and the core remains in place and intact.

Redundancy and segregation of instrumentation and components was incorporated to assure that postulated malfunctions will not impair the ability of the system to meet the design objectives. The system is effective in the event of loss normal station auxiliary power coincident with the loss of coolant, and is tolerant of failures of any single component or instrument channel to respond actively in the system. During the recirculation phase of a loss of coolant, the system is tolerant of a loss of any part of the flow path since back up alternative flow path capability is provided.

The ability of the Safety Injection System to meet its capability objectives is presented in Section 6.2.3. The analysis of the accidents is presented in Chapter 14.

The measure of effectiveness of the Safety Injection System is the ability of the pumps and accumulators to keep the core flooded or to reflood the core rapidly where the core has been uncovered for postulated large area ruptures. The result of this performance is to sufficiently limit any increase in clad temperature below a value where emergency core cooling objectives are met. (Section 6.2.1)

With minimum onsite emergency power available (two-of-three diesel generators) the emergency core cooling equipment available is two out of three safety injection pumps, one out of two residual heat pumps, and three out of four accumulators for a cold leg break and four accumulators for a hot leg break. With these systems, the calculated maximum fuel cladding temperature is limited to a temperature less than that which meets the emergency core cooling design objectives for all break sizes up to and including the double-ended severance of the reactor coolant pipe. (Section 14.3.1)

For large area ruptures analyzed, the clad temperatures are turned around by the accumulator injection. The active pumping components serve only to complete the refill started by the accumulators. Either two safety injection pumps or one residual heat removal pump provides sufficient addition of water to continue the reduction of clad temperature initially caused by the accumulator injection. (Section 6.2)

Inspection of Emergency Core Cooling System (Criterion 36)

Criterion: The emergency core cooling system shall be designed to permit appropriate periodic inspection of important components, such as spray rings in the reactor pressure vessel, water injection nozzles, and piping, to assure the integrity and capability of the system.

Design provisions were made to the extent practicable to facilitate access to the critical parts of the reactor vessel internals, pipes, valves and pumps for visual or boroscopic inspection 63 of 119 IPEC00034663 IPEC00034663

IP3 FSAR UPDATE for erosion, corrosion and vibration wear evidence, and for non-destructive test inspection where such techniques are desirable and appropriate. (Section 6.2)

All components of the Safety Injection System are inspected periodically to demonstrate system readiness.

The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves during system testing.

Testing of Emergency Core Cooling System (Criterion 37)

Criterion: The emergency core cooling system shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leak-tight integrity of its components, (2) the operability and performance of the active components of the system, and (3) the operability of the system as a whole and, under conditions as close to design as practicable, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of the associated cooling water system.

The design of the Safety Injection System provides for capability to initially test, to the extent practicable, the full operational sequence up to the design conditions to demonstrate the state of readiness and capability of the system. (Section 6.2)

The design provides for periodic testing of active components for operability and functional performance.

Power sources are arranged to permit individual actuation of each active component of the Safety Injection System.

The safety injection pumps can be tested periodically during plant operation using the minimum flow recirculation lines provided. The residual heat removal pumps are used every time the residual heat removal loop is put into operation and can be tested periodically. All remote operated valves are exercised and actuation circuits are tested during routine plant maintenance.

All components of the Safety Injection System are inspected periodically to demonstrate system readiness.

The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves during system testing.

In addition, to the extent practicable, the critical parts of the reactor vessel internals, pipes, valves and pumps are inspected visually or by boroscopic examination for erosion, corrosion, and vibration wear evidence, and by non-destructive test inspection where such techniques are desirable and appropriate.

Initial functional tests of the core cooling portion of the Safety Injection System were conducted before initial plant startup. These tests were performed following the flushing and 64 of 119 IPEC00034664 IPEC00034664

IP3 FSAR UPDATE hydrostatic testing of the system and with the Reactor Coolant System cold. The Safety Injection System valving was set initially to simulate the system alignment during plant power operation.

These functional tests were divided into two parts:

a) Demonstrate the proper function of instrumentation and actuation circuits, confirm valve operating times, confirm pump motor starting times, and demonstrate the proper automatic sequencing of load addition to the emergency diesels.

The tests were repeated for the various modes of operation needed to demonstrate performance at partial effectiveness, i.e., to demonstrate the proper loading sequence with two of the three emergency diesels, and to demonstrate the correct automatic starting of a second pump should the first pump fail to respond. These tests were performed without delivery of water to the Reactor Coolant System, but included starting of all pumping equipment involved in each test.

b) Demonstrate the proper delivery rates of injection water to the Reactor Coolant System.

To initiate the first part of the test, the safety injection block switch was moved to the unblock position to provide control power allowing the automatic actuation of the safety injection relays from the low water level and low-pressure signals from the pressurizer instrumentation. Simultaneously, the breakers supplying outside power to the 480 volt buses were tripped manually and operation of the emergency diesel system automatically commenced. The high-head safety injection pumps and the residual heat removal pumps started automatically following the prescribed diesel loading sequence. The valves operated automatically to align the flow path for injection into the Reactor Coolant System.

The second portion of the test was initiated by manually starting individual pumps on mini-flow and manually opening the appropriate isolation valves to deliver water to the Reactor Coolant System. Data was taken to verify proper pump performance and flow delivery rates.

Pre-operational performance tests of the components were performed in the manufacturer's shop. The pressure containing parts of the pump were hydrostatically tested in accordance with Paragraph UG-99 of Section VIII of the ASME Code. Each pump was given a complete shop performance test in accordance with Hydraulic Institute Standards. The pumps were run at design flow and head, shutoff head and at additional points to verify performance characteristics. NPSH was established at design flow by means of adjusting suction pressure for a representative pump. This test was witnessed by qualified Westinghouse personnel.

The remote operated valves in the Safety Injection System are motor operated. Shop tests for each valve included a hydrostatic pressure test, leakage tests, a check of opening and closing time, and verification of torque switch and limit switch settings. The ability of the motor operator to move the valve with the design differential pressure across the gate was 65 of 119 IPEC00034665 IPEC00034665

IP3 FSAR UPDATE demonstrated by opening the valve with an appropriate hydrostatic pressure on one side of the valve.

The recirculation piping and accumulators were hydrostatically tested at 150 percent of design pressure.

The service water and component cooling water pumps were thoroughly tested prior to initial operation.

Periodic testing of the Safety Injection System components and all necessary support systems at power is a portion of Entergy's test program. The safety injection and residual heat removal pumps are to be tested in accordance with the Indian Point 3 Inservice Testing Program, to check the operation of the starting circuits, verify the pumps are in satisfactory running order, and verification is made that required discharge head is attained. No inflow to the Reactor Coolant System will occur whenever the reactor coolant pressure is above 1500 psi. If such testing indicates a need for corrective maintenance, the redundancy of equipment in these systems permits such maintenance to be performed without shutting down or reducing load under conditions defined in the Technical Specifications. These conditions include the period within which the component should be restored to service and the capability of the remaining equipment to meet safety limits within such a period.

The operation of the remote stop valves in the accumulator tank discharge line may be tested by opening the remote test valves just downstream of the stop valve. Flow through the test line can be observed on instruments and the opening and closing of the discharge line stop valves can be sensed on this instrumentation. Test circuits are provided to periodically examine the leakage back through the check valves and to ascertain that these valves seat whenever the reactor system pressure is raised.

This test is routinely performed when the reactor is being returned to power after an outage and the reactor pressure is raised above the accumulator pressure. If leakage through a check valve should become excessive, the isolation valve would be closed. (The safety injection actuation signal will cause this valve to open should it be in the closed position at the time of a Loss-of-Coolant Accident.) The performance of the check valves has been carefully studied and it is highly unlikely that the accumulator lines would have to be closed because of leakage.

The recirculation pumps are normally in a dry sump. Minimum flow testing of these pumps is performed during refueling operation by filling the recirculation sump and opening the miniflow valve on the discharge of the pump and directing the flow back to the sump. Those service water and component cooling pumps which are not running during normal operation may be tested by alternating them with the operating pumps.

The content of the accumulators and the Refueling Water Storage Tank are sampled periodically to assure that the required boron concentration is present.

System testing is conducted during plant shutdown to demonstrate proper automatic operation of the Safety Injection System. An actual or simulated safety injection test signal is applied to initiate automatic action and verification is made that the components receive 66 of 119 IPEC00034666 IPEC00034666

IP3 FSAR UPDATE the safety injection signal in the proper sequence. The Safety Injection and Residual Heat Removal pumps are blocked from starting. Isolation valves in the injection lines are blocked closed so that flow is not introduced into the Reactor Coolant System. The system test demonstrates the operation of the valves, pump circuit breakers, and automatic circuitry.

The test is considered satisfactory if control board indication and visual observations indicate all components have operated and sequenced properly. A complete system test cannot be performed when the reactor is operating because a safety injection signal would cause a reactor trip. The method of assuring complete operability of the Safety Injection System is to combine the system test performed during plant shutdown with more frequent component tests, which can be performed during reactor operation.

The accumulators and the injection piping up to the final isolation valve are maintained full of borated water while the plant is in operation. The accumulators and the high head injection lines are refilled with borated water as required by using the safety injection pumps to recirculate refueling water through the injection lines. A small test line is provided for this purpose in each injection header.

Flow in each of the safety injection headers and in the main flow line for the residual heat removal pumps is monitored by a local flow indicator. Pressure instrumentation is also provided for the main flow paths of the safety injection and residual heat removal pumps.

Accumulator isolation valves are blocked closed for this test.

The eight-switch sequence for recirculation operation is tested following the above injection phase test to demonstrate proper sequencing of valves and pumps. The recirculation pumps are blocked from start during this test.

The external recirculation flow paths are hydrotested during periodic retests at the operating pressures. This is accomplished by running each pump which could be utilized during external recirculation (safety injection and residual heat removal pumps) in turn at near shutoff head conditions and checking the discharge and recirculation test lines. The suction lines are tested by running by the residual heat removal pumps and opening the flow path to the safety injection pumps in the same manner as described above.

During the above test, all system joints, valve packing, pump seals, leak-off connections or other potential pOints of leakage are visually examined. Valve gland packing, pump seals, and flanges are adjusted or replaced as required to reduce the leakage to acceptable proportions. For power operated valves, final packing adjustments are made, and the valves are put through an operating cycle before a final leakage examination is made.

The entire recirculation loop except the recirculation line to the residual heat removal pumps is pressurized during periodic testing of the engineered safety features components. The recirculation line to the residual heat removal pump is capable of being hydrotested during plant shutdown and it is also leak tested at the time of the periodic retests of the contai nment.

Containment Heat Removal (Criterion 38) 67 of 119 IPEC00034667 IPEC00034667

IP3 FSAR UPDATE Criterion: A system to remove heat from the reactor containment shall be provided. The system safety function shall be to reduce rapidly, consistent with the functioning of other associated systems, the containment pressure and temperature following any loss-of-coolant accident and maintain them at acceptable low levels.

Suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

The Reactor Containment heat removal function is accomplished by two independent, full capacity systems.

The Containment Spray System, as described in Section 6.3, sprays cool water into the containment atmosphere, when appropriate, in the event of a Loss-of-Coolant Accident and thereby ensures that the containment pressure does not exceed the design value.

The Containment Air Recirculation Cooling and Filtration System, described in Section 6.4, was designed to recirculate and cool the containment atmosphere in the event of a Loss-of-Coolant Accident to limit containment pressure within the design value.

In the event of a Design Basis Accident, anyone of the following combinations will provide sufficient cooling to reduce containment pressure at rate consistent with limiting offsite doses to acceptable values: (1) five fan cooler units; (2) two containment spray pumps; or (3) three fan cooler units and one spray pump. For design basis accidents in which failure of any single diesel generator is assumed, the resulting equipment configuration is adequate to perform containment cooling and iodine removal requirements. (See FSAR Section 14.3.6 for details.) Capability of the containment heat removal systems to reduce the containment pressure and temperature levels is discussed in Section 14.3.6. The containment cooling system capability assumed in the analysis was one of two available containment spray subsystems and three of five available containment fan cooler units.

This is the minimum equipment available considering the single failure criteria in the emergency power system, the spray system and the fan cooler system.

Inspection of Containment Heat Removal System (Criterion 39)

Criterion: The containment heat removal system shall be designed to permit appropriate periodic inspection of important components such as torus, sumps, spray nozzles and piping to assure the integrity and capability of the system.

Where practicable, all active components and passive components of the Containment Spray System are inspected periodically to determine system readiness. The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves. During operational testing of the containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks. Design provisions for inspection of the safety injection components which also function as part of the Containment Spray System, are described in Section 6.2.5.

68 of 119 IPEC00034668 IPEC00034668

IP3 FSAR UPDATE Provisions were made to the extent practical to facilitate access for periodic visual inspection of all important components of the Containment Air Recirculation Cooling and Filtration System.

The Containment Air Recirculation Cooling and Filtration System was designed to the extent practicable so that the components can be tested periodically, and after any component maintenance, for operability and functional performance.

The air recirculation and cooling units, and the service water pumps, which supply the cooling units, are in operation on an essentially continuous schedule during plant operation, and no additional periodic tests are required.

Means are provided to initially test to the extent practical the full operational sequences of the air recirculation system including transfer to alternate power sources.

Testing of Containment Heat Removal System (Criterion 40)

Criterion: The containment heat removal system shall be designed to permit appropriate periodic pressure and functional testing to assure:

1) The structural and leaktight integrity of its components.

2) The operability and performance of the active components of the system.

3) The operability of the system as a whole, and, under conditions as close to the design as practical, the performance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of the associated cooling water system.

The Containment Spray System active components are tested periodically and also after maintenance is performed. Permanent test lines for the containment spray loops are provided so that system components may be tested. Air test lines for checking that the spray nozzles are unobstructed are provided. Capability was provided to test initially, to the extent practicable, the operational startup sequence of the Containment Spray System including the transfer to alternate power sources. Periodic testing is conducted to verify proper sequencing of valves and pumps on initiation of the containment spray signal and to demonstrate the proper operation of all remotely operated valves and the spray pumps.

(Section 6.3)

Surveillance testing of the Containment Spray System is described in the Technical Specifications. System tests are performed at least once per 24 months. A test is considered satisfactory if visual observations indicate all components have operated satisfactorily. The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves. During operational testing of containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks.

69 of 119 IPEC00034669 IPEC00034669

IP3 FSAR UPDATE The Containment Air Recirculation Cooling and Filtration System was designed to the extent practicable that components can be tested periodically for both operability and functional performance, and after any component maintenance. The air recirculation and cooling units and the service water pumps, which supply the cooling units, are in operation on an essentially continuous basis during plant operation and, therefore, no additional periodic tests are necessary. Means were provided to test initially, to the extent practicable, the full operational sequence of the system, including transfer to alternative power sources.

The containment air cooling units are supplied with cooling water from the Service Water System, as described in Section 9.6.1. One of the three nuclear service water pumps is required for operation during normal containment cooling. For emergency operation, two independent, full flow isolation valves open automatically in the event of an engineered safeguards actuation signal.

Containment Atmosphere Cleanup (Criterion 41)

Criterion: Systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concentration and quality of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere following postulated accidents to assure that containment integrity is maintained.

Each system shall have suitable redundancy in components and features, and suitable interconnections, leak detection, isolation, and containment capabilities to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) its safety function can be accomplished, assuming a single failure.

The Containment Air Recirculation Cooling and Filtration System described in Section 6.4, was designed to remove fission products from the containment atmosphere should they be released in the event of an accident. The filtration capacity of the system is sufficient to reduce the concentration of fission products in the containment atmosphere following a loss of reactor coolant to levels ensuring that the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 30 day thyroid doses will be limited to within the guidelines of 10 CFR 100. Details of the site boundary dose calculation are given in Section 14.3.5. The Containment Spray System also serves as a removal mechanism for fission products postulated to be dispersed in the containment atmosphere.

Suitable redundancy has been provided for these systems. In the event of a Design Basis Accident, three charcoal filters and their associated recirculation fans (five recirculation fans and filters have been provided), along with one of two containment spray pumps and sodium hydroxide addition, will reduce air-borne organic and molecular iodine activities sufficiently to limit offsite doses to acceptable values. These constitute the minimum safeguards for iodine removal and are capable of being operated on emergency power with one diesel generator inoperable. A single failure analysis has been made on all active components of the Containment Air Recirculation and Filtration System to show that the failure of any single active component will not prevent fulfilling the design function. The analysis is summarized 70 of 119 IPEC00034670 IPEC00034670

IP3 FSAR UPDATE in Table 6.4.1. A similar analysis for the Containment Spray System is summarized in Table 6.3-4.

Two full rated recombination systems, as described in Section 6.8, are provided to control the hydrogen evolved in the containment following a Loss-of-Coolant Accident. Either system is capable of preventing the hydrogen concentration from exceeding 2% by volume within the Containment (Section 14.3.7). Power supplies for the recombiners are separate so that loss of one power supply will not affect the remaining system. Sufficient system redundancy and independence are provided such that no single active or passive component failure can negate the minimum requirements of operation.

Inspection of Containment Atmosphere Cleanup Systems (Criterion 42)

Criterion: The containment atmosphere cleanup systems shall be designed to permit appropriate periodic inspection of important components, such as filter frames, ducts, and piping to assure the integrity and capability of the systems.

Access is available for visual inspection of the Containment Air Recirculation Cooling and Filtration System components including fans, cooling coils, dampers, filter units and ductwork. Provisions were made for ready removal of the filters for inspections and testing.

(Section 6.4)

Design provisions were made to the extent practicable to facilitate access for periodic visual inspections of all important components of the Containment Spray System.

Periodic operating checks of the Hydrogen Recombiner System are specified in Technical Specification Section 3.6.8 and described in the FSAR. The portion of the system located outside the Containment should be readily accessible for inspection at any time, while the Containment portion would be accessible for inspection during reactor shutdown.

Testing of Containment Atmosphere Cleanup Systems (Criterion 43)

Criterion: The containment atmosphere cleanup systems shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the systems such as fans, filters, dampers, pumps, and valves and (3) the operability of the systems as a whole and under conditions as close to design as practical, the performance of the full operational sequence that brings the systems into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of associated systems.

The Containment Air Recirculation Cooling and Filtration system was designed to the extent practicable so that components can be tested periodically and after maintenance for operability and functional performance. The air recirculation and cooling units are in operation on an essentially continuous schedule during plant operation and no additional periodic tests are required. (Section 6.4) 71 of 119 IPEC00034671 IPEC00034671

IP3 FSAR UPDATE The closed dampers, which allow for charcoal filter bypass during normal operation, can be periodically tested in a non-operating unit by activating controls and verifying deflection by instruments in the Control Room. Representative sample elements in each of the activated carbon filter plenums are removed periodically during shutdowns and tested to verify their continued efficiency. After reinstallation, the filter assemblies are tested in place in accordance with the Technical Specifications to determine integrity of the flow path.

Means were provided to test initially under conditions as close to design as was practicable the full operational sequence that would bring the system into action, including transfer to the emergency diesel generator power source. Surveillance testing of the containment air filtration system is covered in the Technical Specifications.

One of the design bases for the Hydrogen Recombination System was that the system shall be testable during normal operating conditions of the plant. Operating checks of the system are performed periodically, as required by the Technical Specifications and as discussed in the FSAR.

Testing of the Containment Spray System is addressed in the discussion for Criterion 40.

Cooling Water (Criterion 44)

Criterion: A system to transfer heat from structures, systems, and components important to safety to an ultimate heat sink shall be provided. The system safety function shall be to transfer the combined heat load of these structures, systems, and components under normal operating and accident conditions.

Suitable redundancy in components and features and suitable interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure.

A closed-loop Component Cooling Water System and a once-through Service Water System are provided to transfer heat loads from structures, systems and components important to safety to an ultimate heat sink. The component cooling system transfers heat loads to the Service Water System via component cooling heat exchangers. The Service Water System takes water from the Hudson River and supplies cooling water for the Component Cooling Water System and other various heat loads from structures, systems and components important to safety. The Hudson River is used as the ultimate heat sink.

Six identical service water pumps and three backup service water pumps are provided to supply cooling water to the Service Water System. Sufficient redundancy of active and passive components is provided to ensure that cooling is maintained to vital loads for short and long periods in accordance with the single failure criteria. Two independent service 72 of 119 IPEC00034672 IPEC00034672

IP3 FSAR UPDATE water headers are provided with each being supplied by three pumps. Either of the two supply headers can be used to supply the essential loads, with the other feeding the non-essential loads. Leak detection in the Service Water System for both inside and outside of the Containment can be accomplished by the methods described in Section 6.7.1.

The only major components in the Service Water System located inside the Containment are the fan cooling units. Each unit is provided with valves so that it may be isolated for leak testing. Should there be a failure in the piping or valves at the header supplying water to the fan cooling units, one of the two series valves in the center of the header can be closed and service will continue on the side of the header opposite the failure. Likewise, operation of at least one component cooling heat exchanger (located outside the containment) is assured despite the postulated failure of any single active or passive component in the system from the service water pumps to the heat exchangers themselves. Refer to Section 9.6.1 for details.

A single failure analysis of nuclear service water pumps and discharge line isolation valve is shown on Table 6.4-1.

The Component Cooling Water System was designed to remove residual and sensible heat from the Reactor Coolant System during plant shutdown, cool the letdown flow during power operation, and to provide cooling to dissipate waste heat from various primary plant components. Active loop components in the system are redundant. The Component Cooling Water System is provided with two main headers. Isolation valves are furnished to allow each loop to be isolated and operated as an independent component cooling loop.

The loop design provides for detection of radioactivity entering the loop from a reactor coolant source and also provide for isolation. (Section 9.3)

Water leakage from the component cooling loop can be detected by a falling level in the component cooling surge tanks. The component which is leaking can be located by sequential isolation or inspection of equipment in the loop. A failure analysis of pumps, heat exchangers and valves is presented in Table 9.3-5.

Other means of leak detection in the Component Cooling Water System are covered in Section 6.7.1.2.

Three components cooling pumps and two heat exchangers are provided for the component cooling system. During normal full power operation, two pumps and one heat exchanger will accommodate the heat removal loads. The third pump provides 50% backup and the second heat exchanger provides 100% backup during normal operation. All three pumps and two heat exchangers are to be utilized to remove the residual and sensible heat during normal plant shutdown.

The cooling water system pumps can be operated on onsite electric power or offsite power to accomplish the system safety function. In addition, the onsite sources of emergency power from three diesel generator sets are provided to the safety related pumps required to perform the system safety function upon loss of the normal power supply. (Section 8.2)

Inspection of Cooling Water System (Criterion 45) 73 of 119 IPEC00034673 IPEC00034673

IP3 FSAR UPDATE Criterion: The cooling water system shall be designed to permit appropriate periodic inspection of important components, such as heat exchangers and piping, to assure the integrity and capability of the system.

The cooling water system operates when the reactor is in operation, and is continuously monitored for satisfactory performance which indicates the integrity and capability of the system.

Indian Point 3 has a program for periodic inspection of pipe welds and components for leakage. The program has been reviewed (April 1-3, 1980) and audited by NRC and subsequently revised to incorporate NRC's recommendations and comments.

Testing of Cooling Water System (Criterion 46)

Criterion: The cooling water system shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leaktight integrity of its components, (2) the operability and the performance of the active components of the system, and (3) the operability of the system as a whole and, under conditions as close to design as practical, the performance of the full operational sequence that brings the system into operation for reactor shutdown and for loss-of-coolant accidents, including operation of applicable portions of the protection system and the transfer between normal and emergency power sources.

The active components of the Auxiliary Coolant System are in either continuous or intermittent use during normal plant operation. Their satisfactory functional performance is thus assured. (Section 9.3)

The residual heat removal loop is used to remove residual and sensible heat from reactor coolant during normal shutdown. Provisions for periodic hydrostatic testing to applicable code test pressure were included in the design.

A comprehensive program of plant testing has been formulated and implemented for all equipment, systems and system control vital to the functioning of engineered safety features. The program consists of performance tests of individual pieces of equipment in the manufacturer's shop, integrated tests of the system as a whole, and periodic tests of the actuation circuitry and mechanical components to assure reliable performance upon demand throughout the plant lifetime.

The initial tests of individual components and the integrated tests of the system as a whole complement each other to assure performance of the system as designed and to ensure proper operation of the actuation circuitry. (Section 6.1.1)

The external recirculation flow paths are hydrotested during periodic retests at the operating pressure. This is accomplished by running each pump which could be utilized during external recirculation (safety injection and residual heat removal pumps) in turn at near shutoff head conditions and checking the discharge and recirculation test lines. The suction 74 of 119 IPEC00034674 IPEC00034674

IP3 FSAR UPDATE lines are tested by running the residual heat removal pumps and opening the flow path to the safety injection pumps in the same manner as described above.

During the above test, all system jOints, valve packing, pump seals, leakoff connections or other potential points of leakage are visually examined. Valve gland packing, pump seals, and flanges are adjusted or replaced as required to reduce the leakage to acceptable proportions. For power operated valves, final packing adjustments are made, and the valves are put through an operating cycle before a final leakage examination is made.

During the above test, all system jOints, valve packing, pump seals, leakoff connections or other potential points of leakage are visually examined. Valve gland packing, pump seals, and flanges are adjusted or replaced as required to reduce the leakage to acceptable proportions. For power operated valves, final packing adjustments are made, and the valves are put through an operating cycle before a final leakage examination is made.

The entire recirculation loop except the recirculation line to the residual heat removal pumps is pressurized during periodic testing of the engineered safety feature components. The recirculation line to the residual heat removal pump is capable of being hydrotested during plant shutdown and it is also tested at the time of periodic retests of the Containment.

(Section 6.7.2.5) 1.3.5 Reactor Containment (Criteria 50 to 57)

Containment Design Basis (Criterion 50)

Criterion: The reactor containment structure, including access openings, penetrations, and the containment heat removal system shall be designed so that the containment structure and its internal compartments can accommodate, without exceeding the design leakage rate and with sufficient margin, the calculated pressure and temperature conditions resulting from any loss-of coolant accident. This margin shall reflect consideration of (1) the effects of potential energy sources that have not been included in the determination of the peak conditions, such as energy in steam generators and, as required by 50.44, energy from metal, water and other chemical reactions that may result from degradation, but not total failure, of emergency core cooling functioning; (2) the limited experience and experimental data available for defining accident phenomena and containment responses; and (3) the conservatism of the calculational model and input parameters.

The containment structure and all penetrations were designed to withstand, within design limits, the combined loadings of the design basis accident and design seismic conditions.

All piping systems which penetrate the vapor barrier are anchored at the liner. The penetrations for the main steam, feedwater, blowdown and sample lines were designed so that the penetration is stronger than the piping system and that the vapor barrier is not breeched due to a hypothesized pipe rupture combined, for the case of the steam line, with the coincident internal pressure. The pipe capacity in flexure was assumed to be limited to the plastic moment capacity based upon the ultimate strength of the pipe material. All lines with the exception of small bore line, 2" and smaller connected to the primary coolant 75 of 119 IPEC00034675 IPEC00034675

IP3 FSAR UPDATE system that penetrate the vapor barrier are also anchored in the secondary shield walls (i.e.,

walls surrounding the steam generators and reactor coolant pumps) and are provided with at least one valve between the anchor and the Reactor Coolant System. These anchors were designed to withstand the thrust, moment and torque resulting from a hypothesized rupture of the attached pipe.

All isolation valves are supported to withstand, without impairment of valve operability, the combined loading of the design basis accident and design basis seismic conditions.

Appendix 4B includes the details of the design of primary system supports. In addition, the design pressure will not be exceeded during any subsequent long-term pressure transient determined by the combined effects of heat sources, such as residual heat and limited metal-water reactions (as required by 10 CFR 50.44), structural heat sinks and the operation of the engineered safeguards, the latter utilizing only the emergency electric power supply.

(Section 5.1)

The following general criteria were followed to assure conservatism in computing the required structural load capacity:

a) In calculating the containment pressure, rupture sizes up to and including a double-ended severance of reactor coolant pipe were considered. In considering post-accident pressure effects, various malfunctions of the emergency systems were evaluated. Contingent mechanical or electrical failures were assumed to disable the most limiting of the diesel generators, thus disabling one or two of the five fan-cooler units and one of the two containment spray units. Equipment which can be run from diesel power is described in Chapter 8.

b) The pressure and temperature loadings obtained by analyzing various Loss-of-Coolant Accidents, when combined with operating loads and maximum wind or seismic forces, do not exceed the load-carrying capacity of the structure, its access opening or penetrations.

The most stringent case of these analyses is summarized below:

Discharge of reactor coolant through a double-ended rupture of the main loop piPing, followed by operation of only those engineered safety features which can run simultaneously with power from two of the three onsite diesel generators (the equipment configuration varies with the presumed failed generator regardless of which generator fails, safety requirements are met), results in a sufficiently low radioactive materials leakage from the containment structure that there is no undue risk to the health and safety of the public.

The selection and use of containment materials comply with the applicable codes and standards tabulated in Section 5.1.1.

The concrete containment is not susceptible to a low temperature brittle fracture.

Systems relied upon to operate under post-accident conditions, which are located external 76 of 119 IPEC00034676 IPEC00034676

IP3 FSAR UPDATE to the Containment and communicate directly with the Containment, are considered to be extensions of the leakage boundary.

The pressure retaining components of the containment structure were designed for the maximum potential earthquake ground motion at the site combined with the simultaneous loads of the design basis accident as follows:

1) The liner was designed to ensure that no average strains greater than the strain at the guaranteed yield point occur at the factored loads

2) The mild steel reinforcement was generally designed to ensure that no strains greater than the strain at the guaranteed yield point occur at a cross section under the factored loads.

The pressure retaining components of the Containment subject to deterioration or corrosion in service are provided with appropriate protective means or devices (e.g., protective coatings).

The containment structure was designed to safely withstand several conditions of loading and their credible combinations. The limiting extreme conditions are:

a) Occurrence of gross failure of the Reactor Coolant System which creates a high pressure and temperature condition within the Containment.

b) Coincident failure of the Reactor Coolant System with an earthquake or wind.

The design pressure and temperature of the Containment is equal to the peak pressure and temperature occurring as the result of the complete blowdown of the reactor coolant through any rupture of the Reactor Coolant System up to and including the hypothetical severance of a reactor coolant pipe. Energy contribution from the steam system was included in the calculation of the containment pressure transient due to reverse heat transfer through the steam generator tubes. The supports for the Reactor Coolant System were designed to withstand the blowdown forces associated with the sudden severance of the reactor coolant piping so that the coincidental rupture of the secondary side steam system is not considered credible.

The design pressure and temperature on the containment structure are those created by the hypothetical Loss-of-Coolant Accident. The Reactor Coolant System contains approximately 512,000 Ibs of coolant at a weight average enthalpy of 595 Btu/lb for a total energy of 304,000,000 Btu. In a hypothetical accident, this water is released through a double-ended break in the largest reactor coolant pipe, causing a rapid pressure rise in the Containment. The reactor coolant pipe used in the accident is the 29-in. ID section, because rupture of the 31-in ID section requires that the blowdown go through both the 29-in and the 27.5-in ID pipes and would, therefore, result in a less severe transient.

Additional energy release was considered from the following sources:

a) Stored heat in the reactor core 77 of 119 IPEC00034677 IPEC00034677

IP3 FSAR UPDATE b) Stored heat in the reactor vessel piping and other reactor coolant system components c) Residual heat production d) Limited metal-water reaction energy and resulting hydrogen-oxygen reaction energy The following loadings were considered in the design of the Containment in addition to the pressure and temperature conditions described above:

a) Structure dead load b) Live loads c) Equipment loads d) Internal test pressure e) Earthquake f) Wind (Tornado)

Internal structures consist of equipment supports, shielding, reactor cavity, and canal for fuel transfer, and miscellaneous concrete and steel for floors and stairs. All internal structures are supported on the containment mat.

The refueling canal connects the reactor cavity with the fuel transport tube to the spent fuel pool. The floor and walls of the canal are concrete. The concrete walls and floor are lined with O.25-inch thick stainless steel plate. The linings provide a leakproof membrane that is resistant to abrasion and damage during fuel handling operations. (Appendix 5A)

Fracture Prevention of Containment Pressure Boundary (Criterion 51)

Criterion: The reactor containment boundary shall be designed with sufficient margin to assure that under operating, maintenance, testing and postulated accident conditions (1) its ferritic materials behave in a non-brittle manner and (2) the probability of rapidly propagating fracture is minimized. The design shall reflect consideration of service temperatures and other conditions of the containment boundary material during operation, maintenance, testing, and postulated accident conditions, and the uncertainties in determining (1) material properties, (2) residual steady-state, and transient stresses, and (3) size of flaws.

The selection and use of containment materials comply with the applicable codes and standards tabulated in Section 5.1.1.

78 of 119 IPEC00034678 IPEC00034678

IP3 FSAR UPDATE The concrete containment is not susceptible to a low temperature brittle fracture.

Acceptance criteria for containment pressure boundary material used considered examination for inclusion content and consideration of the effect of inherent flaws on mechanical properties.

The containment liner is enclosed with the Containment and thus is not exposed to the temperature extremes of the environs. The containment ambient temperature during operation is between 50 and 1300 F. This includes both hot operating and cold shutdown conditions. The minimum service metal temperature of the containment liner is well above the NDT temperature +300 F for the liner material. The equipment hatch, penetration sleeves and personnel lock meet the Charpy V-notch impact valves for a minimum of 15 ft-Ibs at -50 0 F.

The pressure retaining components of the containment structure were designed for the maximum potential earthquake ground motion of the site combined with the simultaneous loads of the design basis accident as follows:

1) The liner was designed to ensure that no average strains greater than the strains at the guaranteed yield point occur at the factored loads

2) The mild steel reinforcement was generally designed to ensure that no strains greater than the strain at the guaranteed yield point occur at a cross section under the factored loads.

The pressure retaining components of the Containment subject to deterioration or corrosion in service are provided with appropriate protective means or devices (e.g., protective coatings).

The plate steel liner is carbon steel conforming to ASTM Designation A442-65 "Standard Specification for Carbon Steel Plates with Improved Transition Properties," Grade 60. This steel has a minimum yield strength of 32,000 psi and minimum tensile strength of 60,000 psi with an elongation of 22 percent in an 8-inch gauge length at failure.

The liner is 0.25-inch thick at the bottom, 0.5-inch thick in the first three courses and 0.375-inch thick for the remaining portion of cylindrical walls except that it is 0.75-inch thick at penetrations and 0.5-inch thick in the dome. The liner material has been tested to assure an NDT temperature more than 30F lower than the minimum operating temperature of the liner material.

Impact testing has been done in accordance with Section N331 of Section III of the ASME Boiler and Pressure Vessel Code. A 100 percent visual inspection of the liner anchors was made prior to pouring concrete.

The structural design of the containment structure was based upon limiting load factors which are used as the ratio by which loads will be multiplied for design purposes to assure that the loading deformation behavior of the structure is one of elastic, tolerable strain behavior. The load factor approach was used in this design as a means of making a rational 79 of 119 IPEC00034679 IPEC00034679

IP3 FSAR UPDATE evaluation of the isolated factors which must be considered in assuring an adequate safety margin for the structure. This approach permitted the designer to place the greatest conservatism on those loads most subject to variation and which most directly control the overall safety of the structure. In the case of the containment structure, this approach placed minimum emphasis on the fixed gravity loads and maximum emphasis on accident and earthquake or wind loads. The loads utilized to determine the required limiting capacity of any structural element on the containment structure are presented in Appendix 5A.

The load factors utilized were based upon the load factor concept employed in Part IV-B, "Structural Analysis and Proportioning of Members Strength Design" of ACI 318-63.

Because of the refinement of the analysis and the restrictions on construction procedures, the load factors in the design primarily provide for a safety margin on the load assumptions.

Specific combined load equations used in design are presented in Appendix 5A.

All structural components were designed to have a capacity required by the most severe loading combination.

The design included consideration of both primary and secondary stresses. The load capacity in structural members was based on the ultimate strength values presented in Part IV-B of ACI-318 as reduced by the capacity reduction factor u¢/' which provides for the possibility that small adverse variations in material strengths, workmanship, dimensions, and control, while individually within required tolerances and the limits of good practice, occasionally may combine to result in undercapacity.

For the liner steel the factor urI/' is 0.95 for tension. For compression and shear, the primary membrane liner stress was maintained below 0.95 yield and elastic stability has been assured as a function of liner anchorage requirements.

The liner was designed to assure that no strains greater than the strain at the guaranteed yield point will occur at the factored loads except in regions of local stress concentrations or stresses due to secondary load effects in which case the liner strain is limited to 0.5 percent.

Sufficient anchorage is provided to assure elastic stability of the liner. The basic design concept utilizing stud anchorage of the liner plate to the concrete structure assures stud failure due to shear, tension or bending stress without the stud connection causing failure or tear of the liner plate. The studs in the 0.5-inch plate were installed on a 24" horizontal and 28" vertical grid and, in the 0.375 inch plate, on a 24" horizontal and 14" vertical grid. The design considered the possibility of daily stress reversals due to ambient temperature changes for the life of the plant and the fatigue limit of the studs exceeds the design requirements. (Section 5.1.2)

Service temperatures during operation, maintenance and testing are less severe than those accompanying the containment design basis conditions and therefore will not induce brittle fracture of the containment liner.

Capability for Containment Leakage Rate Testing (Criterion 52) 80 of 119 IPEC00034680 IPEC00034680

IP3 FSAR UPDATE Criterion: The reactor containment and other equipment which may be subjected to containment test conditions shall be designed so that periodic integrated leakage rate testing can be conducted at containment design pressure.

After completion of the containment structure and installation of all penetrations and weld channels, integrated leakage rate tests were performed prior to initial plant operations at a reduced test pressure and at the calculated peak accident pressure to establish the respective measured leakage rates and to verify that the leakage rate at the peak accident conditions was no greater than 0.075 percent by weight per day of the containment steam-air atmosphere at the calculated peak accident conditions. Leak rate testing of the containment is performed in accordance with Technical Specification 5.5.15. The leakage rate program is in accordance with the guidance contained in Regulatory Guide 1.163, except as noted in the Technical Specifications.

The peak accident pressure integrated leakage rate test is conducted at periodic intervals during the life of the plant, and also as appropriate in the event of major maintenance or major plant modifications. A leak rate test at the peak accident pressure using the same test method as the initial leak rate test can be performed at any time during the operational life of the plant, provided the plant is not in operation and precautions are taken to protect instruments and equipment from damage. (Section 5.1.7)

Penetrations were designed with double seals, which are continuously pressurized above accident pressure. The large access openings, such as the Equipment Hatch and Personnel Air Locks, are equipped with double gasketed doors and flanges with the space between the gaskets connected to the pressurization system. The system utilizes a supply of clean, dry compressed air, which places the penetrations under an internal pressure above the peak calculated accident pressure.

A permanently piped monitoring system continuously measures leakage from all penetrations.

Leakage from the monitoring system is checked by continuous measurement of the integrated makeup air flow. In the event excessive leakage is discovered, each penetration can then be checked separately at any time.

Capability is provided to the extent practical for testing the functional operability of valves and associated apparatus during periods of reactor shutdown.

Initiation of containment isolation employs coincidence circuits which allow checking of the operability and calibration of one channel at a time.

Provisions for Containment Testing and Inspection (Criterion 53)

Criterion: The reactor containment shall be designed to permit (1) appropriate periodic inspection of all important areas, such as penetrations, (2) an appropriate surveillance program, and (3) periodic testing at containment design pressure of the leaktightness of penetrations which have resilient seals and expansion bellows.

81 of 119 IPEC00034681 IPEC00034681

IP3 FSAR UPDATE Penetrations were designed with double seals which are continuously pressurized above accident pressure. The large access openings, such as the Equipment Hatch and Personnel Air Locks, are equipped with double gasketed doors and flanges with the space between the gaskets connected to the pressurization system. The system utilizes a supply of clean, dry compressed air which will place the penetrations under an internal pressure above the peak calculated accident pressure.

A permanently piped monitoring system is provided to continuously measure leakage from all penetrations.

Leakage from the monitoring system is checked by continuous measurement of the integrated makeup air flow. In the event excessive leakage is discovered, each penetration can then be checked separately (Section 5.1.7).

The containment is completely closed whenever the primary system temperature is above 200 F, except as required for brief periods necessary to relieve the Containment to keep the pressure below a reasonable level (1- 2 psig) or to purge containment in preparation for containment entry.

Limited access to the Containment through Personnel Air Locks is possible with the reactor at power or with the primary system at design pressure and temperature at hot shutdown for special maintenance on periodic inspections. Access at power is normally restricted to the areas external to the reactor equipment compartment primarily for inspection and maintenance of the air recirculation equipment, incore instrumentation chamber drives, and instrumentation calibration.

The primary reactor shield was designed so that access to the primary equipment is limited by the activity of the primary system equipment and not the reactor. (Section 5.1.4)

All penetrations, the Personnel Air Lock and the Equipment Hatch were designed with double seals, which are normally pressurized at a minimum pressure greater than the calculated peak accident pressure. Individual testing at 115% of containment design pressure is also possible.

The containment ventilation purge ducts are equipped with double isolation valves and the space between the valves is permanently piped up to the penetration pressurization system.

The space can be pressurized to above accident pressure when the isolation valves are closed. The purge valves fail in the closed position upon loss of power (electric or air).

All welded joints in the liner have steel channels welded over them on the inside of the vessel. During construction, the channel welds were tested by means of pressurizing sections with Freon gas and locating leaks with a Freon sniffer. Most liner welds are also continuously pressurized during power operation at a minimum pressure greater than the calculated peak accident pressure. Liner welds that are not pressurized during power operation are those welds associated with disconnected sections of the Weld Channel Pressurization System. The integrity of the welds associated with any disconnected portions of the Weld Channel Pressurization System is verified by integrated leak rate testing.

82 of 119 IPEC00034682 IPEC00034682

IP3 FSAR UPDATE A proof test was applied to each penetration by pressurizing the necessary areas to 54 psig.

This pressure was maintained for a sufficient time to allow soap bubble and Freon sniff tests of all welds and mating surfaces. Any leaks found were repaired and retested; this procedure was repeated until no leak existed.

After it was assured that there were no defects remaining from construction, a sensitive leak rate test was conducted. The sensitive leak rate test included only the volume of the weld channels and double penetrations. This test was more sensitive than the integrated leakage rate test, as the instrumentation used permits a direct measurement of leakage from the pressurized zones. The sensitive leak rate test was conducted with the penetrations and weld channels at a pressure greater than the calculated peak accident pressure with the Containment Building at atmospheric pressure. The leak rate for the double penetrations and weld channel zones was equal to or less than 0.2% of the containment free volume per day.

The double penetrations and most weld seam channels installed on the inside of the liner in the Containment are continuously pressurized to provide a continuous, sensitive and accurate means of monitoring their status with respect to leakage.

Periodic peak pressure containment integrated leakage rate tests are performed in accordance with the Technical Specifications. Peak pressure tests are conducted as appropriate in the event of major maintenance plant modifications.

The Containment Penetration and Weld Channel Pressurization System components located outside the Containment can be visually inspected at any time. Components inside the Containment are inspected during shutdown. All pressurized zones have provisions for either local pressure indication outside the containment or remote low pressure alarms in the Control Room. (Section 6.6.5)

No special testing of system operation or components is necessary to assure that the penetrations and liner weld channels are pressurized above containment calculated peak accident response pressure since the system is in continuous operation during all reactor operations.

Should one zone indicate a leak during operation, the specific penetration or weld channel containing the leak is identified by isolating the individual air supply line to each component in the zone and injecting leak test gas through a capped tube connection installed in each line.

Total leakage from penetrations and weld channels is measured by summing the recorded flows in each of the four pressurization zones. A leak would be expected to build up slowly and would be detected before leakage limits are exceeded. Remedial action is then taken before the limit is reached.

To provide for testing the larger penetrations, branch pressurizing lines are installed from one of the zones to:

a) The double-gasketed space on each hatch of the Personnel Air Lock 83 of 119 IPEC00034683 IPEC00034683

IP3 FSAR UPDATE b) The double-gasketed space at the Equipment Hatch Flange c) The pressurized zones in the spent fuel transfer tube d) The spaces between the two butterfly valves in the purge supply and exhaust ducts e) The two spaces between the three butterfly valves in the containment pressure relief line f) The spaces between double containment isolation valves in the steam jet air ejector return line to containment and in the containment radiation monitor inlet outlet lines The makeup air flow to the penetrations and liner weld joint channels during normal operation is only an indication of the potential leakage from the containment. It does indicate the leakage from the pressurization system, and degree of accuracy is increased when correlated with the results of the full scale containment leak rate tests. The criteria for selection of operating limits for air consumption of the pressurization system are based upon the integrated containment leak rate test acceptance criterion and upon the maintenance of suitable reserve air supplies in the static reserves consisting of the air receivers and nitrogen cylinders. A summary of these operating limits is as follows:

1) A baseline air consumption rate was established for each of the four pressurization headers at the time of successful completion of the preoperational integrated containment leak rate tests. Unexplained increases from the consumption rate require routine investigation and location of the point of leakage.

2) The upper limit for long-term air consumption for the pressurization system is 0.2% of the containment volume per day (sum of four headers) at the system operating pressure, contingent on the following:

a) Pressure in all pressurization zones is maintained above incident pressure b) Air supply is maintained from the compressed air systems with compressors running c) The full complement of air receivers (4) and standby nitrogen cylinders (3) are charged. This is consistent with maintenance of a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> supply.

A variable area flow sensing device is located in each of the headers supplying makeup air to the four pressurization zones. Signal output from each of the four flow sensors is applied to an integrating recorder located in the control room. High flow alarms are available to alert the operator in the control room. The sensitivity of the flowmeters is well within the 84 of 119 IPEC00034684 IPEC00034684

IP3 FSAR UPDATE maximum leakage of the pressurization system.

Piping Systems Penetrating Containment (Criterion 54)

Criterion: Piping systems penetrating primary reactor containment shall be provided with leak detection, isolation, and containment capabilities having redundancy, reliability, and performance capabilities which reflect the importance to safety of isolating these piping systems.

Such piping systems shall be designed with a capability to test periodically the operability of the isolation valves and associated apparatus and to determine if valve leakage is within acceptable limits.

Piping systems which penetrate the Reactor Containment have isolation capabilities commensurate with the systems' design in accomplishing safety related functions or providing isolation of the containment from the outside environment under postulated accident conditions.

Piping penetrating the Containment was designed for pressures at least equal to the containment design pressure and, as a minimum, those portions of piping systems which are essential to the isolation function are capable of withstanding the maximum potential seismic loads.

For those systems which require isolation, redundant barriers are utilized to ensure that the failure of one valve to close will not prevent isolation of the penetration. The containment isolation provisions are discussed in detail in Section 5.2.

Isolation valves which are located in lines connecting to the Reactor Coolant System or which could be exposed to the containment atmosphere under postulated accident conditions are sealed by an Isolation Valve Seal Water System which injects water or gas at a pressure slightly higher than the containment design pressure between the isolation barriers. Containment penetrations and welds are sealed by the Containment Penetration and Weld Channel Pressurization System. In addition to providing seals on penetration isolation barriers, these systems may be utilized for leakage detection. The design and operation of the seal system are described in Sections 6.5 and 6.6. Additional leakage detection provisions are discussed in Section 6.7.

Leakage rate testing of the containment is performed in accordance with Technical Specification 5.5.15. The leakage rate program is in accordance with the guidance contained in Regulatory Guide 1.163, except as noted in the Technical Specifications.

Provisions for leakage testing are discussed in Section 5.1.7 and 5.2.

Reactor Coolant Pressure Boundary Penetrating Containment (Criterion 55)

Criterion: Each line that is part of the reactor coolant pressure boundary and that penetrates primary reactor containment shall be provided with containment isolation valves as follows, unless it can be demonstrated that the containment 85 of 119 IPEC00034685 IPEC00034685

IP3 FSAR UPDATE isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other defined basis:

1) One locked closed isolation valve inside and one locked closed isolation valve outside containment; or

2) One automatic isolation valve inside and one locked closed isolation valve outside containment; or

3) One locked closed isolation valve inside and one automatic isolation valve outside of containment. A simple check valve may not be used as the automatic isolation valve outside containment; or

4) One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment.

Isolation valves outside containment shall be located as close to containment as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety.

Other appropriate requirements to minimize the probability or consequences of an accidental rupture of these lines connected to them shall be provided as necessary to assure adequate safety. Determination of the appropriateness of these requirements, such as higher quality in design, fabrication, and testing, additional provisions for in-service inspection, protection against more severe natural phenomena, and additional isolation valves and containment, shall include consideration of the population density, use characteristics, and physical characteristics of the site environs.

Lines which penetrate the Containment and connect to the Reactor Coolant Pressure Boundary were designed with isolation capabilities sufficient to preclude the release of significant amounts of radioactivity. The containment isolation provisions of each line are consistent with the function of the line during normal operation and safety function of the line during and after the Design Basis Accident.

Effluent lines, except the residual heat removal cooldown line, which connect to the Reactor-Coolant Pressure Boundary and which are normally or intermittently open during reactor operation, but which are not required for safe shutdown, are provided with at least two automatic isolation or two closed manual isolation valves in series located outside of containment. Automatic seal water injection is provided for these valves, as described in Sections 5.2.2. and 6.5.2.

A single, normally closed, manually operated, double disc gate valve is provided on the residual heat removal cooldown line outside of containment for isolation purposes. Because of pressure considerations described in Section 5.2.2, the valve can be sealed between the discs by nitrogen from the Isolation Valve Seal Water System. The seal is manually initiated, as required.

86 of 119 IPEC00034686 IPEC00034686

IP3 FSAR UPDATE Effluent and influent lines connected to the Reactor Coolant Pressure Boundary which are part of systems with essential safety functions and, therefore, must function during or after the Design Basis Accident are provided with containment isolation capabilities commensurate with the required function of the system which the line serves.

Lines in the above category, which are connected to closed systems outside of containment, utilize a single remote manually motor operated double disc gate valve outside of containment as the first isolation barrier. The closed system functions as the second barrier.

Manually initiated sealing systems are available to pressurize between the discs of the gate valve after use of the penetration is terminated post accident.

Lines associated with the Residual Heat Removal System which do not terminate in a closed system were designed with isolation provisions which reflect the required function of the line. (Section 5.2)

The residual heat removal return line isolation provisions consist of a check valve inside containment and outside of the missile barrier as the inboard isolation barrier and a normally open, remote manual motor operated double disc gate valve located outside of containment as the outboard isolation barrier. A manually initiated nitrogen seal is available to the outboard valve.

Two normally closed isolation gate valves in series are provided outside of containment for the recirculation pump discharge sample line. The lines between the isolation valve may be sealed by manually initiating a nitrogen seal from the Isolation Valve Seal Water System, as described in Section 5.2.2.

Since the minimum flow line for the residual heat removal pumps must be open upon pump start, two normally open motor operated valves are provided for containment isolation.

During the accident, system pressure is adequate to preclude leakage from the Containment. If these valves are shut post-accident, an additional leakage barrier is provided by manually injecting nitrogen between the globe valves.

Motor operated isolation valves were provided for the changing water line with a manual type bypass isolation valve. As shown in Plant Drawing 9321-F-27363 [Formerly Figure 5.2-3], each of the three containment isolation valves are located outside of containment. The inboard and outboard isolation valves in the charging header are normally open to avoid compromising the system function. The control valve bypass is not normally on line and is, therefore, normally shut. If it is necessary to isolate this line post-accident, seal water will be manually initiated to pressurize the line volume between the inboard and outboard isolation valves. Additional protection against reactor coolant leakage from the charging line is provided by a closed system outside of containment, the Chemical and Volume Control System.

The safety injection header is valved in accordance with safeguards requirements. The header bypassing the Boron Injection Tank is provided with either a normally open motor operated double disc gate valve or two normally open motor operated gate valves arranged in series. The header including the Boron Injection Tank has single, normally open, motor 87 of 119 IPEC00034687 IPEC00034687

IP3 FSAR UPDATE operated double disc gate isolation valves. After termination of safety injection, these valves can be manually or remote manually, as applicable, shut, and a nitrogen seal between the discs of each valve can be manually initiated.

Branch lines from the safety injection header which could communicate with the Reactor Coolant Pressure Boundary and which are not required for the safety function are provided with two normally shut isolation valves in series with automatic seal water injection between the valves. Each of the isolation valves is located outside of primary containment, as shown in Plant Drawings 9321-F-27353 and -27503 [Figure 5.2-7].

Each containment penetration is designed as an extension of containment and is seismic Class I and missile protected from the penetration or, if located inside containment, from the inboard isolation barrier to and including the outboard barrier. If automatic or remotely operable isolation valves are provided, the valve was designed to fail in the most safe position as delineated by Table 5.2-3.

Primary Containment Isolation (Criterion 56)

Criterion: Each line that connects directly to the containment atmosphere and penetrates primary reactor containment shall be provided with containment isolation valves as follows, unless it can be demonstrated that the containment isolation provision for a specific class of lines, such as instrument lines, are acceptable on some other defined basis:

1) One locked closed isolation valve inside and one locked closed isolation valve outside containment; or

2) One automatic isolation valve inside and one locked closed isolation valve outside containment; or

3) One locked closed isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment; or

4) One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment.

Isolation valves outside containment shall be located as close to the containment as practical and upon loss of actuating power, automatic isolation valves shall be designed to take the position that provides greater safety.

Except for the lines or class of lines addressed in subsequent paragraphs, lines penetrating containment, which are not connected to the Reactor Coolant Pressure Boundary and which are not missile protected or which can otherwise communicate with the containment atmosphere following an accident, are provided with a minimum of two isolation valves in series located outside of containment and are provided with automatic seal water injection.

Lines which are normally open during reactor operation are provided with automatic isolation 88 of 119 IPEC00034688 IPEC00034688

IP3 FSAR UPDATE valves. Lines which are closed during reactor operation are provided with locked closed or administratively controlled closed manual isolation valves. Isolation provisions for these lines are described in detail in Section 5.2.2., Table 5.2.3 and Plant Drawings 9321-F-27473, -27203, -27353, -27453, -27503, -27513 Sh. 1, -27363, -27193, -27233, -27473, -

20253, -27263, -70453, -20173, -20193, -27293 Sh. 1 & 2, -27223, -20353, -40223, -26533,

-20363, -26533, and -27243 [Formerly Figures 5.2-1 through 5.2-28], as applicable.

Due to operations and safeguard considerations, there are several lines penetrating containment which, although equivalent in safety, differ from those described above.

The reactor coolant pump seal water supply lines have normally open motor operated isolation valves in series, located outside of containment. As these lines terminate in the Chemical and Volume Control System, a closed system outside primary containment provides a normal and post accident leakage barrier. Post-accident, when coolant pumps are no longer running, these valves are shut and seal water can be initiated to pressurize the line volume between isolation valves and stem packings on the valves closest to containment above post-accident containment pressure. This arrangement is shown in Plant Drawing 9321-F-27363 [Formerly Figure 5.2-4].

The fuel transfer tube penetration inside the Containment was designed to present a missile protected and pressurized double barrier between the containment atmosphere and the atmosphere outside the containment. A positive pressure is maintained between the double gaskets to complete the double barrier between the containment atmosphere and the inside of the fuel transfer tube.

Containment spray headers, because of safeguard considerations, are each provided with a locked open manual double disc gate valve as the inboard isolation valve and a check valve as an outboard isolation valve. The test lines connect between the header isolation and are, therefore, provided with locked closed manual isolation valves. Each isolation valve is located outside of containment, as shown in Plant Drawing 9321-F-27353, and -27503

[Formerly Figure 5.2-6]. After termination of containment spray or in the event of a leak, the inboard isolation valves may be shut and seal water manually initiated between the discs.

The nitrogen supply lines to the Reactor Coolant Drain Tank has a similar arrangement for containment isolation, except that the inboard isolation valve is an air diaphragm valve and no seal injection is available. (Plant Drawings 9321-F-27193 and -27473 [Formerly Figure 5.2-9])

Isolation provIsions for the reactor coolant pump cooling water lines, shown in Plant Drawings 9321-F-27203 and -27513 [Formerly Figure 5.2-10] include two motor operated gate valves in series outside of containment which automatically close on a Phase B containment isolation signal. Prior to the valve closure, leakage control is provided by the Component Cooling Water Loop, which is a closed system inside containment on the basis of leak before break criteria. Provisions have been made for manually initiating seal water injection into the line volume between the isolation valves, after valve closure.

Isolation provisions for the recirculation pump discharge sample line include two normally closed gate valves in series located outside of containment. Since leakage through the 89 of 119 IPEC00034689 IPEC00034689

IP3 FSAR UPDATE inboard valve would be at a higher pressure than that of the available seal water, a seal between the valves is provided by manually initiating nitrogen injection form the isolation valve seal water system.

Plant Drawing 9321-F-27503 [Formerly Figure 5.2-21] shows the arrangement of the containment pressure instrumentation lines. These instruments are essential of safe shutdown and the isolation provisions, therefore, consist of a single, locked open, manual globe valve installed in each sensing line.

Post-accident containment sampling lines for the hydrogen monitoring system utilize normally closed, fail closed solenoid operated valves for containment isolation. Each sample supply line and return line has an installed valve serving as an inboard isolation barrier. The outboard isolation barrier is provided by a single valve installed in the supply header and a return valve in the return header.

(Plant Drawing 9321-F-26533 [Formerly Figure 5.2-22]). Since these lines are specifically designed for use in a post-accident condition, all isolation valves are located outside of containment and no sealing connection is required. However, as an additional measure of isolation capability, the space between the inboard and the outboard isolation valves in both supply and return headers for each two containment hydrogen monitors can be pressurized from the weld channel system by two parallel normally open, fail shut solenoid operated valves for each line. During testing of system operation the weld channel valves are manually isolated. An automatic Containment Phase A Isolation signal is provided but is not required since the system is essential for post-accident operation. Capability to close these CIVs is assured during a single failure of the Containment Phase A Isolation signal by using the control room switches.

Lines associated with post-accident containment atmosphere control, except the venting supply line, are provided with automatic outboard isolation valves and manual, normally closed, inboard isolation valves. The inboard isolation valve for venting supply line is a check valve. No seal injection is required and all valves are located of outside containment since the system must operate post accident.

Containment leakage test penetrations are used only when the reactor is shut down.

Therefore, no valving is required. The penetrations were provided with flanges or a cap on the inside of containment and the outside of containment to meet dual barrier criteria. Upon a containment isolation signal, each of the subject lines is automatically pressurized with air at a pressure greater than the containment pressure.

The equipment access closure is a bolted, gasket closure, which is sealed during reactor operation. The Personnel Air Locks consist of two doors in series with mechanical interlocks to assure that one door is closed at all times. Each air lock door and the equipment closure are provided with double gaskets to permit pressurization between the gaskets by the Penetration and Weld Channel Pressurization System. (Section 6.6)

Each containment penetration was designed as an extension of containment and is seismic Class I and missile protected from the penetration or, if located inside containment, from the inboard isolation barrier to and including the outboard barrier. If automatic or remotely 90 of 119 IPEC00034690 IPEC00034690

IP3 FSAR UPDATE operable isolation valves are provided, the valve is designed to fail in the most safe position, as delineated by Table 5.2-1.

Closed System Isolation Valves (Criterion 57)

Criterion: Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least one containment isolation valve which shall be either automatic, or locked closed, or capable of remote manual operation.

This valve shall be outside containment and located as close to the containment as practical. A simple check valve may not be used as the automatic isolation valve.

Closed systems within containment not connected to the Reactor Coolant Pressure Boundary include the Steam Generator, Auxiliary Coolant System, Component Cooling Water, Service Water to the Containment Fan Coolers and Motor Coolers, and the Weld Channel Pressurization Air Supply. Each closed system within the Containment is missile protected, as described in Section 5.2.2, and is seismic Class I at least up to and including the isolation valves.

Main steam lines from the steam generators and feedwater lines to the steam generators were designed in accordance with the desirability to maintain the function of the steam generators to transfer heat from the Reactor Coolant System during postulated transients and accidents. Therefore, these lines and the penetrations are designed to permit flow under conditions other than a steam line break. A discussion of the steam and feedwater systems is given in Section 10.2. The associated containment penetrations are illustrated in Plant Drawings 9321-F-20173, -20193, -27293, and -27293 [Formerly Figure 5.2-15] and described by Table 5.2-3.

Component cooling water lines to the residual heat exchangers are required to function post LOCA. Isolation of the inlet lines is accomplished by the installation of single check valve in each inlet line, located just outside of containment. A motor operated gate valve is located just outside of containment in each residual heat exchanger component cooling water return line. During normal operation, the return isolation valves remain closed. Upon the occurrence of a LOCA, the motor operated valves are automatically opened by a safety injector signal. In the unlikely event of a leak, the isolation valves may be remote manually closed to isolate the affected residual heat exchanger. The penetration arrangement for the component cooling water lines to the residual heat exchangers is shown in Plant Drawings 9321-F-27203, and -27513 [Formerly Figure 5.2-11].

Closed systems within the Containment which are required to function during normal operation and during and after the LOCA are provided with a single, normally open, manual isolation valve located outside of containment on each supply and return line. The systems utilizing this arrangement include:

1) Component Cooling Water for Recirculation Pumps (Plant Drawing 9321-F-27203, and -27513 [Formerly Figure 5.2-12])

91 of 119 IPEC00034691 IPEC00034691

IP3 FSAR UPDATE

2) Ventilation Cooling Water for the Containment Fan Coolers and Motor Coolers (Plant Drawing 9321-F-27223 [Formerly Figure 5.2-16])

3) Weld Channel Pressurization Air Supply (Plant Drawings 9321-F-20353, and

-27263 [Formerly Figure 5.2-17])

Additional protection is afforded for penetrations associated with Component Cooling Water, ventilation cooling water and Weld Channel Pressurization Air Supply Systems because these systems operate at pressures higher than the peak containment pressure and have makeup sources available. The ventilation cooling water and Weld Channel Pressurization Air Supply Systems are also Closed systems outside of containment. Additional information for isolation provisions of closed systems is within Section 5.2.

The OEH provides two operating conditions during outage:

1. Standby condition which allows the passage of equipment and personnel through the opening.

2. Closed condition capable of retaining air pressure within Containment Building.

The following design loads are used for the design of the OEH DEAD LOAD: Weight of the OEH (approximate = 14,000 Ibs.)

Design Temperature: 240° F (inside temperature)

Design Pressure: -3 psig (outside pressure) to +6 psig (inside pressure)

Normal Temperature Range: +120°F / -10°F Seismic Design Loads: (OBE) and (DBE) in accordance with FSAR Section 16 and IP3 Response Spectra Maximum Integrated Dose: lX106 RAD 1.3.6 Fuel and Radioactivity Control (Criteria 60 to 64)

Control of Releases of Radioactive Materials to the Environment (Criterion 60)

Criterion: The nuclear power unit design shall include means to control suitably the release of radioactive materials in gaseous and liquid effluents and to handle radioactive solid wastes produced during normal reactor operation, including anticipated operational occurrences. Sufficient holdup capacity shall be provided for retention of gaseous and liquid effluents containing radioactive materials, particularly where unfavorable site environmental conditions can be expected to impose unusual operational limitations upon the release of such effluents to the environment.

Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and offsite shipments are in accordance with applicable governmental regulations.

Radioactive fluids entering the Waste Disposal System are collected in sumps and tanks until subsequent treatment can be made. They are sampled and analyzed to determine the 92 of 119 IPEC00034692 IPEC00034692

IP3 FSAR UPDATE quantity of radioactivity, with an isotopic breakdown if necessary. Before any attempt is made to discharge radioactive waste, they are processed as required and then released under controlled conditions. The system design and operation are characteristically directed toward minimizing releases to unrestricted areas. Discharge streams are appropriately monitored and safety features are incorporated to preclude releases in excess of the limits of 10 CFR 20.

The bulk of the radioactive liquids discharged from the Reactor Coolant System are processed and retained inside the plant by the Chemical and Volume Control System recycle train. This minimizes liquid input to the Waste Disposal System which processes relatively small quantities of generally low-activity level wastes. The processed water from the waste disposal system, from which most of the radioactive material has been removed, is discharged through a monitored line into the circulating water discharge.

Liquid wastes are generated primarily by plant maintenance and service operations.

To maintain the concentration of tritium in the reactor coolant at a level which precludes hazard to personnel during access to the containment, liquid effluent held in the CVCS holdup tanks processed and transferred to the monitor tanks for sampling. Subsequent discharge from the monitor tanks is dependent on the results of sampling analysis. The effluent may be sent back to the holdup tanks for reprocessing, it may be pumped to the primary water storage tank or discharged to the environment with condenser circulating water when within allowable activity concentration as discussed in Chapter 11. Discharged from the sample tanks to the environment is continuously monitored by the Waste Disposal System liquid effluent monitor.

Tritium concentration for effluent discharge is periodically determined to establish the quantity of tritium released in the environment through the waste disposal discharge line to the condenser circulating water. If the total amount of tritium released to the reactor coolant over a year were to be released to the Circulating Water System, the annual average concentration of tritium released to the environment would be between 10 -2 and 10 -4 of 10 CFR 20 limits.

Analysis for tritium concentration prior to each batch release is not necessary providing that the criterion of Note 5 of 10 CFR 20, Appendix B is met.

During normal operation, waste radioactive gases are discharged intermittently at a controlled rate from these tanks through the monitored plant vent. The system is provided with discharge controls so that the release of radioactive effluents to the atmosphere is controlled within the limits set in the Technical Specifications.

Gaseous wastes consist primarily of hydrogen stripped from coolant discharged to the CVCS holdup tanks during boron dilution, nitrogen and hydrogen gases purged from the CVCS volume control when degasing the reactor coolant, and nitrogen from the closed gas blanketing system. The gas decay tank capacity will permit 45 days decay of waste gas before discharge.

In the event of a pipe or tank rupture, the maximum anticipated quantity of waste gas that could be released from anyone tank in the system, is less than 2.0 x 104 curies of 93 of 119 IPEC00034693 IPEC00034693

IP3 FSAR UPDATE equivalent Xe-133, which would result in a dose of less than 0.5 rem beyond the site exclusion boundary.

Spent resins from demineralizers, filter cartridges and other contaminated solid wastes are packaged and stored onsite until shipment offsite for disposal. Suitable containers are used to package these solids at the highest practical concentrations to minimize the number of containers shipped for burial.

Solid wastes consist of waste liquid concentrates, spent resins and miscellaneous materials such as paper and glassware.

All solid waste is placed in suitable containers and stored onsite until shipment offsite is made for disposal. The Interim Radwaste Storage Facility (IRSF) may be utilized for temporary onsite storage of solidified radioactive wastes. (See Section 11.1)

Hydrological and meteorlogical conditions indigenous to the Indian Point site were considered in the design of the Waste Disposal System. The hydrology meteorology of the site are described in Sections 2.5 and 2.6, respectively.

Fuel Storage and Handling and Radioactivity Control (Criterion 61)

Criterion: The fuel storage and handling, radioactive waste, and other systems which may contain radioactivity shall be designed to assure adequate safety under normal and postulated accident conditions. These systems shall be designed (1) with a capability to permit appropriate periodic inspection and testing of components important to safety; (2) with suitable shielding for radiation protection; (3) with appropriate containment, confinement, and filtering systems; (4) with a residual heat removal capability having reliability and testability that reflects the importance to safety of decay heat and other residual heat removal; and (5) to prevent significant reduction in fuel storage coolant inventory under accident conditions.

All fuel and waste storage facilities are contained and their equipment was designed so that accidental releases of radioactivity directly to the atmosphere are monitored and do not exceed the guidelines of 10 CFR 100.

The reactor cavity, refueling canal and spent fuel storage pit are reinforced concrete structures with a seam-welded stainless steel plate liner. These structures were designed to withstand the anticipated earthquake loadings as seismic Class I structures so that the liner prevents leakage even in the event the reinforced concrete develops cracks. (Section 9.5.1)

The refueling water provides a reliable and adequate cooling medium for spent fuel transfer and heat removal from the spent fuel pit is provided by an auxiliary cooling system. Natural radiation and convection is adequate for cooling the waste holdup tanks.

The structural steel and metal siding building surrounding the spent fuel pit is seismic Class III, as is the Fuel Storage Building Crane.

The Auxiliary Coolant System consists of three loops as shown in Plant Drawings 9321-94 of 119 IPEC00034694 IPEC00034694

IP3 FSAR UPDATE F27203and -27513 [Formerly Figures 9.3~1, 9.3-2A and 9.3~2B]: the component loop, the residual heat removal loop, and the spent fuel pit cooling loop.

The spent fuel pit cooling loop was designed to remove the heat generated by stored spent fuel elements from the spent fuel pit. Alternate cooling capability can be made available under anticipated malfunctions or failures (expected fault conditions).

The active components of the Auxiliary Coolant System are in either continuous or intermittent use during normal plant operation so that no additional periodic tests are required. Periodic visual inspections and preventive maintenance are conducted following normal industry practice. (Section 9.3.5)

Adequate shielding for radiation protection is provided during reactor refueling by conducting all spent fuel transfer and storage operations underwater. This permits visual control of the operation at all times while maintaining low radiation levels, less than 2.0 mr/hr, for periodic occupancy of the area by operating personnel. Pit water level is indicated, and water removed from the pit must be pumped out since there are no gravity drains. Shielding is provided for waste handling and storage facilities to permit operation within requirements of 10 CFR 20.

Gamma radiation is continuously monitored in the auxiliary building. A high level signal is alarmed locally and is annunciated in the Control Room.

Auxiliary shielding for the Waste Disposal System and its storage components was designed to limit the dose rate to levels not exceeding 0.75 mr/hr in normally occupied areas, to levels not exceeding 2.0 mr/hr in intermittently occupied areas and to levels not exceeding 15 mr/hr in limited occupancy areas. (Section 11.2)

A controlled leakage building designed for a negative pressure of 0.50 inches of water minimum, permanently encloses the fuel pool. The design features of the fuel handling building that provide this leaktightness include the following items:

1) Special sealing features at joints that include:

a) Sealing off all edges and ends of the walls with a combination of caulking and relatively soft neoprene strip, b) Installation of necessary additional closure flashings at the extremities and at openings, c) Supplying additional caulking in vertical and horizontal joints of liner panels, d) Furnishing liner panels in sufficient thickness to seat well on girt spacings and resist flexing in addition to withstanding the normal design loads, and e) Providing additional fastening for liner panels.

2) Personnel and rolling steel truck doors with inflatable air seals. These seals are inflated upon a high radiation alarm from R-5, although R-5 95 of 119 IPEC00034695 IPEC00034695

IP3 FSAR UPDATE operability does not require this function.

3) Motor operated dampers designed to fail closed are installed on the discharge side of the two supply fans.

Prior to handling operations when irradiated fuel is within the fuel handling building, tests were performed to verify the building leak tightness. Fuel handling operations in the Fuel Storage Building are detailed in Section 3.7.13 of Technical Specifications and Section 9.5 of the FSAR.

Carbon filters, together with suitable face dampers and manual isolation devices are part of the normal Fuel Storage Building Ventilation System and operate as follows:

1) The carbon filters and motor operated dampers are located in the fan plenum downsteam from the roughing and HEPA filters.

2) The fuel storage building supply air fans are provided with motor operated dampers located on the discharge side of the fan. These dampers are interlocked with their respective fan motors and arranged to close when fan motor stops and open during fan motor operation.

3) Manual isolation devices will be installed during all fuel handling operations and leak tested to ensure that all of the air from the fuel storage building is discharged through the roughing HEPA and charcoal filters.

4) A radiation indicator located in the spent fuel pit area automatically initiates the emergency mode of operation by:

a) Stopping fuel storage building supply fans, thereby closing their respective dampers.

b) Opening carbon filter face dampers.

5) The exhaust system has a capacity of approximately 20,000 cfm which maintains a negative pressure in the fuel storage building.

The probability of inadvertently draining the water from the cooling loop of the spent fuel pit is exceedingly low. The only means is through actions such as opening a valve on the cooling line and leaving it open when pump is operating. In the unlikely event of the cooling loop of the spent fuel pit being drained, the spent fuel storage pit itself cannot be drained and no spent fuel is uncovered since the spent fuel pit cooling connections enter near the top of the pit. With no heat removal, the time for the spent fuel pit water to rise from 120 0 F to 180 0 F with 76 fuel assemblies stored in the pit is approximately 13.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The temperature and level indicators in the spent fuel pit would warn the operator of the loss of cooling. This slow heatup rate of the spent fuel pit would allow sufficient time to take any necessary action to provide adequate cooling while the cooling capability of the spent fuel pit cooling loop is being restored.

Assuming that the reactor has recently been refueled and 76 assemblies are stored in the pool, and 76 assemblies were placed in the spent fuel pit, a fission product decay period of approximately 47.5 days would be required after the spent fuel was placed in the pit before 96 of 119 IPEC00034696 IPEC00034696

IP3 FSAR UPDATE the natural heat loss from the pit would be equivalent to the decay heat.

The most serious failure of this loop is complete loss of water in the storage pool. To protect against this possibility, the spent fuel storage pool cooling connections enter near the water level so that the pool cannot be either gravity-drained or inadvertently drained. For this same reason, care is also exercised in the design and installation of the fuel transfer tube.

The water in the spent fuel pit below the cooling loop connections could be removed by using a portable pump.

Loss of water in the spent fuel pit and the resultant uncovering of the spent fuel by way of drains, and permanently connected systems cannot take place for the following reasons:

a) The suction of the Spent Fuel Pit Pump is taken from a point approximately six (6) feet below the top of the pool wall; therefore, this pump cannot be used to uncover fuel, even accidentally b) The Spent Fuel Pump discharge pipe terminates in the pool at elevation 74' -

4 %". This elevation is approximately five (5) feet above the top of the spent fuel assemblies; therefore, this pipe could not accidentally become a syphon to uncover the fuel.

c) The skimmer pump takes suction from, and discharges to the surface of the pool; therefore, it could not accidentally or otherwise uncover the spent fuel d) There are no drains on the bottom or side walls of the spent fuel; draining has to be done deliberately by a temporary pump e) The spent fuel pit cooling loop was designed to seismic Class II, the cleanup equipment and skimmer loops were designed to seismic Class III criteria; however, their failure could not result in the uncovering of the spent fuel, as explained above The primary source of makeup water to the spent fuel pit is the Primary Makeup Water Storage Tank, which is a seismic Class I component. The pumps and most of the piping associated with this system are also seismic Class I. The makeup water loop to the Spent Fuel Pit is seismic Class II, as is the spent fuel pit cooling loop. The cleanup equipment and skimmer loops are seismic Class III. Redundant sources of makeup water to the spent fuel pit are from the refueling water storage tank and the city water supply. In addition, there are provisions for the connection of a temporary cooling system. See Section 9.5 for further discussion of possible loss of water from the spent fuel pit and makeup capabilities.

In addition, a second Spent Fuel Pool Cooling System pump was installed identical to and in parallel with the original pump to provide installed standby pumping capability to the Spent Fuel Pool Cooling System.

The reliability of pumping capability is further enhanced by powering the two pumps from 97 of 119 IPEC00034697 IPEC00034697

IP3 FSAR UPDATE different electrical power buses. Associated piping and valves were designed and analyzed to requirements consistent with the existing system. The modified portions of the system were as a minimum, equal to the standards of the original system and in most cases represents an upgrading of design, material, fabrication, testing and/or quality assurance.

Prevention of Criticality in Fuel Storage and Handling (Criterion 62)

Criterion: Criticality in the fuel storage and handling system shall be prevented by physical systems or processes, preferably by use of geometrically safe configurations.

The Indian Point 3 spent fuel storage pool is equipped with seismic Class I maximum density spent fuel storage racks for an expanded total storage capacity of 1345 fuel assemblies. A stainless steel liner insures against a loss of water. Detailed instructions, licensing bases including Technical Specification requirements and the design of the fuel handling equipment incorporating interlocks and safety features, provide assurance that no incident could occur during refueling, fuel handling, or storage operations that could result in a hazard to the public health and safety. (Section 9.5)

Borated water is used to fill the spent fuel storage pit to a concentration matching that of the reactor cavity and refueling canal during refueling operations. A shutdown margin of 5%

Dklk is maintained, in the cold condition, with all rods inserted. Periodic checks of refueling water boron concentration and the residual heat removal pump operation insure the proper shutdown margin. Direct communications between the control room operator and the manipulator operator allows immediate notification of any impending unsafe condition detected during fuel movement.

The racks are arranged and categorized in two regions based on fuel assembly enrichment and burn-up. All storage cells are bounded on four sides by boral poison sheets, except on the periphery of the pool rack array. The rack are designed to assure that a keff of less than or equal to 0.95 is maintained provided that Technical Specifications dictating placement of fuel in the spent fuel pit are followed.

The storage rack design is a free-standing welded honeycomb array of stainless steel boxes which has no grid frame structure. The racks are supported and leveled on four screw pedestals which bear directly on the pool floor. The racks are free to move horizontally, and strong hydrodynamic coupling between racks causes the racks to move together without rack-to-rack impact. The free-standing design allows any single or combination of racks to withstand a design basis seismic event without toppling or causing damage to fuel assemblies inserted within them.

The core subcritical neutron flux is continuously monitored by two source range neutron monitors, each with continuous visual indication in the Control Room and with one audible indication in the Containment whenever core geometry is being changed.

Fuel Handling System cranes are dead-load tested before fuel movement begins. The test 98 of 119 IPEC00034698 IPEC00034698

IP3 FSAR UPDATE load assumed by the hoists or cranes must be equal to or greater than the maximum load assumed during the refueling operation. Additionally, a thorough visual inspection is made following the dead-load test and prior to fuel handling. A test of interlocks is also performed each refueling, prior to movement of core components. As excess weight interlock is provided to prevent movement of more than one fuel assembly at a time.

Monitoring Fuel and Waste Storage (Criterion 63)

Criterion: Appropriate systems shall be provided in the fuel storage and radioactive waste systems and associated handling areas (1) to detect conditions that may result in the loss of residual heat removal capability and excessive radiation levels and (2) to initiate appropriate safety actions.

Monitoring and alarm instrumentation are provided for fuel and waste storage and handling areas to detect inadequate cooling and to detect excessive radiation levels.

Radiation monitors are provided to maintain surveillance over the waste release operation.

The permanent record of activity releases is provided by radiochemical analysis of known quantities of waste.

There is a controlled ventilation system for fuel storage and waste treatment areas of the auxiliary building which discharges to the atmosphere via the plant vent. Radiation monitors are in continuous service in these areas to actuate a high-activity alarm on the control board annunciator.

Auxiliary shielding for the Waste Disposal System and its storage components was designed to limit the dose rate to levels not exceeding 0.75 mr/hr in normally occupied areas, to levels not exceeding 2.00 mr/hr in intermittently occupied areas and to levels not exceeding 15 mr/hr in limited occupancy areas.

The fuel handling mechanisms were designed so that it is unlikely that an accidental release of radioactivity can take place. These components are also contained within the fuel storage building which further reduces the chance of a "leak" and assists in maintaining the guidelines set up by 10 CFR 100. Furthermore, gamma radiation levels in the Fuel Storage Building itself are continuously monitored by a local (R-5) Area Radiation Monitor. The monitoring serves to warn the operator of impending high radiation levels for such cases as low water level, contaminated water or improper handling of irradiated equipment or fuel elements. If the set point is reached, it is alarmed locally and in the Control Room.

Whenever the ventilation system is required to be in operation, the bypass damper around the charcoal filter must be manually closed. On a high radiation alarm, the following actions automatically take place:

1) Building ventilation supply fans are secured,

2) Dampers at ventilation supply fan close,

3) If open, rolling door closes, 99 of 119 IPEC00034699 IPEC00034699

IP3 FSAR UPDATE

4) Inflatable seals on main doors and truck doors are actuated (R-5 operability does not require this function, however), and

5) Exhaust fans continue to run.

Under these conditions, the maximum calculated in-leakage to the building (as a result of non-air tight construction) would be 20,000 cfm with a one-half inch of water negative pressure inside the building. Thus, there will be zero air leakage from the building proper, and the entire exhaust from the building will pass through roughing HEPA and charcoal filters before passing into the plant vent.

A spent fuel pit cooling loop which is a part of the Auxiliary Coolant System is provided to remove from the spent fuel pit the heat generated by the stored fuel elements. Both the water level and temperature are continuously monitored. High and low levels in the pit (6" above or below the 93' -8" normal) are alarmed in the Control Room, as is high temperature of the water in the pit (135 0 F).

Two monitor tanks are provided to collect liquid wastes processed by the liquid waste disposal system that are suitable for direct release to the river. When a monitor tank is full, it will be isolated and the second tank will be placed in service. The isolated tank is then recirculated and a sample is taken.

The sample taken will be analyzed for gross activity. If the water is considered unsuitable for discharge, it will be returned to the waste holdup tank for reprocessing.

A direct measurement of the activity can be made by means of the radiation detector R-18 located in the monitor pumps' discharge line so that the liquid wastes can be monitored during both recirculation and discharge. The activity level will be indicated on the Waste Disposal Panel and in the Control Room (on the Radiation Monitoring System Cabinet). If the activity exceeds the high alarm setpoint, an alarm will be annunciated at the waste disposal panel, "WDS Liquid Monitor Hi Radiation." In addition, if the activity reaches the alarm point, the control valve RCV-018 in the waste release line will be tripped shut via an electrical interlock. This radiation detector thus provides a backup to the sample analysis in preventing the accidental release of high activity liquid.

If sample analysis indicates the fluid is suitable for discharge to the river, the allowable release rate will be determined and a radioactive waste release permit will be filled out for the particular tank to be dumped. RCV-018 will be opened from the waste disposal panel and locked closed valve No. 1785 will be opened. The pump discharge valve will be throttled to maintain the flow rate, as indicated on the waste disposal panel. The released liquid waste enters the discharge canal via the service water return line from the component cooling water heat exchangers.

The activity of the fluid being released is continuously monitored by R-18 so that in the event that high activity water inadvertently entered the fluid being released, it would be detected and RCV-018 would be tripped closed. This valve cannot be reopened until the high radiation condition is corrected and the alarm is reset from the Control Room.

Four 525 cubic foot large gas decay tanks and six 40 cubic foot small gas decay tanks are provided to hold radioactive waste gases for decay.

100 of 119 IPEC00034700 IPEC00034 700

IP3 FSAR UPDATE The large gas decay tanks are sampled periodically by a gas analyzer. Only the tank in the process of being filled will be sampled; the other tanks will be bypassed. (Operation of the large gas decay tank sample discharge valves, PCV-1036B to 1039B, are controlled by the gas analyzer during this sampling process.) A radiation monitor, R-20, will indicate its reading on the Waste Disposal Panel and will alarm when gaseous activity in the tank being filled reaches the high alarm setpoint (variable setpoint). This alarm is annunciated on the waste disposal panel as "Gas Activity Monitor Hi-Activity" and also in the Control Room.

The alarm is provided so the operator can stop the filling operation before the curie limit on the tank is reached. A maximum of 50,000 curies of equivalent Xenon-133 is allowed in anyone tank so that the site boundary limits of 10CFR20 will not be exceeded if the tank fails.

Monitoring Radioactivity Releases (Criterion 64)

Criterion: Means shall be provided for monitoring the reactor containment atmosphere, spaces containing components for recirculation of LOCA accident fluids, effluent discharge paths, and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences, and from postulated accidents.

The containment atmosphere, the plant vent, the containment fan coolers service water discharge, the Waste Disposal System gas and liquid effluent, the condenser air ejectors, the component cooling loop liquid, the component cooling water heat exchanger service water discharge, the discharges from the condensate polisher Low Total Dissolved Solids (LTDS) and High Total Dissolved Solids (HTDS) Waste Collection Tanks and the steam generator blowdown are monitored for radioactivity released during normal operations, from anticipated transients, and from accident conditions. (Section 11.2)

All gaseous effluent from possible sources of accident releases of radioactivity external to the reactor containment (e.g., the spent fuel pit and waste handling equipment) will be exhausted from the plant vent. All accidental spills of liquids are maintained within the auxiliary building and collected in a drain tank. Any waste disposal system liquid effluent discharged to the condenser circulating water canal is monitored by R-18. For the case of leakage from the reactor containment under accident conditions, the plant area radiation monitoring system, supplemented by portable survey equipment, is provided for monitoring of accident releases.

All fuel and waste storage facilities are contained and equipment designed so that accident releases of radioactivity to the atmosphere are monitored. (Sections 9.5 and 11.2)

Instruments for monitoring radioactivity releases are located at selected points in and around the plant to detect, indicate and record the radiation levels. The system consists of the channels detailed below.

The Containment Air Particulate Monitor (R-11) measures air particulate beta radioactivity in the containment, and ensures that the release rate through the containment vent during purging is maintained below specified limits.

High radiation level for the channel initiates closure of the containment purge supply and exhaust duct valves and pressure relief line valves.

101 of 119 IPEC00034701 IPEC00034701

IP3 FSAR UPDATE A Containment Radioactive Gas Monitor (R-12) is provided to measure gaseous beta radioactivity in the containment to ensure that the radioactivity release rate during purging is maintained below specified limits. High gas radiation level initiates closure of the containment purge supply and exhaust duct valves and pressure line relief valves.

The Plant Vent Gas Monitor (R 14) detects radiation passing through the plant vent to the atmosphere.

Remote indication and annunciation are also provided on the Waste Disposal System control board. On high radiation level alarm the gas release valve in the Waste Disposal System is automatically closed, thus assuring that gaseous releases from the Waste Disposal System are within the specified limits.

The condenser Air Ejector Gas Monitor (R-15) uses a gamma sensitive sodium iodide (Nal) crystal scintillator/photomultiplier to monitor the discharge from the air ejector exhaust header of the condensers for gaseous radiation which is indicative of a primary to secondary system leak. The normal gas discharge is routed to the turbine roof vent. On high radiation level alarm, the condenser exhaust gases are diverted to the containment through a blower.

Waste Disposal System Liquid Effluent Monitor (R-18) continuously monitors all Waste Disposal System liquid releases from the plant. A scintillation counter and sample chamber assembly monitor these effluent discharges. Automatic valve closure action is initiated by this monitor to prevent further release after a high radiation level is indicated and alarmed.

Remote indication and annunciation are also provided on the Waste Disposal System control board.

The measurement ranges of these monitors are given in Section 11.2.

1.4 COMPARISON OF DESIGN PARAMETER The design parameters listed in Table 1.4-1 represent those design parameters for Indian Point 2 and Indian Point 3 in effect at the time of the original license application by Consolidated Edison. These have been retained for historical reference; future comparisons or revisions will not be made.

1.4.1 Thermal and Hydraulic Design Parameters Most of the significant changes which were made in the thermal and hydraulic parameters between Indian Point 2 and 3 resulted from the increase in power level in Indian Point 3.

The Indian Point 3 power level was about 10% higher (3025 Mwt vs 2758 Mwt) than for Indian Point 2 (Line 1)* and this resulted in similar increases in total heat output (Line 2),

average heat flux (Line 25) and average thermal output (Line 27).

The fuel and burnable poison arrangement was optimized in Indian Point 3 to obtain the hot channel factors (Line 7 and 8). These hot channel factors resulted in maximum heat flux (Line 26) and maximum thermal output (Line 28) values associated with the higher heat flux and thermal output average values as pOinted out above.

102 of 119 IPEC00034702 IPEC00034 702

IP3 FSAR UPDATE The use of helium pressurized fuel rods with larger pellet clad gaps (Line 41) resulted in maximum fuel center line (rod) temperature which was about the same as for Indian Point 2 (Lines 30 and 31).

The coolant temperature parameters listed in Line No. 15-21 were slightly higher than for Indian Point 2 due to increased power level.

The rest of the parameters listed in this section of Table 1.4-1 were very similar to those listed for Indian Point 2; the differences are not significant.

1.4.2 Core Mechanical Design Parameters Indian Point 3 reflected a more advanced core design than Indian Point 2. Westinghouse experience in the design and operation of PWR's, together with continuing development programs, resulted in the modified fuel assembly design employed in Indian Point 3. Similar fuel assembly designs have been used in H. B. Robinson Unit No.2, Turkey Point No.3 and Surry Unit No.1. This design is characterized by a reduced number of grids per assembly (Line 38), Zr-4 guide tubes (Indian Point 2 had stainless guide tubes, at the time of this comparison), helium pressurized rods and fuel pellet diameters

• Lines referenced in this section are for Table 1.4-1 (Lines 41 and 46) which vary with the power output and lifetime of the particular core region.

The combination and inter-relationship of higher power, use of zircaloy instead of stainless guide tubes (higher reactivity), and a desired negative moderator coeffiencient at power required the use of more burnable poison rods in Indian Point 3 than Indian Point 2 (Line 53).

Other core mechanical design parameters were as in Indian Point 2.

1.4.3 Final Nuclear Design Data The fuel and poison arrangement coupled with a higher desired power output and improved core design yielded control characteristics for Indian Point 3 somewhat different from Indian Point 2. The effective multiplication parameters (Lines 72 - 74) were slightly higher than for Indian Point 2; this is due to the interplay between higher reactivity (higher enrichment and improved fuel design) and the increased number of burnable poison rods for the first core (Line 53).

Improved core design also permitted improved expected performance as the fuel discharge burnups (Lines 66 and 67) show. Westinghouse acquired substantial experience on fuel design; this experience was incorporated into the Westinghouse design techniques and predicted core performance. Experience on Westinghouse cores has shown calculated parameters to be very close to measured parameters demonstrating the effectiveness of calculational techniques in core designs.

103 of 119 IPEC00034703 IPEC00034 703

IP3 FSAR UPDATE Fuel and control rod characteristics and improved (flatter) power shape have made Indian Point 3 RCC assemblies to be worth slightly more than those in Indian Point 2 (Line 75);

this, again, due to an improved core design.

A flatter power shape was achieved by a combination of altered fuel enrichment (Line 68),

and optimization of the fuel and poison rod arrangements.

The rest of the nuclear design parameters were very similar to those for Indian Point 2 and the slight differences can be explained by the differences in the core and improved calculational techniques based upon extensive experience gained by Westinghouse.

1.4.4 Reactor Coolant System The design capacity and head of the reactor coolant pump (Lines 121 and 122) and tube side design flow rate in the steam generators (Line 108) were changed to reflect the increase in core resistance (due to a more advanced core design) and a modified pump impeller design (more efficient). No other significant changes have occurred in the Reactor Coolant or Steam Systems or their components.

104 of 119 IPEC00034704 IPEC00034 704

IP3 FSAR UPDATE TABLE 1.4-1 COMPARISON OF DESIGN PARAMETERS (1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

THERMAL AND HYDRAULIC DESIGN PARAMETERS Total heat output, MWt 3025 2758 6 6 Total heat output, Btu/hr 10,324 x 10 9413 x 10 2 Heat generated in fuel, % 97.4 97.4 3 Maximum thermal overpower, 12 12 4 with design hot channel factors, %

System pressure, nominal, psia 2250 2250 5 System pressure, minimum 2220 2220 6 steady state, psia Hot Channel Factors Heat Flux, Fq 2.32 2.24 7 Enthalpy rise, F"H 1.55 1.55 8 DNB ratio at nominal conditions 1.89 (L-grid) 2.16 (W-3) 9 (Min)

Minimum DNBR for design transients 1.30 (L-grid) 1.30 (W-3) 10 Coolant Flow Total flow rate, Ib/hr 136.3 x 106 136.1 x10 6 11 6 6 Effective flow rate for 130.1 x 10 130.0 X 10 12 heat transfer through core, Ib/hr Average velocity along 15.6 15.5 13 fuel rods, ftlsec 6 6 Average mass velocity through 2.54x10 2.54 x 10 14 core, Ib/hr-ft2 Coolant Temperature, F Nominal inlet 542.6 543 15 Maximum inlet due to 546.6 547.0 16 instrumentation error and dead band These represent those parameters for Indian Point 3 and Indian Point 2 in effect at the time of the original license application and are retained for historical reference only.

105 of 119 IPEC00034705 IPEC00034 705

IP3 FSAR UPDATE Table 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS (1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

Average rise in vessel 57.8 53.1 17 Average rise in core 62.4 55.4 18 Average in core 574.0 571.7 19 Average in vessel 571.5 569.5 20 Nominal outlet of hot channel 632.0 628.9 21 Average film coefficient, 5990 5970 22 Btu/hr-ft2 - F Average film temperature drop, F 32.2 29.9 23 Heat Transfer at 100% Power Active heat transfer surface area, ft2 52,100 51,400 24 Average heat flux, Btu/hr-ft2 193,000 178,400 25 Maximum heat flux, Btu/hr-ft2 447,500 399,700 26 Average thermal output, kW/ft 6.24 5.78 27 Maximum thermal output, kW/ft 14.5 12.94 28 Maximum clad surface temperature at nominal pressure, F 657 657 29 Fuel Central Temperature, F Maximum 100% power 3600 3300 30 Maximum at overpower 4500 4500 31 Thermal output, kWIft at 21.1 21.1 32 maximum overpower CORE MECHANICAL DESIGN PARAMETERS Fuel Assembly Design RCC Canless RCC Canless 15 x 15 15 x 15 33 Rod Pitch, inches 0.563 0.563 34 Overall dimensions, inches 8.426 x 8.426 8.426 x 8.426 35 Fuel Weight (as U02), pounds 221,600 216,600 36 Total weight, pounds 284,000 276,000 37 Number of grids per assembly 7 9 38 106 of 119 IPEC00034706 IPEC00034 706

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS (1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

Fuel Rods Number 39,372 39,372 39 Outside diameter, inches 0.422 0.422 40 Diametral gap, inches 0.0075 0.0065 41 Clad thickness, inches 0.0243 0.0243 42 Clad material Zircaloy-4 Zircaloy-4 43 Fuel Pellets Material U02 Sintered U0 2 Sintered 44 Density (% of theoretical) 95 94-95-95 45 Diameter, inches 0.3659 0.366 46 Length, inches 0.600 0.600 47 Rod Cluster Control Assemblies Neutron absorber 5% Cd; 15% In; 5% Cd; 15% In; 48 80%Ag 80%Ag Cladding material Type 304 SS- Type 304 SS- 49 Cold Worked Cold Worked Clad Thickness, inches 0.019 0.019 50 Number of clusters 53 53 51 Number of control rods per 20 20 52 cluster Number of burnable poison rods 1434 (1 st cycle) 1412 53 Core Structure Core barrel 10/00, inches 148.38/152.95 148.01152.5 54 Thermal shield 10/00, inches 158.5/164.1 158.5/164.0 55 FINAL NUCLEAR DESIGN DATA Structure Characteristics Clad Weight, pounds 42,915 44,600 56 Core diameter, inches 133.7 132.75 57 Core height, inches 144 144 58 Reflector Thickness and Composition Top - water plus steel, inches 10 10 59 Bottom - water plus steel, inches 10 10 60 Side - water plus steel, inches 20 15 61 107of119 IPEC00034707 IPEC00034707

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS (1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

H2 0/U unit cell (core 4.03 4.01 62 volume ratio)

Number of fuel assemblies 193 193 63 U02 rods per assembly 204 204 64 Performance Characteristics Loading technique 3 region, 3 region, 65 checker board checker board Fuel Discharge Burnup, MWD/MTU Average first cycle 17,000 16,100 66 First core average 28,000 24,700 67 Feed Enrichments, w/o Region 1 2.28 2.21 68 Region 2 (first core with 2.80 2.80 69 burnable poison)

Region 3 3.30 3.30 70 Equilibrium 3.2 3.2 71 Control Characteristics (Beginning of life)

Effective Multiplication (with Burnable Poison)

Cold, no power, clean 1.17 1.113 72 Hot, no power, clean 1.14 1.057 73 Hot, full power, Xe and 1.09 1.001 74 Sm equilibrium Rod Cluster Control Assemblies Total rod worth BOL (calculated) 9.45 8.46 75 Hot, no power, clean, k a Boron Concentrations (First Cycle with Burnable Poison)

To shut reactor down with no rods inserted, clean (I<eff=0.99) cold/hot, ppm 1500/1476 1370/1405 76 To control at power with no rods inserted clean/equilibrium xenon and samarium, ppm 1228/933 1186/890 77 108 of 119 IPEC00034708 IPEC00034 708

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS(1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

Boron worth, hot (at power),

ak/k-ppm 1% 1 104 1% 189 78 Boron worth, cold (zero power),

ak/k-ppm 1% 183 1% 172 79 Kinetic Characteristics Moderator temperature coefficient, -0.0 x 10-4 to -2.5 x 10-4 to 80 ak/k/F -3.5 x 10-4 -3.00 x 10-4 Moderator pressure coefficient, 0.3 x 10-6 to +0.2 x 10-6 to 81 ak/k/psi +4.0 x 10-6 3.00x 10.6 Moderator void (density) coeffient, ak 1 gm Icm 3

-0.0 to +0.43, -0.1 to +0.3 82 Doppler coefficient, ak/k/F -1.0 x 10-5 to -1.1 X 10-5 to 83

-2.0 x 10-5 -1.8 X 10-5 REACTOR COOLANT SYSTEM - CODE REQUIREMENTS Component Reactor vessel ASME III Class A+ ASME III Class A+ 84 Steam Generator Tube Side ASME III Class A+ ASME III Class A+ 85 Shell Side ASME III Class A+ ASME III Class C+ 86 Pressurizer ASME III Class A+ ASME III Class A+ 87 Pressurizer relief tank ASME III Class C+ ASME III Class C++ 88 Pressurizer safety valves ASME 111+ ASMEIII 89 Reactor coolant piping ANSI B31.1-1955 ANSI B31.1-1955 90

+ 1965 Code Edition with applicable Addenda

++ 1964 Code Edition with applicable Addenda 109 of 119 IPEC00034709 IPEC00034 709

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS(1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

PRINICIPAL DESIGN PARAMETERS OF THE REACTOR COOLANT SYSTEM Operating pressure, psig 2235 2235 91 Total reactor coolant system 12,242 12,224 92 volume, cu. ft.

PRINICIPAL DESIGN PARAMETERS OF THE REACTOR VESSEL Material SA 302 Grade B, SA 302 Grade B, 93 low alloy steel, low alloy steel internally clad internally clad with type 304 with type 304 austenitic stain- austenitic stain-less steel less steel Design Pressure, psig 2485 2485 94 Design temperature, F 650 650 95 Operating pressure, psig 2235 2235 96 Inside diameter of shell, inches 173 173 97 Overall height of vessel and enclosure head, ft-inches 43 - 911/16 43 - 911/16 98 Minimum clad thickness, inches 5132 5/32 99 Outlet nozzle radius, inches 12213/16 123 1/16 100 Inlet nozzle radius, inches 13031/32 131 7/32 101 PRINCIPAL DESIGN PARAMETERS OF THE STEAM GENERATORS Number of units 4 4 102 Type Vertical, U-tube Vertical, U-tube 103 with integral- with integral-moisture separator moisture separator Tube material Inconel Inconel 104 Shell material SA 302 Grade B SA 302 Grade B 105 Tube side design pressure, psig 2485 2485 106 Tube side design temperature, F 650 650 107 6 6 Tube side design flow, Iblhr 34.08 x 10 34.03 x 10 108 Shell side design pressure, psig 1085 1085 109 Shell side design pressure temperature, F 600 600 110 110 of 119 IPEC00034710 IPEC00034710

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS(1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

Operating pressure, tube side, nominal, psig 2235 2235 111 Operating pressure, shell side, maximum, psig 1005.3 1005.3 112 Maximum moisture at outlet at  %  % 113 full load, %

Hydrostatic test pressure, tube 3110 3110 114 side (code), psig PRINCIPAL DESIGN PARAMETERS OF THE REACTOR COOLANT PUMPS Number of units 4 4 115 Type Vertical, single Vertical, single 116 stage radial stage radial flow with bottom flow with bottom suction and horiz- suction and horiz-ontal discharge ontal discharge Design pressure, psig 2485 2485 117 Design temperature, F 650 650 118 Operating pressure, nominal, psig 2235 2235 119 Suction temperature, F 555 555 120 Design capacity, gpm 88,500 89,700 121 Design Head, ft 277 272 122 Hydrostatic test pressure (cold), 3110 3110 123 psig Motor type AC induction AC induction 124 single speed single speed 6000 hp 6000 hp 125 PRINCIPAL DESIGN PARAMETERS OF THE REACTOR COOLANT PIPING Material Austenitic SS Austenitic SS 126 Hot leg 10, inches 29 29 127 Cold leg 10, inches 27-1/2 27-1/2 128 Between pump and steam generator 31 31 129 10, inches Design pressure, psig 2485 2485 130 111 of 119 IPEC00034711 IPEC00034711

IP3 FSAR UPDATE TABLE 1.4-1 (Cont.)

COMPARISON OF DESIGN PARAMETERS(1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

STEAM AND POWER CONVERSION DESIGN PARAMETERS Turbine-Generator Four-element, Four-element, 131 Turbine type tandem-compound, tandem-compound, six-flow exhaust six-flow exhaust Turbine capacity, kW Maximum guaranteed 1,021,793 1,021,793 132 Maximum calculated 1,068,701 1,068,701 133 Generator rating, kVa 1,125,600 1,125,600 134 Turbine speed, rpm 1800 1800 135 Condensers Type Radial flow, Radial flow, 136 single pass, single pass.

divided water divided water box box Number 3 3 137 Condensing capacity, Ib of steam/hr (each) 7,230,000 7,230,000 138 Condensate pumps Type 8 stage, vertical, 8 stage, vertical, 139 pit type, pit type, centrifugal centrifugal Number 3 3 140 Design capacity, (each - gpm) 7860 7860 141 Motor type Vertical, induction Vertical, induction 142 Motor rating, hp 3000 3000 143 112 of 119 IPEC00034712 IPEC00034712

IP3 FSAR UPDATE TABLE 1.4-1 (Cant.)

COMPARISON OF DESIGN PARAMETERS(1)

REFERENCE INDIAN POINT 3 INDIAN POINT 2 LINE NO.

Feedwater pumps Type High speed, barrel High speed, barrel 144 casing, single casing, single stage centrifugal stage centrifugal Number 2 2 145 Design capacity (each), gpm 15,300 15,300 146 Motor type horizontal steam horizontal steam 147 turbine turbine Motor rating, hp 8350 8350 148 Auxiliary feedwater source 360,000 gallons 360,000 gallons 149 assured reserve assured reserve in 600,000 gal in 600,000 gal condensate tank. condensate tank.

Alternate supply Alternate supply from 1,500,000 gal from 1,500,000 gal city water tank city water tank Auxiliary feedwater pumps Number 3 (one steam- 3 (one steam- 150 driven, two driven, two electric motor- electric motor-driven) driven)

Design capacity, gpm 800 (steam-driven) 800 (steam-driven) 151 400 (each, motor- 400 (each, motor-driven pump driven pump) 113 of 119 IPEC00034713 IPEC00034713

IP3 FSAR UPDATE 1.5 RESEARCH AND DEVELOPMENT REQUIREMENTS The design of Indian Point 3 was based upon proven concepts which were developed and successfully applied to the design of numerous other pressurized water reactor systems.

The research and development programs discussed in this section were intended to confirm the engineering and design values normally used to complete equipment and system designs. These did not involve the creation of new concepts or ideas.

The technical information generated was used either to demonstrate the safety of the design and more sharply define margins of conservatism or to lead to design improvements.

Each research and development program is briefly summarized for identification. Detailed discussions of each program are available in more detail in the references given in this section.

1.5.1 Programs Required for Plant Operation There were four programs identified in the initial license application as required for plant operation:

1) Core Stability Evaluation

2) Fuel Rod Burst Program

3) Containment Spray Program

4) Charcoal Filter Program.

1. Core Stability Evaluation The purpose of this program was to establish the means for detection and control of potential xenon oscillations and for shaping of the axial power distribution for improved core performance. This program has been completed. A xenon induced X-V oscillation test was conducted at Indian Point 2. Therefore, no test was needed for Indian Point 3. Reference 1 provides a further discussion of the tests performed.

2. Fuel Rod Burst Program The original rod burst program, a study of the performance of zircaloy cladding under simulated Loss-of-Coolant Accident (LOCA) conditions, was completed. This program supplied empirical data from which the effect of geometry distortion on the ability of the Emergency Core Cooling System (ECCS) to meet the LOCA design criteria was determined using available analytical design techniques.

The program included burst and quench tests on single rods and burst tests on rod bundles. As a result of single rod tests, specific design limits were 114 of 119 IPEC00034714 IPEC00034714

IP3 FSAR UPDATE established on peak clad temperature and allowable maximum metal water reaction to assure effective core cooling. The multi rod burst tests demonstrated that even when rod to rod contact does occur after burst, the remaining flow area is always sufficient to ensure adequate core cooling.

Reference 2 (single rod) and Reference 3 (multi rod) provide a further discussion of these tests.

On January 8, 1992, the Authority filed an application (supplemented by letter dated February 26, 1992) to address the use of ZIRLOTM, as well as Zircaloy-4, fuel rod cladding. Amendment No. 117 to Facility Operating License DPR-64, and the associated safety evaluation (Reference 6), were issued by the NRC on May 15, 1992, and document NRC acceptance of the use of ZIRLOTM clad fuel.

3. Containment Spray Program The purpose of this program was the development of technical information to substantiate the effectiveness of a chemically reactive spray for removal of fission product iodine from the containment atmosphere following a Loss-of-Coolant Accident.

The program has been completed. Results provided improved modeling capability and showed that the margins of safety inherent in the system design were not significantly diminished.

Reference 4 provides further discussion of these tests.

4. Charcoal Filter Program An experimental program was conducted at the Oak Ridge National Laboratory (ORNL) at the request of Westinghouse to determine the efficiency of radioactive methyl iodide trapping from flowing steam-air by impregnated charcoal filters.

The program has been completed. The results show that for the conditions expected, the filter configuration used has an initial removal efficiency of at least 70% per pass for all post-accident containment atmosphere environmental conditions up to and including 100% relative humidity.

Reference 5 provides further discussion of these tests.

115 of 119 IPEC00034715 IPEC00034715

IP3 FSAR UPDATE References

1) Eggleston, F. T., "Safety Related Research and Development for Westinghouse Pressurized Water Reactors, Program Summaries, Spring 1976, " WCAP-8768, Westinghouse Electric Corp.

2) Roll, J. B., "Performance of Zircaloy Clad Fuel Rods During a Simulated Loss-of-Coolant Accident -Single Rod Tests," Volume I, WCAP-7805, December 1971; Volume II, WCAP-7379, October 1971; Westinghouse Electric Corp.

3) Schreiber, R., et ai, "Performance of Zircaloy Clad Fuel Rods During a Simulated Loss-of-Coolant Accident - Multi Rod Burst Tests," Volume I, Test Set-up and Results, WCAP-7808 December 1971; Volume II (by C. L. Caso) Analysis of Results, WCAP-7808, December 1971; Westinghouse Electric Corp.

4) Pasedag, W. P., "Iodine Removal by Spray in the Zion Station Containment,"

WCAP-7742, August 1971; Westinghouse Electric Corp.

5) Ackley, R. D., and R. E. Adams, "Trapping of Radioactive Methyl Iodine from Flowing Steam-Air: Westinghouse Test Series," ORNL-TM-2728, October 1968.

6) Safety Evaluation by the Office of Nuclear Reactor Regulation, dated May 15, 1992, Related to Amendment No. 117 to Facility Operating License No. DPR-64.

1.6 IDENTIFICATION OF CONTRACTORS 1.6.1 116 of 119 IPEC00034716 IPEC00034716

IP3 FSAR UPDATE 117 of 119 IPEC00034717 IPEC00034717

IP3 FSAR UPDATE 1.6.2 Operation On December 24, 1975, the Nuclear Regulatory Commission (NRC) issued Amendment No.

1 to Facility Operating License (FOL) DPR-64 which authorized the Authority to purchase and acquire title to, but not operate Indian Point 3, under the terms of this authorization, Consolidated Edison retained responsibility for the operation of Indian Point 3 with the same operating license restrictions on subcritical operation.

On December 31, 1975, the Authority purchased and acquired title to Indian Point 3, including a portion of the Indian Point Site, buildings, facilities and equipment necessary to support operation of Indian Point 3. Certain systems and facilities, the use of which have been provided for by contract between the Authority and Consolidated Edison, are shared between Indian Point 3 and the other units at the site. With respect to facilities which were not acquired by the Authority, but which are shared by Indian Point 3, the Authority has acquired temporary easements.

Mutual use of the combine site as the restricted area and exclusion area for Indian Point 1, 2 and 3 has also been provided for by a contract which is presently in effect.

On April 6, 1976, NRC issued Amendment No. 2 to FOL DPR-64 permitting full term continuous power operation of Indian Point 3. This Amendment included a number of conditions in power level, environmental, geophysical and safety areas, and by reference, wholly incorporated the Technical Specifications (dated April 15, 1976).

Under the terms of its contract with the Authority, and upon completion of construction, pre-operational tests and initial startup, Consolidated Edison assumed and retained responsibility for plant operation. Services contracted for included operation, quality assurance, engineering, maintenance, training, health physics, water chemistry, environmental monitoring, plant and site security, testing modifications, repair and refueling.

On March 16, 1977, the Authority filed an application with NRC to amend FOL DPR-64 to permit the Authority to assume sole and full responsibility for plant operation and for all future design and construction activities at Indian Point 3. On March 8, 1978, NRC issued Amendment No. 12 to FOL DPR-64 permitting the Authority to assume sole responsibility for operation of Indian Point 3.

118 of 119 IPEC00034718 IPEC00034718

IP3 FSAR UPDATE Since that time, the Authority contracts the support of the NSSS Vendor, the plant's original designer and other suitably qualified organizations as required to perform engineering, design, construction and testing services.

The NSSS Vendor and the plant's original designer, Westinghouse Electric Corporation and United Engineers and Constructors Inc., respectively, provide technical support services under the direction of the Authority. These services include: engineering and design services, consulting services, quality assurance and other specialized engineering services as specifically authorized by the Authority. Westinghouse also provides services associated with turbine maintenance and repairs, steam generator inspection, refueling and others as specifically authorized. In addition to Westinghouse and United Engineers, other Contractors are utilized to provide engineering and construction management services associated with major modifications and additional facilities to the plant. Crouse Nuclear Engineering services was retained to provide maintenance and installation services associated with plant improvements.

On a 3 - 4 year cycle, in accordance with Authority procedures, on-site maintenance and installation services associated with plant improvements are competitively bid and awarded to a qualified contractor. The overall functional organization chart for the operations phase is shown in 119 of 119 IPEC00034719 IPEC00034719

IP3 FSAR UPDATE CHAPTER 2 SITE AND ENVIRONMENT 2.1

SUMMARY

OF CONCLUSIONS This Chapter sets forth the site and environmental data which together formed the basis for many of the criteria for designing the facility and for evaluating the routine and accidental releases of radioactive liquids and gases to the environment. These data support the conclusion that there will be no undue risk to public health and safety due to plant operation.

The strength of this conclusion rests with these data and the determinations (also included in this report) of several independent consultants, each speaking within a particular area of expertise - health physics, demography, geology, seismology, hydrology or meteorology, as the case may be.

The task of evaluating the environmental characteristics of the area was facilitated by the fact that more than 12 years of studies and measurements of environmental characteristics were undertaken. For over twenty years, measurements have been made of the effects on the environment of releases from at least one operating nuclear power facility at the Indian Point Site.

Conservative projections have been made of the growth of population in the area and these projections have been taken into account in plant design and operation as to control the effects of accidents. Population estimates are presented in subchapter 2.4.

The census data for 1990 reveals that the population within a 10-mile radius of the site was approximately 238,043 whereas the 2000 estimated population is 564,200. The land is now zoned principally for residential and state park usage although there is some industrial activity and a little agricultural and grazing activity. The projections do not indicate that the land usage within this radius will shift appreciably during the period of plant operation.

Geologically, the site consists of a hard limestone formation in a jointed condition which provides a solid bed for the plant foundation. The bedrock is sufficiently sound to support any loads up to 50 tons per square foot, which is far in excess of any load imposed by the plant. Although it is hard, the jointed limestone formation is permeable to water. Thus, if water from the plant should enter the ground (an improbable event since the plant is designed to preclude any leakage into the ground) it would percolate to the river rather than enter any ground water supply. Additional studies by the geology consultant, Thomas W.

Fluhr, and examination of soil borings confirmed the above conclusions.

In the Hudson River, about 80,000,000 gallons of water flow past the plant each minute during the peak tidal flow. This flow provides additional mixing and dilution for liquid discharges from the facility. Plant design was based on the conservative assumption that the river water is used for drinking, thus radioactive discharges are reduced by dilution with ordinary plant effluent to concentrations that would be tolerable for drinking water. There is very little danger of flooding at the site.

Significant seismic activity in the Indian Point area is rare and no damage has resulted therefrom. As stated by the consultant on seismology, the site is "practically non-seismic" 1 of 506 IPEC00034720 IPEC00034 720

IP3 FSAR UPDATE and is as safe as any area, at present known." Notwithstanding such assurance, the plant is designed to withstand an earth- quake of the highest intensity ever recorded in this area.

Meteorological conditions in the area of the site were determined during a two-year test program (1955 to 1957). The validity of these conclusions was verified by a test program completed in October 1970. The meteorological analysis also includes data from periods of November 26, 1969 through October 1, 1970, and January 1, 1970 through December 31, 1971. These data were used in evaluating the effects of gaseous discharges from the plant during normal operations and during a postulated Loss-of-Coolant Accident. In addition, data supplied by the U.S. Weather Bureau at the Bear Mountain Station, regarding the meteorological conditions during periods of precipitation, have been used to evaluate the rainout of fission gases into surface water reservoirs following a postulated Loss-of-Coolant Accident. The evaluations indicate that the site meteorology provides adequate diffusion and dilution of any released gases.

Environmental radioactivity has been measured at the site and surrounding area for nearly twenty years in association with the operation of Indian Point 1, and the construction and operation of Indian Point 2 and 3. These measurements are being continued and reported as dictated by the Technical Specifications and ODCM. The radiation measurements of fallout, water samples, vegetation, marine life, etc. have shown no perceptible post-operative increase in radioactivity due to plant operations. Noticeable increases in fallout have coincided with weapons testing programs and appear to be related almost entirely to those programs. The New York State Department of Health, in an independent two-year post-operative study(1), found that environmental radioactivity in the vicinity of the site is no higher than anywhere else in the State of New York.

Consultants who partiCipated in the preparation of the various reports, mea-surements and conclusions appearing in this Chapter included Dr. Merril Eisenbud, then Director of Environmental Radiation Laboratory, Institute of Industrial Medicine, New York University; Dr. Benjamin Davidson (deceased), Meteorologist and Director, Geophysical Science Laboratory, New York University College of Engineering; Dr. James Halitski, then Senior Research Scientist, Department of Meteorology and Oceanography, New York University, College of Engineering; Dr. Edgar M. Hoover, then at the Regional Economic Development Institute, Inc.; Metcalf & Eddy Engineers, hydrology specialists; Rev. J. J. Lynch, S.

J., then Director of the Seismic Observatory, Fordham University; Mr. Sidney Paige, then Consulting Geologist; Quirk, Lawler and Matusky Engineers, Environmental Science and Engineering Consultants; Mr. Karl R. Kennison, Consulting Civil and Hydraulic Engineer; Mr. Thomas W. Fluhr, P.E., Consulting Engineering Geologist; Reports by Captain Elliott B.

Roberts, Chief of the Geophysics Division, U.S. Department of Commerce and by Mr.

James Dorman, then at the Lamount Geologist Observatory, Columbia University. And also, Reports by Parsons, Brincherhoff, Quade and Douglas Inc., Engineers; Dames &

Moore, Consultants; and Woodward-Clyde, Consultants.

References

1. Consolidated Edison Indian Point Reactor Post Operational Survey -

August, 1965, Division of Environmental Health Services, New York State Department of Health, Hollis S. Ingraham, M.D., Commissioner.

2 of 506 IPEC00034721 IPEC00034 721

IP3 FSAR UPDATE

2. Consolidated Edison Indian Point Reactor Environmental and Post Operation Survey

- July. 1966, Division of Environmental Health Services, New York State Department of Health, Hollis S. Ingraham, M.D., Commissioner.

2.2 LOCATION 2.2.1 General The Indian Point site comprises approximately 239 acres of land on the east bank of the Hudson River at Indian Point, Village of Buchanan, in upper Westchester County, New York.

Indian Point 3 is located adjacent to and south of Unit No.1 with Indian Point 2 adjacent to and north of Unit No.1, which has been retired. The site is about 24 miles north of the New York City boundary line. The nearest city is Peekskill, 2.5 miles northeast of Indian Point. An aerial photograph, Figure 2.2-1, shows the site and surrounding area.

The minimum distance from the Indian Point 3 reactor center line to the boundary of the site exclusion area and the outer boundary of the low population zone, as defined in 10 CFE 100.3 and 10 CFR 100.11, is 350 meters and 1100 meters, respectively.

2.2.2 Site Ownership and Control Entergy is the sole owner of the Indian Point 3 Nuclear Power Plant. Figure 2.2-2 shows the land owned by Entergy at the Indian Point site. Plant Drawing 9321-F-64513 [Formerly Figure 2.2..,3] shows a plot plan of Indian Point 3 and the boundary line and the Hudson River. Figure 2.2-4 shows the Indian Point Energy Center site ownership boundaries, the location of surrounding communities, and the Low Population Zone for Indian Point 3.

As shown in Figure 2.2-2, the Algonquin Gas Transmission Company has a 26 inch gas main on a right-of-way (approximately 1350 feet long and 65 feet wide) running east to west through Entergy's property. The Georgia - Pacific Corporation has an easement, (approximately 1610 feet long and 30 feet wide), along Entergy's southerly property line. The Georgia - Pacific easement is used for overhead electrical power and telephone lines, and for underground gas, water and sewer lines. These easements permit Entergy to determine all activities within the right-of-way in order to ensure safe operation of the Unit.

The Indian Point 3 protected area is enclosed by a chain link type security fence surmounted by three-strand barbed wire as indicated in Entergy's Security Plan. Appropriate control is maintained by Entergy at all access pOints into the Indian Point 3 security protected area. In addition, some areas within the protected area are designated as "vital areas" and access is controlled by a system of identification badges/card keys, locks and alarms.

Employees, who would need access to or through any portions of Entergy property, are required to adhere to the security provisions and check points operated and controlled by Entergy's security force. Details of Entergy's security program are given in the Security Plan for Indian Point Energy Center.

2.2.3 Access The site is accessible by several roads in the Village of Buchanan. Two paved roads link the eastern boundary of the site to the exiting plant. The site is not served by rail. The Indian Point 3 of 506 IPEC00034722 IPEC00034 722

IP3 FSAR UPDATE 3 protected area is bounded by chain link-type fencing, or the equivalent, and contains an interior roadway system, access to which is under the control of Entergy's Guard Force.

2.2.4 Control of Exclusion and Restricted Area In the event of an emergency situation at any of the Indian Point Units, the person in charge at that Unit shall immediately inform the person in charge at the other units. Further action, evaluation or institution of the offsite emergency plan will then depend on the seriousness of the emergency situation. Further details are provided in the Indian Point Energy Center Emergency Plan.

Control of the Indian Point Site Restricted Area to exclude unauthorized personnel at all times is controlled by IPEC. IPEC has responsibility for maintaining direct and continuous control over the persons on its property.

2.2.5 Activities on the Site The principal activities on the site are the generation, transmission and distribution of electrical energy; associated service activities; activities relating to the controlled conversion of the nuclear energy of fuel to heat energy by the process of nuclear fission; and the storage, utilization and production of special nuclear, source and by-product materials.

2.3 TOPOGRAPHY The Indian Point Site is surrounded on almost all sides by high ground ranging from 600 to 1000 feet above sea level. The site is located on the east bank of the Hudson River, which runs northeast to southwest at this point but turns sharply northwest approximately two miles northeast of the plant. The west bank of the Hudson is flanked by the steep, heavily wooded slopes of the Dunderberg and West Mountains to the northwest (elevations 1086 fee and 1257 feet respectively) and Buckberg Mountain to the west-southwest (elevation 793 feet). These peaks extend to the west by other names and gradually rise to slightly higher peaks.

The general orientation of this mass of high ground is northeast to southwest. One mile northwest of the site, Dunderberg bulges to the east, and north of Dunderberg and the site, high ground reaching 800 feet forms the east bank of the Hudson as the river makes a sharp turn to the northwest. To the east of the site, peaks are generally lower than those to the north and west. Spitzenberg and Blue Mountains average about 600 feet in height and there is a weak, poorly defined series of ridges which again seem to run in a north-northeast direction. The river south of the site makes another sharp bend to the southeast and the widens as it flows past Croton and Haverstraw.

An aerial photograph showing these topographic features of the site and surrounding area is shown in Figure 2.2-1.

2.4 POPULATION 2.4.1 General An initial report was prepared by Environmental AnalYSiS, Inc. in June 1972. The report, which is included herein (see pages 2.4.P-1 to 2.4.P-42), used the 1970 population census to update 4 of 506 IPEC00034723 IPEC00034 723

IP3 FSAR UPDATE population estimates and population projections to the year 2010, in 10-year intervals, for an area within a sixty-mile radius of the Indian Point Nuclear Power Plant Site at Buchanan, New York.

The resident population distribution, based on a May 1970 report was presented graphically by indicating the population estimated for each of the individual area segments of the selected grid system. The population distribution for a 55 mile radius is presented in Figure 2.4-1. The grid was centered on the reactor facility and extended radially for a distance of 55 miles. This area was subdivided by concentric circles with radii of 15, 25,35, 45, and 55 miles, and by equally spaced radial lines.

The grid system, superimposed on the geographical area surrounding the site, for a 60-mile radius, is shown in Figure 2.4-2. Each sector of 22.5° was based on a line segment11.25° from north (resulting in two subdivisions of the north bisected 22.50 sector); the others were designed in a clockwise fashion. The number of persons residing in each segment, based on the 1972 report, is presented in Figures 2.4-3 and 2.4-4 for the 5-mile and 60-mile radii, respectively.

Table 2.4-1, based on the June 1972 report, is a summary of the cumulative ring population estimates for the years 1970 to 2010, in 10 year increments, for complete ring zones up to sixty miles from the site.

In 1992, the Authority submitted new demographic and population distribution data on the Nuclear Regulatory Commission as part of its License Extension Request. This data shows that the projections performed in 1972 by Environmental Analysts were quite realistic, although slightly conservative. The rate of growth within the 50 mile radius was slightly slower than projected. Projections through 2010 should, thus, be viewed as conservative.

In 2003, KLD Associates, Inc. updated population distribution data for the 50 mile radius surrounding Indian Point using 2000 Census data. Table 2.4-2 summarizes this data by Zone.

Tables 2.4-3 through 2.4-18 show population distribution by sector and zone. Table 2.4-19 shows population by segment. A comparison of the 1972 projections with 2000 Census data continues to show that projections through 2010 should be viewed as conservative.

A comparison of the 1972 projections found in Table 2.4-1 with 1990 and 2000 Census data is shown below:

1990 Projection 1990 Census 2000 from 1972 Study Projection 2000 Census from 1972 Study 0-2 miles 15,673 16,774 20,698 12,442 0-5 miles 84,512 73,935 129,397 77,619 0-10 miles 408,198 237,338 564,220 257,475 Projections through 2010 should thus be viewed as conservative.

2.4.2 Population Centers 5 of 506 IPEC00034724 IPEC00034 724

IP3 FSAR UPDATE The closest population centers (defined in 10 CFR 100 as containing more than 25,000 residents) are Newburgh, N.Y. and White Plains, N.Y., both approximately 17 miles from the plant site. However, based on projected populations, the outer boundary of the more densely populated area of the City of Peekskill has been conservatively selected as the closest population center.

2.4.3 Low Population Zone The Code of Federal Regulations, Title 10, Part 100 requires that a reactor be so situated that there is no population center, which is defined as a city of no less than 25,000 people, having its nearest boundary closer than 1-1/3 times the low population zone radius. Based on the 10 CFR 100 definition, and the outer boundary of the more densely populated area of the City of Peekskill as the population center, the low population zone (LPZ) for the plant is 1100 meters.

(See Figure 2.2-4)

About 50 people reside within the low population zone, all of them to the east-southeast. This estimate of 50 people (a number which is expected to remain fairly static) is based on a survey of the area conducted by Consolidated Edison in September 1971.

2.4.4 Exclusion Area The exclusion area for Indian Point 3 is shown in Figure 2.2-2. The minimum distance from the reactor containment to the boundary of the exclusion area is 350 meters. This exclusion area satisfied both 10 CFR 100.3 and 10 CFR 100.11.

2.4.5 Land Usage Figures 2.4-6, 2.4-7, and 2.4-8 show, respectively, the land usage based upon official zoning maps, areas served by public utilities and areas served by sewage systems. The area surrounding the Indian Point Site is generally residential with some large parks and military reservations. The majority of the area to the east of the river within 15 miles of the site is zoned for residential usage as shown on the map in Figure 2.4-6. West of the river, within a fifteen-mile radius, the Palisades Interstate Park and residential areas are the dominant land usage. The only agricultural areas within fifteen miles are south and northwest of the plant, on the west side of the river.

6 of 506 IPEC00034725 IPEC00034 725

IP3 FSAR UPDATE Table 2.4-1

SUMMARY

OF CUMULATIVE RING POPULATION ESTIMATES (JUNE 1972)

Radius of the Ring in Miles Cumulative Ring Population Estimates 1970 1980 1990 2000 2010 Half 21 31 45 65 88 One 745 1,008 1,375 1,891 2,453 Two 9,255 11,981 15,673 20,698 26,016 Three 20,318 25,747 33,045 42,926 53,349 Four 34,553 44,338 57,544 75,482 94,451 Five 52,683 70,053 94,512 129,397 168,164 Ten 218,398 297,459 408,198 564,220 734,682 Fifteen 450,207 603,034 814,078 1,107,195 1,423,387 Twenty 888,163 1,179,611 1,577,851 2,125,429 2,711,048 Thirty 3,984,844 4,637,627 5,480,207 6,584,630 7,724,505 Forty 11,659,574 12,882,240 14,403,268 16,333,563 18,276,655 Fifty 17,471,479 18,991,980 20,923,966 23,400,331 25,899,727 Sixty 19,510,656 21,383,172 23,821,556 26,997,743 30,235,074 7 of 506 IPEC00034726 IPEC00034 726

IP3 FSAR UPDATE Table 2.4-2 2000 Population Estimates By 360 Degree Zone ZONE 2000 Population Accumulated Totals 0-1 mile 1,971 1~2 miles 10,471 2-3 miles 19,516 3-4 miles 18,791 4~5 miles 26,870 77,619 (within 5 miles) 5-6 miles 27,674 6-7 miles 21,404 7-8 miles 25,688 8-9 miles 49,767 9-10 miles 55,323 257,4 75 (within 10 miles) 10-15 miles 398,447 15-20 miles 460,697 20~25 miles 1,116,848 2,233,467{within 25 miles) 25-30 miles 2,205,078 30-35 miles 2,544,937 35-40 miles 3,734,393 40-45 miles 3,833,427 45-50 miles 2,232,598 16,783,900 (within 50 miles) 8 of 506 IPEC00034727 IPEC00034 727

IP3 FSAR UPDATE Table 2.4-3 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 1 (North) 2000 Zone Population 0-1 mile o 1-2 miles 11 2-3 miles 109 3-4 miles 183 4-5 miles 343 5-6 miles 300 6-7 miles 1,322 7-8 miles 2,395 8-9 miles 7,460 9-10 miles 182 10-15 miles 1,366 15-20 miles 43,748 20-25 miles 32,751 25-30 miles 54,348 30-35 miles 48,971 35-40 miles 18,752 40-45 miles 20,142 45-50 miles 41,358 9 of 506 IPEC00034728 IPEC00034 728

IP3 FSAR UPDATE Table 2.4-4 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 2 (North-Northeast) 2000 Zone Population 0-1 mile 0 1-2 miles 0 2-3 miles 314 3-4 miles 661 4-5 miles 1,716 5-6 miles 921 6-7 miles 1,044 7-8 miles 340 8-9 miles 838 9-10 miles 1,235 10-15 miles 2,453 15-20 miles 4,967 20-25 miles 23,111 25-30 miles 22,593 30-35 miles 8,417 35-40 miles 10,711 40-45 miles 8,153 45-50 miles 2,859 10 of 506 IPEC00034729 IPEC00034 729

IP3 FSAR UPDATE Table 2.4-5 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 3 (Northeast) 2000 Zone Population 0-1 mile 17 1-2 miles 3,439 2-3 miles 9,774 3-4 miles 4,510 4-5 miles 2,973 5-6 miles 3,823 6-7 miles 3,356 7-8 miles 1,760 8-9 miles 1,196 9-10 miles 1,097 10-15 miles 14,549 15-20 miles 14,593 20-25 miles 14,498 25-30 miles 11,974 30-35 miles 18,004 35-40 miles 18,775 40-45 miles 6,511 45-50 miles 7,254 11 of 506 IPEC00034730 IPEC00034 730

IP3 FSAR UPDATE Table 2.4-6 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 4 (East-Northeast) 2000 Zone Population 0-1 mile 7 1-2 miles 1,653 2-3 miles 2,841 3-4 miles 3,238 4-5 miles 2,178 5-6 miles 3,683 6-7 miles 2,473 7-8 miles 4,797 8-9 miles 6,936 9-10 miles 6,915 10-15 miles 24,469 15-20 miles 13,258 20-25 miles 20,375 25-30 miles 89,902 30-35 miles 35,294 35-40 miles 21,347 40-45 miles 22,265 45-50 miles 78,210 12 of 506 IPEC00034731 IPEC00034 731

IP3 FSAR UPDATE Table 2.4-7 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 5 (East) 2000 Zone Population 0-1 mile 334 1-2 miles 315 2-3 miles 24 3-4 miles 950 4-5 miles 594 5-6 miles 620 6-7 miles 1,545 7-8 miles 1,355 8-9 miles 3,224 9-10 miles 3,426 10-15 miles 15,387 15-20 miles 8,093 20-25 miles 26,346 25-30 miles 22,542 30-35 miles 22,092 35-40 miles 172,384 40-45 miles 167,423 45-50 miles 88,353 13 of 506 IPEC00034732 IPEC00034 732

IP3 FSAR UPDATE Table 2.4-8 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 6 (East-Southeast) 2000 Zone Population 0-1 mile 251 1-2 miles 192 2-3 miles 757 3-4 miles 656 4-5 miles 918 5-6 miles 304 6-7 miles 75 7-8 miles 319 8-9 miles 626 9-10 miles 2,113 10-15 miles 19,280 15-20 miles 11,355 20-25 miles 34,346 25-30 miles 141,922 30-35 miles 61,824 35-40 miles 18,609 40-45 miles 3,254 45-50 miles 29,437 14 of 506 IPEC00034733 IPEC00034 733

IP3 FSAR UPDATE Table 2.4-9 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 7 (Southeast) 2000 Zone Population 0-1 mile 807 1-2 miles 922 2-3 miles 1,543 3-4 miles 2,490 4-5 miles 694 5-6 miles 4,590 6-7 miles 2,630 7-8 miles 3,004 8-9 miles 10,085 9-10 miles 6,001 10-15 miles 37,224 15-20 miles 18,930 20-25 miles 101,556 25-30 miles 37,702 30-35 miles 12,330 35-40 miles 80,302 40-45 miles 239,071 45-50 miles 309,332 15 of 506 IPEC00034734 IPEC00034 734

IP3 FSAR UPDATE Table 2.4-10 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 8 (South-Southeast) 2000 Zone Population 0-1 mile 435 1-2 miles 2,042 2-3 miles 868 3-4 miles 136 4-5 miles 217 5-6 miles o 6-7 miles 90 7-8 miles o 8-9 miles 3,864 9-10 miles 9,817 10-15 miles 21,348 15-20 miles 116,963 20-25 miles 218,703 25-30 miles 295,031 30-35 miles 258,202 35-40 miles 603,637 40-45 miles 756,484 45-50 miles 464,715 16 of 506 IPEC00034735 IPEC00034 735

IP3 FSAR UPDATE Table 2.4-11 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 9 (South) 2000 Zone Population 0-1 mile 68 1-2 miles 541 2-3 miles o 3-4 miles o 4-5 miles 1,229 5-6 miles 5,661 6-7 miles 942 7-8 miles 4,716 8-9 miles 7,829 9-10 miles 7,864 10-15 miles 45,274 15-20 miles 47,358 20-25 miles 354,441 25-30 miles 926,582 30-35 miles 1,620,749 35-40 miles 2,099,064 40-45 miles 1,934,401 45-50 miles 743,893 17 of 506 IPEC00034736 IPEC00034 736

IP3 FSAR UPDATE Table 2.4-12 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 10 (South-Southwest) 2000 Zone Population 0-1 mile 52 1-2 miles 604 2-3 miles 420 3-4 miles 2,853 4-5 miles 10,900 5-6 miles 5,970 6-7 miles 3,378 7-8 miles 3,778 8-9 miles 6,101 9-10 miles 10,856 10-15 miles 106,089 15-20 miles 68,692 20-25 miles 160,698 25-30 miles 437,592 30-35 miles 325,993 35-40 miles 529,035 40-45 miles 452,790 45-50 miles 351,395 18 of 506 IPEC00034737 IPEC00034737

IP3 FSAR UPDATE Table 2.4-13 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 11 (Southwest) 2000 Zone Population 0-1 mile o 1-2 miles o 2-3 miles 2,115 3-4 miles 2,486 4-5 miles 3,853 5-6 miles 626 6-7 miles 4,496 7-8 miles 3,090 8-9 miles 1,388 9-10 miles 2,955 10-15 miles 17,690 15-20 miles 40,837 20-25 miles 48,470 25-30 miles 69,388 30-35 miles 49,562 35-40 miles 98,399 40-45 miles 139,699 45-50 miles 58,048 19 of 506 IPEC00034738 IPEC00034 738

IP3 FSAR UPDATE Table 2.4-14 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 12 (West-Southwest) 2000 Zone Population 0-1 mile o 1-2 miles 457 2-3 miles 518 3-4 miles 628 4-5 miles 221 5-6 miles 433 6-7 miles 48 7-8 miles 134 8-9 miles o 9-10 miles 5 10-15 miles 5,052 15-20 miles 4,381 20-25 miles 17,860 25-30 miles 15,165 30-35 miles 23,446 35-40 miles 22,991 40-45 miles 52,496 45-50 miles 27,668 20 of 506 IPEC00034739 IPEC00034 739

IP3 FSAR UPDATE Table 2.4-15 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 13 (West) 2000 Zone Population 0-1 mile o 1-2 miles 295 2-3 miles 154 3-4 miles o 4-5 miles o 5-6 miles o 6-7 miles o 7-8 miles o 8-9 miles o 9-10 miles 20 10-15 miles 6,164 15-20 miles 11,313 20-25 miles 17,014 25-30 miles 9.836 30-35 miles 18,522 35-40 miles 15,831 40-45 miles 11,592 45-50 miles 5,663 21 of 506 IPEC00034740 IPEC00034740

IP3 FSAR UPDATE Table 2.4-16 2000 Population Estimates Population Distribution by Sector and Zone SECTOR: 14 (West-Northwest) 2000 Zone Population 0-1 mile o 1-2 miles o 2-3 miles 19 3-4 miles o 4-5 miles o 5-6 miles o 6-7 miles o 7-8 miles o 8-9 miles 217 9-10 miles 1,633 10-15 miles 36,983 15-20 miles 10,970 20-25 miles 14,136 25-30 miles 47,249 30-35 miles 12,119 35-40 miles 6,654 40-45 miles 3,682 45-50 miles 6,307 22 of 506 IPEC00034741 IPEC00034741

IP3 FSAR UPDATE Table 2.4-17 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 15 (Northwest) 2000 Zone Population 0-1 mile o 1-2 miles o 2-3 miles 60 3-4 miles o 4-5 miles 192 5-6 miles o 6-7 miles o 7-8 miles o 8-9 miles 3 9-10 miles 1,204 10-15 miles 9,477 15-20 miles 10,441 20-25 miles 12,645 25-30 miles 10,588 30-35 miles 15,017 35-40 miles 9,956 40-45 miles 6,814 45-50 miles 14,385 23 of 506 IPEC00034742 IPEC00034742

IP3 FSAR UPDATE Table 2.4-18 2000 Population Estimates Population Distribution By Sector and Zone SECTOR: 18 (North-Northwest) 2000 Zone Population 0-1 mile o 1-2 miles o 2-3 miles o 3-4 miles o 4-5 miles 842 5-6 miles 743 6-7 miles 5 7-8 miles o 8-9 miles o 9-10 miles o 10-15 miles 35,642 15-20 miles 34,798 20-25 miles 19,898 25-30 miles 12,664 30-35 miles 14,395 35-40 miles 7,946 40-45 miles 8,650 45-50 miles 3,721 24 of 506 IPEC00034743 IPEC00034743

IP3 FSAR UPDATE TABLE 2.4-19 PERMANENT RESIDENT POPULA TION BY SEGMENT Ring Residential Segment (Miles) Population 1-N 0-2 11 2-NNE 0-2 0 3-NE 0-2 3,456 4-ENE 0-2 1,660 5-E 0-2 649 6-ESE 0-2 443 7-SE 0-2 1,729 8-SSE 0-2 2,477 9-S 0-2 609 10-SSW 0-2 656 11-SW 0-2 0 12-WSW 0-2 457 13-W 0-2 295 14-WNW 0-2 0 15-NW 0-2 0 16-NNW 0-2 0 Ring 0-2 Miles 12,442 1-N 2-5 635 2-NNE 2-5 2,691 3-NE 2-5 17,257 4-ENE 2-5 8,257 5-E 2-5 1,568 6-ESE 2-5 2,331 7-SE 2-5 4,727 8-SSE 2-5 1,221 9-S 2-5 1,229 10-SSW 2-5 14,173 11-SW 2-5 8,454 12-WSW 2-5 1,367 13-W 2-5 154 14-WNW 2-5 19 15-NW 2-5 252 16-NNW 2-5 842 Ring 2-5.Miles 65,177 N 5-10 11,659 NNE 5-10 4,378 NE 5.10 11,232 ENE 5-10 24,804 E 5-10 10,170 ESE 5-10 3,437 SE 5-10 26,310 SSE 5-10 13,771 25 of 506 IPEC00034744 IPEC00034744

IP3 FSAR UPDATE S 5-10 27,012 ssw 5-10 30,083 SW 5-10 12,555 WSE 5-10 620 W 5-10 20 WNW 5-10 1,850 NW 5-10 1,207 NNW 5-10 748 Ring 5-10 Miles 163,403 Cumulative Totals Total 0-2 Miles 12,442 Total 0-5 Miles 77,619 Total 0-10 Miles 257,475 26 of 506 IPEC00034745 IPEC00034745

IP3 FSAR UPDATE 27 of 506 IPEC00034746 IPEC00034746

IP3 FSAR UPDATE 28 of 506 IPEC00034747 IPEC00034747

IP3 FSAR UPDATE 29 of 506 IPEC00034748 IPEC00034748

IP3 FSAR UPDATE 30 of 506 IPEC00034749 IPEC00034749

IP3 FSAR UPDATE 31 of 506 IPEC00034750 IPEC00034750

IP3 FSAR UPDATE 32 of 506 IPEC00034751 IPEC00034751

IP3 FSAR UPDATE 33 of 506 IPEC00034752 IPEC00034752

IP3 FSAR UPDATE 34 of 506 IPEC00034753 IPEC00034753

IP3 FSAR UPDATE 35 of 506 IPEC00034754 IPEC00034754

IP3 FSAR UPDATE 36 of 506 IPEC00034755 IPEC00034755

IP3 FSAR UPDATE 37 of 506 IPEC00034756 IPEC00034756

IP3 FSAR UPDATE 38 of 506 IPEC00034757 IPEC00034 757

IP3 FSAR UPDATE 39 of 506 IPEC00034758 IPEC00034758

IP3 FSAR UPDATE 40 of 506 IPEC00034759 IPEC00034759

IP3 FSAR UPDATE 41 of 506 IPEC00034760 IPEC00034 760

IP3 FSAR UPDATE 42 of 506 IPEC00034761 IPEC00034761

IP3 FSAR UPDATE 43 of 506 IPEC00034762 IPEC00034 762

IP3 FSAR UPDATE 44 of 506 IPEC00034763 IPEC00034 763

IP3 FSAR UPDATE 45 of 506 IPEC00034764 IPEC00034 764

IP3 FSAR UPDATE 46 of 506 IPEC00034765 IPEC00034 765

IP3 FSAR UPDATE 47 of 506 IPEC00034766 IPEC00034 766

IP3 FSAR UPDATE 48 of 506 IPEC00034767 IPEC00034 767

IP3 FSAR UPDATE 49 of 506 IPEC00034768 IPEC00034 768

IP3 FSAR UPDATE 50 of 506 IPEC00034769 IPEC00034 769

IP3 FSAR UPDATE 51 of 506 IPEC00034770 IPEC00034 770

IP3 FSAR UPDATE 52 of 506 IPEC00034771 IPEC00034771

IP3 FSAR UPDATE 53 of 506 IPEC00034772 IPEC00034 772

IP3 FSAR UPDATE 54 of 506 IPEC00034773 IPEC00034 773

IP3 FSAR UPDATE 55 of 506 IPEC00034774 IPEC00034774

IP3 FSAR UPDATE 56 of 506 IPEC00034775 IPEC00034775

IP3 FSAR UPDATE 57 of 506 IPEC00034776 IPEC00034 776

IP3 FSAR UPDATE 58 of 506 IPEC00034777 IPEC00034 777

IP3 FSAR UPDATE 59 of 506 IPEC00034778 IPEC00034 778

IP3 FSAR UPDATE 60 of 506 IPEC00034779 IPEC00034 779

IP3 FSAR UPDATE 61 of 506 IPEC00034780 IPEC00034 780

IP3 FSAR UPDATE 62 of 506 IPEC00034781 IPEC00034 781

IP3 FSAR UPDATE 63 of 506 IPEC00034782 IPEC00034 782

IP3 FSAR UPDATE 64 of 506 IPEC00034783 IPEC00034 783

IP3 FSAR UPDATE 65 of 506 IPEC00034784 IPEC00034 784

IP3 FSAR UPDATE 66 of 506 IPEC00034785 IPEC00034 785

IP3 FSAR UPDATE 67 of 506 IPEC00034786 IPEC00034 786

IP3 FSAR UPDATE 68 of 506 IPEC00034787 IPEC00034787

IP3 FSAR UPDATE 69 of 506 IPEC00034788 IPEC00034 788

IP3 FSAR UPDATE 70 of 506 IPEC00034789 IPEC00034789

IP3 FSAR UPDATE 71 of 506 IPEC00034790 IPEC00034 790

IP3 FSAR UPDATE 72 of 506 IPEC00034791 IPEC00034791

IP3 FSAR UPDATE 73 of 506 IPEC00034792 IPEC00034 792

IP3 FSAR UPDATE 74 of 506 IPEC00034793 IPEC00034 793

IP3 FSAR UPDATE 75 of 506 IPEC00034794 IPEC00034 794

IP3 FSAR UPDATE 76 of 506 IPEC00034795 IPEC00034 795

IP3 FSAR UPDATE 77 of 506 IPEC00034796 IPEC00034 796

IP3 FSAR UPDATE 78 of 506 IPEC00034797 IPEC00034 797

IP3 FSAR UPDATE 79 of 506 IPEC00034798 IPEC00034 798

IP3 FSAR UPDATE 80 of 506 IPEC00034799 IPEC00034 799

IP3 FSAR UPDATE 81 of 506 IPEC00034800 IPEC00034800

IP3 FSAR UPDATE 82 of 506 IPEC00034801 IPEC00034801

IP3 FSAR UPDATE 83 of 506 IPEC00034802 IPEC00034802

IP3 FSAR UPDATE 84 of 506 IPEC00034803 IPEC00034803

IP3 FSAR UPDATE 85 of 506 IPEC00034804 IPEC00034804

IP3 FSAR UPDATE 86 of 506 IPEC00034805 IPEC00034805

IP3 FSAR UPDATE 87 of 506 IPEC00034806 IPEC00034806

IP3 FSAR UPDATE 88 of 506 IPEC00034807 IPEC00034807

IP3 FSAR UPDATE 89 of 506 IPEC00034808 IPEC00034808

IP3 FSAR UPDATE 90 of 506 IPEC00034809 IPEC00034809

IP3 FSAR UPDATE 91 of 506 IPEC00034810 IPEC00034810