ML12335A428

Official Exhibit - NYSR0013F-00-BD01 - UFSAR, Rev. 20, Indian Point Unit 3 (Submitted with License Renewal Application) (2007) (IP3 UFSAR, Rev. 20)

ML12335A428
Person / Time
Site:	Indian Point
Issue date:	12/22/2011
From:	State of NY, Office of the Attorney General
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
RAS 21609, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML12335A428 (210)

Text

United States Nuclear Regulatory Commission Official Hearing Exhibit Entergy Nuclear Operations, Inc.

In the Matter of:

(Indian Point Nuclear Generating Units 2 and 3) v....~f\ REGU<..q" ASLBP #: 07-858-03-LR-BD01 NYSR0013F

~~~'

Docket #: 05000247 l 05000286

< 0 Exhibit #: NYSR0013F-00-BD01 Identified: 10/15/2012 Revised: December 22, 2011

~ ~

IJI o

.,

!>'

~

c;- Admitted: 10/15/2012 Withdrawn:

'e-/i-o? ~O~ Rejected: Stricken:

• • • • . Other:

IP3 FSAR UPDATE is also noted that the Code allows an overpressure allowance above the design pressure under transient conditions.

4) That the RHRS is equipped with a pressure relief valve RV-1836 sized with a relief capacity of 400 gpm. This is a diverse backup to administrative closure of the isolation valves prior to startup to prevent overpressurization when returning the plant to operation. In addition, Technical Specification Section 3.4.12 restricts operation of the SI pumps when the RCS average cold leg temperature is below the OPS enable temperature. These restrictions help to preclude RHR overpressurization.

5) To preclude spurious closure of the valves, the control circuitry is of the energize-to-actuate principle.

6) That each of the pressure channels has a separate Control Room indication to show channel operability.

7) Open/close position indication lights are provided for these valves as well as a visual and audible alarm to indicate when either valve leaves its full open position.

Initial response of the injection systems is automatic with appropriate allowances for delays in actuation of circuitry and active components. The active portions of the injection systems are automatically actuated by the safety injection signal (Chapter 7). In addition, manual actuation of the entire injection system and individual components can be accomplished from the Control Room. In analysis of system performance, delays in reaching the programmed trip points and in actuation of components are conservatively established on the basis that only emergency onsite power is available.

The starting sequence of the safety injection and residual heat removal pumps and the related emergency power equipment is designed so that delivery of the full rated flow is reached within 27 seconds after the process parameters reach the set points for the injection signal.

SECONDS Time to initiate the safety injection signal 2 Time for diesel generators to come up to speed 10 Time for safety injection pumps to come up to speed 10 Time for Residual Heat Removal Pumps to come up to speed 5 Total 27 Motor control centers are energized and injection valves are opened during this time to allow pumped ECCS delivery.

This delay is consistent with the 25 second delay which is assumed in the analysis of the Loss-of-Coolant Accident as described in Chapter 14. The modeling of a 25 second SI delay time is conservative for this action sequence since no credit is taken for Charging or SI flow prior to 25 seconds (although these pumps are actually up to speed), and credit is not taken for partial RHR flow up to 25 seconds. On this basis, the integral injection flow for the assumed 25 42 of 215 IPEC00035651 IPEC00035651

IP3 FSAR UPDATE second delay time remains less than the actual injection flow that would be delivered if partial credit for pumps on prior to 25 seconds was assumed.

To reduce inadvertent Safety Injection System Actuations due to instrumentation lags in the engineered safeguards system high steamline flow, low average temperature Tavg/Low steamline pressure coincidence circuitry, a time delay will be installed in each train (a maximum time delay of 6 seconds will meet the acceptance criteria for a steamline rupture).

Single Failure Analysis A single active failure analysis is presented in Table 6.2-7. All credible active system failures were considered. The analysis of the Loss-of-Coolant Accident presented in Chapter 14 is consistent with the single failure analysis.

It is based on the worst single failure (generally a pump failure) in both the safety injection and residual heat removal pumping systems. The analysis shows that the failure of any single active component will not prevent fulfilling the design function.

In addition, an alternative flow path is available to maintain core cooling if any part of the recirculation flow path becomes unavailable. This evaluated in Table 6.2-8.

The procedure followed to establish the alternate flow path also isolates the spilling line. A valve is provided in the containment recirculation line to the residual heat removal pumps in order to isolate this line should it be required.

Failure analyses of the Component Cooling and Service Water Systems under Loss-of-Coolant Accident conditions are described in Sections 9.3 and 9.6, respectively.

Reliance on Interconnected Systems During the injection phase, the high head safety injection pumps do not depend on any portion of other systems with the exception of the suction line from the refueling water storage tank.

During the recirculation phase of the accident for small breaks, suction to the high head safety injection pumps is provided by the recirculation pumps.

The residual heat removal (low head) pumps are normally used during the reactor shutdown operations. Whenever the reactor is at power, the pumps are aligned for emergency duty.

Shared Function Evaluation Table 6.2-9 is an evaluation of the main components, which have been previously discussed, and a brief description of how each component functions during normal operation and during the accident.

Passive Systems The accumulators are a passive safety feature in that they perform their design function in the total absence of an actuation signal or power source. The only moving parts in the accumulator injection train are in the two check valves.

43 of 215 IPEC00035652 IPEC00035652

IP3 FSAR UPDATE The working parts of the check valves are exposed to fluid of relatively low boric acid concentration. Even if some unforeseen deposition accumulated, a reversed differential pressure of about 25 psi can shear any particles in the bearing that may tend to prevent valve functioning. This is demonstrated by calculation.

The isolation valve at each accumulator is only closed when the reactor is intentionally depressurized, or momentarily for testing when pressurized. The isolation valve is normally opened and an alarm in the Control Room sounds if the valve is inadvertently closed. It is not expected that the isolation valve will have to be closed due to excessive leakage through the check valves.

The check valves operate in the closed position with a nominal differential pressure across the disc of approximately 1650 psi. They remain in this position except for testing or when called upon to function. Since the valves operate normally in the closed position and are, therefore, not subject to the abuse of flowing operation or impact loads caused by sudden flow reversal and seating, they do not experience any wear of the moving parts, and therefore, function as required.

When the Reactor Coolant System is being pressurized during the normal plant heat-up operation, the check valves are tested for leakage as soon as there is about 100 psi differential across the valve. This test confirms the seating of the disc and whether or not there has been an increase in leakage since the last test. When this test is completed, the discharge line test valves are opened and the Reactor Coolant System pressure increase is continued. There should be no increase in leakage from this point on since increasing reactor coolant pressure increases the seating force and decreases the probability of leakage.

The accumulators can accept leakage from the Reactor Coolant System without effect on their availability. Table 6.2-10 indicates what in-leakage rates over a given time period require readjusting the level at the end of the time period. In addition, these rates are compared to the maximum allowed leak rates for manufacturing acceptance test (100 cc/hr, i.e., 10 cc/hr/in).

In-leakage at a rate of 10 cc/hr/inch would require that the accumulator water volume be adjusted approximately once every 8 months. This would indicate that level adjustments can be scheduled and that this work can be done at the operator's convenience. At a leak rate of 80 cc/hr/inch (8 times the acceptance leak rate), the water level will have to be readjusted approximately once a month. This readjustment will take about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> maximum.

The accumulators are located inside the reactor containment and protected from the Reactor Coolant System piping and components by a missile barrier. Accidental release of the gas charge in the accumulators would cause an increase in the containment pressure of approximately 0.1 psi. This release of gas has been included in the containment pressure analysis for the Loss-of-Coolant Accident, Chapter 14.

During normal operation, the flow rate through the reactor coolant piping is approximately five times the maximum flow rate from the accumulator during injection. Therefore, fluid impingement on reactor vessel components during operation of the accumulator is not restricting Emergency Flow to the Core 44 of 215 IPEC00035653 IPEC00035653

IP3 FSAR UPDATE Special attention is given to factors that could adversely affect the accumulator and safety injection flow to the core. These factors are:

Steam binding in the core, including flow blockage due to loop sealing Loss of accumulator water during blowdown Short circuiting of the accumulator from the core to another part of the Reactor Coolant System Loss of accumulator water through the breaks.

All of the above are considered in the analysis and are discussed quantitatively in Chapter 14.

External Recirculation Loop Leakage The Authority has established a program to identify and reduce leakage from systems outside containment that would or could contain highly radioactive fluids during a serious transient or accident.

The following systems are included in the subject program for leak identification and reduction:

Chemical and Volume Control System a) Volume Control Tank up to the outlet isolation valve including gas space b) RCP seal return line from the containment penetration to the VCT Residual Heat Removal System Suction to pumps form Loop 32 Discharge of pumps to containment Safety Injection System a) Recirculation path from containment sump thru RHR pumps to RHR heat exchanger and to safety injection pump suction b) Recirculation path from recirculation pump discharge to safety injection pump suction c) Safety injection pump discharge path to containment d) Boron injection tank e) Alternate recirculation path from the containment sump thru the RHR pump to the suction of 32 SI pump (bypassing the RHR heat exchanger).

Primary Sampling System a) Reactor Coolant Hot Leg Sample 45 of 215 IPEC00035654 IPEC00035654

IP3 FSAR UPDATE b) Recirculation Pumps Sample c) RHR Loop Sample d) Volume Control Tank Sample up to the outlet isolation valve Post-Accident Containment Air Sampling System a) Sample from Containment and return to Containment.

6) Containment Hydrogen Monitoring System a) From Containment and to Containment Leakage detection exterior to the Containment is achieved through use of sump tank and waste holdup tank level detection. The Primary Auxiliary Building sump pumps start automatically in the event that liquid accumulates in the sump. Valving is provided to permit the operator to individually isolate the residual heat removal pumps.

Pump NPSH Requirements Residual Heat Removal Pumps The NPSH of the residual heat removal pumps is evaluated for normal plant shutdown operation, and both the injection and recirculation phase operation of the design basis accident.

The residual heat removal pumps are used as backup to the internal recirculation pumps in the event of failures to the normal recirculation path; this duty provides the pumps with the minimum NPSH condition. The flow produced by one (1) RHR Pump, operating in conjunction with one (1) RHR heat Exchanger, is presently throttled to 5000 gpm to avoid flow-induced vibrations of the heat exchanger tube bundle. When one (1) RHR Pump delivers flow through both RHR Heat Exchangers, the combined flow will be throttled to less than 4500 gpm. At this flow rate, the NPSH margin is 15%.

Safety Injection Pumps The NPSH for the safety injection pumps is evaluated for both the injection and recirculation phase operation of the design basis accident. The end of injection phase operation gives the limiting NPSH requirement, and the NPSH available is determined from the elevation head and vapor pressure of the water in the refueling water storage tank and the pressure drop in the suction piping from the tank to the pumps. At the end of the injection phase, 40 percent N PSH margin is available assuming all three safety injection pumps running at run-out condition together with two RHR pumps at design flow.

Recirculation Pumps The NPSH for the recirculation pumps is evaluated for recirculation operation. The NPSH available is determined from the elevation head of the water above the pump inlet in the sump.

46 of 215 IPEC00035655 IPEC00035655

IP3 FSAR UPDATE The internal recirculation pumps are conventional vertical condensate pumps which in the past have been used with NPSH control. This type control used the NPSH available in the condenser hot well to control the discharge condition of the pump thus resulting in continuous pump cavitation. No approach to cavitating conditions are anticipated for the normal case of two pumps operating. If, however, only one pump is delivering through two heat exchangers with full saturated fluid, the operator is advised to throttle back via the heat exchanger butterfly valves to avoid long term operation at or near cavitating conditions. For cases in which a single recirculation pump is providing flow for both core cooling and containment spray, the pump may be expected to operate in a cavitating mode while recirculation spray is in service.

6.2.4 Minimum Operating Conditions The Technical Specifications establish limiting conditions regarding the operability of the system when in MODES 1, 2, 3, and 4.

6.2.5 Inspections and Tests Inspection All components of the Safety Injection System are inspected periodically to demonstrate system readiness.

The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves during system testing.

In addition, to the extent practical, the critical parts of the reactor vessel internals, pipes, valves and pumps are inspected visually or by boroscopic examination for erosion, corrosion, and vibration wear evidence and for non-destructive test inspection where such techniques are desirable and appropriate.

Pre-Operational Testing Component Testing Pre-operational performance tests of the components were performed in the manufacturer's shop. The pressure-containing parts of the pump were hydrostatically tested in accordance with Paragraph UG-99 of Section VIII of the ASME Code. Each pump was given a complete shop performance test in accordance with Hydraulic Institute Standards. The pumps were run at design flow and head, shutoff head and at additional points to verify performance characteristics. NPSH was established at design flow by means of adjusting suction pressure for a representative pump.

The remote operated valves in the Safety Injection System are motor operated. Shop tests for each valve included a hydrostatic pressure test, leakage tests, a check of opening and closing time, and verification of torque switch and limit switch settings. The ability of the motor operator to move the valve with the design differential pressure across the gate was demonstrated by opening the valve with an appropriate hydrostatic pressure on one side of the valve.

The recirculation piping and accumulators were initially hydrostatically tested at 150 percent of design pressure.

47 of 215 IPEC00035656 IPEC00035656

IP3 FSAR UPDATE The service water and component cooling water pumps were tested prior to initial operation.

System Testing Initial functional tests of the core cooling portion of the Safety Injection System were conducted before initial plant startup. These tests were performed following the flushing and hydrostatic testing of the system and with the Reactor Coolant System cold. The Safety Injection System valving was set initially to simulate the system alignment for Plant Power Operation.

The functional tests were divided into two parts:

1) Demonstrating the proper function of instrumentation and actuation circuits, confirm valve operating times, confirm pump motor starting times, and demonstrate the proper automatic sequencing of load addition to the emergency diesels.

These tests were repeated for the various modes of operation needed to demonstrate performance at partial effectiveness, i.e., to demonstrate the proper loading sequence with two of the three emergency diesels, and to demonstrate the correct automatic starting of a second pump should the first pump fail to respond.

These tests were performed without delivery of water to the Reactor Coolant System, but included the starting of all pumping equipment involved in each test.

2) Demonstrating the proper delivery rates of injection water to the Reactor Coolant System.

To initiate the first part of the test, the safety injection block switch was moved to the unblock position to provide control power allowing the automatic actuation of the safety injection relays from the low water level and low-pressure signals from the pressurizer instrumentation.

Simultaneously, the breakers supplying outside power to the 480 volt buses were tripped manually and operation of the emergency diesel system automatically commences. The high-head safety injection pumps and the residual heat removal pumps were started automatically following the prescribed diesel loading sequence. The valves were operated automatically to align the flow path for injection into the Reactor Coolant System.

The second portion of the test was initiated by manually starting individual pumps on mini-flow and manually opening the appropriate isolation valve to deliver water to the Reactor Coolant System. Data was taken to verify proper pump performance and flow delivery rates.

The systems were accepted only after demonstration of proper actuation and after demonstration of flow delivery and shutoff head within design requirements.

Post-Operational Testing Component Testing Routine periodic testing of the Safety Injection System components and all necessary support systems at power is performed. The safety injection and residual heat removal pumps are to be tested in accordance with the Indian Point 3 Inservice Testing Program, to check the operation of the starting circuits, verify the pumps are in satisfactory running order, and verification is made that required discharge head is attained. No inflow to the Reactor Coolant System occurs whenever the reactor coolant pressure is above 1500 psi. If testing indicates a need for 48 of 215 IPEC00035657 IPEC00035657

IP3 FSAR UPDATE corrective maintenance, the redundancy of equipment in these systems permits such maintenance to be performed without shutting down or reducing load under conditions defined in the Technical Specifications. These conditions include the period within which the component should be restored to service.

The operation of the remote stop valves in the accumulator tank discharge line may be tested by opening the remote test valves just downstream of the stop valve. Flow through the test line can be observed on instruments and the opening and closing of the discharge line stop valves can be sensed on this instrumentation. Test circuits are provided to periodically examine the leakage back through the check valves and to ascertain that these valves seat whenever the Reactor Coolant System pressure is raised.

This test is routinely performed when the reactor is being returned to power after an outage and the reactor pressure is raised above the accumulator pressure. If leakage through a check valve should become excessive, the isolation valve would be closed (the safety injection actuation signal will cause this valve to open should it be in the closed position at the time of a Loss-of-Coolant Accident). The performance of the check valves has been carefully studied and it is concluded that it is highly unlikely that the accumulator lines would have to be closed because of leakage.

The recirculation pumps are normally in a dry sump. Minimum flow testing of these pumps can be performed during refueling operations by filling the recirculation sump and opening the mini flow valve on the discharge of the pump and directing the flow back to the sump. Those service water and component cooling pumps which are not running during normal operation may be tested by alternating with the operating pumps.

The content of the accumulators, the Boron Injection Tank and the Refueling Water Storage Tank are sampled periodically to determine that the required boron concentration is present.

System Testing System testing can be conducted during plant shutdown to demonstrate proper automatic operation of the Safety Injection System. A test signal is applied to initiate automatic action and verification made that the components receive the safety injection signal in the proper sequence. The Safety Injection and Residual Heat Removal pumps are blocked from starting.

Isolation valves in the injection lines are blocked closed so that flow is not introduced into the reactor coolant system. The system test demonstrates the operation of the valves, pump circuit breakers, and automatic circuitry. The test is considered satisfactory if control board indication and visual observations indicate all components have operated and sequenced properly. A complete system test cannot be performed when the reactor is operating because a safety injection signal would cause a reactor trip. The method of assuring complete operability of the Safety Injection System is to combine the system test performed during plant shutdown with more frequent component tests, which can be performed during reactor operation.

The accumulators and the injection piping up to the final isolation valve are maintained full of borated water while the plant is in operation. The accumulators and the high head injection lines are refilled with borated water as required by using the safety injection pumps to recirculate refueling water through the injection lines. A small test line is provided for the purpose in each injection header.

49 of 215 IPEC00035658 IPEC00035658

IP3 FSAR UPDATE Flow in each of the safety injection headers and in the main flow line for the residual heat removal pumps is monitored by a local flow indicator. Pressure instrumentation is also provided for the main flow paths of the safety injection and residual heat removal pumps. Accumulator isolation valves are blocked closed for this test.

The eight-switch sequence for recirculation operation may be tested following the above injection phase test to demonstrate proper sequencing of valves and pumps. The recirculation pumps are blocked from starting during this test.

The external recirculation flow paths are hydrotested during periodic retests at the operating pressures. This is accomplished by running each pump which could be utilized during external recirculation (safety injection and residual heat removal pumps) in turn at near shutoff head conditions and checking the discharge and recirculation test lines. The suction lines are tested by running the residual heat removal pumps and opening the flow path to the safety injection pumps in the same manner as described above.

During the above test, all system joints, valve packings, pump seals, leak-off connections or other potential points of leakage are visually examined. Valve gland packing, pump seals and flanges are adjusted or replaced as required to reduce the leakage to acceptable proportions.

For power operated valves, final packing adjustments are made, and the valves are put through an operating cycle before a final leakage examination is made.

The entire recirculation loop except the recirculation line to the residual heat removal pumps is pressurized during periodic testing of the Engineered-Safety Features components. The recirculation line to the residual heat removal pump is capable of being hydrotested during plant shutdown, and it is also leak tested at the time of the periodic retests of the Containment.

In the event of any modification to the high head safety injection system piping and/or valve arrangement, a system flow test is required. System flow testing establishes and verifies that the actual performance capability of the system is within minimum calculated safety analysis flow ranges.

References

1) Bell, M. J. et ai., "Investigations of Chemical Additives for Reactor Containment Sprays,"

WCAP-7153 (Westinghouse Confidential), March 1968.

2) Revised Feasibility Report for BIT Elimination for Indian Point Unit 3, dated July 1988 (Westinghouse).

3) Modification MOD 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I."

4) Nuclear Safety Evaluation No. NSE 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I."

5) Classification CLAS 86-03-150 SIS, "Elimination of Boron Injection Tank, Phase I."

6) FSAR, Section 14.2.5

7) Engineering Study of NYPS IP3, lOP Pump Model 244 PK-3, "Internal Recirculation Pump," Revision Aug. 4,1997 (IP3-RPT-UNSPEC-02568) 50 of 215 IPEC00035659 IPEC00035659

IP3 FSAR UPDATE

8) NYPA Calculation IP3-CALC-VC-02513, "IP3 Sump Water Level Following LBLOCA-DEPSG."

9) NYPA Calculation IP3-CALC-SI-02430, "NPSHA / NPSHR for SI Internal Recirculation Pumps 31 and 32."

10) Westinghouse Calculation SEE-04-24, "Hydraulic Performance of the Containment Recirculation Pumps (lngersol-Rand 24APK-3) forIP3."

51 of 215 IPEC00035660 IPEC00035660

IP3 FSAR UPDATE TABLE 6.2-1 SAFETY INJECTION SYSTEM - CODE REQUIREMENTS Components Code Refueling Water Storage Tank A WWA D1 00-67 Residual Heat Removal Heat Exchanger Tube Side ASME Section III Class C Shell Side ASM E Section VIII Accumulators ASME Section III Class C Boron Injection Tank ASM E Section III Class C Valves ANSI B16.5 (1955)

Piping ANSI B31.1 (1967)

TABLE 6.2-2 ACCUMULATOR DESIGN PARAMETERS Quantity 4 Type Stainless Steel lined/carbon steel Design Pressure, psig 700 Design Temperature, of 300 Operating Temperature, of #130 Normal Operating Pressure, psig 650 Minimum Operating Pressure, psig 615 Total Volume, fe 1100 Minimum/Maximum Water Volume at Operating Conditions, fe 775/815 Minimum/Maximum Boron Concentration - Normal Operating 2000/2600 Conditions (as boric acid), ppm Relief Valve Set Point, psig* 700

• The relief valves have soft seats and are designed and tested to ensure zero leakage at the normal operating pressure.

52 of 215 IPEC00035661 IPEC00035661

IP3 FSAR UPDATE TABLE 6.2-3 BORON INJECTION TANK DESIGN PARAMETERS QUANTITY 1 Total Volume, gal 900 Boron Concentration (as boric acid) nominal, ppm 21,000**

Design Pressure, psig 1750 Design Temperature, of 300 Operating Pressure, psig 0-1500*

Operating Temperature, of 150 - 180***

Material Stainless Steel Number of Strip Heaters 12 (permanently de-energized)

Heater Capacity, each, kW 1 (permanently de-energized)

• 1500 psig is normal maximum, but could reach 1670 psig for short periods.

• • Actual boron concentration is maintained at approximately 2500 ppm.

• • • Actual operating temperature is ambient.

TABLE 6.2-4 REFUELING WATER STORAGE TANK DESIGN PARAMETERS Quantity 1 Material Stainless Steel Total Tank Capacity at Overflow, gal 355,200 Nominal Water Volume, gal 342,200 Normal Pressure, psig Atmospheric Operating Temperature, of Above freezing Design Pressure, psig Atmospheric Design Temperature, of 120 Minimum/Maximum Boron Concentration - Normal Operating 2400/2600 Conditions (as boric acid), ppm Type of heating Steam 53 of 215 IPEC00035662 IPEC00035662

IP3 FSAR UPDATE TABLE 6.2-5 PUMP DESIGN PARAMETERS I Safety Injection Pump Quantity 3 Design Pressure, discharge, psig 1700 Design Pressure, suction, psig 250 Design Temperature, of 300 Design Flow Rate, gpm 400 Maximum Flow Rate, gpm 675 NPSH Required at Maximum Flow Rate, ft 35 Design Head, ft 2500 Design Shutoff Head, ft 3500 Material Austenitic Stainless Steel Type Horizontal, centrifugal Motor Horsepower 400 I Recirculation Pump Quantity 2 Type Vertical, centrifugal Design Pressure, discharge, psig 250 Design Temperature, of 300 Design Flow, gpm 3000*

Design Head, ft 350 Material Austenitic Stainless Steel Maximum Flow Rate, gpm 4000 Shutoff Head, ft 515 Motor Horsepower 350

• Recirculation flow may exceed 3000 gpm whenever a single pump is providing both core cooling and containment spray flow.

PUMP DESIGN PARAMETERS Residual Heat Removal Pump Quantity 2 Type Vertical, centrifugal Design Pressure, discharge, psig 600 Design Temperature, of 400 Design Flow, gpm 3000 Design Head*, ft 350 Material Austenitic Stainless Steel Maximum Flow Rate, gpm 4500 Design Shutoff Head*, ft 390 Motor Horsepower 400

• For analytical purposes these deSign values should be reduced by 18 ft. to allow for pump wear (See Figure 6.2-3).

54 of 215 IPEC00035663 IPEC00035663

IP3 FSAR UPDATE TABLE 6.2-6 RESIDUAL HEAT REMOVAL SYSTEM HEAT EXCHANGERS DESIGN PARAMETERS Number 2 Type Vertical shell and U-tube Heat exchanged, Btu/hr 30.8 x 106 Fouled transfer rate, Btu/hr-oF-ft2 309 Clean transfer rate, Btu/hr- °F-ff 410 Surface area, ft2 3579 Overall heat transfer coefficient*, Btu/hr-oF 1.1 x 106 Design cycles (85°F - 350°F) 200 Design Conditions:

Parameter Tube Side Shell Side Pressure, psig 600 150 Temperature, of 400 200 6

Flow,lb/hr 1.44 x 10 2.46 X 106 Inlet temperature, of 135 95 Outlet temperature, of 113.5 100.8 Material Stainless Steel Carbon Steel

• Fouled transfer rate multiplied by the design surface area.

55 of 215 IPEC00035664 IPEC00035664

IP3 FSAR UPDATE TABLE 6.2-7 SINGLE ACTIVE FAILURE ANALYSIS - SAFETY INJECTION SYSTEM Component Malfunction Comments A. Accumulator (injection Deliver to broken loop Totally passive system with one phase) accumulator per loop. Evaluation based on three accumulators delivering to the core and one spilling from ruptured loop B. Pump: (injection and recirculation phase as marked)

1) Safety injection Fails to start Three provided. Evaluation based on operation of two

2) Residual heat removal Fails to start Two provided. Evaluation based on operation of one plus at least two safety injection pumps

3) Component cooling* Fails to start A total of 1 of 3 required during recirculation

4) Conventional and Fails to start A total of 3 of 6 required during nuclear service water* recirculation

5) Recirculation* Fails to start Two provided. One required to operate during recirculation

6) Auxiliary component Fails to start Two pairs provided. One required cooling per pair to operate during injection C. Automatically Operated Valves: (Repositioned on Safety Injection Signal) - (Injection phase)

Boron Injection Tank Isolation Inlet (Valves 1852A Fails closed Valves are normally open in two parallel

& 1852B) lines, one valve in either line remains open Outlet (Valves 1835A Fails closed

& 1835B) Valves are normally open in two parallel lines, one valve in either line remains open

2) Accumulator Fails closed All four valves are normally open during discharge valves power operation with AC power (894A-D removed

3) Boron injection tank Fails closed Flowpath is isolated by locked closed recirculation isolation valves 1844,1848, 1198A and 1198B valves (1851A1B)

4) Residual heat Fails to start Cross-over line provided to assure removal line isolation sufficient flow for closure of any valve valve at residual heat with two RHR pumps running exchanger discharge (valves 638,640, 746, 747, 899A, 56 of 215 IPEC00035665 IPEC00035665

IP3 FSAR UPDATE 899B)

TABLE 6.2-7 (Cont.)

SINGLE ACTIVE FAILURE ANALYSIS - SAFETY INJECTION SYSTEM Component Malfunction Comments

5) Isolation valve on Fails to open Two parallel, one valve in either line is component cooling required to open water line from residual heat exchangers (valves 822A & 822B)

D. Power Operated Valves: (Spurious Repositioning) (I njection Phase)

1) Safety injection Fails closed Valves are normally open during power pump recirculation operation with AC power removed isolation valves (842, 843)

2) Residual heat Fails closed Valves are normally open during power removal recirculation operation with AC power removed isolation valves (743, 1870)

3) Refeueling water Fails closed Valves are normally open during power storage tank suction operation with AC power removed isolation removal line isolation valves (1810,882)

4) Residual heat Fails closed Valve is normally open during power operation removal pump with AC power removed discharge header isolation valve (744)

5) High-head safety Fails open Valves are normally closed during power injection header hot operation with AC power removed leg isolation valves (856B, 856G)

6) High-head safety Fails closed Valves are normally open during power injection header cold operation with AC power supplied. The leg isolation valves reduced flow capability with single valve (856C, 856E, 856H, closure is analyzed by the flow delivery of all 856J) three safety injection pumps E. Emergency Power: (injection or recirculation phase)

1) Emergency Diesel 31 Fails to run Two of three safety injection pumps, one of two residual heat removal pumps and two of two recirculation pumps available to operate

2) Emergency Diesel 32 Fails to run Two of three safety injection pumps, one of two residual heat removal pumps and one of two recirculation pumps available to operate

3) Emergency Diesel 33 Fails to run Two of three safety injection pumps, two of two residual heat removal pumps and one of 57 of 215 IPEC00035666 IPEC00035666

IP3 FSAR UPDATE two recirculation pumps available to operate F. Valves Operated from Control Room for Recirculation (recirculation phase)

1) Recirculation internal Fails to open Two valves in parallel, one valve in either line recirculation isolation is required to open (valves 1802A &

1802B)

2) Safety injection pump Fails to open Two valves in parallel, one valve is required to suction valve at open residual heat exchanger discharge (valves 888A &

888B)

3) Isolation valve on the Fails to close Two valves in series, one required to close miniflow line returning to the refueling water storage tank (valves 842 & 843)

4) Isolation at suction Fails to close Two valves in series, one required to close header from (one valve is a check valve)

Refueling Water Storage Tank to safety injection pumps (valves 1810

& 847)

5) Residual heat Fails to close Two valves in series, one required to close removal pump recirculation line (valves 743 & 1870)

6) Residual heat Fails to close Two valves in series, one required to close removal pump (one valve is a check valve) discharge line (valve (744 and check valve 741)

7) Residual heat Fails to close Two valves in series in each of two parallel removal line isolation lines; one valve of each pair is required to valves at residual close heat exchanger discharge (valves 746 & 899A and 747

& 899B)

8) Isolation valves for Fails to open Two valves, one in each of two parallel lines, high head hot leg one valve is required to open recirculation (Valves 856B and 856G)

9) Safety injection Fails to close Two valves provided in series; only one valve pump 32 suction required to isolate high-head recirculation isolation valves suction flow paths (887A/B) 58 of 215 IPEC00035667 IPEC00035667

IP3 FSAR UPDATE TABLE 6.2-7 (Cont.)

SINGLE ACTIVE FAILURE ANALYSIS - SAFETY INJECTION SYSTEM

10) High-head safety Fails open Valves have AC power until realignment to injection header hot high-head hot leg recirculation to prevent leg isolation valves spurious mispositioning (856B, 856G)

11) High-head safety Fails closed Valves are normally open during cold leg injection header cold recirculation. The spurious closure of one leg isolation valves valve results in adequate flow performance (856C, 856E, 856H, with only two safety injection pumps operating.

856J)

12) High-head safety Fails open Valves have AC power removed following injection header cold realignment to high-head hot leg recirculation leg isolation valves to prevent spurious mispositioning (856C, 856E, 856H, 856J)

13) High-head safety Fails closed Valves have AC power removed following injection header hot realignment to high-head hot leg recirculation leg isolation valves to prevent spurious mispositioning (856B, 856G)

14) Limit switches on Fails to stop valve Fully open valve causes pump failure in high-head safety in throttled affected header. Remaining header provides injection header hot position while adequate flow for core cooling. (Note that leg isolation valves opening 8568 is normally full open by design for hot (856B, 856G) leg injection.)

15) Boron Injection Tank Fails to open If closed during low head recircula-tion, one Outlet Isolation valve in either parallel line is required to open Valves, (1835A1B) during transfer to leg recirculation.

• Recirculation phase Note: The status of all active components of the Safety Injection System is indicated on the main control board. Reference is made to Table 6.2-12.

59 of 215 IPEC00035668 IPEC00035668

IP3 FSAR UPDATE TABLE 6.2-8 LOSS OF RECIRCULATION FLOW PATH Flow Path Indication of Loss of Flow Path Alternate Flow Path Low Head Recirculation 1. Insufficient flow in low head From recirculation pump injection lines (one flow to high head injection From recirculation sump to monitor in each of the four low header via the recircula-low head injection header head injection lines*) tion pumps, one of the via the recirculation pumps two residual heat ex-and the residual heat changers and the safety exchanger. injection pump.**

2. As 1 above. From recirculation sump to discharge header of the residual heat exchanger via the residual heat removal pumps.

b. If flow is not established in low head injection lines -

as (a), except path is from discharge of one residual heat ex-changer to the high head injection header via the safety injection pumps.

High Head Recirculation 1. No flow in high head injection a. From containment header (three flow monitors, sump to high head From recirculation sump to one in each injection line, and injection header via high head injection header one pressure monitor). (Note: the residual heat via the recirculation pumps, One of the four cold leg lines removal pumps, one one of the two residual heat per header has been isolated of the two residual exchangers and the high by a locked closed valve.) heat exchangers and head injection pumps. the high head injection pumps.

Note: As shown on Plant Drawings 9321-F-27353 and 27503 [Formerly Figures 6,2-:1A and -

Bl, there are valves at all locations where alternative flow paths are provided.

• With the flow meters on three or more lines indicating greater than zero and with the lowest of these flows at least 360 gpm, .::!:.10 gpm, or with zero flow indicated on two lines and the lowest flow meter for each of the remaining lines reading at least 360 gpm, .::!:. 10 gpm, the supply of recirculated water using low head recirculation will maintain the core flooded even in the event of a low head line spilling and one failed flow meter or other single failure.

60 of 215 IPEC00035669 IPEC00035669

IP3 FSAR UPDATE TABLE 6.2-8 (Cant.)

LOSS OF RECIRCULATION FLOW PATH Flow Path Indication of Loss of Flow Path Alternate Flow Path

b. If flow is not established in high head injection header

- as (a) except path is from discharge of the residual heat removal pumps to the high head injection pumps via safety injection pump 32 (by-passing the residual heat exchangers*) .

2. Flow in only one of the two a. as 1 (b) except that high head injection branch flow from safety headers (three flow monitors injection pump 32 is per branch header). (Note: only supplied to the One of the four cold leg lines unbroken branch per header has been isolated header.

by a locked closed valve.)

NOTE: As shown on Plant Drawings 9321-F-27353 and 27503 [Formerly Figures 6.2-1A and

-B]" there are valves at all locations where alternative flow paths are provided.

• In this recirculation mode, water is returned to the core without being cooled by the residual heat exchangers. Heat is removed from the core by boil-off of the water to the Containment; heat is then removed from the Containment by either the containment fan coolers or/and the Containment Spray System (using cooled water from the recirculation sump via the recirculation pumps and one residual heat exchanger).

61 of 215 IPEC00035670 IPEC00035670

IP3 FSAR UPDATE TABLE 6.2-9 SHARED FUNCTIONS EVALUATION Normal Operating Com onent Arran ement Accident Function Boron Injection Tank (BIT) None Lined up to discharge of None* Lined up to discharge of safety injection pumps safety injection pumps Refueling Water Storage Storage tank for refueling Lined up to suction of safety Source of borated water Lined up to suction of Tank operations injection, residual heat for core and spray safety injection, residual removal, and spray pumps nozzles heat removal and spray pumps Accumulators (4) None Lined up to cold legs of Supply borated water to Lined up to cold legs of reactor coolant piping core promptly reactor coolant piping Safety Injection Pumps (3) Accumulator fill. Core Lined up to hot and cold legs Supply borated water to Lined up to cold legs of cooling inventory makeup of reactor coolant piping core reactor coolant piping during RCS reduced inventory Residual Heat Removal Supply water to core to Lined up to cold legs of Supply borated water to Lined up to cold legs of Pumps 92) remove residual heat reactor coolant piping core reactor coolant piping during shutdowns Recirculation Pumps (2) None Lined up to cold legs of Supply borated water to Lined up to cold legs or reactor coolant piping, spray core and spray nozzles reactor coolant piping headers and suction of safety from recirculation sump spray headers, and suction injection pumps of safety injection pumps

• A modification replaced the concentrated boric accident in the BIT with refueling water, however, no credit is taken for any boron in the BIT by current accident analyses (Refer to FSAR Section 14.2.5).

"U m

()

-u 0 m 0 0 0 0 eN 0 01 62 of 215 0 (J) 0)

-...I (J1 (J)

......

-....J

--"

IP3 FSAR UPDATE TABLE 6.2-9 (Cont.)

SHARED FUNCTIONS EVALUATION Normal Operating Component Normal Operating Function Arrangement Accident Function Accident Arrangement Conventional Service Supply river cooling water Two pumps in service Supply river cooling *One or two pumps in Water Pumps (3) to component cooling heat water to component service exchangers (2) cooling heat exchanger (1) and safeguards components Component Cooling Supply cooling water to Two pumps in service Su pply cooling water to *One or two pumps in Pumps (3) station nuclear residual heat service components exchangers S.1. pumps bearings and recirculation pump motor coolers Residual Heat Exchangers Remove residual heat from Lined up for residual heat Cool water in Lined up for the discharge (2) core during shutdown removal pump operation containment sump for of recirculation pumps core cooling and containment spray Component Cooling Heat Remove heat from Two heat exchangers in Cool water for residual Both heat exchangers in Exchangers (2) component cooling water service heat exchangers and service core cooling pumps Auxiliary Component None Lined up for pump operation Provide component Lined up for pump Cooling Pumps (4) cooling water to operation recirculation pump motor coolers Nuclear Service Water Supply river cooling water One or two pumps in service Supply river cooling *Two or three pumps Pumps (3) to station safeguards and water to component depending on active failure non-nuclear components cooling heat exchanger (all are started (1) and safeguards automatically)

"U components m

• Recirculation phase

()

-u o m o oo o eN o 01 63 of 215 o0) (J)

(J1 -...I (J) tv

-....J N

IP3 FSAR UPDATE TABLE 6.2-10 ACCUMULATOR INLEAKAGE*

Frequency of Level Leak Rate/Maximum Adjustment Months Leak Rate (cc/hr) Allowable Leak Rate 1 787 7.87 3 262 2.62 6 131 1.31 7.9 100 1.00 9 87.4 0.874 12 65.6 0.656 "U

m

()

-u o m o oo o eN o 01 64 of 215 o0) (J)

(J1 -...I (J) eN

-....J 0)

IP3 FSAR UPDATE TABLE 6.2-11 INSTRUMENTATION READOUTS ON THE CONTROL BOARD FOR OPERATOR MONITORING DURING RECIRCULATION System Valves Valve Number SIS MOV 1802 A, B SIS MOV 1810 SIS MOV 885A,B SIS MOV 899 A, B SIS MOV 888 A, B SIS MOV 866 A, B SIS MOV 889 A, B SIS MOV 851 A, B SIS MOV 856, C, E, G SIS MOV 856 B, H, J SIS MOV 882 SIS MOV 842 SIS MOV 843 SIS MOV 1852 A, B SIS MOV 1835 A, B SIS AOV 1851 A, B SIS MOV 894 A, B, C, D SIS MOV 850 A, C ACS MOV 744 ACS MOV 745 A, B, SIS MOV 746 SIS MOV 747 SIS MOV 883 SIS MOV 887 A, B SIS AOV 1813 SIS MOV 1869 A, B SIS HCV638 SIS HCV640 "U

ACS MOV 743 m ACS MOV 1870

()

-u o m o oo o eN o 01 65 of 215 o0) (J)

(J1 -...I (J) .j:::o.

-....J

.j::>.

IP3 FSAR UPDATE TABLE 6.2-11 (Cont.)

INSTRUMENTATION READOUTS ON THE CONTROL BOARD FOR OPERATOR MONITORING DURING RECIRCULATION System Instruments Channel Number SIS FI 945 A, B SIS FI 946 A, B, C, D SIS FI 924 A SIS FI 925 SIS FI 926 (This line has been permanently locked closed:

isolated by valve SI-856A).

SIS FI 926 A (This line has been permanently locked closed:

isolated by valve SI-856F).

SIS FI 927 SIS FI 980 SIS FI 981 SIS FI 982 SIS LI 1251 SIS LI 1252 SIS LI 1253 SIS LI 1254 SIS LI 1255 SIS LI 1256 SIS PI 922 SIS PI 923 SIS PI 947 ACS PI 635 ACS FI 640 & FI 638 "U ACS LIT 628 & LIT 629 m ACS TR 639 & TR 641

()

-u o m o oo o eN o 01 66 of 215 o0) (J)

(J1 -....I (J) 01

-....J (J1

IP3 FSAR UPDATE RCS LRCA 459 RCS LlCA 460 RCS LlCA 461 RCS Ll462 SIS Safety Injection SW Service Water ACS Component Cooling SIS Containment Spray SIS Recirculation ACS Residual Heat Removal

"'U m

()

"'U o m o oo o eN o 01 67 of 215 o0) (J)

(J1 -...I (J) (J)

-....J (J)

IP3 FSAR UPDATE TABLE 6.2-12 QUALITY STANDARDS OF SAFETY INJECTION SYSTEM COMPONENTS RESIDUAL HEAT EXCHANGER Tests and Inspections

1. Hydrostatic Test

2. Radiograph of longitudinal and girth welds (tube side only)

3. UT of tubing or eddy current tests

4. Dye penetrant test of welds

5. Dye penetrant test of tube to tube sheet welds

6. Gas leak test of tube to tube sheet welds before hydro and expanding of tubes Special Manufacturing Process Control

1. Tube to tube sheet weld qualifications procedure

2. Welding and NOT and procedure review

3. Surveillance of supplier quality control and product COMPONENT COOLING HEAT EXCHANGER Test and Inspections Hydrostatic Test "U

m Dye penetrant test of welds

()

-u o m o oo o eN o 01 68 of 215 o0) (J)

(J1 -...I (J) -...I

-....J

-....J

IP3 FSAR UPDATE Special Manufacturing Process Control Welding and NOT and procedure review

2. Surveillance of supplier quality control and product QUALITY STANDARDS OF SAFETY INJECTION SYSTEM COMPONENTS SAFETY INJECTION, RECIRCULATION AND RESIDUAL HEAT REMOVAL PUMPS Tests and Inspections

7. Performance Test

8. Dye penetrant of pressure retaining parts*

9. HydrostatiC Test Special Manufacturing Process Control Weld, NOT and inspection procedures for review Surveillance of suppliers quality control system and product ACCUMULATORS Test and Inspections Hydrostatic test Radiography of longitudinal and girth welds Dye penetrant/magnetic particle of weld "U

m Special Manufacturing Process Control

()

-u o m o oo o eN o 01 69 of 215 o0) (J)

(J1 -...I (J) 00

-....J CD

IP3 FSAR UPDATE

1. Weld, fabrication, NOT and inspection procedure review

2. Surveillance of suppliers quality control and product VALVES A. Tests and Inspections a) 200 psi and 200 F or below (cast or bar stock)

Dye Penetrant Test Hydrostatic Test Seat Leakage Test

• Except Internal Recirculation Pump QUALITY STANDARDS OF SAFETY INJECTION SYSTEM COMPONENTS SAFETY INJECTION, RECIRCULATION AND RESIDUAL HEAT REMOVAL VALVES b) Above 200 psi and 200 F Forged Valves (2%" and larger)

1. UT of billet prior to forging

2. Dye penetrant 100% of accessible areas after forging

3. Hydrostatic test

4. Seal leakage test "U

m (ii) Cast Valves

()

-u o m o oo o eN o 0'1 70 of 215 o0) (J)

(J1 -...I (J) <D

-....J CD

IP3 FSAR UPDATE

1. Radiograph 100%*

2. Dye penetrant all accessible areas*

3. Hydrostatic test

4. Seat Leakage (c) Functional Test Required for:

1. Motor Operated Valves

2. Auxiliary Relief Valves B. Special Manufacturing Process Control

1. Weld, NOT, performance testing, assembly and inspection procedure review

2. Surveillance of suppliers quality control and product

3. Special Weld process procedure qualification (e.g. hard facing)

• For valves with radioactive service only QUALITY STANDARDS OF SAFETY INJECTION SYSTEM COMPONENTS REFUELING WATER STORAGE TANK A. Tests and Inspections Vacuum box test of tank bottom seams

2. Hydrostatic test of tank "U

m

()

-u o m o oo o eN o 01 71 of 215 o0) (J)

(J1 ex>

(J) o CD o

IP3 FSAR UPDATE

3. Hydrostatic test of tank heater coil

10. Spot radiography of longitudinal and girth welds B. Special Manufacturing Process and Material Control

1. Weld, fabrication, NOT and inspection procedure review

2. Surveillance of suppliers' quality control system and product

3. Material chemical and physical properties certification PIPING A. Test and Inspections Class 1501 and below Seamless or welded. If welded 100% radiography is required, shop fabricated and field fabricated pipe weld joints are inspected as follows:

2501 R - 601 R - 100% radiographic inspection and penetrant examination 301 R - 302 - 20% random radiographic inspection 151 R - 152R - 100% liquid penetrant examination B. Special Manufacturing Process Control Surveillance of suppliers' quality control and product "U

m

()

-u 0 m 0 0 0 0 eN 0 01 72 of 215 0 (J) 0)

ex>

(J1 (J)

......

CD

--"

IP3 FSAR UPDATE TABLE 6.2-13 NPSH REQUIREMENTS FOR CLASS 1 (SEISMIC) PUMPS NPSH Fluid Oper. P Elevation of Pump Operating Mode NPSH Req'd Avail. Temp. Atmospheric Pump*

0 Containment Two pumps taking suction from RWST @ 3,000 gpm 17.0 Ft 26.5 Ft 120 F 14.7 psia Approx.44' Spray (2) each & pumping to spray header - until Transfer to Recirculation.**

Two pumps taking suction from RWST @ 3,000 gpm 17.0 Ft 17.5 Ft 120 0 F 14.7 psia Approx.44' each and pumping to spray header - until Termination of CS Pump operation.***

0 Safety Injection Injection to RCS-3 SI pumps @ 650 gpm each 30.0 Ft 42.1 Ft 100 F 14.7 psia 37' -3" (3)

Recirculation to RCS-2 SI pumps @ 675 gpm each 35.0 Ft 79.9 Ft 256 0 F 138.7 psia 37' -3" (Fluid supplied by one internal recirculation pump) (Maximum) (Developed from This value used in discharge pressure NPSHA of internal calculation. Actual reci rcul ation pump suction pump(s)) centerline elevation is 36' 8.5" 0

Residual Heat Injection to RCS-2 RHR pumps @ 3,000 gpm each 11 Ft 59.4 Ft 100 F 14.7 psia 17' - 0" (2)

Internal Recir. Recirculation to RCS - one pump @ approx. 3,000 12.7 Ft (11.4@ 11.76 Ft**** 256 0 F Pressure 37' 4 y.," (1 S stage (1 ) gpm (indicated) 90% required as (Maximum) corresponding to impeller elevation) per vendor saturation approval) temperature of fluid in sump (33 psia max.)

Centerline of suction, except as noted.

Sufficient NPSH is available per IP3-CAL-CS-02590 Rev. 0 Bounding Case since Design Basis has only one CS Pump operating during this scenario.

• • • • Credits remainder of RWST water delivered into Containment prior to start of recirculation containment spray. (Ref. 8 and 9)

"'U m

()

-u o m o oo o eN o 01 73 of 215 o0) (J)

(J1 ex>

(J) tv CD N

IP3 FSAR UPDATE TABLE 6.2-13 (Cont.)

NPSH REQUIREMENTS FOR CLASS 1 (SEISMIC) PUMPS NPSH Fluid Oper. P Elevation of Pump Operating Mode NPSH Req'd Avail. Temp. Atmospheric Pump*

Compo Cooling One pump, post Accident recirculation; @ 5500 gpm 29.0 ft 31.9ftat 179 F0 14.7 psia 43' -3" Water (1) each 19r F (Maximum)

Motor Driven 20 ft 52 ft Ambient 14.7 psia 20' -0.5" Auxiliary (100° F Feedwater (2) Maximum)

Turbine Driven 16 ft 66 ft Ambient 14.7 psia 20' -3.5" Auxiliary (100 0 F Feedwater (1) Maximum)

IA Compr. less than 4 ft flooded 130 0 F 14.7 psia 16' -6" Closed Cooling (head tank)

Water (2)

Service Water 22 ft (6000 37.9 ft 28-95 F0 14.7 psia 8' -6" (Centerline (6) (vertical) gpm) of discharge) 29 ft (7500 gpm)

Diesel Fuel Oil 1 ft Subm. (Tk. 6.39 ft sub- 35-110 0 F 14.7 psia 40' (Approximate Transfer (3) Mounted) mergence centerline of (vertical) discharge)

Primary Water 5ft 33 ft 40-100 0 F 14.7 psia 41' (Floor)

Makeup (2)

ATTACHMENT TO TABLE 6.2-13 SAMPLE CALCULATION FOR HEAD LOSS DUE TO FRICTION TO VERIFY LOSS The Sample NPSH Calculation for Head Loss Due to Friction To Verify NPSH for the CS Pumps has been Superseded by IP3-CAL-CS-02590, "Containment Spray Pump NPSH Review."

"'U m

()

-u o m o oo o eN o 01 74 of 215 o0) (J)

(J1 ex>

(J) eN CD 0)

IP3 FSAR UPDATE ATTACHMENT TO TABLE 6.2-13 SAMPLE CALCULATION FOR HEAD LOSS DUE TO FRICTION TO VERIFY NPSH Ref: Perry's Chemical Engineering Handbook 4th Edition, page 603, equation 6-11 hss = static suction head = vertical distance between free level of source of supply and pump suction center line plus absolute pressure at the free level.

hfs = friction loss in suction line between source of supply and pump suction.

p = vapor pressure of liquid at pumping temperature Example: Containment Spray Pumps - two pumps operating @3000 gpm each "U

m

()

-u o m o oo o eN o 01 75 of 215 o0) (J)

(J1 ex>

(J) .j:::o.

CD

.j::>.

IP3 FSAR UPDATE 6.3 CONTAINMENT SPRAY SYSTEM 6.3.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design criteria, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts, 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Containment Heat Removal Systems Criterion: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure, this system shall perform its required function, assuming failure of any single active component. (GDC 52 of 7/11/67)

Adequate containment heat removal capability for the Containment is provided by two separate, full capacity, engineered safety feature systems: The Containment Spray System, whose components operate in the sequential modes discussed in 6.3.2, and the Containment Air Recirculation Cooling and Filtration System which is discussed in Section 6.4.

The primary purpose of the Containment Spray System is to spray cool water into the containment atmosphere (when appropriate) in the event of a Loss-of-Coolant Accident and thereby ensure that containment pressure does not exceed its design value of 47 psig at 271 F (100% R. H.). This protection is afforded for all pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop. Pressure and temperature transients for a Loss-of-Coolant Accident are presented in Chapter 14. Although the water in the core after a Loss-of-Coolant Accident is quickly sub-cooled by the Safety Injection System, the Containment Spray System design was based on the conservative assumption that the core residual heat is released to the Containment as steam.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the Containment as steam:

Both containment spray pumps (and one of the two spray valves in the recirculation path)

All five containment cooling fans (discussed in Section 6.4)

One containment spray pump and any three out of the five containment cooling fans.

76 of 215 IPEC00035685 IPEC00035685

IP3 FSAR UPDATE Inspection of Containment Pressure Reducing System Criterion: Design provisions shall be made to the extent practical to facilitate the periodic physical inspection of all important components of the containment pressure reducing systems, such as pumps, valves, spray nozzles and sumps. (GDC 58 of 7/11/67)

Where practicable, all active components and passive components of the Containment Spray System are inspected periodically to demonstrate system readiness. The pressure retaining components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves. During operational testing of the containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks. Design provisions for inspection of the Safety Injection System, which also functions as part of the Containment Spray System, are described in Section 6.2.5.

Testing of Containment Pressure Reducing Systems Components Criterion: The containment pressure reducing systems shall be designed, to the extent practical so that active components, such as pumps and valves, can be tested periodically for operability and required functional performance. (GDC 59 of 7/11/67)

All active components in the Containment Spray System were adequately tested both in pre-operational performance tests in the manufacturer's shop and by in-place testing after installation. Thereafter, periodic tests are also performed after any component maintenance.

Testing of the components of the Safety Injection System which are used for containment spray purposes is described in Section 6.2.5.

The component cooling water pumps and the conventional service water pumps which apply the cooling water to the residual heat exchangers are in operation on a relatively continuous schedule during plant operation. Those pumps not running during normal operation are tested periodically by changing the operating pump(s).

Testing of Containment Spray Systems Criterion: A capability shall be provided to the extent practical to test periodically the operability of the containment spray system at a position as close to the spray nozzles as is practical (GDC 60 or 7/11/67)

Permanent test lines for the containment spray loops are located so that all components up to the isolation valves at the spray nozzles may be tested. These isolation valves are checked separately.

The air test lines for checking that spray nozzles are not obstructed, connect downstream of the isolation valves. Air flow through the nozzles is monitored by means of the helium filled balloon method, or other suitable methods that can demonstrate that nozzles are not clogged.

Testing of Operational Sequence of Containment Pressure Reducing Systems Criterion: A capability shall be provided to test initially under conditions as close as practical to the design and the full operational sequence that would bring the containment 77 of 215 IPEC00035686 IPEC00035686

IP3 FSAR UPDATE pressure - reducing system into action, including the transfer to alternate power sources. (GDC 61 of 7/11/67)

Capability was provided to test initially, to the extend practical, the operational start-up sequence of the Containment Spray System including the transfer to alternate power sources.

Performance Objectives The Containment Spray System was designed to spray at least 5200 gpm of borated water, to which sodium hydroxide may be added when necessary, into the Containment whenever the coincidence of two sets of two-out-of-three (high-high) containment pressure (approximately 50% of design value) signals occurs or a manual signal is given. Either of two subsystems containing a pump and associated valving and spray header are independently capable of delivering more than one-half of the design delivery flow, or at least 2600 gpm, based on a pump design flow of at least 2600 gpm at a containment back pressure of 47.0 psig. Actual flow is reduced by up to 150 gpm due to the effect of eductor flow, resulting in a delivered flow of 2450 gpm per pump at a containment back pressure of 47.0 psig.

The design basis was to provide sufficient heat removal capability to maintain the post-accident containment pressure below 47 psig, assuming that the core residual heat is released to the Containment as steam.

A second purpose served by the Containment Spray System is to remove elemental airborne iodine from the containment atmosphere should it be released in the event of a Loss-of-Coolant Accident. The analysis showing the system's ability to limit offsite thyroid dose to within 10 CFR 100 limits after a hypothetical Loss-of-Coolant Accident is presented in Chapter 14. If all engineered safety features operate at design capacity, offsite doses will be limited to within the limits of 10 CFR 20.

The Containment Spray System was designed to operate over an extended time period following a Reactor Coolant System failure, as required to restore and maintain containment conditions at or near atmospheric pressure. It has the capability of reducing the containment post-accident pressure and consequent containment leakage.

Portions of other systems, which share functions and become part of the Containment Spray System when required, were designed to meet the criteria of this section. Neither a single active component failure in such systems during the injection phase, nor an active passive failure during the recirculation phase, will degrade the design heat removal capability of containment cooling.

System piping located within the Containment is redundant and separable in arrangement unless fully protected from damage which may follow any Reactor Coolant System loop failure.

System isolation valves relied upon to operate for containment cooling are redundant, with automatic actuation.

Service Life All portions of the system located within the Containment were designed to withstand, without loss of functional performance, the post-accident containment environment and operate without 78 of 215 IPEC00035687 IPEC00035687

IP3 FSAR UPDATE benefit of maintenance for the period of time needed to restore and maintain containment conditions at near atmospheric pressure.

Codes and Classifications Table 6.3-1 tabulates the codes and standards to which the Containment Spray System components were designed.

6.3.2 System Design and Operations

System Description

Adequate containment cooling and iodine removal are provided by the Containment Spray System, shown in Plant Drawings 9321-F-27353 and 27503 [Formerly Figures 6.2-1A and -B],

whose components operate in sequential modes. These modes are:

a) Spray a portion of the contents of the Refueling Water Storage Tank into the entire containment atmosphere using the containment spray pumps. During this mode, the contents of the spray additive tank (sodium hydroxide) are mixed into the spray stream to provide adequate iodine removal from the containment atmosphere by a washing action.

b) Recirculation of water from the containment sump by the diversion of a portion of the recirculation flow from the Safety Injection System to the spray headers inside the Containment after injection from the Refueling Water Storage Tank has been terminated.

The bases for the selection of the various conditions requiring system actuation are presented in Chapter 14.

The principal components of the Containment Spray System, which provides containment cooling and iodine removal following a Loss-of-Coolant Accident consist of two pumps, one spray additive tank, spray ring headers, nozzles, and the necessary piping and valves. The containment spray pumps and the spray additive tank are located in the Primary Auxiliary Building and the spray pumps take suction directly from the Refueling Water Storage Tank.

The Containment Spray System also utilizes the two 100% capacity recirculation pumps, two residual heat exchangers and associated valves and piping of the Safety Injection System for the long-term recirculation phase of containment cooling and iodine removal after the Refueling Water Storage Tank has been exhausted.

The spray water is injected into the containment through spray nozzles connected to four 360 degree ring headers located in the containment dome area. Each of the spray pumps supplies two of the ring headers.

Injection Phase The spray system will be actuated by the coincidence of two sets of two-out-of-three high-high level containment pressure signals. This starting signal will start the pumps and open the discharge valves to the spray headers. The valves associated with the spray additive tank will be opened on the same signal after a two-minute time delay.

79 of 215 IPEC00035688 IPEC00035688

IP3 FSAR UPDATE An automatic or manual spray initiation signal automatically opens the spray additive tank discharge valves, 876A and 876B. Because the addition of the spray additive (sodium hydroxide) could cause considerable damage to materials and equipment within the Containment, it is desirable to prevent any accidental opening of these valves. Each valve control circuit, therefore, has a timer which delays the opening of the valves for two minutes after receipt of an automatic or manual spray initiation signal. These timers block only the action of these two spray additive valves. All other spray related pumps and valves will function.

After two minutes, if no action has been taken by the operator, valves 876A and 986B will automatically open.

If during the two-minute delay interval, the operator determines that the spray signal is erroneous or not caused by an actual automatic ("Phase B" High-High Containment Pressure signal), or by a manually initiated spray signal, then depression of the "Sodium Hydroxide Cancel" push button on the main control board will prevent the spray additive valves (876A or 876B) from being opened. This "Sodium Hydroxide Cancel" push button will do nothing if operated prior to the initiation of the spray signal.

When the spurious spray signal has been removed or spray has been reset via the spray reset switch at the main control board, the "block" of the spray additive valves operation, which was initiated by the "cancel" switch, is automatically removed. Subsequent actual spray signals will automatically open these valves again after two minutes. The operator always has the ability to open valves 876A and 876B by use of their own individual control switches on the main control board.

As previously stated, after the containment spray signal is actuated, the operator has the capability to stop the timer if he determines that actuation of the sodium hydroxide addition is not warranted, and the operator also has the capability to reinitiate the sodium hydroxide addition. If required, the operator can manually actuate the entire system from the Control Room, and periodically, the operator will actuate system components to demonstrate operability. Additionally, two current indicators, one per containment spray pump motor, monitor their operation once they are started.

Any "P" signal received without an accompanying "T" (i.e., "S") signal is considered to be a spurious "P" signal. The "P" signal is actuated by the Phase B, (high-high level) high containment pressure; the "T" (i.e., "S") signal is actuated by the Phase "A" (high level) high containment pressure.

In order to terminate and reset the containment spray system, the following steps need to be performed:

1) Depress both CS RESET Buttons;

2) Stop the operating CS Pumps(s);

3) Close the opened discharge valve(s) (866A/866), and

4) Depress the Sodium Hydroxide CANCEL Button to initiate closure of the NaOH isolation valves (876A & 876B).

During the injection phase, approximately 150 gpm of the pump discharge flow is diverted from the spray pump discharge line to a spray eductor, where it mixes with the NaOH solution being drawn from the Spray Additive Tank. These liquids are entrained or mixed together before they re-enter the pumping suction piping. The result is a solution suitable for the removal of iodine from the containment atmosphere.

80 of 215 IPEC00035689 IPEC00035689

IP3 FSAR UPDATE During the injection phase, the safety injection and residual heat removal pumps inject borated water into the reactor and the Containment. Since these flow paths do not inject NaOH solution, the ratio of the total volume of fluid injected via the spray pumps to the total volume injected via the safety injection and residual heat removal pumps determines the sump pH after the injection phase.

To meet the containment sump conditions, the changeover from the injection phase to recirculation phase will be initiated after the injection of approximately 195,800 gallons of the Refueling Water Storage Tank capacity. Recirculation will commence after the changeover is completed and the remaining available 95,800 gallons will be injected into the Containment via one containment spray pump. By this procedure it can be assumed that even in the event of a failure to one spray pump train, a sump pH which assures continued iodine removal and retention effectiveness will be obtained. This 95,800 gallon volume allows for operator action to complete the transfer to recirculation before the RWST is completely depleted. Final emptying of the RWST can be accomplished via the Containment Spray Pumps after recirculation has begun, which assures that sump pH will be maintained within design.

Recirculation Phase When the Refueling Water Storage Tank is exhausted, or sufficient sump level is obtained recirculation spray flow will be initiated. The operator can remotely open the stop valves on either of the two spray recirculation lines. Throttle valves in the injection lines to the core split the recirculation flow so that at least 662 gpm is delivered to the core and the remainder to the spray headers. With this split flow, decay heat can be removed by boil-off and the containment pressure maintained below design.

After the two-hour containment scrubbing operations, it is expected that spray flow could be discontinued while maintaining containment pressure with the containment fan cooler units, and returning all of the recirculated water to the core. In this mode, the bulk of the core residual heat is transferred directly to the sump by the spilled coolant to be eventually dissipated through the residual heat exchanger once the sump water becomes heated. The heat removal capacity of three-out-of-five fan coolers is sufficient to remove the corresponding energy addition to the vapor space resulting from steam boil-off from the core, assuming flow into the core from one recirculation pump at the beginning of recirculation, without exceeding containment design pressure; hence, it is not expected that continued spray operation for containment heat removal would required. If, however, the containment pressure was observed to increase, then recirculation to the spray header may be resumed by operator action as described above.

Cooling Water The cooling water supply for the residual heat exchangers is discussed in Section 6.2.

Change-Over The sequence for the change-over from injection to recirculation is also discussed in Section 6.2.

Remotely operated valves of the Containment Spray System which are under manual control (that is, valves which normally are in their ready position and do not receive a containment spray signal) have their positions indicated on a common portion of the control board. At any time during operation, when one of these valves is not in the ready position for injection this is 81 of 215 IPEC00035690 IPEC00035690

IP3 FSAR UPDATE shown visually on the board. In addition, an audible annunciation alerts the operator as to the condition.

Charcoal Filter Dousing A dousing system is provided for the carbon filter bank of each fan cooler unit of the Containment Air Recirculation Cooling and Filtration System. Each dousing system can be supplied with water from the containment spray headers as shown in Plant Drawing 9321-F-27353 [Formerly Figure 6.2-1A]. The dousing system was designed to be started manually by the operator following indication of a fire in a carbon filter bank if high temperature conditions were to occur as a result of a failure of a fan. Further details of the dousing system are given in Section 6.4 Prior to initial operation, the lines connected to the Containment Spray Pumps were cleaned by means of a temporary strainer located on the suction side of the containment spray pumps.

This insured an adequate clean supply of water was available prior to initial plant operation.

These pump strainers were subsequently removed. During plant operation, the Refueling Water Storage Tank (RWST) can be purified by means of the RWST Purification System. This is permitted under administrative controls (i.e., an operator familiar with the operational restrictions of the RWST Purification System who is in contact with the Control Room). This system is connected to Residual Heat Removal (RHR) Pump suction line. The RWST is purified by pumping the water through the Spent Fuel Pit Demineralizer and the Spent Fuel Pit Filter before returning it to the RWST. Also, the RWST Purification pump suction piping originally contained a strainer which was subsequently removed. Thus, the water for the Containment Spray System, therefore, will be of adequate quality to prevent clogging of the spray nozzles for the 1)

Fan Cooler Unit carbon filter dousing system and 2) the spray ring headers located near the containment building dome. No other provisions are provided for filtering the RWST water.

Drain valves are also provided upstream of the carbon filter isolation dousing valves to prevent the unwanted passage of water from entering into the carbon filters during isolation valve testing.

During the post-LOCA recirculation mode of Safety Injection, Residual Heat Removal, and Containment Spray Systems operation, there are no provisions for filtering the water supplied to the carbon filter dousing system. While it is possible that one or more dousing nozzles could become clogged, a filter is not used for the following reasons:

a) The dousing system is placed into operation manually, only after indication of a fire.

b) A filter in the dousing water supply pipe to any of the five carbon filter units could itself become clogged and shut off all dousing water to that unit.

c) Within each carbon filter unit, there is a redundancy of spray nozzles since there is some overlapping of sprays.

d) Should one spray nozzle become clogged and the nearby carbon over- heats, a local fire could not spread since surrounding charcoal is being doused.

Components 82 of 215 IPEC00035691 IPEC00035691

IP3 FSAR UPDATE All associated components, piping, structures and power supplies of the Containment Spray System were designed to seismic Class I criteria.

All components inside containment are capable of withstanding or are protected from differential pressures which may occur during the rapid pressure rise to 47 psig in ten (10) seconds. The lines of the system are protected from missile damage by the concrete crane wall and operating floor.

Parts of the system in contact with borated water, the sodium hydroxide spray additive, or mixtures of the two are stainless steel or an equivalent corrosion resistant material.

The Containment Spray System shares the Refueling Water Storage Tank capacity with the Safety Injection System. For a detailed description of this tank, see Section 6.2 Pumps The two containment spray pumps are of the horizontal, centrifugal type driven by electric motors. The design head of each pump is sufficient to continue at rated capacity, with a minimum level in the Refueling Water Storage Tank, against a head equivalent to the sum of the design pressure of the Containment, the head to the uppermost nozzles, and the line and nozzle pressure losses. Each pump motor is direct-coupled and large enough to meet the maximum power requirements of the pump. Their operation is monitored via the current indicators in the Control Room. The materials of construction are suitable for use in sodium hydroxide and mild boric acid solutions, and are stainless steel or equivalent corrosion resistant material. Design parameters are presented in Table 6.3-2 and the containment spray pump characteristics are shown on Figure 6.3-1.

The containment spray pumps are designed in accordance with the specifications discussed for the pumps in the Safety Injection System, Section 6.2.

The recirculation pumps of the Safety Injection System, which provide flow to the Containment Spray System during the recirculation phase, are described in Section 6.2 Details of the component cooling pumps and service water pumps, which serve the Safety Injection System, are presented in Chapter 9.

Heat Exchangers The two residual heat exchangers of the Safety Injection System, which are used during the recirculation phase, are described in Section 6.2 Spray Nozzles The spray nozzles, which are of the hollow cone, ramp bottom design, are not subject to clogging by particles % inch or less in maximum dimension, and are capable of producing a surface area averaged drop diameter of approximately 1000 microns at 15 gpm and 40 psi differential pressure.

With the spray pump operating at design conditions and the Containment at design pressure, the pressure drop across the nozzles will exceed 40 psi.

83 of 215 IPEC00035692 IPEC00035692

IP3 FSAR UPDATE During spray recirculation operation, the water is screened through a 1/8 inch mesh before leaving the containment sump. The spray nozzles are stainless steel and have a 3/8 inch diameter orifice. The nozzles are connected to four 3601 ring headers (alternating headers connected) of radii 8' 2" (EI. 228.5'), 25' 4" (EI. 223.5'), 42' 3" (EI. 218.5'), and 59' 6" (EI. 213.5').

There are 315 nozzles distributed on the four headers. These nozzle and header arrangements result in maximum area coverage with either branch of the system operating alone, while assuring minimum overlap of spray trajectories in the minimum flow case. (See Chapter 14)

Spray Additive Tank The stainless steel spray additive tank is of sufficient capacity to contain enough sodium hydroxide solution which when mixed with: (1) the refueling water from the Refueling Water Storage Tank, (2) the boric acid from the boron injection tank, (3) the borated water contained within the accumulators, and (4) the reactor coolant, will bring the NaOH concentration in the final mixture in the containment sump to a pH level which assures the continued iodine removal and retention effectiveness of the containment sump water during the recirculation phase of operation after the supply of borated water in the Refueling Water Storage Tank has been exhausted.

A level indicating alarm is provided in the Control Room if, at any time, the solution tank contains less than the required amount of sodium hydroxide solution. Periodic sampling confirms that proper sodium hydroxide concentration exists in the tank. The design parameters are presented in Table 6.3-2.

Spray Additive Eductors The means of adding NaOH to the spray liquid is provided by a liquid jet eductor, a device which uses the kinetic energy of a pressure liquid to entrain another liquid, mix the two, and discharge the mixture against a counter pressure. The pressure liquid in this case is the spray pump discharge flow through the recirculation line of the pumps which is used to entrain the NaOh solution and discharge the mixture into the suction of the spray pumps. The two eductors were designed to provide a spray pH between the limits stated in Section 4.2 of Appendix 6A during the injection phase.

The spray additive eductor is a completely passive device which mixes the NaOH from the spray additive tank with the Refueling Water Storage Tank boric acid solution discharged by the spray pumps. The eductor functions similar to a piping "tee" and an orifice, and involves no moving parts. The motive force for the device is supplied by the spray pumps. The only "malfunctions" which could be postulated are, thus:

1) A completely passive failure of the material of construction of the eductor

2) A postulated reduction in the effectiveness of the operation of the eductor, i.e., an "active" failure of the device.

The first case is not considered credible, since the spray eductors are required only for the short-term (injection phase) operation following the accident.

The second situation, i.e., a single active failure, has been included in the design and evaluation of the spray additive system. Thus the minimum sump pH values given in Appendix 6D 84 of 215 IPEC00035693 IPEC00035693

IP3 FSAR UPDATE correspond to this situation of only one-out-of-two redundant spray additive trains functioning.

As stated previously in this section, when the injection phase is over, some 66,700 gallons of water will remain available in the Refueling Water Storage Tank and will be injected into the containment via one containment spray pump. This assures that minimum sump pH values can be achieved even in the event of failure of one spray pump train.

The eductors were given extensive performance tests at the manufacturer's facility. These tests verified eductor flow for varying suction and discharge conditions, duplicating both system operation and periodic testing, taking suction from the Refueling Water Storage Tank. Pre-operational testing, as part of the initial check out of the Containment Spray System, and periodic operational testing to demonstrate and assure readiness of the eductors and spray system are discussed in Section 6.3.5.

The spray and Emergency Core Cooling System solution will have a maximum pH of 10.0 and a minimum pH of 9.0 (See Appendix 60).

There is a sampling line on the discharge of the recirculation pumps that permits periodic remote sampling of the sump fluid. The primary means for adjusting the sump pH, following the LOCA, is through the use of the chemical mixing tanks and the charging pumps.

Valves The valves for the Containment Spray System were designed in accordance to the specifications discussed for the valves in the Safety Injection System (Section 6.2).

The piping for the Containment Spray system was designed in accordance to the specifications discussed for the piping in the Safety Injection System (Section 6.2).

The system was designed for 150 psig at 300 F on the suction side and 300 psig at 300 F on the discharge side of the spray pumps.

Motors for Pumps and Valves The motors inside and outside containment for the Containment Spray System were designed in accordance with the specifications discussed for motors in the Safety Injection System. (See Section 6.2)

Electrical Supply Details of the normal and emergency power sources are presented in the discussion of the Electrical Systems, Chapter 8.

Environmental Protection The spray headers are located outside and above the reactor and steam generator concrete shield. Another shield, which is removable for refueling, also provides missile protection for the area immediately above the reactor vessel. The spray headers are therefore protected from missiles originating within the Reactor Coolant System.

85 of 215 IPEC00035694 IPEC00035694

IP3 FSAR UPDATE Material Compatibility Parts of the system in contact with borated water, the sodium hydroxide spray additive, or mixtures of the two are of stainless steel or of an equivalent corrosion resistant material.

All exposed surfaces within the Containment have coatings which are not subject to interaction under exposure to the containment spray solution, with the exception of small amounts of aluminum associated with the nuclear flux instrumentation.

An evaluation of materials compatibility is given in Appendix 6E.

6.3.3 Design Evaluation Range of Containment Protection For up to the first 25 minutes following the maximum Loss-of-Coolant Accidents (i.e., during the time that the containment spray pumps take their suction from the Refueling Water Storage Tank), this system provides the design heat removal capacity for the Containment. After the injection phase, one spray pump continues to spray into the Containment for up to an additional thirty minutes. The single pump operation is continued primarily to guarantee that even under failure conditions sufficient sodium hydroxide will be present in the containment sump water.

This continued spray injection is also sufficient to maintain the containment pressure below the design value even if no containment fans were operating.

With the completion of containment spray injection, the operator sets up recirculation to one spray header and to the core; flows are adjusted so that sufficient cooled recirculated water is delivered to keep the core flooded as well as providing flow to one spray header. Flow is sufficient to maintain the containment pressure below the design value, if required.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the containment as steam:

• Both containment spray pumps (and one of the two spray valves in the recirculation path)

• All five containment cooling fans (discussed in Section 6.4)

• One containment spray pump and any three out of the five containment cooling fans.

For design basis accidents in which failure of any single diesel generator is assumed, the resulting equipment configuration is also adequate to satisfy containment cooling requirements.

During the injection and recirculation phases, the spray water is raised to the temperature of the Containment by falling through the steam-air mixture. The minimum fall path of the droplets is approximately 118 ft from the lowest spray ring headers to the operating deck. The actual fall path is longer due to the trajectory of the droplets sprayed out from the ring header. Heat transfer calculations, based upon 1000 micron droplets, show that thermal equilibrium is reached in a distance of approximately five feet. Thus the spray water reaches essentially the saturation temperature.

86 of 215 IPEC00035695 IPEC00035695

IP3 FSAR UPDATE At containment design pressure (47 psig), at least 2450 gpm of sodium hydroxide solution is injected into the containment atmosphere by one spray pump. At containment design temperature (271°F), the total heat absorption capability of one spray pump is approximately 205 x 106 Btu/hr based on the addition of 1100 F refueling water. The IP3 Stretch Power Uprate analysis were performed using 110°F refueling water.

When recirculation is initiated, approximately 95,800 gallons of refueling water is left available in the Refueling Water Storage Tank for spray pump usage. This supply is reserved to allow switchover to recirculation pumps, provide containment pressure relief and provide sump pH control via the containment spray system. When the Refueling Water Storage Tank is empty, or the sufficient sump level is obtained, the recirculation pumps supply the flow to the spray headers. Spraying of water from the sump into the containment atmosphere with one recirculation pump, after cooling to 134.rF with a residual heat exchanger, results in a heat removal rate of 1.63 x 108 Btu/hr at design temperature. This heat removal balances decay heat after 5000 seconds. The prior 2 sentences are a description of the capability of the original system design, at the original plant operating conditions. The performance of the Containment Spray System (at current operating conditions) in containment pressure reduction is discussed in Chapter 14.

In addition to heat removal, the spray system is effective in scrubbing fission products from the containment atmosphere. However, quantitative credit is taken only for absorption of reactive and/or soluble forms of inorganic iodine in the analysis of the hypothetical accident (Section 14.3). A discussion of the effectiveness of containment spray as a fission product trapping process is contained in Appendix 6A.

Any of the combinations of equipment (spray pumps and fans) required for containment heat removal will provide sufficient iodine trapping capability to ensure that post-accident fission product leakage (based on TID-14844 release fractions) does not result in exceeding the dose limits of 10 CFR 100. This is evaluated in Section 14.3.

System Response The starting sequence of the containment spray pumps and their related emergency power equipment was designed so that delivery of the minimum required flow is reached in 43 seconds.

The starting sequence is:

Sequence Seconds (max)

1) Initiation of safety injection Signal, including instrument lag* 2

2) Starting of emergency diesel generators 10

3) Starting of containment spray pumps 8 or 13

4) Acceleration and pipe fill time 32 Total - from event initiation 52 or 57 NOTE: If no LOOP, subtract 10 seconds.

Motor control centers are energized and valves are opened at the same time as the pumps are started. As described in Section 14.3, a delay of 60 seconds is assumed for the starting of the containment spray.

87 of 215 IPEC00035696 IPEC00035696

IP3 FSAR UPDATE Single Failure Analysis A failure analysis has been made on all active components of the system to show that the failure of any single active component will not prevent fulfilling the design function. This analysis is summarized in Table 6.3-4.

In addition, each spray header is supplied from the discharge of one of the two residual heat removal heat exchangers. As described in Section 6.2.3, these two heat exchangers are redundant and can be supplied with recirculated water via separate and redundant flow paths.

The analysis of the Loss-of-Coolant Accident presented in Chapter 14 reflects the single failure analysis.

• NOTE: To reduce inadvertent Safety Injection System Actuation due to instrumentation lags in the engineered safeguards system high steamline flow, low average temperature Tavg/Low steamline pressure coincidence circuitry, a time delay will be installed in each train (a maximum time delay of 6 seconds will meet the acceptance criteria for a steam line rupture).

Reliance on Interconnected Systems For the injection phase, the Containment Spray System operates independently of other Engineered Safety Features following a Loss-of-Coolant Accident, except that it shares the source of water in the Refueling Water Storage Tank with the Safety Injection System. The system acts as a backup to the Containment Air Recirculation Cooling and Filtration System for both the cooling and iodine removal functions. For extended operation in the recirculation mode, water is supplied through recirculation pumps.

During the recirculation phase, some of the flow leaving the residual heat exchangers may be diverted to the containment spray headers or the high head safety injection pumps. Minimum flow requirements are set for the flow being sent to the core and for the flow being sent to the containment spray headers such that at least 662 gpm is sent to the core. Sufficient flow instrumentation is provided so that the operator can perform appropriate flow adjustments with the remote throttle valves in the flow path as shown in Plant Drawing 9321-F-27S03 [Formerly Figure 6.2-1 B].

Normal and emergency power supply requirements are discussed in Chapter 8.

Shared Function Evaluation Table 6.3-5 is an evaluation of the main components which have been discussed previously and a brief description of how each component functions during normal operation and during the accident.

Containment Spray Pump NPSH Requirements The NPSH for the containment spray pumps is evaluated for injection operation. The beginning fill-up period of the injection phase gives the limiting NPSH requirements. The NPSH available is determined from the elevation head and vapor pressure of the water in the RWST and the 88 of 215 IPEC00035697 IPEC00035697

IP3 FSAR UPDATE pressure drop in the piping to the pump. Sufficient NPSH margin is available to prevent cavitation of the CS pumps under all operating conditions.

6.3.4 Minimum Operating Conditions The Technical Specifications establish limiting conditions regarding the operability of the system when the reactor is above MODE 5.

6.3.5 Inspections and Tests Inspections All components of the Containment Spray System are inspected periodically to demonstrate system readiness.

The pressure containing systems are inspected for leaks from pump seals, valve packing, flanged joints and safety valves during system testing. During the operational testing of the containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks.

Pre-Operational Testing Offsite Work These components in the system were subjected to offsite test work:

a) Spray pumps b) Spray nozzles c) Eductors The spray pumps were subjected to conventional acceptance tests and the performance characteristics plotted to illustrate that the pumps met the design specification.

As part of the development work in support of Westinghouse plant equipment, a nozzle of the type used in the spray system was subjected to a performance test to demonstrate and prove the nozzle characteristics (e.g., flow/pressure drop, droplet size, spread of spray, etc.).

As part of the quality assurance program, a random 25% of the nozzles installed at the Indian Point 3 site were given a general performance test.

The eductors were produced and tested in two stages.

A prototype was made to check nozzle calculations prior to manufacture of the stainless steel units A performance test was made by the manufacturer on one of the finished stainless steel units to confirm the capacity at the specified conditions. A sugar-water solution was used to simulate the 30% sodium hydroxide suction fluid.

89 of 215 IPEC00035698 IPEC00035698

IP3 FSAR UPDATE Onsite Test Work The aim of onsite testing was to:

Demonstrate and prove that the system is adequate to meet the design pressure conditions; outside the Containment this involved part radiographic inspection and part hydro-testing; inside the Containment the spray headers were subjected to 100% radiographic inspection Demonstrate that the spray nozzles in the containment spray header are clear of obstructions by passing air through the test connections Verify that the proper sequencing of valves and pumps occurred on initiation of the containment spray signal and demonstrate the proper operation of all remotely operated valves Verify the operation of the spray pumps; each pump was run at shut-off and the mini-flow directed through the normal path back to the Refueling Water Storage Tank. During this time, the mini-flow was adjusted to that required for routine testing Demonstrate the operation of the spray eductors. The eductor and spray additive system were checked by running, in turn, each spray pump on mini-flow with the spray additive tank filled with water and open to the spray eductor suction. During drain down of the spray additive tank, the tank level and corresponding eductor suction flow was recorded via the system instrumentation. Finally, the system performance with water was extrapolated to that with sodium hydroxide and the adequacy of the system thus verified.

In order to establish a reference eductor flow for routine testing of the system, the above was made with the spray additive tank isolated and the eductor drawing water through the RWST/eductor suction test line.

Operational Testing The aim of the periodic testing is to:

Verify that the proper sequencing of valves and pumps occurs on initiation of the containment spray signal and demonstrate the proper operation of all remotely operated valves.

Verify the operation of the spray pumps. Each pump is run at shut-off and the mini-flow directed through the normal path back to the Refueling Water Storage Tank.

Demonstrate the operation of the spray eductors. With the spray injection valves and sodium hydroxide tank valves closed, each spray pump is operated in the shut-off condition but with the mini-flow line open. The test line from the Refueling Water Storage Tank is opened to permit water to be draw through the sodium hydroxide injection line to the eductor suction. A flow rate meter in the sodium hydroxide injection line indicates the test flow established during pre-operational testing.

The operational testing of the Safety Injection System, described in Section 6.2.5, demonstrates proper transfer to the emergency diesel generator power source in the event of a loss of power.

90 of 215 IPEC00035699 IPEC00035699

IP3 FSAR UPDATE TABLE 6.3-1 CONTAINMENT SPRAY SYSTEM-CODE REQUIREMENTS Component Spray Additive Tank ASME Section III, Class C Valves ANSI B16-5 (1955)

Piping (including headers ANSI B31.1 (1955) and spray nozzles) 91 of 215 IPEC00035700 IPEC00035700

IP3 FSAR UPDATE TABLE 6.3-2 CONTAINMENT SPRAY SYSTEM DESIGN PARAMETERS PUMPS Quantity 2 Design pressure, discharge, psig 300 Design pressure, suction, psig 300 Design temperature, F 150 Design flow rate, gpm 2600 Design head, ft 450 Maximum flow rate, gpm 3154 Shutoff head, ft 490 Motor HP 400 Type of Pump Horizontal-Centrifugal EDUCTORS Quantity 2 Eductor Inlet (motive) Injection Phase Operating Fluid Water (with >2400 but <2600 ppm boron)

Operating Pressure, psig 195 Operating Temperature Ambient Flow Rate, gpm 112 (design), ::.150(analyzed)

Discharge Head (including static pressure, friction loss, and discharge elevation), psig 0.4 to 16.5 Eductor Suction Fluid 35%-38% NaOH (solution)

Specific Gravity 1.3 Viscosity (design), cp 10 Suction Pressure, psia 9.3 to 11.0 Operating Temperature Ambient Suction Capacity, gpm 24.2 - 29.5 92 of 215 IPEC00035701 IPEC00035701

IP3 FSAR UPDATE TABLE 6.3-3 SPRAY ADDITIVE TANK DESIGN PARAMETERS Quantity 1 Total Volume (empty), gal 5100 Minimum volume at operating conditions 4000 (solution), gal Required NaOH concentration, wlo 35-38 Design temperature, OF 300 Design pressure, psig 300 Operating temperature, of 110 Operating pressure, psig Approximately 1(1)

Material Carbon steel with stainless steel cladding During normal conditions there is a 1 to 2 psig N2 gas blanket. During the accident the tank pressure will fall below atmospheric pressure; vacuum breakers are provided for this purpose.

93 of 215 IPEC00035702 IPEC00035702

IP3 FSAR UPDATE TABLE 6.3-4 SINGLE FAILURE ANALYSIS - CONTAINMENT SPRAY SYSTEM Component Malfunction Comments and Consequences A. Spray Nozzles Clogged Large number of nozzles (315) renders clogging of a significant number of nozzles as incredible.

B. Pumps Containment Fails to start Two provided. Evaluation based Spray Pump on operation of one pump in addition to three out of five con-tainment cooling fans operating during injection phase.

Recirculation Pump Fails to start Two provided. Evaluation based on operation of one pump and no containment cooling fans operat-ing during recirculation phase.

Conventional and Nuclear Service Fails to start Six provided. Operation of three Water Pumps pumps during recirculation required.

Component Cooling Pumps Fails to start Three provided. Operation of two pumps during recirculation required.

Auxiliary Component Cooling Fails to start Four provided. Two required to Pump operate.

Automatically Operated Valves:

(Open on coincidence of two -

2/3 high containment pressure signals)

1. Containment Spray Pump Fails to open Two parallel path, each with one Discharge Isolation Valve pump and one valve are provided.

(Valves 866A & 866B) Operation of one path is required.

2) Spray additive tank outlet Fails to open Two provided. Operation of one isolation valve (valves 876A required.

& 876B)

3) Isolation valve on component Fails to open Two parallel lines, one valve in cooling water lines from either line is required to open.

residual heat exchangers (valves 822A & 822B) 94 of 215 IPEC00035703 IPEC00035703

IP3 FSAR UPDATE Valves Operated from Control Room for Recirculation

1) Recirculation isolation Fails to open Two valves in parallel, one valve (valves 1802A & 1802B) is required to open.

2) Containment spray header Fails to open Two valves provided. Operation isolation valve from residual of one required.

heat exchangers (valves 889A & 889B)

3) Residual heat removal Fails to close Two valves in series, one pump recirculation online required to close.

(valves 743 & 1870)

4) Residual heat removal Fails to close Two valves in series, one pump discharge line (valve required to close (one valve is a 744 and check valve 741) check valve).

TABLE 6.3-4 (Cont.)

SINGLE FAILURE ANALYSIS - CONTAINMENT SPRAY SYSTEM Component Malfunction Comments and Consequences Automatically Operated Valves (Close from the Control Room on injection to recirculation changeover)

1) Isolation valves at spray Fails to close Check valve in series with one motor operated pump discharge (motor valve provided for each line. In addition, a operated valves 866A & manually operated isolation valve with IVSWS 866B, check valves 867A & is provided in each line.

867B, and manual valves 869A & 869B)

Valves Operated from Control Room for Charcoal Filter Dousing Isolation valves at filter unit (valves 880A & B Fails to open Two valves provided for each of the five units.

880C & D Operation of one valve per unit required.

880E & F 880G & H 880J & K) 95 of 215 IPEC00035704 IPEC00035704

IP3 FSAR UPDATE TABLE 6.3-5 SHARED FUNCTIONS EVALUATION Normal Operating Normal Operating Component EIJOction Arrangement Accident Function Accident Arrangement Spray Additive Tank None Lined up for spray water Source of sodium hydroxide Lined up for spray diversion for spray water water diversion Containment Spray None Lined up to spray headers Supply spray water to Lined up to spray Pumps (2) containment atmosphere headers NOTE: Refer to Section 6.2 for a brief description of the Refueling Water Storage Tank, recirculation pumps, conventional service water pumps, component cooling pump, residual heat exchangers, component cooling heat exchangers and the auxiliary component cooling pumps which are also associated either directly or indirectly with the Containment Spray System.

"U m

()

-u o m o oo o eN o 01 96 of 215 o0) -....I (J1 o

-....J 01 o(J1

IP3 FSAR UPDATE 6.4 CONTAINMENT AIR RECIRCULATION COOLING AND FILTRATION SYSTEM 6.4.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Part 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Containment Heat Removal Systems Criterion: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure, this system shall perform its required function, assuming failure of any single active component. (GDC 52 of 7/11/67)

Adequate heat removal capability for the Containment is provided by two separate, full capacity, engineered safety features systems. These are the Containment Spray System, whose components are described in Section 6.3 and the Containment Air Recirculation Cooling and Filtration System, whose components operate as described in Section 6.4.2. These systems are of different engineering principles and serve as independent backups for each other.

The Containment Air Recirculation Cooling and Filtration System was designed to recirculate and cool the containment atmosphere in the event of a Loss-of-Coolant Accident and thereby ensures that the containment pressure will not exceed its design value of 47 psig at 271 F (100% relative humidity). Although the water in the core after a Loss-of-Coolant Accident is quickly subcooled by the Safety Injection System, the Containment Air Recirculation Cooling and Filtration System was designed on the conservative assumption that the core residual heat is released to the Containment as steam.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the Containment as steam:

1) All five containment cooling fans

2) Both containment spray pumps (and one of the two spray valves in the recirculation path)

3) Any three out of the five containment cooling fans and one of the containment spray pumps For design basis accidents in which failure of any single diesel generator is assumed, the resulting equipment configuration is also adequate to satisfy containment cooling requirements.

97 of 215 IPEC00035706 IPEC00035706

IP3 FSAR UPDATE Inspection of Containment Pressure-Reducing System Criterion: Design provisions shall be made to extent practical to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as pumps, valves, spray nozzles, torus, and sumps. (GDC 58 of 7/11/67)

Design provIsions were made to facilitate access for periodic visual inspection of all the important components of the Containment Air Recirculation Cooling and Filtration System.

Testing of Containment Pressure-Reducing Systems Components Criterion: The containment pressure-reducing systems shall be designed to the extent practical so that components, such as pumps and valves, can be tested periodically for operability and required functional performance. (GDC 59 of 7/11/67)

The Containment Air Recirculation Cooling and Filtration System was designed so that the components can be tested periodically and, after any component maintenance, testing can be conducted for operability and functional performance.

The air recirculation and cooling units, and the service water pumps, which supply the cooling units, are in operation on an essentially continuous schedule during plant operation, and no additional periodic tests are required.

Testing of Operational Sequence of Containment Pressure-Reducing Systems Criterion: A capability shall be provided to test initially under conditions as close as practical to the design and the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources. (GDC 61 of 7/11/67)

Means were provided to test initially the full operational sequence of the air recirculation system, including transfer to alternate power sources.

Inspection of Air Cleanup Systems Criterion: Design provisions shall be made to the extent practical to facilitate physical inspection of all critical parts of containment air cleanup systems, such as ducts, filters, fans, and dampers (GDC 62 of 7/11/67)

Access is available for periodic visual inspection of the Containment Air Recirculation Cooling and Filtration System components, including fans, cooling coils, dampers, filter units and ductwork.

Testing of Air Cleanup Systems Components Criterion: Design provisions shall be made to the extent practical so that active components of the air cleanup systems, such as fans and dampers, can be tested periodically for operability and required functional performance. (GDC 63 of 7/11/67) 98 of 215 IPEC00035707 IPEC00035707

IP3 FSAR UPDATE The charcoal filters of the filtration system are bypassed during normal operation by closed dampers. The dampers in a non-operating unit can be periodically tested by actuating the controls and verifying deflection by instruments in the Control Room. Since the fans are normally in operation, no additional periodic fan tests are necessary.

Testing Air Cleanup Systems Criterion: A capability shall be provided to the extent practical for insite periodic testing and surveillance of the air cleanup systems to ensure (a) filter bypass paths have not developed and (b) filter and trapping materials have not deteriorated beyond acceptable limits. (GDC 64 of 7/11/67)

Representative sample elements in each of the activated carbon filter plenums are removed periodically during shutdowns and tested on the site to verify their continued efficiency. After reinstallation, the filter assemblies are tested in place by aerosol injection to determine integrity of the flow path.

Testing of Operational Sequence of Air Cleanup Systems Criterion: A capability shall be provided to test initially under conditions as close to design as practical, the full operational sequence that would bring the air cleanup systems into action, including the transfer to alternate power sources and the design air flow delivery capability. (GDC 65 of 7/11/67)

Means were provided to test under conditions of close to design as practicable the full operational sequence that would bring the Containment Air Recirculation Cooling and Filtration System into action, including transfer to the emergency diesel generator power source.

Performance Objectives The Containment Ventilation System, Chapter 5, which all of the components of the Containment Air Recirculation Cooling and Filtration System (with the exception of the moisture separators, HEPA filters and charcoal filters) are a part of, was designed to remove the normal heat loss from equipment and piping in the Reactor Containment during plant operation and to remove sufficient heat from the Reactor Containment, following the initial Loss-of-Coolant Accident containment pressure transient, to keep the containment pressure from exceeding the design pressure. The fans and cooling units continue to remove heat after the Loss-of-Coolant Accident and reduce the containment pressure to near atmospheric pressure within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident.

A second function of the Containment Air Recirculation Cooling and Filtration System is to remove fission products from the containment atmosphere should they be released in the event of an accident. The filtration capacity of the system is sufficient to reduce the concentration of fission products in the containment atmosphere following a loss of reactor coolant, to levels ensuring that the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 30 day thyroid doses will be limited to within the guidelines of 10 CFR 100 limits. Details of the site boundary dose calculation are given in Chapter 14 along with the equipment configurations resulting from a presumed loss of one diesel generator.

The air recirculation filtering capacity used to satisfy the design basis, was determined for the following conditions:

99 of 215 IPEC00035708 IPEC00035708

IP3 FSAR UPDATE

1) Containment leak rate of 0.1 % per day for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 0.05% per day after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />

2) Conservative meteorology corrected for building wake effects

3) A 70% efficiency for filtration of organic iodine. (This assumes credit for the demonstrated ability to filter organic forms of iodine at high relative humidity with impregnated charcoal.)

4) Fission product release to the Containment per TID 14844 at a power level of 3216 MWt. This assumes no credit for safety injection in limiting fission product release.

5) Partial effectiveness of the filtration equipment. This assumes two of the five installed carbon filter assemblies are unavailable at the time of the loss of coolant.

In addition to the design bases specified above, the following objectives were met to provide the engineered safety features functions:

1) Each of the five fan-cooler units is capable of transferring heat at the rate of 49.0 x 106 Btu/hr from the containment atmosphere at the post-accident design conditions, i.e., a saturated air-steam mixture at 47 psig and 271 F. This heat transfer rate is 0

that assigned to the fan-cooler units in the analysis of containment and related heat removal system capability in Chapter 14.

The establishment of basic heat transfer design parameters for the cooling coils of the fan-cooler units, and the calculation by computer of the overall heat transfer capacity are discussed in Chapter 14. Among the topics covered are selection of the tube side fouling factor, effect of air side pressure drop, effect of moisture entrainment in the air steam mixture entering the fan-coolers, and calculation of the various air side to water side heat transfer resistances.

2) In removing heat at the design basis rate, the coils are capable of discharging the resulting condensate without impairing the flow capacity of the unit and without raising the exit temperature of the service water to the boiling point. Since condensation of water from the air-steam mixture is the principal mechanism for removal of heat from the post-accident containment atmosphere by the cooling coils, the coil fins will operate as wetted surfaces under these conditions. Entrained water droplets added to the air-steam mixture, such as by operation of the containment spray system, will therefore have essentially no effect on the heat removal capability of the coils.

3) Each of the five air handling units is equipped with moisture separators and high efficiency particulate air (HEPA) filters rated for 8000 cfm unit flow. The latter are capable of 99.97% removal efficiency for 0.3 micronparticles at the post-accident conditions.

4) Each of the five air handling units is capable of supplying air to separate carbon-bed filter units following an accident for fission product iodine removal. The design flow rate through each air handling unit is 69,500 cfm during normal operation and 34,000 cfm during accident conditions. The design flow rate through each carbon filter assembly is 8,000 cfm, at a face velocity of approximately 50 fpm. The remainder of 100 of 215 IPEC00035709 IPEC00035709

IP3 FSAR UPDATE the flow bypasses the filter assemblies. The carbon filter units are designed to remove at least 70% of the incident radioactive iodine in the form of methyl iodide (CH31). These are the iodine removal efficiencies assumed in the analysis of containment capability to retain fission product iodine under the post-accident design conditions in Chapter 14.

In addition to the above design bases, the equipment was designed to operate at the post-accident conditions of 47 psig and 271 F for three hours, followed by operation in an air-steam 0

0 atmosphere at 20 psig, 219 F for an additional 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />. The equipment design will permit subsequent operation of an air-steam atmosphere at 5 psig, 152 F for an indefinite period. See Appendix 6F for details of the IP3 Equipment Qualification Program.

All components are capable of withstanding or are protected from differential pressures which may occur during the rapid pressure rise to 47 psig in ten (10) seconds.

Portions of other systems which share functions and become part of this containment cooling system when required were designed to meet the criteria of this section. Neither a single active component failure in such systems during the injection phase nor an active/passive failure during the recirculation phase will degrade the heat removal capability of containment cooling.

Where portions of these systems are located outside of containment, the following features were incorporated in the design for operation under post-accident conditions:

a) Means for isolation for any section b) Means to detect and control radioactivity leakage into the environs, to the limits consistent with guidelines set forth in 10 CFR 100.

6.4.2 System Design and Operations The flow diagram of the Containment Air Recirculation Cooling and Filtration System is shown on Plant Drawing 9321-F-40223 [Formerly Figure 6.4-2].

Individual system components and their supports meet the requirement for Class I (seismic) structures and each component is mounted to isolate it from fan vibration.

Containment Cooling System Characteristics The air recirculation system consists of five 20% capacity air handling units, each including motor, fan, cooling coils, moisture separators, HEPA filters, carbon filters with spray and fire detection, dampers, duct distribution system, instrumentation and controls. The units are located on the intermediate floor between the containment wall and the primary compartment shield walls. The moisture separators, HEPA filters and activated carbon filter assembly is normally isolated from the main air recirculation stream. Part of the air flow (air-steam mixture) is bypassed through the filtration section of the units (moisture separators, HEPA filters, and carbon filter assembly) to remove volatile iodine following an accident.

Each fan was designed to supply 69,500 cfm at approximately 6.3" s.p. (0.075 Ib/ft3 density) during normal operation and 34,000 cfm, at approximately 8.6" s.p. (0.175 Iblft3 density), during accident operation.

101 of 215 IPEC00035710 IPEC00035710

IP3 FSAR UPDATE The fans are direct driven, centrifugal type, and the coils are plate fintube type. Each air handling unit is capable of removing 49.0 x 106 Btu/hr from the containment atmosphere under accident conditions. A flow of 1400 gpm of service (cooling) water is supplied to each unit during accident conditions. The design maximum river water inlet temperature is 95°F.

Duct work distributes the cooled air to the various containment compartments and areas.

During normal operation, the flow sequence through each air handling unit is as follows; inlet dampers, cooling coils, fan, discharge header. Roughing filters were installed up-stream of the cooling coils during plant clean-up. Any time these filters are used, they must be removed prior to exceeding cold shutdown. In lieu of using roughing filters, cooling coil thermal performance is assured by alternate means. (Reference Generic Letter 89-13)

In the event of an accident, the flow is split into two parts: a minimum of 8000 cfm passes through the filtration section consisting of moisture separation, HEPA filters, and carbon filter assembly, and the remainder of the flow bypasses the filtration section of the units and passes through the cooling coils with the filtration flow. The bypass flow control is accomplished via a damper that fails closed to a pre-set position for accident operation.

Plant Drawing 636F269 [Formerly Figure 6.4-1] is an engineering layout drawing of an air handling unit, showing the arrangement of the above components in the unit. Plant Drawing 9321-F-40253 [Formerly Figure 6.4-3] shows the location of the five units on the intermediate floor (elevation 68' -0").

Actuation Provisions A tight closing damper isolates the filtration section of the units from the normal operating components. Upon loss of air pressure to the damper control cylinder, the damper and accident filtration inlet door opens to permit air to flow through this section. The damper and door are fail safe open via weights and spring, respectively.

Upon either manual or automatic actuation of the safety injection safeguards sequence, the accident damper and door are tripped to the accident position. Accident position is also the "fail-safe position." Electrically operated environmentally qualified three-way solenoid valves are used with the dampers and door to control the instrument air supply (control air).

The containment pressure is sensed by six separate pressure transmitters located outside the Containment. Containment pressure is communicated to the transmitters through three 1" stainless steel lines penetrating the containment vessel. A high containment pressure signal automatically actuates the safety injection safeguard sequence (see Section 6.2.2), which trips the valves to the accident position.

The fans are part of the engineered safety features and either all five or at least three out of the five fans will be started after an accident, depending on the availability of emergency power.

(See Chapters 8 and 14)

Overload protection for the fan motors is provided at the switchgear by over-current trip devices in the motor feeder breakers. The breakers can be operated from the Control Room and can be reclosed from the Control Room following a motor overload trip.

102 of 215 IPEC00035711 IPEC00035711

IP3 FSAR UPDATE Redundant flow switches in the system, operating both normally and post-accident, indicate whether air is circulating in accordance with the design arrangement. Abnormal flow alarms are provided in the Control Room.

Flow Distribution and Flow Characteristics The location of the distribution ductwork outlets, with references to the location of the air handling unit return inlets, ensures that the air is directed to all areas requiring ventilation before returning to the units. The arrangement is shown in Plant Drawing 9321-F-40223 [Formerly Figure 6.4-2].

In addition to ventilating areas inside the periphery of the shield wall, the distribution system also includes two branch ducts located at opposite extremes of the containment wall for ventilating the upper portion of the Containment. These ducts are provided with nozzles and extend upward along the containment wall as required to permit the throw of air from nozzles to reach the dome area and assure that the discharge air will mix with the atmosphere.

The air discharge inside the periphery of the shield wall circulates and rises above the operating floor through openings around the steam generators where it will mix air displaced from the dome area. This mixture returns to the air handling units through floor grating located at the operating floor directly above each air handling unit inlet. The temperature of this air is essentially the ambient existing in the containment vessel.

The steam-air mixture from the Containment entering the cooling coils during the accident will be at approximately 271 F and have a density of 0.175 pounds per cubic foot. Part of the water 0

vapor will condense on the cooling coil, and the air leaving the unit will be saturated at a 0

temperature slightly below 271 F. The fluid also enters the moisture separators at approximately 271 F and saturated (100% R.H.) condition.

0 The purpose of the moisture separators is to remove the entrained moisture to protect the HEPA Filters from excessive pressures due to water buildup during accident operation. The fluid flows through the HEPA filter and into the carbon filters, and to the cooling coils picking up some sensible heat from the fan and fan motor before flowing through into the distribution header. This sensible heat will increase the dry-bulb temperature slightly above 271 F and will 0

decrease the relative humidity slightly below 100%.

With a flow rate of 34,000 cfm from each fan under accident conditions and the containment free volume of 2,610,000 fe the recirculation rate with five fans operating is approximately 4 containment volumes per hour.

Carbon Filter High Temperature Detection and Dousing System The five carbon filter assemblies are provided with high-temperature detectors and associated alarms in the Control Room. Each carbon filter assembly is also provided with a spray system for water dousing upon an indication of a fire. See Figure 6.4-4 and Section 6.3.2.

Capability for detecting and alarming the presence of fires and localized hot spots in the carbon filters is provided by a system of temperature switches. Each carbon filter plenum (containing one bank of 12 adsorbers) is provided with temperature switches. These switches are uniformly distributed for good coverage. The temperature switches are factory-set for 400 F, (which is 0

below the carbon ignition temperature of 644 F) and they are wired in parallel to a common 0

103 of 215 IPEC00035712 IPEC00035712

IP3 FSAR UPDATE alarm in the Control Room. Thus closing of a single switch will actuate the alarm to indicate a high temperature condition in the filter plenum.

The water dousing system provided with each carbon filter plenum was designed to drench the adsorbers thoroughly in the extremely unlikely event of a carbon fire during the post-accident recovery. Water for this system is obtained from the main headers of the containment spray system through a separate 2 inch stainless steel line to each filter plenum. There are two normally closed motor operated valves in parallel in each 2 inch line.

The Containment Spray System is automatically actuated and will be running in the event of a Loss-of-Coolant Accident (injection phase). Upon indication of a fire in a filter unit, the operator manually initiates filter dousing by actuating the parallel-connected isolation valves for each filter assembly. Because of the piping arrangement either of the two spray pumps can be used to feed the dousing lines. The dousing flow (approximately 12 gpm per fan cooler unit) was sized to wet the carbon completely and remove the decay heat of the adsorbed iodine thereby preventing heating to the ignition temperature. The system was designed to so containment spray at slightly reduced flow can continue simultaneously with filter dousing. Provisions were made for testing of the dousing nozzles through an air hose connection.

During the recirculation phase of core cooling, operation of the dousing system is the same as above except that water to the spray headers is supplied from the discharge of the residual heat removal heat exchangers.

Cooling Water for the Fan Cooler Units The cooling water requirements for all five fan cooling units during a major loss of primary coolant accident and recovery are supplied by two of the three nuclear service water pumps.

The Service Water System is described in Chapter 9.

The cooling water discharges from the cooling coils to the discharge canal and is monitored for radioactivity by routing a small bypass flow from each through a line monitored by two adjacent-to-line radiation detection assemblies. Note that for a fan cooler unit (FCU) cooling coil failure, assumed to occur concurrently with a large break LOCA, radiological accessibility to identify and isolate the failed FCU will be possible prior to initiation of external recirculation. Upon indication of radioactivity in the effluent, each cooler discharge line is monitored individually to locate the defective cooling coil which when identified would remain isolated, and operation would continue with the remaining units. The service water system pressure at locations inside the Containment is 15 to 20 psig, which is below the containment design pressure of 47 psig.

However, since the cooling coils and service water lines are completely closed inside the Containment, no contaminated leakage is expected into these units.

Local flow indication is provided outside containment for service water flow to each cooling unit.

Abnormal flow alarms are provided in the Control Room. Service water common inlet temperatures, and all outlet temperatures are displayed at the critical function monitoring system (CFMS).

During normal plant operation, flow through the cooling units is throttled for containment temperature control purposes by a valve on the common discharge header from the cooling units. Two additional independent, full flow, isolation valves open automatically in the event an engineered safeguards actuation signal to bypass the control valve. Both valves fail in the open position upon loss of air pressure and either valve is capable of passing the full flow required for all five fan cooling units.

104 of 215 IPEC00035713 IPEC00035713

IP3 FSAR UPDATE Environmental Protection All system control and instrumentation devices required for containment accident conditions were located to minimize the danger of control loss due to missile damage. Flow switches in the ductwork system, operating both normally and post-accident, indicate whether air is circulating in accordance with the design arrangement. Abnormal flow alarms are provided in the Control Room. Post-accident monitoring of certain parameters are qualified for a post-accident environment.

All fan parts, valve shaft and disc seating surfaces and ducts in contact with the containment fluid are protected against corrosion. The fan motor enclosures, electrical insulation and bearings were designed for operation during accident conditions. See Appendix 6F for qualification testing.

Verification tests under the combined environmental effects of high humidity, pressure, temperature, radiation and applicable chemical concentration of the assembled system (as opposed to tests being performed separately) would require the entire Containment Building or a prototype to be adapted to the test conditions.

No significant information would result from such a test beyond that already obtained from the testing of individual components. The combination of the individual component test results assures the performance of the containment air recirculation system under accident conditions.

All of the air handling units are located on the intermediate floor between the containment vessel and the primary compartment shield wall. The distribution header and service water cooling piping are also located outside the shield wall. This arrangement provides missile protection for all components.

Components Moisture Separators The moisture separators were designed to protect the HEPA Filters from adverse pressures due to water buildup following a Loss-of-Coolant Accident(3). The water flow rate entering the moisture separators is approximately 0.31 gpm per moisture separator (8 per unit) and the moisture separator effluent has essentially zero moisture content.

Each bank was designed for horizontal air flow, and is composed of 8 elements. Each element or separator is 24 in x 24 in x 4 in (minimum) thick and is mounted in a steel support frame.

A steel drain trough was incorporated for each horizontal tier of separators to collect and remove the water that is recovered from the air stream. Further, the design enables the separators to be removed from the upstream side of the support frame.

In order to prevent the bypass of air around the bank, air-tight seals were provided between the floor, walls, plenum, and around the perimeter of each moisture separator. The tight seal is accomplished by gaskets, and adhesive which can withstand a temperature of 300°F. The thickness of the gaskets is % in for the separator elements and do not extend into the media area when installed.

105 of 215 IPEC00035714 IPEC00035714

IP3 FSAR UPDATE The moisture separator elements are of fire resistant construction, and consist of mats of stainless steel wire mesh. Non-stainless steel parts used in the construction are protected against corrosion by painting with one (1) coat each of Carbon Zinc No. 11 and Phenoline 305.

The separator element frames are stainless steel.

Roughing Filters The roughing filters remove the large particles from the air stream before it contacts the cooling coils. The roughing filters were installed during plant clean up. These are efficient for removing large particles. Under normal air flow, they offer a resistance to air flow of approximately 0.2 inches of water.

As in the case for all components of the air handling recirculating system, the bank was designed for horizontal air flow. The filter media is of fire retardant construction composed of a fiber mat support screen and fasteners.

HEPA (Absolute) Filters The high efficiency particulate air (HEPA) filters are capable of 99.97% removal efficiency for 0.3 micron particles at the post-accident design conditions. All materials of construction of these filters are compatible with the sodium hydroxide/boric acid solution in the post-accident environment with the conditions they are exposed to where the moisture separators upstream protected the HEPA filters.

The filter media is made of glass fiber (meets MIL-F-51079) and can withstand the incident ambient steam/air temperature conditions and 100% relative humidity. Filter frames were made of stainless steel. The filters meet MIL-STD-282, MIL-F-51068C, MIL-F051079A, and UL 586.

Fan-Motor Units The five containment cooling fans are of the centrifugal, non-overloading direct drive type.

Each fan can provide a minimum flow rate of 34,000 cfm when operating against the system resistance of approximately 8.6" s.p. existing during the accident condition (0.175 Ib/fe denSity, a containment pressure of 47 psig, and a temperature of 271 F). 0 The reactor containment fan cooler motors are Westinghouse, totally enclosed water cooled, 225 horsepower, induction type, 3 phase, 60 cycle 720 rpm, 440 volt with ample insulation margin. Significant motor details are as follows:

a) Insulation Class F (NEMA rated total temperature 155 C) Westinghouse Thermalastic. It is 0

impregnated and varnish dipped to give a homogeneous insulation system which is highly impervious to moisture. Internal leads and the terminal box-motor interconnection are given special design consideration to assure that the level of insulation matches or exceeds that of the basic motor system. At incident ambient and load conditions (271 F and 225 hp), the motor insulation hot spot temperature is 0

not expected to exceed 12JD C.

b) Heat Exchanger 106 of 215 IPEC00035715 IPEC00035715

IP3 FSAR UPDATE An air to water heat exchanger is connected to the motor to form an entirely enclosed cooling system. The heat removal capability under LOCA conditions is 110,868 Btu/hr at saturation conditions (271° F, 47 psig). Air movement is through the heat exchanger and is returned to the motor. Two vent valves permit incident ambient (increasing containment pressure) to enter the motor air system so the bearings will not be subjected to differential pressure. The cooling coil condensate drain line will enable pressure equalization as the containment pressure is reduced by the motor heat exchanger. The drain is piped to the containment cooler drain system.

The motor cooling coils have tubes of AL-6X stainless steel with continuous copper plate-type turbex fins. Water boxes made of 904L stainless steel provide for the water supply and discharge which are common with the containment cooler water system, i.e., supplied from the nuclear service water header. A two pass water flow design counter to the air flow is employed.

c) Bearings The motors are equipped with high temperature grease lubricated ball bearings as would be required if the bearings were subjected to incident ambient temperatures.

Continuous bearing monitoring is provided which will alarm in the Control Room.

Conduit (Connection) Box The motor leads are brought out of the frame through a seal and into a cast iron sealed explosion-proof type of conduit box.

Factory Tests In addition to the usual quality control tests which were performed to give assurance that the motors meet design specifications, special tests were performed to demonstrate that insulation margins were built in as specified. The completely wound stators have been given a special high potential test to ground. The stators were immersed in water, meggered, given a high potential test while immersed, and baked. After passing the water tests, the rotor was baked, given a final coating dip and were baked again.

Carbon Filters The carbon filters were fabricated with stainless steel frames filled with activated carbon, which is tested in accordance with ASTM D3803-1989, per the IP3 response to Generic Letter 99-02.

The cell construction insures compacted carbon beds of uniform density and thickness.

The design flow rate through each carbon filter unit is 8,000 cfm, at a face velocity of approximately 50 fpm. These units were designed to remove at least 70% of the incident radioactive iodine in the form of methyl iodine (CH31). (1) (2)

Fan Cooling Coils 1070f215 IPEC00035716 IPEC00035716

IP3 FSAR UPDATE The coils were fabricated of cooper plate fin vertically oriented on AL6X (Allegheny-Ludlum) tubes. The heat removal capability of the cooling coils is 49.0 x 106 Btu/hr per air handling unit at saturation conditions (271°F, 47 psig).

The design internal pressure of the coil is 150 psig at 300 of and the coils can withstand an external pressure of 47 psig at a temperature of 271 °F without damage.

Each recirculating unit consists of eight (8) coil units mounted in two banks of four (4) coils high.

These banks are located one behind the other for horizontal series air flow, and the tubes of the coil are horizontal with vertical fins.

Each coil assembly consists of one bank of six row deep coils. Each of the two banks contain four Westinghouse Sturtevant designation WC-36114 (36" high by 114" long) coils. The coils are stacked four high to a bank. The total coil assembly (two banks of coils) is 3% feet wide.

There are 12 rows of tubes in the horizontal flow direction and a total of 96 rows of tubes in the vertical direction. Cooling water flow is 1/3 velocity. Cooling coils have 8.5 fins per inch of tube length. (For normal operation, the coils will remove 2.3 x 106 Btu/hr.)

Local flow indication is provided outside containment for service water flow to each cooling unit.

Abnormal flow alarms are provided in the Control Room. Service water common inlet temperatures, and all outlet temperatures are displayed at the critical function monitoring system (CFMS). Alarms indicating abnormal service water flow and radioactivity are provided in the Control Room.

The coils are provided with drain, pans and drain piping to prevent flooding during accident conditions. This condensate is drained to the Containment Sump. (See Section 6.7.)

Ducting The ducts were designed to withstand the sudden release of Reactor Coolant System energy and energy from associated chemical reactions without failure due to shock or pressure waves by incorporation of dampers along the ducts which open at slight overpressure, 3.0 psi. The ducts were designed and are supported to withstand thermal expansion during an accident.

Ducts are of welded and flanged construction. All longitudinal seams were welded. Where flanged joints were used, joints are provided with gaskets suitable for temperatures to 300 of.

Ducts were constructed of galvanized sheet metal.

Dampers Dampers are held in their operating position by gravity weight and air cylinders. A leak tight damper prevents leakage of air into the charcoal filter compartment during normal operation thereby preventing carbon deterioration. The damper and blow-in door fail to the open position to assure flow through the carbon filters during the accident condition.

Electrical Supply Details of the normal and emergency power sources are presented in Chapter 8.

108 of 215 IPEC00035717 IPEC00035717

IP3 FSAR UPDATE Further information on the components of the Containment Air Recirculation Cooling and Filtration System is given in Chapter 5.

6.4.3 Design Evaluation Range of Containment Protection The Containment Air Recirculation Cooling and Filtration System provides the design heat removal capacity and the design iodine removal capability for the containment following a Loss-of-Coolant Accident assuming that the core residual heat released to the Containment as steam. The system accomplishes this by continuously recirculating the air-steam mixture: 1) through cooling coils to transfer heat from containment to service water, and 2) through activated carbon filters to transfer methyl iodide to the filters from the air-steam mixture.

The performance of the Containment Recirculation Cooling and Filtration System in pressure reduction and iodine removal is discussed in Chapter 14.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the Containment as steam.

1) All five containment cooling fans.

2) Both containment spray pumps (and one of the two spray valves in the recircula-tion path).

3) Any three out of the five containment cooling fans and one containment spray pump.

For design basis accidents in which failure of any single diesel generator is presumed, the resulting equipment configuration is also adequate to satisfy containment cooling and filtration requirements.

System Response The starting sequence of the last of the five containment cooling fans (at design conditions five of the fans and one of the nuclear service water pumps operate during normal power operations for containment ventilation) and the related emergency power equipment were designed so that delivery of the minimum required air flow to the carbon filters and cooling water flow is reached in 58 seconds. In the analysis of the containment pressure transient, Section 14.3, a delay time of 50 seconds was assumed.

The starting sequence is*

Sequence Seconds 1)* Initiation of safety injection signal 2 including instrument lag

2) Starting of emergency diesel generators 10

3) Starting of containment cooling fan 15 or 23

4) Acceleration time (estimated) 10 TOTAL - from event initiation 37 or 45 109 of 215 IPEC00035718 IPEC00035718

IP3 FSAR UPDATE

• NOTE: If no LOOP, subtract ten seconds.

The valves are actuated to safeguards position by the safety injection signal.

Single Failure Analysis A failure analysis was made on all active components of the system to show that the failure of any single active component will not prevent fulfilling the design function. This analysis is summarized in Table 6.4-1 The analysis of the Loss-of-Coolant Accident presented in Chapter 14 is consistent with the single failure analysis.

Loss of a fan motor in a unit should not result in ignition of the carbon. Ignition should be prevented by backflow induced by the operating fans. If, during normal operation, an increase in the carbon filter temperature were to occur, the high temperature detectors would initiate an alarm and the operator would cause the affected bank to be sprayed.

Reliance on Interconnected Systems The Containment Air Recirculation Cooling and Filtration System is dependent on the operation of the Electrical and Service Water Systems. Cooling water to the coils is supplied from the Service Water System. Three nuclear service water pumps are provided, only two of which are required to operate during the post-accident period for the containment cooling function.

Shared Function Evaluation Table 6.4-2 is an evaluation of the main components which have been discussed previously and a brief description of how each component functions during normal operation and during the accident.

Reliability Evaluation of the Fan-Cooler Motor The basic design of the motor and heat exchanger as described herein is such that the incident environment is prevented, in any major sense, from entering the motor winding. When entering in a very limited amount (equalizing motor interior pressure), the incoming atmosphere is directed to the heat exchanger coils where moisture is condensed out. If some quantity of moisture should pass through the coil, the changed motor interior environment would "clean up" as that interior air continually recirculates through the heat exchanger.

It will be noted that the motor insulation hot spot temperature is not expected to exceed 127 C even under incident conditions. Normal life could be expected with a continuous hot spot of 155 C.

During the lifetime of the plant, these motors perform the normal heat removal service and as such are only loaded to approximately 90-100 hp, which is less than half the rated horsepower.

The bearings were designed to perform in the incident ambient temperature conditions.

However, it should be noted that the interior bearing housing details are cooled by the heat exchanger. It is expected that bearing temperatures would be 125 C to 140 C under incident conditions.

110 of 215 IPEC00035719 IPEC00035719

IP3 FSAR UPDATE The insulation has high resistance to moisture and tests performed indicate the insulation system would survive the incident ambient moisture condition without failure (see Appendix 6F).

The heat exchanger system of preventing moisture from reaching the winding keeps the winding in much more favorable conditions. In addition, it should be noted that at the time of the postulated incident, the load on the fan motor would increase, internal motor temperature would increase, and would, therefore, tend to drive any moisture if present, out of the winding.

Additionally, the motors are furnished with insulation voltage margin beyond the operating voltage of 440 volts.

Following the incident rise in pressure, it is not expected that there will be significant mixing of the motor (closed system) environment and the containment ambient.

The heat exchanger was designed using a conservative 0.001 fouling factor.

To prove the effectiveness of the heat exchanger in inhibiting large quantities of the steam air mixture from impringing on the winding and bearings, a full scale motor of the exact same type as described was subjected to prolonged exposure of accident conditions, which included high pressure and temperature, 100% relative humidity, and chemical spray. The test exposed the motor to a steam air mixture as well as boric acid and alkaline spray at approximately 80 psig and saturated temperature conditions.

Insulation resistance, winding and bearing temperature, relative humidity, voltage and current as well as heat exchanger water temperature and flow were recorded periodically during the test.

Following the test, the motor was disassembled and inspected to further assure that the unit performed as designed. The post-testing inspection showed no degradation of the motor components.

Carbon Filter Performance The design flow rate through each carbon filter bank is 8000 cfm, at a face velocity of approximately 50 fpm. The bed thickness of 2 inches provides a superficial residence time of 0.2 sec. Under the design conditions of temperature, pressure, and humidity, and with moisture uptake limited to less than 1 gram of water per gram of dry charcoal, the expected penetration of incident 12 vapor is less than 0.1 %.

An evaluation of the effectiveness of charcoal filters in removing organic iodide from the containment atmosphere is presented in Appendix 6C.

6.4.4 Minimum Operating Conditions The Technical Specifications establish limiting conditions regarding the operability of the air recirculation units when in MODES 1, 2, 3, and 4.

6.4.5 Inspection and Testing Inspection Access is available for visual inspection of the containment fan coolers and recirculation filtration components, including fans, cooling coils, dampers, filter units and ductwork. Provision was made for ready removal of the filters for inspection and testing.

111 of 215 IPEC00035720 IPEC00035720

IP3 FSAR UPDATE Technical Specifications (TS) require charcoal and HEPA filter testing to demonstrate operability any time a fire, chemical release or work done on the filters could alter integrity. Technical Specification surveillance testing is based upon a maximum flow of 8,800 cfm giving a minimum safety factor of 1.87 for methyl iodide removal efficiency while allowing 1% bypass. 50.59 Evaluation 98-3-017 HVAC demonstrates, for purpose of TS implementation, that welding is not a fire, a chemical release or work that could alter filter integrity. The 50.59 evaluation also demonstrates that organic components from painting and similar activities could not alter filter integrity until the organic components are above 10% by weight and concludes that filter testing shall be performed when the organic components are greater than or equal to 2.5% by weight organics. Administrative controls are required to evaluate the percent by weight of organics when activities that could generate organics are conducted.

Testing Component Testing The HEPA filters used in the containment fan cooler system were specified to operate in the post-accident containment environment. Each filter was subjected to standard manufacturer's efficiency and production tests prior to shipment.

These included flow resistance tests and the Standard Efficiency Penetration Test requiring that penetration does not exceed 0.03 percent for 0.3 micron diameter homogeneous diocylphathalate (DOP) particles.

Evaluation tests were performed on sample filters constructed from the filter medium to demonstrate retention of strength under wet conditions, and to demonstrate the effectiveness of the moisture separator for protecting the HEPA filter as follows:

1) The filter was exposed to a flow of wet steam (at 280 F, 50 psig, and 100% R.H.) and water spray (with 2500 ppm boron, pH of 10) in a test facility which simulated the actual filter installation. The water was injected ahead of the filter with a nozzle designed to produce a fine spray. Free (unentrained) moisture was removed by means of a moisture separator upstream of the HEPA filter but no provisions were made for removal of entrained moisture entering the HEPA filter.

2) The filter pressure drop was measured to demonstrate that its resistance to flow under the simulated accident conditions did not significantly increase.

Only filters of a type which have been certified to have passed these tests were accepted for initial use or replacement in the fan coolers application.

Any of the activated carbon filter adsorbers in the air handling units can be removed and tested periodically for effectiveness in removing methyl iodine forms. In addition, periodic in-place testing of the filtration assemblies is made by injection of a DOP aerosol in the air stream at the filter inlet to verify the leak-tightness of individual filter elements and their frame seals. The activated charcoal used shall have an ignition temperature not less than 300 OF.

The in-place testing of HEPA filters with DOP aerosol is performed to demonstrate gasket and media integrity, and overall bank efficiency, rather than an investigation of individual pinhole leaks in the filter media. Test procedures are available at the plant site for inspection.

112 of 215 IPEC00035721 IPEC00035721

IP3 FSAR UPDATE Large filter installations are tested to within 20% of the full rated flow. Besides limiting the quantity of DOP to be introduced into the ventilation system and containment, this is the flow rate at which filter imperfections would most readily be noticeable. At higher flow rates, the turbulent flow through pinhole leaks and other imperfections becomes proportionally less than the laminar flow through the media. Filters therefore increase in efficiency with increasing air flow rates. When an in-place test, carried out in accordance with NRC requirements, shows an unacceptable efficiency, leakage paths can be detected by passing the aerosol through the system, and probing the downstream side of the bank of filters and mounting frame with a probe connected directly to the photometer.

Carbon filters will not be contaminated with DOP, and will be removed from the system before any testing takes place.

For small charcoal filter installations, filter bank efficiencies are determined using Freon 112, in accordance with the procedures described in DP1082 "Standardized Nondestructive Test of Carbon Beds for Reactor Confinement Applications." For large installations, the use of this procedure would necessitate the release of excessive amounts of Freon 112 within the Containment. Due to problems of possible fluoride formation, it is desirable to keep freon contamination to a minimum.

Consequently, instead of introducing Freon into a fully operating ventilation system, carbon filter installations are tested a few cells at a time. The procedure is to use a small temporary portable blower and duct on the inlet side, while checking for leakage on the downstream side of the installation with a halogen leak detector. Any Freon pickup which may occur in the section of the filter under test will be released following the completion of the test and will have no effect on filter performance.

The dampers and blow-in door on each air handling unit can be operated periodically to assure continued operability.

System T esti ng Each fan cooling unit was tested after installation for proper flow and distribution through the duct distribution system. Four fan cooling units are used during normal operation. (Five will only be required for normal operation at design conditions, i.e., when the service water inlet temperature is above 85°F, and this condition is expected to exist only for relatively short periods, if at all.) The fan not in use can be started from the Control Room to verify readiness.

The dampers and blow-in door directing flow through the carbon filter banks are tested only when the fan is not running.

After reinstallation following testing, the carbon filter units are tested in place by aerosol injection to determine integrity of the flow path.

Operational Sequence Testing The test described in Section 6.2.5 serves to demonstrate proper transfer and sequencing of the fan motor supplies from the diesel generators in the event of loss of power. A test signal is used to demonstrate proper damper motion and fan starting prior to installation of the carbon filters.

The test verifies proper functioning of the vane-switch flow indicators.

Verification of Heat Removal Capability 113 of 215 IPEC00035722 IPEC00035722

IP3 FSAR UPDATE Since river water is circulated through the containment fan coolers and since the fans are used under both normal and accident conditions, provisions were made for verifying that the fan cooler heat removal capability does not degrade below that assumed in the containment integrity evaluation.

Instrumentation provided to verify heat removal capability is:

1) An Environmentally qualified RTD is installed on the inlet line to provide indication on the critical function monitoring system (CFMS).

2) Flow measurement of each fan cooler service water effluent is provided by an indicating flow transmitter installed in each line. The transmitter actuates a common annunciator alarm in the Control Room upon the decrease of flow in any fan cooler line.

In addition, the flow indicator provides for manual balance of flow rates in all five fan coolers.

3) In the event of fan cooler coil service water out-leakage, the head of water will increase in a stand pipe weir which collects condensate runoff from each of the fan cooler, motor heat exchanger and demister (moisture separator).

The increase of head is measured by a differential pressure transmitter. The current output signal is connected to an alarm unit which actuates a control room annunciator. Through the use of a weir level indicator and selector switch, the operator can determine the location of the leakage.

4) The containment building ambient temperature is controlled by manually modulating the service water flow through the fan coolers.

The indicating range is 40° - 400°F. Average temperature indication is available at the QSPDS display and at the CR Supervisory Panel. Individual temperatures for each RTD are displayed at the CFMS. An increase in ambient temperature indicates fan cooler failure or service water discharge control valve malfunction. Either cause can be easily checked. To ensure reliability of the temperature instruments, perform a channel check daily and a channel calibration every 24 months.

References

1) "Connecticut-Yankee Charcoal Filter Tests," CYAP 101, (December 1966).

2) Ackley, R.D. and R. E. Adams, "Trapping of Radioactive Methyl Iodide from Flowing Steam-Air: Westinghouse Test Series," ORNL-TM-2728, (December 1969).

3) Reactor Containment Fan Cooler System Technical Manual, Nuclear Technology Division of Westinghouse Electric Corporation, PE-1275, (May 1982).

4) Attachment I to IPN-89-046, "Proposed Change to Technical Specifications to Increase the Design Bases Ultimate Heat Sink Temperature."

114 of 215 IPEC00035723 IPEC00035723

IP3 FSAR UPDATE TABLE 6.4-1 SINGLE FAILURE ANALYSIS - CONTAINMENT AIR RECIRCULATION COOLING AND FILTRATION SYSTEM Component Malfunction Comments and Consequences A. Containment Cooling Fan Fails to start Five provided. Evaluation based on three fans in operation and one containment spray pump operating during the injection phase. Other configurations are evaluated in Chapter 14.

B. Nuclear Service Water Pumps Fails to start Three provided. Two required for operation for containment cooling function.

C. Automatically Operated Valves:

(Open on automatic safeguards sequence)

1) Carbon filter compartment Fails to open Five filters provided. Evaluation based on three filters in operation and one Damper and Blow-in door containment spray pump in operation during the injection phase.

2) Nuclear service water Fails to open Two provided. Operation of one required.

discharge line isolation Valve "U

m

()

-u o m o oo o eN o 01 115 of 215 o0) -....I N

(J1

-....J

.j::>.

'"

.j:::o.

IP3 FSAR UPDATE TABLE 6.4-2 SHARED FUNCTION EVALUATION Normal Operating Normal Operating Accident Arrangement Component Function Arrangement Accident Function Containment Circulate and cool Up to five fan Circulate and cool Three to five fan units in service Cooling Fan containment units in service containment Unit (5) atmosphere atmosphere Nuclear Supply river One or two Supply river Two or three pumps Service Water cooling water to pumps in service cooling water in Pumps (3) fan units service components Carbon Filter None Isolated from Remove iodine Lined up to receive fan discharge flow Units (5) normal fan from containment discharge flow atmosphere

"'U m

()

"'U o m o oo o eN o 01 116 of 215 o0) -....I N

(J1

-....J (J1

'"

01

IP3 FSAR UPDATE 6.5 ISOLATION VALVE SEAL WATER SYSTEM 6.5.1 Design Bases The Isolation Valve Seal Water System assures the effectiveness of the containment isolation valves located in lines connected to the Reactor Coolant System, or that could be exposed to the containment atmosphere during any condition which requires containment isolation, by providing a water seal (and reliable means for injecting seal water between the seats and stem packing of the globe and double disc types of isolation valves, and into the piping between closed gate valves and diaphragm type isolation valves. This system operates to limit the fission product release from the Containment.

Although no credit is taken for operation of this system in the calculation of offsite accident doses, it does provide assurance that the containment leak rate is lower than that assumed in the accident analysis should an accident occur. Design provisions for inspection and testing of the Isolation Valve Seal Water System are discussed in Section 6.5.5.

See Section 5.2, Containment Isolation System for containment isolation diagrams, tabulation of isolation valve parameters and a description of the derivation of "Phase A" and "Phase B" containment isolation signals. Section 5.2.2 discusses the containment isolation valves that are sealed, post-accident, by air from the Penetration and Weld Channel Pressurization System.

6.5.2 System Design and Operation

System Description

The Isolation Valve Seal Water System flow diagram is shown in Plant Drawing 9321-F-27463

[Formerly Figure 6.5-1]. System operation is initiated either manually or by any automatic safety injection signal. When actuated, the Isolation Valve Seal Water System interposes water inside the penetrating line between two isolation pOints located outside the Containment. The resulting water seal blocks leakage from the Containment through valve seats and stem packing. The water is introduced at a pressure slightly higher than the containment peak accident pressure.

The high pressure nitrogen supply used to maintain pressure in the seal water tank does not require any external power source to maintain the required driving pressure. The possibility of leakage from the Containment or Reactor Coolant System past the first isolation point is thus prevented by assuring that if leakage does exist, it will be from the seal water system into the Containment.

The following lines would be subjected to pressure in excess of the isolation Valve Seal Water System design pressure (150 psig) in the event of an accident, due to operation of the recirculation pumps:

1) Residual heat removal loop return line

2) Bypass line from residual heat exchanger outlet to safety injection pumps suction

3) Residual heat removal loop sample line

4) Recirculation pump discharge sample line

5) Residual heat removal pump miniflow line

6) Residual heat removal loop outlet line.

Lines 1, 2, and 6 are isolated by double disc gate valves, while 3, 4 and 5 are each isolated by two valves in series. These valves can be sealed by nitrogen gas from the high pressure 117 of 215 IPEC00035726 IPEC00035726

IP3 FSAR UPDATE nitrogen supply of the Isolation Valve Seal Water System. A self- contained pressure regulator operates to maintain the nitrogen injection pressure slightly higher than the maximum expected line pressure. These valves are closed during power operation, and the nitrogen gas injection is manually initiated.

The system includes one seal water tank capable of supplying the total requirements of the system. The tank is pressurized from the system's own supply of high pressure nitrogen cylinders through pressure control valves. Design pressure of the tank and injection piping* is 150 psig, and relief valves are provided to prevent overpressurization of the system if a pressure control valve fails, or if a seal water injection line communicates with a high pressure line due to a valve failure in the seal water line.

In certain lines approximately three inches and larger, double disc gate valves are used for isolation. A drawing of this valve is presented in Figure 6.5-2. Redundant isolation barriers are provided when the valve is closed. The upstream and downstream discs are forced against their respective seats by the closing action of the valve. Seal water is injected through the valve bonnet and pressurizes the space between the two valve discs. The seal water pressure in excess of the potential accident pressure eliminates any outleakage past the first isolation point.

For smaller lines, isolation is provided by two globe valves in series (inboard and outboard) outside containment, with the seal water injected into the pipe between the valves. The valves are oriented such that the seal water wets the stem packing and plugs as follows:

1) On process lines ingressing containment (incoming lines) IVSWS will wet both the stem packings and plugs on both the inboard and outboard valves.

2) On process lines egressing containment (outgoing lines) IVSWS will wet both the stem packing and plug on the inboard valve, but only wet the plug on the outboard valve. One exception would be the Steam Generator Slowdown CIVs where both the inboard and outboard valves stem packings and plugs are wetted by IVSWS.

• NOTE: The injection piping runs and nitrogen supply piping are fabricated using 3/8 inch 0.0. tubing, which is capable of 2500 psig service.

When the valves are closed for containment isolation, the first isolation point is the valve plug in the valve closest to Containment. One exception would be the RCP seal injection line CIVs where both the valve plug and stem packing act as isolation pOints. In a number of the smaller lines, isolation is provided by two diaphragm valves in series, with the seal water injected into the pipe between the valves.

The normally acceptable leakage across both the seat and stem packing of any gate or globe valve is 10 cc/hr/inch of nominal pipe diameter. Tests on these valves have indicated that much lower leakage rates can be expected. However, design of the Isolation Valve Seal Water System is based on the conservation assumption that all isolation valves are leaking at five times the acceptable value, or 50 cc/hr/inch of nominal pipe diameter. In addition, should one of the isolation valves fail to seat, flow through the failed valve will be limited to approximately 100 times the maximum acceptable leakage value, or 1000 cc/hr/inch of nominal pipe diameter, by the resistance of the seal water injection path. A water seal at the failed valve is assured by proper slope of the protection line, or a loop seal, or by additional valves on the side of the isolation valves away from the Containment.

118 of 215 IPEC00035727 IPEC00035727

IP3 FSAR UPDATE The seal water tank is sized to provide at least a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> supply of seal water under the most adverse circumstances, i.e., isolation valves leaking at the design rate of 50 /cc/hr/ inch, plus the failure of the largest containment isolation valve to seat and leakage at the maximum rate of 1000 cc/hr/inch. The seal water volume required to satisfy these conditions is approximately 144 gallons. A 176 gallon seal water tank is provided. If all of the isolation valves seat properly, as expected, the tank volume is sufficient for approximately 2Yz days of operation at design seal water flow rates before makeup is required. Two separate sources of makeup water are provided to ensure that an adequate supply of seal water is available for long term operation:

the primary water storage tank and the city water system. The tank is instrumented to provide local indication of pressure and water level; low water level, low pressure and high pressure are alarmed on the Waste Disposal/Boron Recycle Panel on EI. 55 of the PAB. Any of these local alarms will be annunciated in the Control Room.

Seal Water Actuation Criteria Containment isolation (Section 5.2) and seal water injection are accomplished automatically for the penetrating lines requiring early isolation, and manually for others, depending on the status of the system being isolated and the potential for leakage in each case. Generally, the following criteria determine whether the isolation and seal water injection are automatic or manual.

Automatic containment isolation and automatic seal water injection are provided for lines that could communicate with the containment atmosphere and be void of water following a Loss-of-Coolant Accident. These lines are as follows:

• Pressurizer Steam and Liquid Space Sample lines

• Excess Letdown Heat Exchanger Cooling Water supply and return lines

• Letdown line

• Reactor Coolant System sample line

• Containment vent header

• Reactor coolant drain tank gas analyzer line

• Station air line Automatic containment isolation and automatic seal water injection are also provided for the following lines, which are not connected directly to the Reactor Coolant System, but terminate inside the Containment at certain components. These components can be exposed to the reactor coolant or containment atmosphere as the result of leakage or failure of a related line or component. The isolated lines are not required for post-accident service. These lines are as follows:

• Pressurizer relief tank gas analyzer line

• Pressurizer relief tank makeup line

• Safety Injection System test line 119 of 215 IPEC00035728 IPEC00035728

IP3 FSAR UPDATE

• Reactor coolant drain tank pump discharge line

• Steam generator blowdown lines

• Steam generator blowdown sample lines

• Demineralized water to Containment

• Accumulator sample line

• Containment sump pump discharge Manual containment isolation and manual seal water injection are provided for lines that are normally filled with water and will remain filled following the Loss-of-Coolant Accident, and for lines that must remain in service for a time following the accident. The manual seal water injection assures a long term seal. These lines are as follows:

• Reactor coolant pump seal water supply lines

• Reactor coolant pump seal water return line

• Charging line

• Safety injection header

• Containment spray headers

• Reactor coolant pump cooling water supply and return lines Manual containment isolation and manual seal gas injection are provided except as noted for lines that are filled with water during the accident but which are at a pressure higher than that provided by the Isolation Valve Seal Water System. These lines must remain in service for a period of time following the accident, or may be placed in service on an intermittent basis following the accident. These lines are as follows:

• Bypass line from residual heat exchanger outlet to safety injection pump suction

• Residual heat removal loop return line

• Residual heat removal loop sample line (automatic isolation)

• Safety injection line from boron injection tank

• Recirculation pump discharge sample line

• Residual heat removal pump miniflow line

• Residual heat removal loop outlet line 1200f215 IPEC00035729 IPEC00035729

IP3 FSAR UPDATE Seal water injection is not necessary to insure the integrity of isolated lines in the following categories:

Lines that are connected to non-radioactive systems outside the Containment and in which a pressure gradient exists which opposes leakage from the Containment. These include nitrogen supply lines to the pressurizer relief tank, accumulators, reactor coolant drain tank, the instrument air header, the weld channel pressurization air lines, and the pressurizer pressure deadweight calibrator line.

Lines that do not communicate with the Containment or Reactor Coolant System and are missile protected throughout their length inside containment. These lines are not postulated to be severed or otherwise opened to the containment atmosphere as a result of a Loss-of-Coolant Accident. These include the steam and feedwater headers and the Containment ventilation system cooling water supply and return lines.

Lines that are designed for post-accident service as part of the engineered safety features. The only line in this category is the containment sump recirculation line. This line is connected to a closed system outside containment.

Special lines such as the fuel transfer tube, containment purge ducts and the containment pressure relief line. The zone between the two gaskets sealing the blind flange to the inner end of the fuel transfer tube is pressurized to prevent leakage from the containment in the event of an accident. The zone between the two butterfly valves in each containment purge duct is pressurized above incident pressure while the valves are closed during power operation as are the two spaces between the three butterfly valves in the containment pressure relief line.

Components All associated components, piping and structures of the Isolation Valve Seal Water System are designed to Class I seismic criteria.

There are no components of this system located inside containment. The piping and valves for the system including the air-operated valves are designed to accordance with the ANSI Code for Pressure Piping (Power Piping Systems) 831.1.

6.5.3 Design Evaluation The isolation Valve Seal Water System (IVSWS) provides an extremely prompt and reliable method of limiting the fission product release from the containment isolation valves in the event of a loss-of-coolant accident.

The employment of the system during a loss-of-coolant accident, while not considered for analysis of the consequences of the accident, provides an additional means of conservatism in ensuring that leakage is minimized. No detrimental effect on any other safeguards systems will occur should the seal water system fail to operate.

Post-accident access for a total of 22 manual IVSWS valves fed from line No 539 and 542 is provided. (Refer to Plant Drawing 9321-F-27463 [Formerly Figure 6.5-1]) Operation of these valves in an acceptable radiation field area during post-accident plant operating conditions is possible.

121 of 215 IPEC00035730 IPEC00035730

IP3 FSAR UPDATE System Response Automatic containment isolation will be completed within approximately two seconds following generation of the Phase A containment isolation signal. This is the approximate closing time of the air operated containment isolation valves (Section 5.2). This closing time is a nominal value only, and is not used as a valve stroke performance criteria nor as an input to any accident analysis or off-site dose calculation. Since the Isolation Valve Seal Water System is actuated by this signal, automatic seal water injection will be in effect within this nominal time period.

Subsequent generation of the Phase B isolation signal on containment high pressure (spray actuation signal) will close a number of motor operated isolation valves with an approximate closing time of 10 seconds (Section 5.2). This closing time is a nominal value only, and is not used as valve stroke performance criteria nor as an input to any accident analysis or off-site dose calculation.

Seal water (or Nitrogen) injection flow is manually initiated to these valves as well as the remainder of the containment isolation valves that receive a manually initiated closure signal at the appropriate time following the loss-of-coolant accident.

Single Failure Analysis A single failure analysis is presented in Table 6.5-2. The analysis shows that the failure of any single active component will not prevent fulfilling the design function of the system.

Reliance on Interconnected Systems The Isolation Valve Seal Water System can operate and meet its design function without reliance on any other system. Electric power is not required for system operation, although instrument power is required to provide indication in the control room of seal water tank pressure and level.

Shared Function Evaluation Table 6.5-3 is an evaluation of the main components discussed previously and brief description of how each component functions during normal operation and during an accident.

6.5.4 Minimum Operating Conditions The Technical Specifications establish limiting conditions regarding the operability of the system when the reactor is critical.

6.5.5 Inspections and Tests Inspections The system components are all located outside the containment and can be visually inspected at any time.

Component Testing 122 of 215 IPEC00035731 IPEC00035731

IP3 FSAR UPDATE Each automatic isolation valve can be tested for operability at times when the penetrating line is not required for normal service. Lines supplying automatic seal water injection can be similarly tested.

System Testing Containment isolation valves and the Isolation Valve Seal Water System can be tested periodically to verify capability for reliable operation. The seal water tank pressure and water level can be observed locally; low water level, low pressure and high pressure will be annunciated locally on the Waste Disposal Panel.

The system is not in service during the Containment Integrated Leakage Rate Test.

Operational Sequence Testing The capacity of the system to deliver water in accordance with the design was verified initially during the pre-operational test period of plant construction and startup. Prior to plant operation, a containment isolation test signal was used to ensure proper sequence of isolation valve closure and seal water addition.

1230f215 IPEC00035732 IPEC00035732

IP3 FSAR UPDATE TABLE 6.5-1 ISOLATION VALVE SEAL WATER TANK Number 1 Total volume, ft3 23.6 Minimum volume, gal 144 Material ASTM A-240 Design pressure, psig 150 Design temperature, F 200 Operating pressure, psig 45 -100 Operating temperature, F Ambient Code ASME UPV (Sect. VIII) 124of215 IPEC00035733 IPEC00035733

IP3 FSAR UPDATE TABLE 6.5-2 SINGLE FAILURE ANALYSIS -ISOLATION VALVE SEAL WATER SYSTEM Component Malfunction Comments A. Automatically Operated Valves (Open on Phase A Containment Isolation Signal)

1) Isolation valve for automatic Fails to open Two provided. Operation of one required injection headers B. Instrumentation

1) Level transmitter Fails Local level indicator at tank also provided

2) Pressure transmitter Fails Local pressure indicator at tank also provided TABLE 6.5-3 SHARED FUNCTIONS EVALUATION Isolation Valve Seal Component Water Storage Tank (1) N2 Supply Bottles (3)

Normal Operating Function None None Normal Operating Lined up to seal water Lined up to seal water tank Arrangement injection piping Accident Function Source of water for sealing Source of N2 to maintain seal water pressure isolation valves Accident Arrangement Lined up to seal water Lined up to seal water tank injection piping "U

m

()

-u o m o oo o eN o 01 1250f215 o0) -....I (J1 eN

.j:::o.

-....J 0)

.j::>.

IP3 FSAR UPDATE 6.6 CONTAINMENT PENETRATION AND WELD CHANNEL PRESSURIZATION SYSTEM 6.6.1 Design Basis The WCCPPS is incorporated into the design of Indian Point 3 as an engineered safety feature.

Its purpose is to provide pressurized gas to all containment penetrations and most liner inner weld seams such that in the event of a LOCA, there would be no leakage through these potential leakage paths from the containment to the atmosphere. Spaces between selected isolation valves are also served by the WCCPPS. By maintaining the WCCPPS at some pressure level above the peak accident pressure, any postulated leakage would be into the Containment rather than out of the Containment.

Although the WCCPPS is an engineering safety feature, no credit is taken for its operation in calculating the amount of radioactivity released for offsite dose evaluations. For Indian Point 3, offsite dose calculations were performed to demonstrate compliance with 10 CFR 100 guidelines and the results were well within those guidelines. In those calculations, it was assumed that the Containment leaked at a rate of 0.1 % per day of Containment free volume for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 0.045% per day of Containment free volume thereafter.

6.6.2 System Design and Operation

System Description

The containment Penetration and Weld Channel Pressurization System is shown in Plant Drawing 9321-F-27263 [Formerly Figure 6.6-1]. A regulated supply of clean and dry compressed air from either of the plant's 100 psig compressed air systems located outside the Containment is supplied to all containment penetrations and most inner liner weld channels.

The system maintains a pressure in excess of containment calculated peak accident response pressure continuously during all reactor operations thereby ensuring that there will be no out-leakage of the containment atmosphere through the penetrations and most liner welds during an accident. Following a design basis accident, the system will maintain pressure greater than the post accident containment pressure for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Typical piping and electrical penetrations are described in Chapter 5.

The primary source of air for this system is the instrument air system (Chapter 9). Two instrument and control air compressors are used, although only one is required to maintain pressurization at the maximum allowable leakage rate of the pressurization system.

The plant air system acts as a backup to the instrument and control air system added reliability.

One plant air compressor is available for backup.

A standby source of gas pressure for the system is provided by a bank of nitrogen cylinders (see Table 6.6-1). The associated nitrogen system will automatically deliver nitrogen at a slightly lower pressure than the normal regulated air supply pressure. Thus, in the event of failure of the normal and backup air supply systems during periods when the system is in operation, the penetration and weld channel pressure requirements will automatically be maintained by the nitrogen supply. This assures reliable pressurization under both normal and accident conditions.

The backup gas supply is sized such that over the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> period following a LOCA, WCCPPS pressure starts above the peak containment pressure, and then is continually maintained above the post-LOCA containment pressure profile.

126 of 215 IPEC00035735 IPEC00035735

IP3 FSAR UPDATE The design basis leakage rate from the WCCPPS is 0.2% of containment free volume per day, with 0.1 % of containment free volume per day leaking into the containment and an identical amount leaking to the environment.

Once the air receiver pressure decays to a 45 psig zone pressure, an automatic transfer to the backup nitrogen cylinders occurs. The WCCPPS zone is then fed nitrogen until the nitrogen accumulators reach equilibrium pressure with the air receiver. Once this equilibrium pressure is reached, both air and nitrogen mix to supply the leaking WCCPPS zone header until the air receiver and nitrogen accumulators are depleted.

Containment penetration and liner weld channels are grouped into four independent zones to simplify the process of locating leaks during operation. Each such zone is served by its own air receiver. In the event that all normal and backup air supplies are lost, each of the four pressurization system zones continues to be supplied with air from its respective air receiver.

Each of the air receivers (see Table 6.6-2), is sized to supply air to its pressurized zone for a period of at least one hour, based on a leakage rate of 0.2% of the containment free volume per day from the affected zone (0.1 % leakage into the containment and 0.1 % leakage to the environment)

If the receivers become exhausted before normal and backup air supplies can be restored, nitrogen from the bank of pressurized cylinders will be supplied to the affected zones. Together the air receivers and nitrogen bank are sized to provide a 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> supply of gas to the system, again based on a total leakage rate from the pressurization system of 0.2% of the containment free volume in 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. There are three nitrogen cylinders in the bank each 24" OD by 20' 6%"

long. The nitrogen supply will also automatically assume the pressurization gas load in the event that an air receiver fails.

A pressure relief valve set at 175 psig (sized for 1250 scfm at 10% accumulation) protects the system from failure of the pressure reducing valve in the line to each zone from the bank of nitrogen cylinder. Each zone of piping is also protected by a relief valve designed to open at 82 psig. Pressure control valves, isolation valves and check valves are located outside of the containment for ease of inspection and maintenance. Failure of any of these components does not lead to loss of pressure in the system since backup systems automatically augment the normal air supply.

The line to each of the four pressurized zones is equipped with a critical pressure drop orifice (installed in the pressure control valve body) to assure that air consumption will be within the capacity of the system. High air consumption in one zone cannot affect the operation of the other zones under any circumstances.

Means for assuring that the weld channels and penetrations are pressurized is provided by flow-through test lines, connected to the pressurized weld channel zones and penetrations at points as far away from the supply points as possible. Pressurization of the zone is verified by closing off the air supply line and opening the flow-through test line valve to observe the escape of the pressurizing medium. Containment penetration and WCCPPS atmosphere may be sampled by opening the flow through test valves.

Pressure Indication In order to ensure that the station operators are aware at all times that all penetrations and liner weld seam channels are pressurized, the following instrumentation is provided:

1270f215 IPEC00035736 IPEC00035736

IP3 FSAR UPDATE

1) The following pressurized zones are equipped with local pressure gages, mounted outside the containment for ready accessibility and available for regular reading. The accuracy of these gages is within 2% of the full scale reading.

a) Each piping penetration, except piping penetration 0'0' b) Each electrical penetration c) The spaces between the two isolation (butterfly) valves in the purge supply and exhaust ducts d) The two spaces between the three isolation (butterfly) valves in the containment pressure relief line e) The double-gasketed space on the outside hatch of each of the two personnel air locks f) The sump drain line valve enclosure g) Spaces between the Post Accident Containment Vent containment isolation valves

2) The pressurized zones located entirely inside the containment, and those zones located in inaccessible areas, are equipped to actuate pressure switches to provide remote low pressure alarms and identification lights in the control room. Examples of the zones so equipped are:

a) Each liner seam weld channel that remains connected to the Weld Channel Pressurization System b) The double-gasketed space on each inside hatch of the personnel air locks c) The double-gasketed space on the equipment door flange d) The pressurized zones in the spent fuel transfer lube e) Shroud rings over penetration to containment liner weld-piping, and electrical penetrations The actuating pressure for each pressure switch is set just above incident pressure and just below the nitrogen supply regulator setting.

Personnel Air Lock Interlock Continuous pressurization of air-lock door double-gasketed barriers, and the protection of the pressurization header against air loss are assured by a set of interlocks. One interlock on each air-lock door prevents opening of the door until the pressurization line is isolated and pressure in the double-gasketed closure is relieved to atmosphere. This prevents excessive leakage from the pressurization system. The pressurization line to this zone is also equipped with a restricting orifice to assure that air consumption, even upon failure of the interlock, will be within the capacity of the pressurization system, and will not result in a loss of pressure in other zones connected to the same pressurization header. Another set of interlocks prevents opening of one air lock door until the double-gasketed zone on the other door is re-pressurized.

1280f215 IPEC00035737 IPEC00035737

IP3 FSAR UPDATE Containment Purge Line Interlock The containment ventilation purge penetration butterfly valves are also interlocked to prevent the opening of either valve until the pressurization line to the space between the valves has been isolated. Isolation of the pressurization line to each purge duct pressurized zone can be accomplished remotely from the Control Room. Alarm lights, prominently displayed on a panel indicating the isolation status of the containment, remain lit identifying an open purge duct isolation valve or a low pressurization zone pressure. Restricting orifices are installed on each pressurization line to the ventilation purge ducts to assure that air consumption, even on failure of an interlock, will not result in loss of pressure to the other zones connected to the same pressurization header.

The containment pressure relief line isolation valves (three butterfly valves in series), and the two pressurized spaces formed between these valves, are provided with similar interlocking to prevent the opening of any of the butterfly valves until the adjacent intervalve space has been depressurized. The pressurization lines to these spaces are also equipped with flow restricting orifices, and alarm lights in the containment identify open valves or low intervalve space pressure.

Containment Inleakage With a continuous inleakage to the Containment from the penetration and liner weld joint channel pressurization system of 0.1 % of the containment volume per day, the calculated time for the containment pressure to rise by 1 psi is approximately 14 days, and therefore is not considered to be an operating or safety problem. From the standpoint of allowable pressure, a much greater inleakage would be permitted. With the ability to limit the activity of the air in the Containment during normal operation through the use of the two containment auxiliary charcoal filter units, each complete with roughing filters, HEPA filters, and charcoal filters (see Chapter 5).

Containment overpressure can be relieved as required through the pressure relief duct and exhaust fan, passing up the discharge duct, along with the exhaust air from the Primary Auxiliary Building. A narrow range pressure indicator is provided on the local fan panel to assist in operation of the building pressure relief fan. The range is -5 to +5 psig.

Components All associated components, piping, and structures, of the Containment Penetration and Weld Channel Pressurization System are designed to Class I seismic criteria.

The piping and valves for the system are designed in accordance with the ANSI Code for Pressure Piping (Power Piping Systems), B31.1.

For a description of the instrument and control air compressors and the plant air compressor, see Section 9.6.

The three nitrogen cylinders provided meet the requirements of Section VIII (Unfired Pressure Vessels) of the ASME Boiler and Pressure Vessel Code, for 2200 psig maximum pressure, and contain a total of 22,000 scf of nitrogen.

6.6.3 Design Evaluation 1290f215 IPEC00035738 IPEC00035738

IP3 FSAR UPDATE The employment of this system following a Loss-of-Coolant Accident, while not considered in the analysis of the consequences of an accident, provides an additional means for ensuring that leakage is minimized, if not altogether eliminated. No detrimental effect of any other safety features system will be felt should the pressurization system fail to operate.

System Response WCCPPS is not single failure proof, as the WCCPPS zones are not redundant. A nitrogen or air regulator failure may render a zone, or in some instances the entire system, incapable of performing its design function (i.e., pressurize the space between containment isolation valves, weld channels and containment penetrations at a pressure greater than the containment accident pressure profile for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> post accident).

This can be tolerated for the following reasons. While one of the design basis functions for WCCPPS is to minimize offsite releases, WCCPPS is not needed to meet the requirements of 10 CFR 100. In addition, no other safeguards systems are dependent on the operation of WCCPPS. As such, a WCCPPS failure would not create undue risk to the health and safety of the public.

To account for active failures, two parallel WCCPPS supply valves are provided for certain containment isolation lines that are normally or intermittently open during operation. These containment isolation valves automatically close on a containment isolation signal. Opening of one of the two WCCPPS supply valves in each line is sufficient to accomplish pressurization gas injection upon closing of the containment isolation valves.

Shared Functions Evaluation Table 6.6-4 is an evaluation of the main components discussed previously and a brief description of how each component functions during normal operation and during an accident.

6.6.4 Minimum Operating Conditions The Technical Specifications establish limiting conditions regarding the operability of the system when the plant is above MODE 5.

6.6.5 Inspections and Tests Inspections The system components located outside the Containment can be visually inspected at any time.

Components inside the Containment can be inspected during shutdown. All pressurized zones have provisions for either local pressure indication outside the Containment or remote low pressure alarms in the Control Room.

Testing Since the system is in operation continuously during all reactor operations to maintain the penetrations and liner weld channels pressurized above containment design pressure, no special testing of system operation or components is necessary.

130 of 215 IPEC00035739 IPEC00035739

IP3 FSAR UPDATE Should one zone indicate a leak during operation, the specific penetration or weld channel containing the leak can be identified by isolating the individual air supply line to each component in the zone and injecting leak test gas through a capped tube connection installed in each line.

Total leakage from penetrations and weld channels is measured by summing the recorded flows in each of the four pressurization zones. A leak would be expected to build up slowly and would therefore be noted before design leakage limits are exceeded. Therefore, remedial action can be taken before the limit is reached. For those liner welds that are no longer continuously pressurized, a leak would not be identified during plant operation. The integrity of these welds is verified by integrated leak rate testing.

In order to provide facility for testing the larger penetrations, branch pressurizing lines are provided from one of the zones to:

1) The double-gasketed space on each hatch of the Personnel Air Lock.

2) The double-gasketed space at the Equipment Hatch flange.

3) The pressurized zones in the spent fuel transfer tube.

4) The spaces between the two butterfly valves in the purge supply exhaust ducts.

5) The two spaces between the three butterfly valves in the containment pressure relief line.

6) The spaces between double containment isolation valves in the steam jet air ejector return line to containment and in the containment radiation monitor inlet and outlet lines.

7) The spaces between the isolation valves for the Post Accident Containment Vent lines and VC Hydrogen Analyzer lines.

The makeup air flow to the penetrations and liner weld joint channels during normal operation is recognized to be only an indication of the potential leakage from the Containment. However, it does indicate the leakage from the pressurization system, and the degree of accuracy will be increased when correlated with the results of the full scale containment leak rate tests. The criteria for selection of operating limits for air consumption of the pressurization system are based upon the integrated containment leak rate test acceptance criterion and upon the maintenance of suitable reserve air supplies in the static reserves consisting of the air receivers and nitrogen cylinders. A summary of these operating limits is included in the Technical Specifications.

A flow sensing device is located in each of the headers supplying makeup air to the four pressurization zones. Signal output from each of the four flow sensors is applied to an integrating recorder located in the Control Room. Output from all sensors is also applied to a summing amplifier which drives a total flow recorder. High flow alarms are also derived in the recording channel, to alert the operator in the Control Room. The flow measurement range is 0-15 SCFM with an accuracy of +/- 1% of full scale. Since a flow of 0.2% of the containment volume per day at 47 psig is approximately 3.6 Fe/minute, the sensitivity of the flow meters is well within the maximum leakage of the pressurization system.

131 of 215 IPEC00035740 IPEC00035740

IP3 FSAR UPDATE TABLE 6.6-1 CONTAINMENT PENETRATION AND WELD CHANNEL PRESSURIZATION SYSTEM EMERGENCY NITROGEN STORAGE Number 3 Volume, (each) fe 7333*

Material ASTM A-372-CL IV Design pressure, psig 2450 Design temperature, F 200 Operating pressure, psig 2200 Operating temperature, F 100 Code ASME UPV (SECT. VIII)

• NOTE: Each nitrogen cylinder has a volume of 51 fe and can store 7333 standard cubic feet of dry nitrogen at 2200 psig at 70° F.

132 of 215 IPEC00035741 IPEC00035741

IP3 FSAR UPDATE TABLE 6.6-2 CONTAINMENT PENETRATION AND WELD CHANNEL PRESSURIZATION SYSTEM AIR RECEIVERS Number 4 Volume, (each) fe 360 Material ASTM A-285-C Design pressure, psig 140 Design temperature, F 200 Operating pressure, psig 100 Operating temperature, F 100 Code ASME UPV (SECT. VIII) 133 of 215 IPEC00035742 IPEC00035742

IP3 FSAR UPDATE TABLE 6.6-3 SINGLE FAILURE ANALYSIS - CONTAINMENT PENETRATION AND WELD CHANNEL PRESSURIZATION SYSTEM Component Malfunction Comments Instrument Air Control Fails to maintain pressure One of two instrument and control air compressors required to Air Compressor operate.

Pressure Reducing Valve Fails to maintain pressure On valve failure, flow is limited to acceptable value (75 scfm) by the for each zone critical pressure drop orifice. Under low flow conditions, over-pressurization of system downstream of valve is prevented by a relief valve.

"'U m

()

"'U o m o oo o eN o 01 134 of 215 o0) -....I (J1

.j:::..

-....J eN

.j::>.

0)

IP3 FSAR UPDATE TABLE 6.6-4 SHARED FUNCTIONS EVALUATION Normal Operating Normal Operating Component Function Arrangement Accident Function Accident Arrangement Instrument and Control Supply air to plant 2 air compressors in Supply air to penetra- 1 air compressor in Air Compressors (2) instrument and controls operation tions and weld channels operation and to penetrations and weld channels Plant Air Compressor Supply air to station air 1 air compressor in 1 air compressor in (1) headers operation operation N2 Cylinders (3) Backup source of N2 to Lined up to Penetration Backup source of N2 to Lined up to Penetration maintain penetration and Weld Channel maintain penetration and Weld Channel and weld channel Pressurization System and weld channel Pressurization System pressure pressure Air Receivers (1) and Primary source of air for Lined up to Penetration Primary source of air for Lined up to Penetration Dryers (3) penetrations and weld and Weld Channel penetrations and weld and Weld Channel channels Pressurization System channels Pressurization System "U

m

()

-u o m o oo o eN o 01 135 of 215 o0) -....I (J1

.j:::..

.j:::..

-....J

.j::>.

.j::>.

IP3 FSAR UPDATE 6.7 LEAKAGE DETECTION AND PROVISIONS FOR THE PRIMARY AND AUXILIARY COOLANT LOOPS 6.7.1 Leakage Detection Systems The leakage detection systems reveal the presence of significant leakage from the primary and auxiliary coolant loops.

6.7.1.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of the compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3. The NRC has concluded that the current IP3 leakage detection system capability is adequate to continue to support the technical bases cited in the NRC's March 10, 1986, SE approving Leak Before Break (LBB) for the IP3 Primary Coolant Loop piping. This position was further clarified in the IP3 Supplement to Safety Evaluation re: Leakage Detection Systems (TAC No. MB3328, dated 01/30/02).

Monitoring Reactor Coolant Leakage Criterion: Means shall be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary. (GDC 16 of 7/11/67)

Positive indications in the Control Room of leakage of coolant from the Reactor Coolant System to the Containment are provided by equipment which permits continuous monitoring of containment air activity and humidity, and of runoff from the condensate collecting pans under the cooling coils of the containment air recirculation units. This equipment provides indication of normal background which is indicative of a basic level of leakage from primary systems and components. Any increase in the observed parameters is an indication of change within the Containment, and the equipment provided is capable of monitoring this change. The basic design criterion is the detection of deviations from normal containment environmental conditions including air particulate activity, radiogas activity, humidity, condensate runoff. The containment sump system with incorporation of a CR alarm (VC Sump Pump running) or operator actions to increase monitoring of the processing system (i.e. sump flow monitor once every 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />),

provides the capability of detecting a 1 gpm leak within four hours.

These methods are designed to monitor leakage into the Containment atmosphere and as such do not distinguish between identified and unidentified leaks.

Monitoring Radioactivity Releases Criterion: Means shall be provided for monitoring the containment atmosphere and the facility effluent discharge paths for radioactivity released from normal operations, from anticipated transients, and from accident conditions.

136 of 215 IPEC00035745 IPEC00035745

IP3 FSAR UPDATE An environmental monitoring program shall be maintained to confirm that radio-activity releases to the environs of the plant have not been excessive. (GDC 17 of 7/11/67)

The containment atmosphere, the plant ventilation exhaust (including exhausts from the Fuel Storage Building, Primary Auxiliary Building, and Waste Holdup Tank Pit), the containment fan-coolers service water discharge, the component cooling loop liquid, the liquid phase of the secondary side of the steam generator, and the condenser air ejector exhaust are monitored for radioactivity concentration during normal operation, anticipated transients and accident conditions.

Principles of Design The principles for design of the leakage detection systems can be summarized as follows:

1) Increased leakage could occur as the result of failure of pump seals, valve packing glands, flange gaskets or instrument connections. The maximum single leakage rate calculated for these types of failures is 50 gpm which would be the anticipated flow rate of water through the pump seal if the entire seal were wiped out and the area between the shaft and housing were completely open.

2) The leakage detection systems shall not produce spurious annunciation from normal expected leakage rates but shall reliably annunciate increasing leakage.

3) Increasing leakage rate shall be annunciated in the control room. An exception is for the VC sump where compensatory operator action could be used if the CR alarm is unavailable as long as the sensitivity of the credited RCS leak detection system is maintained (i.e., 1 GPM within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />). Operator action will be required to isolate the leak in the leaking system.

For Class I systems located outside the containment, leakage is determined by one or more of the following methods:

1) For systems containing radioactive fluids, leakage to the atmosphere would result in an increase in local atmospheric activity levels and would be detected by either the plant vent monitor or by one of the area radiation monitors. Similarly, leakage to other systems which do not normally contain radioactive fluids would result in an increase in the activity level in that system.

2) For closed systems, leakage would result in a reduction in fluid inventory.

3) All leakage would collect in specific areas of the building for subsequent handling by the building drainage systems, e.g., leakage in the vicinity of the residual heat removal pumps would collect in the sumps provided, and would result in operation, or increased operation, of the associated sump pumps.

Details of how these methods are utilized to detect leakage from Class I systems other than the Reactor Coolant System are given in the following sections and summarized in Table 6.7-1.

1370f215 IPEC00035746 IPEC00035746

IP3 FSAR UPDATE The Authority has established a program to identify and reduce leakage from systems outside containment that would or could contain highly radioactive fluids during a serious transient or accident (NUREG - 0578). Leak test results for these systems are presented in Table 6.7-2.

6.7.1.2 Systems Design and Operation Various methods are used to detect leakage from either the primary loop or the auxiliary loops.

Although described to some extent under each system description, all methods are included here for completeness.

Reactor Coolant System During normal operation and anticipated reactor transients, the following methods are employed to detect leakage from the Reactor Coolant System:

Containment Air Particulate Monitor (R-11)

This channel takes continuous air samples from the containment atmosphere and measures the air particulate beta radioactivity. The samples, drawn outside the containment, are in a closed, sealed system and are monitored by a scintillation counter - filter paper detector assembly. The filter paper collects all particulate matter greater than 1 micron in size on its constantly moving surface, which is viewed by a photomultiplier plastic scintillator combination. After passing through the gas monitor, the samples are returned to the containment.

The filter paper has a 25-day minimum supply at normal speed. The filter paper mechanism and electromagnetic assembly which controls the filter paper movement, is provided as an integral part of the detector unit.

The detector assembly is in a completely closed housing. The detector output is amplified by a preamplifier and transmitted to a microprocessor which converts the detector output to digital and analog signals for display, generates alarms and communicates with the Radiation Monitoring System cabinet in the Control Room. Lead shielding is provided for the radiogas detector to reduce the background radiation level to where it does not interfere with the detector's sensitivity.

The activity is indicated on digital displays and recorded by a stripchart recorder. High-activity alarm indication is displayed on the control room annunciator, and the radiation monitor microprocessor. Local and control room alarms provide operational status of supporting equipment such as pumps, motors and flow and pressure controllers.

The containment air particulate monitor is the most sensitive instrument of those available for detection of reactor coolant leakage into the Containment. The measuring range of this monitor is given in Section 11.2.

The sensitivity of the air particulate monitor to an increase in reactor coolant leak rate is dependent upon the magnitude of the normal baseline leakage into the Containment. The sensitivity is greatest where baseline leakage is low as has been demonstrated by experience.

(See Appendix 68.) Where containment air particulate activity is below the threshold of detectability, operation of the monitor with stationary filter paper would increase leak sensitivity to a few cubic centimeters per minute.

Using a source term based on six months after start up through the end of the operating cycle with little fuel defect, varying ambient background level, the least conservative detection 138 of 215 IPEC00035747 IPEC00035747

IP3 FSAR UPDATE capability for R-11 is not expected to exceed a value of 2 gpm within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />. Varying detector background, RCS activity level and failed fuel conditions are contributors to changes in R-11 detection capability.

Containment Radioactive Gas Monitor (R-12)

This channel measures the gaseous beta radioactivity in the Containment by taking the continuous air samples from the containment atmosphere, after they pass through the air particulate monitors, and drawing the samples through a closed, sealed system to a gas monitor assembly.

Each sample is constantly mixed in the fixed, shielded volume, where it is viewed by a plastic scintillator coupled to a heated photomultiplier. The samples are then returned to the Containment.

The detector is in a completely enclosed housing. Lead shielding is provided to reduce the background radiation level to a point where it does not interfere with the detector's sensitivity. A preamplifier is mounted at the detector skid.

The detector outputs are transmitted to a microprocessor which converts the detector output to digital and analog signals for display, and communicates with the Radiation Monitoring System cabinet in the Control Room. The activity is indicated by a digital display and recorded by a stripchart recorder. High-activity alarm indications are displayed on the control room annunciator and the radiation monitoring microprocessor. Local and control room alarms annunciate the supporting equipments' operational status.

The containment radioactive gas monitor is inherently less sensitive. Varying detector background, RCS activity level and failed fuel conditions are contributors to changes in R-12 detection capability. As the detector background increases, either the time to detect a 1gpm leak goes higher or the detectable RCS leak rate is greater than 1 gpm within the specified time frame. The measuring range of this monitor is given in Section 11.2.

R 11/12 and its associated equipment will provide indication of normal background which is indicative of a basic level of leakage from primary systems and components. Any increase in the observed parameters is an indication of the change within the Containment and the equipment provided is capable of monitoring the change.

The NRC has concluded that the current IP3 leakage detection system capability is adequate tom continue to support the technical bases cited in the NRC's March 10, 1986, SE approving Leak Before Break (LBB) for the IP3 Primary Coolant Loop piping. This position was further clarified in the IP3 Supplement to Safety Evaluation re: Leakage Detection Systems (TAC No.

MB3328, dated 01/30/02).

Humidity Detector The humidity detection instrumentation offers another means of detection of leakage into the Containment. Although this instrumentation has not nearly the sensitivity of the air particulate monitor, it has the characteristics of being sensitive to vapor originating from all sources within the Containment, including the reactor coolant and steam and feedwater systems. Plots of containment air dew point variations above a base-line maximum established by the cooling water temperature to the air coolers should be sensitive to incremental increases of water 1390f215 IPEC00035748 IPEC00035748

IP3 FSAR UPDATE leakage to the containment atmosphere on the order of 0.25 gpm per F degree of dewpoint temperature increase.

The sensitivity of this method depends on cooling water temperature, containment air temperature variation and containment air recirculation rate.

Condensate Measuring System This method of leak detection is based on the principle that under equilibrium conditions, the condensate flow draining from the cooling coils of the containment air handling units will equal the amount of water (and/or steam) evaporated from the leaking system. Reasonably accurate measurement of leakage from the Reactor Coolant System by this method is possible because containment air temperature and humidity promote complete evaporation of any leakage from hot systems. The ventilation system is designed to promote good mixing within the containment. During normal operation the containment air conditions will be maintained near 120° F DB and 92° F WB (approximately 36% Relative Humidity) by the fan coolers.

When the water from a leaking system evaporates into this atmosphere, the humidity of the fan cooler intake air will begin to rise. The resulting increase in the condensate drainage rate is given by the equation:

D = L [1-exp(-Q / Vt)]

Where:

D = Change in drainage rate after initiation of increased leakage rate (gpm)

L = Change in evaporated leakage rate (gpm)

Q = Containment ventilation rate (CFM)

V = Containment free volume (fe)

T = Time after start of leak (min.)

Therefore, if four fan cooler units are operating (Q = 280,000 CFM), the condensation rate would be within 5% of a new equilibrium value in approximately 200 minutes after the start of the leak. Detection of the increasing condensation rate, however, would be possible within 5 to 10 minutes.

The condensate measuring device consists essentially of a vertical 6 inch diameter standpipe with a weir cut into the upper portion of the pipe to serve as an overflow. Each fan cooler is provided with a standpipe which is installed in the drain line from the fan cooler unit. A differential pressure transmitter near the bottom of the standpipe is used to measure the water level. Each unit can be drained by a remote operated valve.

A wide range of flow rates can be measured with this device. Flows less than 1 gpm are measured by draining the standpipe and observing the water level rise as a function of time.

Condensate flows from 1 gpm to 30 gpm can be measured by observing the height of the water level above the crest notch of the weir. This water head can be converted to a proportional flow rate by means of a calibration curve. A high level alarm, set above the established normal (baseline) flow, is provided for each unit to warn the operator when operating limits are approached.

All indicators, alarms, and controls are located in the Control Room. This method provides a backup to the radiation monitoring methods.

140 of 215 IPEC00035749 IPEC00035749

IP3 FSAR UPDATE Component Cooling Liquid Monitors CR-17A and R-17B)

These channels continuously monitor the component cooling loop of the Auxiliary Coolant System for activity indicative of a leak of reactor coolant from either the Reactor Coolant System, the recirculation loop, or the residual heat removal loop of the Auxiliary Coolant System, Each scintillation counter is located in an in-line well downstream of the component cooling heat exchangers. The detector assembly output is amplified by a preamplifier and transmitted to the Radiation Monitoring System cabinets in the Control Room. The activity is indicated on a meter and recorded. High activity alarm indications are displayed on the control board annunciator in addition to the Radiation Monitoring System cabinets.

The measuring range of this monitor is given in Section 11.2 Condenser Air Ejector Gas Monitor CR-15)

The channel monitors the discharge from the air ejector exhaust header of the condensers for gaseous radiation, which is indicative of a primary to secondary system leak. The gas discharge is routed to the turbine roof vent. In order to quantify the amount of radiation release from the condensers into the atmosphere, flow measuring instrumentation is installed into the same line with an output to the critical function monitoring system (CFMS). On high radiation level alarm, this gas discharge is diverted to the containment.

The detector output is transmitted to a microprocessor which converts the detector output to digital and analog outputs for display, generates alarms and communicates with the Radiation Monitoring System cabinet in the Control Room. The activity is indicated by a digital display and recorded by a stripchart recorder. High activity alarm indications are displayed on the control room annunciator and the radiation monitoring microprocessor.

A gamma sensitive Sodium Iodide (Nal) crystal scintillatorl photomultiplier tube is used to monitor the gaseous radiation level. The radiation monitor consists of a 3" pipe section in series with the steam jet air ejector exhaust line, a thin-walled sealed well (perpendicular to and penetrating the 3" pipe) which houses the Nal/PM assembly, and ample lead shielding to reduce background radiation interference to an acceptable level.

Steam Generator Liquid Sample Monitor CR-19)

This channel monitors the liquid phase of the secondary side of the steam generator for radiation, which would indicate a primary-to-secondary system leak, providing backup information to that of the condenser air ejector gas monitor. Samples from the bottom of each of the four steam generators are mixed to a common header and the common sample is continuously monitored by one of two separate scintillation detectors. Upon indication of a high radiation level, each steam generator is individually sampled in order to determine the source.

This sampling sequence is achieved by manually selecting the desired unit to be monitored and allotting sufficient time for sample equilibrium to be established (approximately 1 minute).

The sensitivity range of this monitor is given in Table 11.2-7.

A photomultiplier tube - scintillation crystal (Nal combination, mounted in a hermetically sealed unit, is used to monitor liquid effluent activity. Lead shielding is provided to reduce the background level so it does not interfere with the detector's maximum sensitivity. The in-line, fixed - volume container is an integral part of the detector unit.

141 of 215 IPEC00035750 IPEC00035750

IP3 FSAR UPDATE Personnel can enter the Containment and make a visual inspection for leaks. The location of any leak in the Reactor Coolant System would be determined by the presence of boric acid crystals near the leak. The leaking fluid transfers the boric acid crystals outside the Reactor Coolant System and the evaporation process leaves them behind.

If an accident involving gross leakage from the Reactor Coolant System occurred it could be detected by the following methods:

Pump Activity During normal operation only one charging pump is operating. If a gross loss of reactor coolant to another closed system occurred which was not detected by the methods previously described, the speed of the charging pump would indicate the leakage.

The leakage from the reactor coolant will cause a decrease in the pressurizer liquid level that is within the sensitivity range of the pressurizer level indicator. The speed of the charging pump will automatically increase to try to maintain the equivalence between the letdown flow and the combined charging line flow and flow across the reactor coolant pump seals. If the pump reaches a high speed limit, an alarm is actuated.

A break in the primary system would result in reactor coolant flowing into the Containment, reactor vessel, and/or recirculation sumps. Leakage to these sumps would be indicated by the frequency of operation of the containment or recirculation pumps. Since the building floor drains preferentially to the containment sump, the operating frequency of the containment sump pumps wold be more likely to indicate the leak than the operating frequency of the recirculation or reactor vessel sump pumps.

The containment sump contains two redundant level loops consisting of a transmitter and sensor inside containment, and a recorder, indicator and power supply in the control room.

An overflow alarm provides an annunciated alarm on the control room supervisory panel if the level in the sump reaches the containment floor.

The containment sump contains two (2) sump pumps which are actuated by separate pump float switches. These pumps discharge the water to the waste holdup tank outside Containment.

Located on this discharge line outside containment is the flow meter and totalizer, which indicates on the Primary Auxiliary Building waste disposal panel the flow from the pumps and a cumulative measure of the amount of water being discharged from containment. The cumulative volume is trended by the control room operators to identify any abnormal increases in leakage on a daily basis. In addition, indicating lights on the waste disposal panel indicate when the containment sump pumps are running. This panel is periodically operated and monitored by the auxiliary operator who reports directly to the control room operator. The containment sump system with incorporation of a CR alarm (VC Sump Pump running) or operator actions to increase monitoring of the processing system (i.e. sump flow monitor once every four hours), provides the capability of detecting a 1 gpm leak within four hours.

The recirculation sump contains two redundant level loops consisting of a transmitter and sensor inside containment, and a recorder, indicator and power supply in the control room.

Loss of both of these level indications requires a plant shutdown in accordance with Technical Specifications. The recirculation pumps, which discharge into the Reactor Coolant System, are 142 of 215 IPEC00035751 IPEC00035751

IP3 FSAR UPDATE required for a LOCA and require an immediate plant shutdown in accordance with Technical Specifications if they become inoperable.

The reactor pit contains a level sensor which annunciates two alarms at two separate levels on the control room supervisory panel. These alarms annunciate at different levels when the pit accumulates water prior to the level reaching the in-core instrumentation tubing for the reactor vessel. In addition, the running of the first sump pump illuminates an indicating light on the Control Room supervisory panel. At the present time, during normal plant operation, there is no means to test operability of either the level indication or pumps since this sump is normally maintained dry.

The containment sump contains redundant level indication. Loss of both of these level indications requires a plant shutdown in accordance with the Technical Specifications. Even if both level indications were inoperable, the level probe at the top of the sump would still provide an annunicated alarm.

Liquid Inventory Gross leaks might be detected by unscheduled increases in the amount of reactor coolant makeup water which is required to maintain the normal level in the pressurizer.

A large tube side to shell side leak in the non-regenerative (letdown) heat exchanger would result in reactor coolant flowing into the component cooling water and a rise in the liquid level in the component cooling water surge tank. The operator would be alerted by a high water alarm for the surge tank and high radiation and temperature alarms actuated by monitors at the component cooling water pump suction header.

A high level alarm for the component cooling water surge tank and high radiation and temperature alarms actuated by monitors at the component cooling pump suction header could also indicate a thermal barrier cooler coil rupture in a reactor coolant pump. However, in addition to these alarms, high temperature and high flow on the component cooling outlet line from the pump would activate alarms.

Leakage might also be indicated by a rise in the normal containment and/or recirculation sump levels. High level in either of these sumps is indicated in the Control Room. Since the building floor drains preferentially to the containment sump, the containment sump level transmitter would most likely be actuated prior to the level transmitter in the recirculation sump.

The maximum leak rate from an unidentified source that will be permitted during normal operation is 1 gpm.

Leakage directly into the Containment indicates the possibility of a breach in the coolant envelope. The limitation of 1 gpm for a source of leakage not identified is sufficiently above the minimum detectable leakage rate to provide a reliable indication of leakage. The 1 gpm limit is well below the capacity of one coolant charging pump (98 gpm).

The relationship between leak rate and crack site has been studied to detail in WCAP-7503(1),

Revision 1, February 1972. This report includes the following information:

1) The length of a through-wall crack that would leak at the rate of the proposed limit, as a function of wall thickness.

143 of 215 IPEC00035752 IPEC00035752

IP3 FSAR UPDATE

2) The ratio of that length to the length of a critical through-wall crack, based on the application of the principles of fracture mechanics.

3) The mathematical model and data used in such analyses.

Leak rate detection is not relied upon for assuring the integrity of the primary system pressure boundary during operation. The conservative approach which is utilized in the design and fabrication of the components which constitute the primary system pressure boundary together with the operating restrictions which are imposed for system heatup and cool down give adequate assurance that the integrity of the primary system pressure boundary is maintained throughout plant life. The periodic examination of the primary pressure boundary via the in-service inspection program (specified in the Technical Specifications) will physically demonstrate that the operating environment will have no deleterious effect on the primary pressure boundary integrity.

The maximum unidentified leak rate of 1 gpm which is permitted during normal operation is well within the sensitivity of the leak detection systems incorporated within the containment, and it reflects good operating practice based on operating experience gained at other PWR plants.

Detection of leakage from the primary system directs the operator's attention to potential sources of leakage, such as valves, and permits timely evaluation to ensure that any associated activity release does not constitute a public hazard, that the reactor coolant inventory is not significantly affected and that the leakage is well within the capability of the containment drainage system.

Residual Heat Removal Loop The residual heat removal loop removes residual and sensible heat from the core and reduces the temperature of the Reactor Coolant System during the second phase of plant shutdown.

During normal operation, the containment air particulate and radioactive gas monitors, the humidity detector and the condensate measuring system provide means for detecting leakage from the section of the residual heat removal loop inside the Reactor Containment. These systems have been described previously in this section (see description of leak detection from the Reactor Coolant System). Leakage from the residual heat removal loop into the component cooling water loop during normal operation would be detected outside the Containment by the component cooling loop radiation monitor (see analysis of detection of leakage from the Reactor Coolant System in this section).

The physical layout of the two residual heat removal pumps is within separate shielded and isolated rooms within the Primary Auxiliary Building. Detection of a leaking residual heat removal pump is thus possible by means of the radiation monitors provided on the Primary Auxiliary Building plant ventilation system which exhausts these pump compartments.

Alarms in the control room will alert the operator when the activity exceeds a preset level. Small leaks to the environment could be detected with these systems within a short time after they occurred.

When the plant is shutdown personnel can enter the Containment to check visually for leaks.

Detection of the location of significant leaks would be aided by the presence of boric acid crystals near the leak.

144 of 215 IPEC00035753 IPEC00035753

IP3 FSAR UPDATE In case of an accident which involves gross leakage from the part of the residual heat removal loop inside the containment, this leakage would be indicated by a rise in the containment and/or recirculation sump levels. Both these sumps have redundant level indication in the control room. As the building floor drains preferentially to the containment sump, the level transmitter in this sump would most likely be actuated first.

Should a large tube side to shell side leak develop in a residual heat exchanger or the seal heat exchanger of a residual heat removal pump break, the water level in the component cooling surge tank would rise and the operator would be alerted by a high water alarm. Radiation and temperature monitors at the component cooling water pump header will also signal an alarm.

Leakage from both of the residual heat removal pumps is drained to a common sump equipped with a sump pump. The sump pump starts automatically and transfers this leakage to the waste holdup tank; indication and alarm for high level in this tank is made on the waste disposal panel.

This would provide indication of gross leakage (i.e., a seal failure from a residual heat removal pump).

Recirculation Loop If a break occurs in the Reactor Coolant System, the recirculation loop provides long-term protection by recirculating spilled reactor coolant and injected refueling water.

Leakage from the residual heat exchanger would be detected by a radiation monitor (discussed in the section on leak detection from the Reactor Coolant System) at the component cooling water pump discharge header.

A rise in the liquid level in the component cooling surge tank would result if a large tube side to shell side leak developed in a residual heat exchanger. The operator would be alerted by a high level alarm in the component cooling water surge tank and a high radiation and temperature alarm actuated by monitors at the component cooling water pump header.

If the external recirculation loop is used, leakage from the section outside the Containment would be directed by floor drains to the auxiliary building sump and / or sump tank. From here, it is automatically transferred by pumps to the waste holdup tank. Indication and alarm for high level is made on the waste disposal panel. This would serve to alert the operator of the leakage.

Component Cooling Loop Leakage from the component cooling loop inside the Reactor Containment could be detected by the humidity detector and/or the condensate measuring system (see section on Reactor Coolant System leak detection for a description of these systems).

Visual inspection inside the Containment is possible.

Gross leakage from the component cooling loop would be indicated inside the containment by a rise in the liquid level of the containment and/or recirculation sumps. Both of these sumps have redundant level indication in the Control Room. As the building floor drains preferentially to the containment sump, the level transmitter in the sump would be more likely to signal the occurrence of leakage.

If the leakage is from a part of the component cooling loop outside the Containment, it would be directed by floor drains to the auxiliary building sump and/or sump tank. The auxiliary building 145 of 215 IPEC00035754 IPEC00035754

IP3 FSAR UPDATE sump pumps and/or sump tank pumps then automatically transfers the leakage to the waste holdup tank. Indication and alarm for high level is made on the waste disposal panel. This would serve as a means of leak detection for this part of the system.

Leakage of Component Cooling Water into the Service Water System through the Component Cooling Water Heat Exchangers can be detected by a radiation monitor (R-23) which monitors the Service Water return line from the CCW Heat Exchangers. A high radiation alarm is annunciated in the Control Room.

Service Water System During a Loss-of-Coolant Accident the containment fan coolers service water monitors check the containment fan service water discharge line for radiation indicative of a leak from the containment atmosphere into the service water. A small bypass flow from each of the heat exchangers is mixed in a common header and monitored by redundant Nal scintillation detectors. Upon indication of a high radiation level, each heat exchanger is individually sampled to determine which unit is leaking. This sampling sequence is achieved by manually selecting the desired unit to be monitored and allotting sufficient time for sample equilibrium to be established (approximately 1 minute). This method of fan cooler unit (FCU) or FCU motor cooler leak detection and isolation may be performed up until the entry into external recirculation. This is sufficient time to detect and isolate the leak, since the passive failure of the cooling coil is assumed to occur concurrently with the LOCA.

The measuring range of these monitors is given in Section 11.2.

Gross leakage from the Service Water System due to a faulty cooling coil in the Containment Air Recirculation Cooling and Filtration System can be detected by stopping the fans and continuing the cooling water flow. Any significant cooling water leakage would be seen as flow into a collecting pan.

Leakage from a component in the Service Water System in the Primary Auxiliary Building will be directed by floor drains to the Primary Auxiliary Building sump tank. Pumps will then transfer this leakage to the waste holdup tank. Indication and alarm for high level is made on the waste disposal panel, and would serve as a means of leak detection.

Service Water System leaks inside Containment which are directed to the containment sump and/or the recirculation sump are handled and detected in the same manner as Reactor Coolant System leaks.

6.7.1.3 Pre-Operational Testing Since initial operation was substantially without benefit of the containment air particulate monitor and radioactive gas monitor to indicate leaks, the performance of the humidity detector and the condensate measuring system was verified as follows:

The radiogas monitor, air particulate monitor, and humidity detectors were tested prior to plant installation. After installation, the radiogas and air particulate monitors were checked for operability as part of the system checkout of the Radiation Monitoring System utilizing the build-in check source provided in each detector. Sensitivity of the condensate measuring systems and humidity detectors were verified as part of the Indian Point 2 Test Program. These tests demonstrated system sensitivities.

146 of 215 IPEC00035755 IPEC00035755

IP3 FSAR UPDATE During the startup test program at Indian Point 2, a reactor coolant leak of known magnitude was simulated inside the containment vessel, and the performance of the humidity detector and condensate measuring system was observed. The leak was simulated by introducing steam into the Containment at a known rate during a period when containment atmospheric conditions were stable and the fan cooler units were operating. The increase in containment atmosphere moisture content, as indicated by the humidity detectors, was recorded as a function of time following initiation of the simulated leak. As a check, the same information was determined independently using different instrumentation. Elapsed time until condensation on the fan cooler unit cooling coils began, as indicated by the condensate measuring devices, was recorded and compared with the calculated value based on the initial containment humidity.

Steam flow continued, and the performance of the condensate measuring devices in indicating the magnitude of steady cooling coil runoff was observed. As the design of this system was verified in Indian Point 2, it was not necessary to repeat the test on Indian Point 3.

Operability of Technical Specification required radiogas and air particulate monitors is checked periodically in accordance with Technical Specification requirements. Simple comparative checks between the six humidity detectors or between the five condensate measuring systems readily confirm operability of these detection systems.

6.7.2 Leakage Provisions Provisions are made for the isolation and containment of any leakage.

6.7.2.1 Design Basis The provisions made for leakage are designed to prevent uncontrolled leaking of reactor coolant or auxiliary cooling water. This is accomplished by (1) isolation of the leak by valves, (2) designing relief valves to accept the maximum flow rate of water from the worst possible leak, (3) supplying redundant equipment which allows a standby component to be placed in operation while the leaking component is repaired and (4) routing the leakage to various sumps and holdup tanks.

6.7.2.2 Design and Operation Various provisions avert uncontrolled leakage from the primary and auxiliary coolant loops.

The leak detection sensitivity of the radiation monitors during plant operation depends upon the primary coolant activity level and the normal baseline leakage. Reliable indications of coolant leakage above baseline are assured when the coolant activity and baseline leakage result in containment atmospheric activity levels within the sensitivity ranges of the radiation monitors.

The sensitivity ranges of these monitors, and examples of their leak detection response times for various design coolant activity levels are given in Section 6.7.1.2.

When the containment atmospheric activity level is below the threshold of detectability of the radiation monitors, a primary coolant leak would be detected by the other redundant leak detection systems that monitor nonradioactive parameters (humidity, condensate runoff, liquid inventory, containment sump system).

6.7.2.3 Reactor Coolant System When significant leakage from the Reactor Coolant System is detected, action is taken to prevent the release of radioactivity to the atmosphere outside the plant.

147 of 215 IPEC00035756 IPEC00035756

IP3 FSAR UPDATE If either the containment air particulate activity or the radioactive gas activity exceed preset levels on the containment air particulate and radioactive gas monitors, respectively, the containment purge supply and exhaust duct valves and pressure relief line valves are closed.

On high radiation alarm signaled by the condenser air ejector monitor, the condenser exhaust gases are diverted from the turbine roof vent to the Containment through a blower.

A high radiation alarm actuated by the steam generator liquid sample monitor initiates closure of the isolation valves in the blowdown lines and sample lines.

If a leak should develop from the Reactor Coolant System to the component cooling loop, a high radiation alarm will actuate in the control room. If the leak is large, the component cooling surge tanks will fill and overflow to the waste hold-up tanks in the Primary Auxiliary Building.

A large leak in the Reactor Coolant System pressure boundary, which does not flow into another closed loop, would result in reactor coolant flowing into the containment sump and/or the recirculation sump.

Experience with the detection of primary system leakage into the containment vessel of Indian Point 1 is discussed in Appendix 6B.

Evaluation of Potential Leakage from the Reactor Coolant System In considering potential leakage from the Reactor Coolant System containing primary coolant at high pressure, four categories should be considered:

I - Leakage to the reactor coolant drain tank.

II - Leakage to the pressurizer relief tank.

III - Leakage to the containment environment.

IV - Leakage to the interconnecting systems.

For clarity, each of these paths are discussed in turn.

I - Paths Directed to the Reactor Coolant Drain Tank (RCDT)

The routes directed to the Reactor Coolant Drain Tank may be summarized as follows:

1) Reactor Coolant System Loop Drains

2) Accumulator Drains

3) Auxiliary System Equipment Drains

4) Excess Let-down

5) Valve Leakoffs

6) Reactor Coolant Pumps Seal Leakage

7) Reactor Flange Leak-off Of these paths, (1) through (4) do not present a leakage load on the RCDT during normal operation; leakage from the high pressure systems is not expected because of the use of double isolation valves. Path (5) through (7) merit some discussion.

Valve Leak-offs 148 of 215 IPEC00035757 IPEC00035757

IP3 FSAR UPDATE Source - there are some twenty-six valves provided with leak-offs in the containment. Of these valves, only two valves in the Reactor Coolant System, one valve in the Chemical and Volume Control System and four valves in the Safety Injection System will normally have their valve stem packing subjected to pressure.

342 First isolation valve in the letdown line is normally fully open.

535 Pressurizer relief isolation valves which are normally fully open.

536 894A Accumulator isolation valves are normally open. The only leakage would be borated 894B non-radioactive water.

894C 894D Estimated Leakage - In the original FSAR, total leakage of reactor coolant fluid during normal power operation was conservatively estimated by assuming the use of the valve backseat for valves 342, 535, and 536 shown above as well as for valves 571A, 571B, 571C, and 571D (since removed by the RCS RTD Bypass Manifold Removal modification). Since backseats are capable of limiting leakage to less than 1.0 cc per hour per inch of stem diameter, assuming no credit for valve packing, it was assumed that the valves would leak at this rate. Hence for these original seven valves, a total leakage of 7 cc/hr was assumed. Consistent with industry practice, backseats are not used at IP3. The valve packing is used to minimize stem leakage.

Actual RCS leakage is monitored and controlled to Technical Specification limits.

Indication to operator - The operator is alerted to abnormal conditions by an increase of the drain tank water temperature and eventually the change in tank level. Drain tank temperature, pressure, and level are continuously indicated on the "waste disposal/boron recycle" panel in the auxiliary building. High pressure, high temperature, high level and low level are annunciated on the panel. Any alarm on the WDS/BR panel causes annunciation of a single window on the main control board.

Reactor Coolant Pump Seals Source - Charging flow is directed to the reactor coolant pumps via a seal-water-injection filter.

It enters the pumps at a point between the labyrinth seals and the No. 1 face seal. Here the flow splits and a portion (normally about 5 gpm) enters the Reactor Coolant System via the labyrinth seals and thermal-barrier-cooler cavity. The remainder of the flow (normally about 3 gpm) flows up the pump shaft (cooling the lower bearing) and leaves the pump via the No. 1 seal where its pressure is reduced to about 25-30 psig and its temperature is increased from 130°F to about 136°F. The labyrinth flows (20 gpm total for four reactor coolant pumps) are removed from the system as a portion of the letdown flow. The No.1 seal discharges (12 gpm total for our reactor coolant pumps) flow to a common manifold and then via a filter through the Seal Water Heat Exchanger (where the temperature is reduced to about 130°F) to the volume control tank.

The leak-off system between the No.2 and No.3 seals is considered to be part of the Reactor Coolant System. The leak-off system collects leakage passed by the No.2 seal, provides a constant backpressure on the No.2 seal and constant pressure on the No.3 seal. A standpipe is provided to give a constant backpressure during normal operation. The first outlet from the standpipe is orificed to permit normal No. 2 seal leakage to flow to the reactor coolant drain 1490f215 IPEC00035758 IPEC00035758

IP3 FSAR UPDATE tank; excessive No.2 seal leakage will result in a rise in the standpipe level and eventual overflow to the reactor coolant drain tank via a second overflow connection.

Leakage - The normal No.2 seal flow will be 3 gph per pump. This is the value specified in the Reactor Coolant Pump Equipment Specification.

Indication to Operation - Level instrumentation on the standpipes is provided to alert the operator to abnormal conditions. The standpipe consists of a pipe with an orificed overflow at the mid-point, a normally closed drain (for service) at the bottom, and a free-flowing overflow at the top. Normal No.2 seal leakage will flow freely out the mid-point overflow. Excessive leakage will "back-up" in the standpipe until it overflows out the top. A level switch in the upper standpipe actuates an annunciator indicating excessive flow. A level switch in the lower standpipe causes annunciation of the opposite condition which could result in undesirable dry operation of the No.3 seal.

Reactor Vessel Flange Leak-off Source - The reactor vessel flange and head are sealed by two metallic o-rings. To facilitate leakage detection, a leak-off connection was placed between the two o-rings and a leak-off connection was placed beyond the outer o-ring. Piping and associated valving was provided to direct any leakage to the reactor coolant drain tank.

Leakage - During normal operation, the leakage will be negligible since it was specified in the Reactor Vessel Equipment Specification that there is to be zero leakage past the outer o-ring under normal operating and transient conditions.

Indication to Operator - A temperature detector will indicate leakage by a high temperature alarm. The operator is further alerted by the associated increase in drain tank water temperature and eventually the change in tank level.

II - Paths Directed to Pressurizer Relief Tank (PRT)

Source - The PRT condenses and cools the discharge from the pressurizer safety and relief valves. Discharge from smaller relief valves located inside the containment is also piped to the relief tank. During normal operation, leakage could possibly occur from either the pressurizer safety valves, pressurizer relief valves or the CVCS letdown station relief valve.

Leakage - During normal operation, the leakage to the pressurizer relief tank is negligible since the valves were designed for essentially zero leakage at the normal system operating pressure, as specified in the respective valve equipment specifications.

Indication to Operator - For each valve, temperature detectors are provided in the discharge piping to alert the operator to possible leakage.

The rate of increase of the water temperature in the pressurizer relief tank and the level change will indicate to the operator the magnitude of the leakage. In the event of excessive leakage into an interconnecting system causing lifting of the local relief valves, the operator would again be alerted to the situation by a rising tank water temperature (see discussion for Category IV below). To further assist the operators in evaluating pressurizer relief tank conditions, there is a pressure recorder which takes pressure fluctuation data from pressurizer relief tank pressure transmitter and plots it in the CCR.

150 of 215 IPEC00035759 IPEC00035759

IP3 FSAR UPDATE All of the pressurizer power operated relief valves and their associated motor-operated block valves have been provided with an acoustic monitoring system for position indication. Should there be any significant leakage from any of these valves, this system initiates an alarm in the control room.

III - Releases to the Containment Environment Source - The main contributors of leakage to the containment environment may be listed as follows:

1) Valve stem leakages

2) Reactor Coolant Pump No.3 seal leakage

3) Weld leakages

4) Flange leakages Valve Stem Leakage With exception of the pressurizer spray valves, the modulating valve within the containment are provided with leakoff connections which in turn are piped to the reactor coolant drain tank. Of the remaining valves which serve lines and components containing reactor coolant, only two are not normally fully open or fully closed; i.e., the continuous spray bypass needle valves around the main spray valves. The remaining valves are provided with backseats which are capable of limiting leakage to less than one cubic centimeter per hour per inch of stem diameter assuming no credit for packing in the valve. Normally closed globe valves are installed with recirculation flow under the seat to prevent stem leakage from the more radioactive fluid side of the seat.

On the basis of these pessimistic assumptions, the leakage from valves was originally estimated to be approximately 50 cc/hr.

• Modulating valves PCV-455A and PCV-4558 were originally installed with intermediate packing leak-off lines piped to the RCDT. The original assumption was that this configuration would result in a maximum leakage to the RCDT of 6 cC/hr/valve through the packing. A modification resulted in replacement of the standard packing with a live loaded packing configuration to mitigate the potential of any leakage and capping of the existing leakoff line as no longer required. For conservatism, in the unlikely event of failure of the live-load packing, this assumption as to leakage quantity remains.

However, the leakage path would now be to the containment environment in lieu of the RCDT.

• CH-342 was originally supplied with a lantern ring and a leakoff line that was routed to the Reactor Coolant Drain Tank (RCDT) in the event of packing failure. A live load packing configuration has been incorporated in the design of this valve and, consequently, the leakoff line has been retired in place and any potential leak path is to the Containment environment. (Reference NSE 98-3-156 CVCS, Rev. 1)

As a general rule, open valves are not backseated. The plant relies on packing to minimize stem leakage. Actual leakage is monitored and controlled to Technical Specification limits.

Reactor Coolant Pump No.3 Seal Leakage 151 of 215 IPEC00035760 IPEC00035760

IP3 FSAR UPDATE A small continuous leakage is anticipated past the No.3 seal to the containment environment; this fluid will be charging water and was anticipated to be of the order of 100 cc/hr per pump.

This is the value specified in the Reactor Coolant Pump Equipment Specification. The No.3 seal leak-off is diverted to the local open drains and is thus released to the containment environment.

Weld Flanges The welded joints throughout the system were subjected to extensive non-destructive testing; leakage through metal surfaces and welded joints is very unlikely.

Flange Joints There are a number of flanged joints in the system; all of which will be subjected to leak testing before power operation. Experience has shown that hydrostatic testing is successful in locating leaks in a pressure containing system.

Methods of leak location which can be used during plant shutdown include visual observation for escaping steam or water or for the presence of boric acid crystals near the leak. The boric acid crystals are transported outside the Reactor Coolant System in the leaking fluid and deposited by the evaporation process.

Leakages - The main contributors to leakage to the containment environment are considered to be (1) and (2); experience with operating reactors has shown that following the normal pre-operational testing, leakage from these sources is negligible.

Conclusion On the basis of the above, the analysis of the situation indicates a total leak rate to the containment environment of the order 450 cc/hr. For design purposes 50 Ib/day (i.e., 1000cc/hr was assumed.

IV - Leakage to Interconnecting Systems Each of the interconnecting systems are dealt with in turn.

SYSTEM DISCUSSION CVCS This is a normally operating interconnected system redundancy for isolating purposes if required.

SS In the event of sample valves failing close or seat, adequate redundancy is provided by containment isolation valves; the piping between the sets of valves is designed for RCS pressure.

RHR Hot Leg Two isolation valves are provided; in the unlikely event of Connection leakage past the two valves, interconnecting piping is provided to enable pressure relief via the RHR loop relief valve to the pressurizer relief tank.

RHR Cold Leg In the unlikely event of leakage past two sets of check valves into the RHR loop, pressure relief will take place via the RHR loop relief 152 of 215 IPEC00035761 IPEC00035761

IP3 FSAR UPDATE valves to the pressurizer relief tank.

SIS High Head Pump In the event of leakage past two sets of check injection lines valves in any high head branch line, pressure relief will take place to the PRT via the relief valve in the SIS test line.

SIS Accumulator Provisions have been made to check the Connections leak tightness of the leak tightness of the accumulator check valves.

The implications of leakage past these valves are discussed in Section 6.2

• NOTE: The configuration of these RHR, SI and Accumulator connections is shown on Plant Drawing 9321-F~27503 [Formerly Figure 6.2-1A] and consists of in series check valves. AI of these check valves are categorized as Reactor Coolant System (RCS)

Pressure Isolation (PIVs) and are listed in the Table 6.7-3. Periodic testing of these valves for loss leakage is required by Technical Specifications and reduces the probability of an inter-system LOCA (Reference 1). These tests implement the requirements set fourth in Reference 3 regarding the testing of SIS check valves and provide the basis for the rescission of Item A.5 of Reference 2.

On the table 6.7-3 pressure isolation valves S1-857A&G, Q&R, S&T, and U&V are presented as matched sets. These pairs of valves are configured in series on the HHSI non-BIT header cold leg branch lines, and deliver flow to the RCS through the Accumulator/RHR injection lines, with each high head branch connecting upstream (low pressure side) of SI-897 valves present the first pressure isolation valve barrier and are leak tested individually. The upstream pairs of 857 valves combine to form a second barrier and are tested as a pair. No credit is taken for leak tight integrity of an individual valve that is tested as a pair. This testing position was approved by the NRC in the Reference 4 supplemental evaluation.

Although leakage of primary fluid to the secondary system via the steam generator primary/secondary boundary is not expected during normal operation because of the conservative design of the U-tubes in the steam generator, any such leakage would result in an increase of activity level in the secondary system and would be detected by the condenser air ejector gas monitor or by the steam generator liquid sample monitor. (See Section 11.2) 6.7.2.4 Residual Heat Removal Loop High containment air particulate beta and/or gamma activity or high radioactive gas activity will result in an alarm being activated by either the containment air particulate or radioactive gas monitors, respectively. The containment purge supply and exhaust duct valves and pressure relief line valves are closed. This prevents the release of radioactivity to the atmosphere outside the nuclear plant.

If a leak should develop from the residual heat removal loop into the component cooling loop, a high radiation alarm will actuate in the control room. If the leak is large, the component cooling surge tanks will fill and overflow to the waste hold-up tanks in the Primary Auxiliary Building.

Gross leakage from the portion of the residual heat removal loop inside the containment, which does not flow into another closed loop, would result in reactor coolant flowing into the containment sump and/or the recirculation sump. Other leakage provisions for the residual heat removal loop are discussed in Section 9.3.

153 of 215 IPEC00035762 IPEC00035762

IP3 FSAR UPDATE 6.7.2.5 Recirculation Loop The containment purge supply and exhaust duct valves and pressure relief line valves are closed when either the containment air particulate or the radioactive gas monitors read above a preset level. This prevents radioactivity from escaping to the outside atmosphere.

Leakage from the recirculation loop into the component cooling loop results in a radiation alarm and the automatic closing of the component cooling surge tank vent line to prevent gaseous radioactivity release. If the leak was gross and filled the surge tank before the leaking component could be isolated from the component cooling loop, the relief valve on the surge tank would lift and the effluent would be discharged to the waste holdup tank in the auxiliary building.

Gross leakage from the internal recirculation loop which does not flow into another closed loop will flow into the containment sump and/or the recirculation sump. Gross leakage from the external recirculation loop which does not flow into another closed loop will be drained to the auxiliary building sump and/or sump tank. From there it is pumped to the waste holdup tank.

6.7.2.6 Component Cooling Loop Gross leakage from the section of the component cooling loop inside the containment which does not flow into another closed loop will flow into the containment sump and/or the recirculation sump and/or sump tank. Outside the containment, major leakage would be drained to the primary auxiliary building sump. From there it is pumped to the waste holdup tank.

Other provisions made for leakage from the component cooling loop are discussed in Section 9.3 6.7.2.7 Service Water System Gross leakage from the service water system in the Primary Auxiliary Building will be directed by floor drains to the primary auxiliary sump tank, located outside containment. Pumps will then transfer this leakage to the waste holdup tank. A service water leak through the containment fan cooler units could result in containment flooding. The sump water level monitors would detect this flooding. The containment fan cooler condensate drains from the cooling coils and/or cooling coil leakage are collected and flow into a vertical standpipe slotted Weir System. The flow rate from the fan units are measured, based on the water depth flowing over the Weir.

If the drainage rates for all five units are nearly the same, it can be concluded that their water is condensate from the containment atmosphere. A particular unit with a high drainage rate, indicates a possible leak in one of the cooling coils. In series with each transmitter signal is an alarm for "C.B. Fan Cooler Condo High Level." The affected unit will be identified by individually monitoring the drainage flow from each unit using a rotary selector switch.

The containment sump under normal operation collects water from various drains within containment. This water is then pumped to the waste holdup tank when the sump level reaches the actuation level on the sump pump float switches. The sump pump flow meter measures instantaneous flow (an indication of proper pump performance) while the totalizer measures cumulative flow, which is used to indicate changes in sump accumulations.

When the level in the containment sump increases to the float actuation level, one sump pump will start. If the level continues to increase, the second pump starts. There is constant containment sump level indication provided in the Control Room via two independent level 154 of 215 IPEC00035763 IPEC00035763

IP3 FSAR UPDATE indicators. Also, through use of the containment sump flow meter and totalizer, any increase in sump accumulation because of a leak would be detected. If the containment sump level should approach an overflow condition, either because the two pumps cannot keep up with the leak or due to failure of both pumps, an alarm will annunciate in the Control Room via an additional level indicator installed at the top of the containment sump. At this point, water will overflow into the normally empty recirculation sump which will be indicated by the level indication in the control room.

Water collecting in the reactor pit is pumped out via two sump pumps, each pump discharging into an individual check valve that joins a common header and discharges into the containment sump. The reactor pit is normally kept dry. Level alarms in the reactor pit will annunciate in the Control Room if water should accumulate in this area. Also, an indicating light located in the control room will indicate when reactor pit sump pump number 31 is running.

References

1. WASH 1400

2. NRC Letter, A Schwencer to NYPA, Enclosing a Confirmatory Order dated February 11, 1980.

3. NRC Generic Letter 80-14, February 23, 1980, LWR Primary Coolant System Pressure Isolation Valves.

4. NRC letter Dated August 20, 1993, "Supplemental Safety Evaluation of the Second 10 Year Interval Inservice Testing Program and Associated Relief Request for Indian Point Nuclear Generating Unit No.3 (TAC No. M85108)."

155 of 215 IPEC00035764 IPEC00035764

IP3 FSAR UPDATE TABLE 6.7-1 CLASS 1 FLUID SYSTEMS FOR WHICH NO SPECIAL LEAK DETECTION IS PROVIDED Remarks on Leakage Detection (Items a, b, and c are found in the text System of Section 6.7.1)

1. Residual Heat Removal (RHR) Refer to items a, b, c, and Section 6.7.1.2

2. Component Cooling Refer to item c and Section 6.7.1.2

3. Service Water Refer to item c and Section 6.7.1.2

4. Auxiliary Feedwater Visual

5. Waste Disposal Auxiliary building sump pump operation and refer to item a.

TABLE 6.7-2 RESULTS OF LEAK TESTS OUTSIDE CONTAINMENT System Leak Rate Volume Control Tank o Residual Heat Removal System 31.5 cc/min Safety Injection System 3 cc/min Primary Sample System 1 drop/hr Post Accident Containment Sampling System o "U

Modified Post Accident Containment Sampling System 10 cc/min m *NOTE: The above data are provided as information only.

()

-u o m o oo o eN o 01 156 of 215 o0) -....I (J)

(J1

-....J 01 (J)

(J1

IP3 FSAR UPDATE TABLE 6.7-3 REACTOR COOLANT SYSTEM (RCS)

PRESSURE ISOLATION VALVES (PIVs)

SI-838-A SI-8570 SI-857M SI-895B SI-838-B SI-857E SI-857N SI-895C SI-838-C SI-857F SI-857P SI-8950 SI-838-0 SI-857H SI-857Q&R(1) SI-897A SI-857 A&G(1) SI-857J SI-857S&T(1) SI-897B SI-857B SI-857K SI-857U&W(1) SI-897C SI-857C SI-857L SI-895A SI-8970

• NOTE: (1) See Section 6.7.2.3, Part IV for a discussion of these pairings.

"U m

()

-u o m o oo o eN o 01 157 of 215 o0) -....I (J)

(J1 (J)

-....J (J)

(J)

IP3 FSAR UPDATE 6.8 HYDROGEN RECOMBINATION SYSTEM 6.8.1 Design Bases The design bases for the hydrogen control following a postulated Loss-of-Coolant Accident are as follows:

1) The system shall prevent the hydrogen concentration in the containment volume from exceeding 3% by volume following a design basis accident.

2) The system shall be capable of performing its design function in the containment environment following a design basis accident, i.e., withstand the accident and be capable of beginning operation as required when the containment pressure is near ambient.

3) The system shall be designed to withstand the design basis earthquake and still be capable of operation.

4) The system shall be sufficiently redundant and independent to the extent that no single active or passive failure can negate the minimum requirements of operation.

5) The system shall be testable during normal operating conditions of the plant.

6.8.2 System Design and Operation

System Description

The electric hydrogen recombiner systems installed at Indian Point 3 are engineered safety features to control the hydrogen generated in the containment following a Loss-of-Coolant Accident. The redundant systems are designed to seismic Class I Standards.

Two full rated, redundant and independent systems are provided. Each recombiner is powered from a separate safety related MCC. Each is capable of maintaining the ambient H2 concentration at or below three volume percent (v/o).

Each recombiner system consists of a control panel located in the Control Room, a power supply cabinet located in the lower electrical cable tunnel, at elevation 34 ft., and a recombiner located on the operating deck at elevation 95 ft. in the Containment. The electric hydrogen recombiners are located in the southeast and southwest quadrants of the containment approximately 90° apart in the same location as the old flame type recombiners they are replacing. There are no moving parts or controls inside the containment. Heated air within the unit causes airflow by natural convection. The recombiner is a completely passive device.

To regulate the power supply to the recombiner, the power supply cabinet contains an isolation transformer and a controller. This equipment will not be exposed to the post-LOCA environment. The controls for the power supply are located in the Control Room and are manually actuated.

Each hydrogen recombiner consists of the following components:

158 of 215 IPEC00035767 IPEC00035767

IP3 FSAR UPDATE

1) A preheater section, consisting of a shroud placed around the central heaters to take advantage of heat conduction through the central walls, for preheating incoming air.

2) An orifice plate to regulate the rate of airflow through the unit.

3) A heater section, consisting of four banks of metal-sheathed electric resistance heaters, to heat the air flowing through it to hydrogen-oxygen recombination temperatures.

4) An exhaust chamber, which mixes and dilutes the hot effluent with containment air to lower the temperature of the discharge stream.

5) An outer enclosure to protect the unit from impingement by containment spray.

The recombiner unit is manufactured of corrosion-resistant, high-temperature material. The electric hydrogen recombiner uses commercial-type electric resistance heaters sheathed with Incoloy-800 which is an excellent corrosion-resistant material for this service. The recombiner heaters operate at significantly lower power densities than similar heaters used in commercial practice.

System Operation Each recombiner is operated from its control panel located in the Central Control Room.

Emergency operating procedures direct that the hydrogen concentration in the containment be monitored (by manual sampling or with the hydrogen analyzers) following a LOCA or high containment pressure condition and that the hydrogen recombiners be actuated in time to prevent reaching a hydrogen concentration of 4.0 volume percent. System operating procedures provide instructions for the operator to manually put the recombiners in service from the control panel. The recombiner, power supply panel and control panel are shown on Plant Drawings 9321-F-30064 and ~30065 [Formerly Figures 6.8-2 and 6.8-2A]. The power panel for the recombiner contains an isolation transformer and a controller to regulate power into the recombiner. This equipment is not exposed to the post-LOCA containment environment.

To control the recombination process, the correct power input to bring the recombiner above the threshold temperature for recombination is set by adjusting a potentiometer located on the control panel. The correct power required for recombination depends upon containment atmosphere conditions and is determined when recombiner operation is required. For equipment test and periodic checkout, a temperature controller is provided on the control panel to automatically bring the recombiner to the recombination temperature.

The containment atmosphere is heated within the recombiner in a vertical duct, causing it to rise by natural convection. As it rises, replacement air is drawn through intake louvers downward through a preheater section which will temper the air and lower its relative humidity.

The preheated air then flows through an orifice plate, sized to maintain a 100 SCFM flowrate, to the heater section. The airflow is heated to a temperature above 1150°F, the reaction temperature for the hydrogen-oxygen reaction. Any free hydrogen present reacts with atmospheric oxygen to form water vapor. After passing through the heater section, the flow enters a mixing section, which is a louvered chamber where the hot gases are mixed and cooled with containment atmosphere before the gases are discharged directly into the containment. The air discharge louvers are located on three sides of the recombiner. To avoid 1590f215 IPEC00035768 IPEC00035768

IP3 FSAR UPDATE recirculating previously processed air, no discharge louvers are located on the intake side of the recombiner. (Reference 10)

Tests have verified that the hydrogen-oxygen recombination is not a catalytic surface effect associated with the heaters but occurs due to the increased temperature of the process gases.

As the phenomenon is not a catalytic effect, saturation of the unit cannot occur (References 1 and 9).

Instrumentation The recombiners do not require any instrumentation inside the containment for proper operation after a LOCA. The recombiners are started manually after a LOCA. The sampling system is used to obtain containment atmosphere samples that indicate when the recombiners or the venting system should be actuated. Control measures can be initiated when the hydrogen concentration reaches 3.0 vOlume-percent.

The thermocouples and temperature transmitters located in the thermocouple splice box are used for testing and calibration only. Their failure will not affect the safety function of the recombiner.

Power Supply Supply power for the electric recombiners is provided from safety related 480 MCC's 36C and 36B which are backed up by emergency diesel generators 31 and 32, respectively.

In order to prevent overloading of the diesel generators, the electric hydrogen recombiners will be deenergized on loss of offsite power or on a safety injection (SI) signal. Manual operator action will be required to restart the recombiners once adequate diesel generator capacity is available.

Post Accident Containment Atmosphere Sampling System Following an accident, containment atmosphere is monitored for hydrogen concentration. A two channel redundant system is provided. Samples are taken from the plenum chambers of the containment recirculation fan units. Train A monitor takes suction from the plenum chambers of fan units 32 and 35. The train B monitor takes suction from the plenum chambers of fan units 31, 33 and 34.

Sampling should begin with the first 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> following diagnosis of a LOCA or MSLB inside containment. (Reference 11)

To assure that stratification effects or sample errors would not permit all or parts of the containment to hold hydrogen in excess of the lower flammable limit (4.1 v/o) when the measured concentration is 3.0 vlo, the following checks were made: It was determined that the minimum reliable air circulation capacity by three of the main recirculation fans within the containment could recirculate the entire containment air volume at an average rate of 4.8 times an hour (or 210,000 cfm capacity based upon pressure decay to ambient conditions for fan operation). But the calculated hydrogen generation rate during the first day post accident is 17,100 SCF yielding a ratio of air circulation to hydrogen generation in excess of 17,7000: 1.

Due to the decreased rate of hydrogen generation with time, the ratio increases to an even greater value before the hydrogen concentration in the containment reaches two volume 160 of 215 IPEC00035769 IPEC00035769

IP3 FSAR UPDATE percent. At a conservatively predicted generation rate, 60 hours6.944444e-4 days <br />0.0167 hours <br />9.920635e-5 weeks <br />2.283e-5 months <br /> are required to produce hydrogen in the amount of two percent of containment volume. During this same period, the entire atmosphere of the containment would have been recirculated, on the average, 288 times.

Furthermore, the air handling system is designed to promote the interchange of air in all regions of the containment to avoid the possibility of accumulation of hydrogen in stagnant pockets or strata. For example, in the highest part of the containment dome (above the top spray ring),

minimum air recirculation provides one air change approximately every 61 seconds. For these reasons it is concluded that the stratification error is negligible.

Based on the foregoing discussion, it is concluded that the three volume percent design concentration for operating the recombiner provides more than adequate margin for error associated with sampling the containment atmosphere. The calculated containment hydrogen concentration does not reach three volume percent until 10 days post accident, so it is highly unlikely that any significant concentration gradient will exist in the containment when the recombiner is started. Furthermore, since tests have been run with a full scale recombiner system at hydrogen concentrations up to and including 4.0 volume percent hydrogen, a hydrogen concentration between 2 and 3.5 volume percent at the recombiner suction would have no adverse effect on the recombiner operation.

6.8.3 Design Evaluation The analysis of post-LOCA hydrogen production and accumulation in the containment is presented in Section 14.3.7. To determine the effectiveness of the recombiner, it is assumed that it will be activated before the containment hydrogen concentration reaches the design limit of 3 volume-percent. Starting the recombiner at below 3% provides substantial margin in time to reach the lower flammability concentration of 4.1 %. The capacity of the recombiner, working in a 3% hydrogen environment, is at least 3 SCFM of hydrogen gas.

The results of the Regulatory Guide 1.7 analysis indicate that 3% hydrogen occurs at approximately 5.5 days (Figure 14.3-79) and the corresponding aggregate hydrogen production rate is approximately 1.6 SCFM (Figure 14.3-75). This production rate is well within the capacity of the recombiner. Further, because the hydrogen production rate decreases with time, the recombiner can easily accommodate hydrogen concentrations greater than 3%. Thus, starting a recombiner before the containment hydrogen concentration reaches 3% will ensure that the concentration remains well below the lower flammability limit.

Hydrogen stratification in the containment post-LOCA is minimized by the operation of the containment fan coolers. The containment coolers circulate air within the containment volume (Section 6.8.2). A containment sampling line is located near the inlet of each fan cooler.

Assuming that 3 of 5 fan coolers are operating and that the flow rate per unit is 34,000 cfm (design flow rate during accident conditions) results in an average air flow of approximately 18.8 containment volumes per day per unit.

The recombiners are located in an open area of the containment on the 95' elevation operating deck.

The calculated average hydrogen concentration in containment reaches three volume percent in approximately 5.5 days (Safety Guide 7 basis, Figure 14.3-79). Based on this relatively small hydrogen production rate (average less than 5 SCFM, approximately 1.6 SCFM at 5.5 days, Figure 14.3-75) and the large air mixing rate described above, the bulk of the containment volume is expected to be well mixed, and no significant hydrogen concentration gradients are expected at either the hydrogen sampling points or at the recombiner locations.

161 of 215 IPEC00035770 IPEC00035770

IP3 FSAR UPDATE Personnel Doses The control panel for the hydrogen recombiner is located in the Control Room. The control room is designed to provide radiation protection for the operator following a design basis event.

Doses to the control room operators following a large-break LOCA are evaluated in Section 14.3.5. The calculated doses are well within the limits specified in General Design Criterion 19, i.e., 30 rem thyroid and 5 rem whole body.

6.8.4 Tests and Inspections The electric hydrogen recombiners underwent extensive testing in the Westinghouse development program. These tests encompassed the initial analytical studies, laboratory proof-of-principle tests, and full-scale prototype testing. The full scale prototype tests include the effect of:

Varying hydrogen concentrations Alkaline spray atmosphere Steam effects Convection currents Seismic effects A detailed discussion of these tests is provided in references 1 through 9.

Operational tests and inspections are performed in accordance with the requirements of the Technical Specifications to verify the operation of the control system and the ability of the heaters to achieve the required temperature. In addition, a channel calibration of all recombiner instrumentation and control circuits is performed every 24 months.

References

1) Wilson, J. F., "Electric Hydrogen Recombiner for Water Reactor Containments," WCAP-7709-L (Proprietary), July 1971, and WCAP-7820 (Nonproprietary), December 1971.

2) Wilson, J. F., "Electric Hydrogen Recombiner for PWR Containments - Final Development Report," WCAP-7709-L Supplement 1 (Proprietary), and WCAP-7820, Supplement 1 (Nonproprietary), April 1972.

3) Wilson, J. F., "Electric Hydrogen Recombiner for PWR Containments - Equipment Qualification Report," WCAP-7709-L Supplement 2 (Proprietary), and WCAP-7820, Supplement 2 (Nonproprietary), September 1973.

4) Wilson, J. F., "Electric Hydrogen Recombiner for PWR Containments - Long Term Tests," WCAP-7709-L Supplement 3 (Proprietary), and WCAP-7820, Supplement 3 (Nonproprietary), January 1974.

5) Wilson, J. F., "Electric Hydrogen Recombiner for PWR Containments," WCAP-7709-L Supplement 4 (Proprietary), and WCAP-7820, Supplement 4 (Nonproprietary), April 1974.

162 of 215 IPEC00035771 IPEC00035771

IP3 FSAR UPDATE

6) Wilson, J. F., "Electric Hydrogen Recombiner Special Tests," WCAP-7709-L Supplement 5 (Proprietary), and WCAP-7820, Supplement 5 (Nonproprietary), December 1975.

7) Wilson, J. F., "Electric Hydrogen Recombiner IEEE 323-1974 Qualification," WCAP-7709-L Supplement 6 (Proprietary), and WCAP-7820, Supplement 6 (Nonproprietary),

October 1976.

8) Wilson, J. F., "Electric Hydrogen Recombiner for LWR Containments Supplemental Test Number 2," WCAP-7709-L Supplement 7 (Proprietary), and WCAP-7820, Supplement 7 (Nonproprietary), August 1977.

9) Wilson, J. F., "qualification Testing for Model B Electric Hydrogen Recombiner," WCAP-9346 (Proprietary) and WCAP-9347 (Nonproprietary), July 1978.

10) Electric Hydrogen Recombiner Model B Technical Manual, NYPA File 439-100058911.

11) NSE 97-3-269 HR 163 of 215 IPEC00035772 IPEC00035772

IP3 FSAR UPDATE TABLE 6.8-1 DESIGN DATA FOR HYDROGEN RECOMBINERS Quantity 2 Power (each) (maximum/minimum) (kW) 75/50 Model B Capacity (each) (minimum) (SCFM) 100 Heaters (per recombiner)

Number 4 banks Maximum heat flux (Btu/h-ft2) 2850 Maximum sheath temperature (OF) 1550 Gas Temperatures Inlet (OF)80-155 Outlet of heater section (OF) 1150 to 1400 Exhaust ("F) Approximately 50° above ambient Materials Outer structure Type 300 series SS Inner structure Incology 800 Heater element sheath Incology 800 Base skid Type 300 series SS Weight (lb) 4500 Codes and Standards American Society of Mechanical EngineersSection IX, Underwriters Laboratory, National Electric Manufacturers Association, National Fire Protection Association, Institute of Electrical and Electronic Engineers 279, 308, 323, 344, and 383 Design Data for Power Supplies Quantity 2 Electrical Requirements 3 phase, 60 Hz, 480 VAC Power (max.) 90kW "U

m

()

-u o m o oo o eN o 01 164 of 215 o0) -....I (J1 -....I

-....J eN

-....J 0)

IP3 FSAR UPDATE APPENDIX6A IODINE REMOVAL EFFECTIVENESS EVALUATION OF CONTAINMENT SPRAY SYSTEM

1.0 INTRODUCTION

The Containment Spray System is an engineered safety system employed to reduce pressure and temperature in the containment following a postulated Loss-of-Coolant Accident. For this purpose, subcooled water is sprayed into the containment atmosphere through a large number of nozzles from spray headers located in the containment dome.

Because of the large ratio of spray drop surface area to containment volume, the spray system also serves as a removal mechanism for fission products postulated to be dispersed in the containment atmosphere. The source term used for the large-break LOCA assumes major core degradation and is defined in Regulatory Guide 1.183(4) as being a release of gap activity (noble gases, iodines, and alkali metal nuclides) over a half-hour period followed by a core melt that releases additional activity in those three nuclide groups plus additional nuclides over a 1.3 hour3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> duration. The iodine activity is assumed to be primarily in the particulate form (cesium iodide) with small fractions of the iodine in the elemental and organic forms. Nuclides other than the iodines and noble gases are all modeled as being in the particulate form. The sprays are effective at removing elemental iodine and particulates from the containment atmosphere but the organic iodine and the noble gases are not subject to removal by the sprays.

2.0 CONTAINMENT SPRAY IODINE REMOVAL MODEL Spray removal coefficients for particulates and for elemental iodine were calculated for both the injection and recirculation modes of containment spray operation. Calculation of the containment spray removal coefficients is based on the models documented in NURG-0800, SRP Section 6.5.2(1). The removal coefficients were credited in the Large Break LOCA radiological consequences as documented in Section 14.3.5.

2.1 Elemental Iodine Removal Elemental iodine removal during the spraying of a fresh solution is highly dependent on the rate at which the fresh solution surface is introduced into the containment atmosphere. The elemental iodine removal coefficient is given by:

As = 6KgTF VD Where: As = Elemental spray removal coefficient, h(1 Kg = Gas-phase mass transfer coefficient, ftlmin T = Time of fall of the spray drops, min F = Volume flow rate of sprays, fe/hr V = Containment sprayed volume, fe D = Mass mean diameter of the spray drops, ft The gas phase mass transfer coefficient taken from BNL - Technical Report A-3778 2 , is 3 meter/min or 9 84 ftlmin. The average spray droplet fall time of 0.167 minutes was determined based on a spray fall height of 118.5 ft and a spray flow rate of 2,200 gpm. The volumetric flow 165 of 215 IPEC00035774 IPEC00035774

IP3 FSAR UPDATE rate of the sprays is 17,646 fe/hr. The containment sprayed volume is 2,088,000 fe. The mass mean diameter of the spray droplets was calculated to be 0.003675 ft.

From these inputs an elemental iodine removal coefficient of 22.7 hr -1 was calculated. The value used in the large break LOCA radiological consequences was reduced to 20 hr -1, which is the upper limit specified in SRP 6.5.2 (1).

During the recirculation spray mode the spray flow rate is reduced to 962 gpm with a resulting reduction in iodine removal coefficient to 9.9 hr-1. However, during recirculation the spray solution will gradually become loaded with elemental iodine which will limit the capacity of the spray to remove airborne iodine. The spray removal coefficient would be inversely proportional to the DF achieved for elemental iodine. Thus, when recirculation spray is first credited there is still so little elemental iodine in the sump solution that it would be appropriate to use the removal coefficient of 9.9 hr1. But, when the DF approaches its defined limit, the removal coefficient would be only a small fraction of its original value. The impact of this varying nature of the removal coefficient can be approximated by setting the removal coefficient to one half of the calculated value (5.0 hr-1). Thishas the effect of reducing credit for removal of elemental iodine early in the recirculation phase but increasing it in the latter stages of spray removal.

2.2 Elemental Iodine Decontamination Factor In SRP 6.5.2(1), the maximum removal of elemental iodine is that of a decontamination factor (DF) of 200. The OF is related to the total release to the containment atmosphere which takes place over a 1.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> period (based on the source term model provided in Regluatory Guide 1.183(4).

The elemental iodine decontamination factor for the containment atmosphere achieved by the containment spray system is determined by the following equation:

Where: DF = Decontamination Vs = Volume of liquid in the containment sump, fe PC = Partition coefficient for iodine in water Vc = Containment net free volume, fe The post LOCA sump volume is calculated to be 386,000 gallons. The partition coefficient for iodine in water is conservatively assumed to be 10,000 based on a sump pH of 7.0. The net free containment volume is 2,610,000 fe.

The calculated spray decontamination factor is slightly greater than 200. This is reduced to 200 as specified above for use in calculating the large break LOCA radiological consequences. The elemental iodine decontamination factor of 200 is reached at approximately 166 minutes in the calculation of the LOCA doses. No credit for elemental iodine removal by containment sprays is taken after 166 minutes.

2.3 Particulate Iodine Removal The spray removal coefficient for particulates is given by:

166 of 215 IPEC00035775 IPEC00035775

IP3 FSAR UPDATE 2VD Where: Ap = Particulate spray removal coefficient, h(1 H = Drop fall height, ft F = Volume of flow rate of sprays, fe/hr V = Containment sprayed volume E/D= Ratio of a dimensionless collection efficiency E to the average spray drop Diameter D.

The spray fall height is 118.5 ft; the volumetric flow rate of the sprays during the injection phase is 2,200 gpm (17,646 ft 3/hr). The containment sprayed volume is 2,088,000 fe. From SRP 6.5.2(1), the E/D ratio is 10 m-1 until a DF of 50 is attained (i.e., when the aerosol activity released from the core is reduced by a factor of 50) and is a factor of ten lower after a DF of 50 is achieved.

From these inputs the particulate iodine removal coefficient was calculated to be 4,6 h(-1 for a particulate iodine DF less than or equal to 50. The injection phase of the containment spray system is in operation until 45 minutes into the accident. With the activity release from the core having a duration of 1.8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />(4), most of the particulates are not released to the containment atmosphere until after the spray injection phase is over. During the spray recirculation phase the volumetric spray flow is reduced to 962 gpm (7,716 ft3/hr) and the resulting removal coefficient for particulates is 2.0 hr-1 (after a DF of 50 is reached, the removal coefficient drops to 0.2 h(1).

References

1. NUREG-0800, Standard Review Plan, Section 6.5-2, "Containment Spray as a Fission Product Cleanup System," Revision 2, U.S. Nuclear Regulatory Commission, December 1988.

2. BNL - Technical Report A-3788, "Fission Product Removal Effectiveness of Chemical Additives in PWR Containment Sprays," Davis, Nourbakhsh, and Khatib-Rahbar, dated 8/12/86.

3. Deleted

4. Regulatory Guide 1.183, "AlternateRadiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, "July 2000, U.S. Nuclear Regulatory Commission.

1670f215 IPEC00035776 IPEC00035776

IP3 FSAR UPDATE APPENDIX6B CAUTION Appendix 68 shows the leak detection methodology to Indian Point 1. The assumptions and constants contained in this appendix should not be used for Indian Point 3 leak detection calculations.

168 of 215 IPEC00035777 IPEC00035777

IP3 FSAR UPDATE 1690f215 IPEC00035778 IPEC00035778

IP3 FSAR UPDATE 170of215 IPEC00035779 IPEC00035779

IP3 FSAR UPDATE APPENDIX6C CHARCOAL FILTER REMOVAL OF METHYL IODIDE BY ISOTOPIC EXCHANGE

1. INTRODUCTION It was postulated that radioactive iodine in organic forms, principally methyl iodide, exists in the containment atmosphere following a loss of coolant accident. Engineered Safety Features which can remove this radioactive methyl iodide are reactive sprays, charcoal filters by absorption, and impregnated charcoal filters by isotopic exchange. At the present time, no credit is taken for methyl iodide removal by sprays or charcoal filter absorption. Since isotopic exchange of radioactive methyl iodide with iodine impregnated charcoal filters is the only form of active removal considered, a model which accurately describes this process has been derived.

It should be noted that the original charcoal filters installed at Indian Point 3 have been replaced. The carbon used in these replacement filters is co-impregnated with triethylene diamine (TEDA) and potassium iodide (KI) to enhance the ability to absorb organic radioiodine compounds. The bases of this evaluation are nevertheless valid and the results applicable.

The installed Nuclear Grade Activated Charcoal is tested in accordance with ASTM D3803-1989, per the IP3 response to Generic Letter 99-02.

The isotopic exchange reaction between the radioactive methyl iodide in the containment atmosphere and the iodide impregnant on the charcoal filters is of the form:

(1 )

The equilibrium constant for this reaction is defined as:

Keq = [CH311] {Ic*] / [CH31*] [Ic] = 1 (2) where

[CH31] is the grams of iodine as methyl iodide in the containment atmosphere

[CH31*] is the curies of iodine as methyl iodide in the containment atmosphere

[Ic] is the grams of iodine impregnant on the filter

[Ic*] is the curies of iodine on the filter impregnant

2. MATHEMATICAL BASIS FOR THE MODEL From a material balance on the balance on the containment atmosphere, the rate of change of specific activity of iodine as methyl iodide (in the containment atmosphere) can be expressed as:

(3) where:

C1 is the specific activity, defined as curies of a species per gram of the same species, of iodine as methyl iodide in the containment atmosphere.

AF rate constant for isotopic exchange reaction (hr-1) 171 of 215 IPEC00035780 IPEC00035780

IP3 FSAR UPDATE AD decay rate (hr -1)

AL containment leak rate (h(1)

Cin specific activity of methyl iodide in air stream entering filter Cout specific activity of methyl iodide in the air stream exiting from the filter The radioactive iodine on the filter impregnant can expressed as:

(4) where C2 is the iodine specific activity of the filter impregnant The term AF (C'in - C'out) is the rate of change of specific activity of the impregnant by isotopic exchange in units of curies per gram of iodine impregnant per hour.

An analytical expression is obtained by integrating equations (3) and (4) with time and assuming:

a) The specific activity of the air stream exiting from the filter is in equilibrium with the specific activity on the filter.

b) The amount of stable iodine as methyl iodide at time zero remains constant with time.

3. APPLICATION OF CHARCOAL FILTER MODEL TO INDIAN POINT 3 A study was performed to evaluate the effects of the charcoal filter model on the removal of radioactive methyl iodide from the containment atmosphere and the buildup of radioactive iodine on the filter impregnant by isotopic exchange. This evaluation used the following parameters:

1) Plant Power - 3116 MWt

2) Containment Free Volume - 2.61 x 106 fe

3) 6.0 grams of iodine per MWt in the core after 830 days of operation

4) Core Inventories per MWt after 830 days of operation, as follows:

1-131 - 2.51 x 104curies/MWt 1-132 - 3.81 x 104curies/MWt 1-133 - 5.63 x 104curies/MWt 1-134 - 6.58 x 104curies/MWt 1-135 - 5.10 x 104curies/MWt

5) 2.5% of core iodine released to the containment atmosphere as methyl iodine

6) 36 charcoal filter cells with 2 pounds of iodine impregnant per cell, i.e., minimum safeguards

7) Containment leak rate schedule 172 of 215 IPEC00035781 IPEC00035781

IP3 FSAR UPDATE a) 0.001/day ----. 0-24 hrs b) 0.00045/day ----.24-720 hrs

8) Air flow through charcoal filters - 24000 CFM

9) The iodide removal rate-constant, AF in Eqs. (3) and (4), is defined as the air flow through the filters (fraction of the containment volume per hour) times the filter efficiency for methyl iodides. A filter efficiency of 70% was assumed in this analysis.

Test data from the charcoal manufacturer, for the original charcoal filters which were installed at Indian Point 3, impregnated with K1 3 , show a removal efficiency of 98.9% for methyl iodide under conditions (130°C/90% RH) similar to post-LOCA conditions.

Test data from two charcoal manufacturers for charcoal filters cOimpregnated by KI and TEDA, of the type installed at Indian Point 3, show a slightly higher removal efficiency of 99%.6% for methyl iodides.

For either types of impregnated charcoal filters, the assumption of 70% removal efficiency is thus conservative. Results of the analysis are presented in Figures 6C-1 through 6C-10.

4. DISCUSSION OF RESULTS Figures 6C-1 through 6C-5 show the decrease of specific activity of iodine as methyl iodide in the containment and the buildup of radioactive iodine on the filter impregnant by isotopic exchange over a 30-day period. Figures 6C-6 through 6C-10 correspond to Figures 6C-1 through 6C-5 except that the latter five figures give the detailed specific activity breakdown for the 0-2 hour period.

5. CONCLUSIONS It can be seen from the specific activity plots that all isotopes reach an equilibrium value between the filters and the containment atmosphere after which decay and leakage are the only iodine removal mechanism.

173 of 215 IPEC00035782 IPEC00035782

IP3 FSAR UPDATE APPENDIX6D COMPATIBILITY OF MATERIALS UNDER EXPOSURETO THE POST-ACCIDENT CONTAINMENT ENVIRONMENT 1.0 DEFINITION OF POST-ACCIDENT CONTAINMENT ENVIRONMENTAL CONDITIONS As part of the initial license application, an evaluation of the suitability of materials of construction for use in the Reactor Containment System was performed considering the following:

a) The integrity of the materials of construction of engineered safeguards equipment when exposed to post Design Basis Accident (DBA) conditions, and b) The effects of corrosion and deterioration products from both engineered safeguards (vital equipment) and other (non-vital) equipment on the integrity and operability of the engineered safeguards equipment.

Reference post DBA environmental conditions of temperature, pressure, radiation and chemical composition are described in the following sections. The time-temperature-pressure cycle used in the materials evaluation was most conservative since it considered only partial safeguards operation during the DBA. The containment spray and core cooling solutions considered herein include both the design chemical compositions and the design chemical compositions contaminated with deterioration products and fission products, which may conceivably be transferred to the solution during recirculation through the various containment safeguards systems.

1.1 Design Basis Accident Temperature-Pressure Cycle Figure 6D-1 presents the temperature-pressure-time relationship following the Design Basis Accident. These figures represent the Containment condition for the following safety feature operation: one of the two containment spray pumps is considered to inject 3000 gpm of boric acid solution into the Containment. When the Refueling Water Storage Tank is empty, the recirculation pumps supply a flow of 2400 gpm to the spray headers. Recirculation flow through one recirculation pump is cooled in the residual heat exchanger.

Figures 6D-2 and 6D-3 present materials evaluation test conditions for the Containment and core environments, respectively.

Evaluations of materials were performed, in general, for conditions either simulating the time-temperature conditions of Figure 6D-2 or conservatively considering higher temperatures for longer periods. The basis for each material evaluation is described with the discussion of its particular suitability.

1.2 Design Basis Accident Radiation Environment Evaluation of materials for use inside containment included a consideration of the radiation stability requirements for the particular materials application. Figures 6D-4 and 6D-5 present the post DBA containment atmosphere direct gamma dose rate and integrated direct gamma dose, respectively. These data were calculated on the basis of a core meltdown and by assuming the following fission product fractional releases consistent with the TID-14844 model:

174 of 215 IPEC00035783 IPEC00035783

IP3 FSAR UPDATE Noble Gases Fractional Release 1.0 Halogens Fractional Release 0.5 Other Isotopes Fractional Release 0.01 1.3 Design Chemical Composition of the Emergency Core Cooling Solution The system designs provide for use of alkaline adjusted boric acid solution as the containment spray and core cooling fluid.

1.3.1 Alkaline Sodium Borate Plant designs which utilize the containment spray solution for fission product iodine removal, as well as containment cooling, include provisions for injection of chemical additive (sodium hydroxide) to the Emergency Core Cooling System. Boric acid solution, containing approximately 2000 ppm boron, is pumped from the Refueling Water Storage Tank to the Containment System by means of the safety injection pumps, residual heat removal pumps and containment spray pumps.

The chemical additive tank contains sufficient sodium hydroxide solution such that when its contents, the Refueling Water Storage Tank contents, and the Reactor Coolant System fluid are mixed, the resulting pH will be between 7.9 and 10.0. During the initial 30 to 60 minutes of spraying, the spray solution may be at a pH of about 10.

Figure 6D-6 shows a plot of sodium hydroxide concentration versus pH for a 2500 ppm boron solution. Tentative limits of pH between 7.9 and 10 for the mixed spray solution are indicted on this figure.

For the purpose of materials evaluation in the design chemistry solution, the following concentration/time relationship was considered:

o to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> pH = 10.0, Boron 2500 ppm 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to 12 months pH = 9.0, Boron 2500 ppm The solutions were considered aerated through the entire exposure period.

1750f215 IPEC00035784 IPEC00035784

IP3 FSAR UPDATE 1.4 Trace Composition of Emergency Core Cooling Solution During spraying and recirculation, the emergency core cooling solution will wash over virtually all the exposed components and structures in the Reactor Containment. The solution is recirculated through a common sump and hence, any contamination deposited in or leached by the solution from the exposed components and structures will be uniformly mixed in the solution.

The materials compatibility discussion includes consideration of the effects of trace elements which were identified as conceivably being present in the emergency core cooling solution during recirculation.

To identify the trace elements inside containment which may have a deleterious effect on engineered safeguards equipment, one must first, establish which elements are potentially harmful to the materials of construction of the safeguards equipment, and second, ascertain the presence of these elements in forms which can be released to the emergency core cooling solution following a Design Basis Accident. Table 6D-1 presents a listing of the major periodic groups of elements. Elements which are known to be harmful to various metals are noted and potential sources of these elements are identified. A discussion of the effects of these elements is presented in latter sections.

2.0 MATERIALS OF CONSTRUCTION IN CONTAINMENT All materials in the Containment were reviewed from the standpoint of insuring the integrity of equipment and to insure that deterioration products of some materials do not aggravate the accident condition. In essence, therefore, all materials of construction inside containment must exhibit resistance to the post-accident environment or, at worst, contribute only insignificant quantities of trace contaminants which have been identified as potentially harmful to vital safeguards equipment.

Table 6D-2 lists typical materials of construction used in the Reactor Containment System.

Examples of equipment containing these materials are included in the table.

Corrosion testing, described in Section 3.0 of this Appendix, showed that of all the metals tested, only aluminum alloys were found incompatible with the alkaline sodium borate solutions.

Aluminum was observed to corrode at a significant rate with the generation of hydrogen gas.

Since hydrogen generation can be hazardous to containment integrity, a detailed survey was conducted to identify all aluminum components inside containment.

Table 6D-3 lists the Nuclear Steam Supply System aluminum inventory which is considered present in the Reactor Containment. Included in the table is the mass of metal and exposed surface area of each component. The 1100 and the 600 series aluminum alloys are generally the major types found inside containment. This inventory reflects the determination to exclude as much as practicable the use of aluminum in the Containment.

3.0 CORROSION OF METALS OF CONSTRUCTION IN DESIGN BASIS ECC SOLUTION Emergency core cooling components are austenitic stainless steel and hence, are quite resistant to corrosion by the alkaline sodium borate solution, as demonstrated by corrosion tests performed at Westinghouse and ORNL.(1) The general corrosion rate for type 304 and 316 stainless steel was found to be 0.01 mils/month in pH 10 solution at 200 F. Data on corrosion 176 of 215 IPEC00035785 IPEC00035785

IP3 FSAR UPDATE rates of these materials in the alkaline sodium borate solution have also been reported by ORNL(2,3) to confirm the low values.

Extensive testing was also performed on other metals of construction which are found in the Reactor Containment. Testing was performed on these materials to ascertain their compatibility with the spray solution at design post-accident conditions and to evaluate the extent of deterioration product formation, if any, from these materials.

Metals tested included Zircaloy, Inconel, aluminum alloys, cupro-nickel alloys, carbon steel, galvanized carbon steel, and copper. The results of the corrosion testing of these materials are reported in detail in Reference 1. Of the materials tested, only aluminum was found to be incompatible with the alkaline sodium borate solution. Aluminum corrosion is discussed in Section 5.0 of this Appendix. The following is a summary of the corrosion data obtained on various materials of construction exposed for several weeks in aerated alkaline (pH 9.3 - 10.0) sodium borate solution at 200 F. The exposure condition is considered conservative since the test temperature (200 F) is considerably higher than the long-term Design Basis Accident temperature.

Material Maximum Observed Corrosion Rate Mil/Month Carbon Steel 0.003 Zr-4 0.004 Inconel718 0.003 Copper 0.015 90 - 10 Cu-Ni 0.020 70 - 30 Cu-Ni 0.006 Galvanized Carbon Steel 0.051 Brass 0.010 Tests conducted at ORNL(2,3) also have verified the compatibility of various materials of construction with alkaline sodium borate solution. In tests conducted at 284 F, 212 F, and 130 F, stainless steels, Inconel, cupronickels, Monel, and Zircaloy-2 experienced negligible changes in appearance and negligible weight loss.

Corrosion tests at both Westinghouse and ORNL have shown copper suffers only slight attack when exposed to the alkaline sodium borate solution at DBA conditions. The corrosion rate of copper, for example, in alkaline sodium borate solution at 200 F is approximately 0.015 mil/month. (1) The corrosion of copper in an alkaline sodium borate environment under spray conditions at 284 F and 212 F has been reported by ORNL. Corrosion penetrations of less than 0.02 mil were observed after 24-hour exposure at 284 F (see Reference 3, Table 3.13), and a corrosion rate of less than 0.3 mil per month was observed at 212 C (see Reference 2, Table 3.6).

177 of 215 IPEC00035786 IPEC00035786

IP3 FSAR UPDATE The corrosion of copper in the post-accident environment will have a negligible effect on the integrity of the material. Further, the corrosion product formed during exposure to the solution appears tightly bound to the metal surface and hence, will not be released to the ECC solution.

The corrosion rate of galvanized carbon steel in alkaline sodium borate (3000 ppm B, pH 9.3) is also low. Tests conducted in aerated solutions showed the corrosion rate to be 0.003 mil/month (0.046 mg/dm 2/hr) and 0.002 mil/month (0.036 mg/dm 2 /hr) for temperatures of 200 F and 150 F, respectively. It can be seen, therefore, that the corrosion of zinc (galvanized) in alkaline borate solution is minimal and will not contribute significantly to the post-accident hydrogen buildup.

Consideration was given to possible caustic corrosion of austenitic steels by the alkaline solution. Data presented by Swandby(4) (Figure 60-7) show that these steels are not subject to caustic stress cracking at the temperature (285 F and below) and caustic concentrations (less than 1 percent by weight) of interest. It can be seen from Figure 60-7 that the stress cracking boundary minimum temperature as defined by Swandby coincides with a high free caustic concentration (-40%) and is considerably above the long term post-accident design temperature (-80 F). Further, from Figure 60-7, a temperature in excess of 500 F is required to produce stress corrosion cracking at a sodium hydroxide concentration greater than 85%.

It should be noted, considering the possibility of caustic cracking of stainless steel, that the sodium hydroxide-boric acid solution is a buffer mixture wherein no free caustic exists at the temperatures of interest, even when the solution is concentrated locally through evaporation of water. Hence, the above consideration is somewhat hypothetical with regard to the post-accident environment.

4.0 CORROSION OF METALS OF CONSTRUCTION BY TRACE CONTAMINANTS IN EMERGENCY CORE COOLING (ECG) SOLUTION Of the various trace elements which could occur in the emergency core cooling solution in significant quantities, only chlorine (as chloride) and mercury are adjudged potentially harmful to the materials of construction of the safeguards equipment.

The use of mercury or mercury bearing items, however, is prohibited inside containment. This includes mercury vapor lamps, fluorescent lighting and instruments which employ mercury for pressure and temperature measurements and for electrical equipment. Potential sources of mercury, therefore, are excluded from containment and hence, no hazard from this element is recognized.

The possibility of chloride stress corrosion of austenitic stainless steels was also considered. It is believed that corrosion by this mechanism will not be significant during the post-accident period for the following reasons:

1. Low Temperature of ECC Solution The temperature of the ECC solution is reduced after a relatively short period of time (i.e., a few hours) to about 150 F. While the influence of temperature on stress corrosion cracking of stainless steel has not been unequivocally defined, significant laboratory work and field experience indicates that lowering the temperature of the solution decreases the probability of failure. Hoar and Hines(5) observed this trend with austenitic stainless steel in 42 percent by weight solutions of MgC1 2 with temperature decrease from 310 F to 272 F. Staehle and Latanision(6) present data which also show the 1780f215 IPEC00035787 IPEC00035787

IP3 FSAR UPDATE decreasing probability of failure with decreasing solution temperature from about 392 F to 302 F. Staehle and Latanision(6) also report the data of Warren(7) which showed the significant change with decrease in temperature from 212 F to 104 F. The work of Warren, while pertinent to the present consideration in that it shows the general relationship of temperature to time to failure, is not directly applicable in that the chloride concentration (1800 ppm C1) believed to have effected the failure was far in excess of reasonable chloride contamination which my occur in the ECC solution.

2. Low Chloride Concentration of ECC Solution It is anticipated that the chloride concentration of the ECC solution during the post-accident period will be low. Throughout plant construction, surveillance was maintained to ensure that the chloride inventory inside containment would be maintained at a minimum. Controls on use of chloride bearing substance in containment included the following:

a) Restriction in chloride content of water used in concrete b) Prohibition of use of chloride in cleaning agents for stainless steel components and surfaces c) Prohibition of use of chloride in concrete etching for surface preparation d) Use of non-chloride bearing protective coatings inside containment e) Restriction of chloride concentration in safety injection solution, 0.15 ppm chloride maximum The effect of decreasing chloride concentration on decreasing the probability of failure of stressed austenitic stainless steel has been shown by many experimenters. Staehle and Latanision(6) presented data of Staehle which show the decrease in probability of failure with decrease in chloride concentration at 500°F. Edeleanu(8) shows the same trend at chloride concentrations from 40 to 20 percent as MgC1 2 and reported no failures in this experiment at less than about 5 percent MgC1 2 .

Instances of chloride cracking at representative ECC solution temperatures and at low solution chloride concentration have generally been on surfaces on which concentration of the chloride occurred. In the ECCS, concentration of chlorides is not anticipated since the solution will operate subcooled with respect to the containment pressure and, further, the containment atmosphere will be 100% relative humidity.

3) Alkaline Nature of the ECC Solution The ECC solution will have a solution pH between 7.9 and 10.0 after the addition of spray additive (NaOH). Numerous investigators have shown that increasing the solution pH decreases the probability of failure. Thomas et al. (9) showed that the failure probability decreases with increasing pH of boiling solutions of MgCh More directly applicable, Scharfstein and Brindley(1D) showed that increasing the solution pH to 8.8 by the addition of NaOH prevented the occurrence of chloride stress corrosion cracking in a 10 ppm C1 (as NaC1) solution at 185°F. Thirty stressed stainless steel specimens, including 304 as received, 347 as received, and 304 sensitized, were tested. No failures were observed.

179 of 215 IPEC00035788 IPEC00035788

IP3 FSAR UPDATE Other tests runs by Scharfstein and Brindley showed the influence of solution pH on higher chloride concentrations up to 550 ppm C1; however, in these tests, the pH adjusting agents were either sodium phosphate or potassium chromate. The authors express the opinion, however, that in the case of the chromate solution, chloride cracking inhibition was simply due to the hydrolysis yielding pH 8.8 and not to an influence of the chromate anion. A similar hydrolysis will occur in the borate solution.

Studies conducted at Oak Ridge National Laboratory by Griess and Bocarella(11) on type 304 and type 316 stainless steel U-bend stress specimens exposed to an alkaline borate solution (0.15M NaOH -0.28M H3 B03 ) containing 100 ppm chloride (as NaC1) showed no evidence of cracking after 1 day at 140 C, 7 days at 100 C, and 29 days at 55 C.

These extreme test conditions, combined with the fact that some parts of the test specimens were subjected to severe plastic deformation and intergranular attack before exposure, show that the probability of chloride induced stress corrosion cracking in a post-accident environment is very low indeed.

In summary, therefore, it is concluded that exposure of the stainless steel engineered safety feature components to the ECC solution during the post-accident period will not impair its operability from the standpoint of chloride stress corrosion cracking. The environment of low temperature, low chlorides and high pH which will be experienced during the post-accident period will not be conducive to chloride cracking.

5.0 CORROSION OF ALUMINUM ALLOYS Corrosion testing has shown that aluminum alloys are not compatible with alkaline borate solution. The alloys generally corrode fairly rapidly at the post-accident condition temperatures with the liberation of hydrogen gas. A number of corrosion tests were conducted in the Westinghouse laboratories and at ORNL facilities. A review of applicable aluminum corrosion data is given in Table 60-4 and on Figure 60-8.

5.1. Aluminum Corrosion Products in Alkaline Solution The corrosion of aluminum in alkaline solution expected following a design basis accident (DBA) has been shown to proceed with the formation of aluminum hydroxide (14, 15, 16) and the aluminate ion, as well as with the production of hydrogen gas.

The DBA conditions expected for Indian Point 3 include the establishment of an alkaline ECC solution having a total volume of liquid of 4.47 x 105 gallons after actuation of the Engineered Safety Features.

As mentioned above, aluminum is known to corrode in alkaline solutions to give a precipitate of A 1(OHh which, in turn, can re-dissolve in an excess of alkali to form a complex aluminate.

Van Horn(14) noted that the precipitation of A 1(OHh begins about pH4 and is essentially complete at pH7. A further increase in pH to about 9 causes dissolution of the hydroxide with the formation of the aluminate.

It can be seen, therefore, that the solubility of aluminum corrosion product is a function of the pH of the environment. Consistent with this, the corrosion of aluminum is also strongly dependent 180 of 215 IPEC00035789 IPEC00035789

IP3 FSAR UPDATE on the solution pH since when the corrosion products are dissolved from the metal surface, corrosion of the base metal can proceed more freely.

Figure 6D-9 presents a plot of aluminum corrosion rate as a function of solution pH.(1) The corrosion rate of aluminum is seen to decrease by a factor of 21 (1/0.048) as the pH decreases from 9.3 to 8.3 and by a factor of 83 (1/0.012) as the pH decreases from 9.3 to 7.0.

Therefore, one must consider both corrosion and the dissolution of the corrosion products at specific reference conditions since the two are directly related.

The corrosion reactions that are of interest in the DBA condition here would include the reaction of aluminum in alkaline solution to from aluminum hydroxide, i.e.,

(1) and dissolution of the hydroxide to form the aluminate, i.e.,

(2)

A knowledge of the solubility product of the aluminum hydroxide in an alkaline solution allows the determination of the solubility expected for the hydroxide in the DBA environment.

Deltombe and Purbaix(17) have determined the solubility product of aluminum hydroxide. Using the value of 2.28 x 10-11 for Ksp, as reported by Deltombe and Pourbaix, the following calculation can be made.

The solubility of AI(OHh is determined form Equation (2):

AI(OH)3 D AI0 2 - + H+ + H20 Ksp = [ AI0 2 -] [H+ ]

2.28 X 10- 11 =[ AI0 2 -] [H+]

at pH = 9.3 11

[ AIO 2 -] = 2.28 x 10- = 4.6 X 10-2 moles/liter 5 x 10- 10 Therefore, the solubility of A 1(OH 3) in a pH 9.3 solution at 25 C (77 0 F) is equal to 4.6 x 10-2 moles/liter or 3.0 x 10-2 Ibs/gal. Expressed as aluminum, the solubility at these conditions is 1.05 x 1Q-2 Ibs/gal.

The solubility of the aluminum corrosion products in the post-accident environment is a function of both solution pH and temperature. Figure 6D-10 presents plots of the corrosion product solubility, expressed in terms of aluminum, versus solution pH for temperatures of 770 F and 1500 F. The change in solubility with temperature is found utilizing the relationship of the free energy of formation, temperature, and solubility product.

181 of 215 IPEC00035790 IPEC00035790

IP3 FSAR UPOATE With the data available from Figure 60-9 and Figure 60-10 and with a knowledge of the reference aluminum corrosion behavior for any specific plant, one can calculate the expected solubility limits for the corrosion reaction.

For Indian Point 3, there are 4.47 x 105 gallons of ECC solution after actuation of the safety features. The total amount of aluminum present in the Containment is given in Table 60-3.

Table 60-5 shows the corrosion of aluminum with time for the design basis, pH 9.3, post-accident environment.

Table 60-6 presents a summary of the applicable solubility and corrosion parameters for various conditions. The table lists the applicable solubility products (Ksp) and solubilities at the various temperatures and solution pH together with the soluble aluminum limit for the system at the specific conditions. The last values in the table give the aluminum solubility margin after 100 days corrosion, that is, the soluble aluminum limit divided by the aluminum corroded. It can be seen that in all cases, including the very conservative low temperature and low pH conditions, the ECC solution is not expected to be saturated with aluminum corrosion products.

Further, within the expected design conditions for temperature and pH, the aluminum solubility margin ranges from approximately 20 to 106.

It is concluded, therefore, that the corrosion products of aluminum will be in the soluble form during the post-accident period considered and hence, there is no potential for deposition on flow orifices, spray nozzles, or other equipment.

Behavior of Circulating Aluminum Corrosion Products The solubility of aluminum corrosion products has shown that the entire inventory produced after 100 days exposure to the post OBA condition would remain in solution. The review also indicates that the ECC solution is only approximately 17 percent saturated at 77 F and less than 1 percent saturated at 150 0 F.

It is of interest, however, to review the experience of facilities which have operated with insoluble aluminum corrosion products and to relate their conditions with those expected in the post-accident environment.

The most significant experience available was that of Griess(18) who operated a recirculating test facility to measure the corrosion resistance of a variety of materials in alkaline sodium borate spray solution.

Tests were conducted on 1100, 3003, 5052 and 6061 aluminum alloys exposed at 100 0 C in pH 9.3 sodium borate solution (0.15 M NaOH -0.28 M H3B03). It was reported that even though the solution contained copious amounts of flocculent aluminum hydroxide, it had no effect on flow through the spray nozzle (0.093 inch orifice). The pH of the solution did not change because of the increase in the corrosion products.

Griess(18), in describing his observations with regards to aluminum corrosion product deposition potential, stated that:

a) No significant deposition was observed on that cooling coil installed in the solution b) No significant deposition was observed on the heated surfaces of the facility 182 of 215 IPEC00035791 IPEC00035791

IP3 FSAR UPDATE c) No significant deposition was observed on isothermal facility surfaces.

The amounts of aluminum corroded to the solution in the tests conducted by Griess at 55 0 C and 100 0 C were approximately 4.0 and 18.6 grams, respectively. The concentration of aluminum present in the recirculation stream, therefore, was approximately 0.2 and 1 gram/liter, respectively. This value is about a factor of about 5 above the aluminum concentration expected in the post-accident ECC solution at Indian Point 3 in a pH 9.3 solution after 100 days.

Hatcher and Rae (19) describe the appearance of turbidity in the NRU reactor and "propose" that deposition of aluminum corrosion products may have occurred on heat exchanger surfaces, although they do not report any specific examination results. Moreover, Hatcher and Rae report no operations problems associated with the presence of aluminum corrosion product turbidity in the NRU Reactor. The overall heat transfer coefficient for each NRU reactor heat exchanger was measured after 2 years of full power operation on several occasions, and within the limit of accuracy of the measurements, reported at approximately 5%, no change in the thermal resistance had been observed.

It is concluded, therefore, from the work of both Griess and of Hatcher and Rae that the deposition of aluminum corrosion products on heat exchangers surfaces will not be significant in the post-accident environments even for the circumstances of insoluble product formation.

6.0 COMPATIBILITY OF PROTECTIVE COATINGS WITH POST-ACCIDENT ENVIRONMENT The investigation of materials compatibility in the post-accident design basis environment also included an evaluation of protective coating for use inside containment.

The results of the protective coatings evaluation presented in WCAP-7198(12) showed that several inorganic zincs, modified phenolics, and epoxy coatings are resistant to an environment of high temperature (320 0 F maximum test temperature) and alkaline sodium borate. Long-term tests included exposure to spray solution at 150 to 175 F for 60 days, after initially being subjected to the conservative DBA cycle shown in Figure 6D-3. The protective coatings which were found to be resistant to the test conditions, that is, which exhibited no significant loss of adhesion to the substrate for formation of deterioration products, comprise virtually all of the protective coatings recommended for use in containment. Hence, the protective coatings will not add deleterious products to the core cooling solution.

An additional evaluation was performed (Reference 22) which evaluated the contribution of zinc corrosion to the amount of hydrogen in the post-LOCA containment atmosphere. Based on simple modeling and engineering judgment, the evaluation shows that hydrogen recombiners will be in service well before any observable contribution can be made by zinc corrosion.

It should be pointed out that several test panels of the recommended types of protective coatings were exposed for two design basis accident cycles and showed no deterioration or loss of adhesion with the substrate.

7.0 EVALUATION OF THE COMPATIBILITY OF CONCRETE-ECC SOLUTION IN THE POST-ACCIDENT ENVIRONMENT Concrete specimens were tested in boric acid and alkaline sodium borate solutions at conditions conservatively (320 F maximum and 200 F steady state) simulating the post DBA environment.

183 of 215 IPEC00035792 IPEC00035792

IP3 FSAR UPDATE The purpose of this study was to establish:

a) The extent of debris formation by solution attack of the concrete surfaces b) The extent and rate of boron removal from the ECC solution through boron-concrete reaction.

Tests were conducted in tan atmospheric pressure, reflux apparatus to simulate long-term exposure conditions and in a high pressure, autoclave facility to simulate the DBA short term, high temperature transient.

For these tests, the total surface area of concrete in the design containment which may be exposed to the ECC solution following a DBA was estimated at 6.3 x 104 square feet. This value includes both coated and uncoated surfaces. The ECC solution volume for a reference plant was considered at approximately 313,000 gallons and the surface to volume ratio from these values is approximately 29 in 2/gallon. The surface to volume ratios for the concrete-boron tests used were between 28 and 78 in 2/gallon of solution.

Table 6D-7 presents a summary of the data obtained from the concrete-boron test series.

Testing of uncoated concrete specimens in the post-accident environment showed that attack by both boric acid and the alkaline boric acid solution is negligible and the amount of deterioration product formation is insignificant. Other specimens covered with modified phenolic and epoxy protective coatings showed no deterioration product formation. These observations are in agreement with Orchard(13) who lists the following resistances of Portland Cement concrete to attack by various compounds:

Boric acid - little or no attack Alkali hydroxide solution under 10% - little or no attack Sodium borate - mild attack Sodium hydroxide over 10% - very little attack Exposure of uncoated concrete to spray solution between 3200 F and 2100 F has shown a tendency to remove boron very slowly, presumably precipitating an insoluble calcium salt. The rate of change of boron in solution was measured at about 130 ppm per month with pH 9 solution at 210 F for an exposed surface of about 36 square inches per gallon of solution (much greater than any potential exposure in the Containment). The boron loss during the high temperature transient test (320 F maximum) was about 200 ppm. Figure 6D-11 shows a representation of the boron loss from the ECC solution versus time by a boron-concrete reaction following a DBA. The time period from 0 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> shows the loss during a conservative high temperature transient test, ambient to 3200 F to 285 0 F. The data from 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> to 30 days is based on 2100 F data.

A depletion of boron at this rate poses no threat to the safety of the reactor because of the large shutdown margin and the feasibility of adding more boron solution should sample analysis show a need for such action.

8.0 MISCELLANEOUS MATERIALS OF CONSTRUCTION 184 of 215 IPEC00035793 IPEC00035793

IP3 FSAR UPDATE 8.1 Sealants Candidate sealant materials for use in the Reactor Containment System were evaluated in simulated DBA environments. Cured samples of various sealants were exposed in alkaline sodium borate solution (pH 10.0, 3000 ppm boron) to a maximum temperature of 320 0 F.

Table 6D-8 presents a summary of the sealant materials tested together with a description of the panels' appearance after testing. Three generic types of sealants were tested: butyl rubber, silicone, and polyurethane. Each of the materials was the "one package" type, that is, no mixing of components was necessary prior to application. The materials were applied on stainless steel and allowed to cure well prior to testing.

The test results showed that the silicone sealants tested were chemically resistant to the DBA environment and are acceptable for use in containment.

Sealant 780 by Dow Corning Corporation would be acceptable for use in the containment.

Major applications of this sealant could be as concrete expansion joint sealant on the liner insulation panels. Sealant 780 will contribute no deterioration products to the ECC solution during the post DBA period and will maintain its structural integrity and elastic properties.

8.2 PVC Protective Coating Tests were conducted to determine the stability of the polyvinylchloride protective coating, the type which might be used on conduit in the DBA environment. Samples of the PVC exposed to alkaline sodium borate solutions at DBA conditions showed no loss in structural rigidity and no change in weight or appearance.

A sample of PVC coated aluminum conduit (1" OD x 8" length) was irradiated by means of a Co-60 source a an average dose rate of 3.2 x 106 rads/hr to a total accumulated dose of 9.1 x 10 7 rads. The specimen was immersed in alkaline sodium borate solution (pH 10, 3000 ppm boron) at 70 F. Visual examination of the coating after the test showed no evidence of cracking, blistering or peeling, and the specimen appeared completely unaffected by the gamma exposure. Chemical analysis of the test solution indicted that some bond breakage had occurred in the PVC coating as evidenced by an increase in the chloride concentration. The gamma exposure of approximately 108 rad resulted in a release to the solution of 26 mg of chloride per square foot of exposed PVC surface. Considering a total surface area of PVC coating present in containment (approximately 500 ft2) and the ECC solution volume of 313,000 gallons, the chloride concentration increase in the ECC solution due to irradiation of the coating would be approximately 0.01 ppm.

It was concluded, therefore, that PVC protective coating will be stable in the DBA environment.

8.3 Fan Cooler Materials Samples of the following air handling system materials were exposed in an autoclave facility to the DBA temperature - pressure cycle:

a) Moisture separator pad b) High efficiency particulate filter media 185 of 215 IPEC00035794 IPEC00035794

IP3 FSAR UPDATE c) Asbestos separator pads d) Adhesive for joining separator pads and HEPA filter media corners e) Neoprene gasketing material The materials were exposed in both the steam phase and liquid phase of a solution of sodium tetraborate (15 ppm boron) to simulate the concentrations expected downstream of the fan cooler cooling coils. Examination of the specimens after exposure showed the following:

a) Moisture separator pads were somewhat bleached in color, but maintained their structural form and showed good resiliency as removed in both liquid and steam phase exposure b) High efficiency particulate filter media maintained its structural integrity in both the liquid and steam phase. No apparent change.

c) Asbestos separator pads showed some slight color bleaching, however, both steam and liquid phase samples maintained their structural integrity with no significant loss in rigidity d) Adhesive material for the HEPAIseparator pad edges showed no deterioration or embriUlement and maintained its adhesive property e) Neoprene gasketing material is also satisfactory in both the steam and liquid phase. The material showed only weight gain and a shrinkage of 15 to 30 percent based on a superficial, one flat side area. The gasket thickness decreased about 10 percent. The gasket material was unrestrained during the exposure and, hence, the dimensional changes experienced are greater than those which would result in plant applications.

9.0 ENVIRONMENTAL REQUALIFICATIONS An ongoing program of evaluating the environmental qualifications of safety related electrical equipment at Indian Point 3 has been in progress since early 1980.

Included in this program are evaluations of the following environmental parameters: function, service, location, operating time, temperature, pressure, relative humidity, chemical spray, radiation, aging, submergence, and qualifying method. This evaluation program is based on the provisions of: Code of Federal Regulations, Title 10, Part 50.49, "Environmental Qualification of Electric Equipment Important to Safety for Nuclear Power Plants" and Regulatory Guide 1.89, Revision 1, "Environmental Qualification of Certain Electric Equipment Important to Safety for Nuclear Power Plants." Complete and auditable records are available and will be maintained at a central location. These records described the environmental qualification methods used for all safety related electrical equipment in sufficient detail to document compliance with the requirements of 10 CFR 50.49 and Regulatory Guide 1.89, Rev. 1.

Such records will be updated and maintained current as equipment is replaced, further tested, or otherwise further qualified. In accordance with schedule requirements of 10 CFR 50.49, all components falling within the scope of this program will be qualified, replaced, or modified to ensure their operation.

186 of 215 IPEC00035795 IPEC00035795

IP3 FSAR UPDATE References

1) Bell, M. J., J. E. Bulkowski, and L. F. Picone, "Investigation of Chemical Additives for Reactor Containment Sprays," Westinghouse Proprietary WCAP-7153, March 1968.

2) "ORNL Nuclear Safety Research & Development Program Bimonthly Report for July-August 1968," ORNL TM-2368, p. 78.

3) "ONRL Nuclear Safety Research & Development Program Bimonthly Report for September - October 1968," ORNL TM-2425, p. 53.

4) Swandby, R. K., Chemical Engineer 69, 186, November 12, 1962.

5) Hoar, T. P., and J. G. Hines, "Stress Corrosion Cracking of Austenitic Stainless Steel in Aqueous Chloride Solutions," Stress Corrosion Cracking and Embrittlement (ed. W. D.

Robertons), John Wiley and Sons, 1956.

6) Latanision, R. M., and R. W. Staehle, "Stress Corrosion Cracking of Iron - Nickel Chromium Alloys," Department of Metallurgical Engineering, The Ohio State University.

7) Warren, D., Proceedings of Fifteenth Annual Industrial Work Conference, Purdue University, May 1960.

8) Edeleanu, C., JISI173 (1963), 140.

9) Thomas, K. C., et aI., "Stress Corrosion of Type 304 Stainless Steel in Chloride Environment," Corrosion, Volume 20 (1964), p. 89t.

10) Sharfstein, L. R., and W. F. Brindley, "Chloride Stress Corrosion Cracking of Austenitic Stainless Steel - Effect of Temperature and pH," Corrosion, Volume 14 (1958), p. 5881.

11) "ORNL Nuclear Safety Research & Development Program Bimonthly Report for March-April, 1969," ORNL TM-2588.

12) Picone, L. F., "Evaluation of Protective Coatings for Use in Reactor Containment,"

Westinghouse Proprietary WCAP-7198L, April 1968.

13) Orchard, D. F., "Concrete Technology, Volume 1," Contractors Record Limited, London, 1958.

14) Van Horn, K. C., "Aluminum, Volume I," American Society of Metals (1967).

15) Sundararajan, J. and T. C. Rama Char, Corrosion 17 (1961), 39t.

16) Cotton, F. A., and G. Wilkinson, Advanced Inorganic Chemistry, Interscience Publishers, 1962.

17) Deltombe, E. and Purbaix, M., Corrosion 14 (1968), 49t.

187 of 215 IPEC00035796 IPEC00035796

IP3 FSAR UPDATE

18) Griess, J. C., et aI., "Corrosion Studies," ORNL Nuclear Safety Research and Development Program Bi-Monthly, July-August 1968. USAEC Report ORNL-TM-2368, pp.

76-81.

19) Hatcher, S. R. and Rae H. K., Nuclear Science and Engineering 10 (1961), p. 316.

20) SECL-91-313, "Safety Evaluation for Indian Point 3 RWST Boron Increase," Westinghouse Electric Corp.

21) IP3 Technical Specification Amendment 119, June 2, 1992.

22) 10CFR50.59 Evaluation EVL-02-3-070 HC, Rev. 0, "Allowance for Additional Aluminum in Contai nment."

188 of 215 IPEC00035797 IPEC00035797

IP3 FSAR UPDATE Table 60-1 REVIEWOF SOURCES OF VARIOUS ELEMENTS IN CONTAINMENT AND THEIR EFFECTS ON MATERIALS OF CONSTRUCTION Representative Group Elements Corrosivity of Elements Sources of Elements o He, Ne, Kr, Xe No effect on any materials of Fission product release.

construction.

I a Li, Na, K Generally corrosion inhibitive Li - coolant pH adjusting agent properties for steels, and Na - spray additive solution concrete leach product copper alloys - harmful to K - concrete leach product aluminum.

II a Mg, Ca, Sr, Sa Generally not harmful to steel Concrete leach products - deteriorated insulation.

or copper base alloys.

III a Y, La, Ac Not considered harmful in low Fission product release.

concentrations.

IV a Ti, Zr, Hf Not considered harmful to Fuel rod cladding, control rod material, alloying con-stituent.

any materials.

V a V, Nb, Ta Not considered harmful to Alloying constituents in low concentration.

any materials.

VI a Cr, Mo, W Not considered harmful to Alloying constituents in equipment.

any materials.

VII a Mn, Tc, Re Not considered harmful. Mn - alloy constituent.

VIII Fe, Ni, Cr, Os Fe, Ni, Cr - not harmful to Fe, Ni, Cr - alloying con- stituents. Others have no identifiable any materials. sources.

"U m I b Cu, Ag, Au Not harmful to any materials. Cu present as material of construction and alloying constituent.

()

-u 0 m 0 0 0 0 eN 0 01 1890f215 0 -....I 0)

(J1 <D

-....J 00 CD CD

IP3 FSAR UPDATE II b Zn,Cd, Hg Hg - harmful to stainless Hg has been entirely exclud-ed from use in the Contain-ment. Cd steel, Cu alloys, finish plating on components. Zn galvaniz-ing and alloying aluminum constituent.

Zn - unknown Cd - unknown III b B, A1, Ga, In Not harmful to material. B - neutron poison additive A 1 - materials of construction IV b C, Si,1 Sn, Pb C, Si, Sn not harmful to Si - concrete leach product materials. Pb - alloy constituent in some brazes Pb considered harmful to nickel alloys.

V b N, P, As, Sb, Bi No effect from N unless N - containment air. Others not identified in significant materials.

ammonia is formed. Others unknown.

VI b O,S,Se, Te S possible harmful to nickel Te - fission product alloys. S - oils, greases, insulating materials VII b F, C1, Br, I F, considered potentially C1 - concrete leach product, general contamination harmful to Zircaloy. C1, F - organic materials potentially harmful to I - fission products, low concentration stainless steel. Br and I, not BR - fission products, low concentrtion generally harmful.

"'U m

()

"'U o m o oo o eN o 01 190 of 215 o0) -....I (J1 <D

-....J <D CD CD

IP3 FSAR UPDATE TABLE 60-2 MATERIALS OF CONSTRUCTION IN REACTOR CONTAINMENT Material Equipment Application 300 Series Stainless Steel Reactor Coolant System, residual heat removal loop, spray system 400 Series Stainless Steel Valve materials Inconel (600, 690, 718) Steam generator tubing, reactor vessel nozzles, core supports, and fuel rod grids Galvanized Steel Ventilation duct work, CRDM shroud material, 1& C conduit Aluminum Nuclear detectors, I & C equipment, CRDM connectors, paints, reactor vessel insulating foil 4% Mo, 6% Mo Austenitic Stainless Service water piping, fan cooler material Steels Copper Fan and motor cooler tube fin material Carbon Steel Component cooling loop, structural steel, main steam piping, etc.

Monel Possibly instrument housings Brass Possibly instrument housings Protective Coatings General use on carbon steel structures and equipment, concrete Inorganic Zincs Epoxy Modified Phenolics Silicones - neoprene Ventilation duct work gasketing, Sealants "U

m

()

-u o m o oo o eN o 01 191 of 215 o0) 00 (J1 o CD o o

o

IP3 FSAR UPDATE TABLE 60-3 INVENTORY OF ALUMINUM IN CONTAINMENT Item Mass (lbs) Surface area (ff)

1. Valve Parts Inside Containment 230 86

2. Source, Intermediate, and Power Range Detectors 244 83

3. Power Range Polyethylene 228 255 Shields

4. Paint on Steam Generator, 58 7480 Pressurizer and Reactor Vessel

5. Reactor Vessel 269 10,000 Insulating Foil

6. Process Instrumentation and 159 31 Control Equipment

7. Control Rod Drive Mechanism 800 131.6 Fan Blades

8. Flux Mapping 1950 335 Drive System

9. Reactor Coolant Pump Conduit 7.2 4 Boxes

10. Reactor Coolant Pump Motor 125 12.8 Parts

"'U m

()

"'U o m o oo o eN o 01 192 of 215 o0) 00 (J1 o

......

CD o

--"

IP3 FSAR UPDATE

11. Rod Position Indicators 10.6 3.67

12. Contingency 408 1842 Note:The data on this table are equivalent to the data on FSAR Table 14.3-64.

"U m

()

-u o m o oo o eN o 01 193 of 215 o0) 00 (J1 o CD tv o

N

IP3 FSAR UPDATE TABLE 60-4 CORROSION OF ALUMINUM ALLOYS IN ALKALINE SODIUM BORATE SOLUTION Data Temperature Alloy Test Corrosion Rate Point (F) IYQ§ Duration (mg/dm 2 /hr) Q.ti Exposure Condition Reference 1 275 5053 3 hrs. 96.2 9 Solution WCAP-7153, Table 9 2 275 5005 3 hrs. 840 9 Solution WCAP-7153, Table 9 3 200 6061 320 hrs. 15.4 9.3 Solution WCAP-7153, Table 8 WCAP-7153, Figure 9 4 210 5052 7 days 53.0 9 Solution WCAP-7153, Table 7 WCAP-7153, Figure 8 5 210 5052 2 days 14.0 9 Solution WCAP-7153, Table 5 6 210 5005 2 days 27.1 9 Solution WCAP-7153, Table 5 7 284 5052 1 day 54 9.3 Spray ORNL-TM-2425, Table 3.13 8 284 5052 1 day 31.5 9.3 Solution ORNL-TM-2425, Table 3.13 9 212 6061 3 days 126 9.3 Spray ORNL-TM-2368, Table 3.6 10 212 6061 3 days 110 9.3 Solution ORNL-TM-2368, Table 3.6 11 150 6061 7 days 2.9 9.3 Solution Westinghouse data 12 150 5052 7 days 4.2 9.3 Solution Westinghouse data "U

m

()

-u 0 m 0 0 0 0 eN 0 01 194 of 215 0 00 0)

(J1 0 CD eN 0

0)

IP3 FSAR UPDATE TABLE 60-5 CORROSION PRODUCTS OF ALUMINUM FOLLOWING DBA Mass of Mass Time After Aluminum Hydrogen A1 (OH)3 Reactor Trip Corroded Produced Formed (Days) (lb x 10-2 ) (SCF x 10-3 ) (Ib x 10-2 )

1 2.48 4.96 7.19 5 4.31 8.63 14.5 10 4.52 9.03 13.1 20 4.91 9.82 14.2 30 5.3 10.6 15.4 40 5.7 11.4 16.5 50 6.1 12.2 17.7 60 6.5 13.0 18.8 70 6.9 13.8 20.0 80 7.3 14.6 21.2 90 7.6 15.3 22.0 100 8.1 16.1 23.5

-U m

()

-u 0 m 0 0 0 0 eN 0 01 195 of 215 0 00 0)

(J1 0 CD ~

0

.j::>.

IP3 FSAR UPDATE TABLE 60-6

SUMMARY

OF ALUMINUM CORROSION PRODUCT SOLUBILITY DATA Parameter Solution Temperature 77 F 150 F pH 9.3 pH 8.3 pH 93 pH 83 Solubility Product, 2.28 x 10-11 2.28 X 10-11 4.16x10- 1O 4.16 X 10-10 Ksp A 1 Solubility, 1.05 x 10-2 1.05 X 10-3 1.9x10-1 1.9 X 10-2 Ibs A1/gal Soluble A 1 Limit(a) 4.69 x 103 4.69 X 102 8.49 X 104 8.49 X 103 for ECCS, Ibs A 1 Corrosion Rate, (Not Used) (Not Used) 1 0.048 Normalized A 1 Corroded after (Not Used) (Not Used) 810 439(b) 100 Days, Ibs A 1 Solubility Margin 5.8(c) 1.1 (c) 105 19 at 100 Days, Ibs (a) Indian Point 3 solution volume 4.47 x 105 gal.

(b) Value assumes rapid corrosion of all A 1 paint and reactor vessel foil insulation.

(c) Note corrosion rate at 150 F was used for "A 1 corroded" value; hence, value is very conservative.

"'U m

()

"'U 0 m 0 0 0 0 eN 0 01 196 of 215 0 00 0)

(J1 0 CD 01 0

(J1

IP3 FSAR UPDATE TABLE 60-7 CONCRETE SPECIMEN TEST DATA Total Exposed Initial Concrete - Exposure Weight Specimen Boron Period SurfaceNolume Change Weight Test No. (Days) (in 2/gal) (Grams) (Grams) Visual Examination 1 24 28 -22.4 560.0 No apparent change 3 28 20 +21.5 404.0 Light, yellowish deposit on specimen 4(a) 72 38 0 641.2 No apparent change - coating adhesion excellent 5 72 43 -0.2 769.5 Light, hard deposit on specimen 6 4(b) 54 601.4 No apparent change - small amount of sand particles in test can 7 175 23 +11.0 457.0 No apparent change 8(a) 175 38 +26.5 751.0 No apparent change - coating adhesion excellent 9(a) 5(b) 78 +4.0 702.0 No apparent change - coating adhesion excellent (a) These specimens coated with Phenoline 305. All others were uncoated.

(b) These tests were at high temperature DBA transient conditions. All others at 195 to 205 F.

"U m

()

-u o m o oo o eN o 01 1970f215 o0) 00 (J1 o CD m o(J)

IP3 FSAR UPDATE TABLE 60-8 EVALUATION OF SEALANT MATERIALS FOR USE IN CONTAINMENT Sealant Type Manufacturer Post-Test Appearance Butyl rubber A Unchanged, flexible Silicone B Unchanged, flexible Silicone B Unchanged, flexible Polyurethane C Sealant bubbled and became very soft. Solution permeated into bubbles.

Polyurethane C Sealant swelled and became soft, solution permeated into material.

Polyurethane C Sealant swelled, very soft and tacky, solution permeated into material.

"U m

()

-u o m o oo o eN o 01 198 of 215 o0) 00 (J1 o CD -...J o

-....J

IP3 FSAR UPDATE APPENDIX6E SPRAY SYSTEM MATERIALS COMPATIBILITY FOR LONG TERM STORAGE OF SODIUM HYDROXIDE A materials compatibility review for the spray additive tank and associated equipment during long term storage of sodium hydroxide is presented in this Appendix. The exposure conditions are shown in Table 6E-1. The materials for the various components are shown in Table 6E-2.

The corrosion rates for the various materials at or near the long term exposure conditions with air contamination are shown in Table 6E-3. The immunity of most of the materials in Table 6E-2 to caustic cracking at the exposure conditions listed in Table 6E-1 has been reported by Logan(6) (See Figure 6-1). No caustic cracking of 17-4 PH or Stellite has been reported. (7)

The effect of carbon dioxide form air exposure on corrosion of iron is shown in Figure 6-2.(8) at pH 14, no additional corrosion is observed over that observed in carbon dioxide free solution. A nitrogen blanket is continuously maintained over the sodium hydroxide solution in the spray additive tank, thus essentially eliminating any carbon dioxide contamination of the solution.

The Nordel* rubber diaphragm material used in the tank valves was exposed in 33 wlo sodium hydroxide solution (NaOH) at 110°F for 6 months and found to be unaffected by the simulated spray additive tank solution. The completely unchanged appearance of Nordel rubber after 6 months exposure in sodium hydroxide solution would indicate that integrity of the Nordel rubber diaphragm in the spray additive tank valves would not be affected by long term exposure to the spray additive solution. The Nordel rubber material has also been analyzed up to 38 wlo NaOH to assure valve operability when exposed to the highest NaOH concentration (See Table 6.3-3).

The integrity of the structural materials in the spray additive tank system would not be adversely affected even using the corrosion rates presented in Table 6E-3, where air contamination is present. In the Indian Point 3 system, where nitrogen blanketing of the spray additive tank would prevent air contamination, the corrosion rates would be even lower with even less effect on the material integrity.

Diamond Shamrock Company(10) reported that no galling of steel valves occurred after exposure to 50% sodium hydroxide solution at 120 to 140°F for more than 3 years. Stainless steel valves, exhibiting lower corrosion rates, would have an even lower propensity toward galling than steel.

Therefore, no galling should occur on the valves exposed to the long term storage conditions.

The total corrosion product released to the spray additive tank as oxide would be less than 1000 grams per year with aerated solution and would be much less with the air free solution. This small quantity of corrosion product should not present any problems with clogging of delivery lines.

• NOTE: Nordel is a product of Dupont De Nemours and Company.

No sodium hydroxide precipitation would occur for a 38 wlo solution if the temperature of the tank and liners are maintained above 58°F. The tank is in an area of the auxiliary building that is heated (and the temperature logged) such that no solid sodium hydroxide would be present and therefore no clogging of the lines should occur.

References 199 of 215 IPEC00035808 IPEC00035808

IP3 FSAR UPDATE

1) A Guide to Corrosion Resistance, J. F. Polar (Clima: Molybdenum).

2) Corrosion Data Survey (1960 Edition) (Shell Development Company).

3) Resistance of Huntington Alloys to Corrosion (Huntington Alloy Products Division of International Nickel Company, Inc.), page 28.

4) Metals Handbook, 8th Edition, Vol. 1, Properties and Selection of Metals, page 670 (American Society for Metals).

5) From unreported work performed a W NES laboratories.

6) The Stress Corrosion of Metals by H. L. Logan, John Wiley & Sons, Inc., N.Y., 304 and 316 Stainless Steel, page 138, 410 Stainless Steel, page 101, A-516-GR-70, page 44.

7) Letter from R. R. Gaugh, Armco Steel on Data from an Armco Internal Report, dated September 26, 1969, to D. D. Whyte.

8) "Corrosion Causes and Prevention" by F. N. Speller, McGraw Hill Book Company, Inc.,

New York, 1951, page 195.

9) "The Corrosion and Oxidation of Metals" by V. R. Evans, Edward Arnold Publishers, Ltd.,

London, 1960, page 45.

10) Personal communication with Robert Sheppard, Assistant Plant Manager, Divisional Technical Center of Diamond Shamrock Company, Painsville, Ohio.

11) SECL-91-313, "Safety Evaluation for Indian Point Unit 3 RWST Boron Increase,"

Westinghouse Electric Corp.

200 of 215 IPEC00035809 IPEC00035809

IP3 FSAR UPDATE TABLE 6E-1 EXPOSURE CONDITIONS Temperature of 110 Nitrogen Overpressure Slight positive pressure Sodium Hydroxide Concentration, w/o 35-38 w/o Oxygen Concentration - Normal Nitrogen blanketed Carbon Dioxide Concentration - Normal Nitrogen blanketed TABLE 6E-2 COMPONENT MATERIALS Component Material Spray Additive Tank 304 stainless steel cladding on steel A-516 GR-70 Piping 304 stainless steel Valve Bodies 304 and 316 stainless steel Valve Seats Austenitic stainless steel or Steliite Valve Stems 17-4 PH and 410 stainless steel Valve Diaphragm Ethylene-Propylene Dipolymer Nordel Rubber by Dupont 201 of 215 IPEC00035810 IPEC00035810

IP3 FSAR UPDATE TABLE 6E-3 CORROSION RATES NaOH Temperature Concentration, Corrosion Reference Material ill {QQml Aeration Rate Cmils/yr) No.

304 SIS 136 22 to 50 Yes <0.1 1 316 SIS 125 30 Yes <2 2 Steel 179 30 to 50 Yes <20 2 410 SIS 125 30 Yes <2 2 17-4 pH 176 30 Yes 3 to 6 7 Stellite 150 50 Yes <0.6 4 Nordel Rubber 110 33 Yes <0.004 5 202 of 215 IPEC00035811 IPEC00035811

IP3 FSAR UPDATE APPENDIX6F ENVIRONMENTAL QUALIFICATION OF ELECTRICAL EQUIPMENT IMPORTANT TO SAFETY

1. REQUIREMENTS FOR ENVIRONMENTAL QUALIFICATION OF ELECTRICAL EQUIPMENT Part 50.49, Title 10, of the Code of Federal Regulations contains the NRC requirements for Environmental Qualification of Electric Equipment important to safety for nuclear power plants. Specifically it defines electric equipment important to safety as:

"(1) Safety-related electric equipment.* This equipment is that relied upon to remain functional during and following design basis events to ensure (i) the integrity of the reactor coolant pressure boundary, (ii) the capability to shut down the reactor and maintain it in a safe shutdown condition, and (iii) the capability to prevent or mitigate the consequences of accidents that could result in potential offsite exposures comparable to the 10CFR Part 100 guidelines. Design basis events are defined as conditions of normal operation including anticipated operational occurrences, design basis accidents, external events, and natural phenomena for which the plant must be designed to ensure functions (i) through (iii) of this paragraph.

(2) Nonsafety-related electric equipment whose failure under postulated environmental conditions could prevent satisfactory accomplishment of safety functions specified in subparagraphs (i) through (iii) of paragraph (b) (1) of this section by the safety-related equipment.

(3) Certain post-accident monitoring equipment.**"

• Safety-related electric equipment is referred to as "Class 1E" equipment in IEEE 323-1974.

• • Specific guidance concerning the types of variables to be monitored is provided in Revision 2 of Regulatory Guide 1.97, "Instrumentation for Light-Water Cooled Nuclear Power Plants to Assess Plant and Environs Conditions During and Following an Accident."

The regulations further require that equipment must be qualified by one of the following methods.

"(1) Testing an identical item of equipment under identical conditions or similar conditions with a supporting analysis to show that the equipment to be qualified is acceptable.

(2) Testing a similar item of equipment with a supporting analysis to show that the equipment to be qualified is acceptable.

(3) Experience with identical or similar equipment under similar conditions with a supporting analysis to show that the equipment to be qualified is acceptable.

203 of 215 IPEC00035812 IPEC00035812

IP3 FSAR UPDATE (4) Analysis in combination with partial type test data that supports the analytical assumptions and conclusions."

Regarding Equipment which was qualified prior to issuance of 10CFR50.49, the regulations state:

"(k) Applicants for and holders of operating licenses are not required to requalify electric equipment important to safety in accordance with the provisions of this section if the Commission has previously required qualification of that equipment in accordance with "Guidelines for Evaluating Environmental Qualification of Class 1E Electrical Equipment in Operating Reactors," November 1979 (DOR Guidelines), or NUREG-0588 (For Comment version), "Interim Staff Position on Environmental Qualification of Safety-Related Electrical Equipment."

(1) Replacement equipment must be qualified in accordance with the provisions of this section unless there are sound reasons to the contrary."

Equipment installed in Indian Point 3 has been qualified in accordance with

• DOR Guidelines

• 10CFR50.49 based on the equipment installation date.

2. SAFETY RELATED SYSTEMS Regulatory Guide 1.89 Revision 1, dated June 1984, identifies typical safety-related systems that may contain equipment requiring environmental qualification. The systems identified are:

Engineered Safety Feature Actuation Reactor Protection Containment Isolation Steamline Isolation Main Feedwater Shutdown and Isolation Emergency Power Emergency Core Cooling Containment Heat Removal Containment Fission Product Removal Containment Combustible Gas Control Auxiliary Feedwater Containment Ventilation Containment Radiation Monitoring Control Room Habitability System (e.g., HVAC, Radiation Filters)

Ventilation for Areas Containing Safety Equipment Component Cooling Service Water Emergency Systems to Achieve Safety Shutdown 204 of 215 IPEC00035813 IPEC00035813

IP3 FSAR UPDATE The systems installed at Indian Point 3 which are used in whole or in part to accomplish the safety functions identified in Regulatory Guide 1.89 Rev 1 are:

Reactor Protection System Safety Injection System Auxiliary Coolant System Chemical and Volume Control System Condensate and Boiler Feedwater System Ventilation System for Containment, Primary Auxiliary and Fuel Storage Building Service Water System Nuclear Steam Plant Supply Nitrogen to Nuclear Equipment Sampling System Automatic Gas Analyzer System Primary Make-Up Water System Instrument Air System Main Steam System Reactor Coolant System Hydrogen Recombiner System Steam Generator Blowdown Service and Cooling Water System Pressurizing & Pressure Relief System Emergency Diesel System Radiation Monitoring System Emergency AC and DC Distribution System AC Distribution System 125V dc Distribution System

3. DESIGN BASIS EVENTS AND CONDITIONS FOR WHICH ENVIRONMENTAL QUALIFICATION IS REQUIRED 10CFR50.49(b)(1) defines design basis events as follows:

"conditions of normal operation including antiCipated operational occurrences, design basis accidents external events, and natural phenomena for which the plant must be designed to ensure functions (i) through (iii) of this paragraph."

10CFR50.49 further states:

"(c) Requirements for (i) dynamic and seismic qualification of electric equipment important to safety, (ii) protection of electric equipment important to safety against other natural phenomena and external events, and (iii) environmental qualification of electric equipment important to safety located in a mild environment are not included within the scope of this section. A mild environment is an environment that would at no time be significantly more severe than the environment that would occur during normal plant operation, including antiCipated operational occurrences."

The accidents, therefore, which require environmental qualification of electrical equipment installed in Indian Point 3 are:

o Loss of Coolant Accidents (LOCA) o High Energy Line Breaks (HELB) o Main Steam Line Breaks (MSLB) 205 of 215 IPEC00035814 IPEC00035814

IP3 FSAR UPDATE Loss of coolant accidents affect the environmental conditions inside the reactor containment building and in the pipe penetration area, purge valve enclosure area, the safety injection pump room, and the residual heat removal pump room of the Primary Auxiliary Building. High energy line breaks (steam lines and/or feedwater lines) affect the environmental conditions in the steam and feedline penetration area, pipe penetration area, hot penetration blower/chemical feed room, service water chase area (mini-containment), steam generator blowdown recovery heat exchanger room, and in the auxiliary feed pump room. Main steam line breaks inside the reactor containment building affect the environment in the containment building.

A. Pressure and Temperature in the Reactor Containment Building.

Figure 6F-1 shows the pressure and temperature resulting from various size primary system piping breaks inside the containment building. The pressure and temperature transient data were developed for Indian Point 3 based on:

1) Mass and energy release data calculated by the methodology described in Westinghouse Topical Report WCAP-8264.

2) Containment pressure transient data calculated by the methodology described in Westinghouse Topical Report WCAP-7155.

3) A containment free volume of 2.6 x 10 6 cubic feet.

4) Heat removal from one containment spray train and three of five fan coolers in operation, assuming the loss of Diesel Generator No. 33. Equipment configurations resulting from losses of different diesel generators are evaluated in Chapter 14.3.

Figure 6F-1 forms the basis of the postulated pressure and temperature parameters to which equipment inside containment is qualified.

B. Radiation in the Containment Building.

Regulatory Guide 1.89 Revision 1 requires that the source term to be used in determining the radiation environment associated with a design basis LOCA should be based on instantaneous release to the containment of 100% of the noble gas activity, 50% of the halogen activity and 1% of the remaining fission product activity. Using this source term for a 4,100 MWth PWR with a dry containment free volume of 2.52 x 106 cubic feet, NRC calculated the dose as a function of time at the centerline of containment and provided the results in Tables D-1 and D-2 of Regulatory Guide 1.89 Revision 1.

Tables 6F-1 and 6F-2 contain the expected radiation doses at the centerline of the Indian Point 3 containment due to the release of fission products as a result of a postulated LOCA. These tables are based on tables D-1 and D-2 of Regulatory Guide 1.89 Revision 1. Tables 6F-1 and 6F-2 were developed by taking the ratio of the Indian Point 3 power (3025 MWth) to the Regulatory Guide 1.89 Revision 1 reactor power (4,000 MWth) and multiplying the values contained in the Regulatory Guide Appendix D tables by the power level ratio (0.74). For conservatism, no credit was taken for the larger containment volume of Indian Point 3. The centerline doses provided in Tables 6F-1 and 6F-2 were reduced by a factor of 2.7 to account for shielding in the determination of specified radiation doses inside containment.

C. Effect of LOCA in the Primary Auxiliary Building.

206 of 215 IPEC00035815 IPEC00035815

IP3 FSAR UPDATE In the Indian Point 3 design there are several redundant methods of providing Core Cooling following LOCA. Some of these methods involve recirculation of reactor coolant from either the containment sump or from the reactor coolant system hot legs by pumps which are located in the primary auxiliary building outside of the containment boundary. The recirculating coolant contains halogens and other solid fission products and thus causes a radiation field around the piping and equipment containing the coolant. Analyses of radiation levels resulting from the recirculating coolant have been performed to determine the dose rate and integrated does at various locations in the primary auxiliary building, Reference 2. For environmental qualification, the maximum integrated dose used for equipment located in the pipe penetration area, the safety injection pump room and the residual heat removal pump room is 7.07 x 106 rads.

The dose rate and integrated dose in other areas of the primary auxiliary building are negligible.

D. Effect of Pipe Breaks in the Primary Auxiliary Building.

Reference 3 contains an evaluation of the effects of breaks in various high energy lines located in the primary auxiliary building. The conclusions from Reference 3 indicate that the pressure and temperature in the primary auxiliary building are not significantly more severe than during normal operation. The environment due to a high energy line break, therefore, is mild.

The effects of breaks in the steam generator blowdown lines in the Pipe Penetration Area and Heat Exchanger Room are analyzed in Reference 9. A break in these areas will be detected by strategically positioned temperature sensors which would provide the permissive to the valve circuitry to isolate such breaks.

E. Effects of Pipe Breaks in the Steam and Feedline Penetration Area.

Reference 4, 4A and 10 contain the results of analyses of various size steam line breaks in the steam and feedline area of Indian Point 3. The mass and energy releases include the effects of both saturated and superheated steam. Furthermore, the analysis considers the possibility that a MSLB during a mild winter day (in which the building is sealed in accordance with cold weather protection procedures) may result in temperatures more limiting than an MSLB occurring on a hot summer day, when the building is more completely vented. The resultant temperature profiles, which appear on Figures 6F-4 and 6F-8, represent a peak temperature scenario and a bounding composite of nearly 2900 separately modeled cases. The peak temperature of 504 degree F exceeds the maximum temperature qualifications of most EO equipment in the building. Therefore, a series of thermal lag calculations (References 11 and 15) have been performed which show that the short duration of the temperature peak and the effects of equipment housing will prevent the EO equipment from exceeding qualified temperatures.

Figure 6F-4 shows the time dependent temperatures and steam flows resulting from a steam line break, which results in peak temperature. Figure 6F-8 shows a composite temperature profile bounding all analyzed pipe break scenarios.

F. Effects of Pipe Breaks in the Auxiliary Feed Pump Room.

207 of 215 IPEC00035816 IPEC00035816

IP3 FSAR UPDATE Reference 6 contains the results of analyses of breaks in the four-inch steam supply pipe to the turbine driven pump. This break is sensed by redundant, environmentally qualified temperature switches and is terminated in less than 8 seconds by quick closing isolation valves located outside of the auxiliary feed pump room. Figure 6-9B shows the pressure and temperature profile resulting from a break in the 4-inch steam line.

G. Submergence 10CFR50.49 requires that the equipment qualification program include and be based on submergence if the equipment is subject to being submerged. At Indian Point 3, the liquid level inside containment after a worst case Loss-of-Coolant-Accident would be at elevation 50 feet, 1.5 inches maximum (Reference 7). This level corresponds to a depth of 4 feet 1.5 inches.

The Safety-related equipment which would be subject to submergence are some electrical cables and splices. Figure 6-10 shows the temperature profiles to which the cables and splices would be subjected. The pressure is as shown in Figure 6-1.

The sump chemistry is determined primarily by the chemistry of the primary coolant and refueling water storage tanks. The resulting composition for Indian point would be 2400-2600 ppm Boron (as H3 B0 3) buffered to a pH of 9-10 by 35%-38% Sodium Hydroxide (NaOH). There is a negligible effect on sump chemistry as a result of discharge of the accumulators and the boron injection tank because of the small volume of liquid associated with these units. The other constituents of the sump are ppm quantities of solid fission products, iodine, and materials washed from containment surfaces as a result of the containment spray.

4. EQUIPMENT REQUIRING ENVIRONMENTAL QUALIFICATION A listing of equipment installed in Indian Point 3 which is located in areas subject to harsh environmental parameters as a result of LOCA or HELB and is required to function in such a harsh environment is documented in Reference 8, "Master List of Electrical Equipment to be Environmentally Qualified." Reference 8 contains the equipment identification number, the location, the system in which the equipment is installed and the function of the equipment.

The equipment listed in Reference 8 was identified as a result of reviews of system diagrams, emergency operating procedures, and electrical schematic diagrams.

5. DEMONSTRATION OF ENVIRONMENTAL QUALIFICATION OF EQUIPMENT A file is maintained at Indian Point 3 containing all the documents necessary to demonstrate that the equipment listed in Reference 8 is qualified for the accident environments to which the equipment can be subjected. The file also contains documentation which describes how the equipment is maintained to ensure qualified status throughout its installed life.

6. REFERENCES

1) Office of Nuclear Reactor Regulation Safety Evaluation Report for Indian Point Nuclear Power Station Unit No.3; Environmental Qualifications of Safety-Related Electrical Equipment USNRC, 21-May-81 208 of 215 IPEC00035817 IPEC00035817

IP3 FSAR UPDATE

2) Report N06604-182-D-001, Design Review of Plant Accessibility and Environmental Qualification of Equipment for Area/Systems Requiring Occupancy and/or use During Post Depressurized Design Basis Accident Recovery Operation.

3) Analysis of High Energy Lines, Indian Point 3 Docket No. 50-286 Consolidated Edison Company, 09-May-73

4) WCAP-14025, Rev. 2, "Margin Recovery Program, Steamline Break Mass and Energy Releases for Equipment Environmental Qualification Outside Containment,"

Westinghouse Electric Corp., 1997 4A) Report INT-02-4, "Steamline Break Mass/Energy Release Outside Containment for Indian Point 3 (Data from WCAP-14025 R2 and Additional Case to Address TB-OO-04), Westinghouse Electric Corp., February 4,2002

5) Westinghouse letter WOG-84-235, WOG Program to Deterine the Effects of HELB Superheated Mass/Energy Releases Outside Containment - Guidelines for Evaluation September 11, 1984

6) Report P801-4-2 Auxiliary Feed Pump Room, Analysis of Conditions Resulting From a Break in the 4 inch Steam Supply Pipe to the Auxiliary Feed Pump Turbine, Indian Point 3 June 1984

7) Report NSE-80-03-029-WDS-1, Rev. 1 Evaluation of Post Accident Flooding in Containment Building Indian Point Unit 3

8) Master List of Electrical Equipment to be Environmentally Qualified

9) SE Report 860225-1, April 1987, Investigation of High Energy Line Break in the Steam Generator Blowdown Line in both the Pipe Penetration Area and Heat Exchanger Room of IP3

10) Entergy Calculation IP3-CALC-MS-03633, Rev. 1

11) Entergy Calculation IP3-CALC-MS-03667, Rev. 0

12) Entergy Calculation IP3-CALC-MS-03639, Rev. 0

13) Entergy Calculation IP3-CALC-MS-03696, Rev. 0

14) Entergy Calculation IP3-CALC-MS-03698, Rev. 0

15) Entergy Calculation IP3-CALC-MS-03697, Rev. 0

16) 10CFR50.59 Evaluation EVL 02-3-123-MS, Rev. 0, "Evaluation of Steam Break Outside Containment for EQ Purposes" 209 of 215 IPEC00035818 IPEC00035818

IP3 FSAR UPDATE Table 6F-1

SUMMARY

TABLE OF ESTIMATES FOR TOTAL AIRBORNE BETA DOSE CONTRIBUTORS IN CONTAINMENT TO A POINT IN THE CONTAINMENT CENTER INDIAN POINT UNIT NUMBER 3 Time Airborne Iodine Airborne Noble Total Dose (Hr) Dose (rads)* Gas Dose (Rads)* (rads)*

0.00 0.03 1.68E+5 4.03E+5 5.12E+5 0.06 1.93E+5 7.27E+5 9.22E+5 0.09 2.45E+5 9.95E+5 1.24E+6 0.12 2.82E+5 1.20E+6 1.49E+6 0.15 3.09E+5 1.40E+6 1.69E+6 0.18 3.31E+5 1.58E+6 1.91 E+6 0.21 2.48E+5 1.73E+6 2.07E+6 0.25 3.68E+5 1.92E+6 2.28E+6 0.38 4.18E+5 2.43E+6 2.85E+6 0.50 4.54E+5 2.84E+6 3.30E+6 0.75 5.25E+5 3.61E+6 4.12E+6 1.00 5.90E+5 4.29E+6 4.87E+6 2.00 7.89E+5 6.65E+6 7.45E+6 5.00 1.16E+6 1.22E+7 1.13E+7 8.00 1.38E+6 1.62E+7 1.75E+7 24.0 3.72E+6 3.00E+7 3.22E+7 60.0 2.86E+6 4.54E+7 4.82E+7 96.0 3.22E+6 5.51E+7 5.84E+7 192. 3.78E+6 7.38E+7 7.74E+7 298. 4.15E+6 8.63E+7 9.07E+7 394. 4.42E+6 9.22E+7 9.66E+7 560. 4.67E+6 9.88E+7 1.03E+8 720. 4.81 E+6 1.02E+8 1.07E+8 888. 4.89E+6 1.05E+8 1.09E+8 1060 4.93E+6 1.06E+8 1.10E+8 1220 4.96E+6 1.07E+8 1.12E+8 1390 4.98E+6 1.08E+8 1.13E+8 1560 4.98E+6 1.09E+8 1.15E+8 1730 4.98E+6 1.12E+8 1.16E+8 1900 4.98E+6 1.12E+8 1.17E+8 2060 4.98E+6 1.13E+8 1.18E+8 2230 4.99E+6 1.14E+8 1.19E+8 2950 4.99E+6 1.19E+8 1.24E+8 3670 4.99E+6 1.24E+8 1.29E+8 4390 4.99E+6 1.29E+8 1.35E+8 5110 4.99E+6 1.35E+8 1.39E+8 5830 4.99E+6 1.39E+8 1.45E+8 6550 4.99E+6 1.43E+8 1.49E+8 7270 4.99E+6 1.49E+8 1.54E+8 210 of 215 IPEC00035819 IPEC00035819

IP3 FSAR UPDATE 8000 4.99E+6 1.53E+8 1.59E+8 8710 4.99E+6 1.59E+8 1.64E+8 Total 1.64E+8 211 of 215 IPEC00035820 IPEC00035820

IP3 FSAR UPDATE Table 6F-2

SUMMARY

TABLE OF ESTIMATES FOR TOTAL AIRBORNE GAMMA DOSE CONTRIBUTORS IN CONTAINMENT TO A POINT IN THE CONTAINMENT CENTER INDIAN POINT UNIT NUMBER 3 Time Airborne Iodine Airborne Noble Plateout Iodine Total Dose (Hr) Dose (R) Gas Dose (R) Dose (R) (R) 0.00 0.03 3.55E+4 4.92E+4 1.24E+3 9.10E+4 0.06 6.3E+4 1.02E+5 2.93E+3 1.69E+5 0.09 8.03E+4 1.46E+5 5.32E+3 2.31 E+5 0.12 9.22E+4 1.84E+5 8.11E+3 2.85E+5 0.15 1.02E+5 2.21E+5 1.12E+ 3.34E+5 0.18 1.08E+5 2.56E+5 1.45E+4 3.79E+5 0.21 1.14E+5 2.88E+5 1.27E+4 4.21 E+5 0.25 1.20E+5 3.31E+5 2.24E+4 4.73E+5 0.38 1.37E+5 4.56E+5 3.72E+4 6.32E+5 0.50 1.49E+5 5.61E+5 5.09E+4 7.60E+5 0.75 1.74E+5 7.60E+5 7.82E+4 1.01 E+6 1.00 1.96E+5 8.28E+5 1.03E+5 1.23E+6 2.00 2.66E+5 1.50E+6 1.92E+5 1.96E+6 5.00 4.06E+5 2.62E+6 3.98E+5 3.43E+6 8.00 4.89E+5 3.22E+6 5.51E+5 4.26E+6 24.0 7.44E+5 4.62E+6 1.07E+6 6.43E+6 60.0 9.66E+5 5.27E+6 1.55E+6 7.82E+6 96.0 1.07E+6 5.57E+6 1.76E+6 8.41 E+6 192. 1.24E+6 6.12E+6 2.10E+6 9.44E+6 298. 1.36E+6 6.46E+6 2.35E+6 1.01E+7 394. 1.43E+6 6.50E+6 2.51E+6 1.04E+7 560. 1.52E+6 6.67E+6 2.68E+6 1.09E+7 720. 1.57E+6 6.74E+6 2.77E+6 1.11 E+7 888. 1.59E+6 6.77E+6 2.82E+6 1.12E+7 1060 1.60E+6 6.77E+6 2.85E+6 1.13E+7 1220 1.61E+6 6.78E+6 2.86E+6 1.13E+7 1390 1.62E+6 6.79E+6 2.87E+6 1.13E+7 1560 1.62E+6 6.80E+6 2.88E+6 1.13E+7 1730 1.62E+6 6.80E+6 2.88E+6 1.13E+7 1900 1.62E+6 6.80E+6 2.89E+6 1.13E+7 2060 1.62E+6 6.80E+6 2.89E+6 1.13E+7 2230 1.62E+6 6.80E+6 2.89E+6 1.13E+7 2950 1.62E+6 6.81 E+6 2.89E+6 1.14E+7 3670 1.62E+6 6.82E+6 2.89E+6 1.14E+7 4390 1.62E+6 6.82E+6 2.89E+6 1.14E+7 5110 1.62E+6 6.82E+6 2.89E+6 1.14E+7 5830 1.62E+6 6.82E+6 2.89E+6 1.14E+7 6550 1.62E+6 6.82E+6 2.89E+6 1.14E+7 7270 1.62E+6 6.82E+6 2.89E+6 1.14E+7 212 of 215 IPEC00035821 IPEC00035821

IP3 FSAR UPDATE 8000 1.62E+6 6.82E+6 2.89E+6 1.14E+7 8710 1.62E+6 6.82E+6 2.89E+6 1.14E+7 Total 1.14E+ 7 Table 6F-3 Deleted 07/88 213 of 215 IPEC00035822 IPEC00035822

IP3 FSAR UPDATE Table 6F-4 1.40 SO FT. DOUBLE ENDED RUPTURE Time (sec) Pressure (psi d) Temperature (deg F) 1 0.105 186 2 0.119 224 3 0.073 233 4 0.099 227 5 0.090 218 6 0.062 213 7 0.095 215 8 0.074 220 9 0.077 227 10 0.112 236 11 0.084 242 12 0.072 245 13 0.066 247 14 0.094 249 15 0.089 249 16 0.044 247 17 0.051 247 18 0.081 247 19 0.046 245 20 0.076 245 21 0.073 243 22 0.069 242 23 0.036 240 24 0.034 238 25 0.032 236 26 0.030 234 27 0.029 233 28 0.061 233 29 0.060 231 30 0.026 229 40 0.091 204 50 0.091 211 60 0.083 212 70 0.089 210 80 0.089 210 90 0.081 210 100 0.086 206 110 0.066 184 120 -0.000 161 180 0.002 141 240 -0.012 139 300 0.000 140 360 0.004 139 420 -0.008 140 480 -0.003 140 214 of 215 IPEC00035823 IPEC00035823

IP3 FSAR UPDATE 540 0.000 142 600 -0.008 140 215 of 215 IPEC00035824 IPEC00035824

IP3 FSAR UPDATE CHAPTER 7 INSTRUMENTATION AND CONTROL 7.1 GENERAL DESIGN CRITERIA Complete supervision of both the nuclear and turbine-generator sections of the plant is accomplished by the instrumentation and control systems from the control room. The instrumentation and control systems are designed to permit periodic on-line test to demonstrate the operability of the reactor protection system.

Criteria applying in common to all instrumentation and Control Systems are given in Section 7.1.1. Thereafter, criteria which are specific to one of the instrumentation and control systems are discussed in the appropriate portion of the description of that system, as referenced in Section 7.1.2.

The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NRC) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980, and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

7.1.1 Instrumentation and Control Systems Criteria Instrumentation and Control Systems Criterion: Instrumentation and controls shall be provided as required to monitor and maintain within prescribed operating ranges essential reactor facility operating variables.

(GDC 12 of 7/11/67)

Instrumentation and controls essential to avoid undue risk to the health and safety of the public are provided to monitor and maintain neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges.

The non-nuclear regulating process and containment instrumentation measures temperatures, pressure, flow, and levels in the Reactor Coolant System, Steam Systems, Containment and other Auxiliary Systems.

Process variables required on a continuous basis for the startup, power operation, and shutdown of the plant are controlled form and indicated or recorded at the control room, access to which is supervised. The quantity and types of process instrumentation provided ensure safe and orderly operation of all systems and processes over the full operating range of the plant.

7. 1.2 Related Criteria 1 of 108 IPEC00035825 IPEC00035825

IP3 FSAR UPDATE The following are criteria which are related to all instrumentation and control systems but are more specific to other plant features or systems, and therefore are discussed in other chapters, as listed.

Title of Criterion (7/11/67 issue) Reference Suppression of Power Oscillations (GDC 7) Chapter 3 Reactor Core Design (GDC 6) Chapter 3 Quality Standards (GDC 1) Chapter 4 Performance Standards (GDC 2) Chapter 4 Fire Protection (GDC 3) Chapter 5 and 9 Missile Protection (GDC 40) Chapters 4, 5, and 6 Emergency Power (GDC 39 and GDC 24) Chapter 8 7.2 PROTECTIVE SYSTEMS The protective systems consist of both the Reactor Protection System and the Engineered Safety Features. Equipment supplying signals to any of these protective systems is considered a part of that protective system.

7.2.1 Design Bases The General Design Criteria presented and discussed in this section are those which were in effect at the time when Indian Point 3 was designed and constructed. These general design criteria, which formed the bases for the Indian Point 3 design, were published by the Atomic Energy Commission in the Federal Register of July 11, 1967, and subsequently, made a part of 10 CFR 50.

The Authority has completed a study of compliance with 10 CFR Parts 20 and 50 in accordance with some of the provisions of the Commission's Confirmatory Order of February 11, 1980. The detailed results of the evaluation of compliance of Indian Point 3 with the General Design Criteria presently established by the Nuclear Regulatory Commission (NCR) in 10 CFR 50 Appendix A, were submitted to NRC on August 11, 1980 and approved by the Commission on January 19, 1982. These results are presented in Section 1.3.

Control Room Criterion: The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit continuous occupancy of the control room under any credible post-accident condition or as an alternative, access to other areas of the facility as necessary to shut down and maintain safe control of the facility without excessive radiation exposure of personnel. (GDC 11 of 7/11167) 2 of 108 IPEC00035826 IPEC00035826

IP3 FSAR UPDATE Indian Point 3 is equipped with a Control Room which contains those controls and instrumentation necessary for operation of the reactor and turbine generator under normal and accident conditions.

The Control Room is provided with emergency lighting; color coding, labeling and demarcation of reactor coolant control and display panels; switch protection; and other aids as required to ensure proper operation of the reactor, turbine generator and auxiliaries under all operating and accident conditions.

The Control Room is continuously occupied by qualified operating personnel under all operating and Maximum Credible Accident (MCA) conditions. The Post Accident Monitoring instrumentation available to the operator for monitoring plant conditions is provided in Table 7.5-

1. The instrumentation complies with Regulatory Guide 1.97 requirements, as documented in NRC Letter, J.D. Neighbors to R. Beedle, dated 4/3/91, entitled "Emergency Response Capability - Conformance To RG 1.97 Revision 3, for Indian Point 3" (TAC No. 51099).

The instrumentation originally available to the operator for monitoring conditions in the Reactor, Reactor Coolant System and the Containment Building are provided in Historical Tables 7.2-4 and 7.2-5.

Historical Table 7.2-4 lists indication (meters, recorders, etc.) available for providing information following moderate and infrequent faults as originally analyzed in Chapter 14. Similarly, Historical Table 7.2-5 relates to limiting faults such as a LOCA as originally analyzed in Chapter 14.

The design criteria used in the selection of the original readouts were:

1) The range of readouts extend over the maximum expected range of the variable being measured as a result of faults originally analyzed in Chapter 14.

2) The combined indicated accuracies are within the errors originally assumed in the safety analysis.

Sufficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subjected to doses under postulated accident conditions during occupancy of, ingress to and egress from the Control Room which, in the aggregate, would exceed that limits in 10 CFR 100. The control room ventilation consists of a system having a large percentage of recirculated air. The fresh air intake can be closed automatically or by manual backup to stop the intake of airborne activity if monitors indicate that such action is appropriate.

Core Protection Systems Criterion: Core protection systems, together with associated equipment, shall be designed to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits. (GDC 14 of 7/11/67)

The basic reactor tripping philosophy is to define a region of power and coolant temperature conditions allowed by the primary tripping functions, the overpower b.T trip, the overtemperature b.T trip and the nuclear overpower trip. The allowable operating region within these trip settings 3 of 108 IPEC00035827 IPEC00035827

IP3 FSAR UPDATE is provided to prevent any combination of power, temperatures and pressure which would result in DNB with all reactor coolant pumps in operation. Additional tripping functions such as a high pressurizer pressure trip, low pressurizer pressure trip, high pressurizer water level trip, loss of flow trip, steam and feed-water flow mismatch trip, steam generator low-low water level trip, turbine trip, safety injection trip, nuclear source and intermediate range trips, and manual trip are provided as backup tot he primary tripping functions for specific accident conditions and mechanical failures.

A dropped rod signal blocks automatic rod withdrawal and also provides a turbine load cutback if above a given power level. The dropped rod is indicated from individual rod position indicators or by a rapid flux decrease on any of the power range nuclear channels.

Over power t..T, overtemperature t..T, and Tavg deviation rod stops prevent abnormal power conditions which could result from excessive control rod withdrawal initiated by a malfunction of the Reactor Control System or by operator violation of administrative procedures.

Engineered Safety Features Protection Systems Criterion: Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features (GDC 15 of 7/11/67).

Instrumentation and controls provided for the protective systems are designed to trip the reactor in order to prevent or limit fission product release from the core, and to limit energy release, to signal containment isolation, and to control the operation of engineered safety features equipment.

The Engineered Safety Features are actuated by the engineered safety features actuation channels. Each coincidence network energizes an engineered safety features actuation device, which operates the associated engineered safety features equipment, motor starters and valve operators. The channels are designed to combine redundant sensors, independent channel circuitry, coincident trip logic and different parameter measurements so that a safe and reliable system is provided in which a single failure will not defeat the protective function. The action initiating sensors, bistables and logic is shown in the figures which are included in the detailed engineered safety features instrumentation description given in the design section for each system. The engineered safety features instrumentation system actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isolation System, the Containment Air Recirculation System, and the Containment Spray System.

The passive accumulators of the Safety Injection System do not require signal or power sources to perform their function. The actuation of the active portion of the Safety Injection System is described later in this section.

The containment air recirculation coolers are normally in use during plant operation. These units are, however, in the automatic sequence, which actuates the engineered safety features upon receiving the necessary actuating signals indicating an accident condition. The fan cooler bypass valves open on a safety injection signal to provide maximum service water flow.

Containment spray is actuated by coincident and redundant high containment pressure signals (high-high level).

4 of 108 IPEC00035828 IPEC00035828

IP3 FSAR UPDATE The Containment Isolation System provides the means of isolating the various pipes passing through the containment walls as required to prevent the release of radioactivity to the outside environment in the event of a Loss-of-Coolant Accident.

Protection Systems Reliability Criterion: Protection systems shall be designed for high functional reliability and in-service testability necessary to avoid undue risk to the health and safety of the public. (GDC 10 of 7/11/67)

The reactor uses the high speed version of the Westinghouse magnetic-type control rod drive mechanisms. Upon a loss of power to the coils, the Rod Cluster Control (RCG) assemblies with full length absorber rods are released and fall by gravity into the core.

The reactor internals, fuel assemblies and drive system components were designed as seismic Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube. Furthermore, the RCC assemblies are never fully withdrawn from their guide thimbles in the fuel assembly. For this reason, and because of the flexibility designed into the RCC assemblies, abnormal loadings and misalignments can be sustained without impairing operation of the RCC assemblies.

The Rod Cluster Control assembly guide system is locked together with pins throughout its length to ensure against misalignments which might impair control rod movement under normal operating conditions and credible accident conditions. An analogous system has successfully undergone 4132 hours0.0478 days <br />1.148 hours <br />0.00683 weeks <br />0.00157 months <br /> of testing in the Westinghouse Reactor Evaluation Center during which about 27,200 feet of step-driven travel and 1461 trips were accomplished with test misalignments in excess of the maximum possible misalignment experienced when installed in the plant.

All primary reactor trip protection channels required during power operation are supplied with sufficient redundancy to provide the capability for channel calibration and test at power.

Removal of one trip circuit is accomplished by placing that circuit in a tripped mode i.e., a two-out-of-three circuit becomes a one-out-of-two circuit. A Channel bistable may also be placed in a bypassed mode, i.e., a two-out-of-three circuit becomes a two-out-of-two circuit. Testing in a bypassed mode does not trip the system even if a trip condition exists in a concurrent channel.

Reliability and independence are obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical source. Failure to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event.

Protection Systems Redundancy and Independence Criterion: Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure on removal from service of any component or channel of such a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection function to be served. (GDC 20 of 7/11/67) 5 of 108 IPEC00035829 IPEC00035829

IP3 FSAR UPDATE The Reactor Protection Systems were designed so that the most probable modes of failure (loss of voltage, relay failure) in each protection channel result in a signal calling for the protective trip. Each protection system design combines redundant sensors and channel independence with coincident trip philosophy so that a safe and reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant trip, or violate reactor protection criteria.

The design basis for the Reactor Protection System and Engineered Safety Features equipment radiation exposure was that the equipment must function after the exposure associated with the TID-14844 model accident. The maximum anticipated exposure for components located within the Containment was calculated to be 1.6 x 108 rads, which is accumulated during one year following the accident. (Note that the integrated exposure for safeguards equipment during 40 years of operation was calculated to be less than 5 x 105 rads.) In the determination of exposure, no credit was taken for containment cleanup or other removal mechanism other than isotope decay. The expected integrated exposure on the outside of the Containment Building, again assuming TID-14844 releases and no credit for cleanup, will be less than 102 rads integrated over a year at the containment outside surface.

Protection system instrument cables are divided into four channels. Channeling separation is continuous from instrument sensor to receiver. Bistable or digital type outputs 120 volts AC or 125 volts DC to protection system logic relays are divided into the same four channels.

Power and control cables for engineered safeguards are divided into three basic channel systems. Power and control cabling for reactor trip and containment isolation valves are divided into two channels.

In addition to channels of separation, cables were assigned to individual routing systems in accordance with their voltage level, size, and function. Six independent conduit and tray systems are employed on Indian Point 3 as follows:

1) 6900 volt power

2) Heavy 125 volts DC power cables and heavy 480 volts AC (over 100 hp) power cables

3) Lighting panel feeders and medium power (greater than No 12 AWG wire size) 480 volts AC cables

4) Control and light (non-heavy) power cables

5) Instrument cables

6) Rod control cables Conduit fill for all systems is based on standard national Electric Code Recommendations.

Criteria for tray fill are given in Section 8.2 Cables in the conduit and cable schedule are identified by a circuit code, in addition to their routing, to assure that the cable will be installed in the proper tray systems, as well as the proper channel.

6 of 108 IPEC00035830 IPEC00035830

IP3 FSAR UPDATE Separation of channels was established throughout the plant by the use of separate trays or conduits (exceptions are documented and justified in Reference 1). In addition, whenever a heavy power tray was located less than three feet beneath any tray of a different channel, a transit fire barrier was installed between the trays. A vertical barrier was installed where trays of different channels were installed less than one foot apart, horizontally. Vertically barriers and fire wraps were installed to separate cables and equipment and associated non-safety circuits of redundant trains to protect against radiant energy from a 10 CFR 50, Appendix R assumed fire.

Additionally, a horizontal barrier was installed where trays (other than heavy power) were installed less than one foot beneath any tray of a different channel.

In the area of the electrical tunnel between the Control Building and Containment Building and containment penetration area, two tunnels provide the separation for the four channels. A cross section of this portion of the tunnel is shown in the Plant Drawing 9321-F-31193 [Formerly Figure 7.2-18].

In general, control board switches with their associated indicating lights are contained in a modularized structure which provides physical separation between power "trains." Where more than one train is required to connect to a single switch, the wiring is routed to different quadrants within the module itself. Separate connectors for each redundant circuit are used, and board wiring is channelized to separate terminal blocks contained in individual channelized vertical risers located above separated floor slots. The wiring "trains" within the board are divided into three separate groups. Train "X" is that wiring which is associated with buses fed from diesel generator No. 32, Train "Y" is that wiring which is associated with buses fed from diesel generator No. 33 and Train "z" is that wiring which is associated with buses fed from diesel generator No. 31. These "trains" are physically separated from each other by horizontal raceways which route the wiring to its appropriate vertical riser.

The wiring of local control panels which contain cabling from different channels have been separated by interior metal barriers or were separated into more than one panel. The main three phase power circuits are protected by means of three-pole breakers. Individual small power feeds from the motor control centers have three phase protection by means of fuses and "heater" overload devices. Single phase circuits are protected by single pole devices including fuses and/or breakers. (See Section 8.2)

Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions are fully isolated, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel. This approach is used for pressurizer pressure and water level channels, steam generator water level, Tav9 and b.T channels, steam flow-feedwater flow and nuclear instrumentation channels.

The analog type equipment associated with the Reactor Protection and Engineered Safety Features Systems is considered to be the most susceptible to temperature effects because of the accuracies involved. Excessive temperature for long periods in areas containing switchgear, cables, etc. would result in a slight degradation of life but would not affect performance. The Control Room is the limiting case for reactor shutdown with regard to electrical equipment. The protective equipment in the control and relay rooms was designed to 0

operate in an environment up to 120 F without loss of function.

7 of 108 IPEC00035831 IPEC00035831

IP3 FSAR UPDATE Temperature in the Control Room and adjoining equipment room is maintained for personnel comfort at 70 +/- 10°F. Protective equipment in this space was designed to operate within a design tolerance over this temperature range. Design specifications for this equipment specified no loss of protective function up to 120°F. Exceptions to this are evaluated in NSE 95-3-032, Revision 1 (See FSAR Section 9.9.2). Thus, there is a wide margin between design limits and the normal operating environment for control room equipment.

The engineered safety features equipment is actuated by one or the other of the engineered safety features actuation channels. Each coincidence network actuates an engineered safety actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. As an example, the control circuit of a safety injection pump is typical of the control circuit for a large pump operated from switchgear. The actuation relay, energized by the Engineered Safety Features Instrumentation System, has normally open contracts. These contacts energize the circuit breaker closing coil to start the pump when the control relay is energized. The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isolation System, Containment Air Recirculation System and Containment Spray System.

In the Reactor Protection System, two reactor trip breakers are provided to interrupt power to the full length rod drive mechanisms. The breaker main contacts are connected in series (with power supply) so that opening either reactor trip breaker interrupts power to all full length rod mechanisms, permitting them to fall by gravity into the core.

In the event of a loss of reactor trip breaker control power, the reactor trip breaker under voltage coils and associated relays are de-energized and the breakers trip to an open mode. An electrical interlock prevents both bypass breakers from being closed concurrently.

Further detail on redundancy is provided through the detailed descriptions of the respective systems covered by the various sections in this chapter. In summary, reactor protection was designed to meet all presently defined reactor protection criteria and is in accordance with the IEEE-279-1971, "Standard for Nuclear Plant Protection Systems."

Required continuous electrical supply is discussed in Chapter 8.

Demonstration of Functional Operability of Protection Systems Criterion: Means shall be included for suitable testing of the active components of protection systems while the reactor is in operation to determine if failure or loss of redundancy has occurred. (GDC 25 of 7/11/67)

The analog equipment of each protection channel in service at power is capable of being tested and tripped independently by simulated analog input signals to verify its operation. The trip logic circuitry includes means to test each logic channel through to the trip breakers. Thus, the operability of each trip channel can be determined conveniently and without ambiguity.

Testing of the diesel-generator starting may be performed from the diesel generator control board. The generator breaker is not closed automatically after starting during this testing. The generator may be manually synchronized to the 480 Volt bus for loading. Complete testing of the starting of diesel generators can be accomplished by tripping the associated 480 Volt undervoltage relays and providing a coincident simulated safeguards signal. The ability of the 8 of 108 IPEC00035832 IPEC00035832

IP3 FSAR UPDATE units to start within the prescribed time and to carry load can be periodically checked. (The Electrical Systems are discussed in more detail in Section 8.2.3.)

The reactor coolant pump breakers open trip is not testable at power; it is a backup trip which is testable only during shutdown. Testing at power (opening the breakers) would involve a loss of flow in the associated loop.

Protection Against Multiple Disability for Protection Systems Criterion: The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function or shall be tolerable on some basis. (GDC 23 of 7/11/67)

The components of the protection system were designed and laid out so that the mechanical and thermal environment accompanying any emergency situation in which the components are required to function does not interfere with that function.

Separation of redundant analog protection channels originates at the process sensors and continues back through the field wiring and containment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring is achieved using separate wire ways, cable trays, conduit runs and containment penetrations for each redundant channel. Redundant analog equipment is separated by locating redundant components in different protection racks.

Each redundant channel is energized from a different vital instrument bus.

Protection System Failure Analysis Design Criterion: The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electrical power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.

(GDC 26 of 7/11/67)

Each reactor trip circuit was designed so that trip occurs when the circuit is de-energized; therefore, loss of channel power causes the system to go into its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary sensors and each channel is energized from an independent electrical bus. Failure to de-energize when required is a mode of malfunction that affects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event.

Reactor trip is implemented by interrupting power to the magnetic latch mechanisms on all drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power.

The engineered safety features actuation circuits were designed on the "energize to operate" principle unlike the reactor trip circuits.

The steam line isolation signal on high-high containment pressure, which uses the same circuitry as the containment spray actuation signal, was also designed on the "energize to operate" principle. There are a total of six high-high containment pressure instruments which 9 of 108 IPEC00035833 IPEC00035833

IP3 FSAR UPDATE are separated into three channels. The three high-high containment pressure instrument channels are powered from three separate independent sources (one channel from instrument Bus No. 31 powered from Battery No. 31, the second channel from instrument Bus No. 33 powered from Battery No. 33, and the third channel from instrument Bus No. 34 powered from Instrument Bus No. 34 powered from Battery No. 34 with alternate supply from safeguards Motor Control Center No. 36B).

This assures operation of a sufficient number of containment pressure instruments in the event of a power failure to one of the instrument channels.

In the event that power to any instrument bus is lost, there is no single failure that could occur to prevent any protective action. Reactor trip initiation signals are de-energized to actuate. The containment spray initiation signals, of which only two of three are required, are powered from three separate power sources (i.e., Instrument Buses No. 31, No. 33, and No. 34).

If power would ever be lost to any instrument bus, channel trip annunciators, etc. associated with the protective functions powered from this bus would alarm. This would mean to the operator that this one complete protective channel is in the trip mode. The event would be indicative of the loss of power for this particular channel of protective devices.

The above design is consistent with all of the instrument buses regardless of their source of power, as the loss of anyone instrument bus, for any reason, would give channel trip alarms and indications for the respective channel of protection devices. These alarms would be a true indication because on loss of instrument power the associated protective channel is indeed in the trip mode. This complies with the requirements of Section 4.20 of IEEE-279. (See Section 8.2)

Each emergency diesel-generator is started by undervoltage on its associated 480 Volt bus or by the safety injection signal independent of the other 480 Volt buses and diesel generators.

Engine cranking is accomplished by a stored energy system supplied solely for the associated diesel generators. The undervoltage relay scheme was designed so that loss of 480 Volt power does not prevent the relay scheme from functioning properly.

Redundancy of Reactivity Control Criterion: Two independent control systems, preferably of different principles, shall be n provided. (GDC 27 of 7/11/67)

One of the two Reactivity Control Systems employs rod cluster control assemblies to regulate the position of Ag-In-Cd neutron absorbers within the reactor core. The other Reactivity Control System employs the Chemical and Volume Control System to regulate the concentration of boric acid solution (neutron absorber) in the Reactor Coolant System.

A detailed description of the Reactivity Control System for Indian Point 3, sufficient to demonstrate redundancy and capability as established under the provisions of this criterion, is presented in Section 3.1.

Reactivity Control Systems Malfunction Criterion: The reactor protection system shall be capable of protecting against any single malfunction of the reactivity control system, such as unplanned continuous 10 of 108 IPEC00035834 IPEC00035834

IP3 FSAR UPDATE withdrawal (not ejection or dropout) of a control rod, by limiting reactivity transients to avoid exceeding acceptable fuel damage limits. (GDC 31 of 7/11/67)

Reactor shutdown with rods is completely independent of the normal control functions since the trip breakers completely interrupt the power to the full length rod mechanisms regardless of existing control signals. Effects of continuous withdrawal of a rod control assembly and of deboration are described in Sections 7.3.1,7.3.2,9.2 and 14.1.

Principles of Design Redundancy and Independence The protective systems are redundant and independent for all vital inputs and functions. Each channel is functionally independent of other redundant channels and is supplied from an independent power source. Isolation of redundant protection channels is described in further detail elsewhere in this section and in Section 7.2.2.

Manual Actuation Means are provided for manual initiation of protective system action. Failures in the automatic system do not prevent the manual actuation of protective functions. Manual actuation requires the operation of a minimum of equipment.

Channel Bypass or Removal from Operation The system was designed to permit anyone channel to be maintained and when required, tested or calibrated during power operation without system trip. During such operation the active parts of the system continue to meet the single failure criterion. Since the channel under test is either tripped or superimposed, test signals are used which do not negate the process signal.

It should be noted that the "one-out-of-two" logic systems are permitted to violate the single failure criterion during channel bypass, provided that acceptable reliability of operation can be otherwise demonstrated and bypass time interval is short.

Capability for Test and Calibration The bistable portions of the protective system (e.g., relays, bistables, etc.) provide trip signals only after signals from analog portions of the system reach preset values.

Capability is provided for calibrating and testing the performance of the bistable portion of protective channels and various combinations of the logic networks during reactor operation.

The analog portion of a protective channel provides analog signals proportional to a reactor or plant parameter. The following means are provided to permit checking the analog portion of a protective channel during reactor operation:

a} Varying the monitored variable b} Introducing and varying a substitute transmitter signal 11 of 108 IPEC00035835 IPEC00035835

IP3 FSAR UPDATE c) Cross checking between identical channels or between channels which bear a known relationship to each other and which have readouts available.

The design permits the administrative control of the means for manually by-passing channels or protective functions.

The design permits the administrative control of access to all trip settings, module calibration adjustments, test points, and signal injection points.

Information Readout and Indication of Bypass The protective systems were designed to provide the operator with accurate, complete, and timely information pertinent to their own status and to plant safety.

Indication is provided in the Control Room if some part of the system has been administratively bypassed or taken out of service.

Trips are indicated and identified down to the channel level.

Vital Protective Functions and Functional Requirements The Reactor Protective System monitors parameters related to safe operation and trips the reactor to protect the reactor core against fuel rod cladding damage caused by departure from nucleate boiling (DNB) and to protect against Reactor Coolant System damage caused by high system pressure. The engineered safety features instrumentation system monitors parameters to detect failure of the Reactor Coolant System and initiates containment isolation and engineered safety features operation to contain radioactive fission products.

This section covers those protective systems provided to:

a) Trip the reactor to prevent or limit fission product release from the core and to limit energy release.

b) Isolate containment and activate the Isolation Valve Seal Water System when necessary.

c) Control the operation of engineered safety features provided to mitigate the effects of accidents.

The core protective systems in conjunction with inherent plant characteristics were designed to prevent anticipated abnormal conditions from causing fuel damage exceeding limits established in Chapter 3 or Reactor Coolant System damage exceeding effects established in Chapter 4.

Completion of Protective Action Where operating requirements necessitate automatic or manual bypass of a protective function, the design is such that the bypass is removed automatically whenever permissive conditions are not met. Devices used to achieve automatic removal of the bypass of a protective function are part of the protective system and were designed in accordance with the criteria of this section.

12 of 108 IPEC00035836 IPEC00035836

IP3 FSAR UPDATE The protective systems were designed so that once initiated, a protective action goes to completion. Return to normal operation requires administrative action by the operator.

Multiple Trip Settings Where it is necessary to change to a more restrictive trip setting to provide adequate protection for a particular mode of operation or set of operating conditions, the design provides positive means of assuring that the more restrictive trip setting is used. The devices used to prevent improper use of less restrictive trip settings are considered a part of the protective system and were designed in accordance with the other provisions of these criteria.

Interlocks and Administrative Procedures Interlocks and administrative procedures required to limit the consequences of fault conditions other than those specified as limits for the protective function comply with the protective function comply with the protective system criteria.

Protective Actions The Reactor Protective System automatically trips the reactor to protect the reactor core under the following conditions:

a) The reactor power, as measured by neutron flux, reaches a pre-set limit.

b) The temperature rise across the core, as determined from loop LlT, reaches a limit either from an overpower LlT set point or an overtemperature LlT set point (function of Tavg and pressurizer pressure, adjusted by neutron flux distribution). Overtemperature LlT set point is adjusted by neutron flux distribution.

c) The pressurizer pressure reaches an established minimum limit.

d) Loss of reactor coolant flow as sensed by low flow, loss of pump power or pump breakers opening.

e) Pressurizer pressure or level trips the reactor to protect the primary coolant boundary when the pressurizer pressure or level reaches an established maximum limit.

Interlocking functions derived from the Reactor Protective System inhibit control rod withdrawal on the occurrence of a specified parameter reaching a value lower than the value at which reactor trip is initiated.

For anticipated abnormal conditions, protective systems in conjunction with inherent plant characteristics and engineered safety features are designed to ensure that limits for energy release to the Containment and for radiation exposure (as in 10 CFR 100) are not exceeded.

Seismic Design Criteria For either the operational or design basis earthquake, the equipment was designed to assure that it does not lose its capability to perform its function, i.e., shut the plant down and maintain it 13 of 108 IPEC00035837 IPEC00035837

IP3 FSAR UPDATE in a safe shutdown condition. For the design basis earthquake, permanent deformation of the equipment is acceptable provided that the capability to perform its function is maintained.

7.2.2 System Design Reactor Protective System Description Figure 7.2-2 is a block diagram of the Reactor Protective System; Figure 7.2-3 illustrates the core thermal limits and shows the trip points that are used for the protection system. The solid lines are a locus of limiting design conditions representing the core thermal limits at five pressures. The core thermal limits are based on the conditions which yield the applicable limit value for departure from nucleate boiling ratio (DNBR) or those conditions which preclude bulk boiling at the vessel exit. The dashed lines indicate the maximum permissible trip points for the overtemperature high LH reactor trip including allowances for measurement and instrumentation errors.

The maximum and minimum pressures shown (2470 psia and 1750 psia) represent the set points for the high pressure and low pressure reactor trips.

Adequate margins exist between the worst steady state operating point (including all temperature, calorimetric, and pressure errors) and required trip pOints to preclude a spurious plant trip during design transients.

Indication All transmitted signals (flow, pressure, temperature, etc.) which can cause a reactor trip are either indicated or recorded for every channel.

Engineered Safety Features Instrumentation Description Plant Drawings IP3V-0171-0070, IP3V-0171-0056, 5651D72 Sheets 10, 12, and 12A [Formerly Figures 7.2-4, 7.2-5 and 7.2-6] show the action initiating sensors, bistables and logic for the engineered safety features instrumentation.

The engineered safety features actuation system automatically performs the following vital functions:

1) Start operation of the Safety Injection System upon low pressurizer pressure signal or high containment pressure signals (approximately 10% of containment design pressure),

or on coincidence of high differential pressure between any two steam generators, 2 sets of 2/3 high-high pressure [energize to actuate], or after time delay (maximum 6 seconds) in coincidence with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines.

2) Operate the containment isolation valves in non-essential process lines upon detection of high containment pressure signals (Phase A containment isolation). The Isolation Valve Seal Water System is actuated upon automatic actuation of the Safety Injection System.

14 of 108 IPEC00035838 IPEC00035838

IP3 FSAR UPDATE

3) Start the Containment Spray System and operate the remaining containment isolation valves upon detection of a containment pressure signal higher than required in item (2) above (Phase B containment isolation; approximately 24 psig).

4) Start operation of the safeguards equipment actuation sequence signal. This includes actuating signals to such components as the Safety Injection System and the Containment Air Recirculation, Cooling and Filtration System.

Steam Line Isolation Any of the following signals will close all steam line isolation valves:

1) After time delay (maximum 6 seconds) in coincidence with high steam flow in 2/4 lines in coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines.

2) High containment pressure signals (two sets of 2/3 high-high pressure) [energize to actuate].

3) Steam line isolation valves can also be closed one at a time by manual action.

Feedwater Line Isolation Any safety injection signal will isolate the main feedwater lines by closing all control valves (including associated MOVs) and the pump discharge valves. The closure of the pump discharge valves will cause the main feedwater pumps to trip.

ATWS Mitigating System Actuation Circuitry (AMSAC) Description The ATWS Mitigating System Actuation Circuitry (AMSAC) is installed at IP3 in accordance with the requirements of 10 CFR 50.62 "Reduction of Risk From Anticipated Transients Without Scram (A TWS) Events for Light-Water-Cooled Nuclear Power Plants." An ATWS is an anticipated operational occurrence (such as loss of feedwater, loss of condenser vacuum, or loss of offsite power) that is accompanied by a failure of the Reactor Protection System (RPS) to shut down the reactor. The ATWS Rule requires specific improvements in the design and operation of commercial nuclear power facilities to reduce the probability of failure to shut down the reactor following anticipated transients and to mitigate the consequences of an ATWS event.

AMSAC provides an alternate means of tripping the turbine and actuating auxiliary feedwater (AFW) flow apart from the reactor protection system (RPS). The AMSAC equipment is reasonably diverse from the existing RPS equipment to minimize the potential for common cause failures. Also, AMSAC logic power supplies and logic circuitry are independent from the RPS power supplies and logic circuitry. The turbine trip and AFW flow actuation will provide adequate assurance that the reactor coolant system (RCS) would not be subject to potential damage as a result of overpressure. The pressure limit (3200 psi g) corresponds to the ASME boiler and Pressure Vessel Code Level C Service Limit stress criteria. Past ATWS analyses, see WCAP-8330 for example, show there are only two A TWS transients for which the ASME Service level limit may be approached. These transients are the Complete Loss of Normal Feedwater Without Scram and the Loss of Load Without Scram.

15 of 108 IPEC00035839 IPEC00035839

IP3 FSAR UPDATE The Complete Loss of Normal Feedwater transient can occur due to the simultaneous tripping of the main feedwater or condensate pumps or the simultaneous closing of the main feedwater control valves or main feedwater pump discharge valves.

The Loss of Load transient considered for ATWS is one in which the vacuum in the main condenser is lost, resulting in a complete loss of normal feedwater. This could occur, for example, if the circulating water pumps trip. The main turbine will then trip on high backpressure as will any turbine-driven main feedwater pump that exhausts into the main condenser.

Since, in both of the above described transients (and in only these transients) the main feedwater is completely lost, the AMSAC is designed to actuate the auxiliary feedwater flow when the complete loss of main feedwater flow is anticipated.

Short-term protection against high reactor coolant system pressures is not required until 70% of nominal power. However, in order to minimize the amount of reactor coolant system voiding during an A TWS, AMSAC operates at and above 40% of turbine power. Furthermore, the potential exists for spurious AMSAC actuations during start-up at the lower power levels. To assure the above requirements are met, AMSAC is automatically blocked at turbine loads less than 40% by the C-20 permissive. In the event of a turbine trip, both turbine power transmitter indications will drop below 40% of full scale turbine power level. A timer in the AMSAC circuitry will maintain the trip permissive (C-20) for 330 seconds to ensure that the AMSAC system is still armed. However, in the event of an ATWS below 40% of nominal load, operator action will be required to provide long-term core protection by initiating auxiliary feedwater flow.

Actuation of AMSAC will occur on low main feedwater flow as measured by the low feedwater flow transmitters. The setpoint to actuate AMSAC is approximately 21 % of nominal main feedwater flow. Although 21 % flow is more than ample to protect against overpressure in the event of an ATWS, instrumentation error would become unacceptably large if a substantially lower set point were used.

An AMSAC output is initiated after a predetermined time delay whenever turbine power is 40%

or greater coincident with three of the four feedwater flow transmitters indicating feedwater flow of 21 % or less. The time delay is determined by the highest Turbine Power Level sensed at the time the % low feedwater flow is sensed. 60 second lag units maintain Turbine Power Level close to the pre-turbine trip condition, for determination of the variable time delay. The time delay varies from a maximum of 300 seconds at 40% power to 25 seconds at 100% power (in accordance with the WOG curves). The purpose of this time delay is twofold. First, this time delay allows the reactor protection system to respond initially to a low feedwater flow condition.

Secondly, during this time delay, the operator is provided with an AMSAC alert annunciator in the CR. If during the AMSAC alert period the operator increases feedwater flow above 21 %,

AMSAC will not actuate and the timer will reset. However, once an AMSAC signal is initiated, the signal will be maintained for at least 40 seconds to ensure all required actions occur.

Turbine trip, turbine power auxiliary feedwater valve actuation and steam generator isolation and sample valve closure functions are immediately actuated by AMSAC. The motor driven auxiliary feedwater pumps have a 28 second time delay built into their starting circuits. As such, the motor driven auxiliary feedwater pumps will start 28 seconds after an AMSAC signal is initiated. This time delay is in accordance with 10 CFR 50.62 (the AMSAC Rule) which requires that the AMSAC AFW initiation function is performed within 90 seconds following initiation of an AMSAC signal. The AMSAC output signal is energized to actuate, so that a loss of power to the AMSAC cabinet will not initiate an AMSAC trip.

16 of 108 IPEC00035840 IPEC00035840

IP3 FSAR UPDATE The AMSAC Logic Diagram is shown in Plant Drawing 9321-LL-38077 [Formerly Figure 7.2-19].

Reactor Protective System Safety Features Separation of Redundant Protection Channels The Reactor Protection System was designed on a channelized basis to achieve separation between redundant protection channels. The channelized design, as applied to the analog as well as the logic portions of the protection system, is illustrated by Figure 7.2-1 and is discussed below. Although shown for four channel redundancy, the design is applicable to two and three channel redundancy.

Separation of redundant analog channels originates at the process sensors and continues through the field wiring and containment penetrations to the analog protection racks.

Physical separation was used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring was achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Analog equipment was separated by locating redundant components in different protection racks. Each redundant protection set is energized from a separate AC power feed.

The reactor trip bistables are mounted in the protection racks and are the final operational component in an analog protection channel. Each bistable drives two logic relays CC" & "D").

The contacts from the "C" relays are interconnected to form the required actuation logic for Trip Breaker No. 1 through DC power feed No.1. The transition from channel identity to logic identity is made at the logic relay coil/relay contact interface. As such, there is both electrical and physical separation between the analog and the logic portions of the protection system.

The above logic network is duplicated for Trip Breaker No.2 using DC power feed No.2 and the contacts from the "D" relays. Therefore, the two redundant reactor trip logic channels will be physically separated and electrically isolated from one another. Overall, the protection system is comprised of identifiable channels which are physically, electrically and functionally separated and isolated from one another.

Physical Separation The physical arrangement of all elements associated with the protective system reduces the probability of a single physical event impairing the vital functions of the system.

System equipment is distributed between instrument cabinets so as to reduce the probability of damage to the total systems by some single event.

Wiring between vital elements of the system outside of equipment housing was routed and protected so as to maintain the true redundancy of the systems with respect to physical hazards. The same channel isolation and separation criteria as described for the reactor protection circuits were applied to the engineered safety features actuation circuits.

Loss Power 17 of 108 IPEC00035841 IPEC00035841

IP3 FSAR UPDATE A loss of power in the Reactor Protective System causes the affected channel to trip. All bistables operate in a normally energized state and go to a de-energized state to initiate action.

Loss of power, thus, automatically forces the bistables into the tripped state.

Availability of power to the engineered safety features instrumentation is continuously indicated.

The loss of instrument power to the sensors in the engineered safety feature instrumentation starts the engineered safety features equipment associated with the affected channels, except for containment spray which requires instrument power for actuation. Steam line isolation on high-high containment pressure, which utilizes the same actuation circuitry as the containment spray actuation, also requires power to actuate. There are a total of six high-high containment pressure instruments which are separated into three instrument channels. The three high-high containment pressure instrument channels are powered form three separate, independent sources to assure operation in the event of a power failure to one of the instrument channels.

Engineered Safety Features Systems Testing At least once per 24 months, the master relays will be operated with test input to actuate the safeguards sequences. The test will be terminated upon verification that the associated valves are properly aligned and associated pumps are started by the automatic actuation circuits. No flow is introduced into the Reactor Coolant System; verification of pump startup is by breaker position indication and visual inspection of local flow meters in the mini-flow lines, where applicable. The tests will be performed in accordance with the Technical Specification.

Process Analog Protection Channel Testing The basic arrangement of elements comprising a representative analog protection channel is shown in Figure 7.2-7. These elements include a sensor or transmitter, power supply, bistable, bistable trip switch and proving lamp, test-operate switch, test annunciator, test signal injection jack, and test pOints. A portion of the logic system is also included to illustrate the overlap between the typical analog channel and the corresponding logic circuits. The analog system symbols are given in Figure 7.2-14.

Each protection rack include a test panel containing those switches, test jacks and related equipment needed to test the channels contained in the rack. An interlocked hinged cover encloses the test panel. Opening the cover or placing the test-operate switch in the "TEST" position automatically initiates an alarm. These alarms are arranged in rack "sets" to annunciate entry to more than one rack or redundant protection "sets" or channels at any time.

The test panel cover is designed such that it cannot be closed (and the alarm cleared) unless the test signal plugs (described below) are removed. Closing the test panel cover mechanically returns the test switches to the "OPERATE" position.

Test procedures allow the bistable output relays of the channel under test to be placed in the tripped mode prior to proceeding with the analog channel tests. Thus, for the channel under test, the relay elements in the two-out-of-three or the two-out-of-four coincident matrices will be in the tripped mode during the entire test of the channel. This ensures that the remaining channels of the two-out-of-three or the two-out-of-four protective functions meet the single failure criterion during the entire channel test. Placing the bistable trip switch in the tripped mode de-energizes (trips) the bistable output relays and connects a proving lamp to the bistable output circuit. This permits the electrical operation of the solid-state bistable to be observed and the bistable set point relative to the channel analog signal to be verified. Test procedures also allow the bistable output relays of the channel under test to be placed in the bypassed mode 18 of 108 IPEC00035842 IPEC00035842

IP3 FSAR UPDATE prior to proceeding with the analog channel test; i.e., a two-out-of-three circuit becomes a two-out-of-two circuit. Testing in bypass mode is depicted in Figures 7.2-20, 7.2-21, and 7.2-22.

This may only be done for circuits whose hardware does not require the use of jumpers or lifted leads to be placed in the bypass mode. Upon completion of test of the analog channel, the bistable trip switches must be manually reset to their operate mode. Closing the cover of the test panel will not transfer the bistable trip switches from their tripped to their operate position.

The following circuits are equipped with trip bypass capability:

REACTOR TRIP AUTO SAFETY INJECTION ACTUATION Overpower Delta T Hi Containment Pressure Over Temperature Delta T Steam Line Delta P Lo Steam Generator Level Hi Steam Flow SI Lo-Lo Steam Generator Level Lo Steam Line Pressure Steam Flow> Feedwater Flow Mismatch Lo Tavg Pressurizer Hi Pressure Lo Pressurizer Pressure Pressurizer Lo Pressure Pressurizer Hi Level TURBINE TRIP Lo Reactor Coolant Flow Steam Generator Hi-Hi Level Stop Rod Withdrawal Analog channel tests are accomplished by simulating a process measurement signal, varying the simulated signal over the signal span and checking the correlation of bistable set points, channel readouts and other loop elements with precision portable read-out equipment. Test jacks are provided in the test panel for injection of the simulated process signal into each process analog protection channel. Test points are provided in the channel to facilitate an independent means for precision measurement and correlation of the test signal. This procedure does not require any tools nor does it involve in any way the removal or disconnection of wires in the channel under test. In general, the analog channel circuits are arranged so that the channel power supply is loaded and is providing sensing circuit power during channel test. Load capability of the channel power supply is thereby verified by the channel test.

Nuclear Instrumentation Channel Testing Nuclear Instrumentation Channel Systems (NIS) channels are tested by superimposing the test signal on the actual detector signal being received by the channel. The output of the bistable is not placed in a tripped condition prior to testing. A valid trip signal would then be added to the existing test signal, and thereby cause channel trip at a somewhat lower percent of actual reactor power. Protection bistable operation is tested by increasing the test signal (level signal) to the bistable trip level and verifying operation at control board alarms and/or at the NIS racks.

A NIS channel which can cause a reactor trip through one-out-of-two protection logic (source or intermediate range) is provided with a bypass function which prevents the initiation of a reactor trip from that particular channel during the short period that it is undergoing test. The power range channels do not require bypass of the reactor trip function for test purposes since the protection logic is two-out-of-four. The power range dropped rod function is operated from a one-out-of-four protection logic; therefore, a bypass function is provided on each of the power range channels to prevent load cutback during the dropped rod channel test. Over-riding the dropped rod circuitry from causing a spurious turbine runback due to instrument bus noise has 19 of 108 IPEC00035843 IPEC00035843

IP3 FSAR UPDATE no impact on the utilization of the Rod Drop Bypass Switch on each Power Range Nuclear Instrument for nuclear instrument testing.

In all cases the bypass condition and the channel test condition are alarmed on the NIS drawer and at the main control board. An interlock feature between the bypass switch and channel test switch on each channel keeps the test signal from being activated until the bypass function has been inserted. Administrative control is required to ensure that only one protection channel is placed in the bypass condition at anyone time. The power range reactor trips are not affected by the bypass function described above. Therefore these power range trips will be active if required. No provision was made in the channel test circuit for reducing the channel signal level below that signal being received from the NIS detector.

Logic Channel Testing The general design features of the logic system are described below. The trip logic channels for a typical two-out-of-three and a two-out-of-four trip function are shown in Figure 7.2-8. The analog portions of these channels are shown in Figure 7.2-9. Each bistable drives two relays

("A & B" for level and "C" & "0" for pressure). Contacts from the "A" and "C" relays are arranged in a 2/3 and 2/4 trip matrix for Trip Breaker No.1 (RTB). The above configuration is duplicated for Trip Breaker No 2 (RTA) using contacts from the "B" and "0" relays. A series configuration is used for the trip breakers since they are actuated (opened) by undervoltage coils. This approach is consistent with a de-energize-to-trip preferred failure mode. The planned logic system testing includes exercising the reactor trip breakers to demonstrate system integrity.

Bypass breakers are provided for this purpose. During normal operation, these bypass breakers are open. Administrative control is used to minimize the amount of time these breakers are closed. Closure of the breaker is controlled from its respective logic test panel in the Control Room. An interlock is provided that trips both bypass breakers open if a second bypass breaker is closed. The status of the breaker is indicated in the Control Room by indicating lights.

As shown in Figure 7.2-8 the trip signal from the logic network is simultaneously applied to the main trip breaker associated with the specific logic chain as well as the Bypass Breaker associated with the alternate trip breaker. Should a valid trip signal occur while Bypass Breaker No.1 (BYB) is bypassing Trip Breaker No.1 (RTB), Trip Breaker No.2 (RTA) will be opened through its associated logic train. The trip signal applied to Trip Breaker No. 2 (RTA) is simultaneously applied to bypass breaker No. 1 (BYB) thereby opening the bypass around Trip Breaker No.1 (RTB). RTB would either be opened manually as part of the test or would be opened through its associated logic train which would be operational or tripped during a test.

Two auxiliary relays are located in parallel with the undervoltage coils of the trip breaker. The output contacts (normally closed) of these relays are connected in series and initiate actuation of the shunt trip coil of both the reactor trip and the associated bypass breaker upon a reactor trip signal. The above contacts are connected to the respective breaker shunt trip coil circuit through test switches which, during the testing of the undervoltage trip device, block the undervoltage trip signal. The test switches are supervised by control room annunciation. In addition, key operated test switches are provided for each train to allow energization of breaker shunt trip coil independent of the undervoltage trip device. The two sets of test switches in conjunction permits selection of particular reactor or bypass breaker to be tested. During response time testing, the shunt trip relay is tied to a portable recorder which is used to indicate transmission of a trip signal through the logic network. Lights are also provided to indicate the status of the individual logic relays.

20 of 108 IPEC00035844 IPEC00035844

IP3 FSAR UPDATE The following procedure illustrates the method used for testing Trip Breaker No. 1 (RTB) and its associated logic network:

a) Manually set and trip Bypass Breaker No.1 (BYB) to verify operation.

b) Set BYB; trip Trip Breaker No.1 (RTB).

c) Place key operated switch "Train-Auto Defeat" to test position, verify alarm and test lamp illumination.

d) Sequentially de-energize the trip relays 9A1, A2, A3) for each logic combination (1-2, 1-3, 2-3). Verify that the logic network de-energizes the UV coil on Trip Breaker No. 1 (RTB) for each logic combination. Since the neon light monitors the signal applied to the UV coil, operation of the UV coil can be determined from the neon light.

e) Repeat "0" for every logic combination in each matrix.

f) Reset Trip Breaker No.1 (RTB).

g) Trip RTB to validate prior test results as evidenced by the neon light.

h) Reset Trip Breaker No.1 (RTB). Trip BYB.

In order to minimize the possibility of operational errors from either the standpoint of tripping the reactor inadvertently or only partially checking all logic combinations, each logic network includes a logic channel test panel. This panel includes those switches, indicators and recorders needed to perform the logic system test. The front panel arrangement is shown in Figure 7.2-10. The test switches used to de-energize the trip bistable relays operate through interposing relays as shown in Figures 7.2-7 and 7.2-9. This approach avoids violating the separation philosophy used in the analog channel design. Thus, although test switches for redundant channels are conveniently grouped on a single panel to facilitate testing, physical and electrical isolation of redundant protection channels are maintained by the inclusion of the interposing relay which is actuated by the logic test switches.

If the logic test switches in both engineered safeguards logic trains are placed in the test mode simultaneously, the automatic safeguards actuation will be blocked for the two trains. However, a separate alarm on the main control board is provided for each safeguard train to indicate when each train is in test.

The test switches are located in separate safeguards racks and administrative control prevents the simultaneous operation of Train A and Train B test switches.

It should be noted that either one of the safeguards train, which is blocked by its test switch, can always be unblocked and actuated by the manual safety injection switch at the main control board.

Safeguards Initiating Circuitry The safeguards actuation circuitry and hardware layout are designed to maintain circuit isolation through the bistable operated logic relays. The channelized design follow through is shown on the Figure 7.2-15 block diagram.

21 of 108 IPEC00035845 IPEC00035845

IP3 FSAR UPDATE The orderly arrangement of equipment for the Reactor Protection System and Engineered Safety Features Actuation System helps facilitate testing and maintenance. A color code of red, white, blue and yellow is used for analog protection channels in sets I, II, III, and IV, respectively. Large identification plates with the appropriate background color are attached at the front and back surfaces of each analog rack. The protection logic cabinets, housing the Train A logic, master relays, and slave relays, are physically separated from cabinets housing Train B equipment and identified by large identification plates on the input side of the racks where protection signals from the various protection channels are received. Small electrical components have nameplates on the enclosure which houses them. All cables are numbered with identification tags. These numbers are cross-referenced with cable schedule which specifies cable routing and function. The cable trays are color coded with each of the four channels having a different color assigned.

The safeguards bistables, mounted in the analog protection racks, drive both "A" and "B" logic matrix relays. Each matrix contains its own test light and test circuitry. The "A" and "B" logic matrices operate master relays for actuating channels A and B respectively, as shown in Figure 7.2-16.

Control power for logic channels A and B, is supplied from DC distribution panel No. 31 and No.

34, respectively. These redundant actuating channels operate the various safeguards components required with the large loads sequenced as necessary.

Protection channel identity is lost in the intermixing of the relay matrix wiring. Separation of A and B logic channels is maintained by the separate logic racks.

For safety injection, manual reset of the safeguards actuation relays may be accomplished two minutes following their operation. Once reset action is taken, the master relay is reset and its operation blocked, except for manual initiation. The engineered safeguards circuitry can be unblocked by resetting the reactor trip breaker.

Hinged safety covers on the reset pushbuttons in the circuitry of the Safety Injection, Containment Spray, Containment Isolation Phase A and Phase B, and Containment Ventilation Isolation Systems require deliberate action by the operators to actuate these pushbuttons and facilitate placing adequate administrative controls on the actuation of these push buttons. The Containment Ventilation Isolation System cannot be placed in a bypass condition while any of the automatic safety signals is present.

Separate and independent key-lock switches, one for each SI train, are provided in series to each of the auto SI actuation relays to allow manual blocking of the Engineered Safeguards System actuation. (See Section 6.2.2)

Logic Channel Testing Figures 7.2-16 and 7.2-17 show the basic logic test scheme. Test switches are located in associated relay racks rather than in a single test panel. The following procedure is used for testing the logic matrices:

1) Following administrative procedure, test Channel A or B, one at a time 22 of 108 IPEC00035846 IPEC00035846

IP3 FSAR UPDATE

2) Depress the test relay switch to energize the rack test relays. An alarm will sound on the main board and a light at the rack will indicate that the safeguards rack is now in test.

3) Select a matrix and depress the logic test switches. The master relay will energize and matrix test lights will indicate upon actuation of the particular matrix being tested. The slave relay test lights will verify that the master relay contact associated with a particular slave relay has functioned and will also verify the integrity of the slave relay coils.

4) Reset the master relay by depressing the master relay reset switch. Reset the test relays by depressing the test reset switch. A lamp will glow as long as the test relays are energized. If a test relay contact in a particular slave relay circuit does not return to its normal position, then the slave relay test lamps will indicate such. Test lights can be tested by depressing the lens.

Primary Power Source The primary source of control power for the Reactor Protective System is the vital instrument buses described in Chapter 8. The source of power for the measuring elements and the actuation circuits in the engineered safety features instrumentation is also from those buses.

Protective Actions Reactor Trip Description The Reactor Protection System acts to shut the reactor down by means of various reactor trips which are designed to occur when a measured plant variable exceeds predetermined limits.

The protection system consists of all instrumentation which monitors the process variables and initiates trip if the process variables approach safety limits. It includes, but is not limited to, sensing elements, transmitters, converters, relays, actuating devices, interlocks, alarms, signal lines, etc. The trips function to provide rapid reduction of reactivity by the insertion of full-length RCC assemblies under free fall into the reactor core. The full-length RCC assemblies must be energized to remain withdrawn from the core.

Automatic reactor trip occurs upon the loss of power to the full-length control rods. All power to the full-length control rod mechanisms are interlocked by duplicate series connected circuit breakers. The trip breakers are opened by the undervoltage coils on both breakers. The undervoltage coils, which are normally energized, become de-energized by anyone of the several trip signals.

Certain reactor trip channels (lOW reactor coolant flow, etc.) are automatically bypassed at low power where they are not required for safety. Nuclear source range, intermediate range and power range (low setpoint) trips, which are specifically provided for protection at low power or subcritical operation, are bypassed by operator manual action after receiving a permissive signal from the next higher range of instrumentation to allow power escalation during startup.

During power operation, a sufficiently rapid shutdown capability in the form of RCC assemblies is administratively maintained through the control rod insertion limit monitors. Administrative control requires that all shutdown rods be in the fully withdrawn position during power operation.

A resume of reactor trips, including means of actuation and the coincident circuit requirements, is given in Table 7.2.1. The permissive circuits referred to (e.g., P-7) are listed in Table 7.2-2.

23 of 108 IPEC00035847 IPEC0003584 7

IP3 FSAR UPDATE Manual Trip The manual actuating devices are independent of the automatic trip circuitry and are not subject to failures which might make the automatic circuitry inoperable. Either of two manual trip devices located in the Control Room will initiate a reactor trip.

High Nuclear Flux (Power Range) Trip This circuit trips the reactor when two of the four power range channels read above the trip setpoint. There are two independent trip settings, one high and one low setting. The high trip setting provides protection during normal power operation. The low setting, which provides protection during startup, can be manually bypassed when two out of the four power range channels read above approximately 10% power (P-10). Three out of the four channels below 10% automatically reinstates the trip protection. The high setting is always active.

High Nuclear Flux (Intermediate Range )Trip This circuit trips the reactor when one out of the two intermediate range channels reads above the trip setpoint. This trip, which provides protection during reactor startup, can be manually bypassed if two out of four power range channels are above approximately 10% (P-10). Three out of four channels below this value automatically reinstate the trip protection. The intermediate channels (including detectors) are separate from the power range channels.

High Nuclear Flux (Source Range) Trip This circuit trips the reactor when one of the two source range channels reads above the trip setpoint. The trip, which provides protection during reactor startup, can be manually bypassed when one of two intermediate range channels reads above the P-6 setpoint value and is automatically reinstated when both intermediate range channels decrease below this value (P-6). This trip is also bypassed by two out of four high power range signals (P-10). It can also be reinstated below P-10 by an administrative action requiring coincident manual actuation.

The trip point is set between the intermediate range lower limit of instrument sensitivity and the upper limit of the source range instrument range.

Overtemperature l::. T Trip The purpose of this trip is to protect the core against DNB. This circuit trips the reactor on coincidence of two-out-of-the-four signals with one channel (two temperature measurement, hot and cold) per loop. The set point for this reactor trip is continuously calculated for each channel by solving equations of this form:

l::.Ttrip - l::.To [K1 - K2 (Tav9 - T) + K3 (P - PI) - f (l::.I)]

where indicated l::.T at rated power, F 24 of 108 IPEC00035848 IPEC00035848

IP3 FSAR UPDATE Tavg reactor coolant average temperature, two measurements in each loop (Tavg signal is rate compensated), F T' indicated Tavg at nominal condition at rated power, F P pressurizer pressure, four independent measurements, psia P' nominal pressure at rated power, psia set point bias, F constants based on the effect of temperature and pressure on the DNB limits f (LlI) a function of the indicated difference between top and bottom detectors of the power range nuclear ion chambers with gains selected based on measured instrument response during plant startup tests.

Overpower Ll T Trip The purpose of this trip is to protect against excessive power (fuel rod rating protection). This circuit trips the reactor on coincidence of two out of the four signals with one channel (one pair of temperature measurements) per loop.

The set point for this reactor trip is continuously calculated for each channel by solving equations of the form; where indicated LlT at rated power, F Tavg Average temperature, F T' Indicated Tavg at nominal conditions at rated power, F Set point bias Constant Constant Low Pressurizer Pressure Trip The purpose of this circuit is to protect against excessive core steam voids which could lead to DNB. The circuit trips the reactor on coincidence of two out of the four low pressurizer pressure signals. This trip is blocked when any three of the four power range channels and two of two turbine first stage (inlet) pressure channels read below approximately 10% power (P-7).

25 of 108 IPEC00035849 IPEC00035849

IP3 FSAR UPDATE High Pressurizer Pressure Trip The purpose of this circuit is to limit the range of required protection from the overtemperature

~T trip and to protect against Reactor Coolant System over-pressure. This circuit trips the reactor on coincidence of two out of the three high pressurizer pressure signals.

High Pressurizer Water Level Trip This trip is provided as a backup to the high pressurizer pressure trip. The coincidence of two out of the three high pressurizer water level signals trips the reactor. The trip is bypassed when any three of the four power range channels and two of the two turbine first stage (inlet) pressure channels read below approximately 10% power (P-7).

Low Reactor Coolant Flow Trip The trip protects the core form DNB following a loss of coolant flow accident. The means of actuating the loss of coolant flow accident trip are:

a) Measured low flow in the reactor coolant loop. The low flow trip signal is actuated by the coincidence of 2/3 signals of any reactor coolant loop. The loss of flow in any two loops causes a reactor trip above approximately 10% power (P-7). Above the P-8 setpoint any one loop causes a reactor trip. The sensor used for flow measurement is an elbow tap and is discussed in Chapter 4.

b) Reactor coolant pump circuit breaker open functions similarly to the low flow signal with one sensor per reactor coolant pump breaker.

c) Underfrequency on any two of the four reactor coolant pump buses will trip all four reactor coolant pumps and cause a reactor trip above approximately 10% power (P-7).

d) Undervoltage on any two of the four reactor coolant pump buses causes a direct reactor trip above approximately 10% power (P-7).

Safety Injection System (SIS) Actuation Trip A reactor trip occurs when the Safety Injection System is actuated. The means of actuating the SIS trips are:

1) Low pressurizer pressure (two out of three). This signal may be manually blocked or unblocked during start-up and shutdown. This block is accomplished by separate switches for each of the redundant safety injection initiation circuits. The block will be automatically removed above a designated setpoint.

2) High containment pressure (two out of three) set at approximately 10% of containment design pressure.

3) High differential pressure between any two steam lines (two out of three).

4) After time delay: high steam flow in 2/4 lines (one out of two per line), in coincidence with either low Tavg in 2/4 lines or low steam line pressure in 2/4 lines.

26 of 108 IPEC00035850 IPEC00035850

IP3 FSAR UPDATE

5) High-high containment pressure (two sets of two-out-of-three), set at approximately 50%

of containment design pressure [energize to actuate].

6) Manual.

Turbine Generator Trip A turbine trip is sensed by two out of three signals from auto-stop oil pressure. A turbine trip is accompanied by a direct reactor trip above P-8 and a controlled short term release of steam to the condenser occurs which removes sensible heat from the Reactor Coolant System while avoiding steam generator safety valve actuation. Any reactor trip will generate a turbine trip.

Further details are discussed in Chapter 10.

Steam/Feedwater Flow Mismatch Trip This trip protects the reactor from a sudden loss of heat sink. The trip is actuated by one steam/feedwater flow mismatch in selected coincidence with one low steam generator water level in that steam generator. There are two steam/feedwater flow mismatches and two low steam generator water level signals per loop.

Low-Low Steam Generator Water Level Trip The purpose of this trip is to protect the steam generators for the case of a sustained steam/feedwater flow mismatch. The trip is actuated on two out of the three low-low water level signals in any steam generator. A diagram of the steam generator level control and protection system is shown in Plant Drawing IP3V-0171-0355 [Formerly Figure 7.2-13].

Rod Stops A list of rod stops is listed in Table 7.2-3. Some of these have been previously noted under permissive circuits, but are listed again for completeness.

Rod Drop Protection Two independent systems are provided to sense a dropped rod: a rod bottom position detection system and a system which senses sudden reduction in out-of-core neutron flux. Both protection systems initiate protective action in the form of blocking automatic rod withdrawal, and also, a turbine load cutback if above a given power level. This action compensates for accessible adverse core power distributions and permits an orderly retrieval of the dropped RCC.

The primary protection for the dropped RCC accident is the rod bottom signal derived for each rod from its individual position indication system. With the position indication system, initiation of protection is independent of rod location of reactivity worth.

Backup protection is provided by use of the out-of-core power range nuclear detectors and is particularly effective for large nuclear flux reductions occurring in the region of the core adjacent to the detectors.

The rod drop detection circuit from nuclear flux consists basically of a comparison of each ion chamber signal with the same signal taken through a first order lag network. Since a dropped 27 of 108 IPEC00035851 IPEC00035851

IP3 FSAR UPDATE RCC assembly will rapidly depress the local neutron flux, the decrease in flux will be detected by one or more of these four sensors. Such a sudden decrease in ion chamber current will be seen as a difference signal. A negative signal output greater than a preset value (approximately 10%) from any of the four power range channels will actuate the rod drop protection.

Figure 7.4-2 indicates schematically the dropped rod detection circuits and the Nuclear Protection System in general. The potential consequences of any dropped RCC without protective action are presented in Section 14.1.4.

Alarms Any of the following conditions actuate an alarm:

a) Reactor trip (first-out annunciator) b) Trip of any reactor trip channel c) Significant deviation of any major control variable (pressure, Tavg, pressurizer water level, and steam generator water level) d) Actuation of any permissive circuit or override. (Certain permissive are provided with indication light only on the flight panel.)

Control Group Rod Insertion Limits The control rod insertion limit system is used in an administrative control procedure with the objective to maintain an RCCA shutdown margin.

The control group rod insertion limits, ZLL, are calculated as a linear function of reactor power and reactor coolant average temperature. The equation is:

ZLL - A (11 T)avg + B (Tavg) + C where A and B are preset manually adjustable gains and C is a preset manually adjustable bias.

These set pOints may be different for each control bank. The (I1T) avg and (Tavg) are the average of the individual temperature differences and the coolant average temperatures, respectively, measured from the reactor coolant hot leg and cold leg.

One insertion limit monitor with two alarm set pOints is provided for each control bank. A description of control and shutdown rod groups is provided in Section 7.3. The low alarm alerts the operator of an approach to a reduced shutdown reactivity situation requiring boron addition by following normal procedures with the Chemical and Volume Control System (Chapter 9).

Actuation of low-low alarm requires the operator to take immediate action to add boron to the system by anyone of several alternate methods.

7.2.3 System Evaluation Reactor Protection System and DNB The following is a description of how the reactor protection system prevents DNB.

28 of 108 IPEC00035852 IPEC00035852

IP3 FSAR UPDATE The plant variables affecting the DNB ratio are:

Thermal power Coolant flow Coolant temperature Coolant pressure Distribution Core power (hot channel factors)

Figure 7.2-11 illustrates the core limits for which DNBR for the hottest rod is at the design limit and shows the overpower and overtemperature LH reactor trips locus as a function of Tavg and pressure.

Excessive axial offset reduces the overtemperature LlT setpoint associated with both the block on control rod withdrawal and the reactor trip actuation. If the LlT of any RCS loop exceeds the calculated overpower or overtemperature LlT setpoints, permissive signals will be generated which will initiate a block on control rod withdrawal. The setpoint on these LlT rod blocks are approximately 2° F less than the corresponding LlT setpoints used to actuate reactor tip. This provides a margin or buffer prior to achieving operating conditions requiring a reactor trip on overpower or overtemperature. Rod block on LlT circuitry is not redundant, whereas the LlT reactor trips are protective grade and meet the standards of IEEE-279.

Reactor trips for a fixed high pressurizer pressure and for a fixed low pressurizer pressure are provided to limit the pressure range over which core protection depends on the variable overpower and overtemperature LlT trips.

Reactor trips on nuclear overpower and low reactor coolant flow are provided for direct, immediate protection against rapid changes in these variables. However, for all cases in which the calculated DNBR approaches the applicable DNBR limit, a reactor trip on overpower and/or overtemperature LlT would be actuated.

The LlT trip functions are based on the differences between measurements of the hot leg and cold leg temperatures, which are proportional to core power.

The overtemperature LlT trip function is provided with a nuclear flux feedback to reflect a measure of axial power distribution. This will assist in preventing an adverse distribution which could lead to exceeding allowable core conditions.

Overpower Protection In addition to the high power range nuclear flux trips, an overpower LlT trip is provided (2 out of 4 logic) to limit the maximum overpower.

A rod stop function and turbine runback function is provided in the form:

LlT rod stop = Ll T trip - Bp Bp = set point bias (F)

The logic for the runback is one out of four.

29 of 108 IPEC00035853 IPEC00035853

IP3 FSAR UPDATE Overtemperature Protection A second LlT trip (2 out of 4 logic) provides an overtemperature trip which is a function of coolant average temperature and pressurizer pressure derived as previously discussed.

A similar rod stop function is provided in the form; fjT rod stop =LlTtrip - BT BT =set point bias, F The logic for the rod stop is one out of four.

In summary, in the event the difference between top and bottom detectors exceeds the desired range, automatic feedback signals are provided to reduce the overtemperature trip setpoint and to block rod withdrawal to maintain appropriate operating margins to the trip setpoint.

Interaction of Control and Protection The design basis for the control and protection systems permits the use of a detector for both protection and control functions. Where this is done, all equipment common to both the protection and control circuits are classified as part of the protection system. Isolation amplifiers prevent a control system failure from affecting the protection system. In addition, where failure of a protection system component can cause a process excursion which requires protective action the protection system can withstand another independent failure without loss of function.

Generally, this is accomplished with two-out-of-four trip logic. Also, wherever practical, provisions are included in the protection system to prevent a plant outrage because of single failure of a sensor.

Specific Control and Protection Interactions Nuclear Flux Four power range nuclear flux channels are provided for nuclear overpower protection. Isolated outputs from all four channels are averaged for automatic control rod regulation of power. If any channel fails in such a way as to produce a low output, that channel is incapable of proper nuclear overpower protection. In principle, the same failure would cause rod withdrawal and overpower. Two-out-of-four nuclear overpower trip logic will ensure a nuclear overpower trip if needed even with an independent failure in another channel.

In addition, the control system will respond only to rapid changes in indicated nuclear flux; slow changes or drifts are overridden by the temperature control signals. Also, a rapid decrease of any nuclear flux signal will block automatic rod withdrawal as part of the rod drop protection circuitry.

Finally, an overpower signal from any nuclear channel will block automatic rod withdrawal. The set point for this rod stop is below the reactor trip set point.

Coolant Temperature 30 of 108 IPEC00035854 IPEC00035854

IP3 FSAR UPDATE Four TavQ channels are used for overtemperature-overpower protection. (See Plant Drawings IP3V-0171-0052, -0053, -0054, and -0055 [Formerly Figure 7.2-12] for single channel). Isolated output signals from all four channels are also averaged for automatic control rod regulation. In principle, a spuriously low temperature signal from one sensor could cause rod withdrawal and overtemperature. Two-out-of-four overtemperature and overpower LlT logic will ensure a trip is needed even with an independent failure in another channel. In addition, channel deviation alarms in the control system will block automatic rod withdrawal if any temperature channel deviates significantly from the others. Automatic rod withdrawal blocks will also occur if anyone of four nuclear channels indicates an overpower condition or if anyone of the four temperature channels indicates an overtemperature condition. Finally, as shown in Section 14.1, the combination of trips on nuclear overpower, high pressurizer water level, and high pressurizer pressure also serve to limit an excursion for any rate of reactivity insertion.

Narrow range RCS hot leg temperature is measured for each channel through the use of three RTDs located 120 apart. The three RTD signals are averaged by a microsprocessor to 0

produce the hot leg signal for the channel. The microprocessor has the capability to detect a failure of any of the hot leg RTDs.

Pressurizer Pressure Four pressure channels are used for high and low pressure protection and for overpower-overtemperature protection. Three of these are also used for high pressure protection. Isolated output signals from these channels are also used for pressure control. These are discussed separately below:

1) Pressure Control. Spray, power-operated relief valves, and heaters are controlled by isolated output signals from the pressure protection channels:

a) Low Pressure A spurious high pressure signal from one channel can cause low pressure by actuation of a pressurizer spray valve. Spray reduces pressure at a low rate, and some time is available for operator action (about three minutes at maximum spray rate) before a low pressure trip is reached. Additional redundancy is provided by the protection system to ensure underpressure protection, i.e., two-out-of-four low pressure reactor trip logic and two-out-of-three safety injection logic.

Each pressurizer relief valve is interlocked to prevent opening on a single high pressure signal. Furthermore, the valve setpoint is at a higher pressure than the normal high pressure signal actuation pressure.

b) High Pressure The pressurizer heaters are incapable of overpressurizing the Reactor Coolant System.

Maximum steam generation rate with heaters is about 15,000 Ibs/hr, compared with a total capacity of 1,260,000 Ibs/hr for the three safety valves and total capacity of 358,000 Ibs/hr of the two power-operated relief valves. Therefore, overpressure protection is not required for a pressure control failure. Two-out-of-three high pressure trip logic is therefore used.

31 of 108 IPEC00035855 IPEC00035855

IP3 FSAR UPDATE In addition, either of the two relief valves can easily maintain pressure below the high pressure trip point. The two relief valves are controlled by independent pressure channels, one of which is independent of the pressure channel used for heater control.

Finally, the rate of pressure rise achievable with heaters is slow, and ample time and pressure alarms are available for operator action.

An Overpressure Protection System prevents the reactor vessel pressure from exceeding the Technical Specification limits, as described in Section 4.3.4.

c) Pressurizer Level The presssurizer level channels are used for high level reactor trip two out of three.

Isolated output signals from these channels are used for volume control, increasing or decreasing water level. A level control failure could fill or empty the pressurizer at a slow rate (on the order of half an hour or more).

2) High Level A reactor trip on pressurizer high water level is provided to prevent rapid thermal expansions of reactor coolant fluid from filling the pressurizer; the rapid change from high rates of steam relief to water relief can be damaging to the safety valves and relief piping and pressure relief tank. However, a level control failure cannot actuate the safety valves because the high pressure reactor trip is set below the safety valve set pressures. Therefore, a control failure does not require protection system action. In addition, ample time and alarms are available for operator action.

3) Low Level For control failures which tend to empty the pressurizer, a low level signal from either of two independent level control channels will isolate letdown, thus preventing the loss of coolant.

Ample time and alarms exist for operator action.

A low pressurizer level will result for all Loss-of-Coolant Accidents except for a special class of breaks in the range of 2 to 6 inches which occur in the vapor space of the pressurizer. For this special class which does not result in low pressurizer water level, the reactor will be tripped on either low pressure or DT overtemperature as the pressure drops, and DNB will be prevented.

Following reactor trip, there will be no core damage as long as the core remains covered.

Sufficient time is available in accidents of this type for the operator to take manual control of makeup to assure core cooling during subsequent cold shutdown procedures.

Sufficient redundancy is provided to accommodate the loss of one level channel without jeopardizing functional capability of the reactor protection system. In the Technical Specifications, limits are set on the minimum number of operable channels and required plant status for all reactor protection instrumentation.

Steam Generator Water Level; Feedwater Flow Before describing control and protection interaction for these channels, it is beneficial to review the protection system basis for this instrumentation.

32 of 108 IPEC00035856 IPEC00035856

IP3 FSAR UPDATE The basic function of the reactor protection circuits associated with low steam generator water level and low feed water flow is to preserve the steam generator heat sink for removal of long term residual heat. Should a complete loss of feedwater occur with no protective action, the steam generators would boil dry and cause an overtemperature-overpressure excursion in the reactor coolant. Reactor trips on temperature, pressure, and pressurizer water level will trip the plant before there is any damage to the core or reactor coolant system. However, residual heat generated after the reactor trip would cause a pressure spike in the pressurizer that lifts the pressurizer relief valves and causes discharge of liquid reactor coolant to the Containment.

Redundant auxiliary feedwater pumps are provided to prevent this. Reactor trips act before the steam generators are dry to reduce the required capacity and starting time requirements of these pumps and to minimize the thermal transient on the reactor coolant system and steam generators. Independent trip circuits are provided for each steam generator for the following reasons:

1) Should severe mechanical damage occur to the feedwater line to one steam generator, it is difficult to ensure the functional integrity of level and flow instrumentation for that unit. For instance, a major pipe break between the feedwater flow element and the steam generator would cause high flow through the flow element. The rapid depressurization of the steam generator would drastically affect the relation between downcomer water level and steam generator water inventory.

2) It is desirable to minimize thermal transient on a steam generator for credible loss of feed water accidents.

It should be noted that controller malfunctions caused by a protection system failure affect only one steam generator. Also, they do not impair the capability of the main feedwater system under either manual control or automatic Tavg control. Hence, these failures are far from being the worst case with respect to decay heat removal with the steam generators.

a) Feedwater Flow A spurious high signal from the feedwater flow channel being used for control would cause a reduction in feedwater flow and prevent that channel from tripping. A reactor trip on low-low water level, independent of indicated feedwater flow, will ensure a reactor trip if needed.

In addition, the three-element feedwater controller incorporates reset on level, such that with expected gains, a rapid increase in the flow signal would cause only a 12-inch decrease in level before the controller reopened the feedwater valve. A slow increase in the feedwater signal would have no effect at all.

b) Steam Flow A spurious low steam flow signal would have the same effect as a high feedwater signal, discussed above.

c) Level A spurious high water level signal from the protection channel used for control will tend to close the feedwater valve. This level channel is independent of the level and flow channels used for reactor trip on low flow coincident with low level.

33 of 108 IPEC00035857 IPEC00035857

IP3 FSAR UPDATE

1) A rapid increase in the level signal will completely stop feedwater flow and actuate a reactor trip on low feedwater flow coincident with low level.

2) A slow drift in the level signal may not actuate a low feedwater signal. Since the level decrease is slow, the operator has time to respond to low level alarms. Since only one steam generator is affected, automatic protection is not mandatory and reactor trip on two out of three low-low level is acceptable.

7.2.4 Qualification Testing Typical protection system equipment is subjected to type tests under simulated seismic acceleration to demonstrate its ability to perform its functions. Type testing is performed using conservatively large accelerations and applicable frequencies. The peak accelerations and frequencies used are checked against those derived by structural analysis of operational and design basis earthquake loadings. Typical switches and indicators for safety features components have been tested to determine their ability to withstand seismic forces without malfunction which would defeat automatic operation of the required component.

For testing there is no adequate way of knowing what combination of vertical and horizontal input motion produces the worst effects (e.g., stresses, deflections). There is a greater probability that due to the phase relationship of the two simultaneously applied input motions, the resulting combined motion produces less severe effects than when these motions are applied separately. Testing in one direction at a time is considered the best way to obtain positive proof of the equipment's capability. (The independent testing in each of the three directions is also recommended in the IEEE Guide for Seismic Qualifications of Class I Electric Equipment.) Furthermore, the uni-directional testing was performed in a conservative manner, thus providing a margin against any greater effects which may possibly result from the worst combination of simultaneous testing. These conservatisms consist of: (1) an input sine beat motion with 10 cycles per beat, (2) resonant testing at all determined and applicable natural frequencies, (3) further testing at other selected frequencies, and (4) high input acceleration values, particularly for the vertical direction.

Qualification testing was performed on various safety systems such as process instrumentation and nuclear instrumentation. This testing involved demonstrating operation of safety functions at elevated ambient temperatures to 120°F for original control room equipment.

To establish the combined effect upon protection systems of long term operation followed by exposure to accident conditions inside the containment, selected components were subjected to thermal aging followed by irradiation. In addition, components were first irradiated and then subjected to thermal aging. Results of the tests indicate that the components would perform satisfactorily following a Design Basis Accident.

Cables of the type used for Indian Point 3 were tested using the same approach as described above, i.e., irradiation, thermal aging followed by steam exposure and thermal age, and irradiation followed by steam exposure. During exposure to steam, the cables carry nominal voltage and current.

Westinghouse Topical Reports, WCAP-7817(1), WCAP-7817 Supplement 1(2), and WCAP-8234(3) provide the seismic evaluation of safety related equipment. The type tests covered by these reports are applicable to Indian Point 3.

34 of 108 IPEC00035858 IPEC00035858

IP3 FSAR UPDATE References

1) Vogeding, E. L., "Seismic Testing of Electrical and Control Equipment," WCAP-7817, December 1971.

2) Vogeding, E. L., "Seismic Testing of Electrical and Control Equipment (WCID Process Control Equipment)," WCAP-7817 Supplement 1, December 1971.

3) "Seismic Testing and Functional Verification of By-Pass Loop Reactor Coolant RTD's,"

WCAP-8234 (Westinghouse Non-Proprietary Class 3), June 1974.

4) NSE 94-3-124 ED, Rev. 0 "Evaluation of Cable Channelization Deficiencies."

35 of 108 IPEC00035859 IPEC00035859

IP3 FSAR UPDATE Table 7.2-1 LIST OF REACTOR TRIPS & CAUSES OF ACTUATION OF:

ENGINEERED SAFETY FEATURES, CONTAINMENT AND STEAM LINE ISOLATION & AUXILIARY FEEDWATER I COINCIDENCE CIRCUITRY AND INTERLOCKS I COMMENTS REACTOR TRIP

1) Manual Y" no interlocks

2) Overpower nuclear flux 2/4 High and low settings; manual block and automatic reset of low setting by P-1 0, Table 7.2-2

3) Overtemperature T 2/4, no interlocks

4) Overpower T 2/4, no interlocks

5) Low pressurizer pressure 2/4, blocked by P-7

6) High pressurizer pressure (fixed set 2/3, no interlocks points)

7) High pressurizer water level 2/3, blocked by P-7

8) a. Low reactor coolant flow 2/3, per loop, blocked by P-7, P-8

b. Reactor coolant pump breaker 1/1, per loop, blocked by P-7, P-8 Reactor coolant pump breaker is tripped on underfrequency

c. Undervoltage on reactor coolant 2/4, per loop, blocked by P-7 pump bus

d. Underfrequency on reactor coolant 2/4 Underfrequency trips all reactor coolant pump bus pumps

9) Safety injection signal (Actuation) 2/3, low pressurizer pressure (manual block permitted by 2/3 low pressurizer pressure): or 2/3 high containment pressure (high-level): or 2/3 high differential pressure between any two steam lines, or manual Y" or two sets of 2/3 hi-hi containment pressure (high-high pressure) [energize to actuate], or after delay (maximum 6 seconds) with high steam flow in 2/4 lines coincidence with (a) low Tavg in 2/4 lines or (b) low steam line pressure in 2/4 lines

10) Turbine generator 2/3, blocked by P-8 Low auto-stop oil pressures signal

"'U 11) Steamlfeedwater flow mismatch Y, steamlfeedwater flow mismatch in selected m coincidence with low steam generator water level

()

"'U o m o oo o eN o 01 36 of 108 o0) 00 (J)

(J1 CD o (J) o