ML12335A436

Official Exhibit - NYSR0013I-00-BD01 - UFSAR, Rev. 20, Indian Point Unit 3 (Submitted with License Renewal Application) (2007) (IP3 UFSAR, Rev. 20)

ML12335A436
Person / Time
Site:	Indian Point
Issue date:	12/22/2011
From:	State of NY, Office of the Attorney General
To:	Atomic Safety and Licensing Board Panel
SECY RAS
References
RAS 21610, 50-247-LR, 50-286-LR, ASLBP 07-858-03-LR-BD01
Download: ML12335A436 (210)

Text

United States Nuclear Regulatory Commission Official Hearing Exhibit Entergy Nuclear Operations, Inc.

In the Matter of:

(Indian Point Nuclear Generating Units 2 and 3) v....~f\ REGU<..q" ASLBP #: 07-858-03-LR-BD01 NYSR0013I

~~~'

Docket #: 05000247 l 05000286

< 0 Exhibit #: NYSR0013I-00-BD01 Identified: 10/15/2012 Revised: December 22, 2011

~ ~

IJI o

.,

!>'

~

c;- Admitted: 10/15/2012 Withdrawn:

'e-/i-o? ~O~ Rejected: Stricken:

• • • • . Other:

IP3 FSAR UPDATE 12 of 38 IPEC00036281 IPEC00036281

IP3 FSAR UPDATE 13 of 38 IPEC00036282 IPEC00036282

IP3 FSAR UPDATE 14 of 38 IPEC00036283 IPEC00036283

IP3 FSAR UPDATE 15 of 38 IPEC00036284 IPEC00036284

IP3 FSAR UPDATE 13.2.2 16 of 38 IPEC00036285 IPEC00036285

IP3 FSAR UPDATE 13.3.1 17 of 38 IPEC00036286 IPEC00036286

IP3 FSAR UPDATE 13.3.3 18 of 38 IPEC00036287 IPEC00036287

IP3 FSAR UPDATE 19 of 38 IPEC00036288 IPEC00036288

IP3 FSAR UPDATE 13.3.4 20 of 38 IPEC00036289 IPEC00036289

IP3 FSAR UPDATE 13.3.5 21 of 38 IPEC00036290 IPEC00036290

W I-

<<0

-

CX)

<<)

<<)0...

Q:::J 0 0::: N

<<

(f)

N LL IPEC00036291 IPEC00036291

W I-

<<0

-

CX)

<<)

<<)0...

Q:::J 0

<<)

0:::

<<

(f)

N LL IPEC00036292 IPEC00036292

W I-

<<

o C0o...

Q:::J 0:::

-o

'OJ" N

ff5 LL IPEC00036293 IPEC00036293

W I-

<<0

-

CX)

<<)

<<)0...

Q:::J 0 L()

0:::

<<

(f)

N LL IPEC00036294 IPEC00036294

W I-

<<

o C0o...

Q:::J 0:::

-

o

<0 N

ff5 LL IPEC00036295 IPEC00036295

IP3 FSAR UPDATE 13.4.2 27 of 38 IPEC00036296 IPEC00036296

IP3 FSAR UPDATE 28 of 38 IPEC00036297 IPEC00036297

IP3 FSAR UPDATE 29 of 38 IPEC00036298 IPEC00036298

IP3 FSAR UPDATE 30 of 38 IPEC00036299 IPEC00036299

IP3 FSAR UPDATE 31 of 38 IPEC00036300 IPEC00036300

IP3 FSAR UPDATE 32 of 38 IPEC00036301 IPEC00036301

IP3 FSAR UPDATE 33 of 38 IPEC00036302 IPEC00036302

IP3 FSAR UPDATE 34 of 38 IPEC00036303 IPEC00036303

IP3 FSAR UPDATE 35 of 38 IPEC00036304 IPEC00036304

IP3 FSAR UPDATE 36 of 38 IPEC00036305 IPEC00036305

IP3 FSAR UPDATE 37 of 38 IPEC00036306 IPEC00036306

IP3 FSAR UPDATE 38 of 38 IPEC00036307 IPEC00036307

IP3 FSAR UPDATE CHAPTER 14 SAFETY ANALYSIS

14.0 INTRODUCTION

This chapter evaluates the safety aspects of the plant and demonstrates that the plant can be operated safely and that exposures from credible accidents do not exceed the guidelines of 10 CFR 100.

This chapter is divided into three sections, each dealing with a different behavior category:

1. Core and Coolant Boundary Protection Analysis, Section 14.1 The incidents presented in Section 14.1 have no offsite radiation consequences.

2. Standby Safeguards Analysis, Section 14.2 The accidents presented in Section 14.2 are more severe and may cause release of radioactive material to the environment.

3. Rupture of a Reactor Coolant Pipe, Section 14.3 The accident presented in Section 14.3, the rupture of a reactor coolant pipe, is the worst case accident and is the primary basis for the design of engineered safety features. It is shown that even this accident meets by a wide margin the guidelines of 10 CFR 100.

14.0.1 General Assumptions Parameters and assumptions that are common to various accident analysis are described below to avoid repetition in subsequent sections:

Steady State Errors For accident evaluation, the initial conditions are obtained by adding maximum steady state errors to rated values. The following steady state errors are considered.

NSSS Power +/-2% of full power (3230 MWt)

Vessel Average +/-7.5° F for non-RTDP*

Tem perature +/-4.SQF (random) with +2.rF (bias) for RTDP*

Pressurizer +/-60.0 psi for non-RTDP' Pressure +/-52 psi (random) with -3psi (bias) for RTDP'"

Initial values for power, pressurizer pressure, and vessel temperature are selected to minimize the initial W-3 or WRB-1 DNB ratio.

"'NOTE: RTDP is Revised Thermal Design Procedure (Reference 28) 1 of 338 IPEC00036308 IPEC0003630S

IP3 FSAR UPDATE Hot Channel Factors Amendment 175, dated July 1997, revised the Technical Specifications to permit changes to the COLR to increase the Fa limit to less than or equal to 2.42 and F L'.H limit to less than or equal to 1.654 for Vantage 5 fuel and 1.70 for Vantage+ fuel. Thus, FNa (heat flux nuclear hot channel factor) s; 2.50 FN"'H (enthalpy rise nuclear hot channel factor) s; 1.70 for V+ and 15x15 Upgrade NOTE: Original issue of the FSAR has FN q S; 2.71 and FN L'.H s; 1.58 RTDP The incore instrumentation system is employed to verify that actual hot channel factors are, in fact, no higher than those used in the accident analyses.

Control Rod Drop Time A control rod drop time of 2.7 seconds to the dash pot, which includes allowance for seismic effects and additional margin, has been accounted for in the safety analyses. The resulting RCCA displacement as a function of time is shown in Figure 14.1w1. The scram time of 2.7 seconds has been considered for all the nonwLOCA events and has been explicitymodeled'inall the events, including those transients which are sensitive to scram time (Le., fast transients of short duration.)

Reactor Trip A reactor trip signal acts to open the two series trip breakers feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanism to release the control rods, which then fall by gravity into the core. There are various instrumentation delays associated with each tripping function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. The time delay assumed for each tripping function is as follows:

Tripping Time Delay Limiting Trip Point Function Seconds Assumed for Analysis Overpower(nuclear),High Setting 0.5 118%

Overpower(nuclear) Low Setting 0.5 35%

Overtemperature L1 T 2.0 See Figure 7.2w11 Overpower L1 T 2.0 See Figure 7.2w11 High pressurizer pressure 2.0 2470 psia Low pressurizer pressure 2.0 1750 psia 2 of 338 IPEC00036309 IPEC00036309

IP3 FSAR UPDATE High pressurizer water level 1.5 100% of pressurizer level span' Low reactor coolant flow 1.0 87% loop flow (from loop flow detectors)

Undervoltage trip 1.5 Not applicable**

Turbine trip 4.0 85% of SG narrow range level span Low-low steam generator 2.0 0% of narrow range level level span Under frequency 0.6 55 Hz***

The difference between the limiting trip pointer assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and set point error. During preliminary startup tests, it was demonstrated that actual instrument errors are equal to or less than above assumed values.

NOTE: *Reactor trip function not explicitly credited in non-LOCA safety analyses.

• • Function credited in non-LOCA safety analyses, however, no explicit setpoint assumed

• • • A frequency decay rate of 5 Hz/sec is assumed Calorimetric Instrumentation Accuracy The calorimetric error is the error assumed in the determination of core thermal power as obtained from the secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet temperature to the steam generator and steam pressure.

Reference 38 provides an equivalent uncertainty in rated power of 0.5% if the Leading Edge Flow Meter (LEFM) instrumentation is used.

Reference 38 also provides an equivalent uncertainty in rated power of 1.3% if the feedwater venturis are employed.

RCS Voiding During Transients The voids generated in the reactor coolant system during anticipated transients are accounted for in the Westinghouse analysis models. Furthermore, based on transient analyses performed by Westinghouse using these models, it is concluded that steam voiding will not result in unacceptable consequences during anticipated transients. See Reference 4.

Reactor Coolant Pump Trip The Safety Evaluation Report approved the Westinghouse Owners Group (WOG) methodology for justifying manual RCP trip in lieu of automatic trip. The three alternative trip criteria employed by WOG are consistent with the original RCP trip guidelines. Reactor Coolant Subcooling has been selected at Indian Point Unit 3, as the alternate criteria for determining when to trip the 3 of 338 IPEC00036310 IPEC00036310

IP3 FSAR UPDATE Reactor Coolant Pumps. The IP3 plant-specific information regarding the Reactor Coolant Pump trip was reviewed by the USNRC (Reference 8). Subsequently the safety evaluation report was issued by the USNRC (Reference 9) which determined that NYPA had satisfactorily addressed all of the points as identified in Generic Letter No. 85-12.

Replacement Steam Generators I Steam Generator Tube Plugging (SGTP)

The original Westinghouse Model 44 steam generators were replaced in their entirety with physically and functionally similar Model 44F units during the cycle 6/7 refueling outage.

Although design improvements incorporated in the replacement steam generators preclude or limit degradation of the tubes, the replacement steam generators match the design performance of the original steam generators, resulting in very little change to the original operating parameters. The replacement steam generators have been modeled in the postulated accidents and transients with a steam generator tube plugging level range of 0% to 10%

(uniform).

The calculation method utilized to meet DNB design basis is the Revised Thermal Design Procedure {RTDP}, discussed in Reference 28. Uncertainties in plant operating parameters, peaking factors, and the DNB correlation are statistically treated such that there is at least 895 percent probability at a 95 percent confidence level that the minimum DNBR will be greater than the applicable limits. These are given in Table 14.1-0. Since the parameter uncertainties are considered in determining the design DNBR value, nominal input parameters without uncertainties and their magnitude are described in further detail in Section 4.0 of Reference 27.

Revised OTfl.T Reactor Trip Setpoints As a result of implementing the Stretch Power Uprate, the core thermal safety limits are revised and result in a change to the OTfl.T and OPfl.T reactor protection trip setpoints. The revised core thermal safety limits are shown in Technical Specification Figure 2.1-1 and are based on the 15x15 Upgrade fuel design with a maximum full powerF AH of 1.635 (with uncertainties).

The Safety Analysis Values for the OTfl.T and OPfl.T reactor protection trip setpoints determined by Transient Analysis are as follows:

OTfl.T:

K1 =1.42 (Safety Analysis Value)

K2 =0.022 K3 =0.00070 For OTfl.T, the f(fl.I) function is as stated in Technical Specifications section 3.3.1 For K1 , a smaller, more conservative value is utilized by the Tech Spec.

OPfl.T:

4 of 338 IPEC00036311 IPEC00036311

IP3 FSAR UPDATE K4 = 1.164 (Safety Analysis Value)

Ks = 0.0175 for Tavg increasing I 0.0 for Tavg decreasing Ka =0.0015 for T>T'/ 0.0 for T ~ T' (T=Tavg , T' = 572°F)

For~, a smaller more conservative value is utilized by Tech Spec.

The nominal values of Tavg aodpressure used in OTLH and OP6.T calculations are 572°F and 2250 psia, respectively.

The OT6.T and OP6.T instrumentation include values for full power 6.T andT-average for each loop as reference points. Separate values for full power6.T and T-average for each loop are determined during cycle initial power ascension testing and incorporated into the calibration procedures. Prior to instrument calibration at full power, best estimates for 6.T and T-average are used in the setpoint determination. Margin exists in the design basis analyses to compensate for inherent error in the instrumentation during initial startup and for changes in core flux distribution during the operating cycle.

The Safety Analysis Values of the 't' constants used in the OTilT and OPilT equations are:

Time constant (first order lag) for measurement of Tav$! 8.5 seconds Time constant (first order lag) for measurement of il T 8.5 seconds Lead for OTilT trip setpoint 25.0 seconds Lag OTilT trip setpoint 3.0 seconds Rate time constant forOPilT setpoints 10.0 seconds Lead on ilT measurement 0.0 seconds Lag on 6.T measurement 0.0 seconds With respect to RCS pressure, the OTil T and OP.llT trip functions provided in this section are only applicable to a range of pressurizer pressure from 1850 psia to 2470 psia. Hence, the Low and High Pressurizer Pressure Reactor Trip setpoints are set to assure this pressurizer pressure range is not exceeded with appropriate consideration of uncertainties.

Fuel Densification Fuel densification is no longer a concern. Since it was a concern at one time, a study was conducted to evaluate the effects of fuel densification on all non-LOCA transients presented in the FSAR. Fuel densification, which causes irradiated fuel pellets to shrink, conceivably developing high localized power peaks at the fuel gaps, was identified as a potential problem.

Reanalysis was performed for the rod ejection, loss of flow, locked rotor, and rod withdrawal at power transients. While some of the cases reanalyzed yielded more severe results than the corresponding cases analyzed without the effects of fuel densification, it was determined that the effects of fuel densification would not result in any safety criteria being violated. The results are included in WCAP-8146(1).

OFA-LOPARFuel 5 of 338 IPEC00036312 IPEC00036312

IP3 FSAR UPDATE The cycle 5 and cycle 6 cores involved a fuel design transition from the Westinghouse 15x15 low parasitic design (LOPAR) to the 15x15 Optimized fuel Assembly (OFA) design. As the OFA design resulted in an increased control rod drop time, the "fast" transients for which the reactor protection system trips the reactor within a few seconds after transient initiation were quantitatively reanalyzed. As the locked rotor transientisa "fase' transient, it was quantitatively reanalyzed. For Cycle 7 an increased Fll.H of 1.62 was employed and the affected analyses were reperformed.

Vantage 5 Fuel The VANTAGE 5 (V5) fuel assembly was designed to be compatible with OFAs, reactor internalsl interfaces, the fuel handling equipment, and refueling equipment. The VATAGE 5 design dimensions were essentially equivalent to the Indian Point 3 OFA assembly design from an exterior assembly envelope and reactor internals interface standpoint. (Reference 26)

The significant new mechanical features of the VANTAGE 5 design relative to the OFA design included the following:

• Integral Fuel Burnable Absorber (IFBA)

• Reconstitutable Top Nozzle

• Slightly longer fuel rod assembly for extended burnup capability

• Axial Blankets

• Redesigned fuel rod bottom end plug to facilitate reconstitution capability Other different mechanical features are the use of standardized chamfer pellet design and the Debris Filter Bottom Nozzle (DFBN).

V5 fuel was first loaded in Cycle 7.

Vantage+ Fuel Vantage+ (V+) uses the following V5 features:

• Reconstitutable Top Nozzle (RTN)

• Extended Burnup Fuel Assembly Design

• Extreme Low Leakage Loading Pattern

• Enriched Integral Fuel Burnable Absorbers (IFBAs)

• Debris Filter Bottom Nozzle (DFBN)

• Axial Blankets In addition V+ incorporates the following features as described in Reference 27:

• Zirlo' Fuel Cladding

• Low Pressure Drop (LPD) Mid-Grids

• Integral Flow Mixer grids (IFMs)

• ZIRLOTM guide thimbles & instrumentation tubes

• Variable Pitch Fuel Rod Plenum Spring

• Mid-enriched Annular Fuel Pellets in Axial Blanket

• Fuel Assembly & Fuel ROd Dimensional Modifications 6 of 338 IPEC00036313 IPEC00036313

IP3 FSAR UPDATE

• Some Performance + Debris Mitigation Features V+ Fuel began operation in Cycle 10, although one of its features, ZIRLOTM clad was introduced in Cycle 9.

15x15 Upgrade This fuel design incorporates the following features in addition to the V+ fuel features:

• Balanced IFM design

• New Mid-grid design (I-Spring ZIRLOTM Mid-grids)

• Tube-in-tube guide thimble design The characteristics of 15x15 Upgrade fuel have been incorporated into the Chapter 14 accident analyses. 15x15 Upgrade fuel will begin operation in Cycle 14.

14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS For the following plant abnormalities and transients, the Reactor Control and Protection System is relied upon to protect the core and reactor coolant boundary from damage:

1) Uncontrolled control rod assembly withdrawal from subcritical condition

2) Uncontrolled withdrawal control rod assembly, at power

3) Rod Assembly Misalignment (this encompasses a statically misaligned RCCA (14.1.3) and RCCA drop (14.1.4)

4) Chemical and Volume Control System (CVCS) malfunction

5) Loss of reactor coolant flow

6) Startup of an inactive reactor coolant loop

7) Loss of external electrical load

8) Loss of normal feedwater

9) Excessive heat removal due to feedwater system malfunction

10) Excessive load increase incident

11) Loss of all AC power to the station auxiliaries

12) Startup accidents without reactor coolant pump operation

13) Startup accident with a full pressurizer Trip is defined for analytical purposes as the insertion of all full length RCC assemblies except the most reactive assembly which is assumed to remain in the fully withdrawn position. This is 7 of 338 IPEC00036314 IPEC00036314

IP3 FSAR UPDATE to provide margin in shutdown capability against the remote possibility of a stuck RCC assembly condition existing at a time when shutdown is required.

The instrumentation drift and calorimetric errors used to establish the maximum nuclear overpower set point are presented in Table 14.1-1.

The negative reactivity insertion following a reactor trip is a function of the acceleration of the control rods and variation in rod worth as a function of rod position. Control rod positions after trip have been determined experimentally as a function of time using an actual prototype assembly under simulated flow conditions. The resulting rod positions were combined with rod worths to define the negative reactivity insertion as a function of time, according to Figure 14.1-1.

Instrumentation is provided for continuously monitoring all individual RCC assemblies together with their respective bank position. This is in the form of a deviation alarm system. Procedures are established to correct deviations. In the worst case, the plant will be shutdown in an orderly manner and the condition corrected. Such occurrences are expected to be extremely rare based on operation and test experience to date.

In summary, reactor protection was designed to prevent cladding damage in all transients and abnormalities listed above. The most probable modes of failure in each protection channel result in a signal calling for the protective trip. Coincidence of two-out-of-three (or two-out-of-four) signals is required where single channel malfunction could cause spurious trips while at power.

A single component or channel failure in the Protection System itself coincident with one stuck RCCA is always permissible as a contingent failure and does not cause violation of the protection criteria. The Reactor Protection Systems were designed in accordance with the IEEE 279 "Standard for Nuclear Plant Protection Systems," August 1968.

14.1.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical Condition A control rod assembly withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of control rod assemblies resulting in a power excursion. While the probability of a transient of this type is extremely low, such a transient could be caused by a malfunction of the Reactor control or Control Rod Drive Systems. This could occur with the reactor either subcritical or at power. The "at power" case is discussed in Section 14.1.2.

Reactivity is added at a prescribed and controlled rate in bringing the reactor from a shutdown condition to a lower power level during startup by rod control withdrawal. Although the initial startup procedure uses the method of boron dilution, the normal startup is with control rod assembly withdrawal. Control rod assembly motion can cause much faster changes in reactivity than can be made by changing boron concentration.

The control rod drive mechanisms are wired into preselected banks, and these bank configurations are not altered during core life. The assemblies are therefore physically prevented from being withdrawn in other than their respective banks. Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time. The control rod drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed in the detailed analysis assuming the simultaneous worth at maximum speed.

Should a continuous rod assembly be initiated, the transient will be terminated by the following automatic safety features:

8 of 338 IPEC00036315 IPEC00036315

IP3 FSAR UPDATE

1) Source range flux level trip - actuated when either of two independent source range channels indicates a flux level above a preselected, manually adjustable value. This trip function may be manually bypassed when either intermediate range flux channel indicates a flux level above the source range cutoff power level. It is automatically reinstated when both intermediate range channels indicate a flux level below the source range cutoff power level.

2) Intermediate range control rod stop - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value. The control rod stop may be manually bypassed when two out of four power range channels indicate a power level above approximately 10 percent of full power. It is automatically reinstated when three of the four power range channels are below this value.

3) Intermediate range flux level trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value.

This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

4) Power range flux level trip (low setting) - actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

5) Power range control rod stop - actuated when one out of the four power range channels indicate a power level above a pre~set setpoint. This function is always active.

6) Power range flux level trip (high setting) - actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

The nuclear power response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative fuel temperature coefficient. This self-limitation of the initial power burst results from a fast negative fuel temperature feedback (Doppler effect) and is of prime importance during a startup incident since it limits the power to a tolerable level prior to external control action. After the initial power burst, the nuclear power is momentarily reduced; if the incident is not then terminated by a reactor trip, the nuclear power increases again, but at a much slower rate.

Termination of the startup incident by the above protection channels prevents core damage. In addition, the reactor trip from high reactor pressure serves as a backup to terminate the incident before an overpressure condition could occur.

The Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event is a Condition II event as defined by ANS-051.1/N18.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition II occurrence is defined as a fault of moderate frequency, which, at worst, should result in reactor shutdown with the plant being 9 of 338 IPEC00036316 IPEC00036316

IP3 FSAR UPDATE capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event for Indian Point Unit 3 are:

1. Pressure in the reactor coolant and main stream systems should not exceed 110% of their respective design values.

2. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit

3. Fuel centerline temperatures should remain below the minimum temperature at which fuel melting would occur.

4. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently Method of Analysis and Assumptions Analysis of this transient was performed by digital computation incorporating the neutron kinetics, including six delayed groups, and the core thermal and hydraulic equations (Reference 14). In addition to the nuclear flux response, the average fuel clad, and water temperature, and heat flux responses were computed.

In order to give conservative results for the Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition analysis, the following assumptions were made:

1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on Doppler reactivity feedback, a conservatively low (absolute magnitude) value for the Doppler power defect is used.

2. The effect of moderator reactivity is negligible during the initial part of the transient because the heat transfer time constant between the fuel and the moderator is much longer than the neutron flux response time constant. However, after the initial neutron flux peak, the moderator temperature reactivity coefficient affects the succeeding rate of power increase. A highly conservative value of the moderator temperature coefficient is assumed in the analysis to yield the maximum peak heat flux.

3. The analysis assumes the reactor to be at hot zero power conditions with a vessel average temperature of 547°F. This assumption is more conservative than that of a lower initial system temperature (i.e., shutdown conditions). The higher temperature difference enhances fuel-to-coolant heat transfer and reduces the Doppler power defect, resulting in a higher peak heat flux.

4. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to the DNB transient.

10 of 338 IPEC00036317 IPEC00036317

IP3 FSAR UPDATE

5. The positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the two sequential RCCA banks having the greatest combined work at the maximum withdrawal speed.

6. The analysis assumes that the reactor is initially critical at 10-9 fraction of nominal power, which is below the power level expected for any shutdown condition. The combination of highest reactivity insertion rate and lowest initial power produces the highest heat flux.

7. The DNB analysis assumes the most limiting axial and radial power shapes possible during the fuel cycle associated with having the two highest combined worth banks in their highest worth position.

Initial Conditions The Revised Thermal Design Procedure (Reference 28) is not used in the analysis of this event.

Standard Thermal Design Procedure methods (maximum uncertainties in initial conditions) are used instead. Since the event is analyzed from hot zero power, the steady-state uncertainties on core power and RCS average temperature are not considered in defining the initial conditions.

Initial Condition Value Used in Analysis Core Power 10-9 fraction of nominal Pressurizer Pressure 2190 psia Reactor Vessel TIN Reactor Vessel TAVG Core Flow 158,842 gpm (44.82% of TDF reflecting 2 RCPs) (1)

(1) A 1.18% core flow penalty was applied to address the effects of RCS flow asymmetry due to steam generator tube plugging asymmetry.

Control Systems Control systems are assumed to function only if their operation causes more severe accident results. For Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition analysis, no control functions are assumed to operate.

Protection Systems Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrumentation error, setpoint error, delay for trip signal actuation, and delay for control rod assembly release is taken into account. The analysis assumes a 10%

uncertainty in the power range flux trip setpoint (low setting), raising it from the nominal value of 25% nominal to a value of 35% nominal. No credit is taken for the source and intermediate range protection. The reactor trip time delay from reactor trip signal actuation to RCCA release Is assumed to be 0.5 seconds.

11 of 338 IPEC00036318 IPEC00036318

IP3 FSAR UPDATE Reactivity Modeling The Uncontrolled RCCA Withdrawal from a Subcritical Condition accident results in a rapid nuclear power excursion which is terminated initially by Doppler reactivity feedback, and ultimately by reactor trip. Reactivity feedback parameters are chosen to yield the most severe power burst. These include a conservatively small (absolute value) Doppler power defect of 962 pcm at full power and a maximum delayed neutron fraction of 0.007. A total trip reactivity of

-3% i1k!k excluding the highest worth rod is assumed with a scram time of 2.7 seconds from beginning of rod motion until the dashpot is reached.

Heat Transfer Modeling For the DNBR evaluation, a conservatively high fuel rod gap heat transfer coefficient (10,000 Btu/hr-ff - OF) and conservatively low hot channel factors (1.0) are assumed. This maximizes the heat flux during the event which yields a more severe DNBR transient. For the hot spot fuel temperature calculation, a conservatively low fuel rod gap heat transfer coefficient (500 Btu/hr-ff-F) and conservatively high hot channel factors (6.851) are assumed. This maximizes the fuel and clad temperatures resulting from nuclear power transient.

Results Figure 14.1-2 shows the nuclear power transient for the Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event. The neutron flux overshoots the full power nominal value for a very short period of time; therefore, the energy release and fuel temperature increase are relatively small. The heat flux response used in the DNBR evaluation is shown in Figure 14.1-3.

The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the nominal full power value. Figure 14.1-4 shows the transient response of the hot spot fuel centerline, fuel average, and cladding inner temperatures. These temperatures remain below their respective nominal full power values at all times during the event. The minimum DNBR remains above the safety analysis limit at all times.

Table 14.1-2 presents the calculated sequence of events. After reactor trip, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal shutdown procedures.

Conclusions In the event of an Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition, the core and the RCS are not adversely affected since the combinations of thermal power and coolant temperature and flow result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of this transient.

14.1.2 Uncontrolled Control Rod Assembly Withdrawal at Power The "Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power" event is defined as the inadvertent addition of reactivity to the core caused by the withdrawal of RCCA banks when the core is above the no-load condition. The reactivity insertion resulting from the bank (or banks) withdrawal will cause an increase in core nuclear power and subsequent increase in core heat flux. An RCCA withdrawal can occur with the reactor subcritical, at hot 12 of 338 IPEC00036319 IPEC00036319

IP3 FSAR UPDATE zero power, or at power. The uncontrolled RCCA bank at power event is analyzed for Mode 1 (power operation).

The event is simulated by modeling a constant rate of reactivity insertion starting at time zero and continuing until a reactor trip occurs. The analysis assumes a spectrum of possible reactivity insertion rates up to a maximum positive reactivity insertion rate greater than that occurring with the simultaneous withdrawal, at maximum speed, of two sequential RCCA banks occurring with maximum worth. The minimum reactivity insertion rate considered is 1 pcm/second.

Unless the transient response to the RCCA withdrawal event is terminated by manual or automatic action, the power mismatch and resultant temperature rise could eventually result in departure from nucleate boiling (DNB) and/or fuel centerline melt. Additionally, the increase in RCS temperature caused by this event will increase the RCS pressure, and if left unchecked, could challenge the integrity of the Reactor Coolant System Pressure Boundary or the Main Steam System Pressure Boundary.

To avert the core damage that might otherwise result from this event, the reactor protection system is designed to automatically terminate any such event before the departure from nucleate boiling ratio (DNBR) falls below the limit value, the fuel rod kWfft limit is reached the peak pressures exceed their respective limits, or the pressurizer fills. Depending on the initial power level and rate of reactivity insertion, the reactor may be tripped and the RCCA withdrawal terminated by any of the following trip signals.

1) Nuclear power range instrumentation actuates reactor trip if two-out-of-four channels exceed an overpower setpoint.

2) Reactor trip is actuated if any two-out-of-four overtemperature L1 T channels exceed an overtemperature L1 T setpoint. This setpoint is automatically varied with axial power distribution, temperature and pressure to protect against DNB.

3) Reactor trip is actuated if any two-out-of-four overpower L1T channels exceed an overpower L1T set setpoint.

4) A high pressure reactor trip, actuated from any two-out-of-three pressure channels, is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.

5) A high pressurizer water level reactor trip, actuated from any two-out-of-three level channels, is actuated at a fixed point. This affords additional protection for control rod assembly withdrawal incidents but was not considered in the following analysis.

6) In addition to the above listed reactor trips, there are the following control rod assembly withdrawal blocks:

a) High nuclear flux (one-out-of-four) b) Overpower L1T (one-out-of-four) c) Overtemperature ~T (one-out-of-four) 13 of 338 IPEC00036320 IPEC00036320

IP3 FSAR UPDATE The manner in which the combination of overpower and overtemperature l1T trips provide protection over the full range of Reactor Coolant System conditions is illustrated in Chapter 7.

Figure 7.2-11 represents the allowable conditions for reactor vessel average temperature and 11T with the design power distribution in a two dimensional plot. The boundaries of operation defined by the overpower l1T trip and the overtemperature L1T trip are represented as "protection lines" on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors, so that under nominal conditions trip would occur well within the area bounded by these lines.

The utility of the diagram just described is in the fact that the operating limit imposed by any given DNBR can be represented as a line on this coordinate system. The DNB lines represent the locus of conditions for which the DNBR equals the applicable limit. All pOints below and to the left of the line for a given pressure have a DNBR greater than the applicable limit. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The region of permissible operation (power, pressure and temperature) is completely bounded by the combination of reactor trips: high nuclear flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and overtemperature l1T (variable setpoints).

These trips are designed to prevent DNBR or less than the applicable limit. The applicable limits are given in Table 14.1-0.

The uncontrolled RCCA withdrawal at power event is classified as a Condition II event as defined by ANS-051.1N18.2-1973, "Nuclear Safety Criteria for the Design of Stationary PWR Plants." The major hazards associated with an unmitigated and uncontrolled RCCA bank(s) withdrawal at power are the possibility of DNB, filling the pressurizer and an increase in RCS and secondary steam pressures, resulting from the power excursion and subsequent increase in RCS and core temperatures.

The safety analyses criteria for this event are as follows:

1) The pressure in the reactor coolant system and the steam generators should be maintained below 110% of their designed pressures (i.e., 2750.0 psia, and 1208.5 psia, respectively)

2) The critical heat flux and the fuel temperature and clad strain limits should not be exceeded. The peak linear heat generation rate (expressed in kw/ft) should not exceed a value which would cause fuel centerline melting. This is ensured by demonstrating that the minimum DNB ratio does not go below the safety analysis limit values as provided in Table 14.1-0 assisted by Figure 14.1-0. Meeting the DNBR limit also ensures that offsite dose requirements of 10 CFR 20 are met.

3) An incident of moderate frequency (Condition II) should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The uncontrolled RCCA withdrawal at power event is analyzed to show that: 1) the integrity of the core is maintained by the reactor protection systems as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below the 14 of 338 IPEC00036321 IPEC00036321

IP3 FSAR UPDATE accident analysis pressure limits; and 3) the pressurizer does not reach a water solid condition and result in water relief through the pressurizer relief and safety valves. Of these, primary concern for this event is DNB and assuring that the DNBR limit is met.

This transient is analyzed using the RETRAN code (Reference 39). This code simulates the neutron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, SG and SG safety valves. The code computes pertinent plant variables including temperatures, pressures and power level.

The transient responses for the RCCA bank withdrawal at power event were analyzed for a large number of cases with initial power levels of 100%, 60%, and 10% power. A spectrum of positive reactivity insertion rates from a minimum value (1 pcm/sec) up to a maximum value greater than that occurring with the simultaneous withdrawal, at maximum speed, of two sequential RCCA banks having the maximum worth were analyzed for each power level. Each combination of power and reactivity insertion rate was analyzed for limiting core reactivity conditions of minimum (BOL) and maximum (EOL) reactivity feedback conditions.

The Revised Thermal Design Procedure (Reference 28) was used in the analysis for the minimum DNBR so the initial conditions for power, pressurizer pressure and Tavq are at the nominal values. For the analysis of peak RCS pressure, uncertainties in the initial conditions for power, pressurizer pressure and Tavg are conservatively applied.

1) Reactivity Coefficients - Two spectrums are analyzed:

a) Minimum Reactivity Feedback. A least negative moderator density coefficient of reactivity is assumed, corresponding to beginning of core life conditions. A conservatively small (absolute magnitude) Doppler power coefficient, variable with core power, was used in the analysis.

b) Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.

2) A conservatively high setpoint of 118% of full power was assumed for the High Neutron Flux reactor trip. The OTLlT reactor trip function includes all adverse instrumentation and setpoint errors. Delays for trip actuation are assumed to be the maximum values; 0.5 seconds for the High Neutron Flux reactor trip, 2.0 seconds for the OTLlT reactor trip.

3) The trip reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled

4) A range of reactivity insertion rate is examined. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal for the two control banks having maximum combined worth at maximum speed (90 pcm/sec).

5) Power levels of 10%,60% and 100% power are considered.

Results 15 of 338 IPEC00036322 IPEC00036322

IP3 FSAR UPDATE Figures 14.1-5 through 14.1-10 show the transient response for rapid RCCA withdrawal (66 pcm/sec) incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result and margin to DNB is maintained.

The transient response for a slow RCCA withdrawal from full power is shown in Figures 14.1-11 through 14.1-16. Reactor trip on OTL'lT occurs after a longer period and the rise in temperature and pressure is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater that the safety analysis limit.

Figure 14.1-17 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen the high neutron flux and OTL'lT reactor trip channels provide protection over the whole range of reactivity insertion rates. The minimum DNBR is never less than the safety analysis limit.

Figures 14.1-18 through 14.1-19 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents initiating from 60 and 10 percent power levels, respectively, for minimum and maximum reactivity feedback. The results are similar to the 100 percent power case, except as the initial power is decreased, the range over which OTL'lT trip is effective is increased. In all cases the DNBR remains above the safety analysis limit.

The shape of the curves of the minimum DNB ratio versus reactivity insertion rate in the reference figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 14.1-19, for example, it is noted that:

1) For reactivity insertion rates above - 24 pcm/sec reactor trip is initiated by the high neutron flux trip for the minimum reactivity feedback cases. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid.

Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux. Minimum DNBR during the transient thus decreases with decreasing insertion rate.

2) For reactivity insertion rates below -24 pcm/sec the OTL'l T trip terminates the transient.

The OT L'lT reactor trip circuit initiates a reactor trip when measured coolant loop L'lT exceeds a setpoint based on measured Reactor Coolant System average temperature and pressure.

3) For reactivity rates between - 24 pcm/sec and - 7 pcm/sec the effectiveness (in terms of increased minimum DNBR) of the OTL'lT trip increases due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower and the system lags and delays become less significant.

For reactivity insertion rates less than - 7 pcm/sec, the rise of the reactor coolant temperature is sufficiently high so that the steam generator safety valve setpoint is reached prior to the trip.

16 of 338 IPEC00036323 IPEC00036323

IP3 FSAR UPDATE Opening of these valves, which act as an additional heat sink for the Reactor Coolant System, sharply decreases the rate of increase of Reactor Coolant System average temperature.

For transients initiated from higher power levels (for example, see Figure 14.1-17) the effect described in item 4 above, which results in the peak in minimum DNBR at approximately 7 pcm/sec, does not occur since the steam generator safety valves are not actuated prior to trip.

Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 118 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis) and the peak fuel centerline temperature remains below the fuel melting temperature.

For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the OT11T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 118 percent of its nominal value and the peak fuel centerline temperature remains below the fuel melting temperature.

Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced.

The calculated sequence of events for an RCCA bank withdrawal from full power assuming minimum reactivity feedback conditions for a large and a small reactivity insertion rates are shown in Table 14.1 ~3.

With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

Conclusions The high neutron flux and OT11T trip channels provide adequate protection for uncontrolled rod withdrawal event at power up to the maximum reactivity insertion rate of 66 pcm/sec. The minimum calculated DNBR is always greater than the safety analysis limit value pressurizer filling does not occur, and peak pressures in RCS and secondary steam system do not exceed 110% of their respective design pressures.

14.1.3 ROD ASSEMBLY MISALIGNMENT 14.1.3.1 Accident Description RCCA misalignment accident includes the following:

1. One or more dropped RCCAs within the same group.

2. A dropped RCCA bank

3. A statically misaligned RCCA Each RCCA has a position indicator channel which displays the position of the assembly in a display grouping that is convenient to the operator. Fully inserted assemblies are also indicated by a rod at bottom signal which actuates a local alarm and a control room annunciator. Group demand position is also indicated.

17 of 338 IPEC00036324 IPEC00036324

IP3 FSAR UPDATE RCCAs move in preselected banks, and the banks always move in the same preselected sequence. Each bank of RCCAs consists of two groups. The rods comprising a group operate in parallel. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation) of the stationary moveable gripper, and lift coils of the control rod drive mechanism withdraws the RCCA held by the mechanism. Mechanical failures are in the direction of insertion or immobility.

A dropped RCCA, or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the nuclear instrumentation system;

2. Asymmetric power distribution as seen by the nuclear instrumentation system;

3. Rod at bottom signal

4. Rod deviation alarm;

5. Rod position indicators.

Misaligned RCCAs are detected by:

1. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;

2. Rod deviation alarm;

3. Rod position indicators.

The resolution of the rod position indicator channel is 5% of the 12 foot span (7.2 inches).

Deviation of any individual indicated rod position from its group step counter demand position within the limits specified in Table 3.1.4-1 of the Improved Technical Specifications (above 85%

power) or within 24 steps (at or below 85% power) will not cause power distributions worse than the design limits. The rod deviation alarm alerts the operator to rod deviation in excess of these limits. If the rod deviation alarm is not operable, the operator is required to log the rod positions in a prescribed time sequence to confirm the alignment.

If one or more rod position indicator channels should be out of service, operating instructions are followed to assure the alignment of the non-indicated assemblies. These operating instructions use the moveable incore detector system to verify the position of the mal positioned rod. Although not as accurate, the core exit thermocouple system can be used as another indicator of a grossly mal positioned rod. The operating instructions also call for the excore detectors and/or moveable incore detector system and the core exit thermocouple system to be monitored following significant motion of the non-indicating channels.

Another type of rod assembly misalignment is the so-called "Salem Event," in which one or more assemblies move out of the core on a bank control demand to move in (uncontrolled asymmetric withdrawals). The Indian Point 3 operators have been trained on this event.

The Westinghouse Owners Group developed Rod Cluster Control sequence timing modification (24) to remove the potential for single failures to cause uncontrolled asymmetric rod withdrawals.

Reference 25 analyzed logic system single failures for the revised timing and concluded that upon completion of the modification, and performance of identified testing each refueling, the potential for uncontrolled asymmetric withdrawals is resolved. Failures that could occur with the revised timing have been analyzed and result in limited rod movement, either inward, or in the direction demanded. These failures result in consequences less severe than the limiting single Rod Control System malfunction. Westinghouse evaluation concludes that all asymmetric rod 18 of 338 IPEC00036325 IPEC00036325

IP3 FSAR UPDATE motion which could occur due to single failures following the timing change, have been determined to be bounded by current plant analyses and licensing basis. The NRC has reviewed this generic evaluation.

Indian Point 3 has performed the modification to the timing, and has committed to perform surveillance testing during each refueling startup to identify any single failures, and document the acceptability of the timing.

14.1.3.2 Method of Analysis and Assumptions For the statically misaligned RCCA, steady state power distributions are analyzed using appropriate nuclear physics computer codes. The peaking factors are used as input to the VI PRE code to calculate the DNBR. The analysis examines the case of the worst rod withdrawn from bank D inserted at the insertion limit with the reactor initially at full power.

The analysis assumes this incident to occur at beginning of life since this assumption results in the minimum feedback value (least negative) of the moderator temperature coefficient. This assumption maximizes the power rise and minimizes the tendency of the large (most negative) moderator temperature coefficient to flatten the power distribution.

Results The most-severe misalignment situations with respect to DNBR occur at significant power levels. These situations arise from cases in which one RCCA is fully inserted or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the transient approaches the postulated conditions. The bank can be inserted to its insertion limit with anyone assembly fully withdrawn without the DNBR falling below the safety analysis limit value.

The insertion limits in the Core Operating Limits Report (COLR) may vary from time to time depending on several limiting criteria. The full-power insertion limits on control bank D must be chosen to be above that position which meets the minimum DNBR and peaking factors. The full-power insertion limit is usually dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the safety analysis value. The analysis of this case assumes that the initial reactor power, pressure, and RCS temperatures are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

For RCCA misalignment with one RCCA fully inserted, the DNBR does not fall below the safety analysis limit value. The analysis of this case assumes that initial reactor power, pressure, and RCS temperatures are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident; thus, there is no reduction in the ability of the primary coolant to remove heat from the fuel rod. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the limiting design axial power distribution. The resulting linear heat generation rate is well below that which would cause fuel melting.

19 of 338 IPEC00036326 IPEC00036326

IP3 FSAR UPDATE After identifying an RCCA group misalignment condition, the operator must take action as required by the plant Technical Specifications and operating instructions.

Conclusions For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the safety analysis limit value.

14.1.4 Rod Cluster Control Assembly (RCCA) Drop The dropped RCCA accident is initiated by a single electrical or mechanical failure which causes any number and combination of rods from the same group of a given bank to drop to the bottom of the core. A dropped RCCA (single or multiple RCCAs) causes an initial reduction in nuclear power, corresponding to the reactivity worth of the RCCA(s), and a possible increase in the hot channel factor. If no protective action occurred, the reactor coolant system (RCS) would attempt to restore the power to the level that existed before the incident occurred. This would lead to a reduced safety margin or possibly departure from nucleate boiling (DNB), depending upon the magnitude of the hot channel factor.

Protection is provided by an automatic rod withdrawal block (from a rod:..on bottom signal).

Historically, protection was also provided by the automatic turbine runback function; however, this function has been disabled. The acceptance criterion for this event is that no fuel failures occur. This is verified by demonstrating that the departure from nucleate boiling ratio (DNBR) remains above the limit value for the plant.

For purposes of analysis, a single or multiple dropped RCCA occurrence is called a "dropped rod". The multiple dropped RCCAs may be any number and combination of rods from the same group of a given bank. RCCAs from different groups are not considered since it requires more than one single failure for them to drop.

Dropped RCCAs can be detected by the excore detectors, core exit thermocouples, rod deviation alarms, and rod position indicators. In addition, the rod-on-bottom alarm will be actuated. These features serve to alert the operator to a dropped RCCA event. The rod-on-bottom signal device provides an indication signal for each RCCA.

A rod drop signal from any rod position indication channel, or from one or more of the four power range channels, initiates a blocking of automatic rod withdrawal. The rod withdrawal block is redundantly achieved.

The dropped rod (single or multiple dropped RCCAs) events are classified as a Condition II event as defined by ANS-051.1/N18.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II dropped rod event for Indian Point Unit 3 are:

20 of 338 IPEC00036327 IPEC00036327

IP3 FSAR UPDATE

1) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,

2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The dropped rod transient was analyzed using the current approved Westinghouse methodology for plants originally designed with a turbine runback function. The LOFTRAN computer code (Reference 13) calculates the transient system response for the evaluation of the dropped RCCA and dropped RCCA bank events. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, rod control system, steam generators, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Calculated statepoints and nuclear models form the basis used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE code.

The RTDP was used in the analysis so the initial conditions for power, RCS pressure, and Tavg are at the nominal values.

Cases Analyzed Cases were analyzed assuming an automatic rod control block initiated by a dropped rod signal (i.e., by a rod-on-bottom signal), as well as with automatic rod withdrawal (for all possible single dropped RCCA worths) to specifically address the possibility of a single failure in the rod-on-bottom signal which blocks automatic rod withdrawal. Cases were also analyzed over a range of dropped rod worths.

To capture the transient response, dropped rod statepoints designed to bound both operation with and without automatic rod withdrawal were evaluated. The dropped rod/bank statepoints for these latter evaluations are based on generic dropped rod analyses performed as part of the Westinghouse Owners Group (WOG) dropped rod protection modification program, Reference

22. The WOG dropped rod protection modification program was specifically performed to support elimination of turbine runback on dropped rod (for Westinghouse plants with this system) and deletion of the negative flux rate trip (for Westinghouse plants without turbine runback on dropped RCCA).

Two distinct sets of generic dropped rod/bank statepoints were used in the evaluation; both of which are directly applicable to Indian Point Unit 3. One set of WOG dropped rod/bank statepoints considers no turbine runback due to the occurrence of the dropped RCCA but continues to credit a rod withdrawal block function (from either rod-on-bottom or a change in flux signal) which prevents automatic rod withdrawal (i.e., manual rod control). Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. This equilibrium process without rod control system interaction is monotonic, .thus removing power 21 of 338 IPEC00036328 IPEC00036328

IP3 FSAR UPDATE overshoot asa concern. The second set of WOG generic dropped rod statepoints assumes automatic rod control. In the automatic rod control mode, the rod control system receives signals from the excore detectors and the turbine to indicate a primary/secondary side power mismatch. In an attempt to eliminate the power mismatch with turbine runbackdisabled (and failure of the system to block rod withdrawal), the rod control system initiates control bank withdrawal of a partially inserted control bank. With rod withdrawal, power overshoot may occur, after which the control system will insert the control bank and return the plant to nominal power.

Each set of statepoints were considered for all possible single and multiple dropped RCCA worths over a range of dropped rod/bank worths from 100 pcm to 1000 pcm for various moderator temperature coefficients between OpcmrF and -35 pcmrF. The applicability of both of these sets of WOG generic dropped rod statepoints is limited to operation under uniform steam generator tube plugging conditions only.

Results Figures 14.1~20 through 14.1-22 show a typical transient response with automatic rod withdrawal blocked and when reactivity feedback does not offset the worth of the dropped RCCA(s). In this case, beginning-of-life (SOL) conditions are shown with a small negative moderator temperature coefficient (MTC) of -5 pcmrF for a dropped RCCA worth of 400pcm.

As a result of the negative reactivity insertion associated 'with thedroppedRCCA,a cooldown condition of the RCS exists. The nuclear power reaches a level lower than that which existed before the incident, and the RCS temperature and pressure continue to decrease until a low pressurizer pressure reactor trip signal is reached.

Figures 14.1-23 through 14.1-25 show a typical transient response with automatic rod withdrawal blocked and when reactivity feedback is large enough to offset the worth of the dropped RCCA(s). In these figures, end-of-life (EOL) conditions are shown with a large negative MTC of -35 pcmrF for a dropped RCCA worth of 400 pcm. With a large reactivity feedback, a new equilibrium condition is reached without a reactor trip. The nuclear power returns to nearly the initial power level that existed before the inCident, while the RCS temperature and pressure are reduced to a slightly lower condition.

Figures 14.1-26 through 14.1-28 show a typical transient response for a dropped RCCA worth of 200 pcm with automatic rod control functioning and SOL conditions. In this case, BOL conditions are represented by a small negative MTC of -5 pcmrF. As a result of the negative reactivity insertion associated with the dropped RCCA, nuclear power promptly drops to a minimum and is then recovered under rod control. The prompt decrease in nuclear power is governed by the rod worth since the rod control system does not respond during the short drop period. The return to power is not sensitive to this rapid initial drop, but to the indicated power and temperature inputs to the rod control system which, in an attempt to restore power, result in control bank withdrawal that has the potential to cause an overshoot in power, after which the control system will insert the control bank and return the plant to nominal power.

Figures 14.1-29 through 14.1~31 show a typical transientresponse for a dropped RCCA worth of 200 pcm with automatic rod control functioning and 'EOL conditions.ln'these figures, EOL conditions are represented by a large negative MTC of -35 pcmrF. With a large reactivity feedback, the power overshoot is effectively dampened due to the reactivity inserted via cooldown of the RCS as opposed to rods.

22 of 338 IPEC00036329 IPEC00036329

IP3 FSAR UPDATE The evaluation of the generic WOG dropped rod/bank statepoints examined in support of operation without turbine runback, and to address the possibility of a single failure in the rods-on-bottom signal which blocks automatic rod withdrawal show the applicable licensing basis acceptance criteria are met. Specifically, the evaluations performed using the WOG dropped rod/bank statepoints verified that the DNBR licensing basis acceptance criterion is met assuming no turbine runback following a dropped RCCA event for: 1) single or multiple dropped RCCAs from the same group of a given bank with rod withdrawal block, and 2) for all single dropped RCCA worths with automatic rod control functioning. The latter confirms the acceptability of the dropped RCCA event for a single failure of a rod-on-bottom signal which automatically blocks rod withdrawals Due to the nature of the dropped RCCA event without turbine runback (i.e., the addition of negative reactivity to core without a reduction in turbine output), pressure transients in the reactor coolant and main steam systems are not a concern and the pressures will not exceed 110% of the design values. Furthermore, the occurrence of a single dropped RCCA or multiple dropped RCCAs from the same group of a given bank without turbine runback will not result in generating a more serious plant condition without other faults occurring independently.

Conclusion Based on the DNBR results for all the cases analyzed, it has been demonstrated that the DNBR criterion is met and, therefore, it is concluded that dropped RCCAs do not lead to conditions that cause core damage and that all applicable safety criteria are satisfied for this event.

14.1.5 Chemical and Volume Control System Malfunction Reactivity can be added to the core by feeding primary grade water into the Reactor Coolant System via the reactor makeup portion of the Chemical and Volume Control System. The normal dilution procedures call for a limit on the rate of magnitude for any individual dilution, under strict administrative controls. Boron dilution is a manual operation. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during the normal charging to that in the Reactor Coolant System. The Chemical and Volume Control System is designed to limit, even under various postulated failures modes, the potential rate of dilution to a valve, which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve provides the only supply of makeup water to the Reactor Coolant System which can dilute the reactor coolant. Inadvertent dilution can be readily terminated by closing this valve. In order for makeup water to be added to the Reactor Coolant System, at least one charging pump must also be running in addition to a primary makeup water pump.

The maximum delivery rate of un borated water to the Reactor Coolant System is limited by charging pumps. Assuming all three charging pumps are operating, the maximum delivery rate is 294 gpm.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board. In order to dilute, two separate operations are required. First, the operator must switch from the automatic makeup mode to the dilute mode. Second, the operator must 23 of 338 IPEC00036330 IPEC00036330

IP3 FSAR UPDATE actuate the system. Omitting either step would prevent dilution. This makes the possibility of inadvertent dilution very remote.

Information on the status of reactor coolant makeup is continuously available to the operator.

Lights are provided on the control board to indicate the operating condition of pumps in the Chemical and Volume Control System. Alarms are actuated to warn the operator if boric acid or makeup water flow rates deviate from preset values as a result of system malfunction.

The inadvertent boron dilution event is considered to be possible in all modes of plant operation.

However, Indian Point Unit 3 received a license to operate prior to the issuance of Regulatory Guide 1.70, Revisions 2 and 3 (Reference 33). Consequently, the analysis of the boron dilution event is only performed under the requirements of Regulatory Guide 1.70, Revision 1, for conditions equivalent to Modes 1,2 and 6 (i.e., plant modes of power operation, plant startup, and refueling, respectively).

If left unchecked, the reactivity addition due to an inadvertent boron dilution may lead to the loss of plant shutdown margin. During power operation and startup (Modes 1 and 2), this would result in an increase in reactor power and/or loss of the capability to shut the reactor down via insertion of the RCCAs. In refueling (Mode 6), the reactivity insertion due to the dilution may result in the complete loss of plant shutdown margin and possible return to criticality with no means of terminating the reactivity increase.

The licensing-basis safety analysis is performed to identify the amount of time available for operator action to mitigate the effects of boron dilution event prior to the complete loss of plant shutdown margin. Conservative analysis assumptions are used to minimize the calculated time to loss of plant shutdown margin. The calculated time is presented as that required for operator action to effectively mitigate the effects of the boron dilution.

The alarms and indications that would alert the operator to the occurrence of a boron dilution event are the following:

• indication of the boric acid and blended flowrates (all modes)

• CVCS pump status lights (all modes)

• high flux at shutdown alarm (Mode 6)

• indicated/audible increase in source range neutron flux count rate (Mode 6)

• source range reactor trip (Mode 2)

• axial flux difference alarm (Mode 1)

• control rod insertion limit low and low-low alarms (Modes 1 and 2)

• overtemperature ~T alarm and reactor trip (Mode 1)

• power range neutron flux reactor trip, low and high setpoints (Modes 1 and 2)

Prior to the complete loss of plant shutdown margin resulting from an inadvertent boron dilution, RCS and core transient parameters are within the bounds of those calculated for other 24 of 338 IPEC00036331 IPEC00036331

IP3 FSAR UPDATE licensing-basis accidents as defined in the plant Technical Specifications. Therefore, the boron dilution event is not limiting with respect to the licensing-basis acceptance criteria such as minimum DNBR and maximum RCS pressure. Thus, if the time between the inadvertent boron dilution and the loss of plant shutdown margin is greater than the available operator action time acceptance criterion, then the above licensing-basis criteria are assumed to be satisfied. No transient results are quantified or presented as part of the analysis of the boron dilution event.

Initial/Nominal Conditions Assumptions The initial conditions assumed for the inadvertent boron dilution event are dependent on the mode of plant operation for which the analysis is being performed. However, the rated thermal power for each mode is not an assumed variable for this analysis. The RCS pressure and average temperature are the only primary system thermal-hydraulic parameters used in the calculations for the boron dilution event analysis. The RCS flowrate is not an explicit assumption used in the analysis; it is assumed, for all modes, that there is sufficient flow to presume perfect mixing of the dilution water as it enters the RCS. The assumption of perfect mixing has been shown to be conservative with respect to slug-flow mixing via analysis.

Power Operation (Mode 1) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for the use in the calculation of the dilution mass flowrate. The initial RCS average temperature, 579.5 OF, is the nominal full-power value plus 7.5°F which accounts for instrument errors. The initial RCS pressure, 2250 psia, is the nominal plant value. A minimum active RCS volume of 9,350 fe is assumed. This volume corresponds to the total RCS volume excluding the volume of the pressurizer, pressurizer surge line, and the dead volume in the reactor vessel upper head region. In addition, this active RCS volume conservatively assumes a reduced primary-side volume of the steam generators to reflect a maximum steam generator tube plugging level of 10%.

The assumed volumetric dilution flowrate under manual and automatic reactor control is 294 gpm coinciding with the maximum capacity of three charging pumps when the RCS is at pressure. This is a conservative assumption since only one charging pump is normally in operation. The dilution source is assumed to be initially at atmospheric pressure and 40°F.

Startup (Mode 2) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for use in the calculation of the dilution mass flowrate. The initial RCS average temperature, 555.75 OF, is the nominal value at 5% of rated thermal power plus 7.5 OF which accounts for instrument errors. The initial RCS pressure, 2250 psia, is the nominal plant value.

Here too, a minimum active RCS volume of 9,350 ft3 is assumed.

The volumetric dilution flowrate during startup conditions is conservatively assumed to be 294 gpm; that corresponding to the maximum capacity of the three charging pumps. The dilution source is assumed to be initially at atmospheric pressure and 40°F.

Refueling (Mode 6) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for use in the calculation of the dilution mass flowrate. The initial RCS 25 of 338 IPEC00036332 IPEC00036332

IP3 FSAR UPDATE temperature, 140°F is the value consistent with the upper limit on temperature in this mode. The initial RCS pressure, 14.7 psia, is the atmospheric pressure condition.

The Mode 6 analysis assumes the RCS is drained to mid~loop and is being cooled via RHR operation with no reactor coolant pumps operating. Under these conditions, the active mixing volume is 3,266 fe and includes the reactor vessel volume, without its upper head and drained down to the middle of the Reactor vessel nozzles, a single RHR loop volume, the mid-loop volume of two cold leg from the CVCS connection to the reactor vessel, and the mid-loop volume of one hot leg from the reactor vessel to the RHR connection. This active mixing volume does not include the volume of the pressurizer or its surgeline.

The assumed volumetric dilution flowrate during refueling is 294 gpm corresponding to the maximum capacity of the three charging pumps. The dilution source is assumed to be initially atmospheric pressure and 40°F.

In all modes, the secondary side of the plant is not modeled for the inadvertent boron dilution event.

Plant Operating - Conditions The analysis of the potential consequences of the inadvertent boron dilution event includes the following conservative assumptions:

• The analysis is performed for an inadvertent dilution of the RCS for power operation, startup, and refueling modes of plant operation.

• Conservative dilution flowrates have been assumed for each plant operating mode as already discussed. The effective dilution mass flowrate used in the analysis is greater than the nominal volumetric flowrate accounting for the differences in the densities of the primary coolant and the dilution source.

• During power operation (Mode 1), the initial boron concentration is assumed to be 1800 ppm which is a conservative maximum value for the conditions of hot full power, rods at the insertion limits and no xenon. The minimum reactivity change following a reactor trip, results in the maximum critical concentration for the conditions of hot zero power, all rods inserted except the most reactive RCCA, and no xenon. This minimum reactivity change is equivalent to 350 ppm. The critical concentration at hot-zero-power conditions is thus 1450 ppm.

• During Startup (Mode 2), the initial boron concentration is assumed to be 1800 ppm which is a conservative maximum value for the conditions of hot zero power, rods at the insertion limits and no xenon. The minimum reactivity change following a reactor trip, results in the maximum critical concentration for the conditions of hot zero power, all rods inserted except the most-reactive RCCA, and no xenon. This minimum reactivity change is equivalent to 250 ppm. The critical concentration at hot-zero-power conditions is thus 1550 ppm.

• During refueling (Mode 6), the initial boron concentration is assumed to be 2050 ppm which is a conservative minimum value which meets the refueling mode Core Operating Limits Report requirement for a shutdown margin of at least 5% L'1k1k. The critical concentration is assumed to be 1390 ppm which is a conservative maximum predicted value for which the 26 of 338 IPEC00036333 IPEC00036333

IP3 FSAR UPDATE reactor will attain criticality during refueling conditions. The minimum change in boron concentration is thus 660 ppm.

• The dilution source is conservatively assumed to originate at 14.7 psia and 40°F

• The alarms alert the plant operator that a dilution is in progress.

• All other plant systems are assumed to be operating within the limits specified by the plant Technical Specifications and the Technical Requirements Manual.

Cases Considered Four cases of the inadvertent boron dilution event are considered. The cases during power operation (Mode 1, manual and automatic rod control), startup (Mode 2), as well as the refueling case (Mode 6) are discussed.

Event Duration Following the initiation of the inadvertent dilution flow into the RCS, the event duration for the current licensing-basis analysis is less than 40 minutes. Within this time frame, the following events have been assumed:

Power Operation (Mode 1)

• Alarm alerting the operator that an unplanned dilution of the RCS is progressing

• Operator takes action to terminate the dilution flow

• Loss of plant shutdown margin (if no operator action is taken)

During power operation with the reactor in automatic rod control, the power and temperature increase from the boron dilution causes the insertion of the control rods and a decrease in the available shutdown margin. The rod insertion limit alarms (LOW and LOW-LOW settings) alert the operator more than 15 minutes prior to losing the required minimum shutdown margin. This is sufficient time for the operator to determine the cause of dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.

With the reactor in manual rod control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach overtemperature ~ T trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially the equivalent to an uncontrolled RCCA bank withdrawal at power. The maximum reactivity insertion rate for a boron dilution event is conservatively estimated to be about 2.7 pcm/sec, which is within the range of insertion rates analyzed for the uncontrolled RCCA bank withdrawal at power event.

Thus, the effects of dilution prior to reactor trip are bounded by the uncontrolled RCCA bank withdrawal at power analysis as described in Section 14.1.2. Following reactor trip, there are greater than 15 minutes prior to criticality. This is sufficient time for the operator to determine the cause of the dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.

Startup (Mode 2) and Refueling (Mode 6) 27 of 338 IPEC00036334 IPEC00036334

IP3 FSAR UPDATE

• Initiation of an unplanned dilution of the RCS

• Loss of plant shutdown margin (if no operator action is taken)

Following the termination of the dilution into the RCS, the operator can take action to initiate reboration and recover the lost shutdown margin.

Safety Limits The safety limits which are specifically applicable to the inadvertent boron dilution are fuel clad damage and overpressurization of the RCS. The means by which these limits are met in the licensing-basis boron dilution analysis is to assure that the plant shutdown margin is not lost due to the unplanned dilution.

The Indian Point Unit 3 licensing basis boron dilution analysis required that the operator take action to mitigate the effects of the transient. For the boron dilution analyses during power operation conditions, a 15-minute time interval must be available for operator action between an alarm indicating the unplanned dilution of the RCS and the time of the loss of plant shutdown margin. For boron dilution during startup conditions, a 15-minute time interval must be available for operator action between the time the transient begins until the loss of the plant shutdown margin. For a boron dilution during refueling, a 30-minute time interval must be available for operator action between the time the transient begins until the loss of plant shutdown margin.

These minimum time intervals are the acceptance criterion for an inadvertent dilution during these modes of operation for Indian Point Unit 3.

For power operation, the analyses demonstrate there are greater than 15 minutes from an alarm indicating an unplanned dilution and the loss of plant shutdown margin. For startup and refueling conditions, the analyses demonstrate there are greater than 15 minutes and 30 minutes, respectively, from initiation of the unplanned dilution and the loss of plant shutdown margin.

Conclusions The major hazard associated with the inadvertent boron dilution event is the possible fuel clad damage and RCS overpressurization resulting from the loss of plant shutdown margin.

The available time for operator action following an alarm indicating an unplanned dilution (Mode

1) until loss of plant shutdown margin and the time intervals from the initiation of the inadvertent dilution (Modes 2 and 6) until loss of plant shutdown margin have been calculated for Indian Point Unit 3. In Modes 1 and 2, there are more than 15 minutes available for the operator to take action prior to the loss of plant shutdown margin. In Mode 6, there are more than 30 minutes available for the operator to take action prior to the loss of plant shutdown margin.

For the four cases considered, the results show that the integrity of the core and the RCS is maintained since there are more than 15 minutes in Modes 1 and 2, and more than 30 minutes in Mode 6 for the operator to take action prior to the loss of plant shutdown margin.

14.1.6 Loss of Reactor Coolant Flow Flow Coast-Down Accidents 28 of 338 IPEC00036335 IPEC00036335

IP3 FSAR UPDATE A loss of coolant flow incident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply of these pumps. If the reactor is at power at the time of the incident, the immediate effect of loss of coolant flow is a rapid increase in coolant temperature. This increase could result in departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor is not tripped promptly. The following trip circuits provide the necessary protection against a loss of coolant flow incident:

1) Low Voltage or low frequency on pump power supply buses

2) Pump circuit breaker opening

3) Low reactor coolant flow.

These trip circuits and their redundancy are further described in Section 7.2.

Simultaneous loss of electrical power to all reactor coolant pumps at full power is the most severe credible loss of coolant flow condition. For this condition reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to prevent Reactor Coolant System overpressure and the DNB ratio from getting below the applicable limit.

Method of Analysis The following loss of flow cases were analyzed:

1) Partial Loss of Forced Reactor Coolant Flow

2) Complete Loss of Forced Reactor Coolant Flow

3) Reactor Coolant Pump Shaft Seizure (Locked Rotor)

4) Reactor Coolant Pump Shaft Break (Reverse Flow)

Partial Loss of Forced Reactor Coolant Flow

==

Introduction:==

A partial loss of coolant accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase would result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through the individual buses connected to the generator and the offsite power system. When generator trip occurs, the buses continue to be supplied from external power lines, and the pumps continue to supply coolant to the core.

This event is classified as an ANS Condition II fault as defined by ANS-051.1/NI8.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition II occurrence is defined as a fault of moderate frequency, which at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a 29 of 338 IPEC00036336 IPEC00036336

IP3 FSAR UPDATE Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8, low flow in any loop will actuate a reactor trip.

Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

The applicable safety licensing basis acceptance criteria for this Condition II event are:

1. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the designed values,

2. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 limit, and

3. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The loss of one reactor coolant pump with four loops in operation event is analyzed to show that: 1) the integrity of the core is maintained as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limits; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

The loss of one reactor coolant pump event is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (References 40) is then used to calculate the heat flux and DNBR during the transient based on the nuclear power and RCS flow from RETRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

This accident is analyzed with the RTDP as discussed in Reference 28. Initial reactor power, pressurizer pressure and RCS temperature are assumed to be at their nominal values.

A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

A conservative trip reactivity of 4% ilk is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on conservative estimates of system pressure losses.

30 of 338 IPEC00036337 IPEC00036337

IP3 FSAR UPDATE The analysis is performed to bound operation with a maximum uniform steam generator tube plugging levels of:s; 10%.

Results Figures 14.1-44 through 14.1-49 illustrate the transient response for the loss of one reactor coolant pump with four loops in operation. Figure 14.1-49 shows that the DNBR always remains above the limit value. This demonstrates the ability of the primary coolant to remove heat from the fuel rods is not greatly reduced.

The calculated sequence of events is shown in Table 14.1-5. A reactor trip occurs on a low primary reactor coolant flow trip condition which is assumed to be 87% of nominal flow. The Technical Specification low flow allowable value (lOW flow trip point is 90) percent of full loop flow; the trip signal was assumed to be initiated at 87 percent of full loop flow allowing 3 percent for flow measurement errors. Following reactor trip, the affected reactor coolant pump will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

Conclusions The analysis performed has demonstrated that for the loss of reactor coolant pump event, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted and all applicable acceptance criteria are met.

Complete Loss of Forced Reactor Coolant Flow A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

Normal power for the reactor coolant pumps is supplied through buses of a transformer connected to the generator and the offsite power system. Each pump is on a separate bus.

When a generator trip occurs the buses continue to be supplied from external power lines and the pumps continue to supply coolant flow to the core.

This event is classified as an ANS Condition III fault as defined by ANS-051.1/NI8.2 - 1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition III occurrence is defined as an infrequent fault. In addition, a Condition III event should not propagate to cause a more serious fault, i.e., a Condition IV event.

The following signals provide the necessary protection against a complete loss of flow accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., station blackout. This function is blocked below approximately 10 percent power (Permissive 7).

31 of 338 IPEC00036338 IPEC00036338

IP3 FSAR UPDATE The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid.

The reactor trip on low primary coolant flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive 8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

Although this is defined as Condition III even, the event is analyzed to Condition II criteria:

a) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values (i.e., 2750 psia (2735 psig) and 1208.5 psia, respectively),

b) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and c) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The complete loss of flow transient is analyzed for a loss of all four reactor coolant pumps with four loops in operation. The event is analyzed to show that: 1) the integrity of the core is maintained as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limits; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

The transient is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (Reference 40) is then used to calculate the DNBR during the transient based on the nuclear power and RCS flow from RETRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

For the complete loss of flow incident, two cases are considered; reactor trip actuated by redundant bus undervoltage or breaker trip and reactor trip on bus underfrequency (two-out-of-four). For the analysis of the complete loss of flow inCident actuated by bus undervoltage or breaker trip, the loss of flow is assumed to occur at the initiation of the event (Le.,transient time

= 0). Hence, with respect to the safety analysis, the undervoltage trip setpoint is irrelevant.

However, for the analysis of the complete loss of flow incident actuated by a bus un derfrequency, the reactor is assumed to trip after an underfrequency reactor coolant pump trip at 55 Hz, following a frequency decay of 5 Hz/sec from an initial frequency of 60 Hz. The trip is conservatively modeled to occur at 1.6 seconds, which includes a maximum reactor trip time delay of 0.6 seconds.

This accident is analyzed with the RTDP as discussed in Reference 28. Initial reactor power, pressurizer pressure and RCS temperature are assumed to be at their nominal values.

32 of 338 IPEC00036339 IPEC00036339

IP3 FSAR UPDATE A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

A conservative trip reactivity of 4% ilk is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on conservative estimates of system pressure losses.

Results Figures 14.1-50 through 14.1-54 illustrate the transient response for the loss of all four reactor coolant pumps with four loops in operation following a reactor trip on bus undervoltage. Figures 14.1~50A through 14.1~54A illustrate the transient response for the loss of all reactor coolant pumps with four loops in operation following a reactor trip on bus underfrequency. Figures 14.1-54 and 14.1-54A show that the DNBR always remains above the limit value. This demonstrates the ability of the primary coolant to remove heat from the fuel rods is not greatly reduced.

The calculated sequence of events is shown in Table 14.1-6 for the complete loss of flow case in which a reactor trip is assumed on bus undervoltage and Table 14.1-6A for the complete loss of flow case in which a reactor trip is assumed on bus underfrequency. Following reactor trip, the reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

Conclusions The analysis performed has demonstrated that for the complete loss of flow event, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted and all applicable criteria are met.

Reactor Coolant Pump Shaft Seizure (Locked Rotor)

The accident postulated is an instantaneous seizure of a reactor coolant pump rotor. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed 33 of 338 IPEC00036340 IPEC00036340

IP3 FSAR UPDATE for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

This event is classified as an ANS Condition IV fault as defined by ANS-051.1/NI8.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition IV occurrence is defined as a limiting fault. The limits are that the RCS and the core must remain able to provide long term cooling, and offsite dose must remain within the guidelines of 10 CFR 100. The specific (and more restrictive) criteria that Westinghouse uses to ensure that these limits are not violated are as follows:

1. Fuel cladding damage, including melting, due to increased reactor coolant temperatures must be prevented. This is precluded by demonstrating that the maximum clad temperature at the core hot spot remains below 2700°F, and the zirconium-water reaction at the core hot spot is less than 16 weight percent.

2. The peak reactor coolant pressure must remain less than that which would cause stresses to exceed the Faulted Condition stress limits.

3. Rods-in-DNB should be less than or equal to that assumed in the radiological dose analyses for this event.

The necessary protection against an RCP Shaft Seizure accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals.

Method of Analysis and Assumptions The RCP Shaft Seizure transient is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (Reference

40) is then used to calculate the thermal behavior of the fuel located at the core hot spot, as well as DNBR values, based on the nuclear power and RCS flow from RETRAN. The VIPRE computer code includes a film boiling heat transfer coefficient.

The analysis is performed to bound operation with a maximum uniform steam generator tube plugging levels of:s 10%.

A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

A conservative trip reactivity of 4% ilk is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

Two cases are evaluated in the analysis. Both assumed one RCP shaft seizure with all four loops in operation.

34 of 338 IPEC00036341 IPEC00036341

IP3 FSAR UPDATE The first case is analyzed to evaluate the RCS pressure and fuel clad temperature transient conditions. For this case, the plant is assumed to be in operation under the most adverse steady state operation conditions, Le., the maximum guaranteed steady state thermal power, maximum steady state pressure, and maximum steady state coolant average temperature. This assumption results in a conservative calculation of fuel clad temperature transient conditions and of the coolant insurge into the pressurizer, which in turn results in a maximum calculated peak RCS pressure.

For peak RCS pressure evaluation, the initial pressure is conservatively estimated as 60 psi above the nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. The RCS pressure response is shown in Figure 14.1-56 at the point in the reactor coolant system having the maximum pressure.

For this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the consequences with respect to the fuel rod thermal transients is performed. Results obtained from the analysis of this "hot spot" condition represent the upper limit with respect to clad temperature and zirconium water reaction. In the evaluation, the rod power at the hot spot is assumed to be 2.5 times the average rod power (i.e., FQ =2.5) at the initial core power level.

Film Boiling Coefficient The film boiling coefficient is calculated in the VIPRE code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperature. The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are based on the RETRAN results.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between the pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-oF at the initiation of the transient. Thus, the large amount of energy stored in the fuel because of the small initial value of the gap coefficient is released to the clad at the initiation of the transient.

Zirconium Steam Reaction The zirconium-steam reaction can become significant above 1800°F (clad temperature). The Baker-Just parabolic rate equation is used to define the rate of zirconium-steam reaction. The effect of the zirconium-steam reaction is included in the calculation of the "hot spot" clad temperature transient.

The second case is an evaluation of DNB in the core during the transient. This case is analyzed using the RTDP (Reference 28). Initial reactor power and pressurizer pressure are assumed to be at their nominal values for steady state, full power operation. Reactor coolant temperature is 35 of 338 IPEC00036342 IPEC00036342

IP3 FSAR UPDATE assumed to be at the nominal value for the high Tavq program. Uncertainties in initial conditions are included in the DNBR limit as described in the RTDP (Reference 28).

Results Figures 14.1-55 through 14.1-59 illustrate the transient response for the RCP Shaft Seizure event analyzed to evaluate the RCS pressure and fuel clad temperature. The peak reactor coolant system pressure is 2530 psia and is less than that which would cause stresses to exceed the faulted condition stress limits. Also, the peak clad average temperature 1792°F which is considerably less than the limit of 2700°F. The maximum zirconium-steam reaction at the hot spot is 0.3% by weight.

The sequence of events for the case analyzed to evaluate the RCS pressure and fuel clad temperature is given in Table 14.1-7. A reactor trip occurs on a low primary reactor coolant flow trip setpoint which is assumed to be 87% of nominal flow.

For the case analyzed for DNB using the RTDP, the applicable DNB criterion is met. Hence, no "rods-in-DNB" are predicted for the RCP shaft seizure event.

Conclusions All safety criteria (peak RCS pressure less than that which would cause stresses to exceed the faulted condition stress limits, clad average temperature < 2700°F, and Zirc-H 2 0 reaction <

16%) are satisfied for all cases. This demonstrates that the RCS and the core will remain able to provide long term cooling, and off-site doses remain within the guidelines of 10 CFR 50,67 and RG 6.1.183 in the case of an RCP Shaft Seizure event.

Reactor Coolant Pump Shaft Break The accident is postulated as an instantaneous failure of reactor coolant pump shaft. RCS flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor seizure event. With a failed shaft the pump impeller could conceivably be free to spin in the reverse direction instead of being fixed in position. The effect of such reverse spinning is a slight decrease in the final (steady-state) core flow.

The analysis presented under the RCP Shaft Seizure section represents the limiting condition, assuming a locked rotor for forward flow but a free-spinning shaft for reverse flow in the affected loop. Therefore, the conclusions for the RCP Shaft Seizure apply to and bound a reactor coolant pump shaft break accident.

14.1.7 Startup of Inactive Reactor Coolant Loop The Technical Specifications require that all 4 reactor coolant pumps be operating for operation in Modes 1 and 2. This event was originally included in the FSARlicensing basis when operation with a loop out of service was considered. Based on the current Technical Specifications which prohibit at power operation with an inactive loop, this event has been deleted from the updated FSAR.

14.1.8 Loss of External Electrical Load 36 of 338 IPEC00036343 IPEC00036343

IP3 FSAR UPDATE The loss of external electrical load and/or turbine trip event is defined as a complete loss of steam load or a turbine trip from full power without a direct reactor trip. This event is analyzed as a turbine trip from full power as this bounds both events: the loss of external electrical load and turbine trip. The turbine trip event is more severe than the total loss of external load event since it results in a more rapid reduction in steam flow.

For a turbine trip, the reactor would be tripped directly (unless below the power Permissive 8 setpoint) from a signal derived from the turbine autostop oil pressure and turbine stop valves.

The automatic steam dump system accommodates the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere. Additionally, main feedwater flow would be lost if the turbine condenser were not available. For this situation, steam generator level would be maintained by the auxiliary feedwater system.

The unit was designed to accept a 50% step loss of load without actuating a reactor trip. The automatic steam dump system, with 40% steam dump capacity to the condenser, was designed to accommodate this load rejection by reducing the severity of the transient imposed upon the RCS. The reactor power is reduced to the new equilibrium power level at a rate consistent with the capability of the Rod Control System. The pressurizer relief valves may be actuated, but the pressurizer safety valves and the steam generator safety valves do not lift for the 50% step loss of load with steam dump.

In the event the steam dump valves fail to open following a large loss of load or in the event of a complete loss of load with steam dump operating, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, the OT1lT signal, the OP1lT signal, or the low-low, steam generator water level signal. The steam generator shell-side pressure and reactor coolant temperatures will increase rapidly. However, the pressurizer safety valves and steam generator safety valves are sized to protect the RCS and steam generator against overpressurization for all load losses without assuming the operation of the steam dump system. The steam dump valves will not be opened for load reductions of 10% or less. For larger load reductions they may open. The RCS and main steam supply relieving capacities were designed to ensure safety of the unit without requiring the automatic rod control, pressurizer pressure control and/or steam bypass control systems.

The loss of Load/Turbine Trip event is classified as a Condition II fault as defined by the American Nuclear SOCiety, Nuclear Safety Criteria for the Design of Stationary PWR Plants. A Condition II fault will at worst result in a reactor shutdown with the plant capable of returning to operation.

The Safety Analysis Criteria are as follows:

1) The pressure in the reactor coolant system and the steam generators should be maintained below 110% of their design pressures (i.e., 2750.0 psia (2735 psig) and 1208.5 psia, respectively).

2) The critical heat flux and the fuel temperature clad strain limits should not be exceeded.

The peak linear heat generation rate (expressed in kw/ft) should not exceed a value which would cause fuel centerline melting. This is ensured by demonstrating that the 37 of 338 IPEC00036344 IPEC00036344

IP3 FSAR UPDATE minimum DNB ratio does not go below the limit value at any time during the transient.

Meeting the DNBR limit also ensures that offsite dose requirements of 10 CFR 20 are met.

3) An incident of moderate frequency (Condition II) should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The loss of load accident is analyzed for the following reasons: 1) to confirm that the pressurizer and steam generator safety valves are adequately sized to prevent overpressurization of the RCS and steam generators, respectively; 2) to form the basis of the required ASME overpressure protection report; and 3) to ensure that the increase in RCS temperature does not result in DNB in the core. The Reactor Protection System is designed to automatically terminate any such transient before the DNBR falls below the limit value.

The total loss of load transients are analyzed with the RETRAN computer program (Reference 39). The program simulates the neutron kinetics, RCS pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator relief of safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

In this analysis, the behavior of the unit is evaluated for a complete loss of steam loading from full power without a direct reactor trip. The turbine is assumed to trip without actuating all the turbine stop valve limit switches. This assumption delays reactor trip until conditions in the RCS result in a trip on some other signal. Thus, the analysis assumes a worst case transient and demonstrates the adequacy of the pressure relieving devices and core protection margins.

Major assumptions are summarized below:

1) Initial Operating Conditions: For the ONB case, the initial reactor power, RCS pressure, and RCS temperatures are assumed at their nominal values consistent with steady state full power operation and the RTDP methodology. For the peak RCS pressure case, the uncertainties are applied for power, ReS pressure, and RCS temperature, and Thermal Design Flow (TDF) is assumed.

2) Moderator and Doppler Coefficients of Reactivity: The turbine trip is analyzed with minimum reactivity feedback. The minimum feedback (BOL) cases assume a minimum absolute value of the moderator temperature coefficient and the least negative Doppler coefficient.

3) Reactor Control: From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.

4) Steam Release: No credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits the secondary steam pressure at the setpoint value. Through maximizing the pressure transient in the main steam system, the saturation temperature in the steam 38 of 338 IPEC00036345 IPEC00036345

IP3 FSAR UPDATE generators is maximized resulting in limiting pressure and temperature conditions in the RCS.

5) Pressurizer Spray and Power-operated Relief Valves: Two cases with BOl reactivity feedback conditions are analyzed:

a) For the DNB case, full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

b) For the peak ReS pressure case, no credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

6) Feedwater Flow: Main feedwater flow to steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition (pressurizer pressure has begun to decrease) will be reached before auxiliary feedwater initiation is normally assumed to occur.

However, the auxiliary motor driven feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core heat following plant stabilization.

7) Offsite AC Power: loss of offsite power is not postulated to occur coincident with the loss of load incident since the resulting DNBR and pressure transients are limiting when offsite power is available.

8) Pressurizer Safety Valves: For the DNB case, a minimum PSV opening pressure

(-4% tolerance) was assumed. For the peak RCS pressure case, a maximum PSV opening pressure(+4% tolerance) was assumed.

Reactor trip is actuated whenever the first reactor protection system trip setpoint is reached with no credit taken for the direct reactor trip on the turbine trip. The OTL1T reactor trip and high pressurizer pressure reactor trip (2470 psia safety analysis setpoint) are actuated in the analysis.

Results The transients for a total loss of load from full power operation are shown on Figures 14.1-62 through 14.1-77 for two cases; one case with pressure control and one case without pressure control.

Previously four cases were analyzed: two cases with BOL reactivity feedback conditions, and two cases with EOl reactivity feed back conditions. Since the loss of Load I Turbine Trip event results in a primary system heatup, the analysis conservatively assumes minimum reactivity feedback conditions with and without pressurizer pressure control, which bounds the event with EOLreactivity feedback conditions.

Figures 14.1-62 through 14.1-69 show the transient responses for the total loss of steam load at BOl (minimum feedback reactivity coefficients) assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. Following event initiation, the pressurizer pressure and average RCS temperature increase due to the rapid reduced steam flow and heat removal capacity of the secondary-side. The peak pressurizer pressure and water volume and RCS 39 of 338 IPEC00036346 IPEC00036346

IP3 FSAR UPDATE average temperature are reached shortly after the reactor is tripped by the OT ~T trip function.

The DNB ratio decreases initially and then rapidly increases following reactor trip. The minimum DNBR remains well above the safety analysis limit value of 1.45. The pressurizer relief and safety valves are actuated for this case and maintain primary system pressure below 110 percent of the design value. The steam generator safety relief valves open and limit the secondary side steam pressure increase.

The total loss of load event was also analyzed assuming the plant to be initially operating at full power with no credit taken for the pressurizer spray or pressurizer power-operated relief valves.

Figures 14.1-70 through 14.1-77 show the BOL transients without pressure control. The nuclear power remains relatively constant (prior to reactor trip) while pressurizer pressure, pressurizer water volume and RCS average temperature increase. The reactor is tripped on the high pressurizer pressure signal.

Table 14.1-8 summarizes the sequence of events for the two cases considered for the total loss of load transient. The applicable safety analysis limits are:

1) Safety Analysis DNBR limit 1.45

2) Peak RCS Pressure (110% of design pressure) 2750.0 psia

3) Peak Secondary Pressure (110% of SG design pressure) 1208.5 psia The analysis demonstrates that the maximum pressures and minimum DNBR are within the safety analysis limits presented above.

Conclusions The results of the analyses show that the plant design is such that a total loss of external electrical load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure-relieving devices incorporated in the plant's design are adequate to limit the maximum pressures to within the design limits.

The integrity of the core is maintained by operation of the reactor protection system; i.e., the DNBR is maintained above the safety analysis limit value. Thus, no core safety limit will be violated.

14.1.9 Loss of Normal Feedwater Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunction, or loss of offsite ac power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS and possible core damage. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The following events occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

40 of 338 IPEC00036347 IPEC0003634 7

IP3 FSAR UPDATE

1) As the steam system pressure rises following the trip, the steam generator power-operated relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

2) As the no-load temperature is approached the steam generator power-operated relief valves (or safety valves if power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

A loss of normal feedwater is classified as an ANS Condition II event, a fault of moderate frequency. Condition II events include incidents of which anyone may occur during a calendar year for a particular plant.

Following the occurrence of a loss of normal feedwater, the reactor may be tripped by any of the following reactor protection system trip signals.

• Low-low steam generator water level

• Overtemperature ~T

• High pressurizer pressure

• High pressurizer water level

• RCP undervoltage Auxiliary feedwater (AFW) is supplied by actuation of two motor-driven AFW pumps initiated by any of the following signals:

• Low-low water level in any steam generators

• Any safety injection signal

• Loss of offsite power

• Automatic trip (not manual) of any main feedwater pump

• Manual actuation In addition, a turbine-driven AFW pump starts automatically on the following actuation signals although no automatic delivery of water to the steam generators occurs.

• Low-low level in any two steam generators

• Loss of offsite power

• Manual action The auxiliary feedwater system is started automatically. Motor-driven auxiliary feedwater pumps are powered by the emergency diesel generators. The turbine-driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The pumps take suction directly from the condensate storage tank for delivery to the steam generators. Both types of pumps are designed to supply the minimum required flow. However, the motor driven pumps are assumed to supply flow within 60 seconds of initiating signal. Steam Generator Blowdown isolation is assumed starting from event initiation (Reference 36).

41 of 338 IPEC00036348 IPEC00036348

IP3 FSAR UPDATE An analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat plus reactor coolant pump waste heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition.

Method of Analysis A detailed. analysis using the RETRAN computer code (Reference .39) is performed to determine the plant transient following a loss of normal feedwater. The code simulates the core neutron kinetics, reactor coolant system, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables including pressurizer pressure, pressurizer water. level, steam generator. mass, and reactor coolant average temperature.

Assumptions made in the analysis are:

1) The plant is initially operating at 102 percent of the rated thermal power (3230 MWt)

2) The core decay heat generation is based on the 1979 version of the ANSI 5.1, +2 sigma uncertainty. This is a conservative representation of the decay energy release rates based on long term operation at the initial power level preceding the reactor trip.

3) An initial steam generator water level uncertainty of +10% narrow range span (NRS) and a reactor trip setpoint low-low steam generator water level of 0% NRS is assumed.

4) The worst single failure in the auxiliary feedwater system occurs, i.e., failure of one of the motor-driven auxiliary feedwater pumps. A total flow of 343 gpm from one pump is assumed to be delivered equally to two steam generators 60 seconds after reaching the low-low steam generator level setpoint. The capacity of one motor-driven auxiliary feedwater pump is such that the rate of decrease of the water level in the steam generators being fed AFW flow is sufficiently slowed to provide time for an operator action to align the turbine-driven train and prevent water relief from the pressurizer relief or safety valves. The turbine-driven AFW pump, although automatically actuated, requires manual operation to deliver flow and is therefore not assumed available until 10 minutes after reactor trip. An additional 343 gpm of auxiliary feedwater flow is assumed after operator action, split evenly between the two other steam generators.

5) The pressurizer sprays, heaters, and power-operated relief valves are assumed to be operable, resulting in the maximum transient pressurizer water volume. If these control systems did not operate, the pressurizer safety valves would maintain peak RCS pressure at or below the actuation setpoint (2500 psia) throughout the transient.

6) Secondary system steam relief is achieved through the steam generator safety valves.

No credit is taken for the operation of steam dumps or power-operated relief valves.

7) The analysis considers initial hot full power reactor vessel average coolant temperatures at the upper and lower ends of the uprated operating range with uncertainty applied in both the positive and negative direction. The vessel average temperature assumed at the upper end of the range is 572°F with an uncertainty of +/-7.5°F. The average 42 of 338 IPEC00036349 IPEC00036349

IP3 FSAR UPDATE temperature assumedaUhe low end of the range is 549°F with an uncertainty of +/-7.5°F.

Results for the limiting case are presented.

8) Initial pressurizer pressure is assumed to be 2250 psi with an uncertainty of +/-60 psi.

Cases are considered with the pressure uncertainty applied in both the positive and negative direction to conservatively bound potential operating conditions. Results for the limiting case are presented.

9) Initial pressurizer level is at the nominal programmed level plus 8.5% span.

10) Analysis with both minimum (O%) and maximum (10%) steam generator tube plugging was performed to conservatively bound potential operating conditions.

11) The enthalpy of the auxi liary feedwater is assumed to be 90.77 Btull bm corresponding to a condensate storage tank temperature of 120°F.

12) An auxiliary feedwater line purge volume of 268.8 fe is assumed.

The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards system (i.e., the auxiliary feedwater system). The analysis demonstrates the capability of the AFW system to remove long term decay heat, thus preventing RCS overpressurization or loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

For the loss of normal feedwater transient, the reactor coolant volumetric flow remains at its normal value and the reactor trips via the low-low steam generator level trip. The reactor coolant pumps may be manually tripped at some later time to reduce heat addition to the RCS.

Normal reactor control systems are not required to function in this analysis. The reactor protection system is required to function following a loss of normal feedwater as analyzed herein. The auxiliary feedwater system is required to deliver a minimum auxiliary feedwater flow rate and no single active failure will prevent operation of any system required to function.

Results Figures 14.1-90 through 14.1-94 are the significant plant parameters following a loss of normal feedwater and show that the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation.

Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. 60 seconds following the initiation of the low-low level trip, at least one auxiliary feedwater pump is automatically started, reducing the rate of decrease in steam generator water level.

The capacity of one motor-driven auxiliary feedwater pump is such that therate of decrease of the water level in the steam generators being fed AFW flow is sufficiently slowed to provide time 43 of 338 IPEC00036350 IPEC00036350

IP3 FSAR UPDATE for an operator to align the turbine*driven train and prevent waterrelief from the RCS relief or safety valves.

The calculated sequence of events forthis accident is provided in Table 14.1-9. Figure 14,1-90 shows the pressurizer water volume transient. As shown in Figure 14.1*92, RCS subcooling is maintained since the RCS never reaches saturated conditions. Plant procedures may be followed to further stabilize and cool down the plant.

Conclusions Results of the analysis show that, for a loss of normal feedwater event, ali safety criteria are met. The auxiliary feedwater capacity is sufficient to prevent pressurizer filling and any subsequent water relief through the pressurizer safety and relief valves. This assures that the RCS is not overpressurzied.

14.1.10 Excessive Heat Removal Due to Feedwater System Malfunctions Excessive feedwater additions are postulated to occur from a malfunction of the feedwater control system or an operator error which results in the opening of a feedwater control valve.

With the reactor at power, this excess feedwater flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant no-load conditions, the addition of cold feedwater causes a decrease in RCS temperature and a consequential positive reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous excessive feedwater addition is terminated by the automatic feedwater isolation actuated upon receipt of a steam generator high-high water level signal. The steam generator high-high water level signal also results in a turbine trip and a subsequent reactor trip signal on turbine trip. The full power condition is limiting.

Excessive feedwater addition at power results in a core power increase above full power. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower and overtemperature protection (OP11T, and OT11T trips) and high neutron flux trip prevent any power increase that could lead to a DNBR less than the applicable DNBR limit.

The Excessive Heat Removal due to Feedwater System Malfunction event is a Condition II event as defined by ANS-051.1/NI8.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II Excessive Heat Removal due to Feedwater System Malfunction event for Indian Point Unit 3 are:

1) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values, (2750 psia and 1208.5 psia, respectively)

2) Fuel Cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and,

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

44 of 338 IPEC00036351 IPEC00036351

IP3 FSAR UPDATE Method of Analysis and Assumptions The feedwater system malfunction transient is analyzed using the RETRAN computer code (Reference 39) to determine the effects of the excessive heat removal on the reactivity insertion rate, RCS pressure, secondary-side pressure, and DNBR, for the primary purpose of assuring the required protection system features are adequate to prevent the applicable safety analysis limits from being exceeded.

The analysis is performed to bound operation with steam generator tube plugging level up to a maximum uniform steam generator tube plugging level of 10% and considers the following three cases of excessive feedwater addition:

1) Accidental opening of one feedwater control valve from full power initial conditions with the reactor in automatic rod control.

2) Accidental opening of one feedwater control valve from full power initial conditions with the reactor in manual rod control.

3) Accidental opening of one feedwater control valve with the reactor just critical at zero load conditions with the reactor in manual rod control.

In all three cases, one feedwater valve is assumed to accidentally open fully resulting in the excessive feedwater flow to one steam generator. For the cases analyzed at full power initial conditions, the valve opening is assumed to result in a step increase in feedwater flow to 143%

of nominal feedwater flow to one steam generator. For the feedwater control valve failure at zero load conditions, a feedwater valve malfunction is assumed to occur that results in a step increase in flow to one steam generator from zero to 210% of the nominal full load feedwater flow rate for one steam generator.

The analysis assumptions are conservatively selected to bound conditions for 10% uniform steam generator tube plugging levels.

Other pertinent analysis assumptions that affect the transient conditions following the postulated feedwater system malfunction are as follows:

Initial Conditions Initial conditions consistent with the implementation of the RTDP (Reference 28) are used in analysis. These include the use of the following nominal conditions:

Initial Condition HFP HZP Core Power (Mwt) 3216 32.16 NSSS Power (Mwt) 3230 46.16 Pressurizer Pressure (psia) 2250 2250 Reactor Vessel Inlet Temperature (OF) 542.4 547.0 45 of 338 IPEC00036352 IPEC00036352

IP3 FSAR UPDATE Reactor Vessel Average Temperature (OF)* 572.0 547.0 Reactor Vessel Flow (gpm) 364700 354400 Core Bypass Flow (fraction) 0.068 0.075 Other non-RTDP related initial conditions are:

Initial Condition HFP HZP Pressurizer Level (% NRS) 50.8 23.1 Pressurizer Water Volume (fe) 913.33 451.44 Steam Generator Level (% NRS) 35.0 45.0 Steam Generator Mass (Ibm) 60732.2 127828.0 Upper Head Temperature CF) 542.37 546.5 Feedwater Enthalpy (Btu/Ibm) 412.22 412.10 Control Systems For the cases analyzed assuming automatic rod control, the rod control system is modeled to maintain the program Tirill which is assumed to vary linearly between 547°F at no-load conditions to 572°F at full power. Since the event is primarily analyzed for DNB (e.g., cooldown events are not limiting with respect to overpressure concerns) using RTDP, no temperature error is assumed on the rod control system. However, the temperature error is statistically considered in establishing the safety analysis DNBR limit.

No other control systems are assumed to operate for the purpose of mitigating the consequences of this event.

Protection Systems For the feedwater system malfunction accident at full power, the feedwater flow resulting from a fully open control valve is terminated by the steam generator high-high water level signal that closes all feedwater control valves and trips the main feedwater pumps. The steam generator high-high water level signal also produces a signal to trip the turbine. In the RETRAN analysis, the high-high water level setpoint condition is modeled to occur when the steam generator high-high water level trip setpoint of 85% NRS, including uncertainties, is reached.

A turbine trip is modeled to occur 5 seconds after the steam generator water level reaches the high-high steam generator water level condition. If a reactor trip has not yet occurred from either a high neutron flux reactor trip signal or an OP~T reactor trip signal, a reactor trip will occur 4 seconds after the turbine trip (a total of 9 seconds after the high-high steam generator water level setpoint is reached). Should the turbine trip not result in a reactor trip Signal, reactor trip would eventually occur on another reactor trip signal (e.g., high neutron flux, low-low steam generator level).

46 of 338 IPEC00036353 IPEC00036353

IP3 FSAR UPDATE To determine the maximum reactivity insertion rate that occurs following the feedwater control valve failure, the reactor is assumed to be just critical at zero load initial conditions; and feedwater isolation and turbine trip are modeled upon reaching a high-high steam generator water level turbine trip setpoint in the zero power case. Reactor tripon turbine trip is not modeled in the zero power case.

Reactivity Modeling The feedwater system malfunction accident results in a cooldown of the primary system due to the excessive feedwater flow. Therefore, reactivity feedback characteristic of end-of-life conditions are assumed in the analysis. In addition, the analysis conservatively assumes no decay heat and radial weighting to the core quadrant with the steam generator receiving the excess feedwater.

For the full power cases, a total scram reactivity of -4% ~K excluding the highest worth rod is conservatively assumed with a scram time of 2.7 seconds from beginning of rod motion until the dashpot is reached. For the zero power case, a conservative shutdown margin of 1.3% .b.K excluding the highest worth rod is conservatively assumed.

Heat Transfer Modeling Fuel-to-coolant heat transfer coefficients conservatively representing minimum fuel temperature conditions are assumed in the analysis.

No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown and no credit is taken for the heat capacity of the steam and water in the unaffected steam generators. The primary-to-secondary heat transfer corresponding to no steam generator tube plugging is conservatively assumed to maximize the heat cooldown associated with this event.

Results Zero Power Cases:

In the cases of an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, the resulting transient is similar to but less severe than the results of the Hypothetical Steamline Break transient documented in Section 14.2.5. Because the excessive feedwater flow case with the reactor at zero power is bounded by the Steamline Break accident in Section 14.2.5, no transient results are provided in this section. It should be noted that if the incident occurs with the reactor just critical at no-load, the reactor may be tripped by the power range neutron flux trip (low setting).

Full Power Cases:

For the case initiated from full power conditions assuming automatic rod control and uniform steam generator tube plugging, the Nuclear Power, Reactor Vessel Average Temperature, Affected Loop ~T, Pressurizer Pressure, Steam Generator Pressure, Steam Generator Mass, and DNBR transient results are illustrated in Figure 14.1-95 through Figure 14.1-101, respectively. Figures 14.1-102 through Figure 14.1-108 show the equivalent transient conditions 47 of 338 IPEC00036354 IPEC00036354

IP3 FSAR UPDATE for this case with manual rod control. With respect to minimum DNBR, the most limiting full power case is that assuming manual rod control.

For all the full power cases, the steam generator water level rises until the feedwater addition is terminated at 12 seconds after the high-high steam generator water level setpoint (85% narrow range span, including uncertainties) is reached. A turbine trip occurs 5 seconds after reaching the high-high steam generator water level setpoint and a subsequent reactor trip on turbine trip occurs such that rod motion begins 4 seconds after turbine trip. The calculated sequence of events for all the cases analyzed are provided in Table 14.1-10.

In all cases, the minimum DNBR remains above the applicable safety analysis DNBR limit and the primary and secondary-side maximum pressures are less than 110% of the design values.

Conclusions At initial no-load conditions, the resulting transient is similar to but less severe than the Hypothetical Steamline Break transient. Therefore, the results and conclusions of the Steamline Break accident in Section 14.2.5 bound those for the Excessive Heat Removal Due to a Feedwater System Malfunction at no-load conditions.

For the cases of the excessive feedwater addition initiated from full power conditions with and without automatic rod control, the results show that all applicable Condition II acceptance criteria are met for this event.

14.1.11 Excessive Load Increase Incident An excessive load increase event is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10% step-load increase or a 5% per minute ramp load increase in the range of 15 to 100% of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system.

This event could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided that blocks the opening of the valves unless a large turbine load decrease or turbine trip has occurred.

The possible consequence of this event (assuming no protective functions) is departure from nucleate boiling (DNB) with subsequent fuel damage. Note that the event, as presently analyzed, is characterized by an approach to protection setpoints without actually reaching the setpoints.

The excessive load increase is classified as a Condition II fault as defined by ANS-051.1/N18.2-1973, "Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants." A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

48 of 338 IPEC00036355 IPEC00036355

IP3 FSAR UPDATE The applicable safety analysis licensing basis acceptance criteria for the Condition II Excessive Load Increase event for Indian Point Unit 3 are:

1) Pressures in the reactor coolant and main steam systems should be maintained below 110% of the design values,

2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The excessive load increase event is analyzed to show that: 1) the integrity of the core is maintained without actuation of the reactor protection system as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limit; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

Historically, the excessive load increase transients were analyzed with the LOFTRAN computer program (Reference 13). The program simulates the neutron kinetics, RCS, Pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator relief and safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Four cases were analyzed to demonstrate the plant behavior following a 10% step load increase from rated load. These cases are as follows:

1) Reactor control in manual with beginning-of-life minimum moderator reactivity feedback.

2) Reactor control in manual with end-of-life maximum moderator reactivity feedback.

3) Reactor control in automatic with beginning-of-life minimum moderator reactivity feedback.

4) Reactor control in automatic with end-of-life maximum moderator reactivity feedback.

For the beginning-of-life minimum moderator feedback cases, the core has the least negative moderator temperature coefficient of reactivity and the least negative Doppler only power coefficient curve; therefore the least inherent transient response. For the end-of-life maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value and the most negative Doppler only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

A conservative limit on the turbine valve opening (equivalent to 120% turbine load) was assumed, and all cases were analyzed without credit being taken for pressurizer heaters.

49 of 338 IPEC00036356 IPEC00036356

IP3 FSAR UPDATE This accident was analyzed with the RTDP as discussed in Reference 28. Initial reactor power, RCS pressure and temperature were assumed to be at their nominal values.

Normal reactor control systems and engineered safety systems were not required to function for this event. The reactor protection system was assumed to be operable; however, reactor trip was not encountered in the analysis. No single active failure would prevent the reactor protection system from performing its intended function.

Automatic rod control was modeled in the analysis to ensure that the worst case was presented.

The automatic rod control system was not required or modeled to provide reactor protection.

Given the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an explicit analysis was not performed as part of the Stretch Power Uprate Program. Instead, a detailed evaluation of this event was performed. The evaluation model consists of the generation of statepoints based on generic conservative data. The statepoints are then compared to the core thermal limits to ensure that the DNBR limit is not violated. The cases evaluated are:

• Reactor in manual rod control with BOl (minimum moderator) reactivity feedback

• Reactor in manual rodcontrol with EOl (maximum moderator} reactivity feedback

• Reactor in automatic rod control with BOl (minimum moderator) reactivity feedback

• Reactor in automatic rod control with EOl (maximum moderator) reactivity feedback Results and Conclusions An evaluation of this event was performed to support the Stretch Power Uprate Program. The evaluation determined that the DNB design basis for a 10% step load increase continues to be met.

14.1.12 loss of All AC Power to the Station Auxiliaries A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries: i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accomplished by a turbine generator trip at the station, or by a loss of the onsite non-emergency AC distribution system.

The first few seconds of the transient would be almost identical to the four pump loss of flow case presented in Section 14.1.6, that is, the pump coast down inertial and reactor trip would result in a DNBR ~ the applicable limit. After the trip, decay heat will be accommodated by the Auxiliary Feedwater System. This portion of the transient would be similar to that presented in Section 14.1.9 for the loss of Normal Feedwater event The events following such a condition are described in the sequence listed below.

1) Plant vital instruments are supplied by the emergency power sources

2) As the steam system pressure rises following the trip, the steam system power relief valves are automatically opened to the atmosphere. (Steam dump to the condenser is assumed not to be available) 50 of 338 IPEC00036357 IPEC00036357

IP3 FSAR UPDATE

3) If the steam flow rate through the power relief valves is not sufficient or, if the power relief valves are not available, the steam generator self-actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual heat produced in the reactor.

4) As the no-load temperature is approached, the steam power relief valves (or the self-actuated safety valves, if the power relief valves are not available) are used to dissipate the residual heat and to maintain the plant at the hot shutdown condition

5) The emergency diesel generators will start on loss of voltage on 480 volt buses No. 5A and 6A to supply plant vital loads.

The Auxiliary Feedwater System starts automatically as discussed in Section 14.1.9. The steam driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor driven auxiliary feedwater pumps are supplied by power from the diesel generators. The pumps take suction directly from the condensate storage tank for delivery to the steam generators. The Auxiliary Feedwater System insures feedwater supply upon loss of power to the station auxiliaries. The turbine driven pump system (rated at 800 gpm) is sufficient to deliver 200 gpm of unheated condensate from the condensate storage tank to each of the four steam generators. The motor driven pump system (2 pumps rated at 400 gpm each) delivers 200 gpm of unheated condensate to each of the four steam generators with each pump supplying feedwater to two steam generators.

Upon loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops. The natural circulation flow was calculated by a digital code for the conditions of equilibrium flow and maximum loop flow impedance. The model used has given results within 15% of the measured flow values obtained during natural circulation tests conducted at the Yankee-Rowe plant and has also been confirmed at San Onofre and Connecticut Yankee. The natural circulation flow ratio as a function of reactor power is illustrated in Table 14.1-15.

Method of Analysis A detailed analysis using the RETRAN computer code (Reference 39) is performed to determine the plant transient following a loss of AC power to the station auxiliaries. The code simulates the core neutron kinetics, reactor coolant system including natural circulation, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables including pressurizer pressure, pressurizer water level, steam generator mass, and reactor coolant average temperature.

The major assumptions used in the loss of AC power to the station auxiliaries analysis are the same as those presented in Section 14.1.9 for the loss of normal feedwater event, except that in this analysis the reactor coolant pumps begin coasting down after reactor trip. Additionally, in the .Ioss of AC power .to the. station auxiliaries analysis no credit is taken for the immediate response of the control rod drive mechanisms caused by the loss of off site power.

Results 51 of 338 IPEC00036358 IPEC00036358

IP3 FSAR UPDATE The transient response of the RCS following a loss of power to the station auxiliaries is shown in Figures 14.1-143 through 14.1-147. The calculated sequence of events for this event is listed in Table 14.1-14.

The first few seconds of the transient following receipt of a reactor trip signal closely resemble the simulation of the complete loss of flow incident (subsection 14.1.6); i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. After the reactor trip, stored and residual decay heat must be removed by natural circulation to prevent damage to either the RCS or the core.

The analysis results show that the available natural circulation flow is adequate to remove core decay heat following reactor trip and RCP coastdown.

Conclusions Results of the analysis show that, for the loss of offsite power to the station auxiliaries event, all safety criteria are met. The auxiliary feedwater capacity is sufficient to prevent water relief through the pressurizer relief and safety valves; this assures that the RCS is not overpressurized.

The analysis also demonstrates that sufficent long term heat removal capability exists by the natural circulation capability of the RCS following reactor*coolant pumps coastdown to prevent fuel or clad damage.

14.1.13 Startup Accidents Without Reactor Coolant Pump Operation As noted in the Technical Specifications the reactor is not permitted to be in MODES 1 or 2 unless all four reactor coolant pumps are in operation except for special low power tests and natural circulation tests. These tests are conducted under carefully approved procedures and supervision for the purpose of insuring control of core power and control of any reactivity insertion.

14.1.14 Startup Accident With a Full Pressurizer The Technical Specifications require pressurizer water level to be .s. 54.3% in MODES 1, 2 and

3. In view of this restriction, the reactor will not be solid when criticality is achieved.

References (Sections 14.0 & 14.1)

1) "Fuel Densification - Indian Point Nuclear Generating Unit No.3," WCAP-8146, Westinghouse Electric Corporation, July 1973.

2) Farman, R.F., and J.O. Cermark, "Post DNB Heat Transfer During Blow-down," WCAP-9005, (Proprietary), October 1968.

3) "Safety Evaluation for Indian Point Unit 3 with 24 percent tube plugging," attachment to the letter (INT-81-557) dated November 13, 1981, from J.D. Campell, Westinghouse Electric Corporation to J.M. Clabby, Power Authority of the State of New York.

4) "Completion of item II.K.2-17, Potential for voiding in the Reactor Coolant System (RCS) during transients for the Indian Point Power Plant, Unit No.3 (lP-3)," letter dated January 52 of 338 IPEC00036359 IPEC00036359

IP3 FSAR UPDATE 18, 1984 (Docket No. 50-286) from SA Varga, Division of Licensing, USNRC, to J.P.

Bayne, New York Power Authority.

5) "Safety Evaluation by the Office of Nuclear Reactor Regulation related to amendment No.

61 to Facility Operating License No. DPR-64, Power Authority of New York, Indian Point Nuclear Generating Unit No.3," letter dated August 27, 1985 (Docket No. 50-286), from J.D.

Neighbors, Division of Licensing, USNRC, to J.C. Brons, New York Power Authority.

6) "Safety Evaluation for Indian Point Unit 3 with Asymmetric Tube Plugging among Steam Generators," WCAP-10704, Rev. 2, (proprietary), January 1986.

7) "Additional Information Regarding Asymmetric Steam Generator Tube Plugging Analyses and Cycle 4/5 reload," letter dated August 1, 1985 (IPN-85-40), from J.C. Brons, NYPA, to SA Varga, Division of Licensing, USNRC.

8) "NRC review of NYPA submittal on Reactor Coolant pump (RCP) trip responding to the Generic Letter 85-12 TMI Action Item II.K.3.5., Automatic Trip of RCP," letter dated May 12, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, NYPA.

9) "Safety Evaluation by the office of Nuclear Reactor Regulation Implementation of TMI Action Item II.K.3.5," letter dated November 19, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, NYPA.

10) Letter dated April 17, 1987 (Docket No. 50-286) from J.D. Neighbors, Division of Reactor Projects, 1/11, USNRC, to J.C. Brons, NYPA, transmitting Amendment No. 73 to Facility Operating License No. DPR-64, dated April 17, 1987, from R.A Capra, Division of Reactor Projects, 1/11, USNRC.

11) Indian Point 3 Nuclear Power Plant Docket No. 50-286, cycle 5/6 Reload Safety Evaluation, IPN-87-040 dated August 14, 1987 from J.C. Brons, NYPA to Document Control Desk, USNRC.

12) H.G. Hargrove, "FACTRAN - A fortran IV Code for Thermal Transients in a U02 Fuel Rod,"

WCAP-7908, June 1972

13) T.W.T. Burnett, et ai., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), April 1984.

14) D.H. Risher, Jr and R.F. Barry, "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary),

January 1975.

15) L.E. Hochreiter, H. Chelemer, P.T. Chu, "THING IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.

16) L.E. Hochreiter, "Application of the THINC IV Program to PWR Design," WCAP-8054, October 1973.

17) H. Chelemer, et ai., "Improved Thermal Design Procedure," WCAP-8567, July 1975.

18) INT-88-778, "Turbine Runback Setpoint - Final Report," S.P. Swigart (Westinghouse) to Mr.

P. Kokolakis (NYPA), October 19, 1988.

53 of 338 IPEC00036360 IPEC00036360

IP3 FSAR UPDATE

19) Nuclear Safety Evaluation NSE 88-3-013SG, Revision 1, "Steam Generator Replacement Program," dated February 1,1989.

20) "Inspection of Corrective Actions in Response to Report 50-286/87015 SSOMI (Installation and Test): Report 50-286/88200," letter dated March 22, 1989 (Docket No. 50-286) from G.C. Lainas, Division of Reactor Projects 1/11, USNRC, to J.C. Brons, NYPA.

21) Nuclear Safety Evaluation, NSE 93-3-046 MFW, "Feedwater Regulating Valve Stroke Time Change," February 1993.

22) Haessler, R.L. et aI., "Methodology for the Analysis of the Dropped Rod Event," WCAP-11394- P-A, January 1990.

23) WCAP-13803, Rev. 1, "Generic Assessment of Asymmetric Rod Cluster Control Assembly Withdrawal," Westinghouse Electric Corp., August 1993.

24) OG-93-77, "Utility Report for the Generic Letter 90 Day Response for the Salem Rod Control System Failure Event," Westinghouse Owners = Group, Sept. 9, 1993.

25) T. Baker, S. Fowler, et aI., "Rod Control System Evaluation Program," WCAP 13864, Rev.

1-A, June 7, 1994.

26) Vantage 5 Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station, October 1988, Westinghouse.

27) Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station Vantage+ Fuel Upgrade, Revision 3, January 1997, Westinghouse.

28) Friedland, A.J. and Ray,S., "Revised Thermal Design Procedure," WCAP-11397-P-A, April 1989.

29) SECL-97-135, Revision 2, "Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties," March 1998, Westinghouse.

30) Deleted

31) 98IN-G-0004, "New York Power Authority Indian Point Unit 3 Transmittal of RSAC Information for Cycle 10," February 1998, Westinghouse.

32) Reload Safety Evaluation Indian Point Unit 3 Cycle 10, Revision 1, July 1997, Westinghouse.

33) Regulatory Guide 1.70, "Standard Format and Contents of Safety Analysis Report for Nuclear Power Plant."

34) Davidson, S.L. et aI., "Westinghouse Reload Safety Evaluation Methodology," WCAP-9272-P-A, July 1985.

35) Deleted 54 of 338 IPEC00036361 IPEC00036361

IP3 FSAR UPDATE

36) INT-01-049, "Steam Generator Blowdown Assumption for Indian Point Unit 3 (INT)

LONF/LOAC Analyses, December 2001, Westinghouse.

37) Steam Generator Program Report No.: IP3-RPT-SG-01796, Rev. 3, Appendix A, October 1,2001.

38) WCAP-16099-P, Rev. 0 "Westinghouse revised Thermal Design Procedure Instrument Uncertainty Methodology Indian Point Unit 3 (Power Uprate to 3216 Mwt Core Power)'

39) D. S. Huegel, et aI., "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis," WCAP-14882-P-A (Proprietary),

WCAP-15234-A (Non-Proprietary), April 1999.

40) Y. X. Sung, et aI., "Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-A (Proprietary), WCAP-15306 (Non-Proprietary), October 1999.

55 of 338 IPEC00036362 IPEC00036362

IP3 FSAR UPDATE Table 14.1-0 DNBR Limits VANTAGE 5(w/o IFMs) VANTAGE+ and 15x15 Upgrade DNB Correlation WRB-1 WRB-1 Correlation Limit 1.17 1.17 Design Limit (TyplThm) 1.24/1.23 1.23/1.22 Table 14.1-1 INSTRUMENTION DRIFT AND CALORIMETRIC ERRORS NUCLEAR OVERPOWER TRIP CHANNEL Set Point and Error Estimated Instrument Allowances Errors

(% of rated power) (% of rated power)

Nominal Set Point 109 Calorimetric Error 2 0.5*

1.30t Axial power distribution effects on total ion chamber current 5 3 Instrumentation channel drift and set point reproducibility 2 1.0 Maximum overpower trip point assuming all individual errors are simultaneously in the most adverse direction 118

• LEFM tVenturi 56 of 338 IPEC00036363 IPEC00036363

IP3 FSAR UPDATE Table 14.1-2 Sequence of Events Uncontrolled RCCA Bank Withdrawal From a Subcritical Condition EVENT TIME OF EVENT (seconds)

Initiation of Uncontrolled RCCA Withdrawal 0.0 Power Range High Neutron Flux Reactor 9.7 (Trip Setpoint (low setting) Reached (35%>>

Peak Nuclear Power Occurs 9.9 Rods Begin to Fall 10.2 Peak Heat Flux Occurs 11.8 Minimum DNBR Occurs 11.8 Peak Fuel Cladding Inner Temperature Occurs 12.3 Peak Fuel Average Temperature Occurs 12.5 Peak Fuel Centerline Temperature Occurs 13.2 Table 14.1-3 Time Sequence of Events for Uncontrolled RCCA Withdrawal at Full Power Accident Time(sec)

Uncontrolled RCCA bank withdrawal at full power and minimum reactivity feedback

1. Case A Initiation of uncontrolled RCCA 0.0 withdrawal at a high reactivity insertion rate (66 pcm/sec)

Power range high neutron flux 1.9 high trip point reached Rods begin to fall into core 2.4 Minimum DNBR occurs 3.4 57 of 338 IPEC00036364 IPEC00036364

IP3 FSAR UPDATE

2. Case B Initiation of uncontrolled RCCA 0.0 withdrawal at a small reactivity insertion rate (1 pcm/sec)

OTL1T reactor trip signal initiated 95.5 Rods begin to fall into core 97.5 Minimum DNBR occurs 98.0 58 of 338 IPEC00036365 IPEC00036365

IP3 FSAR UPDATE Table 14.1-4 Table Deleted Table 14.1-5 Sequence of Events for the Partial Loss of Flow Event Event Time of Event (sec)

Coastdown of one pump begins 0.0 Low flow reactor trip setpoint (87%) 1.5 reached Rods begin to drop 2.5 Minimum DNBR occurs 3.4 Table 14.1-6 Sequence of Events for the Complete Loss of (Undervoltage) Flow Event Time of Event (sec)

Coastdown of all pumps begins 0.0 Undervoltage reactor trip 0.0 setpoint reached Rods begin to drop 1.5 Minimum DNBR occurs 3.3 59 of 338 IPEC00036366 IPEC00036366

IP3 FSAR UPDATE Table 14.1-6A Sequence of Events for the Complete Loss of Flow (Underfrequency) Event Event Time of Event (sec)

Frequency decay (5 Hz/sec) begins 0.0 Underfrequency trip setpoint (55 Hz) reached 1.0 Coastdown of ali pumps begins 1.0 Rods begin to drop 1.6 Minimum DNBR occurs 3.7 Table 14.1-7 Sequence of Events for the RCP Shaft Seizure Event Time of Event (sec)

Rotor in one pump locks 0.0 Low flow reactor trip 0.1 setpoint (87% reached)

Rods begin to drop 1.1 Maximum clad temperature occurs 3.9 Maximum RCS pressure occurs 5.9 60 of 338 IPEC00036367 IPEC00036367

IP3 FSAR UPDATE Table 14.1-8 Sequence of Events and Transient Results for the Loss of External Electrical Load Event Loss of External Time of Event Electrical Load With Pressurizer Without Pressurizer Control Control Loss of electrical 0.0 0.0 load/turbine trip Reactor trip signal OTL1T Hi Prz P Reactor trip setpoint 14.7 7.9 reached( sec)

Time of rod 16.7 9.9 motion (sec)

Minimum DNBR 17.9 N/A(AJ occurs (sec)

Peak RCS 14.6 10.1 pressure occurs (sec)

Initiation of steam 12.5 14.9 release from SG safety valves (sec)

Peak steam generator 23.1 19.1 pressure occurs(sec)

(a) DNBR does not decrease below its initial value.

61 of 338 IPEC00036368 IPEC00036368

IP3 FSAR UPDATE Table 14.1-9 Time Sequence of Events for the Loss of Normal Feedwater Event Time (seconds)

Main feedwater flow stops 20.0 Low-low steam generator water level reactor trip setpoint reached 52.5 Rods begin to fall 54.5 Automatic auxiliary feedwater from one of the motor-driven 112.5 auxiliary feedwater pumps initiated Operator action to establish auxiliary feedwater flow to remainingsteam generators 654.5 Peak Pressurizer water level occurs 1195.0 62 of 338 IPEC00036369 IPEC00036369

IP3 FSAR UPDATE Table 14.1-10 Sequence of Events for the Feedwater System Malfunction Event at Full Power Feedwater Malfunction Time of event, sec at Full Power With Automatic Without Automatic Rod Control Rod Control Feedwater Flow increases 0.001 0.001 to 143% of Nominal Peak Nuclear Power occurs 69.9 93.4 Minimum DNBR occurs 73.6 91.9 High-High Steam Generator Water 84.8 85.1 Level Setpoint is reached Turbine Trip occurs 89.7 90.0 Rod motion starts 93.7* 94.0*

Peak Pressurizer Pressure 95.6 95.6 occurs Feedwater Isolation valves begin to close 96.7 97.0

• Reactor Trip occurs on Turbine Trip.

63 of 338 IPEC00036370 IPEC00036370

IP3 FSAR UPDATE Tables 14.1-11, 14.1-12, 14.1-13 Deleted 64 of 338 IPEC00036371 IPEC00036371

IP3 FSAR UPDATE Table 14.1-14 Time Sequence of Events for the Loss of All AC Power to the Station Auxiliaries Time of Event (Seconds)

Main Feedwater flow stops 20.0 Low-low steam generator water level reactor trip setpoint reached 59.0 Rods begin to fall 61.0 Reactor coolant pumps begin to coast down 63.0 Automatic auxiliary feedwater from one of the motor-driven auxiliary feedwater pumps initiated 119.0 Operator action to establish auxiliary feedwater flow to remaining steam generators 661.0 Peak pressurizer water level occurs 785.0 65 of 338 IPEC00036372 IPEC00036372

IP3 FSAR UPDATE Table 14.1-15 NATURAL CIRCULATION REACTOR COOLANT FLOW VERSUS REACTOR POWER Reactor Power Reactor coolant Flow

% Full Power  % Nominal Flow 4.0 5.3 3.5 4.7 3.0 4.5 2.5 4.1 2.0 3.8 1.5 3.5 1.0 3.1 66 of 338 IPEC00036373 IPEC00036373

IP3 FSAR UPDATE 14.2 STANDBY SAFETY FEATURES ANALYSIS Adequate provisions were included in the design of the plant and its standby Engineered Safety Features to limit potential exposure of the public to well below the limits of 10 CFR 50;67 guidelines for situations which could conceivably involve uncontrolled releases of radioactive materials to the environment. Those situations which were considered are:

1) Fuel Handling Accidents

2) Accidental Release of Waste Liquid

3) Accidental Release of Waste Gases

4) Rupture of a Steam Generator Tube

5) Rupture of a Steam Pipe

6) Rupture of a Control Rod Drive Mechanism Housing - Rod Cluster Control Assembly (RCCA) Ejection 14.2.1 Fuel Handling Accidents The following fuel handling accidents were evaluated to ensure that no hazards are created:

1) A fuel assembly becomes stuck inside the reactor vessel

2) A fuel assembly or control rod cluster is dropped onto the floor of the reactor cavity

3) A fuel assembly is dropped onto the floor of the spent fuel pit

4) A fuel assembly becomes stuck in the penetration valve

5) A fuel assembly becomes stuck in the transfer carriage or the carriage becomes stuck Causes and Assumptions The possibility of a fuel handling incident is very remote because of the many administrative controls and physical limitations imposed on fuel handling operations. Prior to the transfer canal being opened, boron concentration in the coolant is raised to the refueling concentration and verified by sampling. The refueling cavity is filled with water meeting the same boric acid specifications.

After the vessel head is removed, the rod cluster control drive shafts are disconnected from their respective assemblies using the manipulator crane and the shaft unlatching tool. An appropriate device is used to indicate that the drive shaft is free of the control cluster as the lifting force is applied.

The fuel handling manipulators and hoists were designed so that fuel cannot be raised above a position which provides adequate shield water depth for the safety of operating personnel. This safety feature applies to handling facilities in both the Containment and in the spent fuel pit area. In the spent fuel pit, administrative controls and the design of storage racks and manipulation facilities are such that:

• Fuel at rest is positioned by restraints in an ever safe, always subcritical, geometrical array, with no credit for boric acid in the water.

• Fuel can be manipulated only one assembly at a time.

67 of 338 IPEC00036374 IPEC00036374

IP3 FSAR UPDATE

• Violation of procedures by placing one fuel assembly with any group of assemblies in racks will not result in criticality The spent fuel cask cannot be moved over any region of the spent fuel pit which is north of the spot in the pit that is reserved for the cask. Additionally, if the spent fuel pit contains irradiated fuel, loads in excess of 2,000 pounds are not moved over any region of the spent fuel pit, unless a technical analysis has been performed consistent with the requirements of NUREG-0612 establishing the necessary controls to assure that a load drop accident could damage no more than a single fuel assembly. Administrative and procedural controls to protect fuel and fuel racks may include path selection to prevent loads from passing over or near fuel. For cases in which very heavy loads (>30,000 pounds) are transported over the spent fuel pit, the load cannot under any circumstances pass over fresh or irradiated fuel. In all cases where loads>

2,000 poundsare carried over the pit, the ventilation system must be operable.

No movement of irradiated fuel in the reactor is made until the reactor has been subcritical for at least 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />. Movement of the spent fuel cask is also restricted to at least 90 days after the reactor has been subcritical, to minimize the consequences of an unlikely sideways cask drop.

A detailed description of crane movement limitations appears in Section 9.5.

Adequate cooling of fuel during underwater handling is provided by convective heat transfer to the surrounding water. The fuel assembly is immersed continuously while in the refueling cavity or spent fuel pit.

Even if a spent fuel assembly becomes stuck in the transfer tube, the fuel assembly is completely immersed and natural convection will maintain adequate cooling to remove the decay heat. The fuel handling equipment is described in detail in Section 9.5.

Two Nuclear Instrumentation System source range channels are continuously in operation and provide warning of any approach to criticality during refueling operations. This instrumentation provides a continuous audible signal in the Containment, and would annunciate a local horn and a horn and light in the Control Room if the count rate increased above a preset low level.

Refueling boron concentration is sufficient to maintain the clean, cold, fully loaded core subcritical by at least 5 percent with all Rod Cluster Control Assemblies inserted. The refueling cavity is filled with water with the same boric acid specifications.

All these safety features make the probability of a fuel handling incident very low. Nevertheless, it is possible that a fuel assembly could be dropped during handling operations. Therefore, this incident was analyzed both from the standpoint of radiation exposure and accidental criticality.

Special precautions are taken in all fuel handling operations to minimize the possibility of damage to fuel assemblies during transport to and from the spent fuel pit and during installation in the reactor. All handling operations on irradiated fuel are conducted under water. The handling tools used in the fuel handling operations are conservatively designed and the associated devices are of a fail-safe design.

In the fuel storage area, the fuel assemblies are spaced in a pattern which prevents any possibility of a criticality accident. Plant procedures require that, if the spent fuel pit contains irradiated fuel, loads weighing less than 2,000 pounds may be transported over the pit, provided that the boron concentration exceeds 1000 ppm and that any doors can be promptly closed in the* event of a load drop accident. Analyses show that a dropped load of less than 2,000 pounds is not expected to result in breach of fuel cladding for any assembly in the racks below.

68 of 338 IPEC00036375 IPEC00036375

IP3 FSAR UPDATE However, even if fuel rod cladding were to be damaged by a falling object, the design basis analysis for dropped fuel (which presumes complete destruction of one fuel assembly that has been subcritical for 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />) demonstrates that the subsequent dose would be within acceptable limits.

Transport of heavy loads (> 2,000 pounds) requires the preparation of a technical analysis consistent with the requirements of NUREG-0612 establishing the necessary controls to assure that a load drop accident could damage no more than a single fuel assembly. Administrative and procedural controls to protect fuel and fuel racks may include path selection to prevent loads from passing over or near fuel. For cases in which very heavy loads (> 30,000 pounds) are transported over the spent fuel pit, the load cannot under any circumstances pass over fresh or irradiated fuel. In all cases where loads> 2,000 pounds are carried over the pit, the ventilation system must be operable. When the overhead crane is not in use, inadvertent motion of the crane over the spent fuel racks is limited by administrative controls and / or installation of mechanical stops on the bridge crane rails. Additionally, administrative controls allow only one irradiated fuel assembly to be handled at a given time.

The motions of the cranes which move the fuel assemblies are limited to a low maximum speed.

Caution is exercised during fuel handling to prevent the fuel assembly from striking another fuel assembly or structures in the Containment or Fuel Storage Building.

The fuel handling equipment suspends the fuel assembly in the vertical position during fuel movements, except when the fuel is moved through the transport tube.

The design of the fuel assembly is such that the fuel rods are restrained by grids. The force transmitted to the fuel rods during normal handling is limited to the (grid frictional) restraining force and is not sufficient to breach the fuel rod cladding. If the fuel rods are not in contact with the fuel assembly bottom nozzle, the rods would have to slide against the grid friction force. This would dissipate an appreciable amount of energy and thus limit the impact force of the individual fuel rods.

If one assembly is lowered on top of another, no damage to the fuel rods would occur that would breach the cladding. Considerable deformation would have to occur before the fuel rods would contact the top nozzle adapter plate and apply any appreciable load to the rods. Based on the above, it is unlikely that any damage would occur to the individual fuel rods during handling.

If during handling and subsequent translatory motion the fuel assembly should strike against a flat surface, the fuel assembly lateral loads would be distributed axially along its length with reaction forces at the grids and essentially no damage would be expected in any fuel rods.

Analyses have been made assuming the extremely remote situations where a fuel assembly is dropped vertically and strikes a rigid surface and where one assembly is dropped vertically on another. The analysis of a dropped fuel assembly striking a rigid surface considered the stresses in the fuel cladding and any possible buckling of the fuel rods between the grid supports. The results showed that the buckling load at the bottom section of the fuel rod, which would receive the highest loading, was below the critical buckling load and the stresses were below the yield stress. For the case where one fuel assembly is assumed to be dropped on top of another assembly, the impact load is transmitted through the top nozzle and the RCC guide tubes of the struck assembly before any of the loads reach the fuel rods. As a result, a significant amount of kinetic energy is absorbed by the top nozzle of the struck assembly and the bottom nozzle of the falling assembly, thereby limiting the energy available for the fuel rod 69 of 338 IPEC00036376 IPEC00036376

IP3 FSAR UPDATE deformation. The results of this analysis indicated that the buckling load on the fuel rods was below the critical buckling load and stresses in the cladding were below yield.

In the event a fuel assembly is dropped while steam generator nozzle dams are in service, it must be determined promptly whether the fuel assembly would become exposed to the air should there be a loss of water in the reactor cavity. If so, then preparations shall be made to rapidly close any open steam generators should evidence of a nozzle dam leak appear, once Health Physics has determined it is safe to work in containment.

There is no credible scenario in the Spent Fuel Pit in which a dropped rod cluster control assembly (RCCA) can damage fuel cladding. Each fuel assembly in the pit is stored in a steel cell that encloses it on all four sides and shields the fuel pins from interaction with other objects.

Because an RCCA is much lighter than a fuel assembly, a falling RCCA cannot impact a fuel assembly top nozzle to the extent that the fuel pins underneath can be damaged.

The refueling operation experience that has been obtained with Westinghouse reactor has verified the fact that no fuel cladding integrity failures have occurred during any fuel handling operations. Prototype fuel assemblies have been subject to 3000 pounds of axial load without excessive lateral or axial deformation. The maximum column load expected to be experienced in service is approximately 1000 pounds. This information was used in the fuel handling equipment design to establish the limits for inadvertent axial loads.

For the purposes of evaluating the environmental consequences of a fuel handling incident, a conservative upper limit of damage was assumed by considering the rupture of one complete fuel assembly. The remaining fuel assemblies are so protected by the storage rack structure that no lateral bending loads would be imposed.

Activity Release Characteristics For the assumed accident there would be a sudden release of the gaseous fission products held in the voids between the pellets and cladding of one fuel assembly. The low temperature of the fuel during handling operations precludes further significant release of gases from the pellets themselves after the cladding is breached. Molecular halogen release is also greatly minimized due to their low volatility at these temperatures. The strong tendency for iodine in vapor and particulate form to be scrubbed out of gas bubbles during their ascent to the water surface further reduces the quantity released from the water surface.

An experimental test program(1) was conducted to evaluate the extent of iodine removal by the spent fuel pit water. Iodine removal from the release gas takes place as the gas rises through the body of solution in the spent fuel pit to the pool surface. The extent of iodine removal is determined by mass transfer from the gas phase to the surrounding liquid and is controlled by the bubble diameter and contact time of the bubble in the solution.

In order to obtain all the necessary information regarding this mass transfer process, a number of small scale tests were conducted using trace iodine and carbon dioxide in an inert carrier gas. Iodine testing was performed at the design basis solution conditions (temperature and chemistry), and data were collected for various bubble diameters and solutions depths. This work resulted in the formulation of a mathematical expression for the iodine Decontamination Factor (OF) in terms of bubble size and bubble rise time.

Similar tests were conducted with carbon dioxide in an inert carrier, except that the solution temperature and chemistry were patterned after that of a deep pool where large scale tests 70 of 338 IPEC00036377 IPEC00036377

IP3 FSAR UPDATE were also performed with carbon dioxide. The small scale carbon dioxide tests also resulted in a mathematical expression for DF in terms of bubble size and bubble rise time through the solution.

To complete the experimental program, a full-size fuel assembly simulator was fabricated and placed in a deep pool for testing, where gas released would be typical of that from the postulated damaged assembly. Tests were conducted with trace carbon dioxide in an inert carrier gas and overall DF's were measured as a function of the total gas volume released.

These measurements, combined with an analytical expression derived from small-scale tests with carbon dioxide, permitted an in situ measurement of the effective bubble diameter and rise time, both as a function of the volume of gas released. Having measured the characteristics of large-scale gas releases, the DF for iodine was obtained using the analytical expression from small scale iodine testing.

DF =73e O.313t1d (Reference 32)

Where:

t = rise time (sec) d = effective bubble diameter (cm)

The overall test results clearly indicate that iodine will be readily removed from the gas rising through the spent fuel pit solution and that the efficiency of removal will depend on the volume of gas released instantaneously from the full void space.

Fuel Handling Dose Analysis The consequences of an accident in which all rods in an assembly are breached under water in the spent fuel pit or in the refueling canal have been analyzed using the dose calculation model described in Appendix 14C. A listing of the accident inputs and assumptions are provided in Table 14.2-1. The analysis does not take creditfor either building hold up of the activity orfor removal of iodine by charcoal filters. The activity released from the damaged assembly is assumed to be released to the environment at a uniform rate over a two hour period.

In the analysis, conservative assumptions regarding fission product inventories and species distribution were made. The radial peaking factor (FLlH) applied to this assembly is 1.7. The decay time prior to fuel movement assumed in the fuel handling accident radiological consequences analysis is 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />.

Regulatory Guide 1,183 (Reference 38) states that the fission product gap fractions could potentially be:

1-131 0.08 Other lodines 0.05 KR-85 0.10 Other noble gases 0.05 However since it is projected that a high-burnup fuel assembly could exceed the parameters associated with the use of these gap fractions (i.e., burnup of >54,000 MWD/MTU combined with a maximum linear heat generation rate of >6.3 kW/ft) , more conservative gap fractions are used. With the exception of 1-131, the gap fractions are taken from Regulatory Guide 1.25 (Reference 20) which specifies a gap fraction of 0.30 for Kr-85 and 0.10 for all other noble gases and for iodines. The gap fraction for 1-131 is assumed to be 0.12 consistent with guidance from NUREG/CR-5009 (Reference 30) which specifies this increase.

71 of 338 IPEC00036378 IPEC00036378

IP3 FSAR UPDATE The iodine released from the assembly gap is assumed to be 99.85% elemental and 0.15%

organic. A value of 285 for the pool elemental iodine decontamination factor (DF) was conservatively assumed. A decontamination factor of 1;0 is modeled for organic iodine and noble gases. This results in an overall iodine DF of 200 for the iodine consistent with Reg.

Guide 1.183 guidance.

The activity released from the damaged assembly is assumed to. be released to the environment at a uniform rate over a two-hour period. Since no filtration or isolation of the release path is modeled, this analysis supports a potential fuel handling accident in either the containment or the fuel handling building.

The resulting doses are:

Site Boundary 5.7 rem TEDE Low Population Zone 2.1 rem TEDE Control Room 1.4 rem TEDE The offsite doses are below the dose acceptance limit of 6.3 rem TEDE specified in Reg. Guide 1.183 and the control room dose is below the 10 CFR 50.67 limit 015.0 rem TEDE.

Fuel Cask Drop Accident The exposure limits of 10 CFR 50.67 will not be exceeded by a spent fuel cask drop because the spent fuel cask is not moved over any region of the spent fuel pool which contains irradiated fuel. Mechanical stops incorporated on the bridge rails of the fuel storage building crane make it impossible for the bridge of the crane to travel further north than a point directly over the spot in the spent fuel pit that is reserved for the spent fuel cask. Therefore, it will be impossible to carry any object over the spent fuel storage areas north of the spot in the pit that is reserved for the cask with either the 40 or 5 ton hook of the fuel storage building crane. It is possible to use the fuel storage building crane to carry objects over the spent fuel storage areas that are directly east of the spot in the pit that is reserved for the cask. However, the FSAR and plant procedures prevent any object weighing more than 2,000 pounds from being moved over any region of the fuel pit. Therefore, the storage areas directly east of the spot in the pit that is reserved for the cask are protected from heavy load handling by administrative controls.

14.2.2 Accidental Release of Waste Liquid Accidents which would result in the release of radioactive liquids are those which may involve the rupture or leaking of system pipelines or storage tanks. The largest vessels are the three liquid holdup tanks (CVCS), each sized to hold two-thirds of the reactor coolant liquid volume.

The tanks are used to process the normal recycle or waste fluids produced. The contents of one tank will be passed through the liquid processing train while another tank is being filled.

All liquid waste components except the Reactor Coolant Drain Tank, Liquid Radwaste Processing System Skid and the waste holdup tanks are located in the Primary Auxiliary Building, and any leakage from the tank or piping will be collected in the building sump to be pumped back into the liquid waste system. One waste holdup tank and the liquid holdup tanks (CVCS) are located in a thick concrete underground vault. Two waste holdup tanks are located in the Liquid Radwaste Storage Building. The vault and building volumes are sufficient to hold the full volume of any tank without overflowing into areas outside the vault, building, or flooding pump motors in the adjoining compartment. The Reactor Coolant Drain Tank is located in the Containment Building. Holdup tanks are equipped with safety pressure relief and were 72 of 338 IPEC00036379 IPEC00036379

IP3 FSAR UPDATE designed to accept the established seismic forces at the site. Liquids in the Chemical and Volume Control System flowing into and out of these tanks are controlled by the manual valve operation as governed by prescribed administrative procedures.

The volume control tank design philosophy is similar in many respects to that applied for the holdup tanks. Level alarms, pressure relief valves, and automatic tank isolation and valve control assure that a safe condition is maintained during system operation. Excess letdown flow is directed to the holdup tanks via the Reactor Coolant Drain Tank.

Piping external to the Containment, running between the Containment and the Primary Auxiliary Building and between the Primary Auxiliary Building and the liquid holdup tank vault is run below grade in concrete trenches. Any liquid spillage from pipe rupture or leaks in these trenches would drain to sumps and / or the sump tank be pumped to the waste holdup tanks.

The incipient hazard from these process or waste liquid releases is derived only from the volatilized components. The releases are described and their effects summarized in Section 14.2.3.

No credible mechanism exists for accidental release of liquid wastes to the river. A river diffusion analysis was performed, however, to determine the concentrations which would result in the Chelsea reservoir if a release was assumed. The results of the analysis showed that even the instantaneous release of the entire primary coolant system maximum activity, corresponding to operation with 1% of fuel defects, would not result in peak concentrations at Chelsea in excess of 10 CFR 20 MPC limits. Drought conditions were assumed to exist at the time of and for a period following the spill, limiting the total runoff flow to 4000 cfs. The mean longitudinal diffusion coefficient corresponding to this flow was 8.74 square miles per day. These data represent a drought similar to conditions existing in late summer of 1964, which can be verified by data in Section 2.5.

The unlikely event of a loss of water from a spent resin storage tank actuates a low level alarm to warn the operator. Resin contained in the tank can then be cooled by periodically flushing water from the Primary Water Storage Tank through the resin. Two pathways are available for the water:

(a) through the primary storage water injection pipeline used when resin is removed from the tank, or (b) through the primary storage pipeline used when resin is sluiced from the demineralizers into the tank.

Conservative assumptions made to determine the frequency of flushing to cool the resin were:

1) The tank contains only the mixed bed resin from one mixed bed demineralizer discharge to the spent resin storage tank following operation of the plant for one cycle with 1% fuel defects. This assumption yields the maximum heat generation per unit volume of resin in the tank and the maximum level of radioactivity in the tank.

2) There are no heat losses through the tank walls.

73 of 338 IPEC00036380 IPEC00036380

IP3 FSAR UPDATE

3) Water is lost immediately following discharge of a mixed bed resin into the spent resin storage tank. This yields a maximum heat generation rate due to fission product decay.

These assumptions result in the following relationships:

1) The heat generation rate, q (Btu/hr), due to fission product decay is approximated closely as a function time, t (hours), by q = 178e-00116t +50e-O.00127t+37.5 where the first term is short-lived, the second intermediate-lived, and the last term a long-lived isotope contribution.

2) The mean heat capacity of resin is 0.31 Btu/lbOF

3) Resin volume is 25 fe consistent with assumption number (1) and with the coefficients of the heat generation formula given in item (1)

4) Resin specific gravity is 1.14 with a void fraction of 0.4 giving a resin density of 43 Iblft3

5) The amount of radioactivity in the tank is 21,250 curies.

On this basis, the resin bed temperature, T (OF) as a function of time (hours), is Where To is the initial resin temperature. If To is assumed to be gO°F, it will take four days for the bed temperature to rise to 140°F, the normal resin operating limit. At or below a temperature of 140°F, the radioactivity will not be released from the resin. The actual time to heat to 140°F will be greater than four days because of the of the conservative assumptions made in the calculation. The heat accumulated in the resin through the initial four days will be 18,750 Btu.

The bed can be maintained at 140°F or less by back flushing the resin with primary water at four day intervals. Flush water will be collected by the floor drain system and be pumped to the waste holdup tank. If a 10°F rise is taken in the flush water, the total quantity of water required will be about 250 gallons per back flush operation to remove the 18,750 Btu accumulated in the resin.

Hence, the loss of water from the spent resin storage tank presents no hazard offsite or onsite because means are available both to detect the situation occurring and to keep the resin temperature under control until the resin can be removed to burial facilities.

14.2.3 Accidental Release - Waste Gas The leakage of fission products through cladding defects can result in a buildup of radioactive gases in the reactor coolant. Based on experience with operational, closed cycle, pressurized water reactors, the number of defective fuel elements and the gaseous coolant activity is expected to be low. The shielding and sizing of components such as demineralizers and the 74 of 338 IPEC00036381 IPEC00036381

IP3 FSAR UPDATE Waste Handling System are based on activity corresponding to 1% defective fuel which is at least an order of magnitude greater than expected. Tanks accumulating significant qualities of radioactive gases during operation are the gas decay tanks, the volume control tank, and the liquid holdup tanks.

The volume control tank accumulates gases over a core cycle by the stripping action of the entering spray. Gaseous inventory for the tank, based on operation with 1% defective fuel, is tabulated in Table 14.2-2. During a refueling shutdown, this activity is vented to the waste gas system and stored for decay. Rupture of this tank is assumed to release all of the contained noble gases plus a small fraction of the iodine in the tank. Also, the noble gas activity and a fraction of the iodine activity contained in the letdown flow would be released. A maximum letdown flow of 120 gpm, plus ten percent for uncertainty, is assumed. The noble gas activity in the primary coolant is based on operation with one percent fuel defects (see Table 9.2-5) and the iodine concentration is assumed to be 1.0 jJCi/gm Dose-Equivalent 1-131 (see Table 14C-2).

The iodine concentration is assumed to be reduced by a factor of ten by the demineralizer in the letdown line and ten percent of the remaining iodine activity is assumed to be released to the atmosphere. The letdown line is assumed to be isolated after 30 minutes.

The liquid holdup tanks receive reactor coolant, after passing through demineralizers, during the process of coolant deboration. The liquid is stored and then discharged as waste. The contents of one tank are passed through the liquid processing train while another tank is being filled. In analyzing the consequence of rupture of a holdup tank, it is assumed that a single tank is filled to 80% of capacity using the letdown flow of 132 gpm (maximum purification flow plus 10%) and the primary coolant noble gas concentrations are those for operation with one-percent fuel defects. The iodine concentration in the flow to the holdup tank is assumed to be 0.1 f.lCi/gm of dose-equivalent 1-131 (this is ten-percent of the primary coolant equilibrium activity limit and this reduction is due to the 90% removal assumed to take place in the letdown line mixed-bed demineralizer. A major tank failure would be required to cause release of all the contained noble gas. Since the tanks operate at low pressure, approximately 2 psig, a gas phase leak would result in expUlsion of approximately 12% of the contained gases and then the pressure would be in equilibrium with the atmosphere. It is conservatively assumed that all of the contained noble gas activity and once percent of the iodine activity are released. The tank pits are vented to the ventilation system so that any gaseous leakage would be discharged to the atmosphere by this route. Any liquid leaks from the tanks or piping will be collected in the tank sump pit to be pumped back into the liquid waste system.

The waste gas decay tanks receive the radioactive gases from the radioactive liquids from the various laboratories and drains processed by the Waste Disposal System. The maximum storage of waste gases occurs after a refueling shutdown, at which time the gas decay tanks store the radioactive gases stripped from the reactor coolant. A radiation monitor counts activity in the gas decay tank sample going to the gas analyzer and an alarm is actuated if the activity approaches an operating limit of 50,000 Ci of dose equivalentXe-133 in any tank. As discussed in Section 11.1, six shutdown gas decay tanks are provided in addition to the four gas decay tanks used during power operation to reduce the gaseous activity release as a result of an assumed rupture of one of the tanks during the decay period following a refueling shutdown.

Dose Evaluation The Total Effective Dose Equivalent (TEDE) doses resulting from the failure of any of these tanks is calculated by combining the Effective Dose Equivalent (EDE) dose which is the acute 75 of 338 IPEC00036382 IPEC00036382

IP3 FSAR UPDATE dose resulting from the immersion in the cloud of activity and the Committed Effective Dose Equivalent (CEDE) dose which is the dose resulting from the inhalation and absorption of activity. The dose models are described in detail in Appendix 14 C.

The doses from these postulated failures are dominated by the release of noble gases and the contributions to the doses from iodine releases are relatively small. For the gas decay tank failure there is no release of iodine assumed.

The doses calculated for the tank failures are:

Site Boundary Low Population Control Room Dose (rem TEDE) Zone Dose (rem Dose (rem TEDE)

TEDE)

Volume Control 0.42 0.16 0.08 Tank Gas Decay Heat 0.32 0.12 0.1 Holdup Tank 0.38 0.14 0.1 The offsite dose are all less than 0.5 rem TEDE. The control room doses are all less than the 5.0 rem TEDE dose limit from 10 CFR 50.67.

14.2.4 Steam Generator Tube Rupture Accident Description The accident examined is the complete severance of a single generator tube. This accident is assumed to take place at power with reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system (RCS). In the event of a coincident loss of offsite power, or failure or unavailability of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator power-operated relief valves (and safety valves if their setpoint is reached).

The activity that is available for release from the secondary system is limitedby:

• Activities in the steam generator secondary that are a consequence of operation leakage prior to the complete tube rupture.

• The activity concentration in the reactor coolant.

• Operator actions to isolate the mixed primary and secondary leakage to atmosphere.

In view of the fact that the steam generator tube material is inconel 690, which is highly ductile material, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and accumulation of minor leaks from the Reactor Coolant System to the Steam 76 of 338 IPEC00036383 IPEC00036383

IP3 FSAR UPDATE Generator that exceeds the limits established in the Technical Specifications is not permitted during the reactor operation.

The operator is expected to determine that a steam generator tube rupture (SGTR) has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the ruptured steam generator. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale that ensures that break flow to the secondary steam is terminated before water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by the design basis tube rupture:

Pressurizer low pressure and low-level alarms are actuated and, prior to reactor trip, charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a steam flow/feedwater flow mismatch prior to reactor trip as feedwater flow to the affected steam generator is reduced due to the break flow that is now being supplied to that steam generator.

The secondary side radiation monitors will alarm, indicating a sharp increase in radioactivity in the secondary system, and a transfer signal is initiated which causes the air ejector exhaust to the atmosphere to be discharged to the containment.

Continued loss of reactor coolant inventory leads to a reactor trip signal generated by low pressurizer pressure or overtemperature L1T. A safety injection (SI) signal, initiated by low pressurizer pressure, follows soon after the reactor trip. The SI automatically terminates normal feedwater supply and initiates auxiliary feedwater (AFW) addition.

The reactor trip automatically trips the turbine and, if offsite power is available, the steam dump valves open permitting steam dump to the condenser. In the event of a coincident loss of offsite power and subsequent circulating water pump trip, the steam dump valves would automatically close to protect the condenser. In this case the steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator power-operated relief valves (and safety valves if their setpoint is reached).

Following reactor trip and SI actuation, the continued action of AFW supply and borated SI flow (supplied from the refueling water storage tank) provide a heat sink that absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of condenser steam dump capability, steam relief to the atmosphere.

SI flow results in stabilization of the RCS pressure and pressurizer water level and, if not for the operator's recovery actions, the RCS pressure trends toward the equilibrium value where the SI flow rate equals the break flow rate.

77 of 338 IPEC00036384 IPEC00036384

IP3 FSAR UPDATE Recovery In the event of an SGTR, the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR are provided in the Emergency Operating Procedures. The major operator actions include identification and isolation of the ruptured steam generator, cool down and depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary leakage. These operator actions are described below:

1. Identify the ruptured steam generator.

High secondary side activity, as indicated by the secondary side radiation monitors will typically provide the initial indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level, a high radiation indication on the corresponding air ejector monitor, or from a high radiation alarm in the steam generator blowdown liquid monitor. For a SGTR that results in a reactor trip at high power, the steam generator water level will initially decrease off-scale on the narrow range for all of the steam generators. The AFW flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will return to the narrow range earlier in that steam generator and will continue to increase more rapidly. This response, as indicated by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.

2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.

Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.

3. Cooldown the RCS using the intact steam generators.

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump to the condenser can be used to perform this cooldown. However, if offsite power is lost, the RCS is cooled using the power-operated relief valves (PORVs) on the intact steam generators.

4. Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped.

78 of 338 IPEC00036385 IPEC00036385

IP3 FSAR UPDATE The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.

5. Terminate SI to stop primary to secondary leakage.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed.

When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.

Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated and all immediate safety concerns will have been addressed.

At this time a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.

Results In determining the mass transfer from the RCS through the broken tube, the following conservative assumptions were made:

1) Reactor trip occurs automatically as a result of low pressurizer pressure.

2) The analysis assumes that following the initiation of the SI signal, all charging/SI pumps are actuated and continue to deliver flow for 30 minutes.

3) After reactor trip, the break flow reaches equilibrium at the point where incoming SI and charging flow is balanced by outgoing break flow as in Figure 14.2-1.

4) The steam generators are controlled at the safety valve setting with 3% tolerance and 15% blowdown rather than at the PORV setting.

The analysis assumes that the operator identifies the accident type and terminates break flow to the ruptured steam generator within 30 minutes of accident initiation. The analysis does not require that the operators demonstrate the ability to terminate break flow within 30 minutes from the start of the vent. It is recognized that the operators may not be able to terminate break flow within 30 minutes for all postulated SGTR events. The purpose of the calculation is to provide conservatively high mass-transfer rates for use in the radiological consequences analysis. This is achieved by assuming a constant break flow at the equilibrium flow rate for a relatively long time period. 30 minutes was selected for this purpose.

Sufficient indications and controls are provided at the control board to enable the. operator to complete these functions satisfactorily within 60 minutes for the design-basis event even without offsite power. In order to demonstrate that releases calculated with the 30 minute equilibrium 79 of 338 IPEC00036386 IPEC00036386

IP3 FSAR UPDATE break flow assumption are indeed conservative, an evaluation was performed with a licensed thermal-hydraulic analysis code modeling the operators response to the event. This evaluation modeled the operators identification and isolation of the ruptured steam generator, cooldown of the RCS by dumping steam from the intact steam generators; depressurization of theRCS using the pressurizer PORV and subsequent termination of SI. This evaluation demonstrated that although break flow was terminated at 60 minutes, the ruptured steam generator does not overfill and the mass transfer data calculated with the assumption of a constant break flow at the. equilibrium valve for 30 minutes from reactor trip is limiting as input to the radiological consequences analysis.

This evaluation does not change the formal design basis response time of 30 minutes. It does, however, justify extending the allowable time from 30 to 60 minutes for operator response in the affected Emergency Operating Procedures.

The above assumptions lead to conservative upper bound values of 138,000 pounds for the total amount of reactor coolant transferred to the ruptured steam generator and 72,000 pounds for the total amount of steam released to the atmosphere via the ruptured steam generator as a result of the steam generator tube rupture. A fraction of the break flow flashes directly into steam, while a portion mixes with the secondary liquid. This flashing fraction is calculated to be 21 % prior to reactor trip and 15% following reactor trip. Bounding values for the intact steam generator steam releases were calculated. They are 526,00 Ibm from start of event until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 1,160,000 Ibm from 8 to 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />. These releases conservatively consider that all stored energy and decay heat is removed via intact steam generator steaming rather than the RHR, until 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> from the start of the event.

The Indian Point 3 design basis assumes an operator response time of 30 minutes,as noted in Result 5 above. However, because it is possible that the operators may not be able to complete all required activities in the 30-minute time frame, a separate analysis was performed to quantify the impact of a delay in completing termi nation of break flow.

Westinghouse has prepared a re-analysis of the postulated Steam Generator Tube Rupture, increasing operator response time from 30 minutes to 60 minutes and allowing for the effect of increased charging flow and the potential for steam generator overfill. The analYSiS, which is applicable to ali 24-month cycles (as controlled by the surveillance requirements of Technical Specifications), relied on plant-specific models to demonstrate that the additional 30 minutes would neither result in steam generator overfill nor lead to doses in excess of regulatory requirements (35).

The effect on dose is a slight increase above the 2.3 rem thyroid and 0.71 rem whole-body dose (Site boundary) in the analysis of record, which is well below regulatory limits (30 rem thyroid and2.5 rem whole-body, which are 10% of the 10 CFR 100 requirements),

This provides assurance that, if the operators are unable to complete the termination of break flow within design basis time of 30 minutes, there is adequate margin in the analysis to allow for additional time to complete this task without exceeding regulatory limits.

Environmental Consequences of a Tube Rupture The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the RCS to the secondary system through the steam generators. A conservative analysis of the postulated steam generator tube rupture 80 of 338 IPEC00036387 IPEC00036387

IP3 FSAR UPDATE assumes a loss of offsite power and hence involves the release of steam from the secondary system. The following conservative assumptions were used to calculate the offsite power doses for the postulated steam generator rupture.

1) Both pre-accident and accident-initiated iodine spikes are analyzed. For the pre-accident iodine spike it is assumed that a reactor transient has occurred prior to the steam generator tube rupture and has raised the RCS iodine concentration to 60f.!Cilgm of dose equivalent (DE) 1-131 (see Table 14C-2). For the accident-initiated iodine spike, the reactor trip associated with the steam generator tube rupture creates an iodine spike in the RCS which increases the iodine release rate from fuel to the RCS to a value 335 times greater than the release rate corresponding to the maximum equilibrium RCS Technical Specification concentration of 1.0 f.!Ci/gm of DE 1-131 (see Table 14C-2). The duration of the accident-initiated iodine spike is 4.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.

2) The noble gas activity concentration in the RCS at the time the accident occurs is based on a fuel defect level of 1.0% (see Table 9.2.,5). This is approximately equal to the Technical Specification value of 100/E f.!Cilgm for gross radioactivity.

3) The iodine activity concentration in the secondary coolant at the time the steam generator tube rupture occurs is assumed to be 0.1 f.!Ci/gm of DE 1-131.

4) The amount of primary to secondary steam generator tube leakage in the intact steam generators is assumed to be equal to the Technical Specifications limit of 432 gpd per steam generator for a total of 1296 gpd.

5) Credit is taken for iodine removal from steam released to the condenser prior to reactor trip and concurrent loss of offsite power (an iodine partition factor of 0.01 is applied).

curies Isteam I gmsteam

6) An iodine partition factor in the steam generators of 0.01 is curies Il-liater I gmwater used.

7) All noble gas activity carried over to the secondary side is assumed to be immediately released to the atmosphere.

8) Thirty minutes after the postulated tube rupture accident the pressure between the faulted steam generator and the primary system is equalized. There are 38,500 Ibs of reactor coolant discharged to the secondary side of the faulted steam generator prior to reactor trip and an additional 99,500 Ibs between the reactor trip and 30 minutes. Also, until reactor trip occurs at 392 seconds, 1070.21 Ib/sec of steam is released from each steam generator to the condenser. Between the time of the reactor trip and 30 minutes into the event an additional 72,000 Ibs of steam is released from the faulted steam generator to the atmosphere.

9) The break flow flashing fraction is 0.21 prior to reactor trip and 0.15 after trip.

10) The steaming rate from the intact steam generators is:

i. Pre-trip 3210.63 Ib/sec ii. Trip - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 526,000 Ib/sec 81 of 338 IPEC00036388 IPEC00036388

IP3 FSAR UPDATE iii. 2 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1.16x106 Ib/sec iv. 8 - 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> 1.58x106Ib/sec

11) Auxiliary feedwater is available during the accident.

12) 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> after the accident the residual heat removal system is placed into operation.

13) 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> after the accident no further activity is released to the environment.

14) The atmospheric dispersion factors (XlO) at the site boundary and at the boundary of the low population zone, and at the control room air intake are given in Appendix 14C.

15) Control.room model inputs and assumptions are provided in Appendix 14C.

16) The oftsite breathing rates are:

0-8 hr 3.5x10-4 m3/sec 8 - 24 hr 1.8x10-4 m3 /sec

>24 hr 2.3x10- m3/sec 4

The calculated doses are:

Site Boundary Low Population Control Room Dose (rem TEDE) Zone Dose (rem Dose (rem TEDE)

TEDE)

Pre-Existing 1.9 2.2 Iodine Spike Accident Initiated 1.9 0.8 0.9 Iodine Spike The breathing rate used to calculate the thyroid dose for the accident is 3.47x1 0- 4 m3/sec.

14.2.4.6 Conclusion A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core. An orderly recovery from the accident can be completed, even assuming a simultaneous loss of offsite power.

The offsite doses for pre-existing spike case are less than 25 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183. The offiste doses for the accident-initiated spike case are less than 2.5 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183. The control room dose for each case is less than the 5.0 rem TEDE dose limit from 10 CFR 50.67 14.2.5 Rupture of a Steam Pipe 14.2.5.1 Discussion of Accident 82 of 338 IPEC00036389 IPEC00036389

IP3 FSAR UPDATE A rupture of a steam pipe results in an uncontrolled steam release from the steam generator.

The steam release results in an initial increase in steam inflow which decreases during the accident as the steam pressure falls. The energy removal from the Reactor Coolant System causes a reduction of coolant temperature and pressure. In the presence of a negative coolant temperature coefficient, the cooldown results in a reduction of core shutdown margin. If the most reactive RCCA is assumed stuck in its fully withdrawn position, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a potential problem mainly because of the high hot channel factors which exist when the most reactive assembly is assumed stuck in its fully withdrawn position.

Assuming the most pessimistic combination of circumstances which could lead to power generation following a steam line break, the core is ultimately shut down by boric acid injection delivered by the Emergency Core Cooling System.

The analysis of the Rupture of a Steam Pipe event bounds both hypothetical and credible steamline breaks. A hypothetical steamline break is defined as the double ended rupture of a main steamline. This event is classified as an ANS Condition IV event, a limiting fault. Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to the public health and safety in excess of guideline values of 10 CFR 50.67. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the Emergency Core Cooling System and Containment.

A credible steamline break is classified as an ANS Condition II event and is defined as a release of steam equivalent to the spurious opening, with failure to close, of the largest of any single steam bypass, relief or safety valve. The applicable Indian Point Unit 3 safety analysis licensing basis acceptance criteria for Condition II events are:

1. Pressures in the reactor coolant and main stream systems should be maintained below 110% of the design values,

2. Fueling Cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 limit, and

3. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The purpose of the analysis for the Rupture of a Steam Pipe event is to show that the applicable acceptance criteria for the given ANS Conditions are met for all the cases considered.

The acceptance criteria for hypothetical steamline breaks cases is conservatively demonstrated by showing that the more restrictive Condition II criterion for DNB is met. This ensures that there is no damage to the fuel cladding and no release of fission products from the fuel to the reactor coolant system. The acceptance criterion of no fuel rod failures for credible break case is also demonstrated by showing that no DNB occurs.

The following systems provide the necessary protection against a steam pipe rupture:

1. Safety Injection System actuation from any of the following:

83 of 338 IPEC00036390 IPEC00036390

IP3 FSAR UPDATE a) Two-out-of-three low pressurizer signals b) Two-out-of-three high differential pressure signals between steam lines c) High steam flow in two-out-of-four main steam lines (one-out-of-two per line), in coincidence with either low Reactor Coolant System average temperature (two-out-of-four loops) or low main steam line pressure (two-out-of-four lines) after a time delay (maximum of 6 seconds) d) Two-out-of-three high containment pressure signals e) High-High containment pressure (2 sets of two-out-of-three) [energize to actuate]

f) manual

2. The overpower reactor trips (high neutron flux and OP~T) and the reactor trip occurring in conjunction with receipt of the Safety Injection System.

3. Redundant isolation of the main feedwater lines: Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, any safety injection signal will rapidly close all feedwater control valves, (including the motor-operated block valves and low-flow bypass valves) trip the main feedwater pumps, and close the feedwater pump discharge valves.

4. Trip of the fast-acting Main Steam Isolation Valves (designed to close in less than 5 seconds) on:

a) High steam flow in two-out-of-four main steam lines (one-out-of-two per line), in coincidence with either low Reactor Coolant System average temperature (two-out-of-four loops) or low main steam line pressure (two-out-of-four lines) after a time delay. (maximum of 6 seconds) b) High-High containment pressure (2 sets of two-out-of-three). [energize to actuate]

Each steam line has a fast-closing Isolation Valve (MSIV) with a downstream reverse steam flow Check Valve (MSCV). These eight valves prevent blowdown of more than one steam generator for any main steamline break location even if one valve fails to close. For example, in the case of a break upstream of the MSIV in one main steam line, closure of either the MSCV in that line or the MSIV's in the other lines will prevent blowdown of the other steam generators. In particular, the arrangement precludes blowdown of more than one steam generator inside the Containment and thus prevents possible structural damage to the Containment. In addition, each of the steam generators have integral venturi type flow restrictors located at the steam generator outlet nozzle. These flow restrictors serve to limit the rate of steam release for postulated large steam breaks inside or outside containment.

14.2.5.2 Method of Analysis and Assumptions 84 of 338 IPEC00036391 IPEC00036391

IP3 FSAR UPDATE The Rupture of Steam Pipe transients are analyzed to determine: 1) the effects of the excessive cooldown on reactivity, reactor coolant system pressure, and reactor coolant system temperature for DNBR; and 2) the effects on primary-to-secondary heat transfer and secondary-side conditions for mass and energy release rates. The primary purpose of the analysis is to ensure that the required protection system features are adequate to prevent the applicable safety analysis limits from being exceeded.

Specifically, the analysis of a steam pipe rupture is performed to demonstrate that:

1) Assuming the highest worth RCCA is stuck out of the core with or without offsite power, and assuming a single failure in the engineered safety features, there is no consequential damage to the primary system and the core remains in place and intact.

2) Offsite radiation levels during the accident and post-accident control phase are acceptable (Condition IV criterion).

3) No fuel damage will occur for a credible steam line break equivalent to the spurious opening, with failure to close, of the largest of any single steam bypass, relief or safety valve (Condition II criterion).

4) Energy release to the Containment from the worst hypothetical steam line break does not cause failure of the containment structure (Condition IV criterion).

For items 1 through 3 above, the core heat flux, and the Reactor Coolant System temperature, pressure and flow transient conditions following a steam pipe rupture are determined using the RETRAN computer code (Reference 35). These transient conditions are then used to determine the thermal and hydraulic behavior of the core following a steam line break using the VIPRE computer code (Reference 36); a detailed thermal-hydraulic computer code used to determine if DNB occurs for the core conditions computed. The determination of the critical heat flux is based on local coolant conditions.

For item 4, the pressure conditions inside containment resulting from the mass and energy released to containment through the hypothetical steamline rupture are also considered. This analysis is documented in section 14.3.6.3 Core Response Analysis Two separate steam line rupture cases initiated from EOL, hot standby conditions were analyzed to determine the resulting core power and reactor coolant system transient conditions.

These cases are:

Case A- Steam pipe rupture (1.4ft2) with offsite power available.

Case B- Steam pipe rupture (1.4fe) without offsite power available.

Other pertinent analysis assumptions that affect the core response steamline break transient conditions are as follows.

Initial Conditions The plant is assumed to be operating at hot zero power (HZP) with reactor coolant system pressure equal to nominal reactor coolant system pressure of 2250psia, reactor coolant system 85 of 338 IPEC00036392 IPEC00036392

IP3 FSAR UPDATE flow rate equal to the Thermal Design Flow (TDF) rate of 354,400 gpm (total flow) a steam generator tube plugging level of 0%, reactor coolant system vessel average temperature equal to no-load Tavg of 54rF, and steam generator pressure equal to the no-load pressure of 1000psia.

HZP conditions were considered for all the above cases since this represents the most limiting initial conditions for the accident. Should the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection logic when the trip setpoint is reached. Following a trip at power the Reactor Coolant System contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steamline break before the no load conditions of Reactor Coolant System temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cool down and reactivity insertions proceed in the same manner as in the analysis which assumes no load conditions at time zero. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the Reactor Coolant System cooldown are less for steamline breaks occurring at power.

In the RETRAN model, the HZP initial power level is modeled at 0.01 of the nominal core power level of 3216 MWt.

Additionally the following initial conditions are modeled:

Initial pressurizer level of 23.1 % span Initial steam generator level of 45% NRS Initial core boron concentration of 0 ppm.

Shutdown Margin For the HZP initial conditions assumed in the steamline break core response analysis, the reactor is assumed to be tripped when the streamline break event occurs. All the RCCAs are assumed to be inserted with the exception of the highest worth RCCA, which is assumed to be stuck in a fully withdrawn position. With this initial configuration, the reactor is assumed to be subcritical by the minimum required 1.30% ~k amount of shutdown margin. This is the end-of-life design value including design margins at no load, equilibrium xenon conditions, with the most reactive RCCA stuck in its fully withdrawn position. The actual shutdown capability is expected to be significantly greater. The operation of the RCCA banks during the core burnup is restricted in such a way that addition of positive reactivity in a steamline break accident will not lead to a more adverse condition than the case analyzed.

Reactivity Coefficients The negative moderator coefficient of reactivity assumed is that corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. The Kef( versus coolant temperature corresponding to the negative moderator temperature coefficient used is shown in Figure 14.2-2. In computing the power generation following a steamline break, the local reactivity feedback from the high neutron flux in the region of the core near the stuck control rod assembly has been included in the overall reactivity balance. The local reactivity feedback is 86 of 338 IPEC00036393 IPEC00036393

IP3 FSAR UPDATE composed of the Doppler reactivity from the high fuel temperatures near the stuck RCCA. The effect of power generation in the core on the total core reactivity is shown in Figure 14.2-3 in the form of the Doppler power defect.

The moderator density coefficients and other physics parameters used in the RETRAN point-kinetics model are characteristic of end-of-life conditions and the resulting transient conditions calculated by RETRAN are confirmed to be conservative relative to predications made in confirmatory 3D physics models on a cycle-by-cycle reload basis.

For hypothetical breaks, the core properties associated with the sector nearest the faulted steam generator and those associated with the remaining sectors were conservatively combined to obtain average core properties for reactivity feedback calculations. A non-uniform radial weighting factor of 50% for the sector nearest the faulted steam generator, and 16.7%

each for the remaining three sectors of the core are assumed for the hypothetical steamline break cases to account for the non-uniform cooldown of the reactor coolant system. These conditions conservatively cause under-prediction of the Doppler reactivity feedback in the high power region near the stuck rod. For the power peaking factors, those corresponding to one stuck RCCA and non-uniform core inlet temperatures at end-of-life conditions are assumed. The coldest core inlet temperatures are assumed to occur in the sector with the stuck RCCA. The power peaking factors account for the effect of the local void in the region of the stuck RCCA during the return to power phase following the steamline break. This void in conjunction with the large negative moderator coefficient partially offsets the effects of the stuck RCCA. Since the power peaking factors depend on the core power, operating history, temperature, pressure and flow, they may differ from cycle to cycle.

To verify the conservatism of the assumptions used in the RETRAN point-kinetics reactivity feedback model, the reactivity as well as the power distribution are checked for the limiting statepoints of the cases analyzed. This analysis considers the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and non-uniform core inlet temperature effects in case of hypothetical breaks.

For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints. These results verify conservatism; i.e., over-prediction of positive reactivity from the cooldown and under-prediction of negative reactivity from power generation.

Offsite Power For the cases analyzed assuming offsite power is available, offsite power is assumed to be available throughout the transient which results in continuous reactor coolant pump operation such that full and constant thermal design flow rate is modeled throughout the event.

For the case analyzed, assuming a consequential loss of offsite power, the reactor coolant pumps are assumed to begin a conservative coastdown with the flywheel 3 seconds after event initiation. This results in reduction of reactor coolant system flow throughout the event (see Figure 14.2.-21).

Feedwater 87 of 338 IPEC00036394 IPEC00036394

IP3 FSAR UPDATE To maximize the cooldown following the steam line break event, a full and constant main feedwater flow was conservatively modeled for the hypothetical breaks. Nominal feedwater flow is assumed at the transient initiation and continues until the time of feedwater isolation which occurs after receipt of a safety injection signal. Feedwater isolation is assumed to occur 12 seconds after the safety injection signal is generated. The 12 second delay is a conservatively long time for signal processing, valve realignment, etc. A conservatively low initial feedwater enthalpy of 40.86 Btu/Ibm is assumed for the HZP initial conditions. This corresponds to a feedwater temperature of 70°F. A lower feedwater enthalpy is conservative for steamline break since it increases the magnitude of the cooldown associated with the steamline break event.

Auxiliary Feedwater Auxiliary feedwater flow is assumed to start at the transient initiation and continue throughout the transient to maximize the cooldown effects for core response. A flow rate of 1600gpm is assumed in all cases. This represents two motor driven auxiliary feedwater pumps with design flow rate of 400gpm each and one turbine pump with design flow rate of 800gpm. For the hypothetical steamline break cases, this total auxiliary feedwater flow is conservatively assumed to be delivered to the faulted steam generator.

The temperature of the auxiliary feedwater is conservatively assumed to be 35°F and an auxiliary feedwater purge volume of 1 fe is conservatively modeled.

For both steam line break cases, the auxiliary feedwater flow is not required to mitigate the consequences of the event, but is conservative to assume early delivery and maximized flow.

Safety Injection In the steamline break analyses, the following assumptions are made regarding the safety injection system:

1) Safety injection flow rates are conservatively calculated based on a composite modeling of the minimum SI flow resulting from either a failure of one train of safety injection or a failure of the cold leg branch line motor-operated valve. In all cases, the safety injection flow rates are calculated based on all cold legs injecting into the reactor coolant system.

The safety injection flow rate as function of reactor coolant system pressure is shown in Figure 14.2-4.

2) The refueling water storage tank (RWST) contains borated water with a minimum boron concentration of 2400 ppm and all of the safety injection lines downstream of the RWST, including the boron injection tank (BIT), contain unborated water.

3) A conservatively low enthalpy of 7.23 Btu/Ibm for the safety injection fluid in the RWST and the safety injection lines is assumed. This corresponds to 35°F. A lower enthalpy for the safety injection fluid is conservative since it increases and prolongs the cooldown of the reactor coolant system

4) A conservative time required to sweep the unborated water from the safety injection piping and BIT before delivering the 2400 ppm borated water from the RWST to the core is modeled.

88 of 338 IPEC00036395 IPEC00036395

IP3 FSAR UPDATE The sequence of events in the safety injection system are as follows:

1) For the cases where offsite power is assumed, after generation of the safety injection signal (including conservative delays for the instrumentation, logic, and signal transport),

the appropriate valves begin to operate and the high-head safety injection pumps start.

2) Within 12 seconds following (1) above, the valves are assumed to be in their final position to allow full safety injection flow, and the pumps are assumed to be at full speed. This 12 second delay had been based in part on the stroke times of BIT isolation valves. Now that BIT inlet and outlet isolation valves are maintained in the open position, there are no power operated valves in the High-Head SI flowpaths which require repositioning in response to a safety injection signal. Therefore, this 12 second delay represents a conservative assumption in the safety analysis and the pumps are assumed to be at full speed.

3) In the cases where offsite power is not available, an additional 10 seconds is assumed before (2) above to model the time required to start and load the necessary safety injection equipment onto the diesel generators.

4) For safety injection and steamline isolation signals actuated on high steam flow coincident with either low reactor coolant system average temperature or low steamline pressure, an additional time delay of 6 seconds is assumed after (1) above.

For actuation of the Safety Injection System and closing of the fast-acting Main Steam Isolation Valves previously discussed, the following setpoints were assumed in the analysis for the high steam flow coincidence logic.

1) A low steamline pressure setpoint of 460 psia including uncertainties to account for channel errors and adverse environmental errors.

2) A low Tavg setpoint of 535°F including uncertainty to account for channel errors.

3) A high steam flow safety injection setpoint of 78% of steam flow at full power including uncertainties for channel errors and adverse environmental errors For actuation of the Safety Injection System on a low pressurizer pressure signal, the low pressurizer pressure setpoint assumed in the analysis is 1648.7 psia, including uncertainties.

Instantaneous safety injection flow is assumed to occur whenever reactor coolant system pressure falls below safety injection pump head of 1414.7 psia at any time 2:: 12 seconds after the safety injection signal occurs.

The core response analyses of the steamline break cases assume a failed Main Steam Check Valve in the broken steamline. This conservative assumption results in additional cooldown of the Reactor Coolant System. The additional steam release out the break from the three intact steam generators continues until the MSIV's close in the intact steamlines.

Heat Transfer Modeling 89 of 338 IPEC00036396 IPEC00036396

IP3 FSAR UPDATE Fuel-to-coolant heat transfer coefficients consistent with limiting end-of-cycle conditions and conservatively representing minimum fuel temperatures are assumed in the analysis.

No credit is taken for heat transfer from the thick metal throughout the reactor coolant system to the coolant.

On the secondary-side, the Westinghouse Model 44F Steam Generators were modeled in the analysis.

Decay Heat No credit is taken for decay heat since this would inhibit the cool down of the reactor coolant system.

Steam Generator Water Entrainment Perfect moisture separation in the steam generators is assumed. This assumption leads to conservative results, especially for large breaks, since there would be considerable entrainment of the water in the steam generators following a steamline break. Entrainment of water would reduce the magnitude of the cooldown of the reactor coolant system.

Accident Simulation In determining the core power transients which can result from a steamline break, the following steamline break conditions were considered:

1) Complete severance of main steamline at the exit of the steam generator (down stream of the integral steam flow restrictors) with the plant initially at no-load conditions and all reactor coolant pumps running.

2) Case (1) above assuming a loss of offsite power resulting in a coolant pump coastdown 3 seconds following the steamline break.

These hypothetical steamline break cases represent the most severe Condition IV steamline breaks that can be postulated to occur.

Initial hot shutdown conditions were considered for all the above cases since this represents the most limiting initial conditions for the accident. Should the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection logic when the trip setpoint is reached. Following a trip at power the Reactor Coolant System contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel. Thus, additional stored energy is removed via the cool down caused by the steamline break before the no load conditions of Reactor Coolant System temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cool down and reactivity insertion proceed in the same manner as in the analysis which assumes no load conditions at time zero. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the Reactor Coolant System cooldown are less for steambreaks occurring at power.

90 of 338 IPEC00036397 IPEC00036397

IP3 FSAR UPDATE In computing the steam flow during a steamline break or the inadvertent opening of a steam safety valve, the Moody Curve (Reference 10) for f(UD) = 0 is used.

The break area assumed for hypothetical breaks downstream of the flow restrictor is 1.4fe per loop. This area bounds that of the steamline flow restrictor. All four steam generators are assumed to blow down to atmospheric pressure through their respective flow restrictors until steamline isolation occurs on the intact steam generators.

Results Core Power and Reactor Coolant System Transients Case A: Hypothetical Steam Pipe Rupture with Offsite Power Figures 14.2-5 through 14.2-14 show the transient conditions following a complete severance of a main steamline down stream of the integral steam flow restrictor with the plant initially at no-load conditions and all reactor coolant pumps running. The break assumed is the largest break that can occur anywhere inside or outside the containment. Offsite power is assumed available such that full reactor coolant flow exists. Since the plant is initially at no-load conditions, the transient shown assumes all RCCAs are inserted at time zero with the exception of the worst stuck RCCA (as previously described) being in a fully withdrawn position.

As shown in Figure 14.2-7, the core becomes critical with the rods inserted (with the design shutdown margin and assuming the highest worth stuck RCCA) at approximately 19 seconds.

The high steam flow setpoint is reached immediately in all four loops and the low Tav~ setpoint is reached in at least two loops at 11.5 seconds. The low pressurizer pressure SI setpoint is reached at 15.3 seconds. After considering appropriate time delays for processing the signal and electronics, at 17.3 seconds the actuation of safety injection on low pressurizer pressure is initiated. At 26.5 seconds, isolation of the intact steamlines via closure of the fast-acting Main Steam Isolation Valves is complete. Main feedwater isolation is complete at 57.3 seconds.

In addition, during a Main Steam line Break incident the MOVs associated with the FRVs also will close. These MOVs are powered from MCC 311. MCC 311 is not stripped from Bus 5A.

The mechanical stroke time of 120 seconds to close these associated MOVs has been analyzed and is acceptable.

At 29.3 seconds, full safety injection flow capability of the available safety injection pumps is reached. After purging unborated water from the safety injection lines down stream of the refueling water storage tank, borated water finally reaches the core at approximately 37 seconds after initiation of the steam line rupture event. The peak core average heat flux for this case is 10% of the nominal full power value of 3216 MWt as shown in Figure 14.2-6.

The sequence of events for this case is summarized in Table 14.2-5.

Case B: Hypothetical Steam Pipe Rupture with Loss of Offsite Case B is the same steamline break as that in Case A except that offsite power is assumed to be lost at the time of the break which results in a power loss to the reactor coolant pumps and subsequent reactor coolant system flow coastdown. The loss of offsite power also requires startup of the diesel generators in order to power the safety injection pumps.

91 of 338 IPEC00036398 IPEC00036398

IP3 FSAR UPDATE Figures 14.2-15 through 14.2-25 show the transient conditions for Case B. As shown in Figure 14.2-17, the core becomes critical with the rods inserted (with the design shutdown margin and assuming the worst stuck RCCA) at approximately 24 seconds. The high steam flow setpoint is reached immediately in all four loops and the low Tavg setpoint is reached in at least two loops at 12.6 seconds. The low pressurizer pressure SI setpoint is reached at 16.9 seconds.

After considering appropriate time delays for processing the signal and electronics, at 18.9 seconds the actuation of safety injection on low pressurizer pressure is initiated. At 27.6 seconds, isolation of the intact steamlines via closure of the fast-acting Main Steam Isolation Valves is complete. Main feedwater isolation is complete at 28.9 seconds. However, with the assumption of a loss of offsite power, diesel generator startup is required to power the safety injection pumps. A total of 24 seconds is assumed for diesel generator start and to get the safety injection pumps and valves aligned before reaching the full safety injection flow capability of the available safety injection pumps. At 41 seconds, full safety injection flow capability of the available safety injection pumps is reached. After purging the unborated water from the safety injection lines down stream of the refueling water storage tank, borated water finally reaches the core at approximately 75 seconds after initiation of the steamline rupture event. The peak core average heat flux for this case is 8.9% of the nominal value of 3216 MWt as shown in Figure 14.2-16.

Figure 14.2-21 shows the reactor coolant flow coastdown resulting from the loss of offsite power for this case. The sequence of events for this case are summarized in Table 14.2-6.

Margin to Critical Heat Flux Based on the transient conditions for Cases A and B, a DNBR evaluation was performed using the W-3 DNBR correlation. This evaluation showed that Case A (hypothetical steamline break with offsite power available) is the most limiting case with respect to minimum DNBR and the resulting minimum DNBR is greater than the applicable safety analysis DNBR limit. The minimum DNBR for this case was reached at approximately 50 seconds.

Containment Response The results for the analyses performed to determine the pressure response inside containment resulting from the steamline break mass and energy releases are contained in Section 14.3.6.

Conclusions Although DNB and possible clad perforation is acceptable for a Condition IV event, the Core Response analysis performed herein for the Rupture of a Steam Pipe event has demonstrated that DNB does not occur.

Hence, the analysis and evaluations contained herein for the Rupture of a Steam Pipe event demonstrate that all applicable Indian Point Unit 3 licensing basis safety analysis criteria are satisfied.

14.2.5.5 Dose Evaluation The assumptions and parameters for the steamline break accident dose analyses are given in Table 14.2-9. The dose calculation methodology from Appendix 14C is followed.

92 of 338 IPEC00036399 IPEC00036399

IP3 FSAR UPDATE Offsite Doses The calculated doses are:

Site Boundary Dose Low Population Zone (rem TEDE) Dose (rem TEDE)

Pre-Existing Iodine Spike 0.2 0.3 Accident-Initiated Iodine 0.5 0.8 Spike For the site boundary dose, the limiting 2-hour interval for the pre-existing spike case is 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and the limiting 2-hour interval for the accident-initiated spike case is 3-5 hours.

The offsite doses for the pre-existing spike case are less than 25 rem TEDE which is the dose acceptance limit defined in RegulatoryGuide 1.183. The offsite doses for the accident-initiated spike case are less than 2.5 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183 Control* Room Doses Using the assumptions and method of analysis presented in Appendix 14C for the control room dose analysis model, the doses in the Control Room following a main steam line break are given below.

Pre-Existing Iodine Spike 0.6 rem TEDE Accident-Initiated Iodine Spike 2.1 rem TEDE The control room dose for each case is less than 5.0 rem TEDE dose limit from 10 CFR 50.67.

14.2.5.6 Rupture Of a Control Rod Drive Mechanism Housing (RCC Assembly Ejection) 14.2.6.1 Description Of Accident This accident is a result of any extremely unlikely mechanical failure of a control rod mechanism pressure housing such that the Reactor Coolant System pressure would then eject the RCC assembly and drive shaft. The consequences of this mechanical failure, in addition to being a minor Loss-of-Coolant Accident, may also be a rapid reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage for severe cases.

The resultant core thermal power excursion is limited by the Doppler reactivity effect of the increased fuel temperature and terminated by reactor trip actuated by high neutron flux signals.

14.2.6.2 Design Precautions And Protection Certain features in Westinghouse pressurized water reactors are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur.

93 of 338 IPEC00036400 IPEC00036400

IP3 FSAR UPDATE These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCC assemblies and minimizes the number of assemblies inserted at high power levels.

Mechanical Design The mechanical design is discussed in Chapter 3. An evaluation of the mechanical design and quality control procedures indicates that a failure of a control rod mechanism housing sufficient to allow a control rod to be rapidly ejected from the core should not be considered credible for the following reasons:

1) Each Control Rod Mechanism (CORM) housing was completely assembled and shop-tested at 41 OOpsi for the full-length CORM housing.

2) The mechanism housing were field hydrotested to 3750psig during installation.

3) Stress levels in the mechanism are not affected by anticipated system transients at power or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class A components.

4) The latch mechanism housing and rod travel housing are type 304 stainless steel. The material exhibits excellent notch toughness at all temperatures that will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing and head adapter, and between the latch mechanism housing and rod travel housing are threaded joints reinforced by canopy type rod welds. Administrative procedures require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of the control rod mechanism housing is postulated, the operation of a chemical shim plant is such that the severity of an ejected RCC assembly is inherently limited.

In general, the reactor is operated with RCC assemblies inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control rod banks are selected during nuclear design to lessen the severity of an ejected assembly.

Therefore, should an RCC assembly be ejected from the reactor vessel during normal operation, there would probably be no reactivity excursion-since most of the RCC assemblies are fully withdrawn from the core-or a minor reactivity excursion if an inserted assembly is ejected from its normal position.

However, it may be desirable on occasion to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCC assemblies above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all assemblies is continuously indicated in the Control Room. An alarm will occur if a bank of RCC assemblies approaches its insertion limit or if one assembly 94 of 338 IPEC00036401 IPEC00036401

IP3 FSAR UPDATE deviates from its bank. There are low and low-low level insertion monitors with visual and audio signals. Operating instructions require boration at low level alarm and emergency boration at the low-low alarm. The RCC assembly position monitoring and alarm systems are described in detail in Chapter 7.

Reactor Protection The reactor protection in the event of a rod ejection accident is described in WCAP-7306. (3)

Effects On Adjacent Housings Disregarding the remote possibility of the occurrence of a control rod mechanism housing failure, investigations have shown that failure of a control rod housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings that would increase the severity of the initial accident.

14.2.6.3 Limiting Criteria Due to the extremely low probability of a rod ejection accident, some fuel damage could be considered an acceptable consequence, provided there is no possibility of the offsite consequences exceeding 25% the dose limit guidelines of 10 CFR 50.67 (this limitis identified in Regulatory Guide 1.183). Although severe fuel damage to a portion of the core may in fact be acceptable, it is difficult to treat this type of accident on a sound theoretical basis. For this reason, criteria for the threshold of fuel failure are established, and it is demonstrated that this limit will not be exceeded.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy, have been carried out as part of the SPERT project by the Idaho Nuclear Corporation.(4) Extensive tests of U02 -Zirconium clad fuel rods representative of those in PWR-type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT(5) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; a catastrophic failure. (large fuel dispersal, large pressure rise) event for irradiated rods did not occur following 300 cal/gm.

In view of the above experimental results, and due to the low probability of an RCCA Ejection, this accident is classified as a Condition IV event. The applicable Condition IV criteria are that the RCS and the core must remain able to provide long term cooling, and off-site doses must remain within the 25% of the dose guidelines of 10 CFR 50.67. The specific (and more restrictive) criteria that Westinghouse uses to ensure that the Condition IV criteria are met are as follows:

1) Average fuel pellet enthalpy at the hot spot must be below 200 cal/gm (360 Btu/Ibm),

2) Average clad temperature at the hot spot must remain below 3000°F (Reference 37),

3) Zirc-H 2 0 reaction is less than 16%,

95 of 338 IPEC00036402 IPEC00036402

IP3 FSAR UPDATE

4) Fuel melting will be limited to less than 10% of the fuel volume at the hot spot, and

5) The peak reactor coolant pressure must remain less than that which would cause stresses to exceed the Faulted Condition stress limits.

Criteria 2 and 3 are used by Westinghouse to demonstrate that the core remains in a coolable geometry during a Rod Ejection transient. However, the Nuclear Regulatory Commission (NRC) identifies Criterion 1 as the limit which ensures the core coolablity is maintained Criterion 5 is addressed generically for the RCCA Ejection event in Reference 6.

Method of Analysis and Assumptions The RCCA Ejection transient is simulated using TWINKLE and FACTRAN computer codes described in References 28 and 29. Cases are analyzed for four conditions; BOl-HZP, BOl-HFP, EOl-HZP, and EOl-HFP.

The following major assumptions are made in performing the RCCA Ejection analysis:

Initial Conditions:

HZP Cases HFP Cases Power level (fraction of nominal) o 1.02 RCS Pressure (psia) 2190 2190 Vessel Average Temperature (OF) 547.0 579.5 RCS Flow (fraction of TDF) 0.482 1.0 For the hot zero power cases, RCS flow is conservatively modeled at 46% of Thermal Design Flow (TDF), representing only two reactor coolant pumps in operation. An additional penalty of 0.0118 is applied to account for the affects of loop-to-Ioop ReS flow asymmetry due to steam generator tube plugging asymmetry. The full power cases assume 100% TDF representing all reactor coolant pumps in operation.

1) Peff, the delayed neutron fraction at BOl is equal to 0.0050 and Peff at EOl is equal to 0.0040.

2) Conservative values of trip reactivity are used assuming a stuck rod in addition to the ejected rod. These values are 4% .6.k for the full power cases and 2% .6.k for the zero power cases. Trip reactivity insertion is simulated by dropping a rod of the required worth into the core from full-out position. The rod drop time assumed is 2.7 seconds.

3) For the RCCA Ejection event, protection is provided by a power range High Flux reactor trip. The HFP cases are modeled to trip on a high setpoint of 118% of nominal, including uncertainties. A low setpoint of 35% nominal, including uncertainties, is modeled for the HZP cases.

4) The time delay after the trip setpoint is reached and before the rods start to fall is set to 0.55 seconds. This includes time for processing the trip signal, opening of the trip breaker and releasing of the rods from the coil.

96 of 338 IPEC00036403 IPEC00036403

IP3 FSAR UPDATE

5) No control systems are simulated.

6) The accident is initiated in the TWINKLE code by linearly changing the initial keff by an amount of equal to the worth of the ejected rod over a 0.1 second time span.

Table 14.2-11 provides additional input assumptions used in the analysis.

7) The following table summarizes the Ejected Rod Worths (% ~k), the transient hot channel factors (Fa's) and the Doppler Weighting Factors which were used in each of the Rod Ejection cases analyzed herein.

Ejected Rod Doppler Worth (%~k) Weighting Factor BOl-HZP 0.65 12.0 2.16 EOl-HZP 0.80 20.0 2.95 BOl-HFP 0.17 6.80 1.46 EOl-HFP 0.20 7.10 1.50 Results The sequence of events is provided in Table 14.2-10.

Figures 14.2-48 and 14.2-49 illustrate the fuel rod temperature and nuclear power transients for the EOl-HZP case; the case which results in the highest clad average temperature and magnitude of Zirc-H 2 0 reaction. Figures 14.2-50 and 14.2-51 illustrate the fuel rod temperature and nuclear power transients for the BOl-HFP case. The latter case results in the maximum fuel enthalpy of the four cases considered and has the highest amount of fuel exceeding the fuel melting temperature (4900°F at BOl).

A summary of the results are as follows:

Peak Avg. Fuel Peak Clad Avg. Zirc-H 2O Enthalpy T em perature* Fuel Melt* Reaction*

Case (Btu/Ibm) ---.LEl (%) ~

BOl-HZP 182.3 1892 0.00 0.32 EOl-HZP 228.9 2320 0.00 1.17 BOl-HFP 325.0 2256 7.78 0.88 EOl-HFP 312.7 2177 7.52 0.73 Limit <360.0 <3000 <10.0 <16.0

..

Additional results are presented In Table 14.2-12.

• Note: at the hot spot Environmental Consequences Analysis As a result of the accident, fuel clad damage and a small amount of fuel melt are assumed to occur. Due to the pressure differential between the primary and secondary systems, radioactive reactor coolant is discharged from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves 97 of 338 IPEC00036404 IPEC00036404

IP3 FSAR UPDATE or the main steam safety valves. Iodine and alkali metals group activity is contained in the secondary coolant prior to the accident, and some of this activity is also released to the atmosphere as a result of steaming the steam generators following the accident. Finally, radioactive reactor coolant is discharged to the containment via the spill from the opening in the reactor vessel head. A portion of this*radioactivity is released through containment leakage to the environment. The radiological consequences of this accident are determined using the analysis modeling described in Appendix 14C.

As a result of the rod ejection accident, less than 10% of the fuel rods in the core undergo DNB.

In determining the offsite doses following the rod ejection accident, it is conservatively assumed that 10% of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Consistent with Regulatory Guide 1.183, a gap fraction of 10%isassumed for iodine and noble gas activity. Additionally, 12% of the alkali metal activity is assumed to be in the gap.

The core activity is provided in Table 14C-4 and it is assumed that the damaged fuel rods have all been operating at the maximum radial peaking factor of 1.70.

A small fraction of the fuel in the failed fuel rods is assumed to melt as a result of the rod ejection accident. This amounts to 0.25% of the core and the melting takes place in the centerline of the affected rods. Consistent with Regulatory Guide 1.183, for the containment leakage release pathway 25% of the iodine activity and 100% of the noble gas activity are assumed to enter the containment but for the secondary system release pathway 50% of the iodine activity*and 100% of the noble gas activity are assumed. Additionally, for both pathways it is assumed that 100% of the alkali metal activity from the melted fuel is available for release.

The primary coolantiodine concentration is assumed to be at the equilibrium operating limit of 1.0fJCilgm of dose equivalent 1-131.

Regulatory Guide 1.183 specifies that the iodine released from the fuel is 95% particulate (cesium iodide), 4.85% elemental, and 0.15% organic. These fractions are used for the containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.

Conservatively, all the iodine; alkali metals group and noble gas activity (from the prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.

The primary to secondary steam generator tube leak used in the analysis is 1.0 gpm total far all steam generators combined.

When determining the doses due to containment leakage, all ofthe iodine, alkali metal and noble gas activity is assumed to be in the containment. The design bass is containment leak rate of 0.1% per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter, the containment leak rate is assumed to be one~half the design value, or 0.05% perday. Releases are continued for 30 days from start of the event.

No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concl,.lrrent loss of offsite power. All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the 98 of 338 IPEC00036405 IPEC00036405

IP3 FSAR UPDATE outside atmosphere. Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.

An iodine partition factor in the steam generators of 0.01 curies/gm steam per curries/gm water is used. A partition factor of 0.001 is used for the alkali metal activity in the steam generators.

For the containment leakage pathway, credit is taken for removal of aerosols (iodine in the aerosol form and alkali metals) by the filters in the fan cooler units (FCU). Three of the five FCUs are assumed to be in operation with a fraction of the flow (8000 cfm per FCU) directed through the filters. No credit is taken for the FCU charcoal filters. No credit is taken for sedimentation removal of aerosols or for deposition removal of elemental iodine onto containment surfaces. It is assumed that the containment spray system, which would remove both airborne particles and elemental iodine is not actuated.

The resulting offsite doses are:

Site Boundary 5.2 rem TEDE Low Population Zone 3.9 rem TEDE The limiting 2~hour dose interval for the site boundary dose determination is a -2 hours. The offsite doses are less than 25-percentof the value of 10 CFR 50.67 (less than 6.3 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183.

The accumulated dose to the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite doses and using the control room model discussed in Appendix 14C. The calculated control room dose is 1.6 rem TEDE. This is less than the 5.0 rem TEDE control room dose limit value of 10 CFR 50.67.

==

Conclusions:==

The results of the analysis of the RCCA Ejection event described herein show that all safety criteria are met. Specifically, the maximum clad average temperature is less than 3000°Fmaximum fuel enthalpy is less than 360 BTU/Ibm, fuel melting is less than 10%, and Zirc-H 2 0 reaction is less than 16%. These are all hot spot results.

The peak reactor coolant pressure, which is addressed generically for the RCCA Ejection event in Reference 6, remains less than that which cause stresses to exceed the Faulted Conditions stress limits.

Based on these results, concluded that the RCS and the core will remain able to provide long term cooling, and doses are within the acceptance limits.

References

1. Deleted

2. "MARVEL-A Digital Computer Code for Transient Analysis of a Multi-loop PWR System,"

WCAP-8844, November 1977.

99 of 338 IPEC00036406 IPEC00036406

IP3 FSAR UPDATE

3. Burnett, T.W.T., "Reactor Protection System Diversity in a Westinghouse Pressurized Water Reactor," WCAP-7306, April 1963

4. Taxelius, T.G., ed. "Annual Report-Spert Project, October 1968 September 1969," Idaho Nuclear Corporation TI D-4500, June 1970.

5. Liimatainen, R.C. and F.J. Testa, "Studies in TREAT of Zircaloy-2-clad, U02-Core Simulated Fuel Elements," Argonne National Laboratory, Chemical Engineering Division Semi-Annual Report, ANL-7225, January-June 1966.

6. Risher, D.H., "An Evaluation of the Rod Ejection Accident in Westinghouse PWR's Using Special Kinetics Methods," WCAP-7588, Rev. 1A,January 1975.

7. Henry, A.F. and A.V. Vota, "WlGLE2-A Program for the Solution of the One-Dimensional Two-Group, Space-Time Diffusion Equations Accounting for Temperature, Xenon and Control Feedback," WAPD-TM-532, October 1965.

8. French, R.J. et ai, "Indian Point Unit No.2 Rod Ejection Analysis," WCAP2940, May 1966.

9. Farman, R.F., J.O. Cerman, "Post DNB Heat Transfer During Blow-Down," WCAP-9005, Proprietary, October 1968.

10. Moody, F.S. Transactions of the ASME Journal of Heat Transfer, page 134, Figure 3 February 1965.

11. Tong, L.S. "Prediction of Departure from Nucleate Boiling for an Axially Non-Uniform Heat Flux Distribution," Journal of Nuclear Energy, Volume 21, 1967.

12. "Reload Safety Evaluation - Indian Point Nuclear Plant Unit 3, Cycle 3," dated August, 1979.

13. "Reload Safety Evaluation, Indian Point Nuclear Plant Unit 3, Cycle 2." February, 1978

14. T.W. T. Burnett, Et aI., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary),

WCAP-7907-A (Non-Proprietary), April 1984.

15. Hochreiter, L.. E., Chelmer, H., Chu, P.T., "THINC IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores," WCAP-7956, June 1973.

16. Deleted

17. WCAP-12269, "Containment Margin Improvement Analysis For Indian Point Unit 3," May 1989.

18. WCAP-12313, "Safety Evaluation for An Ultimate Heat Sink Temperature Increase to 95°F at Indian Point Unit 3," July 1989.

19. NYPA Corporate Radiological Engineering Calculation IP3-CALC-RAD-00007, "Replacement of R11/R12 Containment Radiation Monitors- Impact on FSAR Analysis of a Fuel Handling Accident," March 3, 1992.

100 of 338 IPEC00036407 IPEC00036407

IP3 FSAR UPDATE

20. US NRC Regulatory Guide 1.25, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility of Boiling Water and Pressurized Water Reactors," March 23, 1972.

21. Deleted

22. Deleted

23. Deleted

24. Deleted

25. SECL-92-131, "High Head Safety Injection Flow Changes Safety Evaluation,"

Westinghouse Electric Corp., June 1992.

26. SECL-92-255, "Feedwater Regulating Valve Stroke Time Change Safety Evaluation,"

Westinghouse, November 1992.

27. SECL-97-135, "Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties," Westinghouse March 1998.

28. Risher, D.H., Jr. and Barry, R.F., "TWINKLE-A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary),

January 1975.

29. Hargrove, H.G., "FACTRAN-A Fortran IV Code for Thermal Transients in the U02 Fuel Rod," WCAP-7908-A, December 1989.

30. Baker, DA et aI., "Assessment of the Use of Extended Burnup Fuel in Light Water Reactors," NUREG/CR-5009, February 1988.

31. Deleted

32. WCAP-7828, "Radiological Consequences of a Fuel Handling Accident"

33. SAE-TA-99-292, NON-LOCA Evaluation of 4 Percent PSV Setpoint Tolerance for IP3, Rev. 0, Westinghouse Electric Company, October 1999.

34. Westinghouse Letter INT-99-254, "SLB Inside Containment Sensitivities for FCV Failure," October 8, 1999.

35. D. S. Huegel, et aI., "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis," WCAP-14882-P-A (Proprietary) ,WCAP-15234-A (Non-Proprietary), April 1999.

36. Y. X. Sung, et aI., "Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," WCAP-14565-A (Proprietary), WCAP-15306 (Non-Proprietary), October 1999.

101 of 338 IPEC00036408 IPEC00036408

IP3 FSAR UPDATE

37. Letter from W. J. Johnson of Westinghouse Electric Corporation to Mr. R. C. Jones of the Nuclear Regulatory Commission, Letter Number NS-NRC-89-3466, "Use of 270QoF PCT Acceptance Limit in Non-LOCA Accidents," October 23, 1999.

38. US NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.

102 of 338 IPEC00036409 IPEC00036409

IP3 FSAR UPDATE Table 14.2-1 Assumptions and Parameters for the Fuel Handling Accident Analysis

1. Core inventory at 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> after shutdown; 1-130 3.41 E4 Curies 1-131 6.90E7 1-132 6. 38E7 1-133 1.17E7 1-134 0.0 1-135 2.63E4 Kr-85m 5.62E1 Kr-85 1.11 E6 Kr-87 0.0 Kr-88 0.0 Xe-131m 9.71E5 Xe-133m 2.78E6 Xe-133 1.36E8 Xe-135m 4.21E3 Xe-135 7. 86E5 Xe-138 0.0

2. Number of assemblies in the reactor core = 193.

3. All fuel pins in the dropped fuel assembly are broken.

4. Decay time experienced prior to fuel movement = 84 hrs.

5. Atmospheric dispersion factor (offsite and for control room air intake) are provided in Appendix 14C.

6. Operating power in the damaged assembly is 1.70 times core average (this is the design radial peaking factor for the VANTAGE+ fuel).

7. The fission product gap fractions are assumed to be ten percent of all nuclides except Kr-85 which is assumed to be 30 percent and 1-131 which is assumed to be 12 percent.

This is consistent with Reg. Guide 1.25 as modified by NUREG/CR-5009.

8. The iodine is 99.85 percent cesium iodide which is assumed to immediately convert to the elemental form and 0.15 percent organic (this is consistent with Reg. Guide 1.183).

9. There is scrubbing removal of the elemental iodine in the water pool. The overall decontamination factor achieved by scrubbing is assumed to be 200 (consistent with Reg. Guide 1.183).

10. The breathing rate is 3.5E-4 m3 /sec (consistent with Reg. Guide 1.183).

11. For the accident postulated to occur in the spent fuel pit, no credit is taken for the fact that releases to the environment would pass through charcoal filters.

103 of 338 IPEC00036410 IPEC00036410

IP3 FSAR UPDATE

12. For the accident postulated to occur inside the containment, credit is not taken for isolation on the containment purge.

13. For the accident postulated to occur inside the containment, no credit is taken for the fact that releases to the environment would pass through the charcoal filter.

14. The nuclide decay constants and dose conversion factors are given in Appendix 14C.

15. Control room modeling assumptions are detailed in Appendix 14C.

104 of 338 IPEC00036411 IPEC00036411

IP3 FSAR UPDATE Table 14.2-2 Volume Control Tank Noble Gas Activity Isotope ActivityJ.Ql}

Kr-85m 1.61E2 Kr-85 2.24E2 Kr-87 4.96E1 Kr-88 2.40E2 Xe-131m 3.95E2 Xe-133m 4.18E2 Xe-133 3.04E4 Xe-135m 7.54E1 Xe-135 9. 57E2 Xe-138 6. 68 EO Tables 14.2-3 & 14.2-4 Deleted 105 of 338 IPEC00036412 IPEC00036412

IP3 FSAR UPDATE Table 14.2-5 Sequence of Events For the Rupture of a Steam Pipe Event Hypothetical Steamline Break With Offsite Power EVENT Time, Seconds Double-Ended Steamline Rupture in Loop 1 (1.4fe) 0.00 High Steamline Flow Setpoint Reached (2/4 loops) 0.25 HighSteamline Flow Signal Generated (2/4 loops) 8.25 Low-Low Tavg Setpoint Reached in Loop 1 8.81 Low-Low Tavg Setpoi nt Reached in Loop 2 11.53 Low Pressurizer Pressure SI Setpoint Reached 15.29 Low-Low Tavg Signal Generated in Loop 1 16.81 Safety Injection and FWI Actuation due to Lower Pressurizer Pressure 17.29 Low-Low Tavg Signal Generated in Loop 2 19.53 SLI Actuation due to Coincidence of Low-Low Tavg (2/4 loops) I 19.54 High Steam Flow (2/4 loops) ESF MSIV Closure Loops 1,2,3, and 4 26.44(1)

MFIV Closure Loops 1,2,3, and 4 27.19(1)

Safety Injection Flow Initiated 29.31 Peak Core Heat Flux Occurs 39.80 Note: Plus an additional 0.1 second for valve closure time.

106 of 338 IPEC00036413 IPEC00036413

IP3 FSAR UPDATE Table 14.2-6 Sequence of Events For the Rupture of a Steam Pipe Event Hypothetical Steamline Break With Loss of Offsite Power Event Time, Seconds Double-Ended Steamline Rupture in Loop 1 (1.4fe) 0.00 High Steamline Flow Setpoint Reached (2/4 loops) 0.25 Loss of Offsite Power (RCPs begin coasting down) 3.00 High Steamline Flow Signal Generated (2/4 loops) 8.25 Low-Low Tavg Setpoint Reached in Loop 1 9.24 Low-Low Tavg Setpoint Reached in Loop 2 12.56 Low Pressurizer Pressure SI Setpoint Reached 16.94 Low-Low Tavg Signal Generated in Loop 1 17.24 Safety Injection and FWI Actuation due to Low Pressurizer Pressure 18.94 Low-Low Tavg Signal Generated in Loop 2 20.56 SLI Actuation due to Coincidence of Low-Low Tav9 (2/4 loops) I 20.57 High Steam Flow (2/4 loops) ESF MSIV Closure Loops 1,2,3 and4 27.47(1)

MISIV Closure Loops 1, 2, 3 and 4 28.84(1)

Safety Injection Flow Initiated 40.95 Peak Core Heat Flux Occurs 67.72 Note:1. Plus an additional 0.1 second for valve closure time.

107 of 338 IPEC00036414 IPEC00036414

IP3 FSAR UPDATE Tables 14.2-7 & 14.2-8 Deleted 108 of 338 IPEC00036415 IPEC00036415

IP3 FSAR UPDATE Table 14.2-9 Initial Conditions and Input Data For Steam Pipe Rupture Dose Analysis Source Term Nuclide Parameters See Table 14C-5 Primary Coolant Noble Gas Activity prior to Accident Based on operation with 1.0% Fuel Defects (See Table 9.2-5)

Primary Coolant Iodine Activity prior to Accident Pre-Existing Spike 60 I-lCi/gm of DE 1-131 (See Table 14C-2)

Accident-Initiated Spike I-lCi/gm of DE 1-131 (See Table 14C-2)

Primary Coolant Iodine Appearance Rate Increase Due to 500 times equilibrium rate the Accident-Initiated Spike (See Table 14C-3)

Duration of Accident-Initiated Spike 3.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> Secondary Coolant Iodine Activity prior to Accident 0.1 I-lCilgm of DE 1-131 Iodine Chemical Form after Release to Atmosphere Elemental 97%

Organic 3%

Particulate (cesium iodide) 0%

Release Modeling Faulted SG Tube Leak Rate 432 gpd Intact SG Tube Leak Rate (for all 3 SGs) 1008 gpd SG Iodine SteamlWater Partition Coefficient Intact SG 0.01 Faulted SG 1.0 Time for RHR to take over cooling 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> Time to Cool RCS Below 212°F and Stop Releases from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Faulted SG Steam Release from Intact SGs to Enviroment 0-2 hours 402,000 Ibm 2-29 hours 2,273,500 Ibm Steam Release from Faulted SG to Enviroment (during 142,400 Ibm first 5 minutes)

Primary Coolant Mass 1.96E8 gm Intact Steam Generator Secondary Mass 70,400Ibm/SG Faulted Steam Generator Secondary Mass 142,400 Ibm Offsite Atmospheric Factors See Table 14C-6 Offsite Breathing Rates 0-8 hours 3.5E-4 m3/sec 8-24 hours 1.8E-4 m3/sec

>24 hours 2.3E-4 m3/sec Control Room Model See Appendix 14C Time to Start Crediting Emergency Control Room HVAC 1 minute 109 of 338 IPEC00036416 IPEC00036416

IP3 FSAR UPDATE Table 14.2-10 Sequence of Events RCCA Ejection (All Times in Seconds)

BOL-HZP EOL-HZP BOL-HFP EOL-HFP RCCA Ejected 0.0 0.0 0.0 0.0 Reactor Trip 0.34 0.18 0.05 0.04 Setpoint Reached Peak Nuclear Power 0.40 0.21 0.13 0.13 Rods Drop 0.89 0.73 0.60 0.59 Peak Fuel Average 2.65 1.78 2.36 2.48 Temperature Occurs Peak Clad 2.52 1.56 2.46 2.56 Temperature Occurs 110 of 338 IPEC00036417 IPEC00036417

IP3 FSAR UPDATE Table 14.2-11 PARAMETERS FOR RCC ASSEMBLY EJECTION ANALYSIS Time in Life BOL BOL EOL EOL Power Level, % 0 102 0 102 Ejected rod worth, %dk 0.65 0.17 0.80 0.20 Delayed neutron fraction, % 0.50 0.50 0040 0.40 Feedback reactivity weighting 2.16 1.46 2.95 1.5 Trip Reactivity, % dk.lk 2.0 4.0 2.0 4.0 Initial Hot spot gap heat transfer coefficient, Btu/hr-ft2-F 460

• 460

• Transient hot spot gap heat transfer coefficient, Btu/hr-ft2-F 10,000 10,000 10,000 10,000 Initial moderator density coefficient, +0.04 +0.04 +0.27 +0.27 dk/gm/cm3 Fq before rod 2.56 2.56 ejection Fq after rod 12.0 6.8 20.0 7.1 ejection Number of pumps 2 4 2 4

• This value automatically calculated to satisfy initial temperature distributions 111 of 338 IPEC00036418 IPEC00036418

IP3 FSAR UPDATE Table 14.2-12 Deleted 112 of 338 IPEC00036419 IPEC00036419

IP3 FSAR UPDATE Table 14.2-13

SUMMARY

OF ROD EJECTION ANALYSIS PARAMETERS AND RESULTS Time in cycle Accident Parameters Beginning Beginning End End Initial Power, % Rated 0 102 0 102 Power Ejected Rod Worth, % Dklk 0.65 0.17 0.80 0.20 Delayed Neutron Fraction .0050 .0050 0.0040 0.0040 (beft)

FQ during Event 12.0 6.8 20.0 7.1 Results Max Fuel Centerline 2900 (1 ) 3425 (1)

Temperature (OF)

Max. Clad Average 1892 2256 2320 2177 Temperature (OF)

Max Fuel Enthalpy 182.3 325.0 228.9 312.7 (1) Less than 10% fuel centerline melt at the fuel hot spot.

Note: Fore each fuel cycle, the specific rod ejection kinetics are calculated to show compliance with analytical limits. This is documented in the cycle-specific Reload Safety Evaluation.

113 of 338 IPEC00036420 IPEC00036420

IP3 FSAR UPDATE 14.3 LOSS-OF-COOLANT-ACCIDENTS 14.3.1 Identification of Causes and Frequency Classification A Loss-of-Coolant Accident (LOCA) is the result of a pipe rupture of the Reactor Coolant System (RCS) pressure boundary. A major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0 fe. This event is considered a limiting fault, an ANS Condition IV event, in that it is not expected to occur during the lifetime of the plant, but is postulated as a conservative design basis.

A minor pipe break (small break) is defined as a rupture of the RCS pressure boundary with a total cross-sectional area less than 1.0 te, in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered an ANS Condition III event in that it is an infrequent fault that may occur during the life of the plant.

A leak (smaller than a break) can be compensated by the charging system.

It must be demonstrated that there is a high level of probability that the Acceptance Criteria for the LOCA as described in 10 CFR 50.46 (Reference 1) are met.

1) There is a high level of probability that the peak cladding temperature (PCT). shall not exceed 2200°F.

2) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react.

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling. This requirement is met by demonstrating that the PCT does not exceed 2200°F, the maximum local oxidation does not exceed 17%, and the seismic and LOCAforces are not suffiCient to distort the fuel assemblies to the extent that the core cannot be COOled.

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core.

These criteria were established to provide significant margin in ECCS performance following a LOCA.

Reference 2 presents a study in regard to the probability of occurrence of RCS pipe ruptures.

In most cases, small breaks (less than 1.0 ff) yield results with more margin to the acceptance criteria limits than large breaks.

14.3.2 Sequence of Events and Systems Response Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection actuation signal is generated when the appropriate setpoint is reached. These actions will limit the consequences of the accident in two ways:

114 of 338 IPEC00036421 IPEC00036421

IP3 FSAR UPDATE

1) Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat. An average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA core remains subcritical. However, no credit is taken for the insertion of control rods to shut down the reactor in the large break analysis.

2) Injection of borated water provides for heat transfer from the core and prevents excessive clad temperature.

Description of Large Break LOCA Transient Before the break occurs, the reactor is assumed to be ina full power equilibrium condition, i.e., the heat generated in the core is being removed through the steam generator secondary system. At the beginning of the blowdown phase, the entire RCS contains sub-cooled liquid (except for pressurizer, which is at Tsat) which transfers heat from the core by forced convection with some fully developed nucleate boiling. During blowdown, heat from fission product decay, hot internals and the vessel, continues to be transferred to the reactor coolant. After the break develops, the time to departure from nucleate boiling is calculated. Thereafter, the core heat transfer is unstable, with both nucleate boiling and film boiling occurring. As the core becomes voided, both transition boiling and forced convection are considered as the dominant core heat transfer mechanisms. Heattransfer due to radiation is also considered.

The heat transfer between the RCS and the secondary system may be in either direction, depending on the relative temperatures. In the case of the large break LOCA, the primary pressure rapidly decreases below the secondary system pressure and the steam generators are an additional heat source. In the Indian Point 3 Nuclear Power Plant Large Break LOCA analysis using the Best-Estimate methodology, the steam generator secondary is conservatively assumed to be isolated (main feedwaterand steam line) at the initiation of the event to maximize the secondary side heat load.

Performance Criteria for Emergency Core Cooling System The reactor is* designed to withstand thermal effects caused by a loss-of-coolant accident including the double-ended severance of the largest reactor cooling system cold leg pipe. The reactor core and internals together with the Emergency Core Cooling System (ECCS) are designed so that the reactor can be safely shut-down and the essential heat transfer geometry of the core preserved following the accident. Long-term coolability is maintained.

When the RGS depressurizes to approximately 674.7 psia (nominal), the accumulators begin to inject borated water into the reactor coolant loops. Borated water from the accumulator in the broken loop is assumed to spill to containment and be unavailable for core cooling for breaks in the cold leg of the RGS. Flow from the accumulators in the intact loops may not reach the core during depressurization of the RCS due to the fluid dynamics present during the ECGS bypass period. EGCS bypass results from the momentum of the fluid flow up the downcomer due to a break in the cold leg, which entrains EGCS *flow out toward the break. Bypass of the EGCS diminishes as mechanisms responsible for the bypassing are calculated to be no longer effective.

The blowdown phase of the transient ends when the RCS pressure reaches approximately 40 psia.

After the end ofthe blowdown, refill of the reactor vessel lower plenum begins. Refill is completed when emergency core cooling water has filled the lower plenum of the reactor vessel, which is 115 of 338 IPEC00036422 IPEC00036422

IP3 FSAR UPDATE bounded by the bottomofthe active fuel region of the fuel rods (called bottom of core (BOC) recovery time).

The reflood phase of the transient is defined as the time period lasting from BOC recovery until the reactor vessel has been filled with water to the extent that the core temperature rise has been terminated. From the latter stage of blowdown and on into the beginning of reflood, the intact loop accumulator tanks rapidly discharges borated cooling water into the RCS. Although a portion injected prior to end of bypass is lost out the cold leg break, the accumulators eventually contribute to the filling of the reactor vessel downcomer. The downcomer water elevation head provides the driving force required for the reflooding of the reactor core. The safety injection from the high head safety injection (HHSI) pumps and low head safety injection (LHSI) pump aid in the filling of the downcomer and core and subsequently supply water to help maintain a full downcomer and complete the reflooding process.

Continued operation of the ECCS pumps supplies water during long-term cooling. Core temperatures have been reduced to long-term steady state levels associated with dissipation of residual heat generation. After the water level of the refueling water storage tank (RWST) reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching from the injection mode to the sump recirculation mode of ECCS operation. Spilled borated water is drawn from the engineered safety features (ESF) containment sumps by the LHSI pump and returned to the RCS cold legs. Figure 14.3-1 contains a schematic of a representative sequence of events for the Indian Point 3 Nuclear Power Plant Best-Estimate large break LOCA transient.

For the Best-Estimate large break LOCA analysis, one ECCS train, including two high head safety injection (HHSI) pumps and one low head safety injection (LHSI) pump, starts and delivers flow through the injection lines. The accumulator and safety injection flows from the broken loop were assumed to spill to containment. All emergency diesel generators (EDGs) are assumed to start in the modeling of the containment spray pumps and fan coolers. Modeling full containment heat removal systems operation is required by Branch Technical Position CSB 6-1 (Reference 13) and is conservative for the large break LOCA.

To minimize delivery to the reactor, the HHSI and LHSI branch line chosen to spill is selected as the one with the minimum resistance.

Description of Small Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA there are only three characteristic stages, i.e., a gradual blowdown in which the decrease in water level is checked, core recovery, and long-term recirculation.

For small break LOCAs, the most limiting single active failure is the one that results in the minimum ECCS flow delivered to the RCS. This has been determined to be the loss of an emergency power train which results in the loss of one complete train of ECCS components. This means that credit was taken for two out of three high head safety injection pumps. During the small break transient, two high head pumps are assumed to start and deliver flow into all four loops. The flow to the broken loop was conservatively* assumed to spill to* RCS pressure in accordance with Reference 112 for a four loop plant.

Should a small break LOCA occur, depressurization of the RCS causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low-pressure trip setpoint is reached. Loss-Of-116 of 338 IPEC00036423 IPEC00036423

IP3 FSAR UPDATE Offsite-Power (LOOP) is assumed to occur coincident with reactor trip. A safety injection signal is generated when the appropriate setpoint (pressurizer low pressure SI) is reached. After the safety injection signal is generated, an additional delay ensues. This delay (27.8 seconds) accounts for the instrumentation delay, the diesel generator start time, plus the time necessary to align the appropriate valves and bring the pumps up to full speed. The safety features described will limit the consequences of the accident in two ways:

1) Reactor trip and borated water injection supplement void formation in causing rapid reduction of nuclear power to residual level corresponding to the delayed fission and fission product decay. No credit is taken in the LOCA analysis for the boron content of the injection water. However, an average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA remains subcritical. In addition, in the small break analysis, credit is taken for the insertion of Rod Cluster Control Assemblies (RCCAs) subsequent to the reactor trip signal, while assuming the most reactive RCCA is stuck in the full out position, and

2) Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs, the plant is assumed to be in normal plant operation at 102% of hot full power, i.e., the heat generated in the core is being removed via the secondary system. During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as the pumps coast down following LOOP. Upward flow through the core is maintained. However, the core flow is not sufficient to prevent a partial core uncovery. Subsequently, the ECCS provides sufficient core flow to cover the core.

During blowdown, heat from fission product decay, hot internals and the vessel continues to be transferred to the RCS. The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In the case of heat transfer from the RCS to the secondary, heat addition to the secondary results in increased secondary system pressure which leads to steam relief via the safety valves. Makeup to the secondary is automatically provided by the auxiliary feedwater pumps. The safety injection signal isolates normal feedwater flow by closing the main feedwater control and bypass valves and also initiates motor driven auxiliary feedwater flow. In the Small Break LOCA analysis, flow from a single motor driven auxiliary feedwater pump is assumed to begin 60 seconds after the Generation of an SI signal. The secondary flow aids in the reduction of RCS pressure. Also, due to the loss of offsite power assumption, the reactor coolant pumps are assumed to be tripped at the time of reactor trip during the accident and the effects of pump coastdown are included in the blowdown analysis.

When the RCS depressurizes to approximately 555 psia, the cold leg accumulators begin to inject borated water into the reactor coolant loops.

14.3.3 Core and System Performance 14.3.3.1 Mathematical Model The requirements of an acceptable ECCS evaluation model are presented in 10 CFR50.46 (Reference 1).

117 of 338 IPEC00036424 IPEC00036424

IP3 FSAR UPDATE Large Break LOCA Evaluation Model In 1988, as a result of the improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs, the NRC staff amended the requirements of 10 CFR 50A6 and Appendix K, "ECCS Evaluation Models," so that a realistic evaluation* model. may be used to analyze the performance of the ECCS during a hypothetical LOCA (Reference 1). Under the amended rules, best-estimate thermal-hydraulic models may be used in place of models with Appendix K features.

The rule change also requires, as part of the analysis, anassessment of the uncertainty of the best-estimate calculations. It further. requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance limits. Further guidance for the use of best-estimate codes was provided in Regulatory Guide 1.157 (Reference 5).

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code §.caling, 6.pplicability, and .!:!.ncertainty (CSAU) evaluation methodology (Reference 10). This method outlined an approach for defining and qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three-and four-loop PWR plants based on the revised 10 CFR 50A6 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and was approved by the NRC (Reference 11). The methodology is documented in WCAP-12945, "Code Qualification Document (CQD) for Best Estimate LOCA Analysis" (Reference* 12).

The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large break LOCA is WCOBRAfTRAC Version MOD7A, Rev. 1 (Reference 12).

WCOBRAfTRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. This best-estimate computer code contains the following features:

• Ability to model transient three-dimensional flows in different geometries inSide the vessel

• Ability to model thermal and mechanical non-equilibrium between phases

• Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes

• Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.

The reactor vessel is modeled with the three-dimensional, three-field fluid model, while the loop, major loop components, and safety injection points are modeled with the one-dimensional fluid model.

The basic building block for the vessel is the channel, a vertical stack of single mesh cells. Several channels can be connected together by gaps to model a region of the reactor vessel. Regions that occupy the same level form a section of the vessel. Vessel sections are connected axially to complete the vessel mesh by specifying channel connections between sections. Heat transfer surfaces and solid structures that interact significantly with the fluid can be modeled with rods and 118 of 338 IPEC00036425 IPEC00036425

IP3 FSAR UPDATE unheated conductors. The fuel parameters are generated using the Westinghouse fuel performance code (PAD 4.0, Reference 4).

One-dimensional components are connected to the vessel. Special purpose components exist to model specific components such as the steam generator and*pump.

A typical calculation using WCOBRAITRAC begins with the establishment of a steady-state initial condition with all loops intact. The input parameters and initial conditions for this steady-state calculation are discussed in the next section.

Following the establishment of an acceptable steady-state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill,and reflood follows continuously, using the same computer code (WCOBRAITRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure is calculated using the COCO code (References 3 and 6) and mass and energy releases from the WCOBRA/TRAC calculation. The parameters used in the containment analysis to determine this pressure curve are presented in Tables 14.3-4, 14.3-5, 14.3-6a and14.3-6b.

The methods used in the application of WCOBRA/TRAC to the large break LOCA are described in Reference 12. A detailed assessment of the computer code WCOBRAITRAC was made through comparisons to experimental data. These assessments were used to develop quantitative estimates of the code's ability to predict key physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis (Reference 9). The final step of the best-estimate methodology is to combine all the uncertainties related to the code and plant parameters and estimate the PCT at the 95th percentile (PCT95%). The steps taken to derive the PCT uncertainty estimate are summarized below:

1. Plant Model Development In this step, a WCOBRAITRAC model of the Indian Point 3 Nuclear Power Plant is developed.

A high level of noding detail is used, in order to provide an accurate simulation of the transient.

However, specific guidelines are followed to assure that the model is consistent with models used in the code validation; This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences such as in the upper plenum of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions In this step, the expected or desired range of the plant operating conditions to which the analysiS applies is established. The parameters considered are based on a "key LOCA parameters" list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the "initial transient." Next, several confirmatory runs are made, which vary a subset of the key LOCAparameters over their expected operating range in one-at-a-time sensitivities. The results of these calculations for Indian Point 3 Nuclear Power Plant are discussed in Section 5 of Reference 9. The most limiting input conditions,based on these confirmatory runs, are then combined into a single transient, which is then called the "reference transient" 119 of 338 IPEC00036426 IPEC00036426

IP3 FSAR UPDATE

3. PWR Sensitivity Calculations A series of PWR transients are performed in which the initial fluid conditions and boundary conditions are ranged around the nominal conditions used in the reference transient. The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the initial condition bias and uncertainty discussed in Section 6 of Reference 9.

Next, a series of transients are performed which vary the power distribution, taking into account all possible power distributions during normal plant operation. The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the power distribution bias and uncertainty (response surface) discussed in Section 7 of Reference 9.

Finally, a series of transients are performed which vary parameters that affect the overall system response ("global" parameters) and local fuel rod response ("local" parameters). The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the model bias and uncertainty (response surface) discussed in Section 8 of Reference 9.

4. Response Surface Calculations The results from the power distribution and global model WCOBRAITRAC runs performed in Step 3 are fit by regression analyses into equations known as response surfaces. The results of the initial conditions run matrix are used to generate a PCT uncertainty distribution.

5. Uncertainty Evaluation The total peT uncertainty from the initial conditions, power distribution, and model calculations is derived using the approved methodology (Reference 12). The uncertainty calculations assume certain plant operating ranges which may be varied depending on the results obtained. These uncertainties are then combined to determine the initial estimate of the total PCT uncertainty distribution for the guillotine and limiting split breaks. The results of these initial estimates of the total PCT uncertainty are compared to determine the limiting break type.

If the split break is limiting, an additional set of split transients are performed which vary overall system response ("global" parameters) and local fuel rod response ("local" parameters). The results of these calculations form the basis for the determination of the model bias and uncertainty discussed in Section 90t Reference 9. Finally, an additional series of runs is made to quantify the bias and uncertainty due to assuming that the above three uncertainty categories are independent. The final PCT uncertainty distribution is then calculated for the limiting break type, and the 95th percentile PCT (PCT950/0) is determined, as described in Section 14.3.3.3.6 (Uncertainty Evaluation"and Results).

6. Plant Operating Range 120 of 338 IPEC00036427 IPEC00036427

IP3 FSAR UPDATE The plant operating range over which the uncertainty evaluation applies is defined. Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range established in step 2, or may be narrower for some parameters to gain additional PCT margin.

There are three major uncertainty categories or elements:

• Initial condition bias and uncertainty

• Power distribution bias and uncertainty

• Model bias and uncertainty Conceptually, these elements may be assumed to affect the reference transient PCT as shown below PCTi =PCTREF,i + APCT1c,i + ~PCTpD,i + APCTMOD,I (14.3.3.1-1)

where, PCTREF,i

= Reference transient PCT: The reference transient PCT is calculated usingWCOBRAITRAC at the nominal conditions identified in Table 14.3-1, for the blowdown, first and second reflood periods.

= Initialcondition bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes several nominal or average initial conditions, and the average PCT taking into account all possible values of the initial conditions. This bias takes into account plant variations which have a relatively small effect on PCT. The elements which make up this bias and its uncertainty are plant-specific.

APCTpD,i = Power distribution bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes a nominal power distribution, and the average PCT taking into account all possible power distributions during normal plant operation. Elements which contribute to the uncertainty of this bias are calculational uncertainties, and variations due to transient operation of the reactor.

~PCTMOD,i = Model bias and uncertainty: This component accounts for uncertainties in the ability of the WCOBRAITRAC code to accurately predict important phenomena which affect the overall system response ("global" parameters) and the local fuel rod response ("local" parameters). The code and model bias is the difference between the reference transient PCT, which assumes nominal values for the global and local parameters, and the average PCTtaking into account all possible values of global and local parameters.

The separability of the bias and uncertainty components in the manner described above is an approximation, since the parameters in each element may be affected by parameters in other 121 of 338 IPEC00036428 IPEC00036428

IP3 FSAR UPDATE elements. The bias and uncertainty associated with this assumption is quantified as part of the overall uncertainty methodology and included in the final estimates of PCT95%.

Small Break LOCA Evaluation Model For loss-of-coolant accidents due to small breaks less than 1 fe, the NOTRUMP (References 77, 78 and 112) computer code is used to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow through the break. The NOTRUMP computer code is a state-of-the-art one-dimensional general network code consisting of a number of advanced features.

Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-061 1, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants."

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly with the intact loops lumped into a second loop. The transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum applied throughout the system. A detailed description of the NOTRUMP code is provided in References 77, 78 and 111.

The use of NOTRUMP in the analysis involves among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant accident.

Clad thermal analyses are performed with the LOCTA-IV code (Reference 7), which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from NOTRUMP hydraulic calculations as input as shown in Figure 14.3-3. The LOCTA-IV code version used for the clad thermal analysis of the small break LOCA includes the clad swelling and rupture model of NUREG-0630.

For these analyses, the safety injection delivery considers pumped injection flow, which is depicted in Figure 14.3-51 as a function of RCS pressure. This figure represents injection flow from the high head safety injection pumps based on performance curves degraded 5 percent from the design head.

A 27.8 second delay was assumed from the time that the SI signal is generated to the time that the pumps are at full speed and capable of injecting water into the system. The effect of low head safety injection pump (Residual Heat Removal pump) flow is not considered since their shutoff head is lower than Reactor Coolant System pressure during the time period of the transient. Also, minimum Emergency Core Cooling System capability and operability has been assumed in these analyses. The small break LOCA analysis also conservatively assumes that the rod drop time is 2.7 seconds.

Figure 14.3-52 presents the hot rod power shape utilized as input to perform the small break analysis presented here. This power shape was chosen because it provides an appropriate distribution of power versus core height and also because local power is maximized in the upper regions of the reactor core (8 feet to 12 feet). This power shape is skewed to the top of the core with the peak local power occurring at the 9.5 foot core elevation. This is limiting for the small break analysis because of the core uncovery process for small breaks. As the core uncovers, the cladding in the upper elevation 122 of 338 IPEC00036429 IPEC00036429

IP3 FSAR UPDATE of the core heats up and is sensitive to the local power at that elevation. The cladding temperatures in the lower elevation of the core, below the two-phase mixture height, remain low.

The small break analysis was performed with the Westinghouse ECCS small break Evaluation Model using the NOTRUMP code, approved for this use by the Nuclear Regulatory Commission in May 1985 (References 77 and 78), and in August 1996 (Reference 112).

14.3.3.2 Input Parameters and Initial Conditions Tables 14.3-1 and 14.3-8a list important input parameters and initial conditions used in the Indian Point 3 Nuclear Power Plant large break LOCA analysis, and small break LOCA analysis, respectively.

The appropriate best estimate value of -That is modeled for the upper head fluid temperature in the large break LOCA analysis. The small break LOCA analysis was performed with the upper head fluid temperature equal to the Reactor Coolant System hot leg fluid temperature. In addition, the large break LOCA analysis assumed a steam generator tube plugging range of 0 to 10%. The assumption bounds the uprate licensing condition with up to 10% plugging in any steam generator. The small break LOCA analysis included the effects of a 10% uniform steam generator tube plugging.

All accident analyses are bounded by a minimum RWST temperature of 35°F. The Containment Integrity Steam Break analysis simultaneously assumes RWST temperature of 40°F and containment Spray temperature of 110°F, a physically impossible (but highly conservative) assumption to maximize accident consequences. Of the two parameters, Containment Spray temperature is more limiting. Therefore, RWST temperature as low as 35°F is acceptable and consistent with the safety analysis.

14.3.3.3 Large Break LOCA Analysis Results A series of WCOBRAITRAC calculations were performed using the Indian Point 3 Nuclear Power Plant input model, to determine the effect of variations in several key LOCA parameters on peak cladding temperature (PCT). From these studies, an assessment was made of the parameters that had a significant effect as will be described in the following sections.

14.3.3.3.1 Large Break LOCA Reference Transient Description The plant-specific analysis performed for the Indian Point 3 Nuclear Power Plant confirmed that the double-ended cold leg guillotine (DECLG) break is more limiting than the split break as described in Section 9.2.3 of Reference 9. The plant conditions used in the reference transient are listed in Table 14.3-1, Since many of these parameters are at their bounded values, the calculated results are a conservative representation of the response to a large break LOCA The following is a description of the reference transient.

The LOCA transient can be conveniently divided into a number of time periods in which specific phenomena are occurring. For atypical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the down-ward core flow phase.

These are followed by the refill, first reflood, second reflood and long term cooling phases. The important phenomena occurring during each of these phases are discussed for the reference transient. Theresults are shown in Figures 14.3-4 through 14.3-16.

123 of 338 IPEC00036430 IPEC00036430

IP3 FSAR UPDATE Critical Heat Flux (CHF) Phase (- 0 ~ 2 seconds)

Immediately following the cold leg rupture, the break discharge is subcooled at a high flow rate, the core flow reverses, the fuel rods go through departure from nucleate boiling (DNB) and the cladding rapidly heats up while core power shuts down. Figure 14.3-4 shows the maximum cladding temperature in the core, as a function of time. The hot water in the core and upper plenum flashes to steam during this period. This phase is terminated when the water in the lower plenum and downcomer begins to flash. The mixture swells and the intact loop pumps, still rotating in single-phase liquid, push this two-phase mixture into the core.

Upward Core Flow Phase ( 17 seconds)

Heat transfer is improved as the two-phase mixture is pushed into the core: This phase may be enhanced if the pumps are not degraded, and the break discharge rate is low because the fluid is saturated at the break. Figures 14.3-5a and 14.3-5b show the vessel-side and pump-side break flowrate for the reference transient. This phase ends as lower plenum mass is depleted, the loops become two-phase, and the pump head degrades. If pumps are highly degraded orthe break flow is large, the cooling effect due to upward flow may not be significant. Figure 14.3-6 shows the void fraction for one intact loop pump and the broken loop pump. The intact loop pump remains in single-phase liquid flow for several seconds, while the broken loop pump is in two-phase and steam flow soon after the break.

Downward Core Flow Phase ( 24.5 seconds)

The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump flow becomes two-phase. The break flow begins to dominate and pulls flow down through the core.

Figures 14.3-7 and 14.3-8 show the vapor flow at near top of core of channels 17 and 19. While liquid and entrained liquid flows also provide core cooling, the vapor flow in the core best illustrates this phase of core cooling. This period is enhanced by flow from the upper head, As the. system pressure continues to fall, the break flow and consequently the core flow, are reduced. The core begins to heat up as the system reaches containment pressure and the vessel begins to fill with Emergency Core Cooling System (ECCS) water.

Refill Phase (- 24.5 - 36.5 seconds)

The core experiences a nearly adiabatic heatup as the lower plenum fills with ECCS water.

Figure 14.3-9 shows the lower plenum liquid level. This phase ends when the ECCS water enters the core and entrainment begins, with a resulting improvement in heat transfer. Figures 14.3-10 and 14.3-11 show the liquid flows from the accumulator and the safety injection from an intact loop (Loop 4).

First Reflood Phase (- 36.5 - 50.5 seconds)

The accumulators are emptying and nitrogen enters the system (Figure 14.3-10). This forces water into the core which then boils as the lower core region begins to quench, causingrepressurization.

The repressurization is best illustrated by the reduction in pumped SI flow (Figure 14.3-11). During this time, core cooling may be increased.

Second Reflood Phase (....:. 50.5 seconds - end) 124 of 338 IPEC00036431 IPEC00036431

IP3 FSAR UPDATE The system then settles into a gravity driven reflood which exhibits lower core heat transfer. Figures 14.3-12 and 14.3-13 show the core and downcomer liquid levels. Figure 14.3-14 shows the vessel fluid mass. As the quench front progresses further into the core, the peak cladding temperature (PCT) location moves higher in the top core region. Figure 14.3-15 shows the movement of the PCT location~ As the vessel*continues to fill, the PCT location is cooled and the PCT heatup is terminated (Figures 14.3-4 and 14.3-16).

Long Term Core Cooling At the end of the WCOBRA/TRAC calculation, the core and downcomer levels are increasing as the pumped safety injection flow exceeds the break flow. The core and downcomer levels would be expected to continue to rise, until the downcomer mixture level approaches the loop elevation. At that point, the break flow would increase, until it roughly matches the injection flowrate. The core would continue to be cooled until the entire core is eventually quenched.

The reference transient resulted in a blowdown PCT of 1491°F, a first reflood PCT of 1627°F and a second reflood PCT of 1578°F.

14.3.3.3.2 Confirmatory Sensitivity Studies A number of sensitivity calculations were carried out to investigate the effect of the key LOCA parameters, and to determine the PCT effect on the reference transient. In the sensitivity studies performed, LOCA parameters were varied one at a time. For each sensitivity study, a comparison between the base case and the sensitivity case transient results was made.

The results of the sensitivity studies are summarized in Table 14.3-2a. A ful*1 report on the results for all confirmatory sensitivity study results is included in Section 5 of Reference 9. The results of these analyses lead to the following conclusions:

1. Modeling maximum steam generator tube plugging (10%) results in ahigher PCT than minimum steam generator tube plugging (0%).

2. Modeling loss-of-offsite-power (LOOP) results in a higher PCT than no loss-of-offsite-power (no-LOOP):

3. =

Modeling the maximum value of vessel average temperature (Tavg 572°F) results in a higher PCT than minimum value of vessel average temperature (T avg = 549 D F).

4. =

Modeling the maximum power fraction (P LOW 0.8) in the low power/periphery channel

=

of the core results in a higher PCT than minimum power fraction (PLOW 0.3).

14.3.3.3.3 Initial Conditions Sensitivity Studies Several calculations were performed to evaluatethe effect of change in the initial conditions on the calculated LOCA transient. These calculations analyzed key initial plant conditions over their expected range of operation. These studies included effects of ranging RCSconditions (pressure and temperature), safety injection temperature, and accumulator conditions (pressure, temperature and water volume). The results of these studies are presented in Section 6 of Reference 9.

125 of 338 IPEC00036432 IPEC00036432

IP3 FSAR UPDATE The calculated results were used to develop initial condition uncertainty distributions for the blowdown and reflood peaks. These distributions are then used in the uncertainty evaluation to predict the PCT uncertainty component resulting from initial conditions uncertainty (~PCTlc,i).

14.3.3.3.4 Power Distribution Sensitivity Studies Several calculations were performed to evaluate the effect of power distribution on the calculated LOCA transient. The power distribution attributes which were analyzed are the peak linear heat rate, the maximum relative rod power, the relative power in the bottom third of the core (P BOT), and the relative power in the middle third of the core (PMIO). The choice of these variables and their ranges are based on the expected range of plant operation.

The power distribution parameters used for the reference transient are biased to yield a relatively high PCT. The reference transient uses a slightly higher FAH value (1.731) than the Tech Spec FAH value (1.7), a skewed to the top power distribution, and a Fa (2.202) at the midpoint of the sample range.

A run matrix was developed in order to vary the power distribution attributes singly and in combination. The calculated results are presented in Section 7 of Reference 9.

The calculated results were used to develop response surfaces, as described in Step 4 of Section 14.3.3.1, which could be used to predict the change in PCT for various changes in the power distributions for the blowdown and reflood peaks .. These were then used in the uncertainty evaluation, to predict the PCT uncertainty component resulting from uncertainties in power distribution parameters, (APCTPO,i)'

14.3.3.3.5 Global Model Sensitivity Studies Several calculations were performed to evaluate the effect of broken loop resistance, break discharge Coefficient, and condensation rate on the PCT for the guillotine break. As in the power distribution study, these parameters were varied singly and in combination in order to obtain a data base which could be used for response surface generation. The run matrix and ranges of the break flow parameters are described in Reference 12. The limiting split break was also identified using the methodology described in Reference 12. The plant specific calculated results are presented in Section 8 of Reference 9.

The calculated results were used to develop response surfaces as described in Section 14.3.3.1, which could be used to predict the change in PCT for various changes in the flow conditions. These were then used in the uncertainty evaluation to predict the PCT uncertainty component resulting from uncertainties in global model parameters (APCTMOO,i)'

14.3.3.3.6 Uncertainty Evaluation and Results The PCT equation was presented in Section 14.3.3.1. Each element of uncertainty is initially considered to be independent of the other. Each bias component is considered a random variable, whose uncertainty and distribution is obtained directly, oris obtained from the uncertainty of the parameters of which the bias is a function. For example, APCTPD,iisa function of Fa, F"'H, PBOT , and PM10 . Its distribution is obtained by sampling the plant Fa, F"'H, PBOT , and PM10 distributions and using a response surface to calculate ~PCTPO,i' Since APCT i is the sum of these biases, it also becomes a random variable. Separate initial PCT frequency distributions are constructed as follows for the guillotine break and the limiting split break size:

126 of 338 IPEC00036433 IPEC00036433

IP3 FSAR UPDATE

1. Generate a random value of each APCT element.

2. Calculate the resulting PCT using Equation 14.3.3.1-1.

3. Repeat the process many times to generate a histogram of PCTs.

For the Indian Point 3 Nuclear Power Plant, the results of this assessment showed the double-ended cold leg guillotine (DECLG) break to be the limiting break type.

A final verification step is performed in which additional calculations (known as "superposition" calculations) are made with WCOBRAITRAC, simultaneously varying several parameters which were previously assumed independent (for example, power distributions and global models). Predictions using Equation 14.3.3.1-1 are compared to this data, and additional biases and uncertainties are applied.

The estimate of the PCT at 95th percent probability is determined by finding that PCTbeiow which 95th percent of the calculated PCTs reside. This estimate is the licensing basis PCT, under the revised ECCS rule.

The results for the Indian Point 3 Nuclear Power Plant are given in Table 14.3-2b, which shows the limiting second reflood 95th percentile PCT (PCT950/0) of 1944°F. As expected, the difference between the 95th percent value and the average value increases with increasing time, as more parameter uncertainties come into play.

14.3.3.3.7 Evaluation The base analysis discussed in Sections 14.3.3.3.1 to 14.3.3.3.6 was performed assuming a full core of Westinghouse OFA with IFMs and non-IFBA.For Indian Point 3 Nuclear Power Plant large break LOCAanalysis, additional calculations were performed to assess the effect of IFBA fuel, upgraded fuel and transition core.

IFBA Fuel Evaluation The base analysis discussed in Sections 14.3.3.3.1 through 14.3.3.3.6 is for non-IFBA fuel type. An analysis of IFBAfuel was performed utilizing the HOTSPOT code and the high PCT case identified in Section 10.2 of Reference 9. The analysis results indicated that a 15°F penalty is applicable to the first reflood time period for IFBA fuel, and IFBA fuel is bounded by non-IFBA fuel for the second reflood time period.

Upgraded Fuel Evaluation The base analysis discussed in Sections 14.3.3.3.1 through 14.3.3.3.6 is for Westinghouse OFA fuel design with IFMs. The fuel design to be implemented is upgraded fuel with IFMs and either with or without 1.9" I-Springs. The analysis results indicated that the upgraded fuelwithlFMs and 1.9" 1-Springs is bounded by OFA fuel with IFMs. These results also indicated that the upgraded fuel with IFMs but without 1.9" I-Springs is bounded by OFA fuel withlFMs for second reflood ,but a 6°F PCT penalty is applicable for first reflood. Therefore, the best-estimate analysis for the Indian Point 3 127 of 338 IPEC00036434 IPEC00036434

IP3 FSAR UPDATE Nuclear Power Plant bounds operation with upgraded fuel with IFMs and 1.9" I-Springs, but requires a 6°F first reflood PCT penalty for operation with upgraded fuel with I FMs but without 1.9" I-Springs.

Transition Core Evaluation The Indian Point 3 Nuclear Power Plant will be transitioning from the OFA fuel with IFMs to the upgraded fuel with IFMs. An additional calculation was completed to determine the effects of the mixed core. The analysis results show a 18"F PCT penalty for the first reflood time period and a 65"F PCT penalty for the second reflood time period for the transitional period.

In addition, a 5"F PCT penalty for first and second reflood time period will be assessed for upper core plate alignment pin removal for Indian Point 3 Nuclear Power Plant large break LOCA.

14.3.3.3.8 Large Break LOCA Conclusions It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR 50.46 are met. The demonstration that these limits are met for the Indian Point 3 Nuclear Power Plant is as follows:

1) There is a high level of probability that the peak cladding temperature (PCT) shall not exceed 2200"F. The results presented in Table 14.3-2b indicate that this regulatory limit has been met with a limiting second reflood PCT95% of 1944°F. The addition of the 65"F for transition core penalty and 5"F for upper core plate alignment pin removal penalty results in a limiting second reflood PCT of 2014"F.

2) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react. The total amount of hydrogen generated, based on this conservative assessment is 0.0062 times the maximum hypothetical amount, which meets the regulatory limit

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation. The approved Best-Estimate LOCA methodology assesses this requirement using a plant-specific transient which has a PCT in excess of the estimated 95 percentile PCT (PCT95%). Based on this conservative calculation, a maximum local oxidation of 7.6 percent is calculated, which meets the regulatory limit.

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling.

This requirement is met by demonstrating that the PCT does not exceed 2200"F, the maximum local oxidation does not exceed 17%, and the seismic and LOCAforces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled. The approved methodology (Reference 12) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the assemblies in the lower power channel as defined in the WCOBRAITRAC model. This situation has not been previously calculated to occur for the Indian Point Unit3 Nuclear Power Plant. Therefore, this regulatory limit is met.

128 of 338 IPEC00036435 IPEC00036435

IP3 FSAR UPDATE

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core. The conditions at the end of the WCOBRAITRAC calculations indicates that the transition to long term cooling is underway even before the entire core is quenched.

14.3.3.3.9 Plant Operating Range The expected PCT and its uncertainty developed above is valid for a range of plant operating conditions. In contrast to current Appendix K calculations, many parameters in the base case calculation are at nominal values. The range of variation of the operating parameters has been accounted for in the estimated PCT uncertainty. Table 14.3-3 summarizes the operating ranges for the Indian Point 3 Nuclear Power Plant. If operation is maintained within these ranges, the LOCA analysis developed in Reference 9 is considered to be valid.

14.3.3.3 Small Break Results Limiting Case This section presents the results of the limiting small break LOCA analysis for a range of break sizes and Upgraded fuel types with ZIRLO' cladding. NUREG-0737 (Reference 86), section II.K3.31, requires a plant specific small break LOCA analysis using an Evaluation Model revised per Section II.K3.30. In accordance with NRC Generic Letter 83-35 (Reference 87), generic analyses using NOTRUMP (References 77, 78, and 112) were performed and are presented in WCAP-11145 (Reference 88). Those results demonstrate that in comparison of cold leg, hot leg and pump suction leg break locations, the cold leg break location is limiting. The limiting break for Indian Point Unit 3 was found to be a 3 inch cold leg break.

A list of input assumptions used in the same break analysis is provided in Table 14.3-8a. The results of a spectrum analysis (three break sizes) performed for the upgraded ZI RLOTM clad fuel are summarized in Table 14.3-8c while the key transient event times are listed in Table 14.3-8b.

For limiting 3 inch break transient, Figures 14.3-53 through 14.3-60 for the following parameters are given:

• RCS pressure

• Core mixture level

• Hot rod cladding temperature

• Core outlet steam flow rate

• Hot assembly rod surface heat transfer coefficient

• Hot spot fluid temperature

• Break flow rate

• Safety injection mass flow rate In addition, the following transient parameters are presented for the non-limiting 2 inch and 4 inch breaks:

• RCS pressure

• Core mixture level

• Hot rod cladding temperature 129 of 338 IPEC00036436 IPEC00036436

IP3 FSAR UPDATE Figures 14.3-61 through 14.3-63 are for the 2 inch break transient, while Figures 14.3-64 through 14.3-66 show the above parameters for the 4 inch break.

During the initial period of the small break transient, the effect of the break flow rate is not strong enough to overcome the flow rate maintained by the reactor coolant pumps as they coast down following Loss-Of-Offsite-Power (LOOP). Normal upward flow is maintained through the core and core heat is adequately removed. At the low heat generation rates following reactor trip, the fuel rods continue to be well cooled as long as the core is covered by a two-phase mixture level. From the clad temperature transient for the limiting break calculation shown in Figure 14.3-55, it is seen that the peak clad temperature occurs near the time when the core is most deeply uncovered (1954 seconds) and the top of the core is steam cooled. This time is accompanied by the highest vapor superheating Q

above the mixture level. The peak clad temperature during the transient was 1543 F. At the time the transient was terminated, the safety injection flow rate that was delivered to the RCS exceeds the mass flow rate out the break. The decreasing RCS pressure results in greater safety injection flow as well as reduced break flow. As the RCS inventory continues to gradually increase, the reactor mixture level will continue to increase and the fuel clad temperature will continue to decline.

The maximum calculated peak clad temperature for all small breaks analyzed is 1543°F, which is less than the 10 CFR 50.46 ECCS Acceptance Criteria limit of 2200°F. The maximum local metal-water reaction is below the embrittlement limit of 17 percent as water reaction is less than 1 percent, as compared with the 1 percent criterion of 10 CFR 50.46, and the clad temperature transient is terminated at a time when the core geometry is still coolable. As a result, the core temperature will continue to drop and the ability to remove decay heat for an extended period of time will be provided.

Small Break LOCA analysis: Non-Limiting Cases In compliance with 10 CFR 50.46, Section (a)(1)(i), additional cases were analyzed to insure that the 3 inch diameter break was limiting. Calculations were run assuming breaks of 2 inches and 4 inches for the Upgraded ZIRLO' clad fuel. The results of these calculations are shown in Table 14.3-8c and the sequence of events in Table 14.3-8b.

Small Break LOCA Analysis Conclusions Analyses presented in this section show that the high head safety injection of the Emergency Core Cooling System (the low head safety injection pumps were not modeled in the Indian Point Unit 3 small break LOCA analysis), provides sufficient core flooding to keep the calculated peak clad temperature below the required limit of 10CFR 50.46. Hence, adequate protection is provided by the Emergency Core Cooling System in the event of a small break Loss-of-Coolant Accident.

The results of this analysis demonstrate that for a small break LOCA, the Emergency Core Cooling System will meet the acceptance criteria as presented in 10 CFR 50.46.

14.3.3.4 Conclusions For breaks up to an including the double-ended severance of a reactor coolant pipe, the Emergency Core Cooling System will meet the Acceptance Criteria as presented in 10 CFR 50.46 (Reference 1).

That is:

1) There isa high level of probability that the peak cladding temperature (PCT) shall not exceed 2200°F.

130 of 338 IPEC00036437 IPEC00036437

IP3 FSAR UPDATE 2} The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react.

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling.

This requirement is met by demonstrating that the PCT does not exceed 2200°F, the maximum local oxidation does not exceed 17%, and the seismic and LOCA forces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled.

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core.

14.3.4 CORE AND INTERNALS INTEGRITY ANALYSIS 14.3.4.1 Design Criteria The basic requirement of any Loss-of-Coolant Accident, including the double-ended severance of a reactor coolant pipe, is that sufficient integrity be maintained to permit the safe and orderly shutdown of the reactor. This implies that the core must remain essentially intact and deformation of internals must be sufficiently small so that primary loop flow, and particularly, adequate safety injection flow is not impeded.

The ability to insert control rods to the extent necessary to provide shutdown following the accident must be maintained. Maximum allowable defection limitations are established for those regions of the internals that are critical for plant shutdown.

The allowable and no loss of function deflection limits under dead loads plus the maximum potential earthquake and/or blowdown excitation loads are presented in Table 14.3-11. These limits have been established by correlating experimental and analytical results.

14.3.4.2 Internals Evaluation Reference 99 addressed the affects of 24 month channel uncertainties which affected the initial conditions.

Depressurization waves propagate from the postulated break location into the reactor vessel through either a hot leg or a cold leg nozzle.

After a postulated break at the Reactor Pressure Vessel (RPV) inlet nozzle or at the Reactor Coolant Pump (RCP) outlet nozzle, the depressurization path for waves entering the reactor vessel is through the nozzle which contains the broken pipe and into the downcomer annulus which is the region between the core barrel and reactor vessel. The initial waves propagate up, around, and down the downcomer annulus, then up through the region circumferentially enclosed by the core barrel, that is, the fuel region.

As a result, the region of the downcomer annulus close to the break depressurizes rapidly; but because of restricted flow areas and finite wave speed (approximately 3500 feet per second), the 131 of 338 IPEC00036438 IPEC00036438

IP3 FSAR UPDATE opposite side of the core barrel remains at a high pressure. This results in a net horizontal force on the core barrel and RPV. As the depressurization wave propagates around the downcomer annulus and through the core, the barrel differential pressure is reduced and similarly, the resulting hydraulic forces drop. In the case of a postulated RPV outlet rupture, the waves follow a dissimilar depressurization path, passing through the outlet nozzle and directly in to the upper internals region, depressurizing the core, and entering the downcomer annulus from the bottom exit of the core barrel.

Since the depressurization wave travels directly to the inside of the core barrel (so that the downcomer annulus is not directly involved), the internal differential pressures are not as large as the RPV inlet nozzle break, and therefore the horizontal force applied to the core barrel is less for the hot leg break than for a cold leg RPV inlet nozzle break. For breaks in either the hot leg or cold leg, the depressurization waves would continue to propagate by reflection and transition through the reactor vessel and loops. The reactor coolant pump outlet nozzle and reactor pressure vessel inlet nozzle pipe rupture locations have similar vessel internal hydraulic loads, but due to the influence of reactor cavity pressure loads, the vessel inlet nozzle break generates larger forces applied to the reactor vessel.

Blowdown Model The MULLTIFLEX computer code (Reference 26) calculates the hydrodynamic transients within the entire Reactor Coolant System. It considers subcooled, transition, and two-phase (saturated) blowdown regimes. The MULTIFLEX program employs the method of characteristics to solve the conservation laws, assuming one-dimensionality of flow and homogeneity of the liquid-vapor mixture.

The MULTIFLEX code considers a coupled fluid-structure interaction by accounting for the deflection of constraining boundaries, which are represented by separate spring-mass oscillator systems. A beam model of the core support barrel has been developed from the structural properties of the core barrel. In this model, the cylindrical barrel is vertically divided into segments and the pressure as well as the wall motions are projected onto the plane parallel to the broken inlet nozzle. Horizontally, the barrel is divided into segments consisting of separate walls. The spatial pressure variation at each time step is transformed into horizontal forces, which act on the mass pOints of the beam model.

Each flexible wall is bounded on either side by a hydraulic flow path.

Its ability to treat multiple flow branches and a large number of mesh pOints gives the MULTIFLEX code the required flexibility to represent the various flow passages within the primary Reactor Coolant System (RCS). The RCS is divided into subregions in which the fluid flows mainly along their longitudinal axes; each subregion may then be regarded as an equivalent pipe. The entire primary RCS is thus represented by a complex network of equivalent pipes.

Time history values of the pressure, mass velocity, density, and other thermodynamic properties within the RPV (all of which are computed by the MULTIFLEX code), are utilized in the determination of the applied vertical and lateral loads on the reactor vessel internals.

The RPV internal hydraulic loads for pipe ruptures postulated at the vessel safe-end locations were based upon a 110 square-inch break opening area. This limited area was verified to be conservative upon completion of the Reactor Coolant System blowdown analysis by using the actual broken pipe displacements and geometrical relationships. Internal hydraulic loads for a break postulated at the reactor coolant pump outlet nozzle safe-end location were calculated for a full doubled-ended break opening area. Figure 14.3-67 through 14.3-70 present the horizontal hydraulic forces on the reactor vessel and core barrel for the RPV inlet and outlet breaks. The vertical loads on the reactor vessel for these two breaks are also among the figures. The results presented were based on a MULTIFLEX model that is plant specific for Indian Point 3.

132 of 338 IPEC00036439 IPEC00036439

IP3 FSAR UPDATE Force Model Vertical Loads The FORCE-2 (Reference 26) computer code determines the vertical hydrodynamic loads on the reactor vessel internals during blowdown. FORCE-2 utilizes a detailed geometric description of the vessel components, transient pressures, and mass velocities computed by the MULTIFLEX code.

The FORCE-2 code is applicable for all pressure and mass velocity transients arising from a postulated Loss-of-Coolant Accident. Each reactor vessel component for which force calculations are required is designated as an element. If the flow region associated with an element in FORCE-2 is divided into more than one flow path in the MULTIFLEX hydraulic model, then the element in FORCE-2 is subdivided into a corresponding number of divisions.

The analytical basis for the derivation of the mathematical equations utilized in the FORCE-2 code is the conservation of momentum. In evaluating the vertical hydraulic loads on the reactor vessel internals, the following types of transient forces are considered:

1) Pressure differential acting across the element

2) Flow stagnation of the element and unrecovered orifice losses across the element

3) Friction losses along the element.

These three types of forces are summed together to give the total force on each element. Individual forces on elements are further combined, depending upon what particular RV internal component is being considered, to yield the resultant vertical hydraulic load on that component.

Horizontal Loads Variations in the fluid pressure distribution in the downcomer annulus region during the subcooled operation of the blowdown transient produce pressure loading on the reactor vessel internals. The transient pressures computed by the MULTIFLEX code are used to calculate the lateral hydraulic loads on the reactor vessel wall, core barrel, and the thermal shield.

The annular region between the reactor vessel wall and the core barrel (that is, the downcomer annulus) is modeled as cylindrical segments formed by dividing this region into circumferential and axial zones.

14.3.4.3 Response of Reactor Internals to Blowdown Forces Vertical Excitation Structural Model and Method of Analysis The response of reactor internals components due to an excitation produced by a complete severance of a primary loop pipe is analyzed. Assuming a double-ended pipe break occurs in a very short period of time, the rapid drop of pressure at the break produces a disturbance which propagates along the primary loop and excites the internal structure. The characteristics of the hydraulic excitation, combined with those of the structures affected, present a unique dynamic problem.

133 of 338 IPEC00036440 IPEC00036440

IP3 FSAR UPDATE The internal structure is simulated by a multi-mass system connected with springs and dashpots representing the viscous damping due to structural and impact losses, The gaps between various components, as well as coulomb type friction, were also incorporated into the overall model. Since the fuel elements in the fuel assemblies are kept in position by friction forces originating from the preloaded fuel assembly grid fingers, any sliding that occurs between the fuel rods and assembly considered as coulomb type of friction. A series of mechanical modes of local structures were developed and analyzed so that certain basic nonlinear phenomena previously mentioned could be understood. Using the results of these models, a final multi-mass model was adopted to represent the internal structure under vertical excitation. Figure 14.3-71 is a schematic representation of the internals structures. The multi-mass model is shown in Figure 14.3-72. The modeling is conducted in such a way that uniform masses are lumped into easily identifiable discrete masses while elastic elements are represented by springs.

In order to program the multi-mass system, the appropriate spring rates, weights, and forcing function for the various masses were determined. The spring rates and weights of the reactor components were calculated separately for Indian Point 3. The forcing functions for the masses were obtained from the FORCE-2 program described in the previous section. It calculates the transient forces on reactor internals during blowdown using transient pressures and fluid velocities.

For the blowdown analysis, the forcing functions are applied directly to the various internal masses.

For the earthquake analysis of the reactor internals, the forcing function, which is a simulated earthquake response, is applied to the multi-mass system at the ground connections (the reactor vessel). Therefore, the external excitation is transmitted to the internals through the spring at the ground connections.

Results The hot and cold leg break analyses were performed for a one millisecond break opening time. The response of the structure to this type of excitation indicates that the vertical motion is irregular with peaks of very short duration. The deflections and motion of some of the reactor components are limited by the solid height of springs as is the case of the holddown spring located above the barrel flange.

The internals behave as a highly nonlinear system during the vertical oscillations produced by the blowdown forces. The nonlinearities due to the coulomb fictional forces between grids and rods, and to gaps between components causing discontinuities in force transmission. The frequency response is consequently a function not only of the exciting frequencies in the system, but also of the amplitude.

Different break conditions excite different frequencies in the system. Under certain blowdown excitation conditions, the core moves upward, touches the core plate, and falls down on the lower structure causing oscillations in all the components.

The effect of damping has also been considered and it can be seen that the higher frequencies disappear rapidly after each impact or slippage.

The results (Reference 58 and Reference 59) of the computer program give not only the frequency response of the components, but also the maximum impact force and defections. From these results, the component stresses are computed. The impact stresses are obtained in an analogous manner using the maximum forces seen by the various structures during impact.

134 of 338 IPEC00036441 IPEC00036441

IP3 FSAR UPDATE Upper Package and Guide Tubes The most severe case, represented by a hot leg break, shows the core lifting and contacting the upper core plate. The local deformation of the upper core plate where a guide tube is located must be limited so as to prevent the guide tubes from undergoing compression. An analysis (Reference 58 and Reference 59) was performed which showed that the deformation is insufficient to cause the plate to contact the guide tubes and cause any excessive compression of guide tubes.

Fuel Assembly Thimbles When the core moves vertically, touching the upper and lower structures, the thimbles are subjected to impact stresses. These stresses are obtained from the maximum dynamic impact forces on the fuel assemblies. The results are compared with the buckling loads to assure that the cross section distortion does not exceed the allowable limits. Results show that control rod insertion is not jeopardized.

Transverse Excitation Core Barrel The hydraulic pressure transients caused by a Loss-of-Coolant Accident with the break occurring in the hot leg are calculated for a one millisecond breaking time. The resulting loading on the upper core barrel is represented by a dynamic, uniformly distributed compressive pressure wave.

The dynamic stability of the upper core barrel is analyzed. The maximum compressive pressure wave is well below the critical value to produce buckling of the upper core barrel. In addition, the quantitative dynamic response of the upper core barrel was studied for the worst blowdown break time and found to be negligible.

Under the transient pressure conditions resulting from a Loss-of-Coolant Accident in a cold leg, the reactor core barrel is subjected initially to non-axisymmetric internal pressure waves. The initial loading condition is followed by oscillating pressure waves on the core barrel which are both time and space dependent.

In general, there are two possible modes of dynamic response of the core barrel. One mode is the beam response mode of the core barrel resulting from the non-self-equilibrating circumferential component of the pressure forcing function. This response mode is analyzed utilizing shear beam theory since the core barrel is a statically determinate elastic system in the beam mode. The beam mode of core barrel response is conservatively analyzed by comparing the excitation frequencies to the natural frequencies of the core barrel to establish the dynamic response amplification.

The second possible response mode of the core barrel is as a shell, predominantly in the ring modes with the formation of only one axial wave. The "ring" modes of shell vibration involve both the membrane and bending components of loads on the shell, with bending becoming predominant as the number of circumferential waves increase. Thus, the ring vibration modes are analyzed including both bending and membrane terms. The dynamic response is then determined by comparing the pressure loading oscillation frequencies to the natural frequencies as a shell.

Guide Tubes 135 of 338 IPEC00036442 IPEC00036442

IP3 FSAR UPDATE The guide tubes are studied applying the blowdown forces to the structures and calculating the resulting deflections. The guide tubes are considered as being elastically supported at the upper plate and simply supported at the lower end with variable cross section. Consideration is given to frequencies and amplitudes of the forcing function and the response is computed (References 58 and

59) to assure that the deflections do not prevent shutdown of the reactor.

14.3.4.4 Analysis of the Effects of Loss-of-Coolant and Safety Injection on the Reactor Vessel The analysis of the effects of injecting safety injection water into the Reactor Coolant System following a postulated Loss-of-Coolant Accident have been incorporated into a WCAP report submitted to the NRC (Reference 59).

For the reactor vessel three modes of failure are considered, including the ductile mode, brittle mode, and fatigue mode.

Ductile Mode The failure criterion used for this evaluation is that there shall be no gross yielding across the vessel wall using the material yield stress specified in Section III of the ASME Boiler and Pressure Vessel Code. The combined pressure and thermal stresses during injection through the vessel thickness as a function of time have been calculated and compared to the material yield stress for the period of time during the safety injection transient.

The results of the analyses showed that local yielding may occur in approximately the inner 12 percent of the base metal and in the cladding.

Brittle Mode The possibility of a brittle fracture of the irradiated core region has been considered from both a transition temperature approach and a fracture mechanics approach.

The failure criterion used for the transition temperature evaluation is that a local flaw cannot propagate beyond any given point where the applied stress will remain below the critical propagation stress at the applicable temperature at that point.

The results of the transition temperature analysis showed that the stress-temperature condition in the outer 65 percent of the base metal wall thickness remains in the crack arrest region at all times during the safety injection transient. Therefore, if a defect were present in the most detrimental location and orientation (i.e., a crack on the inside surface and circumferentially directed), it could not propagate any further than approximately 35 percent of the wall thickness, even considering the worst case assumptions used in the analysis.

The results of the fracture mechanics analysis, considering the effects of water temperature, heat transfer coefficients, and fracture toughness of the material as a function of time, temperature, and irradiation is included in this report. Both a local effect and a continuous crack effect have been considered with the latter requiring the use of a rigorous finite element axisymmetric code.

Fatigue Mode The failure criterion used for the failure analysis is the one presented in Section III of the ASME Boiler and Pressure Vessel Code. In this method, the piece is assumed to fail once the combined usage 136 of 338 IPEC00036443 IPEC00036443

IP3 FSAR UPDATE factor at the most critical location for all transients applied to the vessel exceeds the code allowable usage factor of one.

The results of this analysis showed that the combined usage factor never exceeded 0.2, even after assuming that the safety injection transient occurred at the end of plant life.

Results In order to promote a fatigue failure during the safety injection transient at the end of plant life, it has been estimated that a wall temperature of approximately 11 OO°F is needed at the most critical area of the vessel (instrumentation tube welds in the bottom head). The design basis of the Safety Injection System ensures that the maximum cladding temperature does not exceed the Zircaloy-4 or ZIRLO melt temperature. This is achieved by prompt recovery of the core through flooding with the passive accumulators and the injection systems. Under these conditions, a vessel temperature of 11 OO°F is not considered a credible possibility and the evaluations of the vessel under such elevated temperatures is for a hypothetical case. For the ductile failure mode, such hypothetical rise in the wall temperature would increase the depth of local yielding in the vessel wall.

The results of these analyses show that the integrity of the reactor vessel is never violated.

The safety injection nozzles have been designed to withstand ten postulated safety injection transients without failure. This design and the associated analytical evaluation were in accordance with the requirements of Section III of the ASME Boiler and Pressure Vessel Code.

The maximum calculated pressure plus thermal stress in the safety injection nozzle during the safety injection transient was calculated to be approximately 50,900 psi. This value compares favorably with the code allowable stress of 80,000 psi.

Ten safety injection transients are considered along with all the other design transients for the vessel in the fatigue analysis of the nozzles. This analysis showed that the usage factor for the safety injection nozzles was 0.47, which is well below the code allowable value of 1.0.

The safety injection nozzles are not in the highly irradiated region of the vessel and thus they are considered ductile during the safety injection transient.

The effect of the safety injection water on the fuel assembly grid springs has been evaluated, and due to the fact that the springs have a large surface area to volume ratio, being in the form of thin strips, and that they are expected to follow the coolant temperature transient with very little lag, hence, no thermal shock is expected and the core cooling is not compromised.

Evaluations of the core barrel and thermal shield have also shown that core cooling is not jeopardized under the postulated accident conditions 14.3.5 Environmental Consequences of Loss-of-Coolant Accident 14.3.5.1 Large~Break LOCA Chapters 5 and 6 describe the protective systems and features which are specifically designed to limit the consequences of a major Loss-of-Coolant Accident (LQCA). The capability of the Safety Injection System for preventing melting of the fuel clad and the ability of the Containment and containment cooling systems to absorb the blowdown forces resulting from a major loss of coolant are discussed in 137 of 338 IPEC00036444 IPEC00036444

IP3 FSAR UPDATE Section 14.3.4. The capability of the safeguards in meeting dose limits set in 10 CFR 50:67 is demonstrated in this section.

Because of the design conservatism and care taken during fabrication and installation of the Reactor Coolant System, a break of the system integrity of any size is considered highly unlikely.

For the purpose of evaluating radiation exposure, a double-ended rupture of a reactor coolant loop is considered with partial safeguards operating from the diesel generator power system. As shown in Section 14.3.2, the Safety Injection System, with diesel generator power from two of the three units, will maintain clad temperature well below the melting point of Zircaloy-4 or ZIRLO and will limit zirconium-water reaction to an insignificant amount. As a result of the cladding temperature increase and the rapid system depressurization, however, cladding failure may occur in the hotter regions of the core. Release of the inventory of the volatile fission products in the pellet-cladding gap might follow.

The doses resulting from a Large Break LOCA have been analyzed assuming that instead of the release of gap activity from a portion of the fuel rods, major core degradation occurs resulting in the release of large amounts of activity to the containment atmosphere. The release of core fission product activity is modeled using the guidance provided in Regulatory Guide 1.183 (Reference 111).

The reactor coolant activity is assumed to be released over the first 30 seconds of the accident.

However, the activity in the coolant is insignificant compared with the release from the core and is not included in the analysis.

With the use of Regulatory Guide 1.183 source term modeling, the release of activity from the core occurs over a 1.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> interval. Also instead of considering only the release of iodines and noble gases, a wide spectrum of nuclides is taken into consideration. Table 14C-4 lists the core inventory for the nuclides being considered for the LOCA with core melt (eight groups of nuclides). Table 14.3-18 provides the fission product release fractions and the timing/duration of releases to the containment as defined by the model in Regulatory Guide 1.183.

The iodine characterization from Regulatory Guide 1.183 is used; this is 4.85% elemental, 0.15%

organic and 95% particulate. The other groups of nuclides (other than the noble gases) all occur as particulates only.

Method of Analysis To evaluate the ability to meet 10 CFR 50,67 guidelines, the radiological consequences are calculated for the worst two hour exposure at the site boundary and for a 30 day exposure at the low population zone outer boundary distance. On site exposure is evaluated in the Control Room for a 30-day duration.

Activity releases to the environment are assumed to occur due to containment leakage and due to the leakage of sump solution recirculating outside containment The dose calculation models used in the analysis are described in Appendix 14C.

Effectiveness of Containment and Isolation Features in Terminating Activity Release The reactor Containment serves as a boundary limiting activity leakage. The containment is steel lined and designed to withstand internal pressure in excess of that resulting from the Design Basis 138 of 338 IPEC00036445 IPEC00036445

IP3 FSAR UPDATE Loss-of-Coolant Accident (Chapter 5). Weld seams and penetrations were designed with a double barrier to inhibit leakage. In addition, the Weld Channel and Penetration Pressurization System supplies a pressurized nitrogen seal, at a pressure above the containment calculated peak accident pressure, between the double barriers of the penetrations and between most double barriers of the weld seams so that if leakage occurred it would be into the Containment (Section 6.6). The Containment Isolation System, Section 5.2, provides a minimum of two barriers in piping penetrating the Containment. The Isolation Valve Seal Water System, Section 6.5, provides a water seal at a pressure above containment calculated peak accident response pressure in the piping lines that could be a source of leakage and is actuated on the containment isolation signal within one minute to terminate containment leakage. The Containment was designed to leak at a rate of less than 0.1 percent per day at design pressure without including the benefit of either the Isolation Valve Seal Water System or the Penetration Pressurization System. The double penetrations and most weld seams are pressurized continuously during reactor operation causing zero outleakage through these paths. No credit is taken in the radiological consequences analysis for the Isolation Valve Seal Water System or the Penetration Pressurization System.

Effectiveness of Spray System for Iodine Removal The effectiveness of the Containment Spray System for removal of inorganic iodine from the containment atmosphere is evaluated in detail in Appendix 6A, "Iodine Removal Effectiveness Evaluation of the Containment Spray System."

As discussed in Appendix 6A, an elemental iodine removal coefficient of 20 h(1 is associated with one spray pump operating during the spray injection phase. The spray flow rate during the recirculation phase is reduced from the injection phase resulting in a removal coefficient* of 10 hr-1 . Recirculation spray flow may be terminated at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the accident. It is also assumed that the sprays are no longer effective after the elemental iodine inventory in the Containment is reduced by a factor of 200.

Also as discussed in Appendix 6A, a particulate iodine removal coefficient of 4.6 h(1 is associated with the spray injection phase with one spray pump operating. The reduced spray flow available during the spray recirculation phase results in a reduction of the removal coefficient to 2.2 h(1. As described in NUREG-800, Standard Review Plan Section 6.5.2, Revision 2, the particulate iodine removal coefficient remains at this value until a particulate iodine decontamination factor of 50 is reached and the value is then reduced by a factor of 10.

Sedimentation Removal of Particulates Aerosols in the containment atmosphere are subject to removal by sedimentation. The sedimentation removal coefficient is conservatively assumed to be only 0.1 hr-1. It is also conservatively assumed that sedimentation removal does not continue beyond a DF of 1000.

During spray operation credit is taken for sedimentation removal of particulates only in the unsprayed region of the containment. Recirculation spray operation may be terminated at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the accident and credit for sedimentation removal of aerosols is applied to the whole containment volume at that time.

Effectiveness of Fan-Cooler Filter System No credit is taken for the HEPA and charcoal filters installed in the fan cooler units.

139 of 338 IPEC00036446 IPEC00036446

IP3 FSAR UPDATE Atmospheric Dispersion The meteorological dispersion of the leakage from the Containment has been calculated using the Sutton dispersion model and the dispersion parameters measured at the Indian Point site. The Sutton model has been modified to account for additional dispersion of the leakage due to turbulence in the wake of the Containment Building. Conservative dispersion characteristics applicable to three time periods were selected (Section 2.6) and the doses calculated for each period.

The Sutton equation for the dispersion of a point source at ground level gives the ground level plume concentration as a function of distance.

Where Cy , Cz and n are the dispersion parameters, u is the wind speed, y is the lateral distance from the plume center line, x is the downwind distance and Q is the point source release term.

In order to take into account building dilution, the Sutton equation is applied to a virtual point source upwind from the Containment. The distance of this source from the building is obtained by the requirement that the dispersion factors (Jy and (Jz of the gaussian distribution obey the relationships:

4(Jy (A )1/2 4(Jz (A)1/2 Where A is the cross-sectional area of the Containment Building. Thus (Jy and (Jz each yield a value for the distance; the geometric average of those values is the distance Xc, upwind of the virtual source.

The modified Sutton equation becomes:

The first and second periods of the dose calculation utilized this modified dispersion formula, a building area of 2000 square meters, and the inversion parameters assumed in TID-14844 which are conservative for the Indian Point Site.

1~5 I~ I~om Category Cy Cz n/L Inversion-I O.4m 0.07m n/L m/sec The first period comprises the first two hours after the accident. The direction of the 1 meter per second wind is assumed to be constant throughout the period. The second is the next 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> after the accident during which the same inversion condition is assumed to exist, but the average wind speed from the same direction is assumed to be 2 meters per second.

140 of 338 IPEC00036447 IPEC0003644 7

IP3 FSAR UPDATE The third period is from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident to 31 days after the accident. During this period, the meteorological conditions are assumed to be randomly distributed among the categories listed below:

Category, I Fraction, F1 1/u Cz Cy n Lapse - L1 0.137 0.575 0.48 0.6 0.2 Lapse - L2 0.061 0.191 0.43 0.53 0.3 Neutral- N 0.378 0.358 0.39 0.47 0.4 Inversion -I 0.424 0.493 0.07 0.40 0.5

-

The parameters u , Cy , Cz , and n for L1, L2 and N are those measured at the site (Section 2.6) and those for I are the TID-14844 assumptions. Because the winds are not expected to be from the same direction throughout the 30-day period, the dispersion formula was modified to account for long-term variability of the mean wind direction. The most adverse distribution was assumed to result in a maximum of 35 percent of the winds blowing in one 20° section. The dispersion formula used is:

This expression is obtained by integrating the Sutton equation from - 00 to +x in the y-direction and then averaging the concentration over the desired sector, i, for the appropriate fraction of the time, f.

The other parameters have been defined with Fi being the fraction of the time any particular weather category exists. As stated, r.. = 0.353 = (2 tan 10°) and f = 0.35.

Based on the above data, the dispersion factors listed in Table 14.3-13 are obtained. These are also plotted in Figure 14.3-73.

Control Room Model The dose criterion applicable to the Control Room is found in 10 CFR 50.67 which specifies that:

Personnel in the Control Room for a 30 day period of time following an accident must not receive doses greater than 5 rem TEDE.

Radiation doses in the Control Room are calculated based on the sources from the following areas:

1) Direct radiation from airborne radioactivity outside the Control Room

2) Airborne radioactivity inside the Control Room from makeup air intake.

3) Direct radiation from activity inside containment air.

The design of the Control Room ventilation and air conditioning system is presented in Section 9.9.2.

During normal operation, conditioned air is admitted to the Control Room through downward directed 141 of 338 IPEC00036448 IPEC00036448

IP3 FSAR UPDATE ceiling registers located 14'-9" above the control room floor. A perforated aluminum or egg crate ceiling is located 12 feet above the floor.

The damper in the makeup air supply duct is partially open during normal operation and under remote manual control. For a description of the Control Room Ventilation and Filtration System refer to Section 9.9.

A Safety Injection signal or a high activity signal from the area monitor (Radiation Monitoring System) in the Control room automatically starts the separate HEPA-charcoal filter unit fan and positions dampers to route flow through this unit. Under these conditions enough air is brought in through the makeup system to maintain the Control Room at a slight positive pressure. All incoming air is passed through the HEPA-charcoal filter unit where non-gaseous activity is cleaned up in the filters.

The whole body dose from the activity inside the Control Room was calculated using a finite cloud model, as discussed in Appendix 14C. The whole body dose from the cloud passing over the Control Room was calculated taking into account the shielding afforded by the walls and roof (24 inches of concrete) of the Control Room. Occupancy factors for control room personnel were assumed to be 1.0 for 0-24 hours, 0.6 for 1-4 days and 0.4 for 4-30 days.

For the direct containment dose contribution to control room operators, the sources were assumed to be homogenously distributed within the free volume of the Reactor Containment. The doses were based on a point kernel attenuation model, with the source region divided into a number of incremental source volumes, and the associated attenuation and gamma ray buildup computed between each source point and the dose point.

Containment Leakage Analysis The radiological consequences of the postulated large-break LOCA has been performed with containment leakage releases continuing over a 30~day period. The containment is assumed to leak at the design basis leakage rate of 0.1 % per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and at half that rate after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Assumptions utilized in the analysis are listed in Table 14.3-18.

Sump Solution Leakage Outside Containment The Indian Point Unit 3 design includes internal recirculation which is to be maintained for the first 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following a LOCA. An analysis has been performed to calculate the dose resulting from leakage from the ECCS outside containment after external recirculation is established at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The activity released from the core is assumed to be present in the sump solution (with the exception of the gaseous activity). The analysis considered a leak rate of 4.0 gph. This is double the Technical Specification limit. The leakage is assumed to start at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and continues until 30 days from the accident initiation. A conservatively low sump water volume is modeled to maximize the iodine concentration in the leakage.

Only the iodine activity has the potential of becoming airborne. Iodine partition coefficients have been calculated for the Indian Point 3 external leakage sources (ECCS leakage post LOCA) beginning at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> post accident when ECCS flow is directed by procedure to go to portions of the external safety injection system. These calculations are based upon calculated post accident fluid temperatures and pH in sump water, and the flows and volumes in the Indian Point 3 primary auxiliary building (PAS), and ventilation flow rates in various areas of the PAS. A partition coefficient of 2.8% is bounding for the 6.5 hr to 30 day period. The iodine becoming airborne is assumed to be 97%

elemental and 3% organic.

142 of 338 IPEC00036449 IPEC00036449

IP3 FSAR UPDATE Additionally, it is also assumed that during the first four hours of the accident there is 1,0 gph sump solution leakage through the reactor coolant pump sealleakoff line that enters the PAB. This leakage is assumed to have an iodine partition coefficientof 10%, The iodine becoming airborne is assumed to be 97% elemental and 3% organic.

The releases would be subject to filtration by the filtered ventilation system provided for the PAB which houses the portions of the ECCS located outside containment. However, filtration of the releases is not credited in the analysis. Table 14.3-18 provides a list of analytical inputs and assumptions for the sump solution leakage.

Calculated Doses The resulting offsite and control room doses are:

Site Boundary Containment leakage 23.1 rem TEDE Sump solution leakage 0.3 rem TEDE Total 23.4 rem TEDE Low Population Zone Containment leakage 10.4 rem TEDE Sump solution leakage 0.8 rem TEDE Total 11.2 rem TEDE Control Room Containment leakage 3.2 rem TEDE Sump solution leakage 1.12 rem TEDE Plume external to control 1.0E-3 rem TEDE room Radiation field from 3.0E-4 rem TEDE containment Total 4.3 rem TEDE The site boundary and LPZ doses are below the 10 CFR 50.67 dose acceptance guideline of 25 rem TEDE. The control room dose is below the 10 CFR 50,67 dose limit of 5,0 rem TEDE.

The worst 2-hour period for the site boundary dose is 0.6 to 2.6 hr.

14.3,5.2 Small Break LOCA Radiological Consequences The radiological consequences resulting from a small break LOCA which is large enough to result in actuation of the containment spray system would be bounded by the Large Break LOCA analysis.

This is true because a small break releases less activity to the containment than that assumed in the large break, but the spray system would function in an identical manner.

An analysis was performed to determine the radiological consequences for a small break LOCA that does not actuate the containment sprays. AS a result of the accident, fuel clad damage is assumed to occur. Due to the potential for leakage between the primary and secondary systems, radioactive reactor coolant is assumed to leak from the primary into the secondary system. A portion of this 143 of 338 IPEC00036450 IPEC00036450

IP3 FSAR UPDATE radioactivity is* released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Radioactive reactor coolant is also discharged to the containment via the break. A portion of this radioactivity is released through containment leakage to the environment.

In determining.the offsite doses following the accident, it is conservatively assumed that all of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Five percent of the core activity is assumed to be contained in the pellet-clad gap. Regulatory Guide 1.183 specifies that the iodine released from the fuel is 95% particulate (cesium iodide), a 4.85% elemental, and 0.15%

organic. These fractions are used for containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.

Conservatively, all the iodine, alkali metals group and noble gas activity (from prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.

The primary to secondary steam generator tube leak used in the analysis is 0.25 gpm and 1.0 gpm for all four steam generators combined.

When determining the doses due to containment leakage, all of the iodine, alkali metal and noble gas activity is assumed to be in the containment The design basis containment leak rate of 0.1% per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter,* the containment leak rate is assumed to be one~half the design value or 0.05% per day. Releases are continued for 30 days from the start ofthe event.

No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite poweL All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere.

Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.

An iodine partition factor in the steam generators of 0.01 curies/gm steam per curies/gm water is used. This partition factor is also used for the alkali metal activity in the steam generators.

No credit is taken for containment spray operation which would remove airborne particulates and elemental iodine. Credit is taken for removal of particulates by the fan cooler unit HEPA filters.

Deposition removal of elemental iodine onto containment surfaces would be expected but no credit was taken for this removal mechanism.

A listing of inputs and assumptions is provided in Table 14.3-18a.

Calculated Doses The small break LOCA 2-hour site boundary dose is 13.1 rem TEDE with the worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose being 0-2 hours. The 30 day low population zone dose is 9.8 rem TEDE. These doses are less than the 25 rem TEDE limit value of 10 CFR 50.67.

The accumulated dose to the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite dose, using the control room model discussed in Appendix 14C. The calculated control room dose is 4.1 rem TEDE which is less than the 5.0 rem TEDE control room dose limit of 10 CFR 50.67.

144 of 338 IPEC00036451 IPEC00036451

IP3 FSAR UPDATE This section is retained for historical purposes. These calculations were performed using the TID-14844 source term and 10 CFR 100 methodologies; In 2005, IP3 was reanalyzed using the Alternate Source Term Methodology under 10 CFR 50.67. This analysis was not part of the standard suite of analyses to be performed under 10 CFR 50.64.

Normally the Reactor Containment is maintained with all flow paths to the atmosphere closed. The containment purge exhaust monitor is used to monitor the releases of the purge system and automatically close the isolation valves in the event that high radiation is detected. In addition, the isolation valves of this system are closed by a high containment pressure signal. The control room operator would also isolate the purge and ventilation systems in the event of any abnormal indications such as low Reactor Coolant System pressure or leakage indications. With the two 36-inch diameter purge lines open to the atmosphere, pressure buildup within the Containment could be delayed.

Under those conditions, containment isolation would be initiated upon a high radiation signal in the purge exhaust or within an expected 15 minutes by the control room operator. With these assumptions, safety injection is assumed delayed until the containment high pressure setpoint is reached or is initiated manually. For the range of pipe sizes connected to the pressurizer vapor space (i.e., % inch up through 6 inches) and evaluated in the analysis, no clad damage is expected and the resulting activity released to the Containment is limited to that contained in the Reactor Coolant System prior to the accident.

The radiological consequences of a Loss-of-Coolant Accident as a result of a rupture in the pressurizer during containment purging make the following conservative assumptions:

1. Rupture in the pressurizer vapor space occurs at full power coincident with containment purging*

2. The activity stored in the Reactor Coolant System (assuming 1% defective fuel) is assumed to be released at a constant rate over a time period of 10 minutes (time to blowdown the Reactor Coolant System at maximum rate)

3. Of the iodine released to the Containment, 50% immediately plates out on interior surfaces of the Containment. Of the airborne iodine in the Containment, 10% is assumed to be of organic form.

4. All activity in the Reactor Coolant System is released to the lower containment volume during blowdown (see Table 9.2-5).

5. No additional core damage occurs as a result of the accident.

6. Containment isolation is not automatically initiated. Rather, containment isolation is initiated by the operator in the Control Room. Two cases were analyzed: a) containment isolation in 15 minutes following the accident, and b) containment isolation is delayed until 50 minutes after the accident.

145 of 338 IPEC00036452 IPEC00036452

IP3 FSAR UPDATE

7. After the Containment is isolated, activity releases result from containment leakage only.

• NOTE: Containment purging is only achieved at cold shutdown.

Tables 14.3-19 through 14.3-21 give the design values, isotopic, and meteorological data used in this analysis. The dose equations and "standard man" data used in this analysis are consistent with those given in AEC Safety Guide No.4. Table 14.3-22 gives the doses calculated for this accident. As can be seen from this table, the doses resulting from this postulated accident are well within the guidelines of 10 CFR 100, even for the unlikely case of continued purging for 50 minutes following the accident.

A variation on this scenario has been evaluated and found to be bounded by the "Small Break LOCA During Purge" accident for Site Boundary and Low Population Zone and, by separate analysis, for the Control Room. This variation involves a pressurizer line break at such time that the pressurizer temperature is greater than 200°F with the remainder of the Reactor Coolant System below 200°F.

Because the RCS is in the cold shutdown condition, containment integrity is relaxed. Therefore, a postulated pressurizer line break could potentially result in a steam release from the RCS to the environment. Conservative assumptions for this scenario include: 1) the release of the entire pressurizer volume as saturated liquid flashing to steam, 2) the break occurring after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of subcriticality following full power reactor operation with the failed fuel at the Technical Specification limit, 3) no credit for containment closure or holdup, 4) release of 50% of halogens and all noble gases to the environment, and 5) a Control Room manual isolation time of 5 minutes, which maximizes doses to Control Room personnel. Under these circumstances, the resultant worst case doses are 24.6 rem to the thyroid in the Control Room (about 82% of the 10 CFR 50, Appendix A, Criterion 19 Limit). For the Site Boundary and Low Population Zone, the doses are less than 10% of the 10 CFR 100 limits (92).

These doses are based on a 24-hour delay prior to relaxation of Commitment integrity after shutdown and on the assumption of reactor coolant activity at the Technical Specifications limits. Accordingly, this delay may be relaxed if measured reactor coolant activity is low, provided that it can be shown that the above doses would not be exceeded subsequent to a postulated pressurizer break. This may be done by using low coolant activity to compensate for a shorter delay time, as established in Reference 92 and plant procedures. This time delay represents administrative controls placed on the relaxation of containment integrity that are more conservative than the licensing basis.

14.3.6 Containment Integrity Analysis The design and licensing of nuclear power plants require that the containment be analyzed for pressure and temperature effects. The analyses include pressure and temperature transients to which the containment might be exposed as a result of postulated line breaks. Containment integrity and subcompartment safety analyses are performed for dry containment designs to quantify the margin in the containment design pressure and peak temperature for equipment environmental qualification (EO), and to demonstrate the acceptability of the containment safeguards equipment to mitigate the postulated transient. As part of a Containment Margin Improvement Program (Reference

90) carried out in 1989, long-term containment integrity analyses were conducted. The objective of the 1989 analysis program was to provide containment analysis results using plant":specific Indian Point Unit 3 data, circa 1989, and new state-of-the-art Loss-of-Coolant-Accident (LOCA) mass and energy release (M&E) evaluation models. In this way the licensing basis for Unit 3 is clarified and updated, and pressure margin for operation of Unit 3 had been determined and made available for possible future use. Subsequent reanalyses were completed for Containment Integrity with respect to 146 of 338 IPEC00036453 IPEC00036453

IP3 FSAR UPDATE the effects of High-Head Injection flow balance criteria, using the margin improvement program as the basis. The Containment Integrity accident analyses herein demonstrate that the peak calculated containment pressure will remain less than the containment design value of 47 psig as identified in WCAP-12269 (Reference 90). SECL-92-131 (Reference 91), SECL-92-255 (Reference 103), and WCAP-12269 document the historical licensing basis containment analyses of record. The 47-psig limit was used as an acceptance criteria by the U.S. Nuclear Regulatory Commission (NRC) in their safety evaluation report (SER) addressing the Containment Margin Improvement and Ultimate Heat Sink Programs (Reference 104).

The potential effects of the IP3 Stretch power Uprate (SPU) were defined as changes to specific safety analysis input parameter values. All safety analysis input parameter values that could potentially be affected by the SPU (Reference 113) were reviewed based on pertinent instrument channel uncertainty calculation previously performed.

The specific changes to safety analyses input parameters consistent with the SPU are:

1. Uncertainly on initial pressurizer pressure of +49 psi.

2. Lower bound on initial accumulator pressure of 555 psia (540 psig).

3. Range on accumulator volume from 807.2 fe to 847.2 fe.

4. Uncertainty on initial condition steam generator level of .+/-.10% narrow range span (NRS).

5. Uncertainty on reactor coolant flow of +/- 2.9%.

The uncontrolled release of pressurized high temperature reactor coolant, termed a Loss-of-Coolant Accident (LOCA), will result in release of steam and water into the containment. This, in turn, will result in an increase in local subcompartment pressures, and an increase in the global containment pressure and temperature. The pressurization of subcompartments in the immediate vicinity of the LOCA break area is evaluated to ensure structural integrity of the subcompartment structures. The most severe pressurization in these areas generally occurs due to the large M&E flow early in the transient. In contrast, the global containment, temperature and pressure must be evaluated for long term EO concerns as well as for the pressure peaks (which occur later than the subcompartment pressure peaks). Therefore, there are both long and short term issues relative to a postulated LOCA that must be considered. As part of the SPU, long-term and short~term LOCA M&E releases were calculated. The long term M&E releases are affected by changes to safety analysis input parameters consistent with IP3 SPU. Specific changes to the safety analysis input parameters included: uncertainty in initial condition pressurizer pressure of +/- 49 psi; lower bound change on initial accumulator pressure of 555 psia (540psig); range on accumulator volume from 807.2 fe to 847.2 fe, uncertainty in initial condition steam generator level of +/- 10% narrow range span (NRS); uncertainty on reactor coolant flow of +/- 2.9%; and uncertainty on initial condition pressurizer level of +5.1/-3.5%

span. Thus, a reanalysis was performed in order to credit additional margin to the containment design and EO limits due to analysis methodology improvements. Short-term M&E releases are neither adversely nor significantly affected by changes to safety analyses input parameters consistent with the Indian Point Unit 3 SPU.

In addition, a long-term containment response analysis is performed based on the calculated long-term M&E releases. The containment response analysis is performed in order to demonstrate the 147 of 338 IPEC00036454 IPEC00036454

IP3 FSAR UPDATE capability of the containment safeguards systems to maintain the containment pressure and temperature below the design and EQ limits following a postulated LOCA. Note that for IP3, LOCA was determined to be limiting for peak pressure.

Steamline ruptures occurring inside a reactor containment structure may result in significant releases of high-energy fluid to the containment environment, possibly resulting in high containment temperatures and pressures. The quantitative nature of the releases following a steamline rupture is dependent upon the many possible configurations of the plant steam system and containment designs as well as the plant operating conditions, the size of the rupture, and the single failure assumption.

The analysis typically considers a variety of postulated pipe breaks encompassing wide variations in plant operation, safety system performance, and break size in determining the containment response to a secondary system pipe rupture.

The postulated break area can have competing effects in blowdown results. Larger areas will be more likely to result in large amounts of water being entrained in the blowdown. However, larger breaks also result in earlier generation of protective trip signals following the break and a reduction of both the power production by the plant and the amount of high energy fluid available to be released to the containment.

When evaluating Indian Point Unit 3, the effects of plant power level and break area on the M&E releases from a ruptured steamline have been restricted to a small a number of cases. Plant power levels of 0%, 30%, 70% and 100% of nominal full power and only the full double-ended rupture (DER) were considered in WCAP-12269 (Reference 90). The cases examined in this study were identified as part of the Margin Improvement Program related to steamline break M&E releases inside contai nment.

14.3.6.1 Long-Term LOCA Mass and Energy Releases 14.3.6.1.1 Introduction Discussed in this section are the long-term LOCA M&E releases for the hypothetical double-ended pump suction (DEPS) and double-ended hot leg (DEH L) break cases. The mass energy release rates described in this section form the basis of further computations to evaluate the containment response following the postulated LOCA (subsection 14.3.6.2).

A total of three LOCA M&E release cases were analyzed. These cases addressed two different break locations, the DEHL break and the DEPS break. The DEPS break was analyzed for both minimum and maximum safeguards (minimum and maximum pumped emergency core cooling system flows).

The minimum emergency core cooling system (ECCS) cases were performed to address maximum available steam release (minimizing steam condensation) and the maximum ECCS cases were performed to address the effects of maximizing mass flow and subsequent effect on containment response.

The limiting long-term LOCA M&E releases are extended out in time to approximately 115 days and are utilized as input to the containment response analysis, which demonstrates margin to the containment design and EQ limits and the acceptability of the containment safeguards systems to mitigate the consequences of a hypothetical large break LOCA. The containment safeguards systems must be capable of limiting the peak containment pressure to less than the design pressure and to limit the temperature and pressure excursion to below the EQ limits. For both the current licensing basis and the SPU, the M&E releases were generated with the March 1979 model, 148 of 338 IPEC00036455 IPEC00036455

IP3 FSAR UPDATE described in Reference 45. The NRC review and approval letter for this model is included with Reference 45. The Reference 45 methodology continues to be acceptable and applicable to Indian Point Unit 3, and has been used and approved on many plant-specific-dockets.

14.3.6.1.2 Input Parameters and Assumptions The M&E release analysis is sensitive to the assumed characteristics of various plant systems. Some of the most-critical items are the RCS initial conditions, core decay heat, accumulators, ECCS flow, and primary and secondary metal mass and steam generator heat release modeling. Specific assumptions concerning each of these items are discussed in this section. Tables 14.3-23 through 14.3-26 present key data assumed in the analysis. All input parameters are determined based on NRC accepted methodology (Reference 45).

Initial Power Level The initial power level is assumed to be 3280.3 MWt which is 102% of the rated thermal power (3216 MWt) adjusted for a calorimetric error of 2% for the Indian Point Unit 3 Station. A maximum initial power is conservative for maximizing the M&E releases, with respect to RCS temperature, available decay heat energy and initial core stored energy.

Initial RCS Temperature and Pressure Initial RCS temperatures are chosen to bound the highest average coolant temperature range of all operating cases. The initial THOT (vessel outlet temperature) of 610.5°F and initial TCOLD (core inlet temperature) of 548.5°F were modeled; both temperatures include a +7.5°F for instrument error and deadband. The use of the higher temperatures is conservative because the initial fluid energy is based on coolant temperatures that are at the maximum levels attained in steady state operation.

The RCS pressure is based upon a nominal value of 2250 psia plus an allowance of +49 psi that accounts for the measurement uncertainty on pressurizer pressure. This assumption only affects the blowdown phase results. The rate at which the RCS blows down is initially more severe at the higher RCS pressure. Additionally the RCS has a higher fluid density at the higher pressure (assuming a constant temperature) and subsequently has a higher RCS mass available for releases. (Note: The RCS initial temperatures were conservatively based upon a steam generator tube plugging (SGTP) level conditions of 0% to 10%, to cover all possible temperature range of operation.)

Steam Generator Model A uniform steam generator tube plugging level of 0% is modeled. This assumption maximizes the reactor coolant volume and fluid release by virtue of consideration of the RCS fluid in all tubes.

During the post-blowdown period, the steam generators are active heat sources since significant energy remains in the secondary metal and secondary mass that has the potential to be transferred to the primary side. The 0% tube plugging assumption maximizes heat transfer area and therefore the transfer of secondary heat across the steam generator tubes. Additionally, this assumption reduces the reactor coolant loop resistance, which reduces the pressure drop upstream of the break for DEPS breaks and increases break flow. Thus, the analysis very conservatively accounts for the level of steam generator plugging by using 0%.

Secondary-to-primary heat transfer is maximized by assuming conservative coefficients of heat transfer (i.e., steam generator primary/secondary heat transfer and RCS metal heat transfer).

Maximum secondary-to-primary heat transfer is ensured by maximizing the initial steam generator mass based upon 100% power conditions and then increasing this by 10% to maximize the available energy.

149 of 338 IPEC00036456 IPEC00036456

IP3 FSAR UPDATE Fuel Design - Core Stored Energy Core stored energy is the amount of energy in the fuel rods above the local coolant temperature. The selection of the fuel design features for the long-term M&E release calculation is based on the need to conservatively maximize the energy stored in the fuel at the beginning of the postulated accident.

Core stored energy is addressed in the analysis as full power seconds.

Core Decay Heat Model The Nuclear Power Plant Standards Committee (NUPPSCO) of the American Nuclear Society (ANS) approved ANS Standard 5.1 (Reference 48) for the determination of decay heat. This standard was used in the M&E release model with the input described below.

Significant assumptions in the generation of the decay heat curve for use in design basis containment integrity LOCA analyses include:

1. Decay heat sources are fission product decay and heavy element decay of U-239 and Np-239.

2. Decay heat power from fissioning isotopes other than U-235 is assumed to be identical to that of U-235.

3. Fission rate is constant over the operating history of maximum power level.

4. The factor accounting for neutron capture in fission products has been taken from Table 10, of Reference 48.

5. The fuel has been assumed to be at full power for 108 of a seconds.

6. The total recoverable energy associated with one fission has been assumed to be 200 MeV/fission.

7. Two sigma uncertainty (two times the standard deviation) has been applied to the fission product decay.

Based upon NRC staff review, the SER of the March 1979 evaluation model (Reference 45), the use of the ANS Standard-5.1, November 1979 decay heat model was approved for the calculation of mass and energy releases to the containment following a loss-of-coolant accident. Table 14.3-26 provides the Decay Heat Curve.

The NRC issued an information notice (Reference 100) regarding the use of the ANS 5.1 decay heat standard. The following items address that information notice:

1. The comparisons presented in the information notice are for Peak Cladding Temperature only. Even though decay effects are illustrated, there is no mention of LOCA M&E releases and containment response calculations.

150 of 338 IPEC00036457 IPEC00036457

IP3 FSAR UPDATE However, there is the implied impact on any analysis that has utilized the ANS standard.

2. For LOCA M&E, the current methodology (Reference 45) utilizes the ANS Standard 5.1 for the determination of the decay heat. The input utilized is called out on page 2-10 of the WCAP. The model, including the decay heat model, has been approved (letter from C. E. Rossi of NRC to W. J. Johnson of Westinghouse, dated 2/17/87, included with Reference 45.)

3. For LOCA M&E, the ANS 5.1 standard is used in the selection of inputs. Power history, initial fuel enrichment, and neutron flux level, which are called out in the information notice, are also called out in Reference 45.

Reactor Coolant System Fluid Energy An increase in RCS fluid volume of 3% (which is composed of 1.6% allowance for thermal expansion and 1.4% for uncertainty) is modeled. A total vessel TDF of 354,400 gpm was used, which includes an allowance for RCS flow uncertainty of +/- 2.9%.

Application of Single-Failure Criteria An analysis of the effects of the single-failure criterion has been performed on the M&E release rates for each break analyzed. An inherent assumption in the generation of the M&E release is that offsite power is lost. This results in the actuation of the emergency diesel generators, which are required to power the ECCS. Maximum containment backpressure equal to the design pressure is modeled, which affects the rate of safety injection, extending the reflood phase, and maximizing the steam release.

Two single failures have been analyzed: The first postulates the single failure of an emergency diesel generator. This is conservatively assumed to result in the loss of one train of safeguards equipment, which is conservatively modeled as: two high head safety injection (HHSI) and one Low Head Safety Injection (LHSI) pump (Minimum Safeguards). The second single failure assumption postulates failure of one containment spray pump. However, this has no impact on the amount of ECCS flow and therefore, no impact on the mass and energy release portion of the analysis. This case considers 3 HHSI and 2 LHSI Pumps (Maximum ECCS).

Safety Injection System Following a large-break LOCA inside containment, the safety injection system (SIS), operates to reflood the RCS. The first phase of the SIS operation is the passive accumulator injection. Four accumulators are assumed available to inject. When the RCS depressurizes to 555 psia the accumulators begin to inject into the cold legs at the reactor coolant loops. The accumulator injection temperature was modeled as 130 F. 0 The active pumped ECCS operation of the SIS was modeled to address both minimum and maximum safeguards (minimum ECCS and maximum ECCS). The minimum ECCS flow is addressed to calculate the effect on minimizing steam-water mixing/ steam condensation. The maximum ECCS case addresses the effects of maximizing mass flow. The safety injection (SI) signal is assumed to be actuated on the low pressurizer pressure setpoint of 1648.7 psia. The SIS was assumed to deliver to the RCS 27.8 seconds after the generation of the SI signal. The ECCS flow is delivered as a function of RCS pressure. The pumped ECCS temperature for the injection phase was assumed to be at 151 of 338 IPEC00036458 IPEC00036458

IP3 FSAR UPDATE 110°F. In the determination of long-term containment pressure and temperature transients, credit is taken for cold leg pumped sump recirculation ECCS flow to the core and sump heat removal via the residual heat removal system (RHR) heat exchangers (Hx). For the minimum ECCS case, (failure of one emergency diesel generator), two HHSI pumps and one LHSI pump are available. The ECCS configuration for the recirculation phase maximum ECCS case is three HHSI pumps and two LHSI pumps.

Tables 14.3-24 and 14.3-25 provide the pumped ECCS flows as a function of RCS pressure for the minimum and maximum ECCS cases, respectively.

14.3.6.1.3 Description of Analyses The evaluation model used for the long-term LOCA M&E release calculations is the March 1979 model described in Reference 45. This evaluation model has been reviewed and approved generically by the NRC. The approval letter is included with Reference 45. This LOCA M&E release methodology has been utilized and approved on the plant-specific dockets for other Westinghouse PWRs such as Catawba Units 1 and 2, Beaver Valley Unit 2, McGuire Units 1 and 2, Millstone Unit 3, Sequoyah Units 1and 2, Surry Units 1 and 2, Indian Point Unit 2 and Indian Point Unit 3.

A description of the Reference 45 methodology is provided below.

Mass and Energy Release Phases The LOCA M&E release analysis is typically divided into four phases: blowdown, refill, reflood, and post-reflood. Each of these phases is analyzed by the following codes: SATAN-VI (blowdown),

WREFLOOD (reflood), FROTH (post-reflood) and EPITOME (post-reflood).

The phases and codes are discussed in detail below.

The first phase of a LOCA M&E release transient is the blowdown phase, the period of time from accident initiation (when the reactor is at steady state operation) to the time that the RCS and containment reach an equilibrium pressure. The blowdown period is typically <30 seconds. It ends when the RCS active core area is essentially empty, which is within seconds of ECCS injection actuation for the minimum safeguards ECCS case. For the maximum ECCS case, ECCS injection is credited after the SI signal is reached without a delay as noted above in order to maximize the mass flow.

A M&E release version of the SATAN-VI code is used for computing the blowdown transient. The code utilizes the control volume (element) approach with the capability for modeling a large variety of thermal fluid system configurations. The fluid properties are considered uniform and thermodynamic equilibrium is assumed in each element. A point kinetics model is used with weighted feedback effects. The major feedback effects include moderator density, moderator temperature, and Doppler broadening. A critical flow calculation for subcooled (modified Zaloudek), two-phase (Moody), or superheated break flow is incorporated into the analysis. The methodology for the use of this model is described in Reference 45.

The refill period is the second phase of the LOCA M&E release transient. It is the period of time when the lower plenum is being filled by accumulator and pumped ECCS water. At the end of blowdown, a large amount of water remains in the cold legs, downcomer and lower plenum. To conservatively consider the refill period for the purpose of containment M&E releases, it is assumed that this water is instantaneously transferred to the lower plenum along with sufficient accumulator water to completely 152 of 338 IPEC00036459 IPEC00036459

IP3 FSAR UPDATE fill the lower plenum. This allows an uninterrupted release of M&E to containment. Thus, the refill period is conservatively neglected in the M&E release calculation.

The third phase of a LOCA M&E release transient is the core reflooding phase, which begins when the RCS has depressurized (blowdown) due to the loss of water through the break. The water from the lower plenum, supplied by the ECCS refills the reactor vessel and provides cooling to the core.

This phase ends when the core is completely quenched. The model conservatively assumes quenching of the core at the 10-foot elevation for containment functional design calculations. During this phase, decay heat generation will produce boiling in the core resulting in a two-phase mixture of steam and water in the core. This two-phase mixture rises above the core and subsequently enters the steam generators. The most-important feature is the steam/water mixing model (described below), which is used during this phase.

The WREFLOOD code is used for computing the reflood portion of the M&E transient. The WREFLOOD code consists of two basic hydraulic models - one for the contents of the reactor vessel, and one for the coolant loops. The two models are coupled through the interchange of the boundary conditions applied at the vessel outlet nozzles and at the top of the downcomer. Additional transient phenomena such as pumped ECCS and accumulators, reactor coolant pump performance, and steam generator releases are included as auxiliary equations that interact with basic models as required. The WREFLOOD code permits the capability to calculate variation during the core reflooding transient of basic parameters such as core flooding rate, core and down comer water levels, fluid thermodynamic conditions (pressure, enthalpy, density) throughout the primary system, and mass flow rates through the primary system. The code permits hydraulic modeling of the two flow paths available for discharging steam and entrained water from the core to the break (i.e., the path through the broken loop and the path through the unbroken loops).

A complete thermal equilibrium mixing condition for the steam and ECCS injection water during the reflood phase has been assumed for each loop receiving ECCS water. This is consistent with usage and application of the Reference 45 M&E release evaluation model in recent analyses, (e.g., D.C.

Cook Docket Reference 101). Even though the Reference 45 model credits steam/mixing only in the intact loop and not in the broken loop, justification, applicability, and NRC approval for using the mixing model in the broken loop has been documented (Reference 101). This assumption is justified and supported by test data, and is summarized below.

The model assumes a complete mixing condition (i.e., thermal equilibrium) for the steam/ water interaction. The complete mixing process, however, is made up of two distinct physical processes.

The first is a two-phase interaction with condensation of steam by cold ECCS water. The second is a single-phase mixing of condensate and ECCS water. Since the steam release is the most important influence to the containment pressure transient, the steam condensation part of the mixing process is the only part that needs to be considered. (Any spillage directly heats only the sump.)

The most applicable steam/water mixing test data has been reviewed for validation of the containment integrity reflood steam/water model. This data was generated in 1/3-scale tests (Reference 46),

which are the largest scale data available, and thus most clearly simulates the flow regimes and gravitational effects that would occur in a PWR. These tests were designed specifically to study the steam/water interaction for PWR reflood conditions.

From the entire series of 1/3-scale tests, a group corresponds almost directly to containment integrity reflood conditions. The injection flow rates for this group cover all phases and mixing conditions calculated during the reflood transient. The data from these tests were reviewed and are discussed in detail in Reference 45. For all of these tests, the data clearly indicates the occurrence of very 153 of 338 IPEC00036460 IPEC00036460

IP3 FSAR UPDATE effective mixing with rapid steam condensation. The mixing model used in the containment integrity reflood calculation is therefore wholly supported by the 1/3-scale steam/water mixing data.

Additionally, the following justification is also noted, the post-blowdown limiting break for the containment integrity peak pressure analysis is the DEPS break. For this break, there are two flowpaths available in the RGS by which M&E may be released to containment. One is through the outlet of the steam generator, and the other is via reverse flow through the reactor coolant pump.

Steam that is not condensed by EGGS injection in the intact RGS loops passes around the downcomer and through the broken loop cold leg and pump in venting to containment. This steam also encounters EGGS injection water as it passes through the broken loop cold legs, complete mixing occurs and a portion of it is condensed. It is this portion of condensed steam that is taken credit for in this analysis. This assumption is justified based upon the postulated break location, and the actual physical presence of the EGGS injection nozzle. A description of the test and test results is contained in References 45 and 46.

Post-reflood describes the period following the reflood transient. For the DEPS break, a two-phase mixture exits the core, passes through the hot legs, is superheated in the steam generators, and exits the break as superheated steam. After the broken loop steam generator cools, the break flow becomes two phase.

The FROTH code (Reference 47) is used for computing the post-reflood transient. The FROTH code calculates the heat release rates resulting from a two-phase mixture level present in the steam generator tubes. The M&E releases that occur during this phase are typically superheated due to the depressurization and equilibration of the broken loop and intact loop steam generators. During this phase of the transient, the RGS has equilibrated with containment pressure, but the steam generators contain a secondary inventory at an enthalpy that is much higher than the primary side. Therefore, there is a significant amount of reverse heat transfer that occurs. Steam is produced in the core due to core decay heat. During the FROTH calculation EGGS injection is addressed for both the injection phase and the recirculation phase.

Steam generator equilibration and depressurization is the process by which secondary side energy is removed from the steam generators in stages. The FROTH computer code calculates the heat removal from the secondary mass until the secondary temperature is at the saturation temperature (Tsat) at the containment design pressure. After the FROTH calculations, steam generator secondary energy is removed based on first- and second-stage rates. The EPITOME code continues the FROTH calculation for steam generator cooldown. The first-stage rate is applied until the steam generator reaches Tsat at the user-specified intermediate equilibration pressure, when the secondary pressure is assumed to reach the actual containment pressure. Then the second-stage rate is used until the final depressurization, when the secondary reaches the reference temperature of Tsat at 14.7 psia, or 212°F. The heat removal of the broken-loop and intact-loop steam generators are calculated separately.

By reading the output files from SATAN VI, WREFLOOD, and FROTH, the EPITOME code compiles a summary of data on the entire transient, including formal instantaneous M&E release tables and M&E balance tables with data at critical times.

During the FROTH calculations, steam generator heat removal rates are calculated using the secondary side temperature, primary side temperature and a secondary side heat transfer coefficient determined using a modified McAdam's correlation. Steam generator energy is removed during the FROTH transient until the secondary side temperature reaches saturation temperature at the containment design pressure. The constant heat removal rate used during the first heat removal 154 of 338 IPEC00036461 IPEG00036461

IP3 FSAR UPDATE stage is based on the final heat removal rate calculated by FROTH. The steam generator energy available to be released during the first stage interval is determined by calculating the difference in secondary energy available at the containment design pressure and that at the (lower) user specified intermediate equilibration pressure, assuming saturated conditions. This energy is then divided by the first stage energy removal rate, resulting in an intermediate equilibration time. At this time, the rate of energy released drops substantially to the second-stage rate. The second-stage rate is determined as the fraction of the difference in secondary energy available between the intermediate equilibration and final depressurization at 212°F, and the time difference from the time of the intermediate equilibration to the user-specified time of the final depressurization at 212°F. With current methodology, all of the secondary energy remaining after the intermediate equilibration is conservatively assumed to be released by imposing a mandatory cooldown and subsequent depressurization down to atmospheric pressure at 3600 seconds, i.e., 14.7 psia and 212°F.

As discussed, the current approved methodology assumes that all energies in the system are taken out to these conditions in the first hour of the event. In actuality, the release of these energies to these conditions would take much longer, on the order of hours. There is the possibility that the remaining energies, for example, down to containment conditions of 130°F could be released:

however, this is not included in the releases discussed herein. Based upon the current and approved models, this additional energy would tend to slightly increase the water temperature of the spilled fluid coming form the pump side of the break, but would not increase the amount of steam being released from the steam generator side of the break. It is expected that the effects on the long-term cool down would be insignificant.

The methodology for the use of this model is described in Reference 45. The M&E release rates are calculated by FROTH and EPITOME until the time of containment depressurization. After containment depressurization (14.7 psia), the M&E release available to containment is generated directly from core boiloff/decay heat.

Computer Codes The Reference 45 M&E release evaluation model is comprised of M&E release versions of the following codes: SATAN VI, WREFLOOD, FROTH, and EPITOME. These codes were used to calculate the long-term LOCA M&E releases for Indian Point Unit 3.

SATAN VI calculates blowdown, the first portion of the thermal-hydraulic transient for the RCS following break initiation, including pressure, enthalpy, density, M&E flowrates, and energy transfer between primary and secondary systems as a function of time.

The WREFLOOD code addresses the portion of the LOCA transient during the core reflood phase.

FROTH models the post-reflood portion of the transient. The FROTH code is used for the steam generator heat addition calculation from the broken and intact loop steam generators.

EPITOME continues the FROTH post-reflood portion of the transient from the time at which the secondary equilibrates to containment design pressure to the end of the transient.

Break Size and Location Generic studies have been performed with respect to the effect of postulated break size on the LOCA M&E releases. The double ended guillotine break has been found to be limiting due to larger mass 155 of 338 IPEC00036462 IPEC00036462

IP3 FSAR UPDATE flow rates during the blowdown phase of the transient. During the reflood and post-reflood phases, the break size has little effect on the releases.

Three distinct locations in the reactor coolant system loop can be postulated for pipe rupture:

1. Hot leg (between reactor vessel and steam generator)

2. Cold leg (between reactor coolant pump and reactor vessel)

3. Pump suction (between steam generator and reactor coolant pump)

The DEHL rupture has been shown in previous studies to result in the highest blowdown M&E release rates. Although the core flooding rate would be the highest for this break location, the amount of energy released from the steam generator secondary is minimal because the majority of the fluid that exits the core bypasses the steam generators venting directly to containment. As a result, the reflood M&E releases are reduced significantly as compared to either the pump suction or cold leg break locations where the core exit mixture must pass through the steam generators before venting through the break. For the DEHL break, generic studies have confirmed that there is no reflood peak (i.e.,

from the end of the blowdown period the containment pressure continually decreases). Therefore only the M&E releases for the hot leg break blowdown phase are calculated and presented in this section of the report.

The cold leg break location has been found in the previous studies to be much less limiting in terms of the overall containment energy releases. The cold leg blowdown is faster than that of the pump suction break, and more mass is released into the containment. However, the core heat transfer is greatly reduced (due to the break location the flow will bypass the normal path through the core and go through the path of least resistance to the broken loop) and this results in a considerably lower energy release into containment. Studies have determined that the blowdown transient for the cold leg is less limiting than that for the pump suction and hot leg breaks. During reflood, the flooding rate is greatly reduced because all the core vent paths include the resistance of the reactor coolant pump, in addition to ECCS injection spill, thus the energy release rate into the containment is reduced.

Therefore, the cold leg break is not included in the scope of this analysis.

The DEPS break combines the effects of the relatively high core flooding rate, as in the DEHL break, with the addition of the stored energy in the steam generators. As a result, the DEPS break yields the highest energy flow rates during the post-blowdown period by including all of the available energy of the RCS and secondary side in calculating the releases to containment.

The break locations analyzed for this program are the DEPS rupture (10.48 fe), and the DEHL rupture (9.18 fe). Break M&E releases have been calculated for the blowdown, reflood and post-reflood phases of the LOCA for the DEPS cases. For the DEHL case, the releases were calculated only for the blowdown phase.

Sources of Mass and Energy The sources of mass considered in the LOCA M&E release analysis are given in Tables 14.3-29, 14.3-47, and 14.3-53. These sources are the ReS, accumulators, and pumped SI.

The energy inventories considered in the LOCA M&E release analysis are given in Tables 14.3-30, 14.3-48, and 14.3-54. The energy sources include:

156 of 338 IPEC00036463 IPEC00036463

IP3 FSAR UPDATE

1. RCS-Water

2. Accumulator Water (all four inject)

3. Pumped Injection Water (RWST/ECCS)

4. Decay Heat

5. Core Stored Energy

6. RCS-Metal- Primary Metal (includes steam generator tubes)

7. Steam Generator Metal (includes transition cone, shell, wrapper, and other internals)

8. Steam Generator Secondary Energy (includes fluid mass and steam mass)

9. Secondary Transfer of Energy (feedwater into and steam out of the steam generator secondary)

The M&E inventories are presented at the following times, as appropriate:

1. Time zero (initial conditions)

2. End of blowdown time

3. End of refill time

4. End of reflood time

5. Time of broken loop steam generator equilibration to pressure setpoint

6. Time of intact loop steam generator equilibration to pressure setpoint

7. Time of full depressurization (3600 seconds)

Energy Reference Points Available Energy: 212°F; 14.7 psia The current approved methodology assumed that all energies in the system are taken out to these conditions in the first hour of the event. This is the total available energy.

Total Energy Content: 32°F; 14.7 psia This is the reference point for the system energy.

In the M&E release data presented, no zirc-water reaction heat was considered because the clad temperature is assumed not to rise high enough for the rate of the zirc-water reaction heat to be of any significance.

14.3.6.1.4 Acceptance Criteria 157 of 338 IPEC00036464 IPEC00036464

IP3 FSAR UPDATE A large-break LOCA is classified as an ANS Condition IV event, an infrequent fault. To satisfy the NRC-on-acceptance criteria presented in the Standard Review Plan Section 6.2.1.3, the relevant requirements are as follows:

1. 10 CFR 50, Appendix A: as it relates to General Design Criteria 16 and 50, with respect to containment design integrity and containment heat removal.

2. 10 CFR 50, Appendix K, paragraph 1.A: as it relates to sources of energy during the LOCA, provides requirements to assure that all energy sources have been considered.

In order to meet these requirements, the following must be addressed.

1. Sources of Energy

2. Break Size and Location

3. Calculation of Each Phase of the Accident

4. Single Failure Criteria Each of these items except for the single failure criteria is addressed in Section 14.3.6.1.3. The single failure criteria is discussed in Section 14.3.6.1.2.

14.3.6.1.5 Results Using the Reference 45 methodology, the M&E release rates were developed to determine the containment pressure and temperature responses for each of the LOCA cases noted in Section 14.3.6.1. The LOCA M&E releases discussed in this section provide the basis for the containment response analysis provided in Section 14.3.6.2.

Table 14.3-27 presents the calculated M&E release for the blowdown phase of the DEHL break. For the DEHL break M&E release tables, break path one refers to the M&E exiting from the reactor vessel side of the break and break path two refers to the M&E exiting from the steam generator side of the break.

Tables 14.3-33 and 14.349 present the calculated M&E releases for the blowdown phase of the DEP'S break for the minimum and maximum safeguards cases. For the DEPS breaks, break path one in the M&E release tables refers to the mass and energy exiting from the steam generator side of the break and break path two refers to the M&E exiting from the pump side of the break.

Tables 14.3-34, and 14.3-50 present the calculated M&E release for the reflood phase of the DEPS break, diesel failure (minimum safeguards), and no failure (maximum safeguards) cases, respectively.

The transients of the principal parameters, such as core flooding rate, core and downcomer level, and SI and accumulator injection rates during he core reflooding portion of the LOCA are given in Tables 14.3-37 and Table 14.3-51 for the DEPS cases.

Tables 14.3-46 and 14.3-52 present the two-phase post-reflood M&E release data for the DEPS.

The sequence of events for the LOCA transients is included in Tables 14.3-58 through 14.3-60.

14.3.6.1.6 Conclusions 158 of 338 IPEC00036465 IPEC00036465

IP3 FSAR UPDATE The consideration of the various energy sources in the long-term M&E release analysis provides assurance that all available sources of energy have been included in this analysis. Thus, the review guidelines presented in Standard Review Plan Section 6.2.1.3 have been satisfied. Any other conclusions cannot be drawn from the generation of M&E releases directly since the releases are inputs to the containment integrity analyses.

14.3.6.2 Long Term LOCA Containment Response (COCO) Analysis 14.3.6.2.1 Accident Description The Indian Point Unit 3 Station containment system is designed such that for all high-energy line break sizes, up to and including the double-ended severance of a reactor coolant pipe or secondary system pipe, the containment peak pressure remains below the design pressure. This section details the containment response subsequent to a hypothetical loss-of-coolant accident (LOCA). The containment response analysis uses the long term M&E release data from Section 14.3.6.1.

The containment response analysis demonstrates the acceptability of the containment safeguards systems to mitigate the consequences of a high-energy line break inside containment. The impact of LOCA M&E releases on the containment pressure is addressed to assure that the containment pressure remains below its design pressure at the licensed core power conditions. In support of equipment design criteria (qualified operating life), with respect to post accident environmental conditions, long term containment pressure and temperature transients are addressed.

14.3.6.2.2 Input Parameters and Assumptions An analysis of containment response to the rupture of the RCS must start with knowledge of the initial conditions in the containment. The pressure, temperature, and humidity of the containment atmosphere prior to the postulated accident are specified in the analysis as shown in Table 14.3-55.

Also, values for the initial temperature of the essential service water (ESW) and refueling water storage tank (RWST) are assumed, along with containment spray (CS) pump flow rate and reactor containment fan cooler (RCFC) heat removal performance. All of these values are chosen conservatively, as shown in Tables 14.3-55, 14.3-56 and 14.3-57. Long-term sump recirculation is addressed via RHR heat exchanger performance. The primary function of the RHR system is to remove heat from the core by way of Emergency Core Cooling System (ECCS), and from the containment through the containment spray system (CSS). Table 14.3-55 provides the RHR system parameters assumed in the analysis.

A series of cases was performed for the LOCA containment response. Section 14.3-6.1 documented the M&E releases for the minimum and maximum ECCS cases for a DEPS break and the releases from the blowdown of a DEHL break.

For the maximum ECCS DEPS case a failure of a containment spray pump was assumed as the single failure, which leaves available as active heat removal systems one containment spray pump/and four RCFCs.

The minimum ECCS case was based upon a diesel train failure (which leaves available as active heat removal systems one containment spray pump and four RCFCs). Due to the duration of the DEHL transient (i.e., blowdown only), no containment safeguards equipment is modeled.

159 of 338 IPEC00036466 IPEC00036466

IP3 FSAR UPDATE The calculations for all of the DEPS cases were performed for ten million seconds (approximately 11.5 days) for long-term equipment qualification. The DEHL cases were terminated soon after the end of the blowdown. The sequence of events for each of these cases is shown in Tables 14.3-58 through 14.3-60.

The following are the major assumptions made in the analysis:

1) The M&E released to the containment are described in Section 4.3.6.1 for LOCA.

2) Homogeneous mixing is assumed. The steam-air mixture and the water phases each have uniform properties. More specifically, thermal equilibrium between the air and the steam is assumed. However, this does not imply thermal equilibrium between the steam-air mixture and the water phase.

3) Air is taken as an ideal gas, while compressed water and steam tables are employed for water and steam thermodynamic properties.

4) For the blowdown portion of the LOCA analysis, the discharge flow separates into steam and water phases at the breakpoint. The saturated water phase is at the total containment pressure, while the steam phase is at the partial pressure of the steam in the containment.

For the post-blowdown portion of the LOCA analysis, steam and water releases are input separately.

5) The saturation temperature at the partial pressure of the steam is used for heat transfer to the heat sinks and the fan coolers 14.3.6.2.3 Description of COCO Model Calculation of containment pressure and temperature is accomplished by use of the digital computer code COCO (Reference 6). COCO is a mathematical model of a generalized containment; the proper selection of various options in the code allows the creation of a specific model for particular containment design. The values used in the specific model for different aspects of the containment are derived from plant-specific input data. The COCO code has been used and found acceptable to calculate containment pressure transients for many dry containment plants, most recently including Vogtle Units 1 and 2, Turkey Point Unit 3, Salem Units 1 and 2, Diablo Canyon Units 1 and 2, Indian Point Unit 2, and Indian Point 3. Transient phenomena within the RCS affect containment conditions by means of convective M&E transport through the pipe break.

For analytical rigor and convenience, the containment air-steam-water mixture is separated into a water (pool) phase and a steam-air phase. Sufficient relationships to describe the transient are provided by the equations of conservation of the M&E as applied to each system, together with appropriate boundary conditions. As thermodynamic equations of state and conditions may vary during the transient, the equations have been derived for all possible cases of superheated or saturated steam and subcooled or saturated water. Switching between states is handled automatically by the code.

Passive Heat Removal The significant heat removal source during the early portion of the transient is the containment structural heat sinks. Provision is made in the containment pressure response analysis for heat transfer through, and heat storage in, both interior and exterior walls. Every wall is divided into a large 160 of 338 IPEC00036467 IPEC00036467

IP3 FSAR UPDATE number of nodes. For each node, a conservation of energy equation expressed in finite-difference form accounts for heat conduction into and out of the node and temperature rise of the node. Table 14.3-35 is the summary of the containment structural heat sinks used in the analysis. The thermal properties of each heat sink material are shown in Table 14.3-36.

The heat transfer coefficient to the containment structure for the early part of the event is calculated based primarily on the work of Tagami (Reference 35). From this work, it was determined that the value of the heat transfer coefficient can be assumed to increase parabolically to a peak value. In COCO, the value then decreases exponentially to a stagnant heat transfer coefficient which is a function of steam-to-air-weight ratio.

The h for stagnant conditions is based upon Tagami's steady state results.

Tagami presents a plot of the maximum value of the heat transfer coefficient, h, as function of coolant energy transfer speed, defined as follows:

total coolant energy transferred into containment (containment volume)(time interval to peak pressure)

From this, the maximum heat transfer coefficient of steel is calculated:

0.6 h max = 75 [ t:V ] (Equation 1) where:

hMAx = maximum value of h (BTUlhr-fe-OF).

tp = time from start of accident to end of blowdown for LOCA and steam line isolation for secondary breaks (sec).

V = containment net free volume (fe)

E = total coolant energy discharge from time zero to tp (BTU).

75 = material coefficient for steel.

(Note: Paint is accounted for by the thermal conductivity of the paint on the heat sink structure, not by an adjustment on the heat transfer coefficient.)

The basis for the equations is a Westinghouse curve fit to the Tagami data.

The parabolic increase to the peak value is calculated by COCO according to the following equation:

o.s hs = h max ( L '

]

(Equation 2) 161 of 338 IPEC00036468 IPEC00036468

IP3 FSAR UPDATE where:

hs = heat transfer coefficient between steel and air/steam mixture (BTU/hr-ft2-0F).

= time from start of event (sec).

For concrete, the heat transfer coefficient is taken as 40 percent of the value calculated for steel during the blowdown phase.

The exponential decrease of the heat transfer coefficient to the stagnant heat transfer coefficient is given by:

h =h s stag + (h max - h) e -mhl ~

stag P (Equation 3) where:

hstag =2 + SOX, 0 < X < 1.4 hstag = h for stagnant conditions (Btu/hr-fe-OF).

X = steam-to-air weight ratio in containment.

Active Heat Removal For a large pipe break, the engineered safety features are quickly brought into operation. Because of the brief period of time required to depressurize the RCS or the main steam system, the containment safeguards are not a major influence on the blowdown peak pressure; however, they reduce the containment pressure after the blowdown and maintain a low long-term pressure and a low long-term tem perature.

RWST Injection During the injection phase of post-accident operation, the ECCS pumps water from the RWST into the reactor vessel. Since this water enters the vessel at refueling water storage tank temperature, which is less than the temperature of the water in the vessel, it is modeled as absorbing heat from the core until the saturation temperature is reached. SI and containment internal spray can be operated for a limited time, depending on the refueling water storage tank (RWST) capacity.

RHR. Sump Recirculation After the supply of refueling water is exhausted, the recirculation system is operated to provide long term cooling of the core and containment spray (CS) water. In this operation, water is drawn from the sump, cooled in a residual heat removal (RHR) heat exchanger, then pumped back into the reactor vessel to remove core residual heat and energy stored in the vessel metal. In addition, pat of the flow leaving the recirculation heat exchanger can be diverted to the internal containment spray system (CSS) for containment depressurization. The heat is removed from the RHR heat exchanger by the component cooling water (CCW). The RHR Hxs and CCW Hxs are coupled in a closed loop system, where the ultimate heat sink is the service water cooling to the CCW Hx.

162 of 338 IPEC00036469 IPEC00036469

IP3 FSAR UPDATE Containment Spray CS is the active removal mechanism that is used for rapid pressure reduction and for containment iodine removal. During the injection phase of operation, the CS pumps draw water from the RWST and spray it into the containment through nozzles mounted high above the operating deck. As the spray droplets fall, they absorb heat from the containment atmosphere. Since the water comes from the RWST, the entire heat capacity of the spray from the RWST temperature to the temperature of the containment atmosphere is available for energy absorption. During the recirculation phase of post-accident operation, water can be drawn from the containment sump, passed through the RHR heat exchanger, and sprayed into the containment atmosphere via the recirculation spray system. The CS parameters are given in Tables 14.3-55 and 14.3-57.

When a spray droplet enters the hot, saturated, steam-air containment environment, the vapor pressure of the water at its surface is much less than the partial pressure of the steam in the atmosphere. Hence, there will be diffusion of steam to the drop surface and condensation on the droplet. This mass flow will carry energy to the droplet. Simultaneously, the temperature difference between the atmosphere and the droplet will cause the droplet temperature and vapor pressure to rise. The vapor pressure of the droplet will eventually become equal to the partial pressure of the steam and the condensation will cease. The temperature of the droplet will essentially equal the temperature of the steam-air mixture.

The equations describing the temperature rise of a falling droplet are as follows.

d

-(Mu) =mhg+q (Equation 4) dt where:

M = droplet mass u = internal energy m = diffusion rate hg = steam enthal py q = heat flow rate

= time d

-(M)=m (Equation 5) dt

where, q = hcA * (Ts - T) m = kgA * (Ps - Pv)

A = area 163 of 338 IPEC00036470 IPEC000364 70

IP3 FSAR UPDATE he = coefficient of heat transfer kg = coefficient of mass transfer T = droplet temperature Ts = steam temperature Ps = steam partial pressure Pv = droplet vapor pressure The coefficients of heat transfer (he) and mass transfer (kg) are calculated from the Nusselt number for heat transfer, Nu, and the Nusselt number for mass transfer, Nu 1.

Both Nu and Nu 1 may be calculated from the equations of Ranz and Marshall (Reference 40).

Nu = 2 + 0.6(Re)1/2 (Pr)1/3 (Equation 6)

where, Nu = Nusselt number for heat transfer Pr = Prandtl number Re = Reynolds number Nu 1 = 2 + .06(Re)1/2 (SC)1/3 (Equation 7)

where, Nu 1 = Nusselt number for mass transfer Sc = Schmidt number Thus, Equations 4 and 5 can be integrated numerically to find the internal energy and mass of the droplet as a function of time as it falls through the atmosphere. Analysis show that the temperature of the (mass) mean droplet produced by the spray nozzles rises to a value within 99 percent of the bulk containment temperature in less than 2 seconds. Detailed calculations of the heatup of spray droplets in post-accident containment atmospheres by Parsly (Reference 41) show that droplets of all sizes encountered in the containment spray reach equilibrium in a fraction of their residence time in a typical pressurized water reactor containment. These results confirm the assumption that the containment spray will be 100 percent effective in removing heat from the atmosphere.

The RCFCs are another means of heat removal. Each RCFC has a fan which draws in the containment atmosphere. Since the RCFCs do not use water from the RWST, the mode of operation remains the same both before and after the CS and ECCS change to the recirculation mode. The steam/air mixture is routed through the enclosed RCFC unit, past essential service water cooling coils. The fan then discharges the air through ducting containing an air volume damper. The air is 164 of 338 IPEC00036471 IPEC00036471

IP3 FSAR UPDATE directed through the ducting to the upper and lower containment volumes and air then diffuses back towards the suction of the RCFCs. See Table 14.3-56 for RCFCs heat removal capability assumed for the containment response analyses.

14.3.6.2.4 Acceptance Criteria The containment response for design-basis containment integrity is an ANS Condition IV event, an infrequent fault. To satisfy the Nuclear Regulatory Commission acceptance criteria presented in the Standard Review Plan Section 6.2.1.1.A for long-term containment response, the relevant requirements are as follows:*

1) GDC 16 and GDC 50: In order to satisfy the requirements of GDC 16 and 50, the peak calculated containment pressure should be less than the containment design pressure of 47 psig;

2) GDC 38: In order to satisfy the requirements of GDC 38, the calculated pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should be less than 50% of the peak calculated value. (This is related to the criteria for doses at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.)

• NOTE: Criterion from 10 CFR 50, Appendix A, 1971.

14.3.6.2.5 Analysis Results The containment pressure, steam temperature and water (sump) temperature profiles from each of the LOCA cases are shown in Figures 14.3-83 through 14.3-86 for the DEPS break cases. The results of the DEHL break are shown in Figures 14.3-100 and 14.3-101.

All of these cases show that the containment pressure will remain below design pressure. After the peak pressure is attained, the operation of the safeguards system reduces the containment pressure.

At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident, the containment pressure has been reduced to a value well below 50 percent of the peak. The peak pressures are shown in Table 14.3-62.

14.3.6.2.6 Conclusions The LOCA containment response analyses have been performed as part of the SPU for Indian Point Unit 3. The analyses include long-term pressure and temperature profiles for each case. As illustrated in Section 14.3.6.2.5, all cases resulted in a peak containment pressure that was less than 47 psig. In addition, all long-term cases were well below 50% of the peak pressure within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Based on the results, all applicable criteria for SRP 6.2.1.1.A have been met for Indian Point Unit 3.

14.3.6.3 Main Steam Line Break Analyses Main Steam Line Break Mass and Energy Release and Containment Pressure Response Steam line ruptures occurring inside a reactor containment structure may result in significant releases of high-energy fluid to the containment environment, possibly resulting in high pressures and temperatures. The quantitative nature of the releases following a steam line rupture is dependent upon the many possible configurations of the plant steam system and containment designs as well as the plant operating conditions, the size of the rupture, and the single failure assumptions. The analysis typically considers a variety of postulated pipe breaks encompassing wide variations in plant 165 of 338 IPEC00036472 IPEC000364 72

IP3 FSAR UPDATE operation, safety system performance, and break size in determining the containment response to a secondary system pipe rupture.

The previous IP3 licensing basis analysis of the MSLB inside containment is documented in WCAP-12269 (Reference 90) and SECL-92-255 (Reference 103). The analysis assumes the availability of only the containment pressure signals as protection functions in order to reduce the number of MSLB cases analyzed.

In the Containment Margin Improvement Program carried out in the spring of 1989, a series of hypothetical steam line break cases were analyzed to evaluate containment pressure response.

Those analyses superseded all previous pressure analyses for steam line break M&E releases inside contai nment.

The M&E release rates are determined using the LOFTRAN computer code (Reference 49). The pressure conditions inside containment are then determined based on the resulting M&E release rates using the COCO computer program (Reference 6), which is discussed in Section 14.3.6.2.3. Cases are run at various power levels for various single failure assumptions. In the analysis, conservative assumptions are made to limit the number of cases to calculate a spectrum of limiting pressure transients. Specifically, the analysis takes no credit for entrainment of water in the break effluent, revaporization of condensate in the containment, or enhanced heat transfer via the Tagami correlation due to turbulence. Furthermore, primary and secondary trips are not credited that might have been credited. These assumptions are made to limit the dependency of the results in peak pressure to break size. By making these conservative assumptions, the largest breaks will produce the most limiting peak pressure results.

Ten cases are run to complete the spectrum of cases needed to adequately determine a peak pressure in containment for comparison against the containment design pressure limit. These cases are:

1. 0% power Main Steam Check Valve (MSCV) failure with offsite power available

2. 70% power MSCV failure with offsite power available

3. 100% power MSCV failure with offsite power available

4. 0% power diesel failure (one engineering safeguards train assumed lost, RCPs conservatively assumed to continue to operate)

5. 100% power diesel failure (one engineering safeguards train assumed lost, RCPs conservatively assumed to continue to operate

6. 0% power Feedwater Control Valve (FCV) failure with offsite power available

7. 30% power FCV failure with offsite power available

8. 70% power FCV failure with offsite power available

9. 100% power FCV failure with offsite power available

10. 100% power Auxiliary Feed Water (AFW) Runout failure with offsite power available 166 of 338 IPEC00036473 IPEC000364 73

IP3 FSAR UPDATE Although the containment pressure analysis for cases 4 and 5 assumes a loss of offsite power requiring diesel generators to power the containment safeguard systems, offsite power is assumed available to the reactor coolant pumps throughout the transient such that full reactor coolant flow exists. Full reactor coolant flow maximizes heat transfer between the primary and secondary systems, which subsequently maximizes the energy release out the steam line break.

The following conditions were assumed in the analyses of the inside containment steam line break M&E release accidents.

1. At the time that the break occurs, a minimum 1.3% shutdown margin exists. This is the end-of-life design value including design margins at no-load, equilibrium xenon conditions, with the most reactive RCC assembly stuck in its fully withdrawn position. The operation of the RCCA banks during core burnup is restricted in such a way that addition of positive reactivity in a steam break accident will not lead to a more adverse condition than the case analyzed.

2. 44F Steam Generators with 1.4fe integral flow restrictors

3. BIT Removal - 0 ppm boron concentration in the BIT

4. Fan Cooler heat removal based on 95 degrees Fahrenheit Service Water Temperature

5. No entrainment of water in steam blowdown. (This is a break size dependent assumption with entrainment above a certain break size and no entrainment below. Therefore, no entrainment will conservatively be assumed.)

6. 30-minute operator action time for isolation of auxiliary feedwater to faulted steam generator.

7. Minimum SI (with a 6 second pure time delay) and containment spray performance characteristics consistent with the number of operating trains.

8. Fuel parameters for 15x15 Upgrade Model are used.

9. No SG Tube Plugging since this conservatively maximizes the heat transfer rate to the secondary side.

The following assumptions are used to determine the limiting power and single failure conditions for the determination of the peak containment pressure.

1. Full double-ended rupture between the flow restrictor and the containment wall with effective break area limited by flow restrictor as appropriate.

2. The operations of SI, RCPs, feedwater pumps and containment heat removal equipment are consistent with the failure assumption and limiting values that are used.

3. Elimination of all break size step change dependencies including:

a) No revaporization of containment wall condensate assumed, and b) Limiting wall heat transfer coefficients 167 of 338 IPEC00036474 IPEC00036474

IP3 FSAR UPDATE

4. Credit for containment signals only (High 1 and High 2 pressure) for reactor trip, SI steam line isolation and feedwater isolation. (Credit for other signals may result in a beak size other than the largest double-ended rupture being more limiting in pressure.)

The FCV failure case addresses I.E. Bulletin 80-04 concerns regarding additional feedwater flow due to FCV failure and failure of AFW runout protection. Feedwater flow as a function of pressure in the steam generator is maximized to the faulted steam generator and minimized to the intact steam generators. Maximizing flow to the faulted steam generator provides more inventory for release thereby maximizing blowdown. Initial assumptions include conservative conditions to bound I.E.

Bulletin 80-04 concerns, including AFW runout. The maximum auxiliary feed runout flow to the faulted steam generator is 400 gpm and is conservatively modeled as a constant flow.

In the analyses, the following assumptions are made regarding the safety injection system.

1. A minimum capability of the safety injection system, with 2 out of 3 (with Safeguard Failure) or 3 out of 3 (without Safeguards Failure) safety injection pumps in operation and 7 percent degraded system performance and based on minimum safeguards assumptions. High Head Safety Injection (HHSI) flow rate assumptions are reduced in accordance with the HHSI flow balancing criteria.

2. The refueling water storage tank (RWST) contains borated water with a boron concentration of 2400 ppm.

3. A conservative time required to sweep the unborated water from the safety injection piping and BIT before delivering the 2400 ppm borated water from the RWST to the core is modeled.

The assumptions made in the analyses performed (no containment safeguards train failure) to determine the pressure response inside containment resulting from the steam line break M&E releases are as follows:

1. Initial containment temperature of 130°F

2. Initial containment pressure of 17.2 psia

3. Initial containment relative humidity of 20%

4. A high containment pressure setpoint of 5.12 psig

5. A high-high containment pressure setpoint of 24.63 psig

6. A delay time for containment setpoints of 50 seconds for containment sprays and 38.2 seconds for the fan coolers (with offsite power available).

7. The containment heat sink data includes paint on the walls

8. A fan cooler efficiency at 95°F service water, 1400 gpm, 4% tube plugging level, and .004 fouling factor. The fan cooler performance is summarized in Table 14.3~56.

9. Full containment safeguards (5 fans, 2 spray pumps)

10. The containment spray performance is summarized in table 14.3-57.

168 of 338 IPEC00036475 IPEC00036475

IP3 FSAR UPDATE In support of the 24-month fuel cycle program, the limiting postulated steam line break determined through prior analysis (for the Containment Margin Improvement Program) and evaluations (HHSI) flow balancing and FRV stroke time increase) has been evaluated. The results of the current analysis are consistent with the instrument assumptions established in the 24 month Fuel Cycle Program.

Specific assumptions included in the analysis of the SLB M&E releases are 7.5°F RCS temperature uncertainty and a 10% narrow-range span uncertainty on the steam generator water level.

Some of the 24-month cycle changes identified in Section 14.3.6 were already evaluated relative to the IP3 MSLB inside containment M&E release calculations and containment response (References 105 and 106). The above referenced evaluations addressed the effect of increasing the pressurizer uncertainty to +/- 40 psi, increasing the pressurizer water level uncertainty to +/- 7% span, increasing the RCS flow uncertainty to +2.9%, revising the accumulator pressure and volume ranges, the effects of RWST level uncertainties, and increasing the steam generator water level uncertainty to +/- 10%

NRS. The pressurizer pressure and water level uncertainty increases have no effect on the calculated steam line break M&E releases since nominal values are typically assumed. The RCS flow uncertainty increase has no effect on the calculated steam line break M&E releases since Thermal Design Flow is assumed. Since the RCS pressure transient does not decrease to the point at which accumulators would inject, no actuation is assumed and the range changes have no effect on the analysis results. RWST level uncertainties do not affect the MSLB M&E release nor containment response transient since the duration of the MSLB event RWST draindown calculation (sump recirculation switchover) do not factor into the analysis.

However, the previous evaluations are recognized that the increase in the steam generator water level uncertainty, which increases the mass discharge into containment during the transient steam generator depressurization, require rigorous containment integrity analysis in order to demonstrate that pertinent acceptance criteria would be met.

The containment model used to calculate the containment response transient following a postulated steam line break M&E release inside containment is not directly affected by the evaluation baseline items for the 24-month fuel cycle project. The MSLB containment response is impacted through the effect of the 24-month fuel cycle uncertainty changes on the steamline break M&E release. The containment model developed for the HHSI Flow Changes Project has been utilized for this 24-month fuel cycle project.

In 1999, a revised analysis (Reference 108) was performed to address a correction to the unisolated feedline volume previously modeled. Based on a single failure assumption of the faulted steam generator feedwater control valve, there was found to be 3783 fe of feedwater not automatically isolated from the break. This volume was defined by the boundary of the main feedwater pump discharge valves and the closed FCVs on the intact loops, and it determined the amount of feedwater that will flash when the feedwater reaches saturated conditions due to steam generator depressurization.

To compensate for this error, administrative restrictions were applied to ensure post-MSLB subcriticality throughout Cycle 11. Prior to Cycle 12, a permanent correction to this error was made via the installation of a modification which closed the motor-operated feedwater block valves and low-flow bypass valves on a feedwater isolation signal. This reduced the unisolated feedwater volume to 400 fe for all credible scenarios.

The most recent analysis was performed for the uprate program. The limiting case is a 1.4 ft2 DER initiated from 70% power with a single failure of the FCV on the faulted loop. The containment 169 of 338 IPEC00036476 IPEC000364 76

IP3 FSAR UPDATE temperature and pressure transients are presented in Figures 14.3-87 and 14.3-88. The peak containment pressure remains below the containment design pressure of 47 psig.

14.3.7 HYDROGEN PRODUCTION AND ACCUMULATION Hydrogen accumulation in the containment atmosphere following the Design Basis Accident can be the result of production from several sources. The potential sources of hydrogen are the zirconium-water reaction, corrosion of construction materials, and radiolytic decomposition of the emergency core cooling solution. The latter source, solution radiolysis, includes both core solution radiolysis and sump solution radiolysis.

Results The results of the calculations for hydrogen production and accumulation from the sources indicated are presented here:

1. Zirconium-water reaction

2. Aluminum corrosion

3. Radiolytic decomposition of core and sump solution are shown in Figure 14.3-75 and 14.3-77.

Figure 14.3-75 shows the total hydrogen production rate as a function of time following a Loss-of-Coolant Accident up to 100 days for the maximum hypothetical accident.

Figure 14.3-77 shows the total quantity of hydrogen accumulated in the Containment as a function of time for the maximum hypothetical accident case up to 100 days. The contribution of the individual sources is shown.

The curves show that if no measures were used to remove or prevent the hydrogen accumulation indicated, the hydrogen generation would result in the approximate concentrations within the containment as shown in Figure 14.3-79.

Although it is indicated that the hydrogen in the Containment would reach 4.1 volume percent (the lower flammable limit in air) in 21 days using the NRC RG 1.7 model, in actuality the concentration of hydrogen would be prevented from ever reaching this level for either model through the use of the Hydrogen Recombiner System. The analysis of record credits the use of just one Hydrogen Recombiner (Reference 109).

Method of Analysis The quantity of zirconium which reacts with the core cooling solution depends on the performance of the Emergency Core Cooling System (ECCS). The criteria for evaluation of the Emergency Core Cooling System requires that the zircaloy-water reaction be limited to 1 percent by weight of the total quantity of zirconium in the core. Emergency Core Cooling System calculations have shown that only 0.1 percent of the zirconium present reacts with water, which is much less than that required by criteria.

The use of aluminum inside the Containment is limited, and aluminum is not used in safety related components which are in contact with the recirculating core cooling fluid. Aluminum is much more reactive with the containment spray alkaline borate solution than other plant materials such as 170 of 338 IPEC00036477 IPEC000364 77

IP3 FSAR UPDATE galvanized steel, copper and copper nickel alloys. By limiting the use of aluminum the aggregate source of hydrogen over the long term is essentially restricted to that arising from radiolytic decomposition of core and sump water. The upper limit rate of such decomposition can be predicted with ample certainty to permit the design of effective countermeasures.

It is noted that the zirconium-water reaction and aluminum corrosion with containment spray are chemical reactions and thus essentially independent of the radiation field inside the Containment following a Loss-of-Coolant Accident. Radiolytic decomposition of water is dependent on the radiation field intensity. The radiation field inside the Containment is calculated for the maximum hypothetical accident in which the fission product activities given in TID-14844 (Reference 51) are used.

The hydrogen generation calculation was performed using the AEC model discussed in NRC RG 1.7 (Reference 52).

Typical Assumptions The following discussion outlines the assumptions used in the calculations:

1) Zirconium-water reaction The zirconium-water reaction is described by the chemical equation:

The hydrogen generation due to this reaction will be completed during the first day following the Loss-of-Coolant accident. The hydrogen generated is assumed to be released immediately to the containment atmosphere.

2) Corrosion of plant materials Oxidation of metals in aqueous solution results in the generation of hydrogen gas as one of the corrosion products. Extensive corrosion testing has been conducted to determine the behavior of the various metals that come in contact with the emergency core cooling solution at Design Basis Accident conditions. Metals tested include Zircaloy, Inconel, aluminum alloys, copper nickel alloys, carbon steel, galvanized carbon steel and copper. Tests conducted at ORNL (References 53 and 54) have also verified the compatibility of the various alloys (exclusive of aluminum) with alkaline borate solution. As applied to the quantitative definition of hydrogen production rates, the results of the corrosion tests have shown that only aluminum will corrode at a rate that will significantly add to the hydrogen accumulation in the containment atmosphere.

The corrosion of aluminum may be described by the overall reaction:

Therefore, three moles of hydrogen are produced for every two moles of aluminum that are oxidized. (Approximately 20 standard cubic feet of hydrogen for each pound of aluminum corroded.)

The time-temperature cycle (Table 14.3-63) considered in the calculation of aluminum corrosion is based on a conservative step-wise representation of the postulated post 171 of 338 IPEC00036478 IPEC000364 78

IP3 FSAR UPDATE accident containment transient. The corrosion rates at the various steps were determined from the aluminum corrosion rate design curve shown in Figure 60-8.

Aluminum corrosion data pOints include the effects of temperature, alloy, and spray solution conditions. Based on these corrosion rates and the aluminum inventory given in Table 14.3-64, the contribution of aluminum corrosion to hydrogen accumulation in the containment following the design basis accident has been calculated. For conservative estimation, no credit was taken for protective shielding effects of insulation or enclosures from the spray, and complete and continuous immersion was assumed.

Calculations based on NRC Reg Guide 1.7 were performed by allowing an increased corrosion rate during the final step of the post-accident containment temperature transient (Table 14.3-63). The corrosion rates earlier in the accident sequence are the higher rates determined from Figure 60-8. This analysis specifically includes the presence of four aluminum-bearing Control Rod Drive Mechanism cooling fans assemblies.

3) Radiolyis of Core and Sump Water Water radiolysis is a complex process involving reactions of numerous intermediates.

However, the overall radiolytic process may be described by the reaction:

1 H20 ~H2+202 Of interest here are the quantitative definitions of the rates and extent of radiolytic hydrogen production following the design basis accident.

An extensive program has been conducted by Westinghouse to investigate the radiolytic decomposition of the core cooling solution following the Design Basis Accident. In the course of the investigation, it became apparent that two separated radiolytic environments exist in the Containment at Design basis Accident Conditions.

In one case, radiolysis of the core cooling solution occurs as a result of the decay energy of fission products which have escaped from the core, result in the radiolysis of the sump solution. The results of these investigations are discussed in Reference 55.

Core Solution Radiolysis The study of radiolysis in dynamic systems was initiated by Westinghouse, which formed the basis for experimental work performed at ORNL. Both studies clearly illustrate the reduced yields in hydrogen from core radiolysis, i.e., reduced from the maximum yield of 0.44 molecules/100eV. These results have been published. (References 55 and 56)

For the purposes of this analysis, the calculations of hydrogen yield from core radiolysis were performed with the very conservative value of 0.44 molecules/100eV. That this value is conservative and a maximum for this type of aqueous solution and gamma radiation is confirmed by the many published works. The Westinghouse results from the dynamic studies show 0.44 to be a maximum at very high solution flow rates through the gamma radiation field. The referenced ORNL (Reference 56) work also confirms this value as a maximum at high flow rates. A. O. Allen (Reference 57) presents a very comprehensive review of work performed to confirm the primary hydrogen yield to be a maximum of 0.44-0.45 molecules/100eV.

172 of 338 IPEC00036479 IPEC000364 79

IP3 FSAR UPDATE On the foregoing basis, the production rate and total hydrogen produced from core radiolysis as a function of time has been conservatively estimated for the maximum hypothetical accident case.

Calculations based on NRC Reg Guide 1.7 assume a hydrogen yield value of 0.5 molecules per 100 eV, with 10% of the gamma energy produced from fission products in the fuel rods absorbed by the solution in the core, and the noble gases escaping to the containment vapor space.

As the emergency core cooling solution flows through the core, it is subjected to gamma radiation from fission products in the fuel. This energy deposition results in solution radiolysis and the production of molecular hydrogen and oxygen. The initial production rate of these species will depend on the rate of energy absorption and the specific radiolytic yields.

The energy absorption rate in solution can be assessed from knowledge of the fission products contained in the core, and a detailed analysis of the dissipation of the decay energy between core materials and the solution. The results of Westinghouse studies show essentially all of the beta energy will be absorbed within the fuel and cladding and that this represents approximately 50% of the total beta-gamma decay energy. This study shows further that of the gamma energy, a maximum of 7.4% will be absorbed by the solution in the core. Thus, an overall absorption factor of 3.7% of the total core decay energy (+) is used to compute solution radiation dose rates and the time-integrated dose. Table 14.3-65 presents the total decay energy (+) of a reactor core, which has operated at full power for 830 days prior to the accident. For the maximum hypothetical accident case, the contained decay energy in the core accounts for the TID-14844 release of 50% halogens and 1% other fission products. To be conservative, the noble gases were assumed to remain in the core, whereas in the TID-14844 model the noble gases were allowed to escape to the Containment, where essentially no water radiolysis would result from decay of these nuclides.

The radiolysis yield of hydrogen in solution has been studied extensively by Westinghouse and ORNL. The results of static capsule tests conducted by Westinghouse indicate that hydrogen yields much lower than the maximum of 0.44 molecules per 100eV of absorbed energy which would be the case in core. With little gas space to escape, the hydrogen formed in solution rapidly recombines with oxygen to reform water. The net effect is very low net hydrogen yields.

Sump Solution Radiolysis Another potential source of hydrogen assumed for the post-accident period arises from water contained in the reactor containment sump being subjected to radiolytic decomposition by fission products. In this consideration, an assessment must be made as to decay energy deposited in the solution and the radiolytic hydrogen yield, much in the same manner as given above for core radiolysis.

The energy deposited in the sump solution is computed using the following basis:

1. For the maximum hypothetical accident, a TID-14844 release model (Reference 51) is assumed where 50% of the total core halogens and 1% of all other fission products, excluding noble gases, are released from the core to the sump solution.

2. The quantity of fission product release is equal to that from a reactor which operated at 3216 Mwt for 830 days prior to the accident. (Table 14.3-65) 173 of 338 IPEC00036480 IPEC00036480

IP3 FSAR UPDATE

3. The total decay energy from the released fission products, both beta-gamma, is assumed to be fully absorbed in the solution.

The energy release by fission products to the sump water includes the decay of halogens, and a separate accounting for the slower decay of the 1% other fission products. To arrive at the energy deposition rate and time-integrated energy deposited, the contribution from each individual fission product class was computed. The overall contributions from each of the two classes of fission products is shown in Table 14.3-66.

The yield of hydrogen from sump solution radiolysis is represented by the static capsule tests performed by Westinghouse and ORNL with the alkaline sodium borate solution. The differences between these tests and the actual conditions for the sump solution, however, are important and render the capsule tests conservative in their predictions of radiolytic hydrogen yields.

In this assessment, the sump solution will have considerable depth, which inhibits the ready diffusion of hydrogen from solution, as compared to the test using shallow depth capsules. This retention of hydrogen in solution will have a significant effect in reducing the hydrogen yields to the containment atmosphere. The buildup of hydrogen concentration in solution will enhance the back reaction to formation of water and lower the net hydrogen yield, in the same manner as a reduction in gas to liquid volume ratio will reduce the yield. This is illustrated by the data presented in Figure 14.3-112 for capsule tests with various gas to liquid volume ratios. The data show a significant reduction in the apparent or net hydrogen yield from the published primary maximum yield of 0.44 molecules/100eV.

Even at the very highest ratios, where capsule solution depths are very low, the yield is less than 0.30, with the highest scatter data point at 0.39 molecules/100eV.

With these considerations taken into account, a reduced hydrogen yield is a reasonable assumption to make for the case of sump radiolysis. While it can be expected the yield will be on the order of 0.1 or less, a conservative value of 0.30 moiecules/100eV has been used in the maximum hypothetical accident case.

Calculation based on NRC Reg. Guide 1.7 do not take credit for a reduced hydrogen yield in the case of sump radiolysis and a hydrogen yield value of 0.5 molecules per 100eV has been used.

References

1) Federal Register, "Emergency Core Cooling Systems: Revisions to Acceptance Criteria," V53, N180, pp35996-36005, September 16, 1988.

2) "Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants," WASH-1400, NUREG 75/014, October 1975.

3) Bordelon, F.M., Massie, H.W., and Zordan, T.A., "Westinghouse ECCS Evaluation Model -

Summary," WCAP-8339 (Non-Proprietary), July 1974.

4} Foster, JP., et aL, Westinghouse Improved Performance Analysis and Design Model (PAD 4.0) WCAP-15063~P-A, Revision 1, with Erratta, 2000.

5) USNRC Regulator Guide 1.157, "Best-Estimate Calculations of Emergency Core Cooling system Performances," May 1990.

174 of 338 IPEC00036481 IPEC00036481

IP3 FSAR UPDATE 6} Bordelon, F. M.and Murphy, E. T, 1974, "Containment Pressure Analysis (COCO), "WCAP-8327 (Proprietary Version), WCAP-8326 (Non-Proprietary Version).

7) Bordelon, F.M., et aI., "LOCA-IV Program: Loss of Coolant Transient Analysis," WCAP-8301, (Proprietary), June 1974 and WCAP-8305, (Non-Proprietary), June 1974.

8) PWR FLECHT Final Report, WCAP-7931, October 1972.

9) J. R. Kobelak, D. W. Golden, "Best Estimates Analysis for the Large Break Loss of Coolant Accident for Indian Point Unit 3 Nuclear Plant Stretch Power Uprate," WCAP-16178-P.

10} Boyack, B., et aI., 1989 "Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident," NUREG/CR-5249.

11} Letter, R. C. Joes (USNRC) To N. J. Liparulo (yj), "Acceptance for Referencing of the Topical Report WCAP-12945(P), Westinghouse Code Qualification Document for Best Estimate Loss-of-Coolant Accident," June 28,1996.

12) Bajorek, S. M., et aI., 1998, "Westinghouse Code Qualification Document for Best Estimate Loss of Coolant Accident Analysis," WCAP 12945-P-A (Proprietary), Volume 1, Revision 2 and Volumes II-V, Revision 1 and WCAP~14747 (Non-Proprietary).

13) Branch Technical Position CSB 6-1, "Minimum Containment Pressure Model for PWR ECCS Performance Evaluation," July, 1981.

14} Deleted 15} Deleted

16) Deleted 17} Deleted 18} Deleted

19) Deleted

20) Deleted

21) R.J. Skwarek, Johnson, W.J. Meyer, P.E., "Westinghouse Emergency Core Cooling System Small Break, October, 1975 Model," WCAP-8970, April 1977.

22) Letter from TM. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2147, dated November 2, 1979.

23) Letter from TM. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2163, dated November 16, 1979.

24) Letter from TM. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2174, dated December 7,1979.

175 of 338 IPEC00036482 IPEC00036482

IP3 FSAR UPDATE

25) Letter from T.M. Anderson of Westinghouse Electric Corporation to Richard P. Denise of the Nuclear Regulatory Commission, Letter Number NS-TMA-2175, dated December 10, 1979.

26) Takeuchi, K., et aI., "MULTIFLEX, A FORTRAN - IV Computer Program for Analyzing Thermal-Hydraulic Structure System Dynamics," WCAP- 8708, February 1976 (Westinghouse Proprietary).

27) Deleted

28) Deleted

29) Deleted 30} Deleted 31} Deleted

32) Deleted

33) Dittus, F.W., and Boelter, L.M.K., University of California (Berkeley), Pubis. Eng., 2, 488 (1930).

34) Jens, W.H., and Lottes, P.A., "Analysis of Heat Transfer, Burnout, Pressure Drop, and Density Data for High Pressure Water," USAEC Report ANL-4627 (1951).

35) Takashi Tagami, "Interim Report on Safety Assessments and Facilities Establishment Project in Japan for Period Ending June 1965," No.1.

36) Macbeth, RV., "Burnout AnalYSiS, Pt. 2, The Basis Burn-out Curve," U.K. Report AEEW-R 167, Winfrith (1963). Also Pt. 3, "The Low-Velocity Burnout Regimes," AEEW-R 222 (1963);

"Application of Local Conditions Hypothesis to World Data for Uniformly Heated Round Tubes and Rectangular Channels," AEEW-R 267 (1963).

37) McEligot, D.M., Ormand, L.W., and Perkins, H.C. Jr., "Internal Low Reynolds Number Turbulent and Transitional Gas Flow with Heat Transfer," Journal of Heat Transfer, Volume 88, pp. 239-245, May 1966.

38) IP3McAdams, W.H., Heat Transmission, 3rd Edition, McGraw-Hili Book Company, Inc., New York, 1954.

39) Dougall, RS., and Rohsenow, W.M., Film Boiling on the Inside of Vertical Tubes with Upward Flow of Fluid at Low Quantities, M IT Report 9079-26.

40) Ranz, E.W. and Marshall, W.R Jr., "Evaporation for Drops," Chemical Engineering Progress, 48, pp. 141-146, March 1952.

41) Parsly, L.F., "Spray Tests at the Nuclear Safety Pilot Plant," in: Nuclear Safety Program Annual Progress Report for Period Ending December 31,1970, ORNL-4647, 1971, p. 82.

42) Eckert, E.RG. and Drake, P.M.J., Heat and Mass Transfer, McGraw-Hili Book Company, Inc.,

New York, 1959.

176 of 338 IPEC00036483 IPEC00036483

IP3 FSAR UPDATE

43) Kern, D.Q., Process Heat Transfer, McGraw-Hili Book Company, Inc., New York, 1950.

44) Chilton, T.H. and Colburn, A.P., "Mass Transfer (Absorption) Coefficients Prediction from Data on Heat Transfer and Fluid Friction," Ind. Eng. Chem., No. 26, 1934, P 1183-1187.

45) WCAP-10325, "Westinghouse LOCA Mass and Energy Release Model for Containment Design - March 1979 Version," April 25, 1979. WCAP-10325-P-A, May 1983 (Proprietary),

WCAP-10326-M (Non-Proprietary).

46) EPRI 294-2 Mixing of Emergency Core Cooling Water with Steam: 1/3 Scale Test and Summary, (WCAP-8423), Final Report June 1975.

47) WCAP-8264-PA (Proprietary), WCAP-8312-A (Non-Proprietary), Rev. 1, "Topical Report Westinghouse Mass and Energy Release Data for Containment Design," August 1975.

48} ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 1979.

49) WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), "LOFTRAN Code Description," April 1984.

50) Eckert, E., and Gross, J., Introduction to Heat and Mass Transfer, (New York: McGraw-Hili Book Company), 1963.

51) DiNunno, J.J., Anderson, FD., Baker, R.E., and Waterfield, R.L., "Calculation of Distance Factors for Power Test Reactor Sites," TID-14844, March 1962.

52} NRC Regulatory Guide 1.7, Control of Combustible Gas Concentration in Containment Following a Loss-of-Coolant Accident, Rev. e, May 2003.

53) Cottrell, W.B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for July - August, 1968," ORNL-TM-2368.

54) Cottrell, W.B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for September-October, 1968," ORNL-TM-2425, p. 53, January 1969.

55) Fletcher, W.D., Bell, M.J., and Picone, L.F., "Post-LOCA Hydrogen Generation in PWR Containments," Nuclear Technology, Volume 10, pp. 420-427, 1971.

56) Zittel, H.E., and Row, T.H., "Radiation and Thermal Stability of Spray Solutions," Nuclear Technology, Volume 10, pp. 436-443, 1971.

57) Allen, A.O., The Radiation Chemistry of Water and Agueous Solutions, (Princeton: Van Nostrand Press), 1961.

58) WCAP-9117, "Analysis of Reactor Coolant System for Postulated Loss-of-Coolant Accident; Indian Point 3 Nuclear Power Plant," Westinghouse Electric Corp, June 1977

59) WCAP-7822, Bohm, G., "Indian Point Unit 2 Reactor Internals Mechanical Analysis for Blowdown Excitation," Westinghouse Electric Corp.

177 of 338 IPEC00036484 IPEC00036484

IP3 FSAR UPDATE

60) WCAP-5890, Rev. 1, "Creep Rupture Tests of type 304 SS Weldments with Central Axial Welds of Type 304 SS at 593 C," Westinghouse Electric Corp.

61) Deleted

62) Deleted

63) NS-TMA-2448

64) Deleted

65) Deleted 66} Deleted

67) Letter from Messrs. R.M. Clark and O. Meeuwis of Westinghouse Electric Corporation, INT 635 dated November 21, 1983 to WA Josiger, New York Power Authority.

68) Safety Evaluation by the Office of the Nuclear Reactor Regulation related to Amendment No.

61, to Facility Operating License No. DPR-64, Power Authority of New York, Indian Point Generating Unit 3, letter dated August 27, 1985 (Docket No. 50-286), from J.D. Neighbors, Division of Licensing, USNRC, to J.C. Brons, New York Power Authority.

69) NUREG-0737, item II.K.3.31, "Plant specific calculation to show compliance with 10 CFR 50.46," letter dated August 18, 1986, (lPN 86- 39) from J.C. Brons, New York Power Authority, to S.A. Varga, Division of PWR Licensing-A, USNRC.

70) Safety Evaluation of NUREG item II.K.3.31 plant specific calculations to show compliance with 10 CFR 50.46, letter dated November 13, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, New York Power Authority.

71} Deleted 72} Deleted

73) Deleted

74) Deleted 75} Deleted

76) Deleted

77) Meyer, P.E., NOTRUMP, A Nodal Transient Small Break and General Network Code, WCAP-10079-P-A, August 1985.

78) Lee, H., Rupprecht, S.D., Tauche, W.o., and Schwarz, W.R., Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code, WCAP-10054-P-A, August 1985.

79) Deleted 178 of 338 IPEC00036485 IPEC00036485

IP3 FSAR UPDATE

80) Bordelon, F.M., Massie, H.W., and Zordan, TA, "Westinghouse ECCS Evaluation Model-Summary," WCAP-8339, (Non-Proprietary), July 1974.

81) Eicheldinger, C., "Westinghouse ECCS Evaluation Model, 1981 Version," WCAP-9220-P-A (Proprietary) February 1979, and WCAP-9221-A (Non-Proprietary), February 1981, Revision 1.

82) Kabadi, J.N., et ai, "The 1981 Version of the Westinghouse ECCS Evaluation Model Using the BASH Code," WCAP-10266-P-A, Revision 2 (Proprietary), August 1986, and WCAP-10337-A (Non-Proprietary).

83) Deleted

84) Deleted

85) "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse - Designed Operating Plants," NUREG-0611, January 1980.

86) "Clarification of TMI Action Plan Requirements," NUREG-0737, November 1980.

87) NRC Generic Letter 83-35 from D.G. Eisenhut, "Clarification of TMI Action Plan Item II.K.3.31,"

November 2, 1983.

88) Rupprecht, S.D., et aI., "Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP-11145-P-A (Proprietary), October 1986.

89) Kachmar, M.P., et aI., "Appendix F LOCA NOTRUMP Evaluation Model: ZIRLO Modifications,"

WCAP-12610, December, 1990.

90) Kolano, JA, Smith, L.C., Wooten, L.A., and Ament, G.G., Containment Margin Improvement Analysis for Indian Point Unit 3, WCAP-12269 Rev. 1 (Proprietary) and WCAP-12338 (Non-Proprietary), May 1989.

91) SECL-92-131, "High Head Safety Injection Flow Changes Safety Evaluation," June 1992.

92) NSE 95-03-044 PZR, "Operation With a Steam Bubble in the Pressurizer and the RCS at Cold Shutdown," Rev. 4.

93) Davidson, S.L. et aI., "Extended Burnup Evaluation of Westinghouse Fuel," WCAP- 10125-P-A, December, 1985.

94) Deleted

95) INT-97-661, "LOCA Analysis Input Data Base Error," RR Laubham to G. Canavan, July 1997.

96) INT-98-207, "10 CFR 50.46 Annual Notification and Reporting for 1997," S.M. Ira to RJ.

Barrett, February 1998.

179 of 338 IPEC00036486 IPEC00036486

IP3 FSAR UPDATE

97) Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station Vantage+ Fuel Upgrade, Revision 3, January 1997, Westinghouse.

98) SECL-97-135, Revision 2, "Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties," March 1998, Westinghouse.

99) SECL-96-103, "Safety Evaluation of 24-Month Fuel Phase/Instrument Channel Uncertainties,"

June 1996, Westinghouse.

100) NRC Information Notice 96-39: Estimate of Decay Heat Using ANS 5.1 Decay Heat Standard May Vary Significantly, July 5, 1996.

101) Docket No. 50-315 & 50-316, "Amendment No. 126 to Facility Operating License No. DPR-58 (TAC No. 71062)," for D. C. Cook Nuclear Plant Unit 1, June 9,1989.

102) Technical Specifications, Indian Point Unit 3, Amendment 176, August 11,1997.

103) SECL-92-255, "Feedwater Regulating Valve Stroke Time Change Safety, Evaluation,"

November 2, 1992.

104) NRC Safety Evaluation Report Related to Amendment No. 98 to Facility Operating License No. DPR-64,5/7/90, J. S. Guo - principal contributor (addresses WCAP-12313 on the UHS temperature increase and WCAP-12269 on the Containment Margin Improvement Program).

105) INT-96-600, "24-Month Cycle Increased Initial Condition Uncertainty Evaluation," 9/6//96, R. R.

Laubham.

106) SECL-96-103, "Safety Evaluation of 24-Month Fuel Cycle Instrument Channel Uncertainties,"

6/18/96, R. R. Laubham (formally issued by letter INT-96-552, dated 6/19/96).

107) Letter RE-99-307, Canavan (NYPA) to Laubham (Westinghouse), June 1,1999.

108) Letter INT-99-248, Ira (Westinghouse) to Gumble (NYPA), August 12, 1999.

109) Letter INT-00-234, Ira (Westinghouse) to Gumble (NYPA), September 25, 2000.

110) Letter INT-99-254, "SLB Inside Containment Sensitivities to FCV Failure," Ira (Westinghouse) to Canavan (NYPA), October 8, 1999.

111) Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power rectors," July 2000.

112) Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), July 1997 and WCAP-10081-NP, Addendum2, Revision 1 (non-Proprietary), August 1995.

113) Stukus, J. R. et all, "Indian Point Nuclear Generating Unit No.3 Stretch Power Uprate NSSS and BQPLicensing Report."

180 of 338 IPEC00036487 IPEC00036487

IP3 FSAR UPDATE 114) Boyack, B., et aL, 1989, "Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident", NUREG/CR-5249.

115) Letter, R.C. Jones (USNRC) to N.J. Liparulo(\IV), "Acceptance for Referencing of the Topical Report WCAP-12945 (P), Westinghouse Code Qualification Document for Best Estimate LOCA Analysis", June 28,1996.

116) "Westinghouse Code Qualificiation Document for Best Estimate LOCA Analysis", WCAP-12945-P (Proprietary). Volumes I-V, June 1992.

117) Letter, N.J. Liparulo (\IV) to R.C. Jones (USNRC), "Revisions to Westinghouse Best-Estimate Methodology", NTD-NRC~95-4575, October 13, 1995.

118) Letter, N.J. Liparulo (\IV) to F.R. Orr (USNRC), "Re-Analysis Work Plans Using Final Best-Estimate Methodology", NSD-NRC-96-4746, June 1996.

119) "Best-Estimate Analysis of the Large Break Loss of Coolant Accident for Indian Point Unit 3 Nuclear Plant", WCAP-14820, June 2001.

Appendix B List of LOCA Analysis Tables Table 14.3-1: Best Estimate Large Break LOCA Key Parameters and Reference Transient Assumptions Table 14.3-2: Deleted Table 14.3-2a: Best Estimate Large Break LOCA Confirmatory Case PCT Results Summary Table 14.3-2b: Best-Estimate Large Break LOCA Results Table 14.3-3: Plant Operating Range Allowed by the Best-Estimate Large Break LOCA Analysis Table 14.3-4: Large Break LOCA Containment Data (Dry Containment)

Table 14.3-5: Large Break LOCA Structural Heat Sink Data Table 14.3-6: Deleted Table 14.3-6a: Best-Estimate Large Break LOCA Mass and Energy Releases from BCL Used for COCO Calculation at Selected Time Points.

Table 14.3-6b: Best Estimate Large Break LOCA Mass and Energy Releases from BCL Accumulator and SL Table 14.3-7: Rod Census Used in Best-Estimate Large Break LOCA Analysis.

Table 14.3-8: Best-Estimate Large Break LOCA Total Minimum Injected Flow from HHSI and LHSI 181 of 338 IPEC00036488 IPEC00036488

IP3 FSAR UPDATE Table 14.3-8a: Initial Parameters For Small Break LOCA Analysis Table 14.3-8b: Small Break LOCA Time Sequence Of Events Table 14.3-8c: Small Break LOCA Analysis Results Table 14.3-9: Deleted Table 14.3-10: Deleted Table 14.3-12: Deleted Table 14.3-14: Deleted Table 14.3-14a Deleted Table 14.3-14b Deleted Table 14.3-14c Deleted Table 14.3-14d Deleted Table 14.3-14e Deleted Table 14.3-14h Deleted Table 14.3-15 Deleted Table 14.3-16 Deleted Table 14.3-17 Deleted Table 14.3-18 Assumptions Used in the Analysis of the Environmental Consequences of a Large-Break LOCA Table 14.3-18a: Assumptions Used in the Analysis of the Environmental Consequences of a Small- Break LOCA.

Table 14.3-23 System Parameters Initial Conditions Table 14.3-24 Total Pumped ECCS Flow Rate to All Four Loops Diesel Failure (Minimum Safeguards)

Table 14.3-25 Total Pumped ECCS Flow Rate to All Four Loops No Failure (Maximum Safeguards)

Table 14.3-26 Decay Heat Curve 1979 ANS Plus 2 Sigma Uncertainty Table 14.3-27 Double-Ended Hot Leg Break Blowdown Mass and Energy Releases (Minimum ECCS) 182 of 338 IPEC00036489 IPEC00036489

IP3 FSAR UPDATE Table 14.3-28 Deleted Table 14.3-29 Double-Ended Hot Leg Break Mass Balance (Minimum ECCS)

Table 14.3-30 Double-Ended Hot Leg Break Energy Balance (Minimum ECCS)

Table 14.3-31 Deleted Table 14.3-32 Deleted Table 14.3-33 Double-Ended Pump Suction Break Blowdown Mass and Energy Releases (Minimum ECCS)

Table 14.3-34 Double-Ended Pump Suction Break Reflood Mass and Energy Releases (Minimum ECCS)

Table 14.3-35 Containment Heat Sinks Table 14.3-36 Theromophysical Properties of Containment Heat Sinks Table 14.3-37 Double-Ended Pump Suction Break Principle Parameters During Reflood (Minimum ECCS)

Table 14.3-46 Double-Ended Pump Suction Break Post-Reflood Mass and Energy Releases (Minimum ECCS)

Table 14.3-47 Double-Ended Pump Suction Break Mass Balance (Minimum ECCS)

Table 14.3-48 Double-Ended Pump Suction Break Energy Balance (Minimum ECCS)

Table 14.3-49 Double-Ended Pump Suction Break Blowdown Mass and Energy Releases (Maximum ECCS)

Table 14.3-50 Double-Ended Pump Suction Break Reflood Mass and Energy Releases (Maximum ECCS)

Table 14.3-51 Double-Ended Pump Suction Break Principle Parameters During Reflood (Maximum ECCS)

Table 14.3-52 Double-Ended Pump Suction Break Post-Reflood Mass and Energy Releases (Maximum ECCS)

Table 14.3-53 Double-Ended Pump Suction Break Mass Balance (Maximum ECCS)

Table 14.3-54 Double-Ended Pump Suction Break Energy Balance (Maximum ECCS)

Table 14.3-55 LOCA Containment Response Analysis Parameters Table 14.3-56 Containment Fan Cooler Performance Table 14.3-57 Containment Spray Performance 183 of 338 IPEC00036490 IPEC00036490