ML15223A945

NRC000223 - IP3 FSAR Rev. 04 Chapter 14 (2011)

ML15223A945
Person / Time
Site:	Indian Point
Issue date:	08/10/2015
From:	NRC/OGC
To:
SECY RAS
References
RAS 28145, ASLBP 07-858-03-LR-BD01, 50-247-LR, 50-286-LR
Download: ML15223A945 (333)

Text

NRC000223 Submitted: August 10, 2015 IP3 FSAR UPDATE CHAPTER 14 SAFETY ANALYSIS

14.0 INTRODUCTION

This chapter evaluates the safety aspects of the plant and demonstrates that the plant can be operated safely and that exposures from credible accidents do not exceed the guidelines of 10 CFR 100.

This chapter is divided into three sections, each dealing with a different behavior category:

1. Core and Coolant Boundary Protection Analysis, Section 14.1 The incidents presented in Section 14.1 have no offsite radiation consequences.

2. Standby Safeguards Analysis, Section 14.2 The accidents presented in Section 14.2 are more severe and may cause release of radioactive material to the environment.

3. Rupture of a Reactor Coolant Pipe, Section 14.3 The accident presented in Section 14.3, the rupture of a reactor coolant pipe, is the worst case accident and is the primary basis for the design of engineered safety features. It is shown that even this accident meets by a wide margin the guidelines of 10 CFR 100.

14.0.1 General Assumptions Parameters and assumptions that are common to various accident analysis are described below to avoid repetition in subsequent sections:

Steady State Errors For accident evaluation, the initial conditions are obtained by adding maximum steady state errors to rated values. The following steady state errors are considered.

NSSS Power +/-2% of full power (3230 MWt)

Vessel Average +/-7.5 F for non-RTDP*

Temperature +/-4.8°F (random) with +2.7°F (bias) for RTDP*

Pressurizer +/-60.0 psi for non-RTDP*

Pressure +/-52 psi (random) with -3psi (bias) for RTDP*

Initial values for power, pressurizer pressure, and vessel temperature are selected to minimize the initial W-3 or WRB-1 DNB ratio.

• NOTE: RTDP is Revised Thermal Design Procedure (Reference 28)

Chapter 14, Page 1 of 333 Revision 04, 2011

IP3 FSAR UPDATE Hot Channel Factors Amendment 175, dated July 1997, revised the Technical Specifications to permit changes to the COLR to increase the FQ limit to less than or equal to 2.42 and F limit to less than or equal to 1.654 for Vantage 5 fuel and 1.70 for Vantage+ fuel. Thus, FNQ (heat flux nuclear hot channel factor) 2.50 FNH (enthalpy rise nuclear hot channel factor) 1.70 for V+ and 15x15 Upgrade NOTE: Original issue of the FSAR has FNq <2.71 and FN<1.58 RTDP The incore instrumentation system is employed to verify that actual hot channel factors are, in fact, no higher than those used in the accident analyses.

Control Rod Drop Time A control rod drop time of 2.7 seconds to the dashpot, which includes allowance for seismic effects and additional margin, has been accounted for in the safety analyses. The resulting RCCA displacement as a function of time is shown in Figure 14.1-1. The scram time of 2.7 seconds has been considered for all the non-LOCA events and has been explicity modeled in all the events, including those transients which are sensitive to scram time (i.e., fast transients of short duration.)

Reactor Trip A reactor trip signal acts to open the two series trip breakers feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanism to release the control rods, which then fall by gravity into the core. There are various instrumentation delays associated with each tripping function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. The time delay assumed for each tripping function is as follows:

Tripping Time Delay Limiting Trip Point Function Seconds Assumed for Analysis Overpower(nuclear),High Setting 0.5 118%

Overpower(nuclear) Low Setting 0.5 35%

Overtemperature T 2.0 See Figure 7.2-11 Overpower T 2.0 See Figure 7.2-11 High pressurizer pressure 2.0 2470 psia Low pressurizer pressure 2.0 1750 psia High pressurizer water level 1.5 100% of pressurizer Chapter 14, Page 2 of 333 Revision 04, 2011

IP3 FSAR UPDATE level span*

Low reactor coolant flow 1.0 87% loop flow (from loop flow detectors)

Undervoltage trip 1.5 Not applicable**

Turbine trip 4.0 85% of SG narrow range level span Low-low steam generator 2.0 0% of narrow range level level span Under frequency 0.6 55Hz***

The difference between the limiting trip pointer assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and set point error. During preliminary startup tests, it was demonstrated that actual instrument errors are equal to or less than above assumed values.

NOTE: *Reactor trip function not explicitly credited in non-LOCA safety analyses.

• • Function credited in non-LOCA safety analyses, however, no explicit setpoint assumed

• • • A frequency decay rate of 5 Hz/sec is assumed Calorimetric Instrumentation Accuracy The calorimetric error is the error assumed in the determination of core thermal power as obtained from the secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet temperature to the steam generator and steam pressure.

Reference 38 provides an equivalent uncertainty in rated power of 0.5% if the Leading Edge Flow Meter (LEFM) instrumentation is used.

Reference 38 also provides an equivalent uncertainty in rated power of 1.3% if the feedwater venturis are employed.

RCS Voiding During Transients The voids generated in the reactor coolant system during anticipated transients are accounted for in the Westinghouse analysis models. Furthermore, based on transient analyses performed by Westinghouse using these models, it is concluded that steam voiding will not result in unacceptable consequences during anticipated transients. See Reference 4.

Reactor Coolant Pump Trip The Safety Evaluation Report approved the Westinghouse Owners Group (WOG) methodology for justifying manual RCP trip in lieu of automatic trip. The three alternative trip criteria employed by WOG are consistent with the original RCP trip guidelines. Reactor Coolant Subcooling has been selected at Indian Point Unit 3, as the alternate criteria for determining when to trip the Reactor Coolant Pumps. The IP3 plant-specific information regarding the Reactor Coolant Chapter 14, Page 3 of 333 Revision 04, 2011

IP3 FSAR UPDATE Pump trip was reviewed by the USNRC (Reference 8). Subsequently the safety evaluation report was issued by the USNRC (Reference 9) which determined that NYPA had satisfactorily addressed all of the points as identified in Generic Letter No. 85-12.

Replacement Steam Generators / Steam Generator Tube Plugging (SGTP)

The original Westinghouse Model 44 steam generators were replaced in their entirety with physically and functionally similar Model 44F units during the cycle 6/7 refueling outage.

Although design improvements incorporated in the replacement steam generators preclude or limit degradation of the tubes, the replacement steam generators match the design performance of the original steam generators, resulting in very little change to the original operating parameters. The replacement steam generators have been modeled in the postulated accidents and transients with a steam generator tube plugging level range of 0% to 10%

(uniform).

RTDP The calculation method utilized to meet DNB design basis is the Revised Thermal Design Procedure (RTDP), discussed in Reference 28. Uncertainties in plant operating parameters, peaking factors, and the DNB correlation are statistically treated such that there is at least a 95 percent probability at a 95 percent confidence level that the minimum DNBR will be greater than the applicable limits. These are given in Table 14.1-0. Since the parameter uncertainties are considered in determining the design DNBR value, nominal input parameters without uncertainties and their magnitude are described in further detail in Section 4.0 of Reference 27.

Revised OTT Reactor Trip Setpoints As a result of implementing the Stretch Power Uprate, the core thermal safety limits are revised and result in a change to the OTT and OPT reactor protection trip setpoints. The revised core thermal safety limits are shown in Technical Specification Figure 2.1-1 and are based on the 15x15 Upgrade fuel design with a maximum full power FH of 1.635 (with uncertainties).

The Safety Analysis Values for the OTT and OPT reactor protection trip setpoints determined by Transient Analysis are as follows:

OTT:

K1 = 1.42 (Safety Analysis Value)

K2 = 0.022 K3 = 0.00070 For OTT, the f(l) function is as stated in Technical Specifications section 3.3.1 For K1, a smaller, more conservative value is utilized by the Tech Spec.

OPT:

K4 = 1.164 (Safety Analysis Value)

Chapter 14, Page 4 of 333 Revision 04, 2011

IP3 FSAR UPDATE K5 = 0.0175 for Tavg increasing / 0.0 for Tavg decreasing K6 = 0.0015 for T>T / 0.0 for T T (T=Tavg, T = 572°F)

For K4, a smaller more conservative value is utilized by Tech Spec.

The nominal values of Tavg and pressure used in OTT and OPT calculations are 572°F and 2250 psia, respectively.

The OTT and OPT instrumentation include values for full power T and T-average for each loop as reference points. Separate values for full power T and T-average for each loop are determined during cycle initial power ascension testing and incorporated into the calibration procedures. Prior to instrument calibration at full power, best estimates for T and T-average are used in the setpoint determination. Margin exists in the design basis analyses to compensate for inherent error in the instrumentation during initial startup and for changes in core flux distribution during the operating cycle.

The Safety Analysis Values of the constants used in the OTT and OPT equations are:

Time constant (first order lag) for measurement of Tavg 8.5 seconds Time constant (first order lag) for measurement of T 8.5 seconds Lead for OTT trip setpoint 25.0 seconds Lag OTT trip setpoint 3.0 seconds Rate time constant for OPT setpoints 10.0 seconds Lead on T measurement 0.0 seconds Lag on T measurement 0.0 seconds With respect to RCS pressure, the OTT and OPT trip functions provided in this section are only applicable to a range of pressurizer pressure from 1850 psia to 2470 psia. Hence, the Low and High Pressurizer Pressure Reactor Trip setpoints are set to assure this pressurizer pressure range is not exceeded with appropriate consideration of uncertainties.

Historical Fuel Assembly Characteristics [Historical Information]

Fuel Densification Fuel densification is no longer a concern. Since it was a concern at one time, a study was conducted to evaluate the effects of fuel densification on all non-LOCA transients presented in the FSAR. Fuel densification, which causes irradiated fuel pellets to shrink, conceivably developing high localized power peaks at the fuel gaps, was identified as a potential problem.

Reanalysis was performed for the rod ejection, loss of flow, locked rotor, and rod withdrawal at power transients. While some of the cases reanalyzed yielded more severe results than the corresponding cases analyzed without the effects of fuel densification, it was determined that the effects of fuel densification would not result in any safety criteria being violated. The results are included in WCAP-8146(1).

OFA-LOPAR Fuel The cycle 5 and cycle 6 cores involved a fuel design transition from the Westinghouse 15x15 low parasitic design (LOPAR) to the 15x15 Optimized fuel Assembly (OFA) design. As the OFA design resulted in an increased control rod drop time, the fast transients for which the reactor Chapter 14, Page 5 of 333 Revision 04, 2011

IP3 FSAR UPDATE protection system trips the reactor within a few seconds after transient initiation were quantitatively reanalyzed. As the locked rotor transient is a fast transient, it was quantitatively reanalyzed. For Cycle 7 an increased FH of 1.62 was employed and the affected analyses were reperformed.

Vantage 5 Fuel The VANTAGE 5 (V5) fuel assembly was designed to be compatible with OFAs, reactor internalsl interfaces, the fuel handling equipment, and refueling equipment. The VATAGE 5 design dimensions were essentially equivalent to the Indian Point 3 OFA assembly design from an exterior assembly envelope and reactor internals interface standpoint. (Reference 26)

The significant new mechanical features of the VANTAGE 5 design relative to the OFA design included the following:

• Integral Fuel Burnable Absorber (IFBA)

• Reconstitutable Top Nozzle

• Slightly longer fuel rod assembly for extended burnup capability

• Axial Blankets

• Redesigned fuel rod bottom end plug to facilitate reconstitution capability Other different mechanical features are the use of standardized chamfer pellet design and the Debris Filter Bottom Nozzle (DFBN).

V5 fuel was first loaded in Cycle 7.

Vantage+ Fuel Vantage+ (V+) uses the following V5 features:

• Reconstitutable Top Nozzle (RTN)

• Extended Burnup Fuel Assembly Design

• Extreme Low Leakage Loading Pattern

• Enriched Integral Fuel Burnable Absorbers (IFBAs)

• Debris Filter Bottom Nozzle (DFBN)

• Axial Blankets In addition V+ incorporates the following features as described in Reference 27:

• Zirlo' Fuel Cladding

• Low Pressure Drop (LPD) Mid-Grids

• Integral Flow Mixer grids (IFMs)

• ZIRLO' guide thimbles & instrumentation tubes

• Variable Pitch Fuel Rod Plenum Spring

• Mid-enriched Annular Fuel Pellets in Axial Blanket

• Fuel Assembly & Fuel Rod Dimensional Modifications

• Some Performance + Debris Mitigation Features Chapter 14, Page 6 of 333 Revision 04, 2011

IP3 FSAR UPDATE V+ Fuel began operation in Cycle 10, although one of its features, ZIRLO' clad was introduced in Cycle 9.

15x15 Upgrade This fuel design incorporates the following features in addition to the V+ fuel features:

• Balanced IFM design

• New Mid-grid design (I-Spring ZIRLO' Mid-grids)

• Tube-in-tube guide thimble design The characteristics of 15x15 Upgrade fuel have been incorporated into the Chapter 14 accident analyses. 15x15 Upgrade fuel will begin operation in Cycle 14.

14.1 CORE AND COOLANT BOUNDARY PROTECTION ANALYSIS For the following plant abnormalities and transients, the Reactor Control and Protection System is relied upon to protect the core and reactor coolant boundary from damage:

1) Uncontrolled control rod assembly withdrawal from subcritical condition

2) Uncontrolled withdrawal control rod assembly, at power

3) Rod Assembly Misalignment (this encompasses a statically misaligned RCCA (14.1.3) and RCCA drop (14.1.4)

4) Chemical and Volume Control System (CVCS) malfunction

5) Loss of reactor coolant flow

6) Startup of an inactive reactor coolant loop

7) Loss of external electrical load

8) Loss of normal feedwater

9) Excessive heat removal due to feedwater system malfunction

10) Excessive load increase incident

11) Loss of all AC power to the station auxiliaries

12) Startup accidents without reactor coolant pump operation

13) Startup accident with a full pressurizer Trip is defined for analytical purposes as the insertion of all full length RCC assemblies except the most reactive assembly which is assumed to remain in the fully withdrawn position. This is to provide margin in shutdown capability against the remote possibility of a stuck RCC assembly condition existing at a time when shutdown is required.

The instrumentation drift and calorimetric errors used to establish the maximum nuclear overpower set point are presented in Table 14.1-1.

The negative reactivity insertion following a reactor trip is a function of the acceleration of the control rods and variation in rod worth as a function of rod position. Control rod positions after trip have been determined experimentally as a function of time using an actual prototype assembly under simulated flow conditions. The resulting rod positions were combined with rod worths to define the negative reactivity insertion as a function of time, according to Figure 14.1-1.

Instrumentation is provided for continuously monitoring all individual RCC assemblies together with their respective bank position. This is in the form of a deviation alarm system. Procedures Chapter 14, Page 7 of 333 Revision 04, 2011

IP3 FSAR UPDATE are established to correct deviations. In the worst case, the plant will be shutdown in an orderly manner and the condition corrected. Such occurrences are expected to be extremely rare based on operation and test experience to date.

In summary, reactor protection was designed to prevent cladding damage in all transients and abnormalities listed above. The most probable modes of failure in each protection channel result in a signal calling for the protective trip. Coincidence of two-out-of-three (or two-out-of-four) signals is required where single channel malfunction could cause spurious trips while at power.

A single component or channel failure in the Protection System itself coincident with one stuck RCCA is always permissible as a contingent failure and does not cause violation of the protection criteria. The Reactor Protection Systems were designed in accordance with the IEEE 279 Standard for Nuclear Plant Protection Systems, August 1968.

14.1.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical Condition A control rod assembly withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of control rod assemblies resulting in a power excursion. While the probability of a transient of this type is extremely low, such a transient could be caused by a malfunction of the Reactor control or Control Rod Drive Systems. This could occur with the reactor either subcritical or at power. The at power case is discussed in Section 14.1.2.

Reactivity is added at a prescribed and controlled rate in bringing the reactor from a shutdown condition to a lower power level during startup by rod control withdrawal. Although the initial startup procedure uses the method of boron dilution, the normal startup is with control rod assembly withdrawal. Control rod assembly motion can cause much faster changes in reactivity than can be made by changing boron concentration.

The control rod drive mechanisms are wired into preselected banks, and these bank configurations are not altered during core life. The assemblies are therefore physically prevented from being withdrawn in other than their respective banks. Power supplied to the rod banks is controlled such that no more than two banks can be withdrawn at any time. The control rod drive mechanism is of the magnetic latch type and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate is analyzed in the detailed analysis assuming the simultaneous worth at maximum speed.

Should a continuous rod assembly be initiated, the transient will be terminated by the following automatic safety features:

1) Source range flux level trip - actuated when either of two independent source range channels indicates a flux level above a preselected, manually adjustable value. This trip function may be manually bypassed when either intermediate range flux channel indicates a flux level above the source range cutoff power level. It is automatically reinstated when both intermediate range channels indicate a flux level below the source range cutoff power level.

2) Intermediate range control rod stop - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value. The control rod stop may be manually bypassed when two out of four power range channels indicate a power level above approximately 10 percent of full power. It is automatically reinstated when three of the four power range channels are below this value.

Chapter 14, Page 8 of 333 Revision 04, 2011

IP3 FSAR UPDATE

3) Intermediate range flux level trip - actuated when either of two independent intermediate range channels indicates a flux level above a preselected, manually adjustable value.

This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

4) Power range flux level trip (low setting) - actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

5) Power range control rod stop - actuated when one out of the four power range channels indicate a power level above a pre-set setpoint. This function is always active.

6) Power range flux level trip (high setting) - actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

The nuclear power response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative fuel temperature coefficient. This self-limitation of the initial power burst results from a fast negative fuel temperature feedback (Doppler effect) and is of prime importance during a startup incident since it limits the power to a tolerable level prior to external control action. After the initial power burst, the nuclear power is momentarily reduced; if the incident is not then terminated by a reactor trip, the nuclear power increases again, but at a much slower rate.

Termination of the startup incident by the above protection channels prevents core damage. In addition, the reactor trip from high reactor pressure serves as a backup to terminate the incident before an overpressure condition could occur.

The Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event is a Condition II event as defined by ANS-051.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition II occurrence is defined as a fault of moderate frequency, which, at worst, should result in reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event for Indian Point Unit 3 are :

1. Pressure in the reactor coolant and main stream systems should not exceed 110% of their respective design values.

2. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit.

3. Fuel centerline temperatures should remain below the minimum temperature at which fuel melting would occur.

Chapter 14, Page 9 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions Analysis of this transient was performed by digital computation incorporating the neutron kinetics, including six delayed groups, and the core thermal and hydraulic equations (Reference 14). In addition to the nuclear flux response, the average fuel clad, and water temperature, and heat flux responses were computed.

In order to give conservative results for the Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition analysis, the following assumptions were made:

1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on Doppler reactivity feedback, a conservatively low (absolute magnitude) value for the Doppler power defect is used.

2. The effect of moderator reactivity is negligible during the initial part of the transient because the heat transfer time constant between the fuel and the moderator is much longer than the neutron flux response time constant. However, after the initial neutron flux peak, the moderator temperature reactivity coefficient affects the succeeding rate of power increase. A highly conservative value of the moderator temperature coefficient is assumed in the analysis to yield the maximum peak heat flux.

3. The analysis assumes the reactor to be at hot zero power conditions with a vessel average temperature of 547F. This assumption is more conservative than that of a lower initial system temperature (i.e., shutdown conditions). The higher temperature difference enhances fuel-to-coolant heat transfer and reduces the Doppler power defect, resulting in a higher peak heat flux.

4. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to the DNB transient.

5. The positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the two sequential RCCA banks having the greatest combined work at the maximum withdrawal speed.

6. The analysis assumes that the reactor is initially critical at 10-9 fraction of nominal power, which is below the power level expected for any shutdown condition. The combination of highest reactivity insertion rate and lowest initial power produces the highest heat flux.

7. The DNB analysis assumes the most limiting axial and radial power shapes possible during the fuel cycle associated with having the two highest combined worth banks in their highest worth position.

Initial Conditions The Revised Thermal Design Procedure (Reference 28) is not used in the analysis of this event.

Standard Thermal Design Procedure methods (maximum uncertainties in initial conditions) are used instead. Since the event is analyzed from hot zero power, the steady-state uncertainties Chapter 14, Page 10 of 333 Revision 04, 2011

IP3 FSAR UPDATE on core power and RCS average temperature are not considered in defining the initial conditions.

Initial Condition Value Used in Analysis Core Power 10-9 fraction of nominal Pressurizer Pressure 2190 psia Reactor Vessel TIN 547.0F Reactor Vessel TAVG 547.0F Core Flow 158,842 gpm (44.82% of TDF reflecting 2 RCPs) (1)

(1)

A 1.18% core flow penalty was applied to address the effects of RCS flow asymmetry due to steam generator tube plugging asymmetry.

Control Systems Control systems are assumed to function only if their operation causes more severe accident results. For Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition analysis, no control functions are assumed to operate.

Protection Systems Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrumentation error, setpoint error, delay for trip signal actuation, and delay for control rod assembly release is taken into account. The analysis assumes a 10%

uncertainty in the power range flux trip setpoint (low setting), raising it from the nominal value of 25% nominal to a value of 35% nominal. No credit is taken for the source and intermediate range protection. The reactor trip time delay from reactor trip signal actuation to RCCA release Is assumed to be 0.5 seconds.

Reactivity Modeling The Uncontrolled RCCA Withdrawal from a Subcritical Condition accident results in a rapid nuclear power excursion which is terminated initially by Doppler reactivity feedback, and ultimately by reactor trip. Reactivity feedback parameters are chosen to yield the most severe power burst. These include a conservatively small (absolute value) Doppler power defect of 962 pcm at full power and a maximum delayed neutron fraction of 0.007. A total trip reactivity of

-3% k/k excluding the highest worth rod is assumed with a scram time of 2.7 seconds from beginning of rod motion until the dashpot is reached.

Heat Transfer Modeling For the DNBR evaluation, a conservatively high fuel rod gap heat transfer coefficient (10,000 Btu/hr-ft2 - F) and conservatively low hot channel factors (1.0) are assumed. This maximizes the heat flux during the event which yields a more severe DNBR transient. For the hot spot fuel temperature calculation, a conservatively low fuel rod gap heat transfer coefficient (500 Btu/hr-Chapter 14, Page 11 of 333 Revision 04, 2011

IP3 FSAR UPDATE ft2-F) and conservatively high hot channel factors (6.851) are assumed. This maximizes the fuel and clad temperatures resulting from nuclear power transient.

Results Figure 14.1-2 shows the nuclear power transient for the Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition event. The neutron flux overshoots the full power nominal value for a very short period of time; therefore, the energy release and fuel temperature increase are relatively small. The heat flux response used in the DNBR evaluation is shown in Figure 14.1-3.

The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the nominal full power value. Figure 14.1-4 shows the transient response of the hot spot fuel centerline, fuel average, and cladding inner temperatures. These temperatures remain below their respective nominal full power values at all times during the event. The minimum DNBR remains above the safety analysis limit at all times.

Table 14.1-2 presents the calculated sequence of events. After reactor trip, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal shutdown procedures.

Conclusions In the event of an Uncontrolled RCCA Bank Withdrawal from a Subcritical Condition, the core and the RCS are not adversely affected since the combinations of thermal power and coolant temperature and flow result in a DNBR greater than the limit value. Thus, no fuel or clad damage is predicted as a result of this transient.

14.1.2 Uncontrolled Control Rod Assembly Withdrawal at Power The Uncontrolled Rod Cluster Control Assembly (RCCA) Bank Withdrawal at Power event is defined as the inadvertent addition of reactivity to the core caused by the withdrawal of RCCA banks when the core is above the no-load condition. The reactivity insertion resulting from the bank (or banks) withdrawal will cause an increase in core nuclear power and subsequent increase in core heat flux. An RCCA withdrawal can occur with the reactor subcritical, at hot zero power, or at power. The uncontrolled RCCA bank at power event is analyzed for Mode 1 (power operation).

The event is simulated by modeling a constant rate of reactivity insertion starting at time zero and continuing until a reactor trip occurs. The analysis assumes a spectrum of possible reactivity insertion rates up to a maximum positive reactivity insertion rate greater than that occurring with the simultaneous withdrawal, at maximum speed, of two sequential RCCA banks occurring with maximum worth. The minimum reactivity insertion rate considered is 1 pcm/second.

Unless the transient response to the RCCA withdrawal event is terminated by manual or automatic action, the power mismatch and resultant temperature rise could eventually result in departure from nucleate boiling (DNB) and/or fuel centerline melt. Additionally, the increase in RCS temperature caused by this event will increase the RCS pressure, and if left unchecked, could challenge the integrity of the Reactor Coolant System Pressure Boundary or the Main Steam System Pressure Boundary.

Chapter 14, Page 12 of 333 Revision 04, 2011

IP3 FSAR UPDATE To avert the core damage that might otherwise result from this event, the reactor protection system is designed to automatically terminate any such event before the departure from nucleate boiling ratio (DNBR) falls below the limit value, the fuel rod kW/ft limit is reached the peak pressures exceed their respective limits, or the pressurizer fills. Depending on the initial power level and rate of reactivity insertion, the reactor may be tripped and the RCCA withdrawal terminated by any of the following trip signals.

1) Nuclear power range instrumentation actuates reactor trip if two-out-of-four channels exceed an overpower setpoint.

2) Reactor trip is actuated if any two-out-of-four overtemperature T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power distribution, temperature and pressure to protect against DNB.

3) Reactor trip is actuated if any two-out-of-four overpower T channels exceed an overpower T set setpoint.

4) A high pressure reactor trip, actuated from any two-out-of-three pressure channels, is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.

5) A high pressurizer water level reactor trip, actuated from any two-out-of-three level channels, is actuated at a fixed point. This affords additional protection for control rod assembly withdrawal incidents but was not considered in the following analysis.

6) In addition to the above listed reactor trips, there are the following control rod assembly withdrawal blocks:

a) High nuclear flux (one-out-of-four) b) Overpower T (one-out-of-four) c) Overtemperature T (one-out-of-four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of Reactor Coolant System conditions is illustrated in Chapter 7.

Figure 7.2-11 represents the allowable conditions for reactor vessel average temperature and T with the design power distribution in a two dimensional plot. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors, so that under nominal conditions trip would occur well within the area bounded by these lines.

The utility of the diagram just described is in the fact that the operating limit imposed by any given DNBR can be represented as a line on this coordinate system. The DNB lines represent the locus of conditions for which the DNBR equals the applicable limit. All points below and to the left of the line for a given pressure have a DNBR greater than the applicable limit. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The region of permissible operation (power, pressure and temperature) is completely bounded by the combination of reactor trips: high nuclear flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and overtemperature T (variable setpoints).

Chapter 14, Page 13 of 333 Revision 04, 2011

IP3 FSAR UPDATE These trips are designed to prevent DNBR or less than the applicable limit. The applicable limits are given in Table 14.1-0.

The uncontrolled RCCA withdrawal at power event is classified as a Condition II event as defined by ANS-051./N18.2-1973, Nuclear Safety Criteria for the Design of Stationary PWR Plants. The major hazards associated with an unmitigated and uncontrolled RCCA bank(s) withdrawal at power are the possibility of DNB, filling the pressurizer and an increase in RCS and secondary steam pressures, resulting from the power excursion and subsequent increase in RCS and core temperatures.

The safety analyses criteria for this event are as follows:

1) The pressure in the reactor coolant system and the steam generators should be maintained below 110% of their designed pressures (i.e., 2750.0 psia, and 1208.5 psia, respectively)

2) The critical heat flux and the fuel temperature and clad strain limits should not be exceeded. The peak linear heat generation rate (expressed in kw/ft) should not exceed a value which would cause fuel centerline melting. This is ensured by demonstrating that the minimum DNB ratio does not go below the safety analysis limit values as provided in Table 14.1-0 assisted by Figure 14.1-0. Meeting the DNBR limit also ensures that offsite dose requirements of 10 CFR 20 are met.

3) An incident of moderate frequency (Condition II) should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The uncontrolled RCCA withdrawal at power event is analyzed to show that: 1) the integrity of the core is maintained by the reactor protection systems as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below the accident analysis pressure limits; and 3) the pressurizer does not reach a water solid condition and result in water relief through the pressurizer relief and safety valves. Of these, primary concern for this event is DNB and assuring that the DNBR limit is met.

This transient is analyzed using the RETRAN code (Reference 39). This code simulates the neutron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, SG and SG safety valves. The code computes pertinent plant variables including temperatures, pressures and power level.

The transient responses for the RCCA bank withdrawal at power event were analyzed for a large number of cases with initial power levels of 100%, 60%, and 10% power. A spectrum of positive reactivity insertion rates from a minimum value (1 pcm/sec) up to a maximum value greater than that occurring with the simultaneous withdrawal, at maximum speed, of two sequential RCCA banks having the maximum worth were analyzed for each power level. Each combination of power and reactivity insertion rate was analyzed for limiting core reactivity conditions of minimum (BOL) and maximum (EOL) reactivity feedback conditions.

The Revised Thermal Design Procedure (Reference 28) was used in the analysis for the minimum DNBR so the initial conditions for power, pressurizer pressure and Tavg are at the Chapter 14, Page 14 of 333 Revision 04, 2011

IP3 FSAR UPDATE nominal values. For the analysis of peak RCS pressure, uncertainties in the initial conditions for power, pressurizer pressure and Tavg are conservatively applied.

1) Reactivity Coefficients - Two spectrums are analyzed:

a) Minimum Reactivity Feedback. A least negative moderator density coefficient of reactivity is assumed, corresponding to beginning of core life conditions. A conservatively small (absolute magnitude) Doppler power coefficient, variable with core power, was used in the analysis.

b) Maximum Reactivity Feedback. A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.

2) A conservatively high setpoint of 118% of full power was assumed for the High Neutron Flux reactor trip. The OTT reactor trip function includes all adverse instrumentation and setpoint errors. Delays for trip actuation are assumed to be the maximum values; 0.5 seconds for the High Neutron Flux reactor trip, 2.0 seconds for the OTT reactor trip.

3) The trip reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled

4) A range of reactivity insertion rate is examined. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal for the two control banks having maximum combined worth at maximum speed (90 pcm/sec).

5) Power levels of 10%, 60% and 100% power are considered.

Results Figures 14.1-5 through 14.1-10 show the transient response for rapid RCCA withdrawal (66 pcm/sec) incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result and margin to DNB is maintained.

The transient response for a slow RCCA withdrawal from full power is shown in Figures 14.1-11 through 14.1-16. Reactor trip on OTT occurs after a longer period and the rise in temperature and pressure is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater that the safety analysis limit.

Figure 14.1-17 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen the high neutron flux and OTT reactor trip channels provide protection over the whole range of reactivity insertion rates. The minimum DNBR is never less than the safety analysis limit.

Figures 14.1-18 through 14.1-19 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents initiating from 60 and 10 percent power levels, respectively, for minimum and maximum reactivity feedback. The results are similar to the 100 percent power Chapter 14, Page 15 of 333 Revision 04, 2011

IP3 FSAR UPDATE case, except as the initial power is decreased, the range over which OTT trip is effective is increased. In all cases the DNBR remains above the safety analysis limit.

The shape of the curves of the minimum DNB ratio versus reactivity insertion rate in the reference figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 14.1-19, for example, it is noted that:

1) For reactivity insertion rates above ~ 24 pcm/sec reactor trip is initiated by the high neutron flux trip for the minimum reactivity feedback cases. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid.

Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNB ratios during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux. Minimum DNBR during the transient thus decreases with decreasing insertion rate.

2) For reactivity insertion rates below ~24 pcm/sec the OTT trip terminates the transient.

The OTT reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based on measured Reactor Coolant System average temperature and pressure.

3) For reactivity rates between ~ 24 pcm/sec and ~ 7 pcm/sec the effectiveness (in terms of increased minimum DNBR) of the OTT trip increases due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower and the system lags and delays become less significant.

For reactivity insertion rates less than ~ 7 pcm/sec, the rise of the reactor coolant temperature is sufficiently high so that the steam generator safety valve setpoint is reached prior to the trip.

Opening of these valves, which act as an additional heat sink for the Reactor Coolant System, sharply decreases the rate of increase of Reactor Coolant System average temperature.

For transients initiated from higher power levels (for example, see Figure 14.1-17) the effect described in item 4 above, which results in the peak in minimum DNBR at approximately 7 pcm/sec, does not occur since the steam generator safety valves are not actuated prior to trip.

Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 118 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis) and the peak fuel centerline temperature remains below the fuel melting temperature.

For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the OTT reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 118 percent of its nominal value and the peak fuel centerline temperature remains below the fuel melting temperature.

Chapter 14, Page 16 of 333 Revision 04, 2011

IP3 FSAR UPDATE Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced.

The calculated sequence of events for an RCCA bank withdrawal from full power assuming minimum reactivity feedback conditions for a large and a small reactivity insertion rates are shown in Table 14.1-3.

With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

Conclusions The high neutron flux and OTT trip channels provide adequate protection for uncontrolled rod withdrawal event at power up to the maximum reactivity insertion rate of 66 pcm/sec. The minimum calculated DNBR is always greater than the safety analysis limit value pressurizer filling does not occur, and peak pressures in RCS and secondary steam system do not exceed 110% of their respective design pressures.

14.1.3 ROD ASSEMBLY MISALIGNMENT 14.1.3.1 Accident Description RCCA misalignment accident includes the following:

1. One or more dropped RCCAs within the same group.

2. A dropped RCCA bank

3. A statically misaligned RCCA Each RCCA has a position indicator channel which displays the position of the assembly in a display grouping that is convenient to the operator. Fully inserted assemblies are also indicated by a rod at bottom signal which actuates a local alarm and a control room annunciator. Group demand position is also indicated.

RCCAs move in preselected banks, and the banks always move in the same preselected sequence. Each bank of RCCAs consists of two groups. The rods comprising a group operate in parallel. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation) of the stationary moveable gripper, and lift coils of the control rod drive mechanism withdraws the RCCA held by the mechanism. Mechanical failures are in the direction of insertion or immobility.

A dropped RCCA, or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the nuclear instrumentation system;

2. Asymmetric power distribution as seen by the nuclear instrumentation system;

3. Rod at bottom signal

4. Rod deviation alarm;

5. Rod position indicators.

Misaligned RCCAs are detected by:

1. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;

2. Rod deviation alarm; Chapter 14, Page 17 of 333 Revision 04, 2011

IP3 FSAR UPDATE

3. Rod position indicators.

The resolution of the rod position indicator channel is 5% of the 12 foot span (7.2 inches).

Deviation of any individual indicated rod position from its group step counter demand position within the limits specified in Table 3.1.4-1 of the Improved Technical Specifications (above 85%

power) or within 24 steps (at or below 85% power) will not cause power distributions worse than the design limits. The rod deviation alarm alerts the operator to rod deviation in excess of these limits. If the rod deviation alarm is not operable, the operator is required to log the rod positions in a prescribed time sequence to confirm the alignment.

If one or more rod position indicator channels should be out of service, operating instructions are followed to assure the alignment of the non-indicated assemblies. These operating instructions use the moveable incore detector system to verify the position of the malpositioned rod. Although not as accurate, the core exit thermocouple system can be used as another indicator of a grossly malpositioned rod. The operating instructions also call for the excore detectors and/or moveable incore detector system and the core exit thermocouple system to be monitored following significant motion of the non-indicating channels.

Another type of rod assembly misalignment is the so-called Salem Event, in which one or more assemblies move out of the core on a bank control demand to move in (uncontrolled asymmetric withdrawals). The Indian Point 3 operators have been trained on this event.

The Westinghouse Owners Group developed Rod Cluster Control sequence timing modification (24) to remove the potential for single failures to cause uncontrolled asymmetric rod withdrawals.

Reference 25 analyzed logic system single failures for the revised timing and concluded that upon completion of the modification, and performance of identified testing each refueling, the potential for uncontrolled asymmetric withdrawals is resolved. Failures that could occur with the revised timing have been analyzed and result in limited rod movement, either inward, or in the direction demanded. These failures result in consequences less severe than the limiting single Rod Control System malfunction. Westinghouse evaluation concludes that all asymmetric rod motion which could occur due to single failures following the timing change, have been determined to be bounded by current plant analyses and licensing basis. The NRC has reviewed this generic evaluation.

Indian Point 3 has performed the modification to the timing, and has committed to perform surveillance testing during each refueling startup to identify any single failures, and document the acceptability of the timing.

14.1.3.2 Method of Analysis and Assumptions For the statically misaligned RCCA, steady state power distributions are analyzed using appropriate nuclear physics computer codes. The peaking factors are used as input to the VIPRE code to calculate the DNBR. The analysis examines the case of the worst rod withdrawn from bank D inserted at the insertion limit with the reactor initially at full power.

The analysis assumes this incident to occur at beginning of life since this assumption results in the minimum feedback value (least negative) of the moderator temperature coefficient. This assumption maximizes the power rise and minimizes the tendency of the large (most negative) moderator temperature coefficient to flatten the power distribution.

Results Chapter 14, Page 18 of 333 Revision 04, 2011

IP3 FSAR UPDATE The most-severe misalignment situations with respect to DNBR occur at significant power levels. These situations arise from cases in which one RCCA is fully inserted or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the transient approaches the postulated conditions. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the safety analysis limit value.

The insertion limits in the Core Operating Limits Report (COLR) may vary from time to time depending on several limiting criteria. The full-power insertion limits on control bank D must be chosen to be above that position which meets the minimum DNBR and peaking factors. The full-power insertion limit is usually dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.

For this RCCA misalignment, with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the safety analysis value. The analysis of this case assumes that the initial reactor power, pressure, and RCS temperatures are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

For RCCA misalignment with one RCCA fully inserted, the DNBR does not fall below the safety analysis limit value. The analysis of this case assumes that initial reactor power, pressure, and RCS temperatures are at the nominal values, with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident; thus, there is no reduction in the ability of the primary coolant to remove heat from the fuel rod. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the limiting design axial power distribution. The resulting linear heat generation rate is well below that which would cause fuel melting.

After identifying an RCCA group misalignment condition, the operator must take action as required by the plant Technical Specifications and operating instructions.

Conclusions For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the safety analysis limit value.

14.1.4 Rod Cluster Control Assembly (RCCA) Drop The dropped RCCA accident is initiated by a single electrical or mechanical failure which causes any number and combination of rods from the same group of a given bank to drop to the bottom of the core. A dropped RCCA (single or multiple RCCAs) causes an initial reduction in nuclear power, corresponding to the reactivity worth of the RCCA(s), and a possible increase in the hot channel factor. If no protective action occurred, the reactor coolant system (RCS) would attempt to restore the power to the level that existed before the incident occurred. This would lead to a reduced safety margin or possibly departure from nucleate boiling (DNB), depending upon the magnitude of the hot channel factor.

Chapter 14, Page 19 of 333 Revision 04, 2011

IP3 FSAR UPDATE Protection is provided by an automatic rod withdrawal block (from a rod-on bottom signal).

Historically, protection was also provided by the automatic turbine runback function; however, this function has been disabled. The acceptance criterion for this event is that no fuel failures occur. This is verified by demonstrating that the departure from nucleate boiling ratio (DNBR) remains above the limit value for the plant.

For purposes of analysis, a single or multiple dropped RCCA occurrence is called a dropped rod. The multiple dropped RCCAs may be any number and combination of rods from the same group of a given bank. RCCAs from different groups are not considered since it requires more than one single failure for them to drop.

Dropped RCCAs can be detected by the excore detectors, core exit thermocouples, rod deviation alarms, and rod position indicators. In addition, the rod-on-bottom alarm will be actuated. These features serve to alert the operator to a dropped RCCA event. The rod-on-bottom signal device provides an indication signal for each RCCA.

A rod drop signal from any rod position indication channel, or from one or more of the four power range channels, initiates a blocking of automatic rod withdrawal. The rod withdrawal block is redundantly achieved.

The dropped rod (single or multiple dropped RCCAs) events are classified as a Condition II event as defined by ANS-051.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II dropped rod event for Indian Point Unit 3 are:

1) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,

2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The dropped rod transient was analyzed using the current approved Westinghouse methodology for plants originally designed with a turbine runback function. The LOFTRAN computer code (Reference 13) calculates the transient system response for the evaluation of the dropped RCCA and dropped RCCA bank events. The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, rod control system, steam generators, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Calculated statepoints and nuclear models form the basis used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE code.

Chapter 14, Page 20 of 333 Revision 04, 2011

IP3 FSAR UPDATE The RTDP was used in the analysis so the initial conditions for power, RCS pressure, and Tavg are at the nominal values.

Cases Analyzed Cases were analyzed assuming an automatic rod control block initiated by a dropped rod signal (i.e., by a rod-on-bottom signal), as well as with automatic rod withdrawal (for all possible single dropped RCCA worths) to specifically address the possibility of a single failure in the rod-on-bottom signal which blocks automatic rod withdrawal. Cases were also analyzed over a range of dropped rod worths.

To capture the transient response, dropped rod statepoints designed to bound both operation with and without automatic rod withdrawal were evaluated. The dropped rod/bank statepoints for these latter evaluations are based on generic dropped rod analyses performed as part of the Westinghouse Owners Group (WOG) dropped rod protection modification program, Reference

22. The WOG dropped rod protection modification program was specifically performed to support elimination of turbine runback on dropped rod (for Westinghouse plants with this system) and deletion of the negative flux rate trip (for Westinghouse plants without turbine runback on dropped RCCA).

Two distinct sets of generic dropped rod/bank statepoints were used in the evaluation; both of which are directly applicable to Indian Point Unit 3. One set of WOG dropped rod/bank statepoints considers no turbine runback due to the occurrence of the dropped RCCA but continues to credit a rod withdrawal block function (from either rod-on-bottom or a change in flux signal) which prevents automatic rod withdrawal (i.e., manual rod control). Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. This equilibrium process without rod control system interaction is monotonic, thus removing power overshoot as a concern. The second set of WOG generic dropped rod statepoints assumes automatic rod control. In the automatic rod control mode, the rod control system receives signals from the excore detectors and the turbine to indicate a primary/secondary side power mismatch. In an attempt to eliminate the power mismatch with turbine runback disabled (and failure of the system to block rod withdrawal), the rod control system initiates control bank withdrawal of a partially inserted control bank. With rod withdrawal, power overshoot may occur, after which the control system will insert the control bank and return the plant to nominal power.

Each set of statepoints were considered for all possible single and multiple dropped RCCA worths over a range of dropped rod/bank worths from 100 pcm to 1000 pcm for various moderator temperature coefficients between 0pcm/°F and -35 pcm/°F. The applicability of both of these sets of WOG generic dropped rod statepoints is limited to operation under uniform steam generator tube plugging conditions only.

Results Figures 14.1-20 through 14.1-22 show a typical transient response with automatic rod withdrawal blocked and when reactivity feedback does not offset the worth of the dropped RCCA(s). In this case, beginning-of-life (BOL) conditions are shown with a small negative moderator temperature coefficient (MTC) of -5 pcm/°F for a dropped RCCA worth of 400 pcm.

As a result of the negative reactivity insertion associated with the dropped RCCA, a cooldown condition of the RCS exists. The nuclear power reaches a level lower than that which existed Chapter 14, Page 21 of 333 Revision 04, 2011

IP3 FSAR UPDATE before the incident, and the RCS temperature and pressure continue to decrease until a low pressurizer pressure reactor trip signal is reached.

Figures 14.1-23 through 14.1-25 show a typical transient response with automatic rod withdrawal blocked and when reactivity feedback is large enough to offset the worth of the dropped RCCA(s). In these figures, end-of-life (EOL) conditions are shown with a large negative MTC of -35 pcm/°F for a dropped RCCA worth of 400 pcm. With a large reactivity feedback, a new equilibrium condition is reached without a reactor trip. The nuclear power returns to nearly the initial power level that existed before the incident, while the RCS temperature and pressure are reduced to a slightly lower condition.

Figures 14.1-26 through 14.1-28 show a typical transient response for a dropped RCCA worth of 200 pcm with automatic rod control functioning and BOL conditions. In this case, BOL conditions are represented by a small negative MTC of -5 pcm/°F. As a result of the negative reactivity insertion associated with the dropped RCCA, nuclear power promptly drops to a minimum and is then recovered under rod control. The prompt decrease in nuclear power is governed by the rod worth since the rod control system does not respond during the short drop period. The return to power is not sensitive to this rapid initial drop, but to the indicated power and temperature inputs to the rod control system which, in an attempt to restore power, result in control bank withdrawal that has the potential to cause an overshoot in power, after which the control system will insert the control bank and return the plant to nominal power.

Figures 14.1-29 through 14.1-31 show a typical transient response for a dropped RCCA worth of 200 pcm with automatic rod control functioning and EOL conditions. In these figures, EOL conditions are represented by a large negative MTC of -35 pcm/°F. With a large reactivity feedback, the power overshoot is effectively dampened due to the reactivity inserted via cooldown of the RCS as opposed to rods.

The evaluation of the generic WOG dropped rod/bank statepoints examined in support of operation without turbine runback, and to address the possibility of a single failure in the rods-on-bottom signal which blocks automatic rod withdrawal show the applicable licensing basis acceptance criteria are met. Specifically, the evaluations performed using the WOG dropped rod/bank statepoints verified that the DNBR licensing basis acceptance criterion is met assuming no turbine runback following a dropped RCCA event for: 1) single or multiple dropped RCCAs from the same group of a given bank with rod withdrawal block, and 2) for all single dropped RCCA worths with automatic rod control functioning. The latter confirms the acceptability of the dropped RCCA event for a single failure of a rod-on-bottom signal which automatically blocks rod withdrawals Due to the nature of the dropped RCCA event without turbine runback (i.e., the addition of negative reactivity to core without a reduction in turbine output), pressure transients in the reactor coolant and main steam systems are not a concern and the pressures will not exceed 110% of the design values. Furthermore, the occurrence of a single dropped RCCA or multiple dropped RCCAs from the same group of a given bank without turbine runback will not result in generating a more serious plant condition without other faults occurring independently.

Conclusion Based on the DNBR results for all the cases analyzed, it has been demonstrated that the DNBR criterion is met and, therefore, it is concluded that dropped RCCAs do not lead to conditions that cause core damage and that all applicable safety criteria are satisfied for this event.

Chapter 14, Page 22 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.1.5 Chemical and Volume Control System Malfunction Reactivity can be added to the core by feeding primary grade water into the Reactor Coolant System via the reactor makeup portion of the Chemical and Volume Control System. The normal dilution procedures call for a limit on the rate of magnitude for any individual dilution, under strict administrative controls. Boron dilution is a manual operation. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during the normal charging to that in the Reactor Coolant System. The Chemical and Volume Control System is designed to limit, even under various postulated failures modes, the potential rate of dilution to a valve, which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve provides the only supply of makeup water to the Reactor Coolant System which can dilute the reactor coolant. Inadvertent dilution can be readily terminated by closing this valve. In order for makeup water to be added to the Reactor Coolant System, at least one charging pump must also be running in addition to a primary makeup water pump.

The maximum delivery rate of unborated water to the Reactor Coolant System is limited by charging pumps. Assuming all three charging pumps are operating, the maximum delivery rate is 294 gpm.

The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board. In order to dilute, two separate operations are required. First, the operator must switch from the automatic makeup mode to the dilute mode. Second, the operator must actuate the system. Omitting either step would prevent dilution. This makes the possibility of inadvertent dilution very remote.

Information on the status of reactor coolant makeup is continuously available to the operator.

Lights are provided on the control board to indicate the operating condition of pumps in the Chemical and Volume Control System. Alarms are actuated to warn the operator if boric acid or makeup water flow rates deviate from preset values as a result of system malfunction.

The inadvertent boron dilution event is considered to be possible in all modes of plant operation.

However, Indian Point Unit 3 received a license to operate prior to the issuance of Regulatory Guide 1.70, Revisions 2 and 3 (Reference 33). Consequently, the analysis of the boron dilution event is only performed under the requirements of Regulatory Guide 1.70, Revision 1, for conditions equivalent to Modes 1,2 and 6 (i.e., plant modes of power operation, plant startup, and refueling, respectively).

If left unchecked, the reactivity addition due to an inadvertent boron dilution may lead to the loss of plant shutdown margin. During power operation and startup (Modes 1 and 2), this would result in an increase in reactor power and/or loss of the capability to shut the reactor down via insertion of the RCCAs. In refueling (Mode 6), the reactivity insertion due to the dilution may result in the complete loss of plant shutdown margin and possible return to criticality with no means of terminating the reactivity increase.

Chapter 14, Page 23 of 333 Revision 04, 2011

IP3 FSAR UPDATE The licensing-basis safety analysis is performed to identify the amount of time available for operator action to mitigate the effects of boron dilution event prior to the complete loss of plant shutdown margin. Conservative analysis assumptions are used to minimize the calculated time to loss of plant shutdown margin. The calculated time is presented as that required for operator action to effectively mitigate the effects of the boron dilution.

The alarms and indications that would alert the operator to the occurrence of a boron dilution event are the following:

• indication of the boric acid and blended flowrates (all modes)

• CVCS pump status lights (all modes)

• high flux at shutdown alarm (Mode 6)

• indicated/audible increase in source range neutron flux count rate (Mode 6) source range reactor trip (Mode 2)

• axial flux difference alarm (Mode 1)

• control rod insertion limit low and low-low alarms (Modes 1 and 2)

• overtemperature T alarm and reactor trip (Mode 1)

• power range neutron flux reactor trip, low and high setpoints (Modes 1 and 2)

Prior to the complete loss of plant shutdown margin resulting from an inadvertent boron dilution, RCS and core transient parameters are within the bounds of those calculated for other licensing-basis accidents as defined in the plant Technical Specifications. Therefore, the boron dilution event is not limiting with respect to the licensing-basis acceptance criteria such as minimum DNBR and maximum RCS pressure. Thus, if the time between the inadvertent boron dilution and the loss of plant shutdown margin is greater than the available operator action time acceptance criterion, then the above licensing-basis criteria are assumed to be satisfied. No transient results are quantified or presented as part of the analysis of the boron dilution event.

Initial/Nominal Conditions Assumptions The initial conditions assumed for the inadvertent boron dilution event are dependent on the mode of plant operation for which the analysis is being performed. However, the rated thermal power for each mode is not an assumed variable for this analysis. The RCS pressure and average temperature are the only primary system thermal-hydraulic parameters used in the calculations for the boron dilution event analysis. The RCS flowrate is not an explicit assumption used in the analysis; it is assumed, for all modes, that there is sufficient flow to presume perfect mixing of the dilution water as it enters the RCS. The assumption of perfect mixing has been shown to be conservative with respect to slug-flow mixing via analysis.

Power Operation (Mode 1) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for the use in the calculation of the dilution mass flowrate. The initial RCS average temperature, 579.5 F, is the nominal full-power value plus 7.5F which accounts for instrument errors. The initial RCS pressure, 2250 psia, is the nominal plant value. A minimum active RCS volume of 9,350 ft3 is assumed. This volume corresponds to the total RCS volume excluding the volume of the pressurizer, pressurizer surge line, and the dead volume in the reactor vessel upper head region. In addition, this active RCS volume conservatively assumes a reduced primary-side volume of the steam generators to reflect a maximum steam generator tube plugging level of 10%.

Chapter 14, Page 24 of 333 Revision 04, 2011

IP3 FSAR UPDATE The assumed volumetric dilution flowrate under manual and automatic reactor control is 294 gpm coinciding with the maximum capacity of three charging pumps when the RCS is at pressure. This is a conservative assumption since only one charging pump is normally in operation. The dilution source is assumed to be initially at atmospheric pressure and 40F.

Startup (Mode 2) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for use in the calculation of the dilution mass flowrate. The initial RCS average temperature, 555.75 F, is the nominal value at 5% of rated thermal power plus 7.5 F which accounts for instrument errors. The initial RCS pressure, 2250 psia, is the nominal plant value.

Here too, a minimum active RCS volume of 9,350 ft3 is assumed.

The volumetric dilution flowrate during startup conditions is conservatively assumed to be 294 gpm; that corresponding to the maximum capacity of the three charging pumps. The dilution source is assumed to be initially at atmospheric pressure and 40F.

Refueling (Mode 6) Assumptions The RCS pressure and average temperature are used to determine the specific volume of the primary coolant for use in the calculation of the dilution mass flowrate. The initial RCS temperature, 140F is the value consistent with the upper limit on temperature in this mode. The initial RCS pressure, 14.7 psia, is the atmospheric pressure condition.

The Mode 6 analysis assumes the RCS is drained to mid-loop and is being cooled via RHR operation with no reactor coolant pumps operating. Under these conditions, the active mixing volume is 3,266 ft3 and includes the reactor vessel volume, without its upper head and drained down to the middle of the Reactor vessel nozzles, a single RHR loop volume, the mid-loop volume of two cold leg from the CVCS connection to the reactor vessel, and the mid-loop volume of one hot leg from the reactor vessel to the RHR connection. This active mixing volume does not include the volume of the pressurizer or its surgeline.

The assumed volumetric dilution flowrate during refueling is 294 gpm corresponding to the maximum capacity of the three charging pumps. The dilution source is assumed to be initially atmospheric pressure and 40F.

In all modes, the secondary side of the plant is not modeled for the inadvertent boron dilution event.

Plant Operating - Conditions The analysis of the potential consequences of the inadvertent boron dilution event includes the following conservative assumptions:

• The analysis is performed for an inadvertent dilution of the RCS for power operation, startup, and refueling modes of plant operation.

• Conservative dilution flowrates have been assumed for each plant operating mode as already discussed. The effective dilution mass flowrate used in the analysis is greater than Chapter 14, Page 25 of 333 Revision 04, 2011

IP3 FSAR UPDATE the nominal volumetric flowrate accounting for the differences in the densities of the primary coolant and the dilution source.

• During power operation (Mode 1), the initial boron concentration is assumed to be 1800 ppm which is a conservative maximum value for the conditions of hot full power, rods at the insertion limits and no xenon. The minimum reactivity change following a reactor trip, results in the maximum critical concentration for the conditions of hot zero power, all rods inserted except the most reactive RCCA, and no xenon. This minimum reactivity change is equivalent to 350 ppm. The critical concentration at hot-zero-power conditions is thus 1450 ppm.

• During Startup (Mode 2), the initial boron concentration is assumed to be 1800 ppm which is a conservative maximum value for the conditions of hot zero power, rods at the insertion limits and no xenon. The minimum reactivity change following a reactor trip, results in the maximum critical concentration for the conditions of hot zero power, all rods inserted except the most-reactive RCCA, and no xenon. This minimum reactivity change is equivalent to 250 ppm. The critical concentration at hot-zero-power conditions is thus 1550 ppm.

• During refueling (Mode 6), the initial boron concentration is assumed to be 2050 ppm which is a conservative minimum value which meets the refueling mode Core Operating Limits Report requirement for a shutdown margin of at least 5% k/k. The critical concentration is assumed to be 1390 ppm which is a conservative maximum predicted value for which the reactor will attain criticality during refueling conditions. The minimum change in boron concentration is thus 660 ppm.

• The dilution source is conservatively assumed to originate at 14.7 psia and 40F

• The alarms alert the plant operator that a dilution is in progress.

• All other plant systems are assumed to be operating within the limits specified by the plant Technical Specifications and the Technical Requirements Manual.

Cases Considered Four cases of the inadvertent boron dilution event are considered. The cases during power operation (Mode 1, manual and automatic rod control), startup (Mode 2), as well as the refueling case (Mode 6) are discussed.

Event Duration Following the initiation of the inadvertent dilution flow into the RCS, the event duration for the current licensing-basis analysis is less than 40 minutes. Within this time frame, the following events have been assumed:

Power Operation (Mode 1)

• Alarm alerting the operator that an unplanned dilution of the RCS is progressing

• Operator takes action to terminate the dilution flow

• Loss of plant shutdown margin (if no operator action is taken)

Chapter 14, Page 26 of 333 Revision 04, 2011

IP3 FSAR UPDATE During power operation with the reactor in automatic rod control, the power and temperature increase from the boron dilution causes the insertion of the control rods and a decrease in the available shutdown margin. The rod insertion limit alarms (LOW and LOW-LOW settings) alert the operator more than 15 minutes prior to losing the required minimum shutdown margin. This is sufficient time for the operator to determine the cause of dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.

With the reactor in manual rod control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach overtemperature T trip setpoint resulting in a reactor trip. The boron dilution transient in this case is essentially the equivalent to an uncontrolled RCCA bank withdrawal at power. The maximum reactivity insertion rate for a boron dilution event is conservatively estimated to be about 2.7 pcm/sec, which is within the range of insertion rates analyzed for the uncontrolled RCCA bank withdrawal at power event.

Thus, the effects of dilution prior to reactor trip are bounded by the uncontrolled RCCA bank withdrawal at power analysis as described in Section 14.1.2. Following reactor trip, there are greater than 15 minutes prior to criticality. This is sufficient time for the operator to determine the cause of the dilution, isolate the reactor water makeup source, and initiate boration before the available shutdown margin is lost.

Startup (Mode 2) and Refueling (Mode 6)

• Initiation of an unplanned dilution of the RCS

• Loss of plant shutdown margin (if no operator action is taken)

Following the termination of the dilution into the RCS, the operator can take action to initiate reboration and recover the lost shutdown margin.

Safety Limits The safety limits which are specifically applicable to the inadvertent boron dilution are fuel clad damage and overpressurization of the RCS. The means by which these limits are met in the licensing-basis boron dilution analysis is to assure that the plant shutdown margin is not lost due to the unplanned dilution.

The Indian Point Unit 3 licensing basis boron dilution analysis required that the operator take action to mitigate the effects of the transient. For the boron dilution analyses during power operation conditions, a 15-minute time interval must be available for operator action between an alarm indicating the unplanned dilution of the RCS and the time of the loss of plant shutdown margin. For boron dilution during startup conditions, a 15-minute time interval must be available for operator action between the time the transient begins until the loss of the plant shutdown margin. For a boron dilution during refueling, a 30-minute time interval must be available for operator action between the time the transient begins until the loss of plant shutdown margin.

These minimum time intervals are the acceptance criterion for an inadvertent dilution during these modes of operation for Indian Point Unit 3.

For power operation, the analyses demonstrate there are greater than 15 minutes from an alarm indicating an unplanned dilution and the loss of plant shutdown margin. For startup and refueling conditions, the analyses demonstrate there are greater than 15 minutes and 30 minutes, respectively, from initiation of the unplanned dilution and the loss of plant shutdown margin.

Chapter 14, Page 27 of 333 Revision 04, 2011

IP3 FSAR UPDATE Conclusions The major hazard associated with the inadvertent boron dilution event is the possible fuel clad damage and RCS overpressurization resulting from the loss of plant shutdown margin.

The available time for operator action following an alarm indicating an unplanned dilution (Mode

1) until loss of plant shutdown margin and the time intervals from the initiation of the inadvertent dilution (Modes 2 and 6) until loss of plant shutdown margin have been calculated for Indian Point Unit 3. In Modes 1 and 2, there are more than 15 minutes available for the operator to take action prior to the loss of plant shutdown margin. In Mode 6, there are more than 30 minutes available for the operator to take action prior to the loss of plant shutdown margin.

For the four cases considered, the results show that the integrity of the core and the RCS is maintained since there are more than 15 minutes in Modes 1 and 2, and more than 30 minutes in Mode 6 for the operator to take action prior to the loss of plant shutdown margin.

14.1.6 Loss of Reactor Coolant Flow Flow Coast-Down Accidents A loss of coolant flow incident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply of these pumps. If the reactor is at power at the time of the incident, the immediate effect of loss of coolant flow is a rapid increase in coolant temperature. This increase could result in departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor is not tripped promptly. The following trip circuits provide the necessary protection against a loss of coolant flow incident:

1) Low Voltage or low frequency on pump power supply buses

2) Pump circuit breaker opening

3) Low reactor coolant flow.

These trip circuits and their redundancy are further described in Section 7.2.

Simultaneous loss of electrical power to all reactor coolant pumps at full power is the most severe credible loss of coolant flow condition. For this condition reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to prevent Reactor Coolant System overpressure and the DNB ratio from getting below the applicable limit.

Method of Analysis The following loss of flow cases were analyzed:

1) Partial Loss of Forced Reactor Coolant Flow

2) Complete Loss of Forced Reactor Coolant Flow

3) Reactor Coolant Pump Shaft Seizure (Locked Rotor)

4) Reactor Coolant Pump Shaft Break (Reverse Flow)

Partial Loss of Forced Reactor Coolant Flow

==

Introduction:==

A partial loss of coolant accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump supplied by a reactor coolant Chapter 14, Page 28 of 333 Revision 04, 2011

IP3 FSAR UPDATE pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase would result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through the individual buses connected to the generator and the offsite power system. When generator trip occurs, the buses continue to be supplied from external power lines, and the pumps continue to supply coolant to the core.

This event is classified as an ANS Condition II fault as defined by ANS-051.1/NI8.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition II occurrence is defined as a fault of moderate frequency, which at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8, low flow in any loop will actuate a reactor trip.

Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

The applicable safety licensing basis acceptance criteria for this Condition II event are:

1. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the designed values,

2. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 limit, and

3. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The loss of one reactor coolant pump with four loops in operation event is analyzed to show that: 1) the integrity of the core is maintained as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limits; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

The loss of one reactor coolant pump event is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (References 40) is then used to calculate the heat flux and DNBR during the transient based on the nuclear power and RCS flow from RETRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

This accident is analyzed with the RTDP as discussed in Reference 28. Initial reactor power, pressurizer pressure and RCS temperature are assumed to be at their nominal values.

A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Chapter 14, Page 29 of 333 Revision 04, 2011

IP3 FSAR UPDATE A conservative trip reactivity of 4% k is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on conservative estimates of system pressure losses.

The analysis is performed to bound operation with a maximum uniform steam generator tube plugging levels of 10%.

Results Figures 14.1-44 through 14.1-49 illustrate the transient response for the loss of one reactor coolant pump with four loops in operation. Figure 14.1-49 shows that the DNBR always remains above the limit value. This demonstrates the ability of the primary coolant to remove heat from the fuel rods is not greatly reduced.

The calculated sequence of events is shown in Table 14.1-5. A reactor trip occurs on a low primary reactor coolant flow trip condition which is assumed to be 87% of nominal flow. The Technical Specification low flow allowable value (low flow trip point is 90) percent of full loop flow; the trip signal was assumed to be initiated at 87 percent of full loop flow allowing 3 percent for flow measurement errors. Following reactor trip, the affected reactor coolant pump will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

Conclusions The analysis performed has demonstrated that for the loss of reactor coolant pump event, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted and all applicable acceptance criteria are met.

Complete Loss of Forced Reactor Coolant Flow A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

Normal power for the reactor coolant pumps is supplied through buses of a transformer connected to the generator and the offsite power system. Each pump is on a separate bus.

When a generator trip occurs the buses continue to be supplied from external power lines and the pumps continue to supply coolant flow to the core.

This event is classified as an ANS Condition III fault as defined by ANS-051.1/NI8.2 - 1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Chapter 14, Page 30 of 333 Revision 04, 2011

IP3 FSAR UPDATE Condition III occurrence is defined as an infrequent fault. In addition, a Condition III event should not propagate to cause a more serious fault, i.e., a Condition IV event.

The following signals provide the necessary protection against a complete loss of flow accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., station blackout. This function is blocked below approximately 10 percent power (Permissive 7).

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid.

The reactor trip on low primary coolant flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive 8, low flow in any loop will actuate a reactor trip. Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops will actuate a reactor trip.

Although this is defined as Condition III even, the event is analyzed to Condition II criteria:

a) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values (i.e., 2750 psia (2735 psig) and 1208.5 psia, respectively),

b) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and c) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The complete loss of flow transient is analyzed for a loss of all four reactor coolant pumps with four loops in operation. The event is analyzed to show that: 1) the integrity of the core is maintained as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limits; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

The transient is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (Reference 40) is then used to calculate the DNBR during the transient based on the nuclear power and RCS flow from RETRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

For the complete loss of flow incident, two cases are considered; reactor trip actuated by redundant bus undervoltage or breaker trip and reactor trip on bus underfrequency (two-out-of-four). For the analysis of the complete loss of flow incident actuated by bus undervoltage or breaker trip, the loss of flow is assumed to occur at the initiation of the event (i.e., transient time

= 0). Hence, with respect to the safety analysis, the undervoltage trip setpoint is irrelevant.

However, for the analysis of the complete loss of flow incident actuated by a bus underfrequency, the reactor is assumed to trip after an underfrequency reactor coolant pump Chapter 14, Page 31 of 333 Revision 04, 2011

IP3 FSAR UPDATE trip at 55 Hz, following a frequency decay of 5 Hz/sec from an initial frequency of 60 Hz. The trip is conservatively modeled to occur at 1.6 seconds, which includes a maximum reactor trip time delay of 0.6 seconds.

This accident is analyzed with the RTDP as discussed in Reference 28. Initial reactor power, pressurizer pressure and RCS temperature are assumed to be at their nominal values.

A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

A conservative trip reactivity of 4% k is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on conservative estimates of system pressure losses.

Results Figures 14.1-50 through 14.1-54 illustrate the transient response for the loss of all four reactor coolant pumps with four loops in operation following a reactor trip on bus undervoltage. Figures 14.1-50A through 14.1-54A illustrate the transient response for the loss of all reactor coolant pumps with four loops in operation following a reactor trip on bus underfrequency. Figures 14.1-54 and 14.1-54A show that the DNBR always remains above the limit value. This demonstrates the ability of the primary coolant to remove heat from the fuel rods is not greatly reduced.

The calculated sequence of events is shown in Table 14.1-6 for the complete loss of flow case in which a reactor trip is assumed on bus undervoltage and Table 14.1-6A for the complete loss of flow case in which a reactor trip is assumed on bus underfrequency. Following reactor trip, the reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

Conclusions The analysis performed has demonstrated that for the complete loss of flow event, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted and all applicable criteria are met.

Reactor Coolant Pump Shaft Seizure (Locked Rotor)

The accident postulated is an instantaneous seizure of a reactor coolant pump rotor. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube Chapter 14, Page 32 of 333 Revision 04, 2011

IP3 FSAR UPDATE side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the spray is not included in the analysis.

This event is classified as an ANS Condition IV fault as defined by ANS-051.1/NI8.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition IV occurrence is defined as a limiting fault. The limits are that the RCS and the core must remain able to provide long term cooling, and offsite dose must remain within the guidelines of 10 CFR 100. The specific (and more restrictive) criteria that Westinghouse uses to ensure that these limits are not violated are as follows:

1. Fuel cladding damage, including melting, due to increased reactor coolant temperatures must be prevented. This is precluded by demonstrating that the maximum clad temperature at the core hot spot remains below 2700°F, and the zirconium-water reaction at the core hot spot is less than 16 weight percent.

2. The peak reactor coolant pressure must remain less than that which would cause stresses to exceed the Faulted Condition stress limits.

3. Rods-in-DNB should be less than or equal to that assumed in the radiological dose analyses for this event.

The necessary protection against an RCP Shaft Seizure accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals.

Method of Analysis and Assumptions The RCP Shaft Seizure transient is analyzed with two computer codes. First, the RETRAN computer code (Reference 39) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE computer code (Reference

40) is then used to calculate the thermal behavior of the fuel located at the core hot spot, as well as DNBR values, based on the nuclear power and RCS flow from RETRAN. The VIPRE computer code includes a film boiling heat transfer coefficient.

The analysis is performed to bound operation with a maximum uniform steam generator tube plugging levels of 10%.

A conservatively large absolute value of the Doppler-only power coefficient is used. This assumption results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Chapter 14, Page 33 of 333 Revision 04, 2011

IP3 FSAR UPDATE A conservative trip reactivity of 4% k is used and is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. A conservative trip reactivity worth versus rod position was modeled in addition to a conservative rod drop time of 2.7 seconds.

Two cases are evaluated in the analysis. Both assumed one RCP shaft seizure with all four loops in operation.

The first case is analyzed to evaluate the RCS pressure and fuel clad temperature transient conditions. For this case, the plant is assumed to be in operation under the most adverse steady state operation conditions, i.e., the maximum guaranteed steady state thermal power, maximum steady state pressurizer pressure and level, and maximum steady state coolant average temperature. This assumption results in a conservative calculation of fuel clad temperature transient conditions and of the coolant insurge into the pressurizer, which in turn results in a maximum calculated peak RCS pressure.

For peak RCS pressure evaluation, the initial pressure is conservatively estimated as 60 psi above the nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. The RCS pressure response is shown in Figure 14.1-56 at the point in the reactor coolant system having the maximum pressure.

For this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the consequences with respect to the fuel rod thermal transients is performed. Results obtained from the analysis of this hot spot condition represent the upper limit with respect to clad temperature and zirconium water reaction. In the evaluation, the rod power at the hot spot is assumed to be at least 2.5 times the average rod power (i.e., FQ = 2.5) at the initial core power level.

Film Boiling Coefficient The film boiling coefficient is calculated in the VIPRE code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperature. The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are based on the RETRAN results.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between the pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-F at the initiation of the transient. Thus, the large amount of energy stored in the fuel because of the small initial value of the gap coefficient is released to the clad at the initiation of the transient.

Zirconium Steam Reaction Chapter 14, Page 34 of 333 Revision 04, 2011

IP3 FSAR UPDATE The zirconium-steam reaction can become significant above 1800F (clad temperature). The Baker-Just parabolic rate equation is used to define the rate of zirconium-steam reaction. The effect of the zirconium-steam reaction is included in the calculation of the hot spot clad temperature transient.

The second case is an evaluation of DNB in the core during the transient. This case is analyzed using the RTDP (Reference 28). Initial reactor power and pressurizer pressure are assumed to be at their nominal values for steady state, full power operation. Reactor coolant temperature is assumed to be at the nominal value for the high Tavg program. Uncertainties in initial conditions are included in the DNBR limit as described in the RTDP (Reference 28).

Results Figures 14.1-55 through 14.1-59 illustrate the transient response for the RCP Shaft Seizure event analyzed to evaluate the RCS pressure and fuel clad temperature. The peak reactor coolant system pressure is 2541 psia and is less than that which would cause stresses to exceed the faulted condition stress limits. Also, the peak clad average temperature 1792F which is considerably less than the limit of 2700F. The maximum zirconium-steam reaction at the hot spot is 0.3% by weight.

The sequence of events for the case analyzed to evaluate the RCS pressure and fuel clad temperature is given in Table 14.1-7. A reactor trip occurs on a low primary reactor coolant flow trip setpoint which is assumed to be 87% of nominal flow.

For the case analyzed for DNB using the RTDP, the applicable DNB criterion is met. Hence, no rods-in-DNB are predicted for the RCP shaft seizure event.

Environmental Consequences of a Locked Rotor The analysis of the locked rotor radiological consequences assumed an iodine concentration of 0.1 µCi/gm of DE I-131 in the primary coolant prior to the accident.

The noble gas and alkali metal activity concentration in the primary coolant when the postulated accident occurs is based on a fuel defect level of 1%. The iodine activity concentration of the secondary coolant when the locked rotor occurs is assumed to be 0.1 µCi/gm of DE I-131. The alkali metal activity concentration of the secondary coolant at the time the locked rotor occurs is assumed to be 10% of the primary side concentration.

The transient analysis shows that no rods in the DNB are calculated for the locked rotor event.

However, it was conservatively assumed that 5% of the fuel rods in the core suffered damage sufficient that all of their gap activity was released to the RCS. Eight percent of the total I-131 core activity, 10% of the total Kr-85 core activity, 5% of the total core activity for other noble gases and other iodines, and 12% of the total core activity for alkali metals were assumed to be in the fuel cladding gap and released into the primary coolant. In the calculation of the activity releases from the failed fuel, the maximum radial peaking factor of 1.7 was applied.

Activity is released to the environment by way of primary-to-secondary leakage and steaming from the secondary side to the environment. The primary-to-secondary steam generator tube leakage rate was assumed to be at the Technical Specification limit of 1440 gallons per day.

Chapter 14, Page 35 of 333 Revision 04, 2011

IP3 FSAR UPDATE The RHRS was assumed to remove all decay heat 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> into the accident, with no futher releases to the environment after that time.

An iodine partition factor in the steam generators of 0.01 (Ci iodine / gm steam) / (Ci iodine / gm water) was used. Prior to reactor trip and concurrent loss-of-offsite-power (LOOP), an iodine removal factor of 0.01 could have been taken for steam released to the condenser, but this was conservatively ignored.

The release of non-volatile activity from the steam generators is limited by Moisture Carryover (MCO). The bounding value for MCO is 0.10%, therefore, an alkali metal partition factor in the steam generators of 0.001 (Ci alkali metal / gm steam) / (Ci alkali metal / gm water) was used.

All noble gas activity carried over to the secondary side through steam generator tube leakage was assumed to be immediately released to the outside atmosphere.

It was assumed that the control room HVAC System begins in normal operation mode, and as activity builds up in the control room, a high radiation signal is generated. It was conservatively assumed that there is a 20 minute operator action time to switch the control room HVAC to the emergency mode of operation after the high radiation signal. For this analysis, this was modeled at 32 minutes.

The locked rotor 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> site boundary dose is 1.1 rem TEDE with the worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose being 27 - 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />. The 30 day low population zone dose is 1.4 rem TEDE. These doses are less than the 2.5 rem TEDE which is the dose acceptance limit defined in the Regluatory Guide 1.183. The calculated control room dose is 2.5 rem TEDE which is less that the 5.0 rem TEDE control room dose limit of 10 CFR 50.67.

Conclusions All safety criteria (peak RCS pressure less than that which would cause stresses to exceed the faulted condition stress limits, clad average temperature < 2700F, and Zirc-H2O reaction <

16%) are satisfied for all cases. This demonstrates that the RCS and the core will remain able to provide long term cooling, and off-site doses remain within the guidelines of 10 CFR 50.67 and RG 6.1.183 in the case of an RCP Shaft Seizure event.

Reactor Coolant Pump Shaft Break The accident is postulated as an instantaneous failure of reactor coolant pump shaft. RCS flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor seizure event. With a failed shaft the pump impeller could conceivably be free to spin in the reverse direction instead of being fixed in position. The effect of such reverse spinning is a slight decrease in the final (steady-state) core flow.

The analysis presented under the RCP Shaft Seizure section represents the limiting condition, assuming a locked rotor for forward flow but a free-spinning shaft for reverse flow in the affected loop. Therefore, the conclusions for the RCP Shaft Seizure apply to and bound a reactor coolant pump shaft break accident.

14.1.7 Startup of Inactive Reactor Coolant Loop Chapter 14, Page 36 of 333 Revision 04, 2011

IP3 FSAR UPDATE The Technical Specifications require that all 4 reactor coolant pumps be operating for operation in Modes 1 and 2. This event was originally included in the FSAR licensing basis when operation with a loop out of service was considered. Based on the current Technical Specifications which prohibit at power operation with an inactive loop, this event has been deleted from the updated FSAR.

14.1.8 Loss of External Electrical Load The loss of external electrical load and/or turbine trip event is defined as a complete loss of steam load or a turbine trip from full power without a direct reactor trip. This event is analyzed as a turbine trip from full power as this bounds both events: the loss of external electrical load and turbine trip. The turbine trip event is more severe than the total loss of external load event since it results in a more rapid reduction in steam flow.

For a turbine trip, the reactor would be tripped directly (unless below the power Permissive 8 setpoint) from a signal derived from the turbine autostop oil pressure and turbine stop valves.

The automatic steam dump system accommodates the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere. Additionally, main feedwater flow would be lost if the turbine condenser were not available. For this situation, steam generator level would be maintained by the auxiliary feedwater system.

The unit was designed to accept a 50% step loss of load without actuating a reactor trip. The automatic steam dump system, with 40% steam dump capacity to the condenser, was designed to accommodate this load rejection by reducing the severity of the transient imposed upon the RCS. The reactor power is reduced to the new equilibrium power level at a rate consistent with the capability of the Rod Control System. The pressurizer relief valves may be actuated, but the pressurizer safety valves and the steam generator safety valves do not lift for the 50% step loss of load with steam dump.

In the event the steam dump valves fail to open following a large loss of load or in the event of a complete loss of load with steam dump operating, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, the OTT signal, the OPT signal, or the low-low steam generator water level signal. The steam generator shell-side pressure and reactor coolant temperatures will increase rapidly. However, the pressurizer safety valves and steam generator safety valves are sized to protect the RCS and steam generator against overpressurization for all load losses without assuming the operation of the steam dump system. The steam dump valves will not be opened for load reductions of 10% or less. For larger load reductions they may open. The RCS and main steam supply relieving capacities were designed to ensure safety of the unit without requiring the automatic rod control, pressurizer pressure control and/or steam bypass control systems.

The Loss of Load/Turbine Trip event is classified as a Condition II fault as defined by the American Nuclear Society, Nuclear Safety Criteria for the Design of Stationary PWR Plants. A Condition II fault will at worst result in a reactor shutdown with the plant capable of returning to operation.

The Safety Analysis Criteria are as follows:

Chapter 14, Page 37 of 333 Revision 04, 2011

IP3 FSAR UPDATE

1) The pressure in the reactor coolant system and the steam generators should be maintained below 110% of their design pressures (i.e., 2750.0 psia (2735 psig) and 1208.5 psia, respectively).

2) The critical heat flux and the fuel temperature clad strain limits should not be exceeded.

The peak linear heat generation rate (expressed in kw/ft) should not exceed a value which would cause fuel centerline melting. This is ensured by demonstrating that the minimum DNB ratio does not go below the limit value at any time during the transient.

Meeting the DNBR limit also ensures that offsite dose requirements of 10 CFR 20 are met.

3) An incident of moderate frequency (Condition II) should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The loss of load accident is analyzed for the following reasons: 1) to confirm that the pressurizer and steam generator safety valves are adequately sized to prevent overpressurization of the RCS and steam generators, respectively; 2) to form the basis of the required ASME overpressure protection report; and 3) to ensure that the increase in RCS temperature does not result in DNB in the core. The Reactor Protection System is designed to automatically terminate any such transient before the DNBR falls below the limit value.

The total loss of load transients are analyzed with the RETRAN computer program (Reference 39). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator relief and safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from full power without a direct reactor trip. The turbine is assumed to trip without actuating all the turbine stop valve limit switches. This assumption delays reactor trip until conditions in the RCS result in a trip on some other signal. Thus, the analysis assumes a worst case transient and demonstrates the adequacy of the pressure relieving devices and core protection margins.

Major assumptions are summarized below:

1) Initial Operating Conditions: For the DNB case, the initial reactor power, RCS pressure, and RCS temperatures are assumed at their nominal values consistent with steady state full power operation and the RTDP methodology. For the peak RCS pressure case, the uncertainties are applied for power, RCS pressure, and RCS temperature, and Thermal Design Flow (TDF) is assumed.

2) Moderator and Doppler Coefficients of Reactivity: The turbine trip is analyzed with minimum reactivity feedback. The minimum feedback (BOL) cases assume a minimum absolute value of the moderator temperature coefficient and the least negative Doppler coefficient.

3) Reactor Control: From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.

Chapter 14, Page 38 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4) Steam Release: No credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the safety valve setpoint where steam release through safety valves limits the secondary steam pressure at the setpoint value. Through maximizing the pressure transient in the main steam system, the saturation temperature in the steam generators is maximized resulting in limiting pressure and temperature conditions in the RCS.

5) Pressurizer Spray and Power-operated Relief Valves: Two cases with BOL reactivity feedback conditions are analyzed:

a) For the DNB case, full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

b) For the peak RCS pressure case, no credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure.

6) Feedwater Flow: Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition (pressurizer pressure has begun to decrease) will be reached before auxiliary feedwater initiation is normally assumed to occur.

However, the motor driven auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps. The auxiliary feedwater flow would remove core heat following plant stabilization.

7) Offsite AC Power: Loss of offsite power is not postulated to occur coincident with the loss of load incident since the resulting DNBR and pressure transients are limiting when offsite power is available.

8) Pressurizer Safety Valves: For the DNB case, a minimum PSV opening pressure

(-4% tolerance) was assumed. For the peak RCS pressure case, a maximum PSV opening pressure(+4% tolerance) was assumed.

Reactor trip is actuated whenever the first reactor protection system trip setpoint is reached with no credit taken for the direct reactor trip on the turbine trip. The OTT reactor trip and high pressurizer pressure reactor trip (2470 psia safety analysis setpoint) are actuated in the analysis.

Results The transients for a total loss of load from full power operation are shown on Figures 14.1-62 through 14.1-77 for two cases; one case with pressure control and one case without pressure control.

Previously four cases were analyzed: two cases with BOL reactivity feedback conditions, and two cases with EOL reactivity feedback conditions. Since the Loss of Load / Turbine Trip event results in a primary system heatup, the analysis conservatively assumes minimum reactivity feedback conditions with and without pressurizer pressure control, which bounds the event with EOL reactivity feedback conditions.

Chapter 14, Page 39 of 333 Revision 04, 2011

IP3 FSAR UPDATE Figures 14.1-62 through 14.1-69 show the transient responses for the total loss of steam load at BOL (minimum feedback reactivity coefficients) assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. Following event initiation, the pressurizer pressure and average RCS temperature increase due to the rapidly reduced steam flow and heat removal capacity of the secondary-side. The peak pressurizer pressure and water volume and RCS average temperature are reached shortly after the reactor is tripped by the OTT trip function. The DNB ratio decreases initially and then rapidly increases following reactor trip. The minimum DNBR remains well above the safety analysis limit value of 1.45. The pressurizer relief and safety valves are actuated for this case and maintain primary system pressure below 110 percent of the design value. The steam generator safety relief valves open and limit the secondary side steam pressure increase.

The total loss of load event was also analyzed assuming the plant to be initially operating at full power with no credit taken for the pressurizer spray or pressurizer power-operated relief valves.

Figures 14.1-70 through 14.1-77 show the BOL transients without pressure control. The nuclear power remains relatively constant (prior to reactor trip) while pressurizer pressure, pressurizer water volume and RCS average temperature increase. The reactor is tripped on the high pressurizer pressure signal.

Table 14.1-8 summarizes the sequence of events for the two cases considered for the total loss of load transient. The applicable safety analysis limits are:

1) Safety Analysis DNBR limit 1.45

2) Peak RCS Pressure (110% of design pressure) 2750.0 psia

3) Peak Secondary Pressure (110% of SG design pressure) 1208.5 psia The analysis demonstrates that the maximum pressures and minimum DNBR are within the safety analysis limits presented above.

Conclusions The results of the analyses show that the plant design is such that a total loss of external electrical load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure-relieving devices incorporated in the plants design are adequate to limit the maximum pressures to within the design limits.

The integrity of the core is maintained by operation of the reactor protection system; i.e., the DNBR is maintained above the safety analysis limit value. Thus, no core safety limit will be violated.

14.1.9 Loss of Normal Feedwater Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunction, or loss of offsite ac power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS and possible core damage. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

Chapter 14, Page 40 of 333 Revision 04, 2011

IP3 FSAR UPDATE The following events occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

1) As the steam system pressure rises following the trip, the steam generator power-operated relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

2) As the no-load temperature is approached the steam generator power-operated relief valves (or safety valves if power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

A loss of normal feedwater is classified as an ANS Condition II event, a fault of moderate frequency. Condition II events include incidents of which any one may occur during a calendar year for a particular plant.

Following the occurrence of a loss of normal feedwater, the reactor may be tripped by any of the following reactor protection system trip signals:

• Low-low steam generator water level

• Overtemperature T

• High pressurizer pressure

• High pressurizer water level

• RCP undervoltage Auxiliary feedwater (AFW) is supplied by actuation of two motor-driven AFW pumps initiated by any of the following signals:

• Low-low water level in any steam generators

• Any safety injection signal

• Loss of offsite power

• Automatic trip (not manual) of any main feedwater pump

• Manual actuation In addition, a turbine-driven AFW pump starts automatically on the following actuation signals although no automatic delivery of water to the steam generators occurs.

• Low-low level in any two steam generators

• Loss of offsite power

• Manual action The auxiliary feedwater system is started automatically. Motor-driven auxiliary feedwater pumps are powered by the emergency diesel generators. The turbine-driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The pumps take suction directly from the condensate storage tank for delivery to the steam generators. Both types of pumps are designed to supply the minimum required flow. However, the motor driven pumps are assumed to supply flow within 60 seconds of initiating signal. Steam Generator Blowdown isolation is assumed starting from event initiation (Reference 36).

Chapter 14, Page 41 of 333 Revision 04, 2011

IP3 FSAR UPDATE An analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat plus reactor coolant pump waste heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition.

Method of Analysis A detailed analysis using the RETRAN computer code (Reference 39) is performed to determine the plant transient following a loss of normal feedwater. The code simulates the core neutron kinetics, reactor coolant system, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables including pressurizer pressure, pressurizer water level, steam generator mass, and reactor coolant average temperature.

Assumptions made in the analysis are:

1) The plant is initially operating at 102 percent of the rated thermal power (3230 MWt)

2) The core decay heat generation is based on the 1979 version of the ANSI 5.1, +2 sigma uncertainty. This is a conservative representation of the decay energy release rates based on long term operation at the initial power level preceding the reactor trip.

3) An initial steam generator water level uncertainty of +10% narrow range span (NRS) and a reactor trip setpoint low-low steam generator water level of 0% NRS is assumed.

4) The worst single failure in the auxiliary feedwater system occurs, i.e., failure of one of the motor-driven auxiliary feedwater pumps. A total flow of 343 gpm from one pump is assumed to be delivered [Deleted] to two steam generators 60 seconds after reaching the low-low steam generator level setpoint. The capacity of one motor-driven auxiliary feedwater pump is such that the rate of decrease of the water level in the steam generators being fed AFW flow is sufficiently slowed to provide time for an operator action to align the turbine-driven train and prevent water relief from the pressurizer relief or safety valves. The turbine-driven AFW pump, although automatically actuated, requires manual operation to deliver flow and is therefore not assumed available until 10 minutes after reactor trip. An additional 343 gpm of auxiliary feedwater flow is assumed after operator action, to the two other steam generators. Upon automatic start of a motor driven AFW pump, the flow distribution may be asymmetrical in the individual branch lines to the associated steam generators. Sensitivity analyses have demonstrated that branch line asymmetry of up to 150 gpm under limiting accident conditions is acceptable.

5) The pressurizer sprays, heaters, and power-operated relief valves are assumed to be operable, resulting in the maximum transient pressurizer water volume. If these control systems did not operate, the pressurizer safety valves would maintain peak RCS pressure at or below the actuation setpoint (2500 psia) throughout the transient.

6) Secondary system steam relief is achieved through the steam generator safety valves.

No credit is taken for the operation of steam dumps or power-operated relief valves.

Chapter 14, Page 42 of 333 Revision 04, 2011

IP3 FSAR UPDATE

7) The analysis considers initial hot full power reactor vessel average coolant temperatures at the upper and lower ends of the uprated operating range with uncertainty applied in both the positive and negative direction. The vessel average temperature assumed at the upper end of the range is 572°F with an uncertainty of +/-7.5°F. The average temperature assumed at the low end of the range is 549°F with an uncertainty of +/-7.5°F.

Results for the limiting case are presented.

8) Initial pressurizer pressure is assumed to be 2250 psi with an uncertainty of +/-60 psi.

Cases are considered with the pressure uncertainty applied in both the positive and negative direction to conservatively bound potential operating conditions. Results for the limiting case are presented.

9) Initial pressurizer level is at the nominal programmed level plus 8.5% span.

10) Analysis with both minimum (0%) and maximum (10%) steam generator tube plugging was performed to conservatively bound potential operating conditions.

11) The enthalpy of the auxiliary feedwater is assumed to be 90.77 Btu/lbm corresponding to a condensate storage tank temperature of 120°F.

12) An auxiliary feedwater line purge volume of 268.8 ft3 is assumed.

The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards system (i.e., the auxiliary feedwater system). The analysis demonstrates the capability of the AFW system to remove long term decay heat, thus preventing RCS overpressurization or loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

For the loss of normal feedwater transient, the reactor coolant volumetric flow remains at its normal value and the reactor trips via the low-low steam generator level trip. The reactor coolant pumps may be manually tripped at some later time to reduce heat addition to the RCS.

Normal reactor control systems are not required to function in this analysis. The reactor protection system is required to function following a loss of normal feedwater as analyzed herein. The auxiliary feedwater system is required to deliver a minimum auxiliary feedwater flow rate and no single active failure will prevent operation of any system required to function.

Results Figures 14.1-90 through 14.1-94 are the significant plant parameters following a loss of normal feedwater and show that the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation.

Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. 60 seconds following the initiation of the low-low level trip, at least one auxiliary feedwater pump is automatically started, reducing the rate of decrease in steam generator water level.

Chapter 14, Page 43 of 333 Revision 04, 2011

IP3 FSAR UPDATE The capacity of one motor-driven auxiliary feedwater pump is such that the rate of decrease of the water level in the steam generators being fed AFW flow is sufficiently slowed to provide time for an operator to align the turbine-driven train and prevent water relief from the RCS relief or safety valves.

The calculated sequence of events for this accident is provided in Table 14.1-9. Figure 14.1-90 shows the pressurizer water volume transient. As shown in Figure 14.1-92, RCS subcooling is maintained since the RCS never reaches saturated conditions. Plant procedures may be followed to further stabilize and cool down the plant.

Sensitivity analyses have demonstrated that all safety criteria for this event are also met with an AFW branch line flow delivery asymmetry of up to 150 gpm.

Conclusions Results of the analysis show that, for a loss of normal feedwater event, all safety criteria are met. The auxiliary feedwater capacity is sufficient to prevent pressurizer filling and any subsequent water relief through the pressurizer safety and relief valves. This assures that the RCS is not overpressurzied.

14.1.10 Excessive Heat Removal Due to Feedwater System Malfunctions Excessive feedwater additions are postulated to occur from a malfunction of the feedwater control system or an operator error which results in the opening of a feedwater control valve.

With the reactor at power, this excess feedwater flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant no-load conditions, the addition of cold feedwater causes a decrease in RCS temperature and a consequential positive reactivity insertion due to the effects of the negative moderator coefficient of reactivity.

Continuous excessive feedwater addition is terminated by the automatic feedwater isolation actuated upon receipt of a steam generator high-high water level signal. The steam generator high-high water level signal also results in a turbine trip and a subsequent reactor trip signal on turbine trip. The full power condition is limiting.

Excessive feedwater addition at power results in a core power increase above full power. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower and overtemperature protection (OPT, and OTT trips) and high neutron flux trip prevent any power increase that could lead to a DNBR less than the applicable DNBR limit.

The Excessive Heat Removal due to Feedwater System Malfunction event is a Condition II event as defined by ANS-051.1/NI8.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

The applicable safety analysis licensing basis acceptance criteria for the Condition II Excessive Heat Removal due to Feedwater System Malfunction event for Indian Point Unit 3 are:

1) Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values, (2750 psia and 1208.5 psia, respectively)

Chapter 14, Page 44 of 333 Revision 04, 2011

IP3 FSAR UPDATE

2) Fuel Cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and,

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The feedwater system malfunction transient is analyzed using the RETRAN computer code (Reference 39) to determine the effects of the excessive heat removal on the reactivity insertion rate, RCS pressure, secondary-side pressure, and DNBR, for the primary purpose of assuring the required protection system features are adequate to prevent the applicable safety analysis limits from being exceeded.

The analysis is performed to bound operation with steam generator tube plugging level up to a maximum uniform steam generator tube plugging level of 10% and considers the following three cases of excessive feedwater addition:

1) Accidental opening of one feedwater control valve from full power initial conditions with the reactor in automatic rod control.

2) Accidental opening of one feedwater control valve from full power initial conditions with the reactor in manual rod control.

3) Accidental opening of one feedwater control valve with the reactor just critical at zero load conditions with the reactor in manual rod control.

In all three cases, one feedwater valve is assumed to accidentally open fully resulting in the excessive feedwater flow to one steam generator. For the cases analyzed at full power initial conditions, the valve opening is assumed to result in a step increase in feedwater flow to 143%

of nominal feedwater flow to one steam generator. For the feedwater control valve failure at zero load conditions, a feedwater valve malfunction is assumed to occur that results in a step increase in flow to one steam generator from zero to 210% of the nominal full load feedwater flow rate for one steam generator.

The analysis assumptions are conservatively selected to bound conditions for 10% uniform steam generator tube plugging levels.

Other pertinent analysis assumptions that affect the transient conditions following the postulated feedwater system malfunction are as follows:

Initial Conditions Initial conditions consistent with the implementation of the RTDP (Reference 28) are used in analysis. These include the use of the following nominal conditions:

Initial Condition HFP HZP Core Power (Mwt) 3216 32.16 NSSS Power (Mwt) 3230 46.16 Pressurizer Pressure (psia) 2250 2250 Reactor Vessel Inlet Temperature (F) 542.4 547.0 Chapter 14, Page 45 of 333 Revision 04, 2011

IP3 FSAR UPDATE Reactor Vessel Average Temperature (F)* 572.0 547.0 Reactor Vessel Flow (gpm) 364700 354400 Core Bypass Flow (fraction) 0.068 0.075 Other non-RTDP related initial conditions are:

Initial Condition HFP HZP Pressurizer Level (% NRS) 50.8 23.1 Pressurizer Water Volume (ft3) 913.33 451.44 Steam Generator Level (% NRS) 35.0 45.0 Steam Generator Mass (Ibm) 60732.2 127828.0 Upper Head Temperature (F) 542.37 546.5 Feedwater Enthalpy (Btu/Ibm) 412.22 412.10 Control Systems For the cases analyzed assuming automatic rod control, the rod control system is modeled to maintain the program Tavg which is assumed to vary linearly between 547F at no-load conditions to 572F at full power. Since the event is primarily analyzed for DNB (e.g., cooldown events are not limiting with respect to overpressure concerns) using RTDP, no temperature error is assumed on the rod control system. However, the temperature error is statistically considered in establishing the safety analysis DNBR limit.

No other control systems are assumed to operate for the purpose of mitigating the consequences of this event.

Protection Systems For the feedwater system malfunction accident at full power, the feedwater flow resulting from a fully open control valve is terminated by the steam generator high-high water level signal that closes all feedwater control valves and trips the main feedwater pumps. The steam generator high-high water level signal also produces a signal to trip the turbine. In the RETRAN analysis, the high-high water level setpoint condition is modeled to occur when the steam generator high-high water level trip setpoint of 85% NRS, including uncertainties, is reached.

A turbine trip is modeled to occur 5 seconds after the steam generator water level reaches the high-high steam generator water level condition. If a reactor trip has not yet occurred from either a high neutron flux reactor trip signal or an OPT reactor trip signal, a reactor trip will occur 4 seconds after the turbine trip (a total of 9 seconds after the high-high steam generator water level setpoint is reached). Should the turbine trip not result in a reactor trip signal, reactor trip would eventually occur on another reactor trip signal (e.g., high neutron flux, low-low steam generator level).

Chapter 14, Page 46 of 333 Revision 04, 2011

IP3 FSAR UPDATE To determine the maximum reactivity insertion rate that occurs following the feedwater control valve failure, the reactor is assumed to be just critical at zero load initial conditions; and feedwater isolation and turbine trip are modeled upon reaching a high-high steam generator water level turbine trip setpoint in the zero power case. Reactor trip on turbine trip is not modeled in the zero power case.

Reactivity Modeling The feedwater system malfunction accident results in a cooldown of the primary system due to the excessive feedwater flow. Therefore, reactivity feedback characteristic of end-of-life conditions are assumed in the analysis. In addition, the analysis conservatively assumes no decay heat and radial weighting to the core quadrant with the steam generator receiving the excess feedwater.

For the full power cases, a total scram reactivity of -4% K excluding the highest worth rod is conservatively assumed with a scram time of 2.7 seconds from beginning of rod motion until the dashpot is reached. For the zero power case, a conservative shutdown margin of 1.3% K excluding the highest worth rod is conservatively assumed.

Heat Transfer Modeling Fuel-to-coolant heat transfer coefficients conservatively representing minimum fuel temperature conditions are assumed in the analysis.

No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown and no credit is taken for the heat capacity of the steam and water in the unaffected steam generators. The primary-to-secondary heat transfer corresponding to no steam generator tube plugging is conservatively assumed to maximize the heat cooldown associated with this event.

Results Zero Power Cases:

In the cases of an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, the resulting transient is similar to but less severe than the results of the Hypothetical Steamline Break transient documented in Section 14.2.5. Because the excessive feedwater flow case with the reactor at zero power is bounded by the Steamline Break accident in Section 14.2.5, no transient results are provided in this section. It should be noted that if the incident occurs with the reactor just critical at no-load, the reactor may be tripped by the power range neutron flux trip (low setting).

Full Power Cases:

For the case initiated from full power conditions assuming automatic rod control and uniform steam generator tube plugging, the Nuclear Power, Reactor Vessel Average Temperature, Affected Loop T, Pressurizer Pressure, Steam Generator Pressure, Steam Generator Mass, and DNBR transient results are illustrated in Figure 14.1-95 through Figure 14.1-101, respectively. Figures 14.1-102 through Figure 14.1-108 show the equivalent transient conditions Chapter 14, Page 47 of 333 Revision 04, 2011

IP3 FSAR UPDATE for this case with manual rod control. With respect to minimum DNBR, the most limiting full power case is that assuming manual rod control.

For all the full power cases, the steam generator water level rises until the feedwater addition is terminated at 12 seconds after the high-high steam generator water level setpoint (85% narrow range span, including uncertainties) is reached. A turbine trip occurs 5 seconds after reaching the high-high steam generator water level setpoint and a subsequent reactor trip on turbine trip occurs such that rod motion begins 4 seconds after turbine trip. The calculated sequence of events for all the cases analyzed are provided in Table 14.1-10.

In all cases, the minimum DNBR remains above the applicable safety analysis DNBR limit and the primary and secondary-side maximum pressures are less than 110% of the design values.

Conclusions At initial no-load conditions, the resulting transient is similar to but less severe than the Hypothetical Steamline Break transient. Therefore, the results and conclusions of the Steamline Break accident in Section 14.2.5 bound those for the Excessive Heat Removal Due to a Feedwater System Malfunction at no-load conditions.

For the cases of the excessive feedwater addition initiated from full power conditions with and without automatic rod control, the results show that all applicable Condition II acceptance criteria are met for this event.

14.1.11 Excessive Load Increase Incident An excessive load increase event is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10% step-load increase or a 5% per minute ramp load increase in the range of 15 to 100% of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system.

This event could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided that blocks the opening of the valves unless a large turbine load decrease or turbine trip has occurred.

The possible consequence of this event (assuming no protective functions) is departure from nucleate boiling (DNB) with subsequent fuel damage. Note that the event, as presently analyzed, is characterized by an approach to protection setpoints without actually reaching the setpoints.

The excessive load increase is classified as a Condition II fault as defined by ANS-051.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants. A Condition II event is defined as a fault of moderate frequency, which, at worst, should result in a reactor shutdown with the plant being capable of returning to operation. In addition, a Condition II event should not propagate to cause a more serious fault, i.e., a Condition III or IV category event.

Chapter 14, Page 48 of 333 Revision 04, 2011

IP3 FSAR UPDATE The applicable safety analysis licensing basis acceptance criteria for the Condition II Excessive Load Increase event for Indian Point Unit 3 are:

1) Pressures in the reactor coolant and main steam systems should be maintained below 110% of the design values,

2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit, and

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Method of Analysis and Assumptions The excessive load increase event is analyzed to show that: 1) the integrity of the core is maintained without actuation of the reactor protection system as the DNBR remains above the safety analysis limit value; 2) the peak RCS and secondary system pressures remain below 110% of the design limit; and 3) the pressurizer does not fill. Of these, the primary concern is DNB and assuring that the DNBR limit is met.

Historically, the excessive load increase transients were analyzed with the LOFTRAN computer program (Reference 13). The program simulates the neutron kinetics, RCS, Pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator relief and safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Four cases were analyzed to demonstrate the plant behavior following a 10% step load increase from rated load. These cases are as follows:

1) Reactor control in manual with beginning-of-life minimum moderator reactivity feedback.

2) Reactor control in manual with end-of-life maximum moderator reactivity feedback.

3) Reactor control in automatic with beginning-of-life minimum moderator reactivity feedback.

4) Reactor control in automatic with end-of-life maximum moderator reactivity feedback.

For the beginning-of-life minimum moderator feedback cases, the core has the least negative moderator temperature coefficient of reactivity and the least negative Doppler only power coefficient curve; therefore the least inherent transient response. For the end-of-life maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value and the most negative Doppler only power coefficient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

A conservative limit on the turbine valve opening (equivalent to 120% turbine load) was assumed, and all cases were analyzed without credit being taken for pressurizer heaters.

This accident was analyzed with the RTDP as discussed in Reference 28. Initial reactor power, RCS pressure and temperature were assumed to be at their nominal values.

Normal reactor control systems and engineered safety systems were not required to function for this event. The reactor protection system was assumed to be operable; however, reactor trip Chapter 14, Page 49 of 333 Revision 04, 2011

IP3 FSAR UPDATE was not encountered in the analysis. No single active failure would prevent the reactor protection system from performing its intended function.

Automatic rod control was modeled in the analysis to ensure that the worst case was presented.

The automatic rod control system was not required or modeled to provide reactor protection.

Given the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an explicit analysis was not performed as part of the Stretch Power Uprate Program. Instead, a detailed evaluation of this event was performed. The evaluation model consists of the generation of statepoints based on generic conservative data. The statepoints are then compared to the core thermal limits to ensure that the DNBR limit is not violated. The cases evaluated are:

• Reactor in manual rod control with BOL (minimum moderator) reactivity feedback

• Reactor in manual rod control with EOL (maximum moderator) reactivity feedback

• Reactor in automatic rod control with BOL (minimum moderator) reactivity feedback

• Reactor in automatic rod control with EOL (maximum moderator) reactivity feedback Results and Conclusions An evaluation of this event was performed to support the Stretch Power Uprate Program. The evaluation determined that the DNB design basis for a 10% step load increase continues to be met.

14.1.12 Loss of All AC Power to the Station Auxiliaries A complete loss of non-emergency AC power may result in the loss of all power to the plant auxiliaries: i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accomplished by a turbine generator trip at the station, or by a loss of the onsite non-emergency AC distribution system.

The first few seconds of the transient would be almost identical to the four pump loss of flow case presented in Section 14.1.6, that is, the pump coast down inertial and reactor trip would result in a DNBR the applicable limit. After the trip, decay heat will be accommodated by the Auxiliary Feedwater System. This portion of the transient would be similar to that presented in Section 14.1.9 for the Loss of Normal Feedwater event. The events following such a condition are described in the sequence listed below.

1) Plant vital instruments are supplied by the emergency power sources

2) As the steam system pressure rises following the trip, the steam system power relief valves are automatically opened to the atmosphere. (Steam dump to the condenser is assumed not to be available)

3) If the steam flow rate through the power relief valves is not sufficient or, if the power relief valves are not available, the steam generator self-actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual heat produced in the reactor.

Chapter 14, Page 50 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4) As the no-load temperature is approached, the steam power relief valves (or the self-actuated safety valves, if the power relief valves are not available) are used to dissipate the residual heat and to maintain the plant at the hot shutdown condition

5) The emergency diesel generators will start on loss of voltage on 480 volt buses No. 5A and 6A to supply plant vital loads.

The Auxiliary Feedwater System starts automatically as discussed in Section 14.1.9. The steam driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor driven auxiliary feedwater pumps are supplied by power from the diesel generators. The pumps take suction directly from the condensate storage tank for delivery to the steam generators. The Auxiliary Feedwater System insures feedwater supply upon loss of power to the station auxiliaries. The turbine driven pump system (rated at 800 gpm) is sufficient to deliver 200 gpm of unheated condensate from the condensate storage tank to each of the four steam generators. The motor driven pump system (2 pumps rated at 400 gpm each) delivers 200 gpm of unheated condensate to each of the four steam generators with each pump supplying feedwater to two steam generators.

Upon loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops. The natural circulation flow was calculated by a digital code for the conditions of equilibrium flow and maximum loop flow impedance. The model used has given results within 15% of the measured flow values obtained during natural circulation tests conducted at the Yankee-Rowe plant and has also been confirmed at San Onofre and Connecticut Yankee. The natural circulation flow ratio as a function of reactor power is illustrated in Table 14.1-15.

Method of Analysis A detailed analysis using the RETRAN computer code (Reference 39) is performed to determine the plant transient following a loss of AC power to the station auxiliaries. The code simulates the core neutron kinetics, reactor coolant system including natural circulation, pressurizer, pressurizer power operated relief valves and safety valves, pressurizer heaters and spray, steam generators, main steam safety valves, and the auxiliary feedwater system, and computes pertinent variables including pressurizer pressure, pressurizer water level, steam generator mass, and reactor coolant average temperature.

The major assumptions used in the loss of AC power to the station auxiliaries analysis are the same as those presented in Section 14.1.9 for the loss of normal feedwater event, except that in this analysis the reactor coolant pumps begin coasting down after reactor trip. Additionally, in the loss of AC power to the station auxiliaries analysis no credit is taken for the immediate response of the control rod drive mechanisms caused by the loss of off site power.

Results The transient response of the RCS following a loss of power to the station auxiliaries is shown in Figures 14.1-143 through 14.1-147. The calculated sequence of events for this event is listed in Table 14.1-14.

The first few seconds of the transient following receipt of a reactor trip signal closely resemble the simulation of the complete loss of flow incident (subsection 14.1.6); i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. After the Chapter 14, Page 51 of 333 Revision 04, 2011

IP3 FSAR UPDATE reactor trip, stored and residual decay heat must be removed by natural circulation to prevent damage to either the RCS or the core.

The analysis results show that the available natural circulation flow is adequate to remove core decay heat following reactor trip and RCP coastdown.

Sensitivity analyses have demonstrated that all safety criteria for this event are also met with an AFW branch line flow delivery asymmetry of up to 150 gpm.

Conclusions Results of the analysis show that, for the loss of offsite power to the station auxiliaries event, all safety criteria are met. The auxiliary feedwater capacity is sufficient to prevent water relief through the pressurizer relief and safety valves; this assures that the RCS is not overpressurized.

The analysis also demonstrates that sufficent long term heat removal capability exists by the natural circulation capability of the RCS following reactor coolant pumps coastdown to prevent fuel or clad damage.

14.1.13 Startup Accidents Without Reactor Coolant Pump Operation As noted in the Technical Specifications the reactor is not permitted to be in MODES 1 or 2 unless all four reactor coolant pumps are in operation except for special low power tests and natural circulation tests. These tests are conducted under carefully approved procedures and supervision for the purpose of insuring control of core power and control of any reactivity insertion.

14.1.14 Startup Accident With a Full Pressurizer The Technical Specifications require pressurizer water level to be < 54.3% in MODES 1, 2 and

3. In view of this restriction, the reactor will not be solid when criticality is achieved.

References (Sections 14.0 & 14.1)

1) Fuel Densification - Indian Point Nuclear Generating Unit No. 3, WCAP-8146, Westinghouse Electric Corporation, July 1973.

2) Farman, R.F., and J.O. Cermark, Post DNB Heat Transfer During Blow-down, WCAP-9005, (Proprietary), October 1968.

3) Safety Evaluation for Indian Point Unit 3 with 24 percent tube plugging, attachment to the letter (INT-81-557) dated November 13, 1981, from J.D. Campell, Westinghouse Electric Corporation to J.M. Clabby, Power Authority of the State of New York.

4) Completion of item II.K.2-17, Potential for voiding in the Reactor Coolant System (RCS) during transients for the Indian Point Power Plant, Unit No. 3 (IP-3), letter dated January 18, 1984 (Docket No. 50-286) from S.A. Varga, Division of Licensing, USNRC, to J.P.

Bayne, New York Power Authority.

5) Safety Evaluation by the Office of Nuclear Reactor Regulation related to amendment No.

61 to Facility Operating License No. DPR-64, Power Authority of New York, Indian Point Chapter 14, Page 52 of 333 Revision 04, 2011

IP3 FSAR UPDATE Nuclear Generating Unit No. 3, letter dated August 27, 1985 (Docket No. 50-286), from J.D.

Neighbors, Division of Licensing, USNRC, to J.C. Brons, New York Power Authority.

6) Safety Evaluation for Indian Point Unit 3 with Asymmetric Tube Plugging among Steam Generators, WCAP-10704, Rev. 2, (proprietary), January 1986.

7) Additional Information Regarding Asymmetric Steam Generator Tube Plugging Analyses and Cycle 4/5 reload, letter dated August 1, 1985 (IPN-85-40), from J.C. Brons, NYPA, to S.A. Varga, Division of Licensing, USNRC.

8) NRC review of NYPA submittal on Reactor Coolant pump (RCP) trip responding to the Generic Letter 85-12 TMI Action Item II.K.3.5., Automatic Trip of RCP, letter dated May 12, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, NYPA.

9) Safety Evaluation by the office of Nuclear Reactor Regulation Implementation of TMI Action Item II.K.3.5, letter dated November 19, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, NYPA.

10) Letter dated April 17, 1987 (Docket No. 50-286) from J.D. Neighbors, Division of Reactor Projects, I/II, USNRC, to J.C. Brons, NYPA, transmitting Amendment No. 73 to Facility Operating License No. DPR-64, dated April 17, 1987, from R.A Capra, Division of Reactor Projects, I/II, USNRC.

11) Indian Point 3 Nuclear Power Plant Docket No. 50-286, cycle 5/6 Reload Safety Evaluation, IPN-87-040 dated August 14, 1987 from J.C. Brons, NYPA to Document Control Desk, USNRC.

12) H.G. Hargrove, FACTRAN - A fortran IV Code for Thermal Transients in a UO2 Fuel Rod, WCAP-7908, June 1972

13) T.W.T. Burnett, et al., LOFTRAN Code Description, WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), April 1984.

14) D.H. Risher, Jr and R.F. Barry, TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary),

January 1975.

15) L.E. Hochreiter, H. Chelemer, P.T. Chu, THING IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores, WCAP-7956, June 1973.

16) L.E. Hochreiter, Application of the THINC IV Program to PWR Design, WCAP-8054, October 1973.

17) H. Chelemer, et al., Improved Thermal Design Procedure, WCAP-8567, July 1975.

18) INT-88-778, Turbine Runback Setpoint - Final Report, S.P. Swigart (Westinghouse) to Mr.

P. Kokolakis (NYPA), October 19, 1988.

19) Nuclear Safety Evaluation NSE 88-3-013SG, Revision 1, Steam Generator Replacement Program, dated February 1,1989.

Chapter 14, Page 53 of 333 Revision 04, 2011

IP3 FSAR UPDATE

20) Inspection of Corrective Actions in Response to Report 50-286/87015 SSOMI (Installation and Test): Report 50-286/88200, letter dated March 22, 1989 (Docket No. 50-286) from G.C. Lainas, Division of Reactor Projects I/II, USNRC, to J.C. Brons, NYPA.

21) Nuclear Safety Evaluation, NSE 93-3-046 MFW, Feedwater Regulating Valve Stroke Time Change, February 1993.

22) Haessler, R.L. et al., Methodology for the Analysis of the Dropped Rod Event, WCAP-11394- P-A, January 1990.

23) WCAP-13803, Rev. 1, Generic Assessment of Asymmetric Rod Cluster Control Assembly Withdrawal, Westinghouse Electric Corp., August 1993.

24) OG-93-77, Utility Report for the Generic Letter 90 Day Response for the Salem Rod Control System Failure Event, Westinghouse Owners = Group, Sept. 9, 1993.

25) T. Baker, S. Fowler, et al., Rod Control System Evaluation Program, WCAP 13864, Rev.

1-A, June 7, 1994.

26) Vantage 5 Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station, October 1988, Westinghouse.

27) Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station Vantage+ Fuel Upgrade, Revision 3, January 1997, Westinghouse.

28) Friedland, A.J. and Ray,S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

29) SECL-97-135, Revision 2, Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties, March 1998, Westinghouse.

30) Deleted

31) 98IN-G-0004, New York Power Authority Indian Point Unit 3 Transmittal of RSAC Information for Cycle 10, February 1998, Westinghouse.

32) Reload Safety Evaluation Indian Point Unit 3 Cycle 10, Revision 1, July 1997, Westinghouse.

33) Regulatory Guide 1.70, Standard Format and Contents of Safety Analysis Report for Nuclear Power Plant.

34) Davidson, S.L. et al., Westinghouse Reload Safety Evaluation Methodology, WCAP-9272-P-A, July 1985.

35) Deleted

36) INT-01-049, Steam Generator Blowdown Assumption for Indian Point Unit 3 (INT)

LONF/LOAC Analyses, December 2001, Westinghouse.

Chapter 14, Page 54 of 333 Revision 04, 2011

IP3 FSAR UPDATE

37) Steam Generator Program Report No.: IP3-RPT-SG-01796, Rev. 3, Appendix A, October 1, 2001.

38) WCAP-16099-P, Rev. 0 Westinghouse revised Thermal Design Procedure Instrument Uncertainty Methodology Indian Point Unit 3 (Power Uprate to 3216 MWt Core Power)

39) D. S. Huegel, et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A (Proprietary),

April 1999, WCAP-15234-A (Non-Proprietary), May 1999.

40) Y. X. Sung, et al., Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-A (Proprietary), WCAP-15306 (Non-Proprietary), October 1999.

Chapter 14, Page 55 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-0 DNBR Limits VANTAGE 5(w/o IFMs) VANTAGE+ and 15x15 Upgrade DNB Correlation WRB-1 WRB-1 Correlation Limit 1.17 1.17 Design Limit (Typ/Thm) 1.24/1.23 1.23/1.22 Table 14.1-1 INSTRUMENTION DRIFT AND CALORIMETRIC ERRORS NUCLEAR OVERPOWER TRIP CHANNEL Set Point and Error Estimated Instrument Allowances Errors

(% of rated power) (% of rated power)

Nominal Set Point 109 ---

Calorimetric Error 2 0.5*

1.30 Axial power distribution effects on total ion chamber current 5 3 Instrumentation channel drift and set point reproducibility 2 1.0 Maximum overpower trip point assuming all individual errors are simultaneously in the most adverse direction 118 ---

• LEFM

Venturi Chapter 14, Page 56 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-2 Sequence of Events Uncontrolled RCCA Bank Withdrawal From a Subcritical Condition EVENT TIME OF EVENT (seconds)

Initiation of Uncontrolled RCCA Withdrawal 0.0 Power Range High Neutron Flux Reactor 9.7 (Trip Setpoint (low setting) Reached (35%))

Peak Nuclear Power Occurs 9.9 Rods Begin to Fall 10.2 Peak Heat Flux Occurs 11.8 Minimum DNBR Occurs 11.8 Peak Fuel Cladding Inner Temperature Occurs 12.3 Peak Fuel Average Temperature Occurs 12.5 Peak Fuel Centerline Temperature Occurs 13.2 Table 14.1-3 Time Sequence of Events for Uncontrolled RCCA Withdrawal at Full Power Accident Event Time(sec)

Uncontrolled RCCA bank withdrawal at full power and minimum reactivity feedback

1. Case A Initiation of uncontrolled RCCA 0.0 withdrawal at a high reactivity insertion rate (66 pcm/sec)

Power range high neutron flux 1.9 high trip point reached Rods begin to fall into core 2.4 Minimum DNBR occurs 3.4 Chapter 14, Page 57 of 333 Revision 04, 2011

IP3 FSAR UPDATE

2. Case B Initiation of uncontrolled RCCA 0.0 withdrawal at a small reactivity insertion rate (1 pcm/sec)

OTT reactor trip signal initiated 95.5 Rods begin to fall into core 97.5 Minimum DNBR occurs 98.0 Chapter 14, Page 58 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-4 Table Deleted Table 14.1-5 Sequence of Events for the Partial Loss of Flow Event Event Time of Event (sec)

Coastdown of one pump begins 0.0 Low flow reactor trip setpoint (87%) 1.5 reached Rods begin to drop 2.5 Minimum DNBR occurs 3.4 Table 14.1-6 Sequence of Events for the Complete Loss of (Undervoltage) Flow Event Event Time of Event (sec)

Coastdown of all pumps begins 0.0 Undervoltage reactor trip 0.0 setpoint reached Rods begin to drop 1.5 Minimum DNBR occurs 3.3 Chapter 14, Page 59 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-6A Sequence of Events for the Complete Loss of Flow (Underfrequency) Event Event Time of Event (sec)

Frequency decay (5 Hz/sec) begins 0.0 Underfrequency trip setpoint (55 Hz) reached 1.0 Coastdown of all pumps begins 1.0 Rods begin to drop 1.6 Minimum DNBR occurs 3.7 Table 14.1-7 Sequence of Events for the RCP Shaft Seizure Event Event Time of Event (sec)

Rotor in one pump locks 0.0 Low flow reactor trip 0.1 setpoint (87% reached)

Rods begin to drop 1.1 Maximum clad temperature occurs 3.9 Maximum RCS pressure occurs 5.8 Chapter 14, Page 60 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-8 Sequence of Events for the Loss of External Electrical Load Event Loss of External Time of Event Electrical Load With Pressurizer Without Pressurizer Control Control Event Loss of electrical 0.0 0.0 load/turbine trip Reactor trip signal OTT Hi Prz P Reactor trip setpoint 14.7 8.0 reached (sec)

Time of rod 16.7 10.0 motion (sec)

Minimum DNBR 17.9 N/A(A) occurs (sec)

Peak RCS 14.6 10.3 pressure occurs (sec)

Initiation of steam 12.5 14.9 release from SG safety valves (sec)

Peak steam generator 23.1 19.2 pressure occurs(sec)

(a) DNBR does not decrease below approximately its initial value.

Chapter 14, Page 61 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-9 Time Sequence of Events for the Loss of Normal Feedwater Event Event Time (seconds)

Main feedwater flow stops 20.0 Low-low steam generator water level reactor trip setpoint reached 52.5 Rods begin to fall 54.5 Automatic auxiliary feedwater from one of the motor-driven 112.5 auxiliary feedwater pumps initiated Operator action to establish auxiliary feedwater flow to remaining steam generators 654.5 Peak Pressurizer water level occurs 1195.0 Chapter 14, Page 62 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-10 Sequence of Events for the Feedwater System Malfunction Event at Full Power Feedwater Malfunction Time of event, sec at Full Power With Automatic Without Automatic Rod Control Rod Control Event Feedwater Flow increases 0.001 0.001 to 143% of Nominal Peak Nuclear Power occurs 69.9 93.4 Minimum DNBR occurs 73.6 91.9 High-High Steam Generator Water 84.8 85.1 Level Setpoint is reached Turbine Trip occurs 89.7 90.0 Rod motion starts 93.7* 94.0*

Peak Pressurizer Pressure 95.6 95.6 occurs Feedwater Isolation valves begin to close 96.7 97.0

• Reactor Trip occurs on Turbine Trip.

Chapter 14, Page 63 of 333 Revision 04, 2011

IP3 FSAR UPDATE Tables 14.1-11, 14.1-12, 14.1-13 Deleted Table 14.1-14 Time Sequence of Events for the Loss of All AC Power to the Station Auxiliaries Event Time of Event (Seconds)

Main Feedwater flow stops 20.0 Low-low steam generator water level reactor trip setpoint reached 59.0 Rods begin to fall 61.0 Reactor coolant pumps begin to coast down 63.0 Automatic auxiliary feedwater from one of the motor-driven auxiliary feedwater pumps initiated 119.0 Operator action to establish auxiliary feedwater flow to remaining steam generators 661.0 Peak pressurizer water level occurs 785.0 Chapter 14, Page 64 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.1-15 NATURAL CIRCULATION REACTOR COOLANT FLOW VERSUS REACTOR POWER Reactor Power Reactor coolant Flow

% Full Power  % Nominal Flow 4.0 5.3 3.5 4.7 3.0 4.5 2.5 4.1 2.0 3.8 1.5 3.5 1.0 3.1 Chapter 14, Page 65 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.2 STANDBY SAFETY FEATURES ANALYSIS Adequate provisions were included in the design of the plant and its standby Engineered Safety Features to limit potential exposure of the public to well below the limits of 10 CFR 50.67 guidelines for situations which could conceivably involve uncontrolled releases of radioactive materials to the environment. Those situations which were considered are:

1) Fuel Handling Accidents

2) Accidental Release of Waste Liquid

3) Accidental Release of Waste Gases

4) Rupture of a Steam Generator Tube

5) Rupture of a Steam Pipe

6) Rupture of a Control Rod Drive Mechanism Housing - Rod Cluster Control Assembly (RCCA) Ejection 14.2.1 Fuel Handling Accidents The following fuel handling accidents were evaluated to ensure that no hazards are created:

1) A fuel assembly becomes stuck inside the reactor vessel

2) A fuel assembly or control rod cluster is dropped onto the floor of the reactor cavity

3) A fuel assembly is dropped onto the floor of the spent fuel pit

4) A fuel assembly becomes stuck in the penetration valve

5) A fuel assembly becomes stuck in the transfer carriage or the carriage becomes stuck Causes and Assumptions The possibility of a fuel handling incident is very remote because of the many administrative controls and physical limitations imposed on fuel handling operations. Prior to the transfer canal being opened, boron concentration in the coolant is raised to the refueling concentration and verified by sampling. The refueling cavity is filled with water meeting the same boric acid specifications.

After the vessel head is removed, the rod cluster control drive shafts are disconnected from their respective assemblies using the manipulator crane and the shaft unlatching tool. An appropriate device is used to indicate that the drive shaft is free of the control cluster as the lifting force is applied.

The fuel handling manipulators and hoists were designed so that fuel cannot be raised above a position which provides adequate shield water depth for the safety of operating personnel. This safety feature applies to handling facilities in both the Containment and in the spent fuel pit area. In the spent fuel pit, administrative controls and the design of storage racks and manipulation facilities are such that:

• Fuel at rest is positioned by restraints in an ever safe, always subcritical, geometrical array, with no credit for boric acid in the water.

• Fuel can be manipulated only one assembly at a time.

• Violation of procedures by placing one fuel assembly with any group of assemblies in racks will not result in criticality Chapter 14, Page 66 of 333 Revision 04, 2011

IP3 FSAR UPDATE The spent fuel cask cannot be moved over any region of the spent fuel pit which is north of the spot in the pit that is reserved for the cask. Additionally, if the spent fuel pit contains irradiated fuel, loads in excess of 2,000 pounds are not moved over any region of the spent fuel pit, unless a technical analysis has been performed consistent with the requirements of NUREG-0612 establishing the necessary controls to assure that a load drop accident could damage no more than a single fuel assembly. Administrative and procedural controls to protect fuel and fuel racks may include path selection to prevent loads from passing over or near fuel. For cases in which very heavy loads (>30,000 pounds) are transported over the spent fuel pit, the load cannot under any circumstances pass over fresh or irradiated fuel. In all cases where loads >

2,000 pounds are carried over the pit, the ventilation system must be operable.

No movement of irradiated fuel in the reactor is made until the reactor has been subcritical for at least 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />. Movement of the spent fuel cask is also restricted to at least 90 days after the reactor has been subcritical, to minimize the consequences of an unlikely sideways cask drop.

A detailed description of crane movement limitations appears in Section 9.5.

Adequate cooling of fuel during underwater handling is provided by convective heat transfer to the surrounding water. The fuel assembly is immersed continuously while in the refueling cavity or spent fuel pit.

Even if a spent fuel assembly becomes stuck in the transfer tube, the fuel assembly is completely immersed and natural convection will maintain adequate cooling to remove the decay heat. The fuel handling equipment is described in detail in Section 9.5.

Two Nuclear Instrumentation System source range channels are continuously in operation and provide warning of any approach to criticality during refueling operations. This instrumentation provides a continuous audible signal in the Containment, and would annunciate a local horn and a horn and light in the Control Room if the count rate increased above a preset low level.

Refueling boron concentration is sufficient to maintain the clean, cold, fully loaded core subcritical by at least 5 percent with all Rod Cluster Control Assemblies inserted. The refueling cavity is filled with water with the same boric acid specifications.

All these safety features make the probability of a fuel handling incident very low. Nevertheless, it is possible that a fuel assembly could be dropped during handling operations. Therefore, this incident was analyzed both from the standpoint of radiation exposure and accidental criticality.

Special precautions are taken in all fuel handling operations to minimize the possibility of damage to fuel assemblies during transport to and from the spent fuel pit and during installation in the reactor. All handling operations on irradiated fuel are conducted under water. The handling tools used in the fuel handling operations are conservatively designed and the associated devices are of a fail-safe design.

In the fuel storage area, the fuel assemblies are spaced in a pattern which prevents any possibility of a criticality accident. Plant procedures require that, if the spent fuel pit contains irradiated fuel, loads weighing less than 2,000 pounds may be transported over the pit, provided that the boron concentration exceeds 1000 ppm and that any doors can be promptly closed in the event of a load drop accident. Analyses show that a dropped load of less than 2,000 pounds is not expected to result in breach of fuel cladding for any assembly in the racks below.

However, even if fuel rod cladding were to be damaged by a falling object, the design basis analysis for dropped fuel (which presumes complete destruction of one fuel assembly that has Chapter 14, Page 67 of 333 Revision 04, 2011

IP3 FSAR UPDATE been subcritical for 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />) demonstrates that the subsequent dose would be within acceptable limits.

Transport of heavy loads (> 2,000 pounds) requires the preparation of a technical analysis consistent with the requirements of NUREG-0612 establishing the necessary controls to assure that a load drop accident could damage no more than a single fuel assembly. Administrative and procedural controls to protect fuel and fuel racks may include path selection to prevent loads from passing over or near fuel. For cases in which very heavy loads (> 30,000 pounds) are transported over the spent fuel pit, the load cannot under any circumstances pass over fresh or irradiated fuel. In all cases where loads > 2,000 pounds are carried over the pit, the ventilation system must be operable. When the overhead crane is not in use, inadvertent motion of the crane over the spent fuel racks is limited by administrative controls and / or installation of mechanical stops on the bridge crane rails. Additionally, administrative controls allow only one irradiated fuel assembly to be handled at a given time.

The motions of the cranes which move the fuel assemblies are limited to a low maximum speed.

Caution is exercised during fuel handling to prevent the fuel assembly from striking another fuel assembly or structures in the Containment or Fuel Storage Building.

The fuel handling equipment suspends the fuel assembly in the vertical position during fuel movements, except when the fuel is moved through the transport tube.

The design of the fuel assembly is such that the fuel rods are restrained by grids. The force transmitted to the fuel rods during normal handling is limited to the (grid frictional) restraining force and is not sufficient to breach the fuel rod cladding. If the fuel rods are not in contact with the fuel assembly bottom nozzle, the rods would have to slide against the grid friction force. This would dissipate an appreciable amount of energy and thus limit the impact force of the individual fuel rods.

If one assembly is lowered on top of another, no damage to the fuel rods would occur that would breach the cladding. Considerable deformation would have to occur before the fuel rods would contact the top nozzle adapter plate and apply any appreciable load to the rods. Based on the above, it is unlikely that any damage would occur to the individual fuel rods during handling.

If during handling and subsequent translatory motion the fuel assembly should strike against a flat surface, the fuel assembly lateral loads would be distributed axially along its length with reaction forces at the grids and essentially no damage would be expected in any fuel rods.

Analyses have been made assuming the extremely remote situations where a fuel assembly is dropped vertically and strikes a rigid surface and where one assembly is dropped vertically on another. The analysis of a dropped fuel assembly striking a rigid surface considered the stresses in the fuel cladding and any possible buckling of the fuel rods between the grid supports. The results showed that the buckling load at the bottom section of the fuel rod, which would receive the highest loading, was below the critical buckling load and the stresses were below the yield stress. For the case where one fuel assembly is assumed to be dropped on top of another assembly, the impact load is transmitted through the top nozzle and the RCC guide tubes of the struck assembly before any of the loads reach the fuel rods. As a result, a significant amount of kinetic energy is absorbed by the top nozzle of the struck assembly and the bottom nozzle of the falling assembly, thereby limiting the energy available for the fuel rod deformation. The results of this analysis indicated that the buckling load on the fuel rods was below the critical buckling load and stresses in the cladding were below yield.

Chapter 14, Page 68 of 333 Revision 04, 2011

IP3 FSAR UPDATE In the event a fuel assembly is dropped while steam generator nozzle dams are in service, it must be determined promptly whether the fuel assembly would become exposed to the air should there be a loss of water in the reactor cavity. If so, then preparations shall be made to rapidly close any open steam generators should evidence of a nozzle dam leak appear, once Health Physics has determined it is safe to work in containment.

There is no credible scenario in the Spent Fuel Pit in which a dropped rod cluster control assembly (RCCA) can damage fuel cladding. Each fuel assembly in the pit is stored in a steel cell that encloses it on all four sides and shields the fuel pins from interaction with other objects.

Because an RCCA is much lighter than a fuel assembly, a falling RCCA cannot impact a fuel assembly top nozzle to the extent that the fuel pins underneath can be damaged.

The refueling operation experience that has been obtained with Westinghouse reactor has verified the fact that no fuel cladding integrity failures have occurred during any fuel handling operations. Prototype fuel assemblies have been subject to 3000 pounds of axial load without excessive lateral or axial deformation. The maximum column load expected to be experienced in service is approximately 1000 pounds. This information was used in the fuel handling equipment design to establish the limits for inadvertent axial loads.

For the purposes of evaluating the environmental consequences of a fuel handling incident, a conservative upper limit of damage was assumed by considering the rupture of one complete fuel assembly. The remaining fuel assemblies are so protected by the storage rack structure that no lateral bending loads would be imposed.

Activity Release Characteristics For the assumed accident there would be a sudden release of the gaseous fission products held in the voids between the pellets and cladding of one fuel assembly. The low temperature of the fuel during handling operations precludes further significant release of gases from the pellets themselves after the cladding is breached. Molecular halogen release is also greatly minimized due to their low volatility at these temperatures. The strong tendency for iodine in vapor and particulate form to be scrubbed out of gas bubbles during their ascent to the water surface further reduces the quantity released from the water surface.

An experimental test program(1) was conducted to evaluate the extent of iodine removal by the spent fuel pit water. Iodine removal from the release gas takes place as the gas rises through the body of solution in the spent fuel pit to the pool surface. The extent of iodine removal is determined by mass transfer from the gas phase to the surrounding liquid and is controlled by the bubble diameter and contact time of the bubble in the solution.

In order to obtain all the necessary information regarding this mass transfer process, a number of small scale tests were conducted using trace iodine and carbon dioxide in an inert carrier gas. Iodine testing was performed at the design basis solution conditions (temperature and chemistry), and data were collected for various bubble diameters and solutions depths. This work resulted in the formulation of a mathematical expression for the iodine Decontamination Factor (DF) in terms of bubble size and bubble rise time.

Similar tests were conducted with carbon dioxide in an inert carrier, except that the solution temperature and chemistry were patterned after that of a deep pool where large scale tests were also performed with carbon dioxide. The small scale carbon dioxide tests also resulted in a Chapter 14, Page 69 of 333 Revision 04, 2011

IP3 FSAR UPDATE mathematical expression for DF in terms of bubble size and bubble rise time through the solution.

To complete the experimental program, a full-size fuel assembly simulator was fabricated and placed in a deep pool for testing, where gas released would be typical of that from the postulated damaged assembly. Tests were conducted with trace carbon dioxide in an inert carrier gas and overall DFs were measured as a function of the total gas volume released.

These measurements, combined with an analytical expression derived from small-scale tests with carbon dioxide, permitted an in situ measurement of the effective bubble diameter and rise time, both as a function of the volume of gas released. Having measured the characteristics of large-scale gas releases, the DF for iodine was obtained using the analytical expression from small scale iodine testing.

DF = 73e 0.313t/d (Reference 32)

Where:

t = rise time (sec) d = effective bubble diameter (cm)

The overall test results clearly indicate that iodine will be readily removed from the gas rising through the spent fuel pit solution and that the efficiency of removal will depend on the volume of gas released instantaneously from the full void space.

Fuel Handling Dose Analysis The consequences of an accident in which all rods in an assembly are breached under water in the spent fuel pit or in the refueling canal have been analyzed using the dose calculation model described in Appendix 14C. A listing of the accident inputs and assumptions are provided in Table 14.2-1. The analysis does not take credit for either building hold up of the activity or for removal of iodine by charcoal filters. The activity released from the damaged assembly is assumed to be released to the environment at a uniform rate over a two hour period.

In the analysis, conservative assumptions regarding fission product inventories and species distribution were made. The radial peaking factor (FH) applied to this assembly is 1.7. The decay time prior to fuel movement assumed in the fuel handling accident radiological consequences analysis is 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br />.

Regulatory Guide 1.183 (Reference 38) states that the fission product gap fractions could potentially be:

I-131 0.08 Other Iodines 0.05 KR-85 0.10 Other noble gases 0.05 However since it is projected that a high-burnup fuel assembly could exceed the parameters associated with the use of these gap fractions (i.e., burnup of >54,000 MWD/MTU combined with a maximum linear heat generation rate of >6.3 kW/ft), more conservative gap fractions are used. With the exception of I-131, the gap fractions are taken from Regulatory Guide 1.25 (Reference 20) which specifies a gap fraction of 0.30 for Kr-85 and 0.10 for all other noble gases and for iodines. The gap fraction for I-131 is assumed to be 0.12 consistent with guidance from NUREG/CR-5009 (Reference 30) which specifies this increase.

Chapter 14, Page 70 of 333 Revision 04, 2011

IP3 FSAR UPDATE The iodine released from the assembly gap is assumed to be 99.85% elemental and 0.15%

organic. A value of 285 for the pool elemental iodine decontamination factor (DF) was conservatively assumed. A decontamination factor of 1.0 is modeled for organic iodine and noble gases. This results in an overall iodine DF of 200 for the iodine consistent with Reg.

Guide 1.183 guidance.

The activity released from the damaged assembly is assumed to be released to the environment at a uniform rate over a two-hour period. Since no filtration or isolation of the release path is modeled, this analysis supports a potential fuel handling accident in either the containment or the fuel handling building. The control room dose takes no credit for operator action to switch the CRVS to the emergency mode.

The resulting doses are:

Site Boundary 5.7 rem TEDE Low Population Zone 2.1 rem TEDE Control Room 2.8 rem TEDE The offsite doses are below the dose acceptance limit of 6.3 rem TEDE specified in Reg. Guide 1.183 and the control room dose is below the 10 CFR 50.67 limit of 5.0 rem TEDE.

Fuel Cask Drop Accident As discussed in Section 9.12.4.3, Single Failure Proof Cranes foe Spent Fuel Caks, the fuel storage building cranes main hook that handles spent fuel casks has been upgraded to single-failure-proof in accordance with the applicable guidelines of NRC NUREG-0554 (Single-Failure-Proof Cranes for Nuclear Power Plants, May 1979) and the applicable requirements of American Society of Mechanical Engineers ASME NOG-1-2004, Rules foe Construction of Overhead and Gantry Cranes (top Running Bridge, Multiple Girder) to support spent fuel cask handling activities, without the necessity of having to postulate the drop of a spent fuel cask.

With the cranes main hook qualified as single-failure-proof, and when the cranes is used as part of a single-failure-proof handling system for critical lifts as discussed in NRC NUREG-0800, Revision 1 of Section 9.1.5, Overhead Heavy Load Handling Systems, Sub-sectionlll.4.C, a cask drop accident is not a credible event and need not be postulated. The following cask drop accident results and features have not changed and are being retained since the analysis bounds other drop accidents that may be postulated in the fuel storage building and cask loading pit even though a cask drop accident is no longer credible.

The exposure limits of 10 CFR 50.67 will not be exceeded by a spent fuel cask drop because the spent fuel cask is not moved over any region of the spent fuel pool which contains irradiated fuel. Electrical limit switches incorporated in the bridge rails and trolley rails of the fuel storage building crane limit crane travel so that loads are not inadvertently moved over any region of the spent fuel pit which contains irradiated fuel. Removable mechanical stops are available for installation on the bridge rails of the fuel storage building crane to backup the bridge rail electrical limit switches and prevent the bridge of the crane from traveling further north than a point directly over the spot in the spent fuel pit that is reserved for the spent fuel cask. With the bridge rail removable mechanical stops in use, it will be impossible to carry any object over the spent fuel storage areas north of the spot in the pit that is reserved for the cask with either the 40 or 50-ton hook of the fuel storage building crane. With the bridge rail removable mechanical stops in use and if the trolley rail electrical limit switches are bypassed or out of service, it is possible foe the fuel storage building crane to carry objects over the spent fuel storage areas that are directly east of the spot in the pit that is reserved for the cask. However, the FSAR and plant procedures prevent any object weighing more than 2,000 pounds from being moved over Chapter 14, Page 71 of 333 Revision 04, 2011

IP3 FSAR UPDATE any region of the spent fuel pit containing irradiated fuel. Therefore, the storage areas directly east of the spot in the pit that is reserved for the cask are protected from heavy load handling by electrical limit switches and by administrative controls.

14.2.2 Accidental Release of Waste Liquid Accidents which would result in the release of radioactive liquids are those which may involve the rupture or leaking of system pipelines or storage tanks. The largest vessels are the three liquid holdup tanks (CVCS), each sized to hold two-thirds of the reactor coolant liquid volume.

The tanks are used to process the normal recycle or waste fluids produced. The contents of one tank will be passed through the liquid processing train while another tank is being filled.

All liquid waste components except the Reactor Coolant Drain Tank, Liquid Radwaste Processing System Skid and the waste holdup tanks are located in the Primary Auxiliary Building, and any leakage from the tank or piping will be collected in the building sump to be pumped back into the liquid waste system. One waste holdup tank and the liquid holdup tanks (CVCS) are located in a thick concrete underground vault. Two waste holdup tanks are located in the Liquid Radwaste Storage Building. The vault and building volumes are sufficient to hold the full volume of any tank without overflowing into areas outside the vault, building, or flooding pump motors in the adjoining compartment. The Reactor Coolant Drain Tank is located in the Containment Building. Holdup tanks are equipped with safety pressure relief and were designed to accept the established seismic forces at the site. Liquids in the Chemical and Volume Control System flowing into and out of these tanks are controlled by the manual valve operation as governed by prescribed administrative procedures.

The volume control tank design philosophy is similar in many respects to that applied for the holdup tanks. Level alarms, pressure relief valves, and automatic tank isolation and valve control assure that a safe condition is maintained during system operation. Excess letdown flow is directed to the holdup tanks via the Reactor Coolant Drain Tank.

Piping external to the Containment, running between the Containment and the Primary Auxiliary Building and between the Primary Auxiliary Building and the liquid holdup tank vault is run below grade in concrete trenches. Any liquid spillage from pipe rupture or leaks in these trenches would drain to sumps and / or the sump tank be pumped to the waste holdup tanks.

The incipient hazard from these process or waste liquid releases is derived only from the volatilized components. The releases are described and their effects summarized in Section 14.2.3.

No credible mechanism exists for accidental release of liquid wastes to the river. A river diffusion analysis was performed, however, to determine the concentrations which would result in the Chelsea reservoir if a release was assumed. The results of the analysis showed that even the instantaneous release of the entire primary coolant system maximum activity, corresponding to operation with 1% of fuel defects, would not result in peak concentrations at Chelsea in excess of 10 CFR 20 MPC limits. Drought conditions were assumed to exist at the time of and for a period following the spill, limiting the total runoff flow to 4000 cfs. The mean longitudinal diffusion coefficient corresponding to this flow was 8.74 square miles per day. These data represent a drought similar to conditions existing in late summer of 1964, which can be verified by data in Section 2.5.

Chapter 14, Page 72 of 333 Revision 04, 2011

IP3 FSAR UPDATE The unlikely event of a loss of water from a spent resin storage tank actuates a low level alarm to warn the operator. Resin contained in the tank can then be cooled by periodically flushing water from the Primary Water Storage Tank through the resin. Two pathways are available for the water:

(a) through the primary storage water injection pipeline used when resin is removed from the tank, or (b) through the primary storage pipeline used when resin is sluiced from the demineralizers into the tank.

Conservative assumptions made to determine the frequency of flushing to cool the resin were:

1) The tank contains only the mixed bed resin from one mixed bed demineralizer discharge to the spent resin storage tank following operation of the plant for one cycle with 1% fuel defects. This assumption yields the maximum heat generation per unit volume of resin in the tank and the maximum level of radioactivity in the tank.

2) There are no heat losses through the tank walls.

3) Water is lost immediately following discharge of a mixed bed resin into the spent resin storage tank. This yields a maximum heat generation rate due to fission product decay.

These assumptions result in the following relationships:

1) The heat generation rate, q (Btu/hr), due to fission product decay is approximated closely as a function time, t (hours), by q = 178e-0.0116t +50e-0.00127t +37.5 where the first term is short-lived, the second intermediate-lived, and the last term a long-lived isotope contribution.

2) The mean heat capacity of resin is 0.31 Btu/IbF

3) Resin volume is 25 ft3 consistent with assumption number (1) and with the coefficients of the heat generation formula given in item (1)

4) Resin specific gravity is 1.14 with a void fraction of 0.4 giving a resin density of 43 Ib/ft3

5) The amount of radioactivity in the tank is 21,250 curies.

On this basis, the resin bed temperature, T (F) as a function of time (hours), is

(

T = 47 1 e 0.0116t

) + 141(1 e 0.00127 t

) + 0.11t + T o Where T0 is the initial resin temperature. If T0 is assumed to be 90F, it will take four days for the bed temperature to rise to 140F, the normal resin operating limit. At or below a temperature of 140F, the radioactivity will not be released from the resin. The actual time to heat to 140F will be greater than four days because of the of the conservative assumptions made in the calculation. The heat accumulated in the resin through the initial four days will be 18,750 Btu.

Chapter 14, Page 73 of 333 Revision 04, 2011

IP3 FSAR UPDATE The bed can be maintained at 140F or less by back flushing the resin with primary water at four day intervals. Flush water will be collected by the floor drain system and be pumped to the waste holdup tank. If a 10F rise is taken in the flush water, the total quantity of water required will be about 250 gallons per back flush operation to remove the 18,750 Btu accumulated in the resin.

Hence, the loss of water from the spent resin storage tank presents no hazard offsite or onsite because means are available both to detect the situation occurring and to keep the resin temperature under control until the resin can be removed to burial facilities.

14.2.3 Accidental Release - Waste Gas The leakage of fission products through cladding defects can result in a buildup of radioactive gases in the reactor coolant. Based on experience with operational, closed cycle, pressurized water reactors, the number of defective fuel elements and the gaseous coolant activity is expected to be low. The shielding and sizing of components such as demineralizers and the Waste Handling System are based on activity corresponding to 1% defective fuel which is at least an order of magnitude greater than expected. Tanks accumulating significant qualities of radioactive gases during operation are the gas decay tanks, the volume control tank, and the liquid holdup tanks.

The volume control tank accumulates gases over a core cycle by the stripping action of the entering spray. Gaseous inventory for the tank, based on operation with 1% defective fuel, is tabulated in Table 14.2-2. During a refueling shutdown, this activity is vented to the waste gas system and stored for decay. Rupture of this tank is assumed to release all of the contained noble gases plus that small amount contained in the 132 gpm flow from demineralizer which would continue for up to five (5) minutes before isolation would occur.

The liquid holdup tanks receive reactor coolant, after passing through demineralizers, during the process of coolant deboration. The liquid is stored and then discharged as waste. The contents of one tank are passed through the liquid processing train while another tank is being filled.

In analyzing the consequence of rupture of a holdup tank, it is assumed that immediately after filling the tank, the combined noble gas and a portion of the iodines are released. A major tank failure would be required to cause release of all the contained noble gas. Since the tanks operate at low pressure, approximately 2 psig, a gas phase leak would result in expulsion of approximately 12% of the contained gases and then the pressure would be in equilibrium with the atmosphere. The tank pits are vented to the ventilation system so that any gaseous leakage would be discharged to the atmosphere by this route. Any liquid leaks from the tanks or piping will be collected in the tank sump pit to be pumped back into the liquid waste system.

The waste gas decay tanks receive the radioactive gases from the radioactive liquids from the various laboratories and drains processed by the Waste Disposal System. The maximum storage of waste gases occurs after a refueling shutdown, at which time the gas decay tanks store the radioactive gases stripped from the reactor coolant. As discussed in Section 11.1, six shutdown gas decay tanks are provided in addition to the four gas decay tanks used during power operation to reduce the gaseous activity release as a result of an assumed rupture of one of the tanks during the decay period following a refueling shutdown.

Dose Evaluation Chapter 14, Page 74 of 333 Revision 04, 2011

IP3 FSAR UPDATE The doses calculated for the tank failures are:

Site Boundary WB Low Population Control Room WB Dose (rem) Zone WB Dose Dose (rem)

(rem)

Volume Control 0.42 0.16 0.02 Tank Gas Decay Tank 0.32 0.12 0.02 Holdup Tank 0.38 0.14 0.03 The CR offsite doses are all less than the 0.5 rem whole-body limit (Reg. Guide 1.26).

14.2.4 Steam Generator Tube Rupture Accident Description The accident examined is the complete severance of a single generator tube. This accident is assumed to take place at power with reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the reactor coolant system (RCS). In the event of a coincident loss of offsite power, or failure or unavailability of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator power-operated relief valves (and safety valves if their setpoint is reached).

The activity that is available for release from the secondary system is limited by:

• Activities in the steam generator secondary that are a consequence of operation leakage prior to the complete tube rupture.

• The activity concentration in the reactor coolant.

• Operator actions to isolate the mixed primary and secondary leakage to atmosphere.

In view of the fact that the steam generator tube material is inconel 690, which is highly ductile material, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and accumulation of minor leaks from the Reactor Coolant System to the Steam Generator that exceeds the limits established in the Technical Specifications is not permitted during the reactor operation.

The operator is expected to determine that a steam generator tube rupture (SGTR) has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the ruptured steam generator. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale that ensures that break flow to the secondary Chapter 14, Page 75 of 333 Revision 04, 2011

IP3 FSAR UPDATE steam is terminated before water level in the affected steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by the design basis tube rupture:

1. Pressurizer low pressure and low-level alarms are actuated and, prior to reactor trip, charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a steam flow/feedwater flow mismatch prior to reactor trip as feedwater flow to the affected steam generator is reduced due to the break flow that is now being supplied to that steam generator.

2. The secondary side radiation monitors will alarm, indicating a sharp increase in radioactivity in the secondary system, and a transfer signal is initiated which causes the air ejector exhaust to the atmosphere to be discharged to the containment.

3. Continued loss of reactor coolant inventory leads to a reactor trip signal generated by low pressurizer pressure or overtemperature T. A safety injection (SI) signal, initiated by low pressurizer pressure, follows soon after the reactor trip. The SI automatically terminates normal feedwater supply and initiates auxiliary feedwater (AFW) addition.

4. The reactor trip automatically trips the turbine and, if offsite power is available, the steam dump valves open permitting steam dump to the condenser. In the event of a coincident loss of offsite power and subsequent circulating water pump trip, the steam dump valves would automatically close to protect the condenser. In this case the steam generator pressure would rapidly increase, resulting in steam discharge to the atmosphere through the steam generator power-operated relief valves (and safety valves if their setpoint is reached).

5. Following reactor trip and SI actuation, the continued action of AFW supply and borated SI flow (supplied from the refueling water storage tank) provide a heat sink that absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of condenser steam dump capability, steam relief to the atmosphere.

6. SI flow results in stabilization of the RCS pressure and pressurizer water level and, if not for the operators recovery actions, the RCS pressure trends toward the equilibrium value where the SI flow rate equals the break flow rate.

Recovery In the event of an SGTR, the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR are provided in the Emergency Operating Procedures. The major operator actions include identification and isolation of the ruptured steam generator, cooldown and depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary leakage. These operator actions are described below:

1. Identify the ruptured steam generator.

High secondary side activity, as indicated by the secondary side radiation monitors will typically provide the initial indication of an SGTR event. The ruptured steam generator Chapter 14, Page 76 of 333 Revision 04, 2011

IP3 FSAR UPDATE can be identified by an unexpected increase in steam generator level, a high radiation indication on the corresponding air ejector monitor, or from a high radiation alarm in the steam generator blowdown liquid monitor. For a SGTR that results in a reactor trip at high power, the steam generator water level will initially decrease off-scale on the narrow range for all of the steam generators. The AFW flow will begin to refill the steam generators, distributing flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will return to the narrow range earlier in that steam generator and will continue to increase more rapidly. This response, as indicated by the steam generator water level instrumentation, provides confirmation of an SGTR event and also identifies the ruptured steam generator.

2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.

Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.

3. Cooldown the RCS using the intact steam generators.

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump to the condenser can be used to perform this cooldown. However, if offsite power is lost, the RCS is cooled using the power-operated relief valves (PORVs) on the intact steam generators.

4. Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured.

This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped.

The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if offsite power is lost or the RCPs are not running, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.

5. Terminate SI to stop primary to secondary leakage.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressures equalize.

Chapter 14, Page 77 of 333 Revision 04, 2011

IP3 FSAR UPDATE Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.

Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated and all immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cooldown and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.

Results In determining the mass transfer from the RCS through the broken tube, the following conservative assumptions were made:

1) Reactor trip occurs automatically as a result of low pressurizer pressure.

2) The analysis assumes that following the initiation of the SI signal, all charging/SI pumps are actuated and continue to deliver flow for 30 minutes.

3) After reactor trip, the break flow reaches equilibrium at the point where incoming SI and charging flow is balanced by outgoing break flow as in Figure 14.2-1.

4) The steam generators are controlled at the safety valve setting with 3% tolerance and 15% blowdown rather than at the PORV setting.

The analysis assumes that the operator identifies the accident type and terminates break flow to the ruptured steam generator within 30 minutes of accident initiation. The analysis does not require that the operators demonstrate the ability to terminate break flow within 30 minutes from the start of the event. It is recognized that the operators may not be able to terminate break flow within 30 minutes for all postulated SGTR events. The purpose of the calculation is to provide conservatively high mass-transfer rates for use in the radiological consequences analysis. This is achieved by assuming a constant break flow at the equilibrium flow rate for a relatively long time period. 30 minutes was selected for this purpose.

Sufficient indications and controls are provided at the control board to enable the operator to complete these functions satisfactorily within 60 minutes for the design-basis event even without offsite power. In order to demonstrate that releases calculated with the 30 minute equilibrium break flow assumption are indeed conservative, an evaluation was performed with a licensed thermal-hydraulic analysis code modeling the operators response to the event. This evaluation modeled the operators identification and isolation of the ruptured steam generator, cooldown of the RCS by dumping steam from the intact steam generators, depressurization of the RCS using the pressurizer PORV and subsequent termination of SI. This evaluation demonstrated that although break flow was terminated at 60 minutes, the ruptured steam generator does not overfill and the mass transfer data calculated with the assumption of a constant break flow at the equilibrium valve for 30 minutes from reactor trip is limiting as input to the radiological consequences analysis.

This evaluation does not change the formal design basis response time of 30 minutes. It does, however, justify extending the allowable time from 30 to 60 minutes for operator response in the affected Emergency Operating Procedures.

The above assumptions lead to conservative upper bound values of 138,000 pounds for the total amount of reactor coolant transferred to the ruptured steam generator and 72,000 pounds Chapter 14, Page 78 of 333 Revision 04, 2011

IP3 FSAR UPDATE for the total amount of steam released to the atmosphere via the ruptured steam generator as a result of the steam generator tube rupture. A fraction of the break flow flashes directly into steam, while a portion mixes with the secondary liquid. This flashing fraction is calculated to be 21% prior to reactor trip and 15% following reactor trip. Bounding values for the intact steam generator steam releases were calculated. They are 526,00 lbm from start of event until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 1,160,000 lbm from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> and 1,580,000 lbm from 8 to 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br />. These releases conservatively consider that all stored energy and decay heat is removed via intact steam generator steaming rather than the RHR, until 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> from the start of the event.

A sensitivity evaluation of the SGTR with respect to AFW branch line flow delivery asymmetry of up to 150 gpm determined that the above operator action times would continue to met and release values specified would be unaffected.

Environmental Consequences of a Tube Rupture The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is leakage from the RCS to the secondary system through the steam generators. A conservative analysis of the postulated steam generator tube rupture assumes a loss of offsite power and hence involves the release of steam from the secondary system. The following conservative assumptions were used to calculate the offsite power doses for the postulated steam generator rupture.

1) Both pre-accident and accident-initiated iodine spikes are analyzed. For the pre-accident iodine spike it is assumed that a reactor transient has occurred prior to the steam generator tube rupture and has raised the RCS iodine concentration to 60Ci/gm of dose equivalent (DE) I-131 (see Table 14C-2). For the accident-initiated iodine spike, the reactor trip associated with the steam generator tube rupture creates an iodine spike in the RCS which increases the iodine release rate from fuel to the RCS to a value 335 times greater than the release rate corresponding to the maximum equilibrium RCS Technical Specification concentration of 1.0 Ci/gm of DE I-131 (see Table 14C-2). The duration of the accident-initiated iodine spike is 4.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.

2) The noble gas activity concentration in the RCS at the time the accident occurs is based on a fuel defect level of 1.0% (see Table 9.2-5). This is approximately equal to the Technical Specification value of 100/E Ci/gm for gross radioactivity.

3) The iodine activity concentration in the secondary coolant at the time the steam generator tube rupture occurs is assumed to be 0.1 Ci/gm of DE I-131.

4) The amount of primary to secondary steam generator tube leakage in the intact steam generators is assumed to be equal to the Technical Specifications limit of 432 gpd per steam generator for a total of 1296 gpd.

5) Credit is taken for iodine removal from steam released to the condenser prior to reactor trip and concurrent loss of offsite power (an iodine partition factor of 0.01 is applied).

curies l steam / gm steam

6) An iodine partition factor in the steam generators of 0.01 is curies l water / gm water used.

Chapter 14, Page 79 of 333 Revision 04, 2011

IP3 FSAR UPDATE

7) All noble gas activity carried over to the secondary side is assumed to be immediately released to the atmosphere.

8) Thirty minutes after the postulated tube rupture accident the pressure between the faulted steam generator and the primary system is equalized. There are 38,500 lbs of reactor coolant discharged to the secondary side of the faulted steam generator prior to reactor trip and an additional 99,500 lbs between the reactor trip and 30 minutes. Also, until reactor trip occurs at 392 seconds, 1070.21 lb/sec of steam is released from each steam generator to the condenser. Between the time of the reactor trip and 30 minutes into the event an additional 72,000 lbs of steam is released from the faulted steam generator to the atmosphere.

9) The break flow flashing fraction is 0.21 prior to reactor trip and 0.15 after trip.

10) The steaming rate and steam release from the intact steam generators is:

i. Pre-trip 3210.63 lb/sec ii. Trip - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 526,000 lb/sec iii. 2 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 1.16x106 lb/sec iv. 8 - 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> 1.58x106 lb/sec

11) Auxiliary feedwater is available during the accident.

12) 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> after the accident the residual heat removal system is placed into operation.

13) 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> after the accident no further activity is released to the environment.

14) The atmospheric dispersion factors (X/Q) at the site boundary and at the boundary of the low population zone, and at the control room air intake are given in Appendix 14C.

15) Control room model inputs and assumptions are provided in Appendix 14C.

16) The offsite breathing rates are:

0 - 8 hr 3.5x10-4 m3/sec 8 - 24 hr 1.8x10-4 m3/sec

>24 hr 2.3x10 m3/sec

-4 The calculated doses are:

Site Boundary Low Population Control Room Dose (rem TEDE) Zone Dose (rem Dose (rem TEDE)

TEDE)

Pre-Existing 4.9 1.9 2.2 Iodine Spike Accident Initiated 1.9 0.8 0.9 Iodine Spike The breathing rate used to calculate the thyroid dose for the accident is 3.47x10-4 m3/sec.

14.2.4.6 Conclusion Chapter 14, Page 80 of 333 Revision 04, 2011

IP3 FSAR UPDATE A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core. An orderly recovery from the accident can be completed, even assuming a simultaneous loss of offsite power.

The offsite doses for pre-existing spike case are less than 25 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183. The offiste doses for the accident-initiated spike case are less than 2.5 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183. The control room dose for each case is less than the 5.0 rem TEDE dose limit from 10 CFR 50.67 14.2.5 Rupture of a Steam Pipe 14.2.5.1 Discussion of Accident A rupture of a steam pipe results in an uncontrolled steam release from the steam generator.

The steam release results in an initial increase in steam inflow which decreases during the accident as the steam pressure falls. The energy removal from the Reactor Coolant System causes a reduction of coolant temperature and pressure. In the presence of a negative coolant temperature coefficient, the cooldown results in a reduction of core shutdown margin. If the most reactive RCCA is assumed stuck in its fully withdrawn position, there is an increased possibility that the core will become critical and return to power. A return to power following a steam pipe rupture is a potential problem mainly because of the high hot channel factors which exist when the most reactive assembly is assumed stuck in its fully withdrawn position.

Assuming the most pessimistic combination of circumstances which could lead to power generation following a steam line break, the core is ultimately shut down by boric acid injection delivered by the Emergency Core Cooling System.

The analysis of the Rupture of a Steam Pipe event bounds both hypothetical and credible steamline breaks. A hypothetical steamline break is defined as the double ended rupture of a main steamline. This event is classified as an ANS Condition IV event, a limiting fault. Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to the public health and safety in excess of guideline values of 10 CFR 50.67. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the Emergency Core Cooling System and Containment.

A credible steamline break is classified as an ANS Condition II event and is defined as a release of steam equivalent to the spurious opening, with failure to close, of the largest of any single steam bypass, relief or safety valve. The applicable Indian Point Unit 3 safety analysis licensing basis acceptance criteria for Condition II events are:

1. Pressures in the reactor coolant and main stream systems should be maintained below 110% of the design values,

2. Fueling Cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 limit, and

3. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Chapter 14, Page 81 of 333 Revision 04, 2011

IP3 FSAR UPDATE The purpose of the analysis for the Rupture of a Steam Pipe event is to show that the applicable acceptance criteria for the given ANS Conditions are met for all the cases considered.

The acceptance criteria for hypothetical steamline breaks cases is conservatively demonstrated by showing that the more restrictive Condition II criterion for DNB is met. This ensures that there is no damage to the fuel cladding and no release of fission products from the fuel to the reactor coolant system. The acceptance criterion of no fuel rod failures for credible break case is also demonstrated by showing that no DNB occurs.

The following systems provide the necessary protection against a steam pipe rupture:

1. Safety Injection System actuation from any of the following:

a) Two-out-of-three low pressurizer signals b) Two-out-of-three high differential pressure signals between steam lines c) High steam flow in two-out-of-four main steam lines (one-out-of-two per line), in coincidence with either low Reactor Coolant System average temperature (two-out-of-four loops) or low main steam line pressure (two-out-of-four lines) after a time delay (maximum of 6 seconds) d) Two-out-of-three high containment pressure signals e) High-High containment pressure (2 sets of two-out-of-three) [energize to actuate]

f) manual

2. The overpower reactor trips (high neutron flux and OPT) and the reactor trip occurring in conjunction with receipt of the Safety Injection System.

3. Redundant isolation of the main feedwater lines: Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main feedwater valves, any safety injection signal will rapidly close all feedwater control valves, (including the motor-operated block valves and low-flow bypass valves) trip the main feedwater pumps, and close the feedwater pump discharge valves.

4. Trip of the fast-acting Main Steam Isolation Valves (designed to close in less than 5 seconds) on:

a) High steam flow in two-out-of-four main steam lines (one-out-of-two per line), in coincidence with either low Reactor Coolant System average temperature (two-out-of-four loops) or low main steam line pressure (two-out-of-four lines) after a time delay. (maximum of 6 seconds) b) High-High containment pressure (2 sets of two-out-of-three). [energize to actuate]

Each steam line has a fast-closing Isolation Valve (MSIV) with a downstream reverse steam flow Check Valve (MSCV). These eight valves prevent blowdown of more than one steam generator for any main steamline break location even if one valve fails to close. For example, in the case of a break upstream of the MSIV in one main steam line, closure of either the MSCV in that line or the MSIVs in the other lines will prevent blowdown of the other steam generators. In particular, the arrangement precludes blowdown of more than one steam generator inside the Containment and thus prevents possible structural damage to the Containment. In addition, each of the steam generators have integral Chapter 14, Page 82 of 333 Revision 04, 2011

IP3 FSAR UPDATE venturi type flow restrictors located at the steam generator outlet nozzle.

These flow restrictors serve to limit the rate of steam release for postulated large steam breaks inside or outside containment.

14.2.5.2 Method of Analysis and Assumptions The Rupture of Steam Pipe transients are analyzed to determine: 1) the effects of the excessive cooldown on reactivity, reactor coolant system pressure, and reactor coolant system temperature for DNBR; and 2) the effects on primary-to-secondary heat transfer and secondary-side conditions for mass and energy release rates. The primary purpose of the analysis is to ensure that the required protection system features are adequate to prevent the applicable safety analysis limits from being exceeded.

Specifically, the analysis of a steam pipe rupture is performed to demonstrate that:

1) Assuming the highest worth RCCA is stuck out of the core with or without offsite power, and assuming a single failure in the engineered safety features, there is no consequential damage to the primary system and the core remains in place and intact.

2) Offsite radiation levels during the accident and post-accident control phase are acceptable (Condition IV criterion).

3) No fuel damage will occur for a credible steam line break equivalent to the spurious opening, with failure to close, of the largest of any single steam bypass, relief or safety valve (Condition II criterion).

4) Energy release to the Containment from the worst hypothetical steam line break does not cause failure of the containment structure (Condition IV criterion).

For items 1 through 3 above, the core heat flux, and the Reactor Coolant System temperature, pressure and flow transient conditions following a steam pipe rupture are determined using the RETRAN computer code (Reference 35). These transient conditions are then used to determine the thermal and hydraulic behavior of the core following a steam line break using the VIPRE computer code (Reference 36); a detailed thermal-hydraulic computer code used to determine if DNB occurs for the core conditions computed. The determination of the critical heat flux is based on local coolant conditions.

For item 4, the pressure conditions inside containment resulting from the mass and energy released to containment through the hypothetical steamline rupture are also considered. This analysis is documented in section 14.3.6.3 Core Response Analysis Two separate steam line rupture cases initiated from EOL, hot standby conditions were analyzed to determine the resulting core power and reactor coolant system transient conditions.

These cases are:

Case A - Steam pipe rupture (1.4ft2) with offsite power available.

Case B - Steam pipe rupture (1.4ft2) without offsite power available.

Other pertinent analysis assumptions that affect the core response steamline break transient conditions are as follows.

Initial Conditions Chapter 14, Page 83 of 333 Revision 04, 2011

IP3 FSAR UPDATE The plant is assumed to be operating at hot zero power (HZP) with reactor coolant system pressure equal to nominal reactor coolant system pressure of 2250psia, reactor coolant system flow rate equal to the Thermal Design Flow (TDF) rate of 354,400 gpm (total flow) a steam generator tube plugging level of 0%, reactor coolant system vessel average temperature equal to no-load Tavg of 547F, and steam generator pressure equal to the no-load pressure of 1000psia.

HZP conditions were considered for all the above cases since this represents the most limiting initial conditions for the accident. Should the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection logic when the trip setpoint is reached. Following a trip at power the Reactor Coolant System contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steamline break before the no load conditions of Reactor Coolant System temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis which assumes no load conditions at time zero. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the Reactor Coolant System cooldown are less for steamline breaks occurring at power.

In the RETRAN model, the HZP initial power level is modeled at 0.01 of the nominal core power level of 3216 MWt.

Additionally the following initial conditions are modeled:

Initial pressurizer level of 23.1% span Initial steam generator level of 45% NRS Initial core boron concentration of 0 ppm.

Shutdown Margin For the HZP initial conditions assumed in the steamline break core response analysis, the reactor is assumed to be tripped when the streamline break event occurs. All the RCCAs are assumed to be inserted with the exception of the highest worth RCCA, which is assumed to be stuck in a fully withdrawn position. With this initial configuration, the reactor is assumed to be subcritical by the minimum required 1.30% k amount of shutdown margin. This is the end-of-life design value including design margins at no load, equilibrium xenon conditions, with the most reactive RCCA stuck in its fully withdrawn position. The actual shutdown capability is expected to be significantly greater. The operation of the RCCA banks during the core burnup is restricted in such a way that addition of positive reactivity in a steamline break accident will not lead to a more adverse condition than the case analyzed.

Reactivity Coefficients The negative moderator coefficient of reactivity assumed is that corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. The Keff versus coolant temperature corresponding to the negative moderator temperature coefficient used is shown in Figure 14.2-2. In computing the power generation following a steamline break, the local reactivity feedback from the high neutron flux in the region of the core near the stuck control rod Chapter 14, Page 84 of 333 Revision 04, 2011

IP3 FSAR UPDATE assembly has been included in the overall reactivity balance. The local reactivity feedback is composed of the Doppler reactivity from the high fuel temperatures near the stuck RCCA. The effect of power generation in the core on the total core reactivity is shown in Figure 14.2-3 in the form of the Doppler power defect.

The moderator density coefficients and other physics parameters used in the RETRAN point-kinetics model are characteristic of end-of-life conditions and the resulting transient conditions calculated by RETRAN are confirmed to be conservative relative to predications made in confirmatory 3D physics models on a cycle-by-cycle reload basis.

For hypothetical breaks, the core properties associated with the sector nearest the faulted steam generator and those associated with the remaining sectors were conservatively combined to obtain average core properties for reactivity feedback calculations. A non-uniform radial weighting factor of 50% for the sector nearest the faulted steam generator, and 16.7%

each for the remaining three sectors of the core are assumed for the hypothetical steamline break cases to account for the non-uniform cooldown of the reactor coolant system. These conditions conservatively cause under-prediction of the Doppler reactivity feedback in the high power region near the stuck rod. For the power peaking factors, those corresponding to one stuck RCCA and non-uniform core inlet temperatures at end-of-life conditions are assumed. The coldest core inlet temperatures are assumed to occur in the sector with the stuck RCCA. The power peaking factors account for the effect of the local void in the region of the stuck RCCA during the return to power phase following the steamline break. This void in conjunction with the large negative moderator coefficient partially offsets the effects of the stuck RCCA. Since the power peaking factors depend on the core power, operating history, temperature, pressure and flow, they may differ from cycle to cycle.

To verify the conservatism of the assumptions used in the RETRAN point-kinetics reactivity feedback model, the reactivity as well as the power distribution are checked for the limiting statepoints of the cases analyzed. This analysis considers the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and non-uniform core inlet temperature effects in case of hypothetical breaks.

For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated including the above local effects for the statepoints. These results verify conservatism; i.e., over-prediction of positive reactivity from the cooldown and under-prediction of negative reactivity from power generation.

Offsite Power For the cases analyzed assuming offsite power is available, offsite power is assumed to be available throughout the transient which results in continuous reactor coolant pump operation such that full and constant thermal design flow rate is modeled throughout the event.

For the case analyzed, assuming a consequential loss of offsite power, the reactor coolant pumps are assumed to begin a conservative coastdown with the flywheel 3 seconds after event initiation. This results in reduction of reactor coolant system flow throughout the event (see Figure 14.2.-21).

Feedwater Chapter 14, Page 85 of 333 Revision 04, 2011

IP3 FSAR UPDATE To maximize the cooldown following the steamline break event, a full and constant main feedwater flow was conservatively modeled for the hypothetical breaks. Nominal feedwater flow is assumed at the transient initiation and continues until the time of feedwater isolation which occurs after receipt of a safety injection signal. Feedwater isolation is assumed to occur 12 seconds after the safety injection signal is generated. The 12 second delay is a conservatively long time for signal processing, valve realignment, etc. A conservatively low initial feedwater enthalpy of 40.86 Btu/Ibm is assumed for the HZP initial conditions. This corresponds to a feedwater temperature of 70F. A lower feedwater enthalpy is conservative for steamline break since it increases the magnitude of the cooldown associated with the steamline break event.

Auxiliary Feedwater Auxiliary feedwater flow is assumed to start at the transient initiation and continue throughout the transient to maximize the cooldown effects for core response. A flow rate of 1600gpm is assumed in all cases. This represents two motor driven auxiliary feedwater pumps with design flow rate of 400gpm each and one turbine pump with design flow rate of 800gpm. For the hypothetical steamline break cases, this total auxiliary feedwater flow is conservatively assumed to be delivered to the faulted steam generator.

The temperature of the auxiliary feedwater is conservatively assumed to be 35F and an auxiliary feedwater purge volume of 1 ft3 is conservatively modeled.

For both steam line break cases, the auxiliary feedwater flow is not required to mitigate the consequences of the event, but is conservative to assume early delivery and maximized flow.

Safety Injection In the steamline break analyses, the following assumptions are made regarding the safety injection system:

1) Safety injection flow rates are conservatively calculated based on a composite modeling of the minimum SI flow resulting from either a failure of one train of safety injection or a failure of the cold leg branch line motor-operated valve. In all cases, the safety injection flow rates are calculated based on all cold legs injecting into the reactor coolant system.

The safety injection flow rate as function of reactor coolant system pressure is shown in Figure 14.2-4.

2) The refueling water storage tank (RWST) contains borated water with a minimum boron concentration of 2400 ppm and all of the safety injection lines downstream of the RWST, including the boron injection tank (BIT), contain unborated water.

3) A conservatively low enthalpy of 7.23 Btu/Ibm for the safety injection fluid in the RWST and the safety injection lines is assumed. This corresponds to 35F. A lower enthalpy for the safety injection fluid is conservative since it increases and prolongs the cooldown of the reactor coolant system Chapter 14, Page 86 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4) A conservative time required to sweep the unborated water from the safety injection piping and BIT before delivering the 2400 ppm borated water from the RWST to the core is modeled.

The sequence of events in the safety injection system are as follows:

1) For the cases where offsite power is assumed, after generation of the safety injection signal (including conservative delays for the instrumentation, logic, and signal transport),

the appropriate valves begin to operate and the high-head safety injection pumps start.

2) Within 12 seconds following (1) above, the valves are assumed to be in their final position to allow full safety injection flow, and the pumps are assumed to be at full speed. This 12 second delay had been based in part on the stroke times of BIT isolation valves. Now that BIT inlet and outlet isolation valves are maintained in the open position, there are no power operated valves in the High-Head SI flowpaths which require repositioning in response to a safety injection signal. Therefore, this 12 second delay represents a conservative assumption in the safety analysis and the pumps are assumed to be at full speed.

3) In the cases where offsite power is not available, an additional 10 seconds is assumed before (2) above to model the time required to start and load the necessary safety injection equipment onto the diesel generators.

4) For safety injection and steamline isolation signals actuated on high steam flow coincident with either low reactor coolant system average temperature or low steamline pressure, an additional time delay of 6 seconds is assumed after (1) above.

For actuation of the Safety Injection System and closing of the fast-acting Main Steam Isolation Valves previously discussed, the following setpoints were assumed in the analysis for the high steam flow coincidence logic.

1) A low steamline pressure setpoint of 460 psia including uncertainties to account for channel errors and adverse environmental errors.

2) A low Tavg setpoint of 535F including uncertainty to account for channel errors.

3) A high steam flow safety injection setpoint of 78% of steam flow at full power including uncertainties for channel errors and adverse environmental errors For actuation of the Safety Injection System on a low pressurizer pressure signal, the low pressurizer pressure setpoint assumed in the analysis is 1648.7 psia, including uncertainties.

Instantaneous safety injection flow is assumed to occur whenever reactor coolant system pressure falls below safety injection pump head of 1414.7 psia at any time 12 seconds after the safety injection signal occurs.

The core response analyses of the steamline break cases assume a failed Main Steam Check Valve in the broken steamline. This conservative assumption results in additional cooldown of the Reactor Coolant System. The additional steam release out the break from the three intact steam generators continues until the MSIVs close in the intact steamlines.

Chapter 14, Page 87 of 333 Revision 04, 2011

IP3 FSAR UPDATE Heat Transfer Modeling Fuel-to-coolant heat transfer coefficients consistent with limiting end-of-cycle conditions and conservatively representing minimum fuel temperatures are assumed in the analysis.

No credit is taken for heat transfer from the thick metal throughout the reactor coolant system to the coolant.

On the secondary-side, the Westinghouse Model 44F Steam Generators were modeled in the analysis.

Decay Heat No credit is taken for decay heat since this would inhibit the cooldown of the reactor coolant system.

Steam Generator Water Entrainment Perfect moisture separation in the steam generators is assumed. This assumption leads to conservative results, especially for large breaks, since there would be considerable entrainment of the water in the steam generators following a steamline break. Entrainment of water would reduce the magnitude of the cooldown of the reactor coolant system.

Accident Simulation In determining the core power transients which can result from a steamline break, the following steamline break conditions were considered:

1) Complete severance of main steamline at the exit of the steam generator (down stream of the integral steam flow restrictors) with the plant initially at no-load conditions and all reactor coolant pumps running.

2) Case (1) above assuming a loss of offsite power resulting in a coolant pump coastdown 3 seconds following the steamline break.

These hypothetical steamline break cases represent the most severe Condition IV steamline breaks that can be postulated to occur.

Initial hot shutdown conditions were considered for all the above cases since this represents the most limiting initial conditions for the accident. Should the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection logic when the trip setpoint is reached. Following a trip at power the Reactor Coolant System contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable energy stored in the fuel. Thus, additional stored energy is removed via the cooldown caused by the steamline break before the no load conditions of Reactor Coolant System temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertion proceed in the same manner as in the analysis which assumes no load conditions at time zero. However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the Reactor Coolant System cooldown are less for steam breaks occurring at power.

Chapter 14, Page 88 of 333 Revision 04, 2011

IP3 FSAR UPDATE In computing the steam flow during a steamline break or the inadvertent opening of a steam safety valve, the Moody Curve (Reference 10) for f(L/D) = 0 is used.

The break area assumed for hypothetical breaks downstream of the flow restrictor is 1.4ft2 per loop. This area bounds that of the steamline flow restrictor. All four steam generators are assumed to blow down to atmospheric pressure through their respective flow restrictors until steamline isolation occurs on the intact steam generators.

Results Core Power and Reactor Coolant System Transients Case A: Hypothetical Steam Pipe Rupture with Offsite Power Figures 14.2-5 through 14.2-14 show the transient conditions following a complete severance of a main steamline down stream of the integral steam flow restrictor with the plant initially at no-load conditions and all reactor coolant pumps running. The break assumed is the largest break that can occur anywhere inside or outside the containment. Offsite power is assumed available such that full reactor coolant flow exists. Since the plant is initially at no-load conditions, the transient shown assumes all RCCAs are inserted at time zero with the exception of the worst stuck RCCA (as previously described) being in a fully withdrawn position.

As shown in Figure 14.2-7, the core becomes critical with the rods inserted (with the design shutdown margin and assuming the highest worth stuck RCCA) at approximately 19 seconds.

The high steam flow setpoint is reached immediately in all four loops and the low Tavg setpoint is reached in at least two loops at 11.5 seconds. The low pressurizer pressure SI setpoint is reached at 15.3 seconds. After considering appropriate time delays for processing the signal and electronics, at 17.3 seconds the actuation of safety injection on low pressurizer pressure is initiated. At 26.5 seconds, isolation of the intact steamlines via closure of the fast-acting Main Steam Isolation Valves is complete. Main feedwater isolation is complete at 27.3 seconds.

In addition, during a Main Steamline Break incident the MOVs associated with the FRVs also will close. These MOVs are powered from MCC 311. MCC 311 is not stripped from Bus 5A.

The mechanical stroke time of 120 seconds to close these associated MOVs has been analyzed and is acceptable.

At 29.3 seconds, full safety injection flow capability of the available safety injection pumps is reached. After purging unborated water from the safety injection lines down stream of the refueling water storage tank, borated water finally reaches the core at approximately 37 seconds after initiation of the steamline rupture event. The peak core average heat flux for this case is 10% of the nominal full power value of 3216 MWt as shown in Figure 14.2-6.

The sequence of events for this case is summarized in Table 14.2-5.

Case B: Hypothetical Steam Pipe Rupture with Loss of Offsite Power Case B is the same steamline break as that in Case A except that offsite power is assumed to be lost at the time of the break which results in a power loss to the reactor coolant pumps and subsequent reactor coolant system flow coastdown. The loss of offsite power also requires startup of the diesel generators in order to power the safety injection pumps.

Chapter 14, Page 89 of 333 Revision 04, 2011

IP3 FSAR UPDATE Figures 14.2-15 through 14.2-25 show the transient conditions for Case B. As shown in Figure 14.2-17, the core becomes critical with the rods inserted (with the design shutdown margin and assuming the worst stuck RCCA) at approximately 24 seconds. The high steam flow setpoint is reached immediately in all four loops and the low Tavg setpoint is reached in at least two loops at 12.6 seconds. The low pressurizer pressure SI setpoint is reached at 16.9 seconds.

After considering appropriate time delays for processing the signal and electronics, at 18.9 seconds the actuation of safety injection on low pressurizer pressure is initiated. At 27.6 seconds, isolation of the intact steamlines via closure of the fast-acting Main Steam Isolation Valves is complete. Main feedwater isolation is complete at 28.9 seconds. However, with the assumption of a loss of offsite power, diesel generator startup is required to power the safety injection pumps. A total of 24 seconds is assumed for diesel generator start and to get the safety injection pumps and valves aligned before reaching the full safety injection flow capability of the available safety injection pumps. At 41 seconds, full safety injection flow capability of the available safety injection pumps is reached. After purging the unborated water from the safety injection lines down stream of the refueling water storage tank, borated water finally reaches the core at approximately 75 seconds after initiation of the steamline rupture event. The peak core average heat flux for this case is 8.9% of the nominal value of 3216 MWt as shown in Figure 14.2-16.

Figure 14.2-21 shows the reactor coolant flow coastdown resulting from the loss of offsite power for this case. The sequence of events for this case are summarized in Table 14.2-6.

Margin to Critical Heat Flux Based on the transient conditions for Cases A and B, a DNBR evaluation was performed using the W-3 DNBR correlation. This evaluation showed that Case A (hypothetical steamline break with offsite power available) is the most limiting case with respect to minimum DNBR and the resulting minimum DNBR is greater than the applicable safety analysis DNBR limit. The minimum DNBR for this case was reached at approximately 50 seconds.

Containment Response The results for the analyses performed to determine the pressure response inside containment resulting from the steamline break mass and energy releases are contained in Section 14.3.6.

Conclusions Although DNB and possible clad perforation is acceptable for a Condition IV event, the Core Response analysis performed herein for the Rupture of a Steam Pipe event has demonstrated that DNB does not occur.

Hence, the analysis and evaluations contained herein for the Rupture of a Steam Pipe event demonstrate that all applicable Indian Point Unit 3 licensing basis safety analysis criteria are satisfied.

14.2.5.5 Dose Evaluation The assumptions and parameters for the steamline break accident dose analyses are given in Table 14.2-9. The dose calculation methodology from Appendix 14C is followed.

Chapter 14, Page 90 of 333 Revision 04, 2011

IP3 FSAR UPDATE Offsite Doses The calculated doses are:

Site Boundary Dose Low Population Zone (rem TEDE) Dose (rem TEDE)

Pre-Existing Iodine Spike 0.2 0.3 Accident-Initiated Iodine 0.5 0.8 Spike For the site boundary dose, the limiting 2-hour interval for the pre-existing spike case is 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and the limiting 2-hour interval for the accident-initiated spike case is 3-5 hours.

The offsite doses for the pre-existing spike case are less than 25 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183. The offsite doses for the accident-initiated spike case are less than 2.5 rem TEDE which is the dose acceptance limit defined in Regulatory Guide 1.183 Control Room Doses Using the assumptions and method of analysis presented in Appendix 14C for the control room dose analysis model, the doses in the Control Room following a main steam line break are given below.

Pre-Existing Iodine Spike 0.6 rem TEDE Accident-Initiated Iodine Spike 2.1 rem TEDE The control room dose for each case is less than 5.0 rem TEDE dose limit from 10 CFR 50.67.

14.2.6. Rupture Of a Control Rod Drive Mechanism Housing (RCC Assembly Ejection) 14.2.6.1 Description Of Accident This accident is a result of any extremely unlikely mechanical failure of a control rod mechanism pressure housing such that the Reactor Coolant System pressure would then eject the RCC assembly and drive shaft. The consequences of this mechanical failure, in addition to being a minor Loss-of-Coolant Accident, may also be a rapid reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage for severe cases.

The resultant core thermal power excursion is limited by the Doppler reactivity effect of the increased fuel temperature and terminated by reactor trip actuated by high neutron flux signals.

14.2.6.2 Design Precautions And Protection Certain features in Westinghouse pressurized water reactors are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur.

These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens Chapter 14, Page 91 of 333 Revision 04, 2011

IP3 FSAR UPDATE the potential ejection worth of RCC assemblies and minimizes the number of assemblies inserted at high power levels.

Mechanical Design The mechanical design is discussed in Chapter 3. An evaluation of the mechanical design and quality control procedures indicates that a failure of a control rod mechanism housing sufficient to allow a control rod to be rapidly ejected from the core should not be considered credible for the following reasons:

1) Each Control Rod Mechanism (CDRM) housing was completely assembled and shop-tested at 4100psi for the full-length CDRM housing.

2) The mechanism housing were field hydrotested to 3750psig during installation.

3) Stress levels in the mechanism are not affected by anticipated system transients at power or by the thermal movement of the coolant loops. Moments induced by the design earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class A components.

4) The latch mechanism housing and rod travel housing are type 304 stainless steel.

The material exhibits excellent notch toughness at all temperatures that will be encountered.

A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing and head adapter, and between the latch mechanism housing and rod travel housing are threaded joints reinforced by canopy type rod welds. Administrative procedures require periodic inspections of these (and other) welds.

Nuclear Design Even if a rupture of the control rod mechanism housing is postulated, the operation of a chemical shim plant is such that the severity of an ejected RCC assembly is inherently limited.

In general, the reactor is operated with RCC assemblies inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control rod banks are selected during nuclear design to lessen the severity of an ejected assembly.

Therefore, should an RCC assembly be ejected from the reactor vessel during normal operation, there would probably be no reactivity excursionsince most of the RCC assemblies are fully withdrawn from the core-or a minor reactivity excursion if an inserted assembly is ejected from its normal position.

However, it may be desirable on occasion to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCC assemblies above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all assemblies is continuously indicated in the Control Room. An alarm will occur if a bank of RCC assemblies approaches its insertion limit or if one assembly deviates from its bank. There are low and low-low level insertion monitors with visual and audio Chapter 14, Page 92 of 333 Revision 04, 2011

IP3 FSAR UPDATE signals. Operating instructions require boration at low level alarm and emergency boration at the low-low alarm. The RCC assembly position monitoring and alarm systems are described in detail in Chapter 7.

Reactor Protection The reactor protection in the event of a rod ejection accident is described in WCAP-7306. (3)

Effects On Adjacent Housings Disregarding the remote possibility of the occurrence of a control rod mechanism housing failure, investigations have shown that failure of a control rod housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings that would increase the severity of the initial accident.

14.2.6.3 Limiting Criteria Due to the extremely low probability of a rod ejection accident, some fuel damage could be considered an acceptable consequence, provided there is no possibility of the offsite consequences exceeding 25% the dose limit guidelines of 10 CFR 50.67 (this limit is identified in Regulatory Guide 1.183). Although severe fuel damage to a portion of the core may in fact be acceptable, it is difficult to treat this type of accident on a sound theoretical basis. For this reason, criteria for the threshold of fuel failure are established, and it is demonstrated that this limit will not be exceeded.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy, have been carried out as part of the SPERT project by the Idaho Nuclear Corporation.(4) Extensive tests of U02 -Zirconium clad fuel rods representative of those in PWR-type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT(5) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases about 10% with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; a catastrophic failure. (large fuel dispersal, large pressure rise) event for irradiated rods did not occur following 300 cal/gm.

In view of the above experimental results, and due to the low probability of an RCCA Ejection, this accident is classified as a Condition IV event. The applicable Condition IV criteria are that the RCS and the core must remain able to provide long term cooling, and off-site doses must remain within the 25% of the dose guidelines of 10 CFR 50.67. The specific (and more restrictive) criteria that Westinghouse uses to ensure that the Condition IV criteria are met are as follows:

1) Average fuel pellet enthalpy at the hot spot must be below 200 cal/gm (360 Btu/Ibm),

2) Average clad temperature at the hot spot must remain below 3000F (Reference 37),

3) Zirc-H20 reaction is less than 16%,

4) Fuel melting will be limited to less than 10% of the fuel volume at the hot spot, and Chapter 14, Page 93 of 333 Revision 04, 2011

IP3 FSAR UPDATE

5) The peak reactor coolant pressure must remain less than that which would cause stresses to exceed the Faulted Condition stress limits.

Criteria 2 and 3 are used by Westinghouse to demonstrate that the core remains in a coolable geometry during a Rod Ejection transient. However, the Nuclear Regulatory Commission (NRC) identifies Criterion 1 as the limit which ensures the core coolablity is maintained Criterion 5 is addressed generically for the RCCA Ejection event in Reference 6.

Method of Analysis and Assumptions The RCCA Ejection transient is simulated using TWINKLE and FACTRAN computer codes described in References 28 and 29. Cases are analyzed for four conditions; BOL-HZP, BOL-HFP, EOL-HZP, and EOL-HFP.

The following major assumptions are made in performing the RCCA Ejection analysis:

Initial Conditions:

HZP Cases HFP Cases Power Level (fraction of nominal) 0 1.02 RCS Pressure (psia) 2190 2190 Vessel Average Temperature (F) 547.0 579.5 RCS Flow (fraction of TDF) 0.482 1.0 For the hot zero power cases, RCS flow is conservatively modeled at 46% of Thermal Design Flow (TDF), representing only two reactor coolant pumps in operation. An additional penalty of 0.0118 is applied to account for the affects of loop-to-loop RCS flow asymmetry due to steam generator tube plugging asymmetry. The full power cases assume 100% TDF representing all reactor coolant pumps in operation.

1) eff, the delayed neutron fraction at BOL is equal to 0.0050 and eff at EOL is equal to 0.0040.

2) Conservative values of trip reactivity are used assuming a stuck rod in addition to the ejected rod. These values are 4% k for the full power cases and 2% k for the zero power cases. Trip reactivity insertion is simulated by dropping a rod of the required worth into the core from full-out position. The rod drop time assumed is 2.7 seconds.

3) For the RCCA Ejection event, protection is provided by a power range High Flux reactor trip. The HFP cases are modeled to trip on a high setpoint of 118% of nominal, including uncertainties. A low setpoint of 35% nominal, including uncertainties, is modeled for the HZP cases.

4) The time delay after the trip setpoint is reached and before the rods start to fall is set to 0.55 seconds. This includes time for processing the trip signal, opening of the trip breaker and releasing of the rods from the coil.

5) No control systems are simulated.

Chapter 14, Page 94 of 333 Revision 04, 2011

IP3 FSAR UPDATE

6) The accident is initiated in the TWINKLE code by linearly changing the initial keff by an amount of equal to the worth of the ejected rod over a 0.1 second time span.

Table 14.2-11 provides additional input assumptions used in the analysis.

7) The following table summarizes the Ejected Rod Worths (% k), the transient hot channel factors (FQs) and the Doppler Weighting Factors which were used in each of the Rod Ejection cases analyzed herein.

Ejected Rod Doppler Case Worth (%k) FQ Weighting Factor BOL-HZP 0.65 12.0 2.16 EOL-HZP 0.80 20.0 2.95 BOL-HFP 0.17 6.80 1.46 EOL-HFP 0.20 7.10 1.50 Results The sequence of events is provided in Table 14.2-10.

Figures 14.2-48 and 14.2-49 illustrate the fuel rod temperature and nuclear power transients for the EOL-HZP case; the case which results in the highest clad average temperature and magnitude of Zirc-H20 reaction. Figures 14.2-50 and 14.2-51 illustrate the fuel rod temperature and nuclear power transients for the BOL-HFP case. The latter case results in the maximum fuel enthalpy of the four cases considered and has the highest amount of fuel exceeding the fuel melting temperature (4900F at BOL).

A summary of the results are as follows:

Peak Avg. Fuel Peak Clad Avg. Zirc-H20 Enthalpy Temperature* Fuel Melt* Reaction*

Case (Btu/Ibm) (F) (%) (%)

BOL-HZP 182.3 1892 0.00 0.32 EOL-HZP 228.9 2320 0.00 1.17 BOL-HFP 325.0 2256 7.78 0.88 EOL-HFP 312.7 2177 7.52 0.73 Limit <360.0 <3000 <10.0 <16.0 Additional results are presented in Table 14.2-12.

• Note: at the hot spot Environmental Consequences Analysis As a result of the accident, fuel clad damage and a small amount of fuel melt are assumed to occur. Due to the pressure differential between the primary and secondary systems, radioactive reactor coolant is discharged from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Iodine and alkali metals group activity is contained in the secondary coolant prior to the accident, and some of this activity is also released to the Chapter 14, Page 95 of 333 Revision 04, 2011

IP3 FSAR UPDATE atmosphere as a result of steaming the steam generators following the accident. Finally, radioactive reactor coolant is discharged to the containment via the spill from the opening in the reactor vessel head. A portion of this radioactivity is released through containment leakage to the environment. The radiological consequences of this accident are determined using the analysis modeling described in Appendix 14C.

As a result of the rod ejection accident, less than 10% of the fuel rods in the core undergo DNB.

In determining the offsite doses following the rod ejection accident, it is conservatively assumed that 10% of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Consistent with Regulatory Guide 1.183, a gap fraction of 10% is assumed for iodine and noble gas activity. Additionally, 12% of the alkali metal activity is assumed to be in the gap.

The core activity is provided in Table 14C-4 and it is assumed that the damaged fuel rods have all been operating at the maximum radial peaking factor of 1.70.

A small fraction of the fuel in the failed fuel rods is assumed to melt as a result of the rod ejection accident. This amounts to 0.25% of the core and the melting takes place in the centerline of the affected rods. Consistent with Regulatory Guide 1.183, for the containment leakage release pathway 25% of the iodine activity and 100% of the noble gas activity are assumed to enter the containment but for the secondary system release pathway 50% of the iodine activity and 100% of the noble gas activity are assumed. Additionally, for both pathways it is assumed that 100% of the alkali metal activity from the melted fuel is available for release.

The primary coolant iodine concentration is assumed to be at the equilibrium operating limit of 1.0µCi/gm of dose equivalent I-131 prior to the rod ejection accident. The alkali metals and noble gas activity concentrations in the RCS at the time the accident occurs are based on operation with a fuel defect level of one percent. The iodine activity concentration of the secondary coolant at the time the rod ejection accident occurs is assumed to be 0.10 µCi/gm of dose equivalent I-131.

Regulatory Guide 1.183 specifies that the iodine released from the fuel is 95% particulate (cesium iodide), 4.85% elemental, and 0.15% organic. These fractions are used for the containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.

Conservatively, all the iodine, alkali metals group and noble gas activity (from prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.

The primary to secondary steam generator tube leak used in the analysis is 1.0 gpm total for all steam generators combined.

When determining the doses due to containment leakage, all of the iodine, alkali metal and noble gas activity is assumed to be in the containment. The design bassis containment leak rate of 0.1% per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter, the containment leak rate is assumed to be one-half the design value, or 0.05% per day. Releases are continued for 30 days from start of the event.

No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite power. All noble gas activity carried over to the secondary Chapter 14, Page 96 of 333 Revision 04, 2011

IP3 FSAR UPDATE side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere. Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.

An iodine partition factor in the steam generators of 0.01 curies/gm steam per curries/gm water is used. A partition factor of 0.001 is used for the alkali metal activity in the steam generators.

For the containment leakage pathway, credit is taken for removal of aerosols (iodine in the aerosol form and alkali metals) by the HEPA filters in the fan cooler units (FCU). Three of the five FCUs are assumed to be in operation with a fraction of the flow (8000 cfm per FCU) directed through the filters. No credit is taken for the FCU charcoal filters. No credit is taken for sedimentation removal of aerosols or for deposition removal of elemental iodine onto containment surfaces. It is assumed that the containment spray system, which would remove both airborne particles and elemental iodine is not actuated.

The resulting offsite doses are:

Site Boundary 4.4 rem TEDE Low Population Zone 2.2 rem TEDE The limiting 2-hour dose interval for the site boundary dose determination is 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The offsite doses are less than 25-percent of the value of 10 CFR 50.67 (less than 6.3 rem TEDE) which is the dose acceptance limit identified in Regulatory Guide 1.183.

The accumulated dose to the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite doses and using the control room model discussed in Appendix 14C. The calculated control room dose is 0.9 rem TEDE. This is less than the 5.0 rem TEDE control room dose limit value of 10 CFR 50.67.

==

Conclusions:==

The results of the analysis of the RCCA Ejection event described herein show that all safety criteria are met. Specifically, the maximum clad average temperature is less than 3000F, maximum fuel enthalpy is less than 360 BTU/Ibm, fuel melting is less than 10%, and Zirc-H2O reaction is less than 16%. These are all hot spot results.

The peak reactor coolant pressure, which is addressed generically for the RCCA Ejection event in Reference 6, remains less than that which cause stresses to exceed the Faulted Conditions stress limits.

Based on these results, concluded that the RCS and the core will remain able to provide long term cooling, and doses are within the acceptance limits.

References

1. Deleted

2. MARVEL-A Digital Computer Code for Transient Analysis of a Multi-loop PWR System, WCAP-8844, November 1977.

Chapter 14, Page 97 of 333 Revision 04, 2011

IP3 FSAR UPDATE

3. Burnett, T.W.T., Reactor Protection System Diversity in a Westinghouse Pressurized Water Reactor, WCAP-7306, April 1963

4. Taxelius, T.G., ed. Annual Report-Spert Project, October 1968 September 1969, Idaho Nuclear Corporation TID-4500, June 1970.

5. Liimatainen, R.C. and F.J. Testa, Studies in TREAT of Zircaloy-2-clad, UO2-Core Simulated Fuel Elements, Argonne National Laboratory, Chemical Engineering Division Semi-Annual Report, ANL-7225, January-June 1966.

6. Risher, D.H., An Evaluation of the Rod Ejection Accident in Westinghouse PWRs Using Special Kinetics Methods, WCAP-7588, Rev. 1A, January 1975.

7. Henry, A.F. and A.V. Vota, WIGLE2-A Program for the Solution of the One-Dimensional Two-Group, Space-Time Diffusion Equations Accounting for Temperature, Xenon and Control Feedback, WAPD-TM-532, October 1965.

8. French, R.J. et al, Indian Point Unit No. 2 Rod Ejection Analysis, WCAP2940, May 1966.

9. Farman, R.F., J.O. Cerman, Post DNB Heat Transfer During Blow-Down, WCAP-9005, Proprietary, October 1968.

10. Moody, F.S. Transactions of the ASME Journal of Heat Transfer, page 134, Figure 3 February 1965.

11. Tong, L.S. Prediction of Departure from Nucleate Boiling for an Axially Non-Uniform Heat Flux Distribution, Journal of Nuclear Energy, Volume 21, 1967.

12. Reload Safety Evaluation - Indian Point Nuclear Plant Unit 3, Cycle 3, dated August, 1979.

13. Reload Safety Evaluation, Indian Point Nuclear Plant Unit 3, Cycle 2. February, 1978

14. T.W. T. Burnett, Et al., LOFTRAN Code Description, WCAP-7907-P-A (Proprietary),

WCAP-7907-A (Non-Proprietary), April 1984.

15. Hochreiter, L..E., Chelmer, H., Chu, P.T., THINC IV, An Improved Program for Thermal Hydraulic Analysis of Rod Bundle Cores, WCAP-7956, June 1973.

16. Deleted

17. WCAP-12269, Containment Margin Improvement Analysis For Indian Point Unit 3, May 1989.

18. WCAP-12313, Safety Evaluation for An Ultimate Heat Sink Temperature Increase to 95F at Indian Point Unit 3, July 1989.

19. NYPA Corporate Radiological Engineering Calculation IP3-CALC-RAD-00007, Replacement of R11/R12 Containment Radiation Monitors- Impact on FSAR Analysis of a Fuel Handling Accident, March 3, 1992.

Chapter 14, Page 98 of 333 Revision 04, 2011

IP3 FSAR UPDATE

20. US NRC Regulatory Guide 1.25, Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility of Boiling Water and Pressurized Water Reactors, March 23, 1972.

21. Deleted

22. Deleted

23. Deleted

24. Deleted

25. SECL-92-131, High Head Safety Injection Flow Changes Safety Evaluation, Westinghouse Electric Corp., June 1992.

26. SECL-92-255, Feedwater Regulating Valve Stroke Time Change Safety Evaluation, Westinghouse, November 1992.

27. SECL-97-135, Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties, Westinghouse March 1998.

28. Risher, D.H., Jr. and Barry, R.F., TWINKLE-A Multi-Dimensional Neutron Kinetics Computer Code, WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary),

January 1975.

29. Hargrove, H.G., FACTRAN-A Fortran IV Code for Thermal Transients in the UO2 Fuel Rod, WCAP-7908-A, December 1989.

30. Baker, D.A. et al., Assessment of the Use of Extended Burnup Fuel in Light Water Reactors, NUREG/CR-5009, February 1988.

31. Deleted

32. WCAP-7828, Radiological Consequences of a Fuel Handling Accident

33. SAE-TA-99-292, NON-LOCA Evaluation of 4 Percent PSV Setpoint Tolerance for IP3, Rev. 0, Westinghouse Electric Company, October 1999.

34. Westinghouse Letter INT-99-254, SLB Inside Containment Sensitivities for FCV Failure, October 8, 1999.

35. D. S. Huegel, et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, WCAP-14882-P-A (Proprietary), WCAP-15234-A (Non-Proprietary), April 1999.

36. Y. X. Sung, et al., Vipre-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-A (Proprietary), WCAP-15306 (Non-Proprietary), October 1999.

Chapter 14, Page 99 of 333 Revision 04, 2011

IP3 FSAR UPDATE

37. Letter from W. J. Johnson of Westinghouse Electric Corporation to Mr. R. C. Jones of the Nuclear Regulatory Commission, Letter Number NS-NRC-89-3466, Use of 2700°F PCT Acceptance Limit in Non-LOCA Accidents, October 23, 1989.

38. US NRC Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

Chapter 14, Page 100 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-1 Assumptions and Parameters for the Fuel Handling Accident Analysis

1. Core inventory at 84 hours9.722222e-4 days <br />0.0233 hours <br />1.388889e-4 weeks <br />3.1962e-5 months <br /> after shutdown; I-130 3.41E4 Curies I-131 6.90E7 I-132 6.38E7 I-133 1.17E7 I-134 0.0 I-135 2.63E4 Kr-85m 5.62E1 Kr-85 1.11E6 Kr-87 0.0 Kr-88 0.0 Xe-131m 9.71E5 Xe-133m 2.78E6 Xe-133 1.36E8 Xe-135m 4.21E3 Xe-135 7.86E5 Xe-138 0.0

2. Number of assemblies in the reactor core = 193.

3. All fuel pins in the dropped fuel assembly are broken.

4. Decay time experienced prior to fuel movement = 84 hrs.

5. Atmospheric dispersion factor (offsite and for control room air intake) are provided in Appendix 14C.

6. Operating power in the damaged assembly is 1.70 times core average (this is the design radial peaking factor for the fuel).

7. The fission product gap fractions are assumed to be ten percent of all nuclides except Kr-85 which is assumed to be 30 percent and I-131 which is assumed to be 12 percent.

This is consistent with Reg. Guide 1.25 as modified by NUREG/CR-5009.

8. The iodine is 99.85 percent cesium iodide which is assumed to immediately convert to the elemental form and 0.15 percent organic (this is consistent with Reg. Guide 1.183).

9. There is scrubbing removal of the elemental iodine in the water pool. The overall decontamination factor achieved by scrubbing is assumed to be 200 (consistent with Reg. Guide 1.183).

10. The breathing rate is 3.5E-4 m3/sec (consistent with Reg. Guide 1.183).

11. For the accident postulated to occur in the spent fuel pit, no credit is taken for the fact that releases to the environment would pass through charcoal filters.

Chapter 14, Page 101 of 333 Revision 04, 2011

IP3 FSAR UPDATE

12. For the accident postulated to occur inside the containment, credit is not taken for isolation on the containment purge.

13. For the accident postulated to occur inside the containment, no credit is taken for the fact that releases to the environment would pass through the charcoal filter.

14. The nuclide decay constants and dose conversion factors are given in Appendix 14C.

15. Control room modeling assumptions are detailed in Appendix 14C.

Chapter 14, Page 102 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-2 Volume Control Tank Noble Gas Activity Isotope Activity (Ci)

Kr-85m 1.61E2 Kr-85 2.24E2 Kr-87 4.96E1 Kr-88 2.40E2 Xe-131m 3.95E2 Xe-133m 4.18E2 Xe-133 3.04E4 Xe-135m 7.54E1 Xe-135 9.57E2 Xe-138 6.68E0 Tables 14.2-3 & 14.2-4 Deleted Chapter 14, Page 103 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-5 Sequence of Events For the Rupture of a Steam Pipe Event Hypothetical Steamline Break With Offsite Power EVENT Time, Seconds Double-Ended Steamline Rupture in Loop 1 (1.4ft2) 0.00 High Steamline Flow Setpoint Reached (2/4 loops) 0.25 High Steamline Flow Signal Generated (2/4 loops) 8.25 Low-Low Tavg Setpoint Reached in Loop 1 8.81 Low-Low Tavg Setpoint Reached in Loop 2 11.53 Low Pressurizer Pressure SI Setpoint Reached 15.29 Low-Low Tavg Signal Generated in Loop 1 16.81 Safety Injection and FWI Actuation due to Lower Pressurizer Pressure 17.29 Low-Low Tavg Signal Generated in Loop 2 19.53 SLI Actuation due to Coincidence of Low-Low Tavg (2/4 loops) / 19.54 High Steam Flow (2/4 loops) ESF MSIV Closure Loops 1, 2, 3, and 4 26.44(1)

MFIV Closure Loops 1, 2, 3, and 4 27.19(1)

Safety Injection Flow Initiated 29.31 Peak Core Heat Flux Occurs 39.80 Note: Plus an additional 0.1 second for valve closure time.

Chapter 14, Page 104 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-6 Sequence of Events For the Rupture of a Steam Pipe Event Hypothetical Steamline Break With Loss of Offsite Power Event Time, Seconds Double-Ended Steamline Rupture in Loop 1 (1.4ft2) 0.00 High Steamline Flow Setpoint Reached (2/4 loops) 0.25 Loss of Offsite Power (RCPs begin coasting down) 3.00 High Steamline Flow Signal Generated (2/4 loops) 8.25 Low-Low Tavg Setpoint Reached in Loop 1 9.24 Low-Low Tavg Setpoint Reached in Loop 2 12.56 Low Pressurizer Pressure SI Setpoint Reached 16.94 Low-Low Tavg Signal Generated in Loop 1 17.24 Safety Injection and FWI Actuation due to Low Pressurizer Pressure 18.94 Low-Low Tavg Signal Generated in Loop 2 20.56 SLI Actuation due to Coincidence of Low-Low Tavg (2/4 loops) / 20.57 High Steam Flow (2/4 loops) ESF MSIV Closure Loops 1, 2, 3 and 4 27.47(1)

MISIV Closure Loops 1, 2, 3 and 4 28.84(1)

Safety Injection Flow Initiated 40.95 Peak Core Heat Flux Occurs 67.72 Note:1. Plus an additional 0.1 second for valve closure time.

Chapter 14, Page 105 of 333 Revision 04, 2011

IP3 FSAR UPDATE Tables 14.2-7 & 14.2-8 Deleted Chapter 14, Page 106 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-9 Initial Conditions and Input Data For Steam Pipe Rupture Dose Analysis Source Term Nuclide Parameters See Table 14C-5 Primary Coolant Noble Gas Activity prior to Accident Based on operation with 1.0% Fuel Defects (See Table 9.2-5)

Primary Coolant Iodine Activity prior to Accident Pre-Existing Spike 60 µCi/gm of DE I-131 (See Table 14C-2)

Accident-Initiated Spike 1.0 µCi/gm of DE I-131 (See Table 14C-2)

Primary Coolant Iodine Appearance Rate Increase Due to 500 times equilibrium rate the Accident-Initiated Spike (See Table 14C-3)

Duration of Accident-Initiated Spike 3.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> Secondary Coolant Iodine Activity prior to Accident 0.1 µCi/gm of DE I-131 Iodine Chemical Form after Release to Atmosphere Elemental 97%

Organic 3%

Particulate (cesium iodide) 0%

Release Modeling Faulted SG Tube Leak Rate 432 gpd Intact SG Tube Leak Rate (for all 3 SGs) 1008 gpd SG Iodine Steam/Water Partition Coefficient Intact SG 0.01 Faulted SG 1.0 Time for RHR to take over cooling 29 hours3.356481e-4 days <br />0.00806 hours <br />4.794974e-5 weeks <br />1.10345e-5 months <br /> Time to Cool RCS Below 212°F and Stop Releases from 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Faulted SG Steam Release from Intact SGs to Enviroment 0-2 hours 402,000 lbm 2-29 hours 2,273,500 lbm Steam Release from Faulted SG to Enviroment (during 142,400 lbm first 5 minutes)

Primary Coolant Mass 1.96E8 gm Intact Steam Generator Secondary Mass 70,400 lbm/SG Faulted Steam Generator Secondary Mass 142,400 lbm Offsite Atmospheric Factors See Table 14C-6 Offsite Breathing Rates 0-8 hours 3.5E-4 m3/sec 8-24 hours 1.8E-4 m3/sec

>24 hours 2.3E-4 m3/sec Control Room Model See Appendix 14C Time to Start Crediting Emergency Control Room HVAC 1 minute Chapter 14, Page 107 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-10 Sequence of Events RCCA Ejection (All Times in Seconds)

BOL-HZP EOL-HZP BOL-HFP EOL-HFP RCCA Ejected 0.0 0.0 0.0 0.0 Reactor Trip 0.34 0.18 0.05 0.04 Setpoint Reached Peak Nuclear Power 0.40 0.21 0.13 0.13 Rods Drop 0.89 0.73 0.60 0.59 Peak Fuel Average 2.65 1.78 2.36 2.48 Temperature Occurs Peak Clad 2.52 1.56 2.46 2.56 Temperature Occurs Chapter 14, Page 108 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-11 PARAMETERS FOR RCC ASSEMBLY EJECTION ANALYSIS Time in Life BOL BOL EOL EOL Power Level, % 0 102 0 102 Ejected rod worth, %dk 0.65 0.17 0.80 0.20 Delayed neutron fraction, % 0.50 0.50 0.40 0.40 Feedback reactivity weighting 2.16 1.46 2.95 1.5 Trip Reactivity, % dk./k 2.0 4.0 2.0 4.0 Initial Hot spot gap heat transfer coefficient, Btu/hr-ft2-F 460

• 460

• Transient hot spot gap heat transfer coefficient, Btu/hr-ft2-F 10,000 10,000 10,000 10,000 Initial moderator density coefficient, +0.04 +0.04 +0.27 +0.27 dk/gm/cm3 Fq before rod - 2.56 - 2.56 ejection Fq after rod 12.0 6.8 20.0 7.1 ejection Number of pumps 2 4 2 4

• This value automatically calculated to satisfy initial temperature distributions Chapter 14, Page 109 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-12 Deleted Chapter 14, Page 110 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.2-13

SUMMARY

OF ROD EJECTION ANALYSIS PARAMETERS AND RESULTS Time in cycle Accident Parameters Beginning Beginning End End Initial Power, % Rated 0 102 0 102 Power Ejected Rod Worth, % Dk/k 0.65 0.17 0.80 0.20 Delayed Neutron Fraction .0050 .0050 0.0040 0.0040 (beff)

FQ during Event 12.0 6.8 20.0 7.1 Results Max Fuel Centerline 2900 (1) 3425 (1)

Temperature (F)

Max. Clad Average 1892 2256 2320 2177 Temperature (F)

Max Fuel Enthalpy 182.3 325.0 228.9 312.7 (1) Less than 10% fuel centerline melt at the fuel hot spot.

Note: Fore each fuel cycle, the specific rod ejection kinetics are calculated to show compliance with analytical limits. This is documented in the cycle-specific Reload Safety Evaluation.

Chapter 14, Page 111 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.3 LOSS-OF-COOLANT-ACCIDENTS 14.3.1 Identification of Causes and Frequency Classification A Loss-of-Coolant Accident (LOCA) is the result of a pipe rupture of the Reactor Coolant System (RCS) pressure boundary. A major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0 ft2. This event is considered a limiting fault, an ANS Condition IV event, in that it is not expected to occur during the lifetime of the plant, but is postulated as a conservative design basis.

A minor pipe break (small break) is defined as a rupture of the RCS pressure boundary with a total cross-sectional area less than 1.0 ft2, in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered an ANS Condition III event in that it is an infrequent fault that may occur during the life of the plant.

A leak (smaller than a break) can be compensated by the charging system.

It must be demonstrated that there is a high level of probability that the Acceptance Criteria for the LOCA as described in 10 CFR 50.46 (Reference 1) are met.

1) There is a high level of probability that the peak cladding temperature (PCT) shall not exceed 2200°F.

2) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react.

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling. This requirement is met by demonstrating that the PCT does not exceed 2200°F, the maximum local oxidation does not exceed 17%, and the seismic and LOCA forces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled.

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core.

These criteria were established to provide significant margin in ECCS performance following a LOCA.

Reference 2 presents a study in regard to the probability of occurrence of RCS pipe ruptures.

In most cases, small breaks (less than 1.0 ft2) yield results with more margin to the acceptance criteria limits than large breaks.

14.3.2 Sequence of Events and Systems Response Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection actuation signal is generated when the appropriate setpoint is reached. These actions will limit the consequences of the accident in two ways:

Chapter 14, Page 112 of 333 Revision 04, 2011

IP3 FSAR UPDATE

1) Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat. An average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA core remains subcritical. However, no credit is taken for the insertion of control rods to shut down the reactor in the large break analysis.

2) Injection of borated water provides for heat transfer from the core and prevents excessive clad temperature.

Description of Large Break LOCA Transient Before the break occurs, the reactor is assumed to be in a full power equilibrium condition, i.e., the heat generated in the core is being removed through the steam generator secondary system. At the beginning of the blowdown phase, the entire RCS contains sub-cooled liquid (except for pressurizer, which is at Tsat) which transfers heat from the core by forced convection with some fully developed nucleate boiling. During blowdown, heat from fission product decay, hot internals and the vessel, continues to be transferred to the reactor coolant. After the break develops, the time to departure from nucleate boiling is calculated. Thereafter, the core heat transfer is unstable, with both nucleate boiling and film boiling occurring. As the core becomes voided, both transition boiling and forced convection are considered as the dominant core heat transfer mechanisms. Heat transfer due to radiation is also considered.

The heat transfer between the RCS and the secondary system may be in either direction, depending on the relative temperatures. In the case of the large break LOCA, the primary pressure rapidly decreases below the secondary system pressure and the steam generators are an additional heat source. In the Indian Point 3 Nuclear Power Plant Large Break LOCA analysis using the Best-Estimate methodology, the steam generator secondary is conservatively assumed to be isolated (main feedwater and steam line) at the initiation of the event to maximize the secondary side heat load.

Performance Criteria for Emergency Core Cooling System The reactor is designed to withstand thermal effects caused by a loss-of-coolant accident including the double-ended severance of the largest reactor cooling system cold leg pipe. The reactor core and internals together with the Emergency Core Cooling System (ECCS) are designed so that the reactor can be safely shut-down and the essential heat transfer geometry of the core preserved following the accident. Long-term coolability is maintained.

When the RCS depressurizes to approximately 674.7 psia (nominal), the accumulators begin to inject borated water into the reactor coolant loops. Borated water from the accumulator in the broken loop is assumed to spill to containment and be unavailable for core cooling for breaks in the cold leg of the RCS. Flow from the accumulators in the intact loops may not reach the core during depressurization of the RCS due to the fluid dynamics present during the ECCS bypass period. ECCS bypass results from the momentum of the fluid flow up the downcomer due to a break in the cold leg, which entrains ECCS flow out toward the break. Bypass of the ECCS diminishes as mechanisms responsible for the bypassing are calculated to be no longer effective.

The blowdown phase of the transient ends when the RCS pressure reaches approximately 40 psia.

After the end of the blowdown, refill of the reactor vessel lower plenum begins. Refill is completed when emergency core cooling water has filled the lower plenum of the reactor vessel, which is Chapter 14, Page 113 of 333 Revision 04, 2011

IP3 FSAR UPDATE bounded by the bottom of the active fuel region of the fuel rods (called bottom of core (BOC) recovery time).

The reflood phase of the transient is defined as the time period lasting from BOC recovery until the reactor vessel has been filled with water to the extent that the core temperature rise has been terminated. From the latter stage of blowdown and on into the beginning of reflood, the intact loop accumulator tanks rapidly discharges borated cooling water into the RCS. Although a portion injected prior to end of bypass is lost out the cold leg break, the accumulators eventually contribute to the filling of the reactor vessel downcomer. The downcomer water elevation head provides the driving force required for the reflooding of the reactor core. The safety injection from the high head safety injection (HHSI) pumps and low head safety injection (LHSI) pump aid in the filling of the downcomer and core and subsequently supply water to help maintain a full downcomer and complete the reflooding process.

Continued operation of the ECCS pumps supplies water during long-term cooling. Core temperatures have been reduced to long-term steady state levels associated with dissipation of residual heat generation. After the water level of the refueling water storage tank (RWST) reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching from the injection mode to the sump recirculation mode of ECCS operation. Spilled borated water is drawn from the engineered safety features (ESF) containment sumps by the LHSI pump and returned to the RCS cold legs. Figure 14.3-1 contains a schematic of a representative sequence of events for the Indian Point 3 Nuclear Power Plant Best-Estimate large break LOCA transient.

For the Best-Estimate large break LOCA analysis, one ECCS train, including two high head safety injection (HHSI) pumps and one low head safety injection (LHSI) pump, starts and delivers flow through the injection lines. The accumulator and safety injection flows from the broken loop were assumed to spill to containment. All emergency diesel generators (EDGs) are assumed to start in the modeling of the containment spray pumps and fan coolers. Modeling full containment heat removal systems operation is required by Branch Technical Position CSB 6-1 (Reference 13) and is conservative for the large break LOCA.

To minimize delivery to the reactor, the HHSI and LHSI branch line chosen to spill is selected as the one with the minimum resistance.

Description of Small Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA there are only three characteristic stages, i.e., a gradual blowdown in which the decrease in water level is checked, core recovery, and long-term recirculation.

For small break LOCAs, the most limiting single active failure is the one that results in the minimum ECCS flow delivered to the RCS. This has been determined to be the loss of an emergency power train which results in the loss of one complete train of ECCS components. This means that credit was taken for two out of three high head safety injection pumps. During the small break transient, two high head pumps are assumed to start and deliver flow into all four loops. The flow to the broken loop was conservatively assumed to spill to RCS pressure in accordance with Reference 112 for a four loop plant.

Should a small break LOCA occur, depressurization of the RCS causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low-pressure trip setpoint is reached. Loss-Of-Chapter 14, Page 114 of 333 Revision 04, 2011

IP3 FSAR UPDATE Offsite-Power (LOOP) is assumed to occur coincident with reactor trip. A safety injection signal is generated when the appropriate setpoint (pressurizer low pressure SI) is reached. After the safety injection signal is generated, an additional delay ensues. This delay (27.8 seconds) accounts for the instrumentation delay, the diesel generator start time, plus the time necessary to align the appropriate valves and bring the pumps up to full speed. The safety features described will limit the consequences of the accident in two ways:

1) Reactor trip and borated water injection supplement void formation in causing rapid reduction of nuclear power to residual level corresponding to the delayed fission and fission product decay. No credit is taken in the LOCA analysis for the boron content of the injection water. However, an average RCS/sump mixed boron concentration is calculated to ensure that the post-LOCA remains subcritical. In addition, in the small break analysis, credit is taken for the insertion of Rod Cluster Control Assemblies (RCCAs) subsequent to the reactor trip signal, while assuming the most reactive RCCA is stuck in the full out position, and

2) Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs, the plant is assumed to be in normal plant operation at 102% of hot full power, i.e., the heat generated in the core is being removed via the secondary system. During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as the pumps coast down following LOOP. Upward flow through the core is maintained. However, the core flow is not sufficient to prevent a partial core uncovery. Subsequently, the ECCS provides sufficient core flow to cover the core.

During blowdown, heat from fission product decay, hot internals and the vessel continues to be transferred to the RCS. The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In the case of heat transfer from the RCS to the secondary, heat addition to the secondary results in increased secondary system pressure which leads to steam relief via the safety valves. Makeup to the secondary is automatically provided by the auxiliary feedwater pumps. The safety injection signal isolates normal feedwater flow by closing the main feedwater control and bypass valves and also initiates motor driven auxiliary feedwater flow. In the Small Break LOCA analysis, flow from a single motor driven auxiliary feedwater pump is assumed to begin 60 seconds after the Generation of an SI signal. The secondary flow aids in the reduction of RCS pressure. Also, due to the loss of offsite power assumption, the reactor coolant pumps are assumed to be tripped at the time of reactor trip during the accident and the effects of pump coastdown are included in the blowdown analysis.

When the RCS depressurizes to approximately 555 psia, the cold leg accumulators begin to inject borated water into the reactor coolant loops.

14.3.3 Core and System Performance 14.3.3.1 Mathematical Model The requirements of an acceptable ECCS evaluation model are presented in 10 CFR 50.46 (Reference 1).

Chapter 14, Page 115 of 333 Revision 04, 2011

IP3 FSAR UPDATE Large Break LOCA Evaluation Model In 1988, as a result of the improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, "ECCS Evaluation Models," so that a realistic evaluation model may be used to analyze the performance of the ECCS during a hypothetical LOCA (Reference 1). Under the amended rules, best-estimate thermal-hydraulic models may be used in place of models with Appendix K features.

The rule change also requires, as part of the analysis, an assessment of the uncertainty of the best-estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance limits. Further guidance for the use of best-estimate codes was provided in Regulatory Guide 1.157 (Reference 5).

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (Reference 10). This method outlined an approach for defining and qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three- and four-loop PWR plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and was approved by the NRC (Reference 11). The methodology is documented in WCAP-12945, "Code Qualification Document (CQD) for Best Estimate LOCA Analysis" (Reference 12).

The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large break LOCA is WCOBRA/TRAC Version MOD7A, Rev. 1 (Reference 12).

WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. This best-estimate computer code contains the following features:

• Ability to model transient three-dimensional flows in different geometries inside the vessel

• Ability to model thermal and mechanical non-equilibrium between phases

• Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes

• Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.

The reactor vessel is modeled with the three-dimensional, three-field fluid model, while the loop, major loop components, and safety injection points are modeled with the one-dimensional fluid model.

The basic building block for the vessel is the channel, a vertical stack of single mesh cells. Several channels can be connected together by gaps to model a region of the reactor vessel. Regions that occupy the same level form a section of the vessel. Vessel sections are connected axially to complete the vessel mesh by specifying channel connections between sections. Heat transfer surfaces and solid structures that interact significantly with the fluid can be modeled with rods and unheated conductors. The fuel parameters are generated using the Westinghouse fuel performance code (PAD 4.0, Reference 4).

One-dimensional components are connected to the vessel. Special purpose components exist to model specific components such as the steam generator and pump.

Chapter 14, Page 116 of 333 Revision 04, 2011

IP3 FSAR UPDATE A typical calculation using WCOBRA/TRAC begins with the establishment of a steady-state initial condition with all loops intact. The input parameters and initial conditions for this steady-state calculation are discussed in the next section.

Following the establishment of an acceptable steady-state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill, and reflood follows continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure is calculated using the COCO code (References 3 and 6) and mass and energy releases from the WCOBRA/TRAC calculation. The parameters used in the containment analysis to determine this pressure curve are presented in Tables 14.3-4, 14.3-5, 14.3-6a and 14.3-6b.

The methods used in the application of WCOBRA/TRAC to the large break LOCA are described in Reference 12. A detailed assessment of the computer code WCOBRA/TRAC was made through comparisons to experimental data. These assessments were used to develop quantitative estimates of the code's ability to predict key physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant-specific analysis (Reference 9). The final step of the best-estimate methodology is to combine all the uncertainties related to the code and plant parameters and estimate the PCT at the 95th percentile (PCT95%). The steps taken to derive the PCT uncertainty estimate are summarized below:

1. Plant Model Development In this step, a WCOBRA/TRAC model of the Indian Point 3 Nuclear Power Plant is developed. A high level of noding detail is used, in order to provide an accurate simulation of the transient. However, specific guidelines are followed to assure that the model is consistent with models used in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences such as in the upper plenum of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions In this step, the expected or desired range of the plant operating conditions to which the analysis applies is established. The parameters considered are based on a "key LOCA parameters" list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the "initial transient." Next, several confirmatory runs are made, which vary a subset of the key LOCA parameters over their expected operating range in one-at-a-time sensitivities.

The results of these calculations for Indian Point 3 Nuclear Power Plant are discussed in Section 5 of Reference 9. The most limiting input conditions, based on these confirmatory runs, are then combined into a single transient, which is then called the "reference transient."

3. PWR Sensitivity Calculations A series of PWR transients are performed in which the initial fluid conditions and boundary conditions are ranged around the nominal conditions used in the reference transient. The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the initial condition bias and uncertainty discussed in Section 6 of Reference 9.

Chapter 14, Page 117 of 333 Revision 04, 2011

IP3 FSAR UPDATE Next, a series of transients are performed which vary the power distribution, taking into account all possible power distributions during normal plant operation. The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the power distribution bias and uncertainty (response surface) discussed in Section 7 of Reference 9.

Finally, a series of transients are performed which vary parameters that affect the overall system response ("global" parameters) and local fuel rod response ("local" parameters). The results of these calculations for Indian Point 3 Nuclear Power Plant form the basis for the determination of the model bias and uncertainty (response surface) discussed in Section 8 of Reference 9.

4. Response Surface Calculations The results from the power distribution and global model WCOBRA/TRAC runs performed in Step 3 are fit by regression analyses into equations known as response surfaces. The results of the initial conditions run matrix are used to generate a PCT uncertainty distribution.

5. Uncertainty Evaluation The total PCT uncertainty from the initial conditions, power distribution, and model calculations is derived using the approved methodology (Reference 12). The uncertainty calculations assume certain plant operating ranges which may be varied depending on the results obtained. These uncertainties are then combined to determine the initial estimate of the total PCT uncertainty distribution for the guillotine and limiting split breaks. The results of these initial estimates of the total PCT uncertainty are compared to determine the limiting break type. If the split break is limiting, an additional set of split transients are performed which vary overall system response ("global" parameters) and local fuel rod response ("local" parameters). The results of these calculations form the basis for the determination of the model bias and uncertainty discussed in Section 9 of Reference 9. Finally, an additional series of runs is made to quantify the bias and uncertainty due to assuming that the above three uncertainty categories are independent. The final PCT uncertainty distribution is then calculated for the limiting break type, and the 95th percentile PCT (PCT95%) is determined, as described in Section 14.3.3.3.6 (Uncertainty Evaluation and Results).

6. Plant Operating Range The plant operating range over which the uncertainty evaluation applies is defined.

Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range established in step 2, or may be narrower for some parameters to gain additional PCT margin.

There are three major uncertainty categories or elements:

• Initial condition bias and uncertainty

• Power distribution bias and uncertainty

• Model bias and uncertainty Conceptually, these elements may be assumed to affect the reference transient PCT as shown below PCTi = PCTREF,i + PCTIC,i + PCTPD,i + PCTMOD,i (14.3.3.1-1)

where, Chapter 14, Page 118 of 333 Revision 04, 2011

IP3 FSAR UPDATE PCT REF,i = Reference transient PCT: The reference transient PCT is calculated using WCOBRA/TRAC at the nominal conditions identified in Table 14.3-1, for the blowdown, first and second reflood periods.

PCTIC,i = Initial condition bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes several nominal or average initial conditions, and the average PCT taking into account all possible values of the initial conditions. This bias takes into account plant variations which have a relatively small effect on PCT. The elements which make up this bias and its uncertainty are plant-specific.

PCTPD,i = Power distribution bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes a nominal power distribution, and the average PCT taking into account all possible power distributions during normal plant operation. Elements which contribute to the uncertainty of this bias are calculational uncertainties, and variations due to transient operation of the reactor.

PCTMOD,i = Model bias and uncertainty: This component accounts for uncertainties in the ability of the WCOBRA/TRAC code to accurately predict important phenomena which affect the overall system response ("global" parameters) and the local fuel rod response ("local" parameters). The code and model bias is the difference between the reference transient PCT, which assumes nominal values for the global and local parameters, and the average PCT taking into account all possible values of global and local parameters.

The separability of the bias and uncertainty components in the manner described above is an approximation, since the parameters in each element may be affected by parameters in other elements. The bias and uncertainty associated with this assumption is quantified as part of the overall uncertainty methodology and included in the final estimates of PCT95%.

Small Break LOCA Evaluation Model For loss-of-coolant accidents due to small breaks less than 1 ft2, the NOTRUMP (References 77, 78 and 112) computer code is used to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow through the break. The NOTRUMP computer code is a state-of-the-art one-dimensional general network code consisting of a number of advanced features.

Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes and regime-dependent heat transfer correlations. The NOTRUMP small break LOCA emergency core cooling system (ECCS) evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-061 1, Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants.

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken loop is modeled explicitly with the intact loops lumped into a second loop. The transient behavior of the Chapter 14, Page 119 of 333 Revision 04, 2011

IP3 FSAR UPDATE system is determined from the governing conservation equations of mass, energy, and momentum applied throughout the system. A detailed description of the NOTRUMP code is provided in References 77, 78 and 111.

The use of NOTRUMP in the analysis involves among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant accident.

Clad thermal analyses are performed with the LOCTA-IV code (Reference 7), which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from NOTRUMP hydraulic calculations as input as shown in Figure 14.3-3. The LOCTA-IV code version used for the clad thermal analysis of the small break LOCA includes the clad swelling and rupture model of NUREG-0630.

For these analyses, the safety injection delivery considers pumped injection flow, which is depicted in Figure 14.3-51 as a function of RCS pressure. This figure represents injection flow from the high head safety injection pumps based on performance curves degraded 5 percent from the design head.

A 27.8 second delay was assumed from the time that the SI signal is generated to the time that the pumps are at full speed and capable of injecting water into the system. The effect of low head safety injection pump (Residual Heat Removal pump) flow is not considered since their shutoff head is lower than Reactor Coolant System pressure during the time period of the transient. Also, minimum Emergency Core Cooling System capability and operability has been assumed in these analyses. The small break LOCA analysis also conservatively assumes that the rod drop time is 2.7 seconds.

Figure 14.3-52 presents the hot rod power shape utilized as input to perform the small break analysis presented here. This power shape was chosen because it provides an appropriate distribution of power versus core height and also because local power is maximized in the upper regions of the reactor core (8 feet to 12 feet). This power shape is skewed to the top of the core with the peak local power occurring at the 9.5 foot core elevation. This is limiting for the small break analysis because of the core uncovery process for small breaks. As the core uncovers, the cladding in the upper elevation of the core heats up and is sensitive to the local power at that elevation. The cladding temperatures in the lower elevation of the core, below the two-phase mixture height, remain low.

The small break analysis was performed with the Westinghouse ECCS small break Evaluation Model using the NOTRUMP code, approved for this use by the Nuclear Regulatory Commission in May 1985 (References 77 and 78), and in August 1996 (Reference 112).

14.3.3.2 Input Parameters and Initial Conditions Tables 14.3-1 and 14.3-8a list important input parameters and initial conditions used in the Indian Point 3 Nuclear Power Plant large break LOCA analysis, and small break LOCA analysis, respectively.

The appropriate best estimate value of ~Thot is modeled for the upper head fluid temperature in the large break LOCA analysis. The small break LOCA analysis was performed with the upper head fluid temperature equal to the Reactor Coolant System hot leg fluid temperature. In addition, the large break LOCA analysis assumed a steam generator tube plugging range of 0 to 10%. The assumption bounds the uprate licensing condition with up to 10% plugging in any steam generator. The small break LOCA analysis included the effects of a 10% uniform steam generator tube plugging.

Chapter 14, Page 120 of 333 Revision 04, 2011

IP3 FSAR UPDATE All accident analyses are bounded by a minimum RWST temperature of 35°F. The Containment Integrity Steam Break analysis simultaneously assumes RWST temperature of 40°F and containment Spray temperature of 110°F, a physically impossible (but highly conservative) assumption to maximize accident consequences. Of the two parameters, Containment Spray temperature is more limiting. Therefore, RWST temperature as low as 35°F is acceptable and consistent with the safety analysis.

14.3.3.3 Large Break LOCA Analysis Results A series of WCOBRA/TRAC calculations were performed using the Indian Point 3 Nuclear Power Plant input model, to determine the effect of variations in several key LOCA parameters on peak cladding temperature (PCT). From these studies, an assessment was made of the parameters that had a significant effect as will be described in the following sections.

14.3.3.3.1 Large Break LOCA Reference Transient Description The plant-specific analysis performed for the Indian Point 3 Nuclear Power Plant confirmed that the double-ended cold leg guillotine (DECLG) break is more limiting than the split break as described in Section 9.2.3 of Reference 9. The plant conditions used in the reference transient are listed in Table 14.3-1. Since many of these parameters are at their bounded values, the calculated results are a conservative representation of the response to a large break LOCA. The following is a description of the reference transient.

The LOCA transient can be conveniently divided into a number of time periods in which specific phenomena are occurring. For a typical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the down-ward core flow phase.

These are followed by the refill, first reflood, second reflood and long term cooling phases. The important phenomena occurring during each of these phases are discussed for the reference transient. The results are shown in Figures 14.3-4 through 14.3-16.

Critical Heat Flux (CHF) Phase (~ 0 - 2 seconds)

Immediately following the cold leg rupture, the break discharge is subcooled at a high flow rate, the core flow reverses, the fuel rods go through departure from nucleate boiling (DNB) and the cladding rapidly heats up while core power shuts down. Figure 14.3-4 shows the maximum cladding temperature in the core, as a function of time. The hot water in the core and upper plenum flashes to steam during this period. This phase is terminated when the water in the lower plenum and downcomer begins to flash. The mixture swells and the intact loop pumps, still rotating in single-phase liquid, push this two-phase mixture into the core.

Upward Core Flow Phase (~ 2 - 17 seconds)

Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be enhanced if the pumps are not degraded, and the break discharge rate is low because the fluid is saturated at the break. Figures 14.3-5a and 14.3-5b show the vessel-side and pump-side break flowrate for the reference transient. This phase ends as lower plenum mass is depleted, the loops become two-phase, and the pump head degrades. If pumps are highly degraded or the break flow is large, the cooling effect due to upward flow may not be significant. Figure 14.3-6 shows the void fraction for one intact loop pump and the broken loop pump. The intact loop pump remains in single-Chapter 14, Page 121 of 333 Revision 04, 2011

IP3 FSAR UPDATE phase liquid flow for several seconds, while the broken loop pump is in two-phase and steam flow soon after the break.

Downward Core Flow Phase (~ 17 - 24.5 seconds)

The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump flow becomes two-phase. The break flow begins to dominate and pulls flow down through the core.

Figures 14.3-7 and 14.3-8 show the vapor flow at near top of core of channels 17 and 19. While liquid and entrained liquid flows also provide core cooling, the vapor flow in the core best illustrates this phase of core cooling. This period is enhanced by flow from the upper head. As the system pressure continues to fall, the break flow and consequently the core flow, are reduced. The core begins to heat up as the system reaches containment pressure and the vessel begins to fill with Emergency Core Cooling System (ECCS) water.

Refill Phase (~ 24.5 - 36.5 seconds)

The core experiences a nearly adiabatic heatup as the lower plenum fills with ECCS water.

Figure 14.3-9 shows the lower plenum liquid level. This phase ends when the ECCS water enters the core and entrainment begins, with a resulting improvement in heat transfer. Figures 14.3-10 and 14.3-11 show the liquid flows from the accumulator and the safety injection from an intact loop (Loop 4).

First Reflood Phase (~ 36.5 - 50.5 seconds)

The accumulators are emptying and nitrogen enters the system (Figure 14.3-10). This forces water into the core which then boils as the lower core region begins to quench, causing repressurization.

The repressurization is best illustrated by the reduction in pumped SI flow (Figure 14.3-11). During this time, core cooling may be increased.

Second Reflood Phase (~ 50.5 seconds - end)

The system then settles into a gravity driven reflood which exhibits lower core heat transfer. Figures 14.3-12 and 14.3-13 show the core and downcomer liquid levels. Figure 14.3-14 shows the vessel fluid mass. As the quench front progresses further into the core, the peak cladding temperature (PCT) location moves higher in the top core region. Figure 14.3-15 shows the movement of the PCT location. As the vessel continues to fill, the PCT location is cooled and the PCT heatup is terminated (Figures 14.3-4 and 14.3-16).

Long Term Core Cooling At the end of the WCOBRA/TRAC calculation, the core and downcomer levels are increasing as the pumped safety injection flow exceeds the break flow. The core and downcomer levels would be expected to continue to rise, until the downcomer mixture level approaches the loop elevation. At that point, the break flow would increase, until it roughly matches the injection flowrate. The core would continue to be cooled until the entire core is eventually quenched.

The reference transient resulted in a blowdown PCT of 1491°F, a first reflood PCT of 1627°F and a second reflood PCT of 1578°F.

Chapter 14, Page 122 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.3.3.3.2 Confirmatory Sensitivity Studies A number of sensitivity calculations were carried out to investigate the effect of the key LOCA parameters, and to determine the PCT effect on the reference transient. In the sensitivity studies performed, LOCA parameters were varied one at a time. For each sensitivity study, a comparison between the base case and the sensitivity case transient results was made.

The results of the sensitivity studies are summarized in Table 14.3-2a. A full report on the results for all confirmatory sensitivity study results is included in Section 5 of Reference 9. The results of these analyses lead to the following conclusions:

1. Modeling maximum steam generator tube plugging (10%) results in a higher PCT than minimum steam generator tube plugging (0%).

2. Modeling loss-of-offsite-power (LOOP) results in a higher PCT than no loss-of-offsite-power (no-LOOP).

3. Modeling the maximum value of vessel average temperature (Tavg = 572°F) results in a higher PCT than minimum value of vessel average temperature (Tavg = 549°F).

4. Modeling the maximum power fraction (PLOW = 0.8) in the low power/periphery channel of the core results in a higher PCT than minimum power fraction (PLOW = 0.3).

14.3.3.3.3 Initial Conditions Sensitivity Studies Several calculations were performed to evaluate the effect of change in the initial conditions on the calculated LOCA transient. These calculations analyzed key initial plant conditions over their expected range of operation. These studies included effects of ranging RCS conditions (pressure and temperature), safety injection temperature, and accumulator conditions (pressure, temperature and water volume). The results of these studies are presented in Section 6 of Reference 9.

The calculated results were used to develop initial condition uncertainty distributions for the blowdown and reflood peaks. These distributions are then used in the uncertainty evaluation to predict the PCT uncertainty component resulting from initial conditions uncertainty (PCTIC,i).

14.3.3.3.4 Power Distribution Sensitivity Studies Several calculations were performed to evaluate the effect of power distribution on the calculated LOCA transient. The power distribution attributes which were analyzed are the peak linear heat rate, the maximum relative rod power, the relative power in the bottom third of the core (PBOT), and the relative power in the middle third of the core (PMID). The choice of these variables and their ranges are based on the expected range of plant operation.

The power distribution parameters used for the reference transient are biased to yield a relatively high PCT. The reference transient uses a slightly higher FH value (1.731) than the Tech Spec FH value (1.7), a skewed to the top power distribution, and a FQ (2.202) at the midpoint of the sample range.

A run matrix was developed in order to vary the power distribution attributes singly and in combination. The calculated results are presented in Section 7 of Reference 9.

The calculated results were used to develop response surfaces, as described in Step 4 of Section 14.3.3.1, which could be used to predict the change in PCT for various changes in the power distributions for the blowdown and reflood peaks. These were then used in the uncertainty evaluation, Chapter 14, Page 123 of 333 Revision 04, 2011

IP3 FSAR UPDATE to predict the PCT uncertainty component resulting from uncertainties in power distribution parameters, (PCTPD,i).

14.3.3.3.5 Global Model Sensitivity Studies Several calculations were performed to evaluate the effect of broken loop resistance, break discharge coefficient, and condensation rate on the PCT for the guillotine break. As in the power distribution study, these parameters were varied singly and in combination in order to obtain a data base which could be used for response surface generation. The run matrix and ranges of the break flow parameters are described in Reference 12. The limiting split break was also identified using the methodology described in Reference 12. The plant specific calculated results are presented in Section 8 of Reference 9.

The calculated results were used to develop response surfaces as described in Section 14.3.3.1, which could be used to predict the change in PCT for various changes in the flow conditions. These were then used in the uncertainty evaluation to predict the PCT uncertainty component resulting from uncertainties in global model parameters (PCTMOD,i).

14.3.3.3.6 Uncertainty Evaluation and Results The PCT equation was presented in Section 14.3.3.1. Each element of uncertainty is initially considered to be independent of the other. Each bias component is considered a random variable, whose uncertainty and distribution is obtained directly, or is obtained from the uncertainty of the parameters of which the bias is a function. For example, PCTPD,i is a function of FQ, FH, PBOT, and PMID. Its distribution is obtained by sampling the plant FQ, FH, PBOT, and PMID distributions and using a response surface to calculate PCTPD,i. Since PCTi is the sum of these biases, it also becomes a random variable. Separate initial PCT frequency distributions are constructed as follows for the guillotine break and the limiting split break size:

1. Generate a random value of each PCT element.

2. Calculate the resulting PCT using Equation 14.3.3.1-1.

3. Repeat the process many times to generate a histogram of PCTs.

For the Indian Point 3 Nuclear Power Plant, the results of this assessment showed the double-ended cold leg guillotine (DECLG) break to be the limiting break type.

A final verification step is performed in which additional calculations (known as "superposition" calculations) are made with WCOBRA/TRAC, simultaneously varying several parameters which were previously assumed independent (for example, power distributions and global models). Predictions using Equation 14.3.3.1-1 are compared to this data, and additional biases and uncertainties are applied.

The estimate of the PCT at 95th percent probability is determined by finding that PCT below which 95th percent of the calculated PCTs reside. This estimate is the licensing basis PCT, under the revised ECCS rule.

The results for the Indian Point 3 Nuclear Power Plant are given in Table 14.3-2b, which shows the limiting second reflood 95th percentile PCT (PCT95%) of 1944°F. As expected, the difference between the 95th percent value and the average value increases with increasing time, as more parameter uncertainties come into play.

Chapter 14, Page 124 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.3.3.3.7 Evaluation The base analysis discussed in Sections 14.3.3.3.1 to 14.3.3.3.6 was performed assuming a full core of Westinghouse OFA with IFMs and non-IFBA. For Indian Point 3 Nuclear Power Plant large break LOCA analysis, additional calculations were performed to assess the effect of IFBA fuel, upgraded fuel, containment sump strainer, initial containment temperature, bent alignment pin, and ECCS evaluation model assessments.

IFBA Fuel Evaluation The base analysis discussed in Sections 14.3.3.3.1 through 14.3.3.3.6 is for non-IFBA fuel type. An analysis of IFBA fuel was performed utilizing the HOTSPOT code and the high PCT case identified in Section 10.2 of Reference 9. The IFBA analysis indicated that the non-IFBA results bound IFBA results for all time periods.

Upgraded Fuel Evaluation The base analysis discussed in Sections 14.3.3.3.1 through 14.3.3.3.6 is for Westinghouse OFA fuel design with IFMs. The fuel design to be implemented is upgraded fuel with IFMs and either with or without 1.9" I-Springs. The analysis results indicated that the upgraded fuel with IFMs and 1.9" I-Springs is bounded by OFA fuel with IFMs. These results also indicated that the upgraded fuel with IFMs but without 1.9" I-Springs is bounded by OFA fuel with IFMs for second reflood , but a 6°F PCT penalty is applicable for first reflood. Therefore, the best-estimate analysis for the Indian Point 3 Nuclear Power Plant bounds operation with upgraded fuel with IFMs and 1.9" I-Springs, but requires a 6°F first reflood PCT penalty for operation with upgraded fuel with IFMs but without 1.9" I-Springs.

Containment Sump Strainer An evaluation of the sump strainer metal added to containment in response to GSI-191, resulted in a 0°F PCT penalty for the first reflood time period and a 2°F PCT penalty for the second reflood time period.

Initial Containment Temperature Evaluation The Indian Point Unit 3 Large Break LOCA PCT Analysis of Record assumed an initial containment /

accumulator temperature of 90°F. A lower initial containment temperature of 80°F at rated power is desirable, and an evaluation determined that a 10°F reduction in initial containment / accumulator temperature would result in a PCT of 2.2°F for the first reflood time period and 11.8°F penalty for the second reflood time period.

Bent Alignment Pin An evaluation was completed to assess the impact of the removal of one or both upper alignment pins form core locations A5, A11, and B13 as well as the removal of one pin at core location A6. The evaluation concluded that the modifications would result in a 5°F PCT penalty, which is applied at both the first and second reflood time periods.

Chapter 14, Page 125 of 333 Revision 04, 2011

IP3 FSAR UPDATE LBLOCA ECCS Evaluation Model Assessments Assessments are made on the ECCS evaluation model to reconcile model updates and corrections or correct errors discovered in the IP3 licensing basis analysis. The following assessments with non-zero PCT impact are currently applicable to the IP3 LBLOCA analysis: a 5°F Reflood 1, 5°F Reflood 2 penalty for revised blowdown heatup uncertainty distribution and a 75°F Reflood 1, 15°F Reflood 2 penalty for the HOTSPOT fuel relocation error.

14.3.3.3.8 Large Break LOCA Conclusions It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR 50.46 are met. The demonstration that these limits are met for the Indian Point 3 Nuclear Power Plant is as follows:

1) There is a high level of probability that the peak cladding temperature (PCT) shall not exceed 2200°F. The results presented in Table 14.3-2b indicate that this regulatory limit has been met with a limiting second reflood PCT95% of 1944°F. The PCT including Assessments is reported annually to the NRC as per the requirements of 10CFR50.46.

2) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react. The total amount of hydrogen generated, based on this conservative assessment is 0.0062 times the maximum hypothetical amount, which meets the regulatory limit.

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation. The approved Best-Estimate LOCA methodology assesses this requirement using a plant-specific transient which has a PCT in excess of the estimated 95 percentile PCT (PCT95%). Based on this conservative calculation, a maximum local oxidation of 7.6 percent is calculated, which meets the regulatory limit.

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling.

This requirement is met by demonstrating that the PCT does not exceed 2200°F, the maximum local oxidation does not exceed 17%, and the seismic and LOCA forces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled. The approved methodology (Reference 12) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the assemblies in the lower power channel as defined in the WCOBRA/TRAC model. This situation has not been previously calculated to occur for the Indian Point Unit 3 Nuclear Power Plant. Therefore, this regulatory limit is met.

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core. The conditions at the end of the WCOBRA/TRAC calculations indicates that the transition to long term cooling is underway even before the entire core is quenched.

Chapter 14, Page 126 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.3.3.3.9 Plant Operating Range The expected PCT and its uncertainty developed above is valid for a range of plant operating conditions. In contrast to current Appendix K calculations, many parameters in the base case calculation are at nominal values. The range of variation of the operating parameters has been accounted for in the estimated PCT uncertainty. Table 14.3-3 summarizes the operating ranges for the Indian Point 3 Nuclear Power Plant. If operation is maintained within these ranges, the LOCA analysis developed in Reference 9 is considered to be valid.

14.3.3.3 Small Break Results Limiting Case This section presents the results of the limiting small break LOCA analysis for a range of break sizes and Upgraded fuel types with ZIRLOTM cladding. NUREG-0737 (Reference 86), section II.K3.31, requires a plant specific small break LOCA analysis using an Evaluation Model revised per Section II.K3.30. In accordance with NRC Generic Letter 83-35 (Reference 87), generic analyses using NOTRUMP (References 77, 78, and 112) were performed and are presented in WCAP-11145 (Reference 88). Those results demonstrate that in comparison of cold leg, hot leg and pump suction leg break locations, the cold leg break location is limiting. The limiting break for Indian Point Unit 3 was found to be a 3 inch cold leg break.

A list of input assumptions used in the same break analysis is provided in Table 14.3-8a. The results of a spectrum analysis (three break sizes) performed for the upgraded ZIRLOTM clad fuel are summarized in Table 14.3-8c while the key transient event times are listed in Table 14.3-8b.

For limiting 3 inch break transient, Figures 14.3-53 through 14.3-60 for the following parameters are given:

• RCS pressure

• Core mixture level

• Hot rod cladding temperature

• Core outlet steam flow rate

• Hot assembly rod surface heat transfer coefficient

• Hot spot fluid temperature

• Break flow rate

• Safety injection mass flow rate In addition, the following transient parameters are presented for the non-limiting 2 inch and 4 inch breaks:

• RCS pressure

• Core mixture level

• Hot rod cladding temperature Figures 14.3-61 through 14.3-63 are for the 2 inch break transient, while Figures 14.3-64 through 14.3-66 show the above parameters for the 4 inch break.

During the initial period of the small break transient, the effect of the break flow rate is not strong enough to overcome the flow rate maintained by the reactor coolant pumps as they coast down following Loss-Of-Offsite-Power (LOOP). Normal upward flow is maintained through the core and core heat is adequately removed. At the low heat generation rates following reactor trip, the fuel rods Chapter 14, Page 127 of 333 Revision 04, 2011

IP3 FSAR UPDATE continue to be well cooled as long as the core is covered by a two-phase mixture level. From the clad temperature transient for the limiting break calculation shown in Figure 14.3-55, it is seen that the peak clad temperature occurs near the time when the core is most deeply uncovered (1954 seconds) and the top of the core is steam cooled. This time is accompanied by the highest vapor superheating above the mixture level. The peak clad temperature during the transient was 1543°F. At the time the transient was terminated, the safety injection flow rate that was delivered to the RCS exceeds the mass flow rate out the break. The decreasing RCS pressure results in greater safety injection flow as well as reduced break flow. As the RCS inventory continues to gradually increase, the reactor mixture level will continue to increase and the fuel clad temperature will continue to decline.

The maximum calculated peak clad temperature for all small breaks analyzed is 1543°F, which is less than the 10 CFR 50.46 ECCS Acceptance Criteria limit of 2200°F. The maximum local metal-water reaction is below the embrittlement limit of 17 percent as water reaction is less than 1 percent, as compared with the 1 percent criterion of 10 CFR 50.46, and the clad temperature transient is terminated at a time when the core geometry is still coolable. As a result, the core temperature will continue to drop and the ability to remove decay heat for an extended period of time will be provided.

Small Break LOCA analysis: Non-Limiting Cases In compliance with 10 CFR 50.46, Section (a)(1)(i), additional cases were analyzed to insure that the 3 inch diameter break was limiting. Calculations were run assuming breaks of 2 inches and 4 inches for the Upgraded ZIRLOTM clad fuel. The results of these calculations are shown in Table 14.3-8c and the sequence of events in Table 14.3-8b.

Small Break LOCA Analysis Conclusions Analyses presented in this section show that the high head safety injection of the Emergency Core Cooling System (the low head safety injection pumps were not modeled in the Indian Point Unit 3 small break LOCA analysis), provides sufficient core flooding to keep the calculated peak clad temperature below the required limit of 10CFR 50.46. Hence, adequate protection is provided by the Emergency Core Cooling System in the event of a small break Loss-of-Coolant Accident.

The results of this analysis demonstrate that for a small break LOCA, the Emergency Core Cooling System will meet the acceptance criteria as presented in 10 CFR 50.46.

14.3.3.4 Conclusions For breaks up to an including the double-ended severance of a reactor coolant pipe, the Emergency Core Cooling System will meet the Acceptance Criteria as presented in 10 CFR 50.46 (Reference 1).

That is:

1) There is a high level of probability that the peak cladding temperature (PCT) shall not exceed 2200°F.

2) The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react.

3) The maximum calculated local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

Chapter 14, Page 128 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4) Calculated changes in core geometry shall be such that the core remains amenable to cooling.

This requirement is met by demonstrating that the PCT does not exceed 2200°F, the maximum local oxidation does not exceed 17%, and the seismic and LOCA forces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled.

5) After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long lived radioactivity remaining in the core.

14.3.4 CORE AND INTERNALS INTEGRITY ANALYSIS 14.3.4.1 Design Criteria The basic requirement of any Loss-of-Coolant Accident, including the double-ended severance of a reactor coolant pipe, is that sufficient integrity be maintained to permit the safe and orderly shutdown of the reactor. This implies that the core must remain essentially intact and deformation of internals must be sufficiently small so that primary loop flow, and particularly, adequate safety injection flow is not impeded.

The ability to insert control rods to the extent necessary to provide shutdown following the accident must be maintained. Maximum allowable defection limitations are established for those regions of the internals that are critical for plant shutdown.

The allowable and no loss of function deflection limits under dead loads plus the maximum potential earthquake and/or blowdown excitation loads are presented in Table 14.3-11. These limits have been established by correlating experimental and analytical results.

14.3.4.2 Internals Evaluation Reference 99 addressed the affects of 24 month channel uncertainties which affected the initial conditions.

Depressurization waves propagate from the postulated break location into the reactor vessel through either a hot leg or a cold leg nozzle.

After a postulated break at the Reactor Pressure Vessel (RPV) inlet nozzle or at the Reactor Coolant Pump (RCP) outlet nozzle, the depressurization path for waves entering the reactor vessel is through the nozzle which contains the broken pipe and into the downcomer annulus which is the region between the core barrel and reactor vessel. The initial waves propagate up, around, and down the downcomer annulus, then up through the region circumferentially enclosed by the core barrel, that is, the fuel region.

As a result, the region of the downcomer annulus close to the break depressurizes rapidly; but because of restricted flow areas and finite wave speed (approximately 3500 feet per second), the opposite side of the core barrel remains at a high pressure. This results in a net horizontal force on the core barrel and RPV. As the depressurization wave propagates around the downcomer annulus and through the core, the barrel differential pressure is reduced and similarly, the resulting hydraulic forces drop. In the case of a postulated RPV outlet rupture, the waves follow a dissimilar depressurization path, passing through the outlet nozzle and directly in to the upper internals region, depressurizing the core, and entering the downcomer annulus from the bottom exit of the core barrel.

Since the depressurization wave travels directly to the inside of the core barrel (so that the Chapter 14, Page 129 of 333 Revision 04, 2011

IP3 FSAR UPDATE downcomer annulus is not directly involved), the internal differential pressures are not as large as the RPV inlet nozzle break, and therefore the horizontal force applied to the core barrel is less for the hot leg break than for a cold leg RPV inlet nozzle break. For breaks in either the hot leg or cold leg, the depressurization waves would continue to propagate by reflection and transition through the reactor vessel and loops. The reactor coolant pump outlet nozzle and reactor pressure vessel inlet nozzle pipe rupture locations have similar vessel internal hydraulic loads, but due to the influence of reactor cavity pressure loads, the vessel inlet nozzle break generates larger forces applied to the reactor vessel.

Blowdown Model The MULLTIFLEX computer code (Reference 26) calculates the hydrodynamic transients within the entire Reactor Coolant System. It considers subcooled, transition, and two-phase (saturated) blowdown regimes. The MULTIFLEX program employs the method of characteristics to solve the conservation laws, assuming one-dimensionality of flow and homogeneity of the liquid-vapor mixture.

The MULTIFLEX code considers a coupled fluid-structure interaction by accounting for the deflection of constraining boundaries, which are represented by separate spring-mass oscillator systems. A beam model of the core support barrel has been developed from the structural properties of the core barrel. In this model, the cylindrical barrel is vertically divided into segments and the pressure as well as the wall motions are projected onto the plane parallel to the broken inlet nozzle. Horizontally, the barrel is divided into segments consisting of separate walls. The spatial pressure variation at each time step is transformed into horizontal forces, which act on the mass points of the beam model.

Each flexible wall is bounded on either side by a hydraulic flow path.

Its ability to treat multiple flow branches and a large number of mesh points gives the MULTIFLEX code the required flexibility to represent the various flow passages within the primary Reactor Coolant System (RCS). The RCS is divided into subregions in which the fluid flows mainly along their longitudinal axes; each subregion may then be regarded as an equivalent pipe. The entire primary RCS is thus represented by a complex network of equivalent pipes.

Time history values of the pressure, mass velocity, density, and other thermodynamic properties within the RPV (all of which are computed by the MULTIFLEX code), are utilized in the determination of the applied vertical and lateral loads on the reactor vessel internals.

The RPV internal hydraulic loads for pipe ruptures postulated at the vessel safe-end locations were based upon a 110 square-inch break opening area. This limited area was verified to be conservative upon completion of the Reactor Coolant System blowdown analysis by using the actual broken pipe displacements and geometrical relationships. Internal hydraulic loads for a break postulated at the reactor coolant pump outlet nozzle safe-end location were calculated for a full doubled-ended break opening area. Figure 14.3-67 through 14.3-70 present the horizontal hydraulic forces on the reactor vessel and core barrel for the RPV inlet and outlet breaks. The vertical loads on the reactor vessel for these two breaks are also among the figures. The results presented were based on a MULTIFLEX model that is plant specific for Indian Point 3.

Force Model Vertical Loads The FORCE-2 (Reference 26) computer code determines the vertical hydrodynamic loads on the reactor vessel internals during blowdown. FORCE-2 utilizes a detailed geometric description of the vessel components, transient pressures, and mass velocities computed by the MULTIFLEX code.

Chapter 14, Page 130 of 333 Revision 04, 2011

IP3 FSAR UPDATE The FORCE-2 code is applicable for all pressure and mass velocity transients arising from a postulated Loss-of-Coolant Accident. Each reactor vessel component for which force calculations are required is designated as an element. If the flow region associated with an element in FORCE-2 is divided into more than one flow path in the MULTIFLEX hydraulic model, then the element in FORCE-2 is subdivided into a corresponding number of divisions.

The analytical basis for the derivation of the mathematical equations utilized in the FORCE-2 code is the conservation of momentum. In evaluating the vertical hydraulic loads on the reactor vessel internals, the following types of transient forces are considered:

1) Pressure differential acting across the element

2) Flow stagnation of the element and unrecovered orifice losses across the element

3) Friction losses along the element.

These three types of forces are summed together to give the total force on each element. Individual forces on elements are further combined, depending upon what particular RV internal component is being considered, to yield the resultant vertical hydraulic load on that component.

Horizontal Loads Variations in the fluid pressure distribution in the downcomer annulus region during the subcooled operation of the blowdown transient produce pressure loading on the reactor vessel internals. The transient pressures computed by the MULTIFLEX code are used to calculate the lateral hydraulic loads on the reactor vessel wall, core barrel, and the thermal shield.

The annular region between the reactor vessel wall and the core barrel (that is, the downcomer annulus) is modeled as cylindrical segments formed by dividing this region into circumferential and axial zones.

14.3.4.3 Response of Reactor Internals to Blowdown Forces Vertical Excitation Structural Model and Method of Analysis The response of reactor internals components due to an excitation produced by a complete severance of a primary loop pipe is analyzed. Assuming a double-ended pipe break occurs in a very short period of time, the rapid drop of pressure at the break produces a disturbance which propagates along the primary loop and excites the internal structure. The characteristics of the hydraulic excitation, combined with those of the structures affected, present a unique dynamic problem.

The internal structure is simulated by a multi-mass system connected with springs and dashpots representing the viscous damping due to structural and impact losses, The gaps between various components, as well as coulomb type friction, were also incorporated into the overall model. Since the fuel elements in the fuel assemblies are kept in position by friction forces originating from the preloaded fuel assembly grid fingers, any sliding that occurs between the fuel rods and assembly considered as coulomb type of friction. A series of mechanical modes of local structures were developed and analyzed so that certain basic nonlinear phenomena previously mentioned could be understood. Using the results of these models, a final multi-mass model was adopted to represent the internal structure under vertical excitation. Figure 14.3-71 is a schematic representation of the internals structures. The multi-mass model is shown in Figure 14.3-72. The modeling is conducted in Chapter 14, Page 131 of 333 Revision 04, 2011

IP3 FSAR UPDATE such a way that uniform masses are lumped into easily identifiable discrete masses while elastic elements are represented by springs.

In order to program the multi-mass system, the appropriate spring rates, weights, and forcing function for the various masses were determined. The spring rates and weights of the reactor components were calculated separately for Indian Point 3. The forcing functions for the masses were obtained from the FORCE-2 program described in the previous section. It calculates the transient forces on reactor internals during blowdown using transient pressures and fluid velocities.

For the blowdown analysis, the forcing functions are applied directly to the various internal masses.

For the earthquake analysis of the reactor internals, the forcing function, which is a simulated earthquake response, is applied to the multi-mass system at the ground connections (the reactor vessel). Therefore, the external excitation is transmitted to the internals through the spring at the ground connections.

Results The hot and cold leg break analyses were performed for a one millisecond break opening time. The response of the structure to this type of excitation indicates that the vertical motion is irregular with peaks of very short duration. The deflections and motion of some of the reactor components are limited by the solid height of springs as is the case of the holddown spring located above the barrel flange.

The internals behave as a highly nonlinear system during the vertical oscillations produced by the blowdown forces. The nonlinearities due to the coulomb fictional forces between grids and rods, and to gaps between components causing discontinuities in force transmission. The frequency response is consequently a function not only of the exciting frequencies in the system, but also of the amplitude.

Different break conditions excite different frequencies in the system. Under certain blowdown excitation conditions, the core moves upward, touches the core plate, and falls down on the lower structure causing oscillations in all the components.

The effect of damping has also been considered and it can be seen that the higher frequencies disappear rapidly after each impact or slippage.

The results (Reference 58 and Reference 59) of the computer program give not only the frequency response of the components, but also the maximum impact force and defections. From these results, the component stresses are computed. The impact stresses are obtained in an analogous manner using the maximum forces seen by the various structures during impact.

Upper Package and Guide Tubes The most severe case, represented by a hot leg break, shows the core lifting and contacting the upper core plate. The local deformation of the upper core plate where a guide tube is located must be limited so as to prevent the guide tubes from undergoing compression. An analysis (Reference 58 and Reference 59) was performed which showed that the deformation is insufficient to cause the plate to contact the guide tubes and cause any excessive compression of guide tubes.

Fuel Assembly Thimbles Chapter 14, Page 132 of 333 Revision 04, 2011

IP3 FSAR UPDATE When the core moves vertically, touching the upper and lower structures, the thimbles are subjected to impact stresses. These stresses are obtained from the maximum dynamic impact forces on the fuel assemblies. The results are compared with the buckling loads to assure that the cross section distortion does not exceed the allowable limits. Results show that control rod insertion is not jeopardized.

Transverse Excitation Core Barrel The hydraulic pressure transients caused by a Loss-of-Coolant Accident with the break occurring in the hot leg are calculated for a one millisecond breaking time. The resulting loading on the upper core barrel is represented by a dynamic, uniformly distributed compressive pressure wave.

The dynamic stability of the upper core barrel is analyzed. The maximum compressive pressure wave is well below the critical value to produce buckling of the upper core barrel. In addition, the quantitative dynamic response of the upper core barrel was studied for the worst blowdown break time and found to be negligible.

Under the transient pressure conditions resulting from a Loss-of-Coolant Accident in a cold leg, the reactor core barrel is subjected initially to non-axisymmetric internal pressure waves. The initial loading condition is followed by oscillating pressure waves on the core barrel which are both time and space dependent.

In general, there are two possible modes of dynamic response of the core barrel. One mode is the beam response mode of the core barrel resulting from the non-self-equilibrating circumferential component of the pressure forcing function. This response mode is analyzed utilizing shear beam theory since the core barrel is a statically determinate elastic system in the beam mode. The beam mode of core barrel response is conservatively analyzed by comparing the excitation frequencies to the natural frequencies of the core barrel to establish the dynamic response amplification.

The second possible response mode of the core barrel is as a shell, predominantly in the ring modes with the formation of only one axial wave. The ring modes of shell vibration involve both the membrane and bending components of loads on the shell, with bending becoming predominant as the number of circumferential waves increase. Thus, the ring vibration modes are analyzed including both bending and membrane terms. The dynamic response is then determined by comparing the pressure loading oscillation frequencies to the natural frequencies as a shell.

Guide Tubes The guide tubes are studied applying the blowdown forces to the structures and calculating the resulting deflections. The guide tubes are considered as being elastically supported at the upper plate and simply supported at the lower end with variable cross section. Consideration is given to frequencies and amplitudes of the forcing function and the response is computed (References 58 and

59) to assure that the deflections do not prevent shutdown of the reactor.

14.3.4.4 Analysis of the Effects of Loss-of-Coolant and Safety Injection on the Reactor Vessel The analysis of the effects of injecting safety injection water into the Reactor Coolant System following a postulated Loss-of-Coolant Accident have been incorporated into a WCAP report submitted to the NRC (Reference 59).

Chapter 14, Page 133 of 333 Revision 04, 2011

IP3 FSAR UPDATE For the reactor vessel three modes of failure are considered, including the ductile mode, brittle mode, and fatigue mode.

Ductile Mode The failure criterion used for this evaluation is that there shall be no gross yielding across the vessel wall using the material yield stress specified in Section III of the ASME Boiler and Pressure Vessel Code. The combined pressure and thermal stresses during injection through the vessel thickness as a function of time have been calculated and compared to the material yield stress for the period of time during the safety injection transient.

The results of the analyses showed that local yielding may occur in approximately the inner 12 percent of the base metal and in the cladding.

Brittle Mode The possibility of a brittle fracture of the irradiated core region has been considered from both a transition temperature approach and a fracture mechanics approach.

The failure criterion used for the transition temperature evaluation is that a local flaw cannot propagate beyond any given point where the applied stress will remain below the critical propagation stress at the applicable temperature at that point.

The results of the transition temperature analysis showed that the stress-temperature condition in the outer 65 percent of the base metal wall thickness remains in the crack arrest region at all times during the safety injection transient. Therefore, if a defect were present in the most detrimental location and orientation (i.e., a crack on the inside surface and circumferentially directed), it could not propagate any further than approximately 35 percent of the wall thickness, even considering the worst case assumptions used in the analysis.

The results of the fracture mechanics analysis, considering the effects of water temperature, heat transfer coefficients, and fracture toughness of the material as a function of time, temperature, and irradiation is included in this report. Both a local effect and a continuous crack effect have been considered with the latter requiring the use of a rigorous finite element axisymmetric code.

Fatigue Mode The failure criterion used for the failure analysis is the one presented in Section III of the ASME Boiler and Pressure Vessel Code. In this method, the piece is assumed to fail once the combined usage factor at the most critical location for all transients applied to the vessel exceeds the code allowable usage factor of one.

The results of this analysis showed that the combined usage factor never exceeded 0.2, even after assuming that the safety injection transient occurred at the end of plant life.

Results In order to promote a fatigue failure during the safety injection transient at the end of plant life, it has been estimated that a wall temperature of approximately 1100°F is needed at the most critical area of the vessel (instrumentation tube welds in the bottom head). The design basis of the Safety Injection Chapter 14, Page 134 of 333 Revision 04, 2011

IP3 FSAR UPDATE System ensures that the maximum cladding temperature does not exceed the Zircaloy-4 or ZIRLO melt temperature. This is achieved by prompt recovery of the core through flooding with the passive accumulators and the injection systems. Under these conditions, a vessel temperature of 1100°F is not considered a credible possibility and the evaluations of the vessel under such elevated temperatures is for a hypothetical case. For the ductile failure mode, such hypothetical rise in the wall temperature would increase the depth of local yielding in the vessel wall.

The results of these analyses show that the integrity of the reactor vessel is never violated.

The safety injection nozzles have been designed to withstand ten postulated safety injection transients without failure. This design and the associated analytical evaluation were in accordance with the requirements of Section III of the ASME Boiler and Pressure Vessel Code.

The maximum calculated pressure plus thermal stress in the safety injection nozzle during the safety injection transient was calculated to be approximately 50,900 psi. This value compares favorably with the code allowable stress of 80,000 psi.

Ten safety injection transients are considered along with all the other design transients for the vessel in the fatigue analysis of the nozzles. This analysis showed that the usage factor for the safety injection nozzles was 0.47, which is well below the code allowable value of 1.0.

The safety injection nozzles are not in the highly irradiated region of the vessel and thus they are considered ductile during the safety injection transient.

The effect of the safety injection water on the fuel assembly grid springs has been evaluated, and due to the fact that the springs have a large surface area to volume ratio, being in the form of thin strips, and that they are expected to follow the coolant temperature transient with very little lag, hence, no thermal shock is expected and the core cooling is not compromised.

Evaluations of the core barrel and thermal shield have also shown that core cooling is not jeopardized under the postulated accident conditions 14.3.5 Environmental Consequences of Loss-of-Coolant Accident 14.3.5.1 Large-Break LOCA Chapters 5 and 6 describe the protective systems and features which are specifically designed to limit the consequences of a major Loss-of-Coolant Accident (LOCA). The capability of the Safety Injection System for preventing melting of the fuel clad and the ability of the Containment and containment cooling systems to absorb the blowdown forces resulting from a major loss of coolant are discussed in Section 14.3.4. The capability of the safeguards in meeting dose limits set in 10 CFR 50.67 is demonstrated in this section.

Because of the design conservatism and care taken during fabrication and installation of the Reactor Coolant System, a break of the system integrity of any size is considered highly unlikely.

For the purpose of evaluating radiation exposure, a double-ended rupture of a reactor coolant loop is considered with partial safeguards operating from the diesel generator power system. As shown in Section 14.3.2, the Safety Injection System, with diesel generator power from two of the three units, will maintain clad temperature well below the melting point of Zircaloy-4 or ZIRLO and will limit zirconium-water reaction to an insignificant amount. As a result of the cladding temperature increase Chapter 14, Page 135 of 333 Revision 04, 2011

IP3 FSAR UPDATE and the rapid system depressurization, however, cladding failure may occur in the hotter regions of the core. Release of the inventory of the volatile fission products in the pellet-cladding gap might follow.

The doses resulting from a Large Break LOCA have been analyzed assuming that instead of the release of gap activity from a portion of the fuel rods, major core degradation occurs resulting in the release of large amounts of activity to the containment atmosphere. The release of core fission product activity is modeled using the guidance provided in Regulatory Guide 1.183 (Reference 111).

Source Term The reactor coolant activity is assumed to be released over the first 30 seconds of the accident.

However, the activity in the coolant is insignificant compared with the release from the core and is not included in the analysis.

With the use of Regulatory Guide 1.183 source term modeling, the release of activity from the core occurs over a 1.8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> interval. Also instead of considering only the release of iodines and noble gases, a wide spectrum of nuclides is taken into consideration. Table 14C-4 lists the core inventory for the nuclides being considered for the LOCA with core melt (eight groups of nuclides). Table 14.3-18 provides the fission product release fractions and the timing/duration of releases to the containment as defined by the model in Regulatory Guide 1.183.

The iodine characterization from Regulatory Guide 1.183 is used; this is 4.85% elemental, 0.15%

organic and 95% particulate. The other groups of nuclides (other than the noble gases) all occur as particulates only.

Method of Analysis To evaluate the ability to meet 10 CFR 50.67 guidelines, the radiological consequences are calculated for the worst two hour exposure at the site boundary and for a 30 day exposure at the low population zone outer boundary distance. On site exposure is evaluated in the Control Room for a 30-day duration.

Activity releases to the environment are assumed to occur due to containment leakage and due to the leakage of sump solution recirculating outside containment The dose calculation models used in the analysis are described in Appendix 14C.

Effectiveness of Containment and Isolation Features in Terminating Activity Release The reactor Containment serves as a boundary limiting activity leakage. The containment is steel lined and designed to withstand internal pressure in excess of that resulting from the Design Basis Loss-of-Coolant Accident (Chapter 5). Weld seams and penetrations were designed with a double barrier to inhibit leakage. In addition, the Weld Channel and Penetration Pressurization System supplies a pressurized nitrogen seal, at a pressure above the containment calculated peak accident pressure, between the double barriers of the penetrations and between most double barriers of the weld seams so that if leakage occurred it would be into the Containment (Section 6.6). The Containment Isolation System, Section 5.2, provides a minimum of two barriers in piping penetrating the Containment. The Isolation Valve Seal Water System, Section 6.5, provides a water seal at a pressure above containment calculated peak accident response pressure in the piping lines that could be a source of leakage and is actuated on the containment isolation signal within one minute to Chapter 14, Page 136 of 333 Revision 04, 2011

IP3 FSAR UPDATE terminate containment leakage. The Containment was designed to leak at a rate of less than 0.1 percent per day at design pressure without including the benefit of either the Isolation Valve Seal Water System or the Penetration Pressurization System. The double penetrations and most weld seams are pressurized continuously during reactor operation causing zero outleakage through these paths. No credit is taken in the radiological consequences analysis for the Isolation Valve Seal Water System or the Penetration Pressurization System.

Effectiveness of Spray System for Iodine Removal The effectiveness of the Containment Spray System for removal of inorganic iodine from the containment atmosphere is evaluated in detail in Appendix 6A, Iodine Removal Effectiveness Evaluation of the Containment Spray System.

As discussed in Appendix 6A, an elemental iodine removal coefficient of 20 hr-1 is associated with one spray pump operating during the spray injection phase. The spray flow rate during the recirculation phase is reduced from the injection phase resulting in a removal coefficient of 5 hr-1. Recirculation spray flow may be terminated at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the accident. It is also assumed that the sprays are no longer effective after the elemental iodine inventory in the Containment is reduced by a factor of 200.

Also as discussed in Appendix 6A, a particulate iodine removal coefficient of 4.6 hr-1 is associated with the spray injection phase with one spray pump operating. The reduced spray flow available during the spray recirculation phase results in a reduction of the removal coefficient to 2.0 hr-1. As described in NUREG-800, Standard Review Plan Section 6.5.2, Revision 2, the particulate iodine removal coefficient remains at this value until a particulate iodine decontamination factor of 50 is reached and the value is then reduced by a factor of 10.

Sedimentation Removal of Particulates Aerosols in the containment atmosphere are subject to removal by sedimentation. The sedimentation removal coefficient is conservatively assumed to be only 0.1 hr-1. It is also conservatively assumed that sedimentation removal does not continue beyond a DF of 1000.

During spray operation credit is taken for sedimentation removal of particulates only in the unsprayed region of the containment. Recirculation spray operation may be terminated at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> into the accident and credit for sedimentation removal of aerosols is applied to the whole containment volume at that time.

Effectiveness of Fan-Cooler Filter System No credit is taken for the HEPA and charcoal filters installed in the fan cooler units.

Atmospheric Dispersion The meteorological dispersion of the leakage from the Containment has been calculated using the Sutton dispersion model and the dispersion parameters measured at the Indian Point site. The Sutton model has been modified to account for additional dispersion of the leakage due to turbulence in the wake of the Containment Building. Conservative dispersion characteristics applicable to three time periods were selected (Section 2.6) and the doses calculated for each period.

The Sutton equation for the dispersion of a point source at ground level gives the ground level plume concentration as a function of distance.

Chapter 14, Page 137 of 333 Revision 04, 2011

IP3 FSAR UPDATE

( ( )) ( ( (

X = (2Q ) / uC y C z x ( 2n) exp y 2 / C 2y x ( 2n) )))

Where Cy, Cz and n are the dispersion parameters, u is the wind speed, y is the lateral distance from the plume center line, x is the downwind distance and Q is the point source release term.

In order to take into account building dilution, the Sutton equation is applied to a virtual point source upwind from the Containment. The distance of this source from the building is obtained by the requirement that the dispersion factors y and z of the gaussian distribution obey the relationships:

12 4 y = (A) 4 z = ( A )1 2 Where A is the cross-sectional area of the Containment Building. Thus y and z each yield a value for the distance; the geometric average of those values is the distance xo upwind of the virtual source.

(1 ( 2n ) )

x 0 = ( A (8CyCz ) )

The modified Sutton equation becomes:

( (

X = ( 2Q ) uC yCz ( x + x 0 )

2 n

)) exp ( ( y 2

)

C2y ( x + x 0 )

n 2

)

The first and second periods of the dose calculation utilized this modified dispersion formula, a building area of 2000 square meters, and the inversion parameters assumed in TID-14844 which are conservative for the Indian Point Site.

Category Cy Cz N U Xo n/2 n/2 Inversion-I 0.4m 0.07m 0.5 1 m/sec 430 m The first period comprises the first two hours after the accident. The direction of the 1 meter per second wind is assumed to be constant throughout the period. The second is the next 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> after the accident during which the same inversion condition is assumed to exist, but the average wind speed from the same direction is assumed to be 2 meters per second.

The third period is from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident to 31 days after the accident. During this period, the meteorological conditions are assumed to be randomly distributed among the categories listed below:

Category, I Fraction, F1 1/ u Cz Cy n Lapse - L1 0.137 0.575 0.48 0.6 0.2 Lapse - L2 0.061 0.191 0.43 0.53 0.3 Neutral - N 0.378 0.358 0.39 0.47 0.4 Inversion - I 0.424 0.493 0.07 0.40 0.5 Chapter 14, Page 138 of 333 Revision 04, 2011

IP3 FSAR UPDATE The parameters u , Cy, Cz, and n for L1, L2 and N are those measured at the site (Section 2.6) and those for I are the TID-14844 assumptions. Because the winds are not expected to be from the same direction throughout the 30-day period, the dispersion formula was modified to account for long-term variability of the mean wind direction. The most adverse distribution was assumed to result in a maximum of 35 percent of the winds blowing in one 20° section. The dispersion formula used is:

2f Fi

( X Q )30 = 1 2 2 N i i

uC xi x 2 This expression is obtained by integrating the Sutton equation from - to + in the y-direction and then averaging the concentration over the desired sector, i, for the appropriate fraction of the time, f.

The other parameters have been defined with Fi being the fraction of the time any particular weather category exists. As stated, = 0.353 = (2 tan 10°) and f = 0.35.

Based on the above data, the dispersion factors listed in Table 14.3-13 are obtained. These are also plotted in Figure 14.3-73.

Control Room Model The dose criterion applicable to the Control Room is found in 10 CFR 50.67 which specifies that:

Personnel in the Control Room for a 30 day period of time following an accident must not receive doses greater than 5 rem TEDE.

Radiation doses in the Control Room are calculated based on the sources from the following areas:

1) Direct radiation from airborne radioactivity outside the Control Room

2) Airborne radioactivity inside the Control Room from makeup air intake.

3) Direct radiation from activity inside containment air.

The design of the Control Room ventilation and air conditioning system is presented in Section 9.9.2.

During normal operation, conditioned air is admitted to the Control Room through downward directed ceiling registers located 14-9 above the control room floor. A perforated aluminum or egg crate ceiling is located 12 feet above the floor.

The damper in the makeup air supply duct is partially open during normal operation and under remote manual control. For a description of the Control Room Ventilation and Filtration System refer to Section 9.9.

A Safety Injection signal or a high activity signal from the area monitor (Radiation Monitoring System) in the Control room automatically starts the separate HEPA-charcoal filter unit fan and positions dampers to route flow through this unit. Under these conditions enough air is brought in through the makeup system to maintain the Control Room at a slight positive pressure. All incoming air is passed through the HEPA-charcoal filter unit where non-gaseous activity is cleaned up in the filters.

The whole body dose from the activity inside the Control Room was calculated using a finite cloud model, as discussed in Appendix 14C. The whole body dose from the cloud passing over the Control Room was calculated taking into account the shielding afforded by the walls and roof (24 inches of Chapter 14, Page 139 of 333 Revision 04, 2011

IP3 FSAR UPDATE concrete) of the Control Room. Occupancy factors for control room personnel were assumed to be 1.0 for 0-24 hours, 0.6 for 1-4 days and 0.4 for 4-30 days.

For the direct containment dose contribution to control room operators, the sources were assumed to be homogenously distributed within the free volume of the Reactor Containment. The doses were based on a point kernel attenuation model, with the source region divided into a number of incremental source volumes, and the associated attenuation and gamma ray buildup computed between each source point and the dose point.

Containment Leakage Analysis The radiological consequences of the postulated large-break LOCA has been performed with containment leakage releases continuing over a 30-day period. The containment is assumed to leak at the design basis leakage rate of 0.1% per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and at half that rate after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Assumptions utilized in the analysis are listed in Table 14.3-18.

Sump Solution Leakage Outside Containment The Indian Point Unit 3 design includes internal recirculation which is to be maintained for the first 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> following a LOCA. An analysis has been performed to calculate the dose resulting from leakage from the ECCS outside containment after external recirculation is established at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

The activity released from the core is assumed to be present in the sump solution (with the exception of the gaseous activity). The analysis considered a leak rate of 4.0 gph. This is double the allowable limit. The leakage is assumed to start at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and continues until 30 days from the accident initiation. A conservatively low sump water volume is modeled to maximize the iodine concentration in the leakage.

Only the iodine activity has the potential of becoming airborne. Iodine partition coefficients have been calculated for the Indian Point 3 external leakage sources (ECCS leakage post LOCA) beginning at 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> post accident when ECCS flow is directed by procedure to go to portions of the external safety injection system. These calculations are based upon calculated post accident fluid temperatures and pH in sump water, and the flows and volumes in the Indian Point 3 primary auxiliary building (PAB), and ventilation flow rates in various areas of the PAB. A partition coefficient of 10% is bounding for the 6.5 hr to 30 day period. The iodine becoming airborne is assumed to be 97%

elemental and 3% organic.

Additionally, it is also assumed that during the first four hours of the accident there is 1.0 gph sump solution leakage through the reactor coolant pump seal leakoff line that enters the PAB. This leakage is assumed to have an iodine partition coefficient of 10%. The iodine becoming airborne is assumed to be 97% elemental and 3% organic.

The releases would be subject to filtration by the filtered ventilation system provided for the PAB which houses the portions of the ECCS located outside containment. However, filtration of the releases is not credited in the analysis. Table 14.3-18 provides a list of analytical inputs and assumptions for the sump solution leakage.

Calculated Doses The resulting offsite and control room doses are:

Site Boundary Chapter 14, Page 140 of 333 Revision 04, 2011

IP3 FSAR UPDATE Total 23.6 rem TEDE Low Population Zone Total 13.0 rem TEDE Control Room Total 4.98 rem TEDE The site boundary and LPZ doses are below the 10 CFR 50.67 dose acceptance guideline of 25 rem TEDE. The control room dose is below the 10 CFR 50.67 dose limit of 5.0 rem TEDE.

The worst 2-hour period for the site boundary dose is 0.6 to 2.6 hr.

14.3.5.2 Small Break LOCA Radiological Consequences The radiological consequences resulting from a small break LOCA which is large enough to result in actuation of the containment spray system would be bounded by the Large Break LOCA analysis.

This is true because a small break releases less activity to the containment than that assumed in the large break, but the spray system would function in an identical manner.

An analysis was performed to determine the radiological consequences for a small break LOCA that does not actuate the containment sprays. As a result of the accident, fuel clad damage is assumed to occur. Due to the potential for leakage between the primary and secondary systems, radioactive reactor coolant is assumed to leak from the primary into the secondary system. A portion of this radioactivity is released to the outside atmosphere through either the atmospheric relief valves or the main steam safety valves. Radioactive reactor coolant is also discharged to the containment via the break. A portion of this radioactivity is released through containment leakage to the environment.

In determining the offsite doses following the accident, it is conservatively assumed that all of the fuel rods in the core suffer sufficient damage that all of their gap activity is released. Five percent of the core activity is assumed to be contained in the pellet-clad gap. Regulatory Guide 1.183 specifies that the iodine released from the fuel is 95% particulate (cesium iodide), 4.85% elemental, and 0.15%

organic. These fractions are used for containment leakage release pathway. However, for the steam generator steaming pathway the iodine in solution is considered to be all elemental and after it is released to the environment the iodine is modeled as 97% elemental and 3% organic.

Conservatively, all the iodine, alkali metals group and noble gas activity (from prior to the accident and resulting from the accident) is assumed to be in the primary coolant (and not in the containment) when determining doses due to the primary to secondary steam generator tube leakage.

The primary to secondary steam generator tube leak used in the analysis is 0.25 gpm and 1.0 gpm for all four steam generators combined.

When determining the doses due to containment leakage, all of the iodine, alkali metal and noble gas activity is assumed to be in the containment. The design basis containment leak rate of 0.1% per day is used for the initial 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Thereafter, the containment leak rate is assumed to be one-half the design value or 0.05% per day. Releases are continued for 30 days from the start of the event.

No credit for iodine removal is taken for any steam released to the condenser prior to reactor trip and concurrent loss of offsite power. All noble gas activity carried over to the secondary side through steam generator tube leakage is assumed to be immediately released to the outside atmosphere.

Chapter 14, Page 141 of 333 Revision 04, 2011

IP3 FSAR UPDATE Secondary side releases are terminated when the primary pressure drops below the secondary side pressure.

An iodine partition factor in the steam generators of 0.01 curies/gm steam per curies/gm water is used. This partition factor is also used for the alkali metal activity in the steam generators.

No credit is taken for containment spray operation which would remove airborne particulates and elemental iodine. Credit is taken for removal of particulates by the fan cooler unit HEPA filters.

Deposition removal of elemental iodine onto containment surfaces would be expected but no credit was taken for this removal mechanism.

A listing of inputs and assumptions is provided in Table 14.3-18a.

Calculated Doses The small break LOCA 2-hour site boundary dose is 11.0 rem TEDE with the worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose being 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The 30 day low population zone dose is 5.5 rem TEDE. These doses are less than the 25 rem TEDE limit value of 10 CFR 50.67.

The accumulated dose to the control room operators following the postulated accident was calculated using the same release, removal and leakage assumptions as the offsite dose, using the control room model discussed in Appendix 14C. The calculated control room dose is 2.2 rem TEDE which is less than the 5.0 rem TEDE control room dose limit of 10 CFR 50.67.

14.3.5.3 Small Break LOCA During Purge [Historical Information]

This section is retained for historical purposes. These calculations were performed using the TID-14844 source term and 10 CFR 100 methodologies. In 2005, IP3 was reanalyzed using the Alternate Source Term Methodology under 10 CFR 50.67. This analysis was not part of the standard suite of analyses to be performed under 10 CFR 50.64.

An analysis was performed on a small break LOCA that might occur during containment purging. The analysis assumed that the break was at a location in the Reactor Coolant System (i.e., pressurizer vapor space) such that the break (leak) would not immediately affect the pressurizer pressure or actuate safety injection. A LOCA occurring elsewhere in the Reactor Coolant System, up to and including the double-ended break in the RCS pipes, would produce a low pressurizer pressure.

Normally the Reactor Containment is maintained with all flow paths to the atmosphere closed. The containment purge exhaust monitor is used to monitor the releases of the purge system and automatically close the isolation valves in the event that high radiation is detected. In addition, the isolation valves of this system are closed by a high containment pressure signal. The control room operator would also isolate the purge and ventilation systems in the event of any abnormal indications such as low Reactor Coolant System pressure or leakage indications. With the two 36-inch diameter purge lines open to the atmosphere, pressure buildup within the Containment could be delayed.

Under those conditions, containment isolation would be initiated upon a high radiation signal in the purge exhaust or within an expected 15 minutes by the control room operator. With these assumptions, safety injection is assumed delayed until the containment high pressure setpoint is reached or is initiated manually. For the range of pipe sizes connected to the pressurizer vapor space (i.e., 3/4 inch up through 6 inches) and evaluated in the analysis, no clad damage is expected and the resulting activity released to the Containment is limited to that contained in the Reactor Coolant System prior to the accident.

Chapter 14, Page 142 of 333 Revision 04, 2011

IP3 FSAR UPDATE The radiological consequences of a Loss-of-Coolant Accident as a result of a rupture in the pressurizer during containment purging make the following conservative assumptions:

1. Rupture in the pressurizer vapor space occurs at full power coincident with containment purging*

2. The activity stored in the Reactor Coolant System (assuming 1% defective fuel) is assumed to be released at a constant rate over a time period of 10 minutes (time to blowdown the Reactor Coolant System at maximum rate)

3. Of the iodine released to the Containment, 50% immediately plates out on interior surfaces of the Containment. Of the airborne iodine in the Containment, 10% is assumed to be of organic form.

4. All activity in the Reactor Coolant System is released to the lower containment volume during blowdown (see Table 9.2-5).

5. No additional core damage occurs as a result of the accident.

6. Containment isolation is not automatically initiated. Rather, containment isolation is initiated by the operator in the Control Room. Two cases were analyzed: a) containment isolation in 15 minutes following the accident, and b) containment isolation is delayed until 50 minutes after the accident.

7. After the Containment is isolated, activity releases result from containment leakage only.

• NOTE: Containment purging is only achieved at cold shutdown.

Tables 14.3-19 through 14.3-21 give the design values, isotopic, and meteorological data used in this analysis. The dose equations and standard man data used in this analysis are consistent with those given in AEC Safety Guide No. 4. Table 14.3-22 gives the doses calculated for this accident. As can be seen from this table, the doses resulting from this postulated accident are well within the guidelines of 10 CFR 100, even for the unlikely case of continued purging for 50 minutes following the accident.

A variation on this scenario has been evaluated and found to be bounded by the Small Break LOCA During Purge accident for Site Boundary and Low Population Zone and, by separate analysis, for the Control Room. This variation involves a pressurizer line break at such time that the pressurizer temperature is greater than 200°F with the remainder of the Reactor Coolant System below 200°F.

Because the RCS is in the cold shutdown condition, containment integrity is relaxed. Therefore, a postulated pressurizer line break could potentially result in a steam release from the RCS to the environment. Conservative assumptions for this scenario include: 1) the release of the entire pressurizer volume as saturated liquid flashing to steam, 2) the break occurring after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of subcriticality following full power reactor operation with the failed fuel at the Technical Specification limit, 3) no credit for containment closure or holdup, 4) release of 50% of halogens and all noble gases to the environment, and 5) a Control Room manual isolation time of 5 minutes, which maximizes doses to Control Room personnel. Under these circumstances, the resultant worst case doses are 24.6 rem to the thyroid in the Control Room (about 82% of the 10 CFR 50, Appendix A, Criterion 19 Limit). For the Site Boundary and Low Population Zone, the doses are less than 10% of the 10 CFR 100 limits (92).

Chapter 14, Page 143 of 333 Revision 04, 2011

IP3 FSAR UPDATE These doses are based on a 24-hour delay prior to relaxation of Commitment integrity after shutdown and on the assumption of reactor coolant activity at the Technical Specifications limits. Accordingly, this delay may be relaxed if measured reactor coolant activity is low, provided that it can be shown that the above doses would not be exceeded subsequent to a postulated pressurizer break. This may be done by using low coolant activity to compensate for a shorter delay time, as established in Reference 92 and plant procedures. This time delay represents administrative controls placed on the relaxation of containment integrity that are more conservative than the licensing basis.

14.3.6 Containment Integrity Analysis The design and licensing of nuclear power plants require that the containment be analyzed for pressure and temperature effects. The analyses include pressure and temperature transients to which the containment might be exposed as a result of postulated line breaks. Containment integrity and subcompartment safety analyses are performed for dry containment designs to quantify the margin in the containment design pressure and peak temperature for equipment environmental qualification (EQ), and to demonstrate the acceptability of the containment safeguards equipment to mitigate the postulated transient. As part of a Containment Margin Improvement Program (Reference

90) carried out in 1989, long-term containment integrity analyses were conducted. The objective of the 1989 analysis program was to provide containment analysis results using plant-specific Indian Point Unit 3 data, circa 1989, and new state-of-the-art Loss-of-Coolant-Accident (LOCA) mass and energy release (M&E) evaluation models. In this way the licensing basis for Unit 3 is clarified and updated, and pressure margin for operation of Unit 3 had been determined and made available for possible future use. Subsequent reanalyses were completed for Containment Integrity with respect to the effects of High-Head Injection flow balance criteria, using the margin improvement program as the basis. The Containment Integrity accident analyses herein demonstrate that the peak calculated containment pressure will remain less than the containment design value of 47 psig as identified in WCAP-12269 (Reference 90). SECL-92-131 (Reference 91), SECL-92-255 (Reference 103), and WCAP-12269 document the historical licensing basis containment analyses of record. The 47-psig limit was used as an acceptance criteria by the U.S. Nuclear Regulatory Commission (NRC) in their safety evaluation report (SER) addressing the Containment Margin Improvement and Ultimate Heat Sink Programs (Reference 104).

The potential effects of the IP3 Stretch power Uprate (SPU) were defined as changes to specific safety analysis input parameter values. All safety analysis input parameter values that could potentially be affected by the SPU (Reference 113) were reviewed based on pertinent instrument channel uncertainty calculation previously performed.

The specific changes to safety analyses input parameters consistent with the SPU are:

1. Uncertainly on initial pressurizer pressure of +49 psi.

2. Lower bound on initial accumulator pressure of 555 psia (540 psig).

3. Range on accumulator volume from 807.2 ft3 to 847.2 ft3.

4. Uncertainty on initial condition steam generator level of +10% narrow range span (NRS).

5. Uncertainty on reactor coolant flow of +/- 2.9%.

LOCA The uncontrolled release of pressurized high temperature reactor coolant, termed a Loss-of-Coolant Accident (LOCA), will result in release of steam and water into the containment. This, in turn, will result in an increase in local subcompartment pressures, and an increase in the global containment pressure and temperature. The pressurization of subcompartments in the immediate Chapter 14, Page 144 of 333 Revision 04, 2011

IP3 FSAR UPDATE vicinity of the LOCA break area is evaluated to ensure structural integrity of the subcompartment structures. The most severe pressurization in these areas generally occurs due to the large M&E flow early in the transient. In contrast, the global containment, temperature and pressure must be evaluated for long term EQ concerns as well as for the pressure peaks (which occur later than the subcompartment pressure peaks). Therefore, there are both long and short term issues relative to a postulated LOCA that must be considered. As part of the SPU, long-term and short-term LOCA M&E releases were calculated. The long term M&E releases are affected by changes to safety analysis input parameters consistent with IP3 SPU. Specific changes to the safety analysis input parameters included: uncertainty in initial condition pressurizer pressure of +/- 49 psi; lower bound change on initial accumulator pressure of 555 psia (540psig); range on accumulator volume from 807.2 ft3 to 847.2 ft3, uncertainty in initial condition steam generator level of +/- 10% narrow range span (NRS); uncertainty on reactor coolant flow of +/- 2.9%; and uncertainty on initial condition pressurizer level of +5.1/-3.5%

span. Thus, a reanalysis was performed in order to credit additional margin to the containment design and EQ limits due to analysis methodology improvements. Short-term M&E releases are neither adversely nor significantly affected by changes to safety analyses input parameters consistent with the Indian Point Unit 3 SPU.

In addition, a long-term containment response analysis is performed based on the calculated long-term M&E releases. The containment response analysis is performed in order to demonstrate the capability of the containment safeguards systems to maintain the containment pressure and temperature below the design and EQ limits following a postulated LOCA. Note that for IP3, LOCA was determined to be limiting for peak pressure.

MSLB Steamline ruptures occurring inside a reactor containment structure may result in significant releases of high-energy fluid to the containment environment, possibly resulting in high containment temperatures and pressures. The quantitative nature of the releases following a steamline rupture is dependent upon the many possible configurations of the plant steam system and containment designs as well as the plant operating conditions, the size of the rupture, and the single failure assumption.

The analysis typically considers a variety of postulated pipe breaks encompassing wide variations in plant operation, safety system performance, and break size in determining the containment response to a secondary system pipe rupture.

The postulated break area can have competing effects in blowdown results. Larger areas will be more likely to result in large amounts of water being entrained in the blowdown. However, larger breaks also result in earlier generation of protective trip signals following the break and a reduction of both the power production by the plant and the amount of high energy fluid available to be released to the containment.

When evaluating Indian Point Unit 3, the effects of plant power level and break area on the M&E releases from a ruptured steamline have been restricted to a small a number of cases. Plant power levels of 0%, 30%, 70% and 100% of nominal full power and only the full double-ended rupture (DER) were considered in WCAP-12269 (Reference 90). The cases examined in this study were identified as part of the Margin Improvement Program related to steamline break M&E releases inside containment.

14.3.6.1 Long-Term LOCA Mass and Energy Releases 14.3.6.1.1 Introduction Chapter 14, Page 145 of 333 Revision 04, 2011

IP3 FSAR UPDATE Discussed in this section are the long-term LOCA M&E releases for the hypothetical double-ended pump suction (DEPS) and double-ended hot leg (DEHL) break cases. The mass energy release rates described in this section form the basis of further computations to evaluate the containment response following the postulated LOCA (subsection 14.3.6.2).

A total of three LOCA M&E release cases were analyzed. These cases addressed two different break locations, the DEHL break and the DEPS break. The DEPS break was analyzed for both minimum and maximum safeguards (minimum and maximum pumped emergency core cooling system flows).

The minimum emergency core cooling system (ECCS) cases were performed to address maximum available steam release (minimizing steam condensation) and the maximum ECCS cases were performed to address the effects of maximizing mass flow and subsequent effect on containment response.

The limiting long-term LOCA M&E releases are extended out in time to approximately 115 days and are utilized as input to the containment response analysis, which demonstrates margin to the containment design and EQ limits and the acceptability of the containment safeguards systems to mitigate the consequences of a hypothetical large break LOCA. The containment safeguards systems must be capable of limiting the peak containment pressure to less than the design pressure and to limit the temperature and pressure excursion to below the EQ limits. For both the current licensing basis and the SPU, the M&E releases were generated with the March 1979 model, described in Reference 45. The NRC review and approval letter for this model is included with Reference 45. The Reference 45 methodology continues to be acceptable and applicable to Indian Point Unit 3, and has been used and approved on many plant-specific-dockets.

14.3.6.1.2 Input Parameters and Assumptions The M&E release analysis is sensitive to the assumed characteristics of various plant systems. Some of the most-critical items are the RCS initial conditions, core decay heat, accumulators, ECCS flow, and primary and secondary metal mass and steam generator heat release modeling. Specific assumptions concerning each of these items are discussed in this section. Tables 14.3-23 through 14.3-26 present key data assumed in the analysis. All input parameters are determined based on NRC accepted methodology (Reference 45).

Initial Power Level The initial power level is assumed to be 3280.3 MWt which is 102% of the rated thermal power (3216 MWt) adjusted for a calorimetric error of 2% for the Indian Point Unit 3 Station. A maximum initial power is conservative for maximizing the M&E releases, with respect to RCS temperature, available decay heat energy and initial core stored energy.

Initial RCS Temperature and Pressure Initial RCS temperatures are chosen to bound the highest average coolant temperature range of all operating cases. The initial THOT (vessel outlet temperature) of 610.5°F and initial TCOLD (core inlet temperature) of 548.5°F were modeled; both temperatures include a +7.5°F for instrument error and deadband. The use of the higher temperatures is conservative because the initial fluid energy is based on coolant temperatures that are at the maximum levels attained in steady state operation.

The RCS pressure is based upon a nominal value of 2250 psia plus an allowance of +49 psi that accounts for the measurement uncertainty on pressurizer pressure. This assumption only affects the blowdown phase results. The rate at which the RCS blows down is initially more severe at the higher RCS pressure. Additionally the RCS has a higher fluid density at the higher pressure (assuming a constant temperature) and subsequently has a higher RCS mass available for releases. (Note: The Chapter 14, Page 146 of 333 Revision 04, 2011

IP3 FSAR UPDATE RCS initial temperatures were conservatively based upon a steam generator tube plugging (SGTP) level conditions of 0% to 10%, to cover all possible temperature range of operation.)

Steam Generator Model A uniform steam generator tube plugging level of 0% is modeled. This assumption maximizes the reactor coolant volume and fluid release by virtue of consideration of the RCS fluid in all tubes.

During the post-blowdown period, the steam generators are active heat sources since significant energy remains in the secondary metal and secondary mass that has the potential to be transferred to the primary side. The 0% tube plugging assumption maximizes heat transfer area and therefore the transfer of secondary heat across the steam generator tubes. Additionally, this assumption reduces the reactor coolant loop resistance, which reduces the pressure drop upstream of the break for DEPS breaks and increases break flow. Thus, the analysis very conservatively accounts for the level of steam generator plugging by using 0%.

Secondary-to-primary heat transfer is maximized by assuming conservative coefficients of heat transfer (i.e., steam generator primary/secondary heat transfer and RCS metal heat transfer).

Maximum secondary-to-primary heat transfer is ensured by maximizing the initial steam generator mass based upon 100% power conditions and then increasing this by 10% to maximize the available energy.

Fuel Design - Core Stored Energy Core stored energy is the amount of energy in the fuel rods above the local coolant temperature. The selection of the fuel design features for the long-term M&E release calculation is based on the need to conservatively maximize the energy stored in the fuel at the beginning of the postulated accident.

Core stored energy is addressed in the analysis as full power seconds.

Core Decay Heat Model The Nuclear Power Plant Standards Committee (NUPPSCO) of the American Nuclear Society (ANS) approved ANS Standard 5.1 (Reference 48) for the determination of decay heat. This standard was used in the M&E release model with the input described below.

Significant assumptions in the generation of the decay heat curve for use in design basis containment integrity LOCA analyses include:

1. Decay heat sources are fission product decay and heavy element decay of U-239 and Np-239.

2. Decay heat power from fissioning isotopes other than U-235 is assumed to be identical to that of U-235.

3. Fission rate is constant over the operating history of maximum power level.

4. The factor accounting for neutron capture in fission products has been taken from Table 10, of Reference 48.

5. The fuel has been assumed to be at full power for 108 of a seconds.

6. The total recoverable energy associated with one fission has been assumed to be 200 MeV/fission.

7. Two sigma uncertainty (two times the standard deviation) has been applied to the fission product decay.

Based upon NRC staff review, the SER of the March 1979 evaluation model (Reference 45), the use of the ANS Standard-5.1, November 1979 decay heat model was approved for the calculation Chapter 14, Page 147 of 333 Revision 04, 2011

IP3 FSAR UPDATE of mass and energy releases to the containment following a loss-of-coolant accident. Table 14.3-26 provides the Decay Heat Curve.

The NRC issued an information notice (Reference 100) regarding the use of the ANS 5.1 decay heat standard. The following items address that information notice:

1. The comparisons presented in the information notice are for Peak Cladding Temperature only. Even though decay effects are illustrated, there is no mention of LOCA M&E releases and containment response calculations.

However, there is the implied impact on any analysis that has utilized the ANS standard.

2. For LOCA M&E, the current methodology (Reference 45) utilizes the ANS Standard 5.1 for the determination of the decay heat. The input utilized is called out on page 2-10 of the WCAP. The model, including the decay heat model, has been approved (letter from C. E. Rossi of NRC to W. J. Johnson of Westinghouse, dated 2/17/87, included with Reference 45.)

3. For LOCA M&E, the ANS 5.1 standard is used in the selection of inputs. Power history, initial fuel enrichment, and neutron flux level, which are called out in the information notice, are also called out in Reference 45.

Reactor Coolant System Fluid Energy An increase in RCS fluid volume of 3% (which is composed of 1.6% allowance for thermal expansion and 1.4% for uncertainty) is modeled. A total vessel TDF of 354,400 gpm was used, which includes an allowance for RCS flow uncertainty of +/- 2.9%.

Application of Single-Failure Criteria An analysis of the effects of the single-failure criterion has been performed on the M&E release rates for each break analyzed. An inherent assumption in the generation of the M&E release is that offsite power is lost. This results in the actuation of the emergency diesel generators, which are required to power the ECCS. Maximum containment backpressure equal to the design pressure is modeled, which affects the rate of safety injection, extending the reflood phase, and maximizing the steam release.

Two single failures have been analyzed: The first postulates the single failure of an emergency diesel generator. This is conservatively assumed to result in the loss of one train of safeguards equipment, which is conservatively modeled as: two high head safety injection (HHSI) and one Low Head Safety Injection (LHSI) pump (Minimum Safeguards). The second single failure assumption postulates failure of one containment spray pump. However, this has no impact on the amount of ECCS flow and therefore, no impact on the mass and energy release portion of the analysis. This case considers 3 HHSI and 2 LHSI Pumps (Maximum ECCS).

Safety Injection System Following a large-break LOCA inside containment, the safety injection system (SIS), operates to reflood the RCS. The first phase of the SIS operation is the passive accumulator injection. Four accumulators are assumed available to inject. When the RCS depressurizes to 555 psia the Chapter 14, Page 148 of 333 Revision 04, 2011

IP3 FSAR UPDATE accumulators begin to inject into the cold legs at the reactor coolant loops. The accumulator injection temperature was modeled as 130°F.

The active pumped ECCS operation of the SIS was modeled to address both minimum and maximum safeguards (minimum ECCS and maximum ECCS). The minimum ECCS flow is addressed to calculate the effect on minimizing steam-water mixing/ steam condensation. The maximum ECCS case addresses the effects of maximizing mass flow. The safety injection (SI) signal is assumed to be actuated on the low pressurizer pressure setpoint of 1648.7 psia. The SIS was assumed to deliver to the RCS 27.8 seconds after the generation of the SI signal. The ECCS flow is delivered as a function of RCS pressure. The pumped ECCS temperature for the injection phase was assumed to be at 110°F. In the determination of long-term containment pressure and temperature transients, credit is taken for cold leg pumped sump recirculation ECCS flow to the core and sump heat removal via the residual heat removal system (RHR) heat exchangers (HX). For the minimum ECCS case, (failure of one emergency diesel generator), two HHSI pumps and one LHSI pump are available. The ECCS configuration for the recirculation phase maximum ECCS case is three HHSI pumps and two LHSI pumps.

Tables 14.3-24 and 14.3-25 provide the pumped ECCS flows as a function of RCS pressure for the minimum and maximum ECCS cases, respectively.

14.3.6.1.3 Description of Analyses The evaluation model used for the long-term LOCA M&E release calculations is the March 1979 model described in Reference 45. This evaluation model has been reviewed and approved generically by the NRC. The approval letter is included with Reference 45. This LOCA M&E release methodology has been utilized and approved on the plant-specific dockets for other Westinghouse PWRs such as Catawba Units 1 and 2, Beaver Valley Unit 2, McGuire Units 1 and 2, Millstone Unit 3, Sequoyah Units 1and 2, Surry Units 1 and 2, Indian Point Unit 2 and Indian Point Unit 3.

A description of the Reference 45 methodology is provided below.

Mass and Energy Release Phases The LOCA M&E release analysis is typically divided into four phases: blowdown, refill, reflood, and post-reflood. Each of these phases is analyzed by the following codes: SATAN-VI (blowdown),

WREFLOOD (reflood), FROTH (post-reflood) and EPITOME (post-reflood).

The phases and codes are discussed in detail below.

The first phase of a LOCA M&E release transient is the blowdown phase, the period of time from accident initiation (when the reactor is at steady state operation) to the time that the RCS and containment reach an equilibrium pressure. The blowdown period is typically <30 seconds. It ends when the RCS active core area is essentially empty, which is within seconds of ECCS injection actuation for the minimum safeguards ECCS case. For the maximum ECCS case, ECCS injection is credited after the SI signal is reached without a delay as noted above in order to maximize the mass flow.

A M&E release version of the SATAN-VI code is used for computing the blowdown transient. The code utilizes the control volume (element) approach with the capability for modeling a large variety of thermal fluid system configurations. The fluid properties are considered uniform and thermodynamic equilibrium is assumed in each element. A point kinetics model is used with weighted feedback Chapter 14, Page 149 of 333 Revision 04, 2011

IP3 FSAR UPDATE effects. The major feedback effects include moderator density, moderator temperature, and Doppler broadening. A critical flow calculation for subcooled (modified Zaloudek), two-phase (Moody), or superheated break flow is incorporated into the analysis. The methodology for the use of this model is described in Reference 45.

The refill period is the second phase of the LOCA M&E release transient. It is the period of time when the lower plenum is being filled by accumulator and pumped ECCS water. At the end of blowdown, a large amount of water remains in the cold legs, downcomer and lower plenum. To conservatively consider the refill period for the purpose of containment M&E releases, it is assumed that this water is instantaneously transferred to the lower plenum along with sufficient accumulator water to completely fill the lower plenum. This allows an uninterrupted release of M&E to containment. Thus, the refill period is conservatively neglected in the M&E release calculation.

The third phase of a LOCA M&E release transient is the core reflooding phase, which begins when the RCS has depressurized (blowdown) due to the loss of water through the break. The water from the lower plenum, supplied by the ECCS refills the reactor vessel and provides cooling to the core.

This phase ends when the core is completely quenched. The model conservatively assumes quenching of the core at the 10-foot elevation for containment functional design calculations. During this phase, decay heat generation will produce boiling in the core resulting in a two-phase mixture of steam and water in the core. This two-phase mixture rises above the core and subsequently enters the steam generators. The most-important feature is the steam/water mixing model (described below), which is used during this phase.

The WREFLOOD code is used for computing the reflood portion of the M&E transient. The WREFLOOD code consists of two basic hydraulic models - one for the contents of the reactor vessel, and one for the coolant loops. The two models are coupled through the interchange of the boundary conditions applied at the vessel outlet nozzles and at the top of the downcomer. Additional transient phenomena such as pumped ECCS and accumulators, reactor coolant pump performance, and steam generator releases are included as auxiliary equations that interact with basic models as required. The WREFLOOD code permits the capability to calculate variation during the core reflooding transient of basic parameters such as core flooding rate, core and down comer water levels, fluid thermodynamic conditions (pressure, enthalpy, density) throughout the primary system, and mass flow rates through the primary system. The code permits hydraulic modeling of the two flow paths available for discharging steam and entrained water from the core to the break (i.e., the path through the broken loop and the path through the unbroken loops).

A complete thermal equilibrium mixing condition for the steam and ECCS injection water during the reflood phase has been assumed for each loop receiving ECCS water. This is consistent with usage and application of the Reference 45 M&E release evaluation model in recent analyses, (e.g., D.C.

Cook Docket Reference 101). Even though the Reference 45 model credits steam/mixing only in the intact loop and not in the broken loop, justification, applicability, and NRC approval for using the mixing model in the broken loop has been documented (Reference 101). This assumption is justified and supported by test data, and is summarized below.

The model assumes a complete mixing condition (i.e., thermal equilibrium) for the steam/ water interaction. The complete mixing process, however, is made up of two distinct physical processes.

The first is a two-phase interaction with condensation of steam by cold ECCS water. The second is a single-phase mixing of condensate and ECCS water. Since the steam release is the most important influence to the containment pressure transient, the steam condensation part of the mixing process is the only part that needs to be considered. (Any spillage directly heats only the sump.)

Chapter 14, Page 150 of 333 Revision 04, 2011

IP3 FSAR UPDATE The most applicable steam/water mixing test data has been reviewed for validation of the containment integrity reflood steam/water model. This data was generated in 1/3-scale tests (Reference 46),

which are the largest scale data available, and thus most clearly simulates the flow regimes and gravitational effects that would occur in a PWR. These tests were designed specifically to study the steam/water interaction for PWR reflood conditions.

From the entire series of 1/3-scale tests, a group corresponds almost directly to containment integrity reflood conditions. The injection flow rates for this group cover all phases and mixing conditions calculated during the reflood transient. The data from these tests were reviewed and are discussed in detail in Reference 45. For all of these tests, the data clearly indicates the occurrence of very effective mixing with rapid steam condensation. The mixing model used in the containment integrity reflood calculation is therefore wholly supported by the 1/3-scale steam/water mixing data.

Additionally, the following justification is also noted, the post-blowdown limiting break for the containment integrity peak pressure analysis is the DEPS break. For this break, there are two flowpaths available in the RCS by which M&E may be released to containment. One is through the outlet of the steam generator, and the other is via reverse flow through the reactor coolant pump.

Steam that is not condensed by ECCS injection in the intact RCS loops passes around the downcomer and through the broken loop cold leg and pump in venting to containment. This steam also encounters ECCS injection water as it passes through the broken loop cold legs, complete mixing occurs and a portion of it is condensed. It is this portion of condensed steam that is taken credit for in this analysis. This assumption is justified based upon the postulated break location, and the actual physical presence of the ECCS injection nozzle. A description of the test and test results is contained in References 45 and 46.

Post-reflood describes the period following the reflood transient. For the DEPS break, a two-phase mixture exits the core, passes through the hot legs, is superheated in the steam generators, and exits the break as superheated steam. After the broken loop steam generator cools, the break flow becomes two phase.

The FROTH code (Reference 47) is used for computing the post-reflood transient. The FROTH code calculates the heat release rates resulting from a two-phase mixture level present in the steam generator tubes. The M&E releases that occur during this phase are typically superheated due to the depressurization and equilibration of the broken loop and intact loop steam generators. During this phase of the transient, the RCS has equilibrated with containment pressure, but the steam generators contain a secondary inventory at an enthalpy that is much higher than the primary side. Therefore, there is a significant amount of reverse heat transfer that occurs. Steam is produced in the core due to core decay heat. During the FROTH calculation ECCS injection is addressed for both the injection phase and the recirculation phase.

Steam generator equilibration and depressurization is the process by which secondary side energy is removed from the steam generators in stages. The FROTH computer code calculates the heat removal from the secondary mass until the secondary temperature is at the saturation temperature (Tsat) at the containment design pressure. After the FROTH calculations, steam generator secondary energy is removed based on first- and second-stage rates. The EPITOME code continues the FROTH calculation for steam generator cooldown. The first-stage rate is applied until the steam generator reaches Tsat at the user-specified intermediate equilibration pressure, when the secondary pressure is assumed to reach the actual containment pressure. Then the second-stage rate is used until the final depressurization, when the secondary reaches the reference temperature of Tsat at 14.7 psia, or 212°F. The heat removal of the broken-loop and intact-loop steam generators are calculated separately.

Chapter 14, Page 151 of 333 Revision 04, 2011

IP3 FSAR UPDATE By reading the output files from SATAN VI, WREFLOOD, and FROTH, the EPITOME code compiles a summary of data on the entire transient, including formal instantaneous M&E release tables and M&E balance tables with data at critical times.

During the FROTH calculations, steam generator heat removal rates are calculated using the secondary side temperature, primary side temperature and a secondary side heat transfer coefficient determined using a modified McAdams correlation. Steam generator energy is removed during the FROTH transient until the secondary side temperature reaches saturation temperature at the containment design pressure. The constant heat removal rate used during the first heat removal stage is based on the final heat removal rate calculated by FROTH. The steam generator energy available to be released during the first stage interval is determined by calculating the difference in secondary energy available at the containment design pressure and that at the (lower) user specified intermediate equilibration pressure, assuming saturated conditions. This energy is then divided by the first stage energy removal rate, resulting in an intermediate equilibration time. At this time, the rate of energy released drops substantially to the second-stage rate. The second-stage rate is determined as the fraction of the difference in secondary energy available between the intermediate equilibration and final depressurization at 212°F, and the time difference from the time of the intermediate equilibration to the user-specified time of the final depressurization at 212°F. With current methodology, all of the secondary energy remaining after the intermediate equilibration is conservatively assumed to be released by imposing a mandatory cooldown and subsequent depressurization down to atmospheric pressure at 3600 seconds, i.e., 14.7 psia and 212°F.

As discussed, the current approved methodology assumes that all energies in the system are taken out to these conditions in the first hour of the event. In actuality, the release of these energies to these conditions would take much longer, on the order of hours. There is the possibility that the remaining energies, for example, down to containment conditions of 130°F could be released:

however, this is not included in the releases discussed herein. Based upon the current and approved models, this additional energy would tend to slightly increase the water temperature of the spilled fluid coming form the pump side of the break, but would not increase the amount of steam being released from the steam generator side of the break. It is expected that the effects on the long-term cooldown would be insignificant.

The methodology for the use of this model is described in Reference 45. The M&E release rates are calculated by FROTH and EPITOME until the time of containment depressurization. After containment depressurization (14.7 psia), the M&E release available to containment is generated directly from core boiloff/decay heat.

Computer Codes The Reference 45 M&E release evaluation model is comprised of M&E release versions of the following codes: SATAN VI, WREFLOOD, FROTH, and EPITOME. These codes were used to calculate the long-term LOCA M&E releases for Indian Point Unit 3.

SATAN VI calculates blowdown, the first portion of the thermal-hydraulic transient for the RCS following break initiation, including pressure, enthalpy, density, M&E flowrates, and energy transfer between primary and secondary systems as a function of time.

The WREFLOOD code addresses the portion of the LOCA transient during the core reflood phase.

Chapter 14, Page 152 of 333 Revision 04, 2011

IP3 FSAR UPDATE FROTH models the post-reflood portion of the transient. The FROTH code is used for the steam generator heat addition calculation from the broken and intact loop steam generators.

EPITOME continues the FROTH post-reflood portion of the transient from the time at which the secondary equilibrates to containment design pressure to the end of the transient.

Break Size and Location Generic studies have been performed with respect to the effect of postulated break size on the LOCA M&E releases. The double ended guillotine break has been found to be limiting due to larger mass flow rates during the blowdown phase of the transient. During the reflood and post-reflood phases, the break size has little effect on the releases.

Three distinct locations in the reactor coolant system loop can be postulated for pipe rupture:

1. Hot leg (between reactor vessel and steam generator)

2. Cold leg (between reactor coolant pump and reactor vessel)

3. Pump suction (between steam generator and reactor coolant pump)

The DEHL rupture has been shown in previous studies to result in the highest blowdown M&E release rates. Although the core flooding rate would be the highest for this break location, the amount of energy released from the steam generator secondary is minimal because the majority of the fluid that exits the core bypasses the steam generators venting directly to containment. As a result, the reflood M&E releases are reduced significantly as compared to either the pump suction or cold leg break locations where the core exit mixture must pass through the steam generators before venting through the break. For the DEHL break, generic studies have confirmed that there is no reflood peak (i.e.,

from the end of the blowdown period the containment pressure continually decreases). Therefore only the M&E releases for the hot leg break blowdown phase are calculated and presented in this section of the report.

The cold leg break location has been found in the previous studies to be much less limiting in terms of the overall containment energy releases. The cold leg blowdown is faster than that of the pump suction break, and more mass is released into the containment. However, the core heat transfer is greatly reduced (due to the break location the flow will bypass the normal path through the core and go through the path of least resistance to the broken loop) and this results in a considerably lower energy release into containment. Studies have determined that the blowdown transient for the cold leg is less limiting than that for the pump suction and hot leg breaks. During reflood, the flooding rate is greatly reduced because all the core vent paths include the resistance of the reactor coolant pump, in addition to ECCS injection spill, thus the energy release rate into the containment is reduced.

Therefore, the cold leg break is not included in the scope of this analysis.

The DEPS break combines the effects of the relatively high core flooding rate, as in the DEHL break, with the addition of the stored energy in the steam generators. As a result, the DEPS break yields the highest energy flow rates during the post-blowdown period by including all of the available energy of the RCS and secondary side in calculating the releases to containment.

The break locations analyzed for this program are the DEPS rupture (10.48 ft2), and the DEHL rupture (9.18 ft2). Break M&E releases have been calculated for the blowdown, reflood and post-reflood phases of the LOCA for the DEPS cases. For the DEHL case, the releases were calculated only for the blowdown phase.

Sources of Mass and Energy Chapter 14, Page 153 of 333 Revision 04, 2011

IP3 FSAR UPDATE The sources of mass considered in the LOCA M&E release analysis are given in Tables 14.3-29, 14.3-47, and 14.3-53. These sources are the RCS, accumulators, and pumped SI.

The energy inventories considered in the LOCA M&E release analysis are given in Tables 14.3-30, 14.3-48, and 14.3-54. The energy sources include:

1. RCS-Water

2. Accumulator Water (all four inject)

3. Pumped Injection Water (RWST/ECCS)

4. Decay Heat

5. Core Stored Energy

6. RCS-Metal - Primary Metal (includes steam generator tubes)

7. Steam Generator Metal (includes transition cone, shell, wrapper, and other internals)

8. Steam Generator Secondary Energy (includes fluid mass and steam mass)

9. Secondary Transfer of Energy (feedwater into and steam out of the steam generator secondary)

The M&E inventories are presented at the following times, as appropriate:

1. Time zero (initial conditions)

2. End of blowdown time

3. End of refill time

4. End of reflood time

5. Time of broken loop steam generator equilibration to pressure setpoint

6. Time of intact loop steam generator equilibration to pressure setpoint

7. Time of full depressurization (3600 seconds)

Energy Reference Points Available Energy: 212°F; 14.7 psia The current approved methodology assumed that all energies in the system are taken out to these conditions in the first hour of the event. This is the total available energy.

Total Energy Content: 32°F; 14.7 psia This is the reference point for the system energy.

In the M&E release data presented, no zirc-water reaction heat was considered because the clad temperature is assumed not to rise high enough for the rate of the zirc-water reaction heat to be of any significance.

14.3.6.1.4 Acceptance Criteria A large-break LOCA is classified as an ANS Condition IV event, an infrequent fault. To satisfy the NRC-on-acceptance criteria presented in the Standard Review Plan Section 6.2.1.3, the relevant requirements are as follows:

1. 10 CFR 50, Appendix A: as it relates to General Design Criteria 16 and 50, with respect to containment design integrity and containment heat removal.

Chapter 14, Page 154 of 333 Revision 04, 2011

IP3 FSAR UPDATE

2. 10 CFR 50, Appendix K, paragraph 1.A: as it relates to sources of energy during the LOCA, provides requirements to assure that all energy sources have been considered.

In order to meet these requirements, the following must be addressed:

1. Sources of Energy

2. Break Size and Location

3. Calculation of Each Phase of the Accident

4. Single Failure Criteria Each of these items except for the single failure criteria is addressed in Section 14.3.6.1.3. The single failure criteria is discussed in Section 14.3.6.1.2.

14.3.6.1.5 Results Using the Reference 45 methodology, the M&E release rates were developed to determine the containment pressure and temperature responses for each of the LOCA cases noted in Section 14.3.6.1. The LOCA M&E releases discussed in this section provide the basis for the containment response analysis provided in Section 14.3.6.2.

Table 14.3-27 presents the calculated M&E release for the blowdown phase of the DEHL break. For the DEHL break M&E release tables, break path one refers to the M&E exiting from the reactor vessel side of the break and break path two refers to the M&E exiting from the steam generator side of the break.

Tables 14.3-33 and 14.349 present the calculated M&E releases for the blowdown phase of the DEPS break for the minimum and maximum safeguards cases. For the DEPS breaks, break path one in the M&E release tables refers to the mass and energy exiting from the steam generator side of the break and break path two refers to the M&E exiting from the pump side of the break.

Tables 14.3-34, and 14.3-50 present the calculated M&E release for the reflood phase of the DEPS break, diesel failure (minimum safeguards), and no failure (maximum safeguards) cases, respectively.

The transients of the principal parameters, such as core flooding rate, core and downcomer level, and SI and accumulator injection rates during he core reflooding portion of the LOCA are given in Tables 14.3-37 and Table 14.3-51 for the DEPS cases.

Tables 14.3-46 and 14.3-52 present the two-phase post-reflood M&E release data for the DEPS.

The sequence of events for the LOCA transients is included in Tables 14.3-58 through 14.3-60.

14.3.6.1.6 Conclusions The consideration of the various energy sources in the long-term M&E release analysis provides assurance that all available sources of energy have been included in this analysis. Thus, the review guidelines presented in Standard Review Plan Section 6.2.1.3 have been satisfied. Any other conclusions cannot be drawn from the generation of M&E releases directly since the releases are inputs to the containment integrity analyses.

14.3.6.2 Long Term LOCA Containment Response (COCO) Analysis 14.3.6.2.1 Accident Description Chapter 14, Page 155 of 333 Revision 04, 2011

IP3 FSAR UPDATE The Indian Point Unit 3 Station containment system is designed such that for all high-energy line break sizes, up to and including the double-ended severance of a reactor coolant pipe or secondary system pipe, the containment peak pressure remains below the design pressure. This section details the containment response subsequent to a hypothetical loss-of-coolant accident (LOCA). The containment response analysis uses the long term M&E release data from Section 14.3.6.1.

The containment response analysis demonstrates the acceptability of the containment safeguards systems to mitigate the consequences of a high-energy line break inside containment. The impact of LOCA M&E releases on the containment pressure is addressed to assure that the containment pressure remains below its design pressure at the licensed core power conditions. In support of equipment design criteria (qualified operating life), with respect to post accident environmental conditions, long term containment pressure and temperature transients are addressed.

14.3.6.2.2 Input Parameters and Assumptions An analysis of containment response to the rupture of the RCS must start with knowledge of the initial conditions in the containment. The pressure, temperature, and humidity of the containment atmosphere prior to the postulated accident are specified in the analysis as shown in Table 14.3-55.

Also, values for the initial temperature of the essential service water (ESW) and refueling water storage tank (RWST) are assumed, along with containment spray (CS) pump flow rate and reactor containment fan cooler (RCFC) heat removal performance. All of these values are chosen conservatively, as shown in Tables 14.3-55, 14.3-56 and 14.3-57. Long-term sump recirculation is addressed via RHR heat exchanger performance. The primary function of the RHR system is to remove heat from the core by way of Emergency Core Cooling System (ECCS), and from the containment through the containment spray system (CSS). Table 14.3-55 provides the RHR system parameters assumed in the analysis.

A series of cases was performed for the LOCA containment response. Section 14.3-6.1 documented the M&E releases for the minimum and maximum ECCS cases for a DEPS break and the releases from the blowdown of a DEHL break.

For the maximum ECCS DEPS case a failure of a containment spray pump was assumed as the single failure, which leaves available as active heat removal systems one containment spray pump/and four RCFCs.

The minimum ECCS case was based upon a diesel train failure (which leaves available as active heat removal systems one containment spray pump and four RCFCs). Due to the duration of the DEHL transient (i.e., blowdown only), no containment safeguards equipment is modeled.

The calculations for all of the DEPS cases were performed for ten million seconds (approximately 11.5 days) for long-term equipment qualification. The DEHL cases were terminated soon after the end of the blowdown. The sequence of events for each of these cases is shown in Tables 14.3-58 through 14.3-60.

The following are the major assumptions made in the analysis:

1) The M&E released to the containment are described in Section 4.3.6.1 for LOCA.

Chapter 14, Page 156 of 333 Revision 04, 2011

IP3 FSAR UPDATE

2) Homogeneous mixing is assumed. The steam-air mixture and the water phases each have uniform properties. More specifically, thermal equilibrium between the air and the steam is assumed. However, this does not imply thermal equilibrium between the steam-air mixture and the water phase.

3) Air is taken as an ideal gas, while compressed water and steam tables are employed for water and steam thermodynamic properties.

4) For the blowdown portion of the LOCA analysis, the discharge flow separates into steam and water phases at the breakpoint. The saturated water phase is at the total containment pressure, while the steam phase is at the partial pressure of the steam in the containment.

For the post-blowdown portion of the LOCA analysis, steam and water releases are input separately.

5) The saturation temperature at the partial pressure of the steam is used for heat transfer to the heat sinks and the fan coolers 14.3.6.2.3 Description of COCO Model Calculation of containment pressure and temperature is accomplished by use of the digital computer code COCO (Reference 6). COCO is a mathematical model of a generalized containment; the proper selection of various options in the code allows the creation of a specific model for particular containment design. The values used in the specific model for different aspects of the containment are derived from plant-specific input data. The COCO code has been used and found acceptable to calculate containment pressure transients for many dry containment plants, most recently including Vogtle Units 1 and 2, Turkey Point Unit 3, Salem Units 1 and 2, Diablo Canyon Units 1 and 2, Indian Point Unit 2, and Indian Point 3. Transient phenomena within the RCS affect containment conditions by means of convective M&E transport through the pipe break.

For analytical rigor and convenience, the containment air-steam-water mixture is separated into a water (pool) phase and a steam-air phase. Sufficient relationships to describe the transient are provided by the equations of conservation of the M&E as applied to each system, together with appropriate boundary conditions. As thermodynamic equations of state and conditions may vary during the transient, the equations have been derived for all possible cases of superheated or saturated steam and subcooled or saturated water. Switching between states is handled automatically by the code.

Passive Heat Removal The significant heat removal source during the early portion of the transient is the containment structural heat sinks. Provision is made in the containment pressure response analysis for heat transfer through, and heat storage in, both interior and exterior walls. Every wall is divided into a large number of nodes. For each node, a conservation of energy equation expressed in finite-difference form accounts for heat conduction into and out of the node and temperature rise of the node. Table 14.3-35 is the summary of the containment structural heat sinks used in the analysis. The thermal properties of each heat sink material are shown in Table 14.3-36.

The heat transfer coefficient to the containment structure for the early part of the event is calculated based primarily on the work of Tagami (Reference 35). From this work, it was determined that the value of the heat transfer coefficient can be assumed to increase parabolically to a peak value. In Chapter 14, Page 157 of 333 Revision 04, 2011

IP3 FSAR UPDATE COCO, the value then decreases exponentially to a stagnant heat transfer coefficient which is a function of steam-to-air-weight ratio.

The h for stagnant conditions is based upon Tagamis steady state results.

Tagami presents a plot of the maximum value of the heat transfer coefficient, h, as function of coolant energy transfer speed, defined as follows:

total coolant energy transferred into containment (containment volume)(time interval to peak pressure)

From this, the maximum heat transfer coefficient of steel is calculated:

0.6 E

h max = 75 (Equation 1) t pV where:

hMAX = maximum value of h (BTU/hr-ft2-°F).

tp = time from start of accident to end of blowdown for LOCA and steam line isolation for secondary breaks (sec).

V = containment net free volume (ft3)

E = total coolant energy discharge from time zero to tp (BTU).

75 = material coefficient for steel.

(Note: Paint is accounted for by the thermal conductivity of the paint on the heat sink structure, not by an adjustment on the heat transfer coefficient.)

The basis for the equations is a Westinghouse curve fit to the Tagami data.

The parabolic increase to the peak value is calculated by COCO according to the following equation:

0.5 t

h s = h max , 0 t tp (Equation 2) tp where:

hs = heat transfer coefficient between steel and air/steam mixture (BTU/hr-ft2-°F).

t = time from start of event (sec).

For concrete, the heat transfer coefficient is taken as 40 percent of the value calculated for steel during the blowdown phase.

Chapter 14, Page 158 of 333 Revision 04, 2011

IP3 FSAR UPDATE The exponential decrease of the heat transfer coefficient to the stagnant heat transfer coefficient is given by:

(h )e ( ), t >

.05 t t p h =h s stag

+ max h stag tp (Equation 3) where:

hstag = 2 + 50X, 0 < X < 1.4 hstag = h for stagnant conditions (Btu/hr-ft2-°F).

X = steam-to-air weight ratio in containment.

Active Heat Removal For a large pipe break, the engineered safety features are quickly brought into operation. Because of the brief period of time required to depressurize the RCS or the main steam system, the containment safeguards are not a major influence on the blowdown peak pressure; however, they reduce the containment pressure after the blowdown and maintain a low long-term pressure and a low long-term temperature.

RWST Injection During the injection phase of post-accident operation, the ECCS pumps water from the RWST into the reactor vessel. Since this water enters the vessel at refueling water storage tank temperature, which is less than the temperature of the water in the vessel, it is modeled as absorbing heat from the core until the saturation temperature is reached. SI and containment internal spray can be operated for a limited time, depending on the refueling water storage tank (RWST) capacity.

RHR, Sump Recirculation After the supply of refueling water is exhausted, the recirculation system is operated to provide long term cooling of the core and containment spray (CS) water. In this operation, water is drawn from the sump, cooled in a residual heat removal (RHR) heat exchanger, then pumped back into the reactor vessel to remove core residual heat and energy stored in the vessel metal. In addition, part of the flow leaving the residual heat exchanger can be diverted to the internal containment spray system (CSS) for containment depressurization. The heat is removed from the RHR heat exchanger by the component cooling water (CCW). The RHR Hxs and CCW Hxs are coupled in a closed loop system, where the ultimate heat sink is the service water cooling to the CCW Hx.

Containment Spray CS is the active removal mechanism that is used for rapid pressure reduction and for containment iodine removal. During the injection phase of operation, the CS pumps draw water from the RWST and spray it into the containment through nozzles mounted high above the operating deck. As the spray droplets fall, they absorb heat from the containment atmosphere. Since the water comes from the RWST, the entire heat capacity of the spray from the RWST temperature to the temperature of the containment atmosphere is available for energy absorption. During the recirculation phase of post-Chapter 14, Page 159 of 333 Revision 04, 2011

IP3 FSAR UPDATE accident operation, water can be drawn from the containment sump, passed through the RHR heat exchanger, and sprayed into the containment atmosphere via the recirculation spray system. The CS parameters are given in Tables 14.3-55 and 14.3-57.

When a spray droplet enters the hot, saturated, steam-air containment environment, the vapor pressure of the water at its surface is much less than the partial pressure of the steam in the atmosphere. Hence, there will be diffusion of steam to the drop surface and condensation on the droplet. This mass flow will carry energy to the droplet. Simultaneously, the temperature difference between the atmosphere and the droplet will cause the droplet temperature and vapor pressure to rise. The vapor pressure of the droplet will eventually become equal to the partial pressure of the steam and the condensation will cease. The temperature of the droplet will essentially equal the temperature of the steam-air mixture.

The equations describing the temperature rise of a falling droplet are as follows.

d

( Mu ) = m h g + q (Equation 4) dt where:

M = droplet mass u = internal energy m = diffusion rate hg = steam enthalpy q = heat flow rate t = time d

(M) = m (Equation 5) dt

where, q = hcA * (Ts - T) m = kgA * (Ps - Pv)

A = area hc = coefficient of heat transfer kg = coefficient of mass transfer T = droplet temperature Ts = steam temperature Ps = steam partial pressure Pv = droplet vapor pressure The coefficients of heat transfer (hc) and mass transfer (kg) are calculated from the Nusselt number for heat transfer, Nu, and the Nusselt number for mass transfer, Nu1.

Both Nu and Nu1 may be calculated from the equations of Ranz and Marshall (Reference 40).

Nu = 2 + 0.6(Re)1/2 (Pr)1/3 (Equation 6)

where, Nu = Nusselt number for heat transfer Pr = Prandtl number Re = Reynolds number Nu1 = 2 + .06(Re)1/2 (Sc)1/3 (Equation 7)

Chapter 14, Page 160 of 333 Revision 04, 2011

IP3 FSAR UPDATE

where, Nu1 = Nusselt number for mass transfer Sc = Schmidt number Thus, Equations 4 and 5 can be integrated numerically to find the internal energy and mass of the droplet as a function of time as it falls through the atmosphere. Analysis show that the temperature of the (mass) mean droplet produced by the spray nozzles rises to a value within 99 percent of the bulk containment temperature in less than 2 seconds. Detailed calculations of the heatup of spray droplets in post-accident containment atmospheres by Parsly (Reference 41) show that droplets of all sizes encountered in the containment spray reach equilibrium in a fraction of their residence time in a typical pressurized water reactor containment. These results confirm the assumption that the containment spray will be 100 percent effective in removing heat from the atmosphere.

RCFC The RCFCs are another means of heat removal. Each RCFC has a fan which draws in the containment atmosphere. Since the RCFCs do not use water from the RWST, the mode of operation remains the same both before and after the CS and ECCS change to the recirculation mode. The steam/air mixture is routed through the enclosed RCFC unit, past essential service water cooling coils. The fan then discharges the air through ducting containing an air volume damper. The air is directed through the ducting to the upper and lower containment volumes and air then diffuses back towards the suction of the RCFCs. See Table 14.3-56 for RCFCs heat removal capability assumed for the containment response analyses.

14.3.6.2.4 Acceptance Criteria The containment response for design-basis containment integrity is an ANS Condition IV event, an infrequent fault. To satisfy the Nuclear Regulatory Commission acceptance criteria presented in the Standard Review Plan Section 6.2.1.1.A for long-term containment response, the relevant requirements are as follows:*

1) GDC 16 and GDC 50: In order to satisfy the requirements of GDC 16 and 50, the peak calculated containment pressure should be less than the containment design pressure of 47 psig;

2) GDC 38: In order to satisfy the requirements of GDC 38, the calculated pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should be less than 50% of the peak calculated value. (This is related to the criteria for doses at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.)

• NOTE: Criterion from 10 CFR 50, Appendix A, 1971.

14.3.6.2.5 Analysis Results The containment pressure, steam temperature and water (sump) temperature profiles from each of the LOCA cases are shown in Figures 14.3-83 through 14.3-86 for the DEPS break cases. The results of the DEHL break are shown in Figures 14.3-100 and 14.3-101.

All of these cases show that the containment pressure will remain below design pressure. After the peak pressure is attained, the operation of the safeguards system reduces the containment pressure.

At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident, the containment pressure has been reduced to a value well below 50 percent of the peak. The peak pressures are shown in Table 14.3-62.

Chapter 14, Page 161 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14.3.6.2.6 Conclusions The LOCA containment response analyses have been performed as part of the SPU for Indian Point Unit 3. The analyses include long-term pressure and temperature profiles for each case. As illustrated in Section 14.3.6.2.5, all cases resulted in a peak containment pressure that was less than 47 psig. In addition, all long-term cases were well below 50% of the peak pressure within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Based on the results, all applicable criteria for SRP 6.2.1.1.A have been met for Indian Point Unit 3.

14.3.6.3 Main Steam Line Break Analyses Main Steam Line Break Mass and Energy Release and Containment Pressure Response Steam line ruptures occurring inside a reactor containment structure may result in significant releases of high-energy fluid to the containment environment, possibly resulting in high pressures and temperatures. The quantitative nature of the releases following a steam line rupture is dependent upon the many possible configurations of the plant steam system and containment designs as well as the plant operating conditions, the size of the rupture, and the single failure assumptions. The analysis typically considers a variety of postulated pipe breaks encompassing wide variations in plant operation, safety system performance, and break size in determining the containment response to a secondary system pipe rupture.

The previous IP3 licensing basis analysis of the MSLB inside containment is documented in WCAP-12269 (Reference 90) and SECL-92-255 (Reference 103). The analysis assumes the availability of only the containment pressure signals as protection functions in order to reduce the number of MSLB cases analyzed.

In the Containment Margin Improvement Program carried out in the spring of 1989, a series of hypothetical steam line break cases were analyzed to evaluate containment pressure response.

Those analyses superseded all previous pressure analyses for steam line break M&E releases inside containment.

The M&E release rates are determined using the LOFTRAN computer code (Reference 49). The pressure conditions inside containment are then determined based on the resulting M&E release rates using the COCO computer program (Reference 6), which is discussed in Section 14.3.6.2.3. Cases are run at various power levels for various single failure assumptions. In the analysis, conservative assumptions are made to limit the number of cases to calculate a spectrum of limiting pressure transients. Specifically, the analysis takes no credit for entrainment of water in the break effluent, revaporization of condensate in the containment, or enhanced heat transfer via the Tagami correlation due to turbulence. Furthermore, primary and secondary trips are not credited that might have been credited. These assumptions are made to limit the dependency of the results in peak pressure to break size. By making these conservative assumptions, the largest breaks will produce the most limiting peak pressure results.

Ten cases are run to complete the spectrum of cases needed to adequately determine a peak pressure in containment for comparison against the containment design pressure limit. These cases are:

1. 0% power Main Steam Check Valve (MSCV) failure with offsite power available

2. 70% power MSCV failure with offsite power available

3. 100% power MSCV failure with offsite power available Chapter 14, Page 162 of 333 Revision 04, 2011

IP3 FSAR UPDATE

4. 0% power diesel failure (one engineering safeguards train assumed lost, RCPs conservatively assumed to continue to operate)

5. 100% power diesel failure (one engineering safeguards train assumed lost, RCPs conservatively assumed to continue to operate

6. 0% power Feedwater Control Valve (FCV) failure with offsite power available

7. 30% power FCV failure with offsite power available

8. 70% power FCV failure with offsite power available

9. 100% power FCV failure with offsite power available

10. 100% power Auxiliary Feed Water (AFW) Runout failure with offsite power available Although the containment pressure analysis for cases 4 and 5 assumes a loss of offsite power requiring diesel generators to power the containment safeguard systems, offsite power is assumed available to the reactor coolant pumps throughout the transient such that full reactor coolant flow exists. Full reactor coolant flow maximizes heat transfer between the primary and secondary systems, which subsequently maximizes the energy release out the steam line break.

The following conditions were assumed in the analyses of the inside containment steam line break M&E release accidents.

1. At the time that the break occurs, a minimum 1.3% shutdown margin exists. This is the end-of-life design value including design margins at no-load, equilibrium xenon conditions, with the most reactive RCC assembly stuck in its fully withdrawn position. The operation of the RCCA banks during core burnup is restricted in such a way that addition of positive reactivity in a steam break accident will not lead to a more adverse condition than the case analyzed.

2. 44F Steam Generators with 1.4ft2 integral flow restrictors

3. BIT Removal - 0 ppm boron concentration in the BIT

4. Fan Cooler heat removal based on 95 degrees Fahrenheit Service Water Temperature

5. No entrainment of water in steam blowdown. (This is a break size dependent assumption with entrainment above a certain break size and no entrainment below. Therefore, no entrainment will conservatively be assumed.)

6. 30-minute operator action time for isolation of auxiliary feedwater to faulted steam generator.

7. Minimum SI (with a 6 second pure time delay) and containment spray performance characteristics consistent with the number of operating trains.

8. Fuel parameters for 15x15 Upgrade Model are used.

9. No SG Tube Plugging since this conservatively maximizes the heat transfer rate to the secondary side.

The following assumptions are used to determine the limiting power and single failure conditions for the determination of the peak containment pressure.

1. Full double-ended rupture between the flow restrictor and the containment wall with effective break area limited by flow restrictor as appropriate.

Chapter 14, Page 163 of 333 Revision 04, 2011

IP3 FSAR UPDATE

2. The operations of SI, RCPs, feedwater pumps and containment heat removal equipment are consistent with the failure assumption and limiting values that are used.

3. Elimination of all break size step change dependencies including:

a) No revaporization of containment wall condensate assumed, and b) Limiting wall heat transfer coefficients

4. Credit for containment signals only (High 1 and High 2 pressure) for reactor trip, SI steam line isolation and feedwater isolation. (Credit for other signals may result in a beak size other than the largest double-ended rupture being more limiting in pressure.)

The FCV failure case addresses I.E.Bulletin 80-04 concerns regarding additional feedwater flow due to FCV failure and failure of AFW runout protection. Feedwater flow as a function of pressure in the steam generator is maximized to the faulted steam generator and minimized to the intact steam generators. Maximizing flow to the faulted steam generator provides more inventory for release thereby maximizing blowdown. Initial assumptions include conservative conditions to bound I.E.

Bulletin 80-04 concerns, including AFW runout. The maximum auxiliary feed runout flow to the faulted steam generator is 400 gpm and is conservatively modeled as a constant flow.

In the analyses, the following assumptions are made regarding the safety injection system.

1. A minimum capability of the safety injection system, with 2 out of 3 (with Safeguard Failure) or 3 out of 3 (without Safeguards Failure) safety injection pumps in operation and 7 percent degraded system performance and based on minimum safeguards assumptions. High Head Safety Injection (HHSI) flow rate assumptions are reduced in accordance with the HHSI flow balancing criteria.

2. The refueling water storage tank (RWST) contains borated water with a boron concentration of 2400 ppm.

3. A conservative time required to sweep the unborated water from the safety injection piping and BIT before delivering the 2400 ppm borated water from the RWST to the core is modeled.

The assumptions made in the analyses performed (no containment safeguards train failure) to determine the pressure response inside containment resulting from the steam line break M&E releases are as follows:

1. Initial containment temperature of 130°F

2. Initial containment pressure of 17.2 psia

3. Initial containment relative humidity of 20%

4. A high containment pressure setpoint of 5.12 psig

5. A high-high containment pressure setpoint of 24.63 psig

6. A delay time for containment setpoints of 50 seconds for containment sprays and 38.2 seconds for the fan coolers (with offsite power available).

7. The containment heat sink data includes paint on the walls

8. A fan cooler efficiency at 95°F service water, 1400 gpm, 4% tube plugging level, and .004 fouling factor. The fan cooler performance is summarized in Table 14.3-56.

9. Full containment safeguards (5 fans, 2 spray pumps)

10. The containment spray performance is summarized in table 14.3-57.

Chapter 14, Page 164 of 333 Revision 04, 2011

IP3 FSAR UPDATE In support of the 24-month fuel cycle program, the limiting postulated steam line break determined through prior analysis (for the Containment Margin Improvement Program) and evaluations (HHSI) flow balancing and FRV stroke time increase) has been evaluated. The results of the current analysis are consistent with the instrument assumptions established in the 24 month Fuel Cycle Program.

Specific assumptions included in the analysis of the SLB M&E releases are 7.5°F RCS temperature uncertainty and a 10% narrow-range span uncertainty on the steam generator water level.

Some of the 24-month cycle changes identified in Section 14.3.6 were already evaluated relative to the IP3 MSLB inside containment M&E release calculations and containment response (References 105 and 106). The above referenced evaluations addressed the effect of increasing the pressurizer uncertainty to +/- 40 psi, increasing the pressurizer water level uncertainty to +/- 7% span, increasing the RCS flow uncertainty to +2.9%, revising the accumulator pressure and volume ranges, the effects of RWST level uncertainties, and increasing the steam generator water level uncertainty to +/- 10%

NRS. The pressurizer pressure and water level uncertainty increases have no effect on the calculated steam line break M&E releases since nominal values are typically assumed. The RCS flow uncertainty increase has no effect on the calculated steam line break M&E releases since Thermal Design Flow is assumed. Since the RCS pressure transient does not decrease to the point at which accumulators would inject, no actuation is assumed and the range changes have no effect on the analysis results. RWST level uncertainties do not affect the MSLB M&E release nor containment response transient since the duration of the MSLB event RWST draindown calculation (sump recirculation switchover) do not factor into the analysis.

However, the previous evaluations are recognized that the increase in the steam generator water level uncertainty, which increases the mass discharge into containment during the transient steam generator depressurization, require rigorous containment integrity analysis in order to demonstrate that pertinent acceptance criteria would be met.

The containment model used to calculate the containment response transient following a postulated steam line break M&E release inside containment is not directly affected by the evaluation baseline items for the 24-month fuel cycle project. The MSLB containment response is impacted through the effect of the 24-month fuel cycle uncertainty changes on the steamline break M&E release. The containment model developed for the HHSI Flow Changes Project has been utilized for this 24-month fuel cycle project.

In 1999, a revised analysis (Reference 108) was performed to address a correction to the unisolated feedline volume previously modeled. Based on a single failure assumption of the faulted steam generator feedwater control valve, there was found to be 3783 ft3 of feedwater not automatically isolated from the break. This volume was defined by the boundary of the main feedwater pump discharge valves and the closed FCVs on the intact loops, and it determined the amount of feedwater that will flash when the feedwater reaches saturated conditions due to steam generator depressurization.

To compensate for this error, administrative restrictions were applied to ensure post-MSLB subcriticality throughout Cycle 11. Prior to Cycle 12, a permanent correction to this error was made via the installation of a modification which closed the motor-operated feedwater block valves and low-flow bypass valves on a feedwater isolation signal. This reduced the unisolated feedwater volume to 400 ft3 for all credible scenarios.

The most recent analysis was performed for the uprate program. The limiting case is a 1.4 ft2 DER initiated from 70% power with a single failure of the FCV on the faulted loop. The containment Chapter 14, Page 165 of 333 Revision 04, 2011

IP3 FSAR UPDATE temperature and pressure transients are presented in Figures 14.3-87 and 14.3-88. The peak containment pressure remains below the containment design pressure of 47 psig.

14.3.7 HYDROGEN PRODUCTION AND ACCUMULATION Hydrogen accumulation in the containment atmosphere following the Design Basis Accident can be the result of production from several sources. The potential sources of hydrogen are the zirconium-water reaction, corrosion of construction materials, and radiolytic decomposition of the emergency core cooling solution. The latter source, solution radiolysis, includes both core solution radiolysis and sump solution radiolysis.

Results The results of the calculations for hydrogen production and accumulation from the sources indicated are presented here:

1. Zirconium-water reaction

2. Aluminum corrosion

3. Radiolytic decomposition of core and sump solution are shown in Figure 14.3-75 and 14.3-77.

Figure 14.3-75 shows the total hydrogen production rate as a function of time following a Loss-of-Coolant Accident up to 100 days for the maximum hypothetical accident.

Figure 14.3-77 shows the total quantity of hydrogen accumulated in the Containment as a function of time for the maximum hypothetical accident case up to 100 days. The contribution of the individual sources is shown.

The curves show that if no measures were used to remove or prevent the hydrogen accumulation indicated, the hydrogen generation would result in the approximate concentrations within the containment as shown in Figure 14.3-79.

Although it is indicated that the hydrogen in the Containment would reach 4.1 volume percent (the lower flammable limit in air) in 21 days using the NRC RG 1.7 model, in actuality the concentration of hydrogen would be prevented from ever reaching this level for either model through the use of the Hydrogen Recombiner System. The analysis of record credits the use of just one Hydrogen Recombiner (Reference 109).

Method of Analysis The quantity of zirconium which reacts with the core cooling solution depends on the performance of the Emergency Core Cooling System (ECCS). The criteria for evaluation of the Emergency Core Cooling System requires that the zircaloy-water reaction be limited to 1 percent by weight of the total quantity of zirconium in the core. Emergency Core Cooling System calculations have shown that only 0.1 percent of the zirconium present reacts with water, which is much less than that required by criteria.

The use of aluminum inside the Containment is limited, and aluminum is not used in safety related components which are in contact with the recirculating core cooling fluid. Aluminum is much more reactive with the containment spray alkaline borate solution than other plant materials such as galvanized steel, copper and copper nickel alloys. By limiting the use of aluminum the aggregate source of hydrogen over the long term is essentially restricted to that arising from radiolytic Chapter 14, Page 166 of 333 Revision 04, 2011

IP3 FSAR UPDATE decomposition of core and sump water. The upper limit rate of such decomposition can be predicted with ample certainty to permit the design of effective countermeasures.

It is noted that the zirconium-water reaction and aluminum corrosion with containment spray are chemical reactions and thus essentially independent of the radiation field inside the Containment following a Loss-of-Coolant Accident. Radiolytic decomposition of water is dependent on the radiation field intensity. The radiation field inside the Containment is calculated for the maximum hypothetical accident in which the fission product activities given in TID-14844 (Reference 51) are used.

The hydrogen generation calculation was performed using the AEC model discussed in NRC RG 1.7 (Reference 52).

Typical Assumptions The following discussion outlines the assumptions used in the calculations:

1) Zirconium-water reaction The zirconium-water reaction is described by the chemical equation:

Zr + 2H2O ZrO2 + 2H2 + Heat The hydrogen generation due to this reaction will be completed during the first day following the Loss-of-Coolant accident. The hydrogen generated is assumed to be released immediately to the containment atmosphere.

2) Corrosion of plant materials Oxidation of metals in aqueous solution results in the generation of hydrogen gas as one of the corrosion products. Extensive corrosion testing has been conducted to determine the behavior of the various metals that come in contact with the emergency core cooling solution at Design Basis Accident conditions. Metals tested include Zircaloy, Inconel, aluminum alloys, copper nickel alloys, carbon steel, galvanized carbon steel and copper. Tests conducted at ORNL (References 53 and 54) have also verified the compatibility of the various alloys (exclusive of aluminum) with alkaline borate solution. As applied to the quantitative definition of hydrogen production rates, the results of the corrosion tests have shown that only aluminum will corrode at a rate that will significantly add to the hydrogen accumulation in the containment atmosphere.

The corrosion of aluminum may be described by the overall reaction:

2Al + 3H2O Al2O3 + 3H2 Therefore, three moles of hydrogen are produced for every two moles of aluminum that are oxidized. (Approximately 20 standard cubic feet of hydrogen for each pound of aluminum corroded.)

The time-temperature cycle (Table 14.3-63) considered in the calculation of aluminum corrosion is based on a conservative step-wise representation of the postulated post accident containment transient. The corrosion rates at the various steps were determined from the aluminum corrosion rate design curve shown in Figure 6D-8.

Aluminum corrosion data points include the effects of temperature, alloy, and spray solution conditions. Based on these corrosion rates and the aluminum inventory given Chapter 14, Page 167 of 333 Revision 04, 2011

IP3 FSAR UPDATE in Table 14.3-64, the contribution of aluminum corrosion to hydrogen accumulation in the containment following the design basis accident has been calculated. For conservative estimation, no credit was taken for protective shielding effects of insulation or enclosures from the spray, and complete and continuous immersion was assumed.

Calculations based on NRC Reg Guide 1.7 were performed by allowing an increased corrosion rate during the final step of the post-accident containment temperature transient (Table 14.3-63). The corrosion rates earlier in the accident sequence are the higher rates determined from Figure 6D-8. This analysis specifically includes the presence of four aluminum-bearing Control Rod Drive Mechanism cooling fans assemblies.

3) Radiolyis of Core and Sump Water Water radiolysis is a complex process involving reactions of numerous intermediates.

However, the overall radiolytic process may be described by the reaction:

1 H2O H2 + 2 O 2 Of interest here are the quantitative definitions of the rates and extent of radiolytic hydrogen production following the design basis accident.

An extensive program has been conducted by Westinghouse to investigate the radiolytic decomposition of the core cooling solution following the Design Basis Accident. In the course of the investigation, it became apparent that two separated radiolytic environments exist in the Containment at Design basis Accident Conditions.

In one case, radiolysis of the core cooling solution occurs as a result of the decay energy of fission products which have escaped from the core, result in the radiolysis of the sump solution. The results of these investigations are discussed in Reference 55.

Core Solution Radiolysis The study of radiolysis in dynamic systems was initiated by Westinghouse, which formed the basis for experimental work performed at ORNL. Both studies clearly illustrate the reduced yields in hydrogen from core radiolysis, i.e., reduced from the maximum yield of 0.44 molecules/100eV. These results have been published. (References 55 and 56)

For the purposes of this analysis, the calculations of hydrogen yield from core radiolysis were performed with the very conservative value of 0.44 molecules/100eV. That this value is conservative and a maximum for this type of aqueous solution and gamma radiation is confirmed by the many published works. The Westinghouse results from the dynamic studies show 0.44 to be a maximum at very high solution flow rates through the gamma radiation field. The referenced ORNL (Reference 56) work also confirms this value as a maximum at high flow rates. A. O. Allen (Reference 57) presents a very comprehensive review of work performed to confirm the primary hydrogen yield to be a maximum of 0.44-0.45 molecules/100eV.

On the foregoing basis, the production rate and total hydrogen produced from core radiolysis as a function of time has been conservatively estimated for the maximum hypothetical accident case.

Chapter 14, Page 168 of 333 Revision 04, 2011

IP3 FSAR UPDATE Calculations based on NRC Reg Guide 1.7 assume a hydrogen yield value of 0.5 molecules per 100 eV, with 10% of the gamma energy produced from fission products in the fuel rods absorbed by the solution in the core, and the noble gases escaping to the containment vapor space.

As the emergency core cooling solution flows through the core, it is subjected to gamma radiation from fission products in the fuel. This energy deposition results in solution radiolysis and the production of molecular hydrogen and oxygen. The initial production rate of these species will depend on the rate of energy absorption and the specific radiolytic yields.

The energy absorption rate in solution can be assessed from knowledge of the fission products contained in the core, and a detailed analysis of the dissipation of the decay energy between core materials and the solution. The results of Westinghouse studies show essentially all of the beta energy will be absorbed within the fuel and cladding and that this represents approximately 50% of the total beta-gamma decay energy. This study shows further that of the gamma energy, a maximum of 7.4% will be absorbed by the solution in the core. Thus, an overall absorption factor of 3.7% of the total core decay energy (+) is used to compute solution radiation dose rates and the time-integrated dose. Table 14.3-65 presents the total decay energy (+) of a reactor core, which has operated at full power for 830 days prior to the accident. For the maximum hypothetical accident case, the contained decay energy in the core accounts for the TID-14844 release of 50% halogens and 1% other fission products. To be conservative, the noble gases were assumed to remain in the core, whereas in the TID-14844 model the noble gases were allowed to escape to the Containment, where essentially no water radiolysis would result from decay of these nuclides.

The radiolysis yield of hydrogen in solution has been studied extensively by Westinghouse and ORNL. The results of static capsule tests conducted by Westinghouse indicate that hydrogen yields much lower than the maximum of 0.44 molecules per 100eV of absorbed energy which would be the case in core. With little gas space to escape, the hydrogen formed in solution rapidly recombines with oxygen to reform water. The net effect is very low net hydrogen yields.

Sump Solution Radiolysis Another potential source of hydrogen assumed for the post-accident period arises from water contained in the reactor containment sump being subjected to radiolytic decomposition by fission products. In this consideration, an assessment must be made as to decay energy deposited in the solution and the radiolytic hydrogen yield, much in the same manner as given above for core radiolysis.

The energy deposited in the sump solution is computed using the following basis :

1. For the maximum hypothetical accident, a TID-14844 release model (Reference 51) is assumed where 50% of the total core halogens and 1% of all other fission products, excluding noble gases, are released from the core to the sump solution.

2. The quantity of fission product release is equal to that from a reactor which operated at 3216 MWt for 830 days prior to the accident. (Table 14.3-65)

3. The total decay energy from the released fission products, both beta-gamma, is assumed to be fully absorbed in the solution.

The energy release by fission products to the sump water includes the decay of halogens, and a separate accounting for the slower decay of the 1% other fission products. To arrive at the energy deposition rate and time-integrated energy deposited, the contribution from each individual fission product class was computed. The overall contributions from each of the two classes of fission products is shown in Table 14.3-66.

Chapter 14, Page 169 of 333 Revision 04, 2011

IP3 FSAR UPDATE The yield of hydrogen from sump solution radiolysis is represented by the static capsule tests performed by Westinghouse and ORNL with the alkaline sodium borate solution. The differences between these tests and the actual conditions for the sump solution, however, are important and render the capsule tests conservative in their predictions of radiolytic hydrogen yields.

In this assessment, the sump solution will have considerable depth, which inhibits the ready diffusion of hydrogen from solution, as compared to the test using shallow depth capsules. This retention of hydrogen in solution will have a significant effect in reducing the hydrogen yields to the containment atmosphere. The buildup of hydrogen concentration in solution will enhance the back reaction to formation of water and lower the net hydrogen yield, in the same manner as a reduction in gas to liquid volume ratio will reduce the yield. This is illustrated by the data presented in Figure 14.3-112 for capsule tests with various gas to liquid volume ratios. The data show a significant reduction in the apparent or net hydrogen yield from the published primary maximum yield of 0.44 molecules/100eV.

Even at the very highest ratios, where capsule solution depths are very low, the yield is less than 0.30, with the highest scatter data point at 0.39 molecules/100eV.

With these considerations taken into account, a reduced hydrogen yield is a reasonable assumption to make for the case of sump radiolysis. While it can be expected the yield will be on the order of 0.1 or less, a conservative value of 0.30 molecules/100eV has been used in the maximum hypothetical accident case.

Calculation based on NRC Reg. Guide 1.7 do not take credit for a reduced hydrogen yield in the case of sump radiolysis and a hydrogen yield value of 0.5 molecules per 100eV has been used.

References

1) Federal Register, Emergency Core Cooling Systems: Revisions to Acceptance Criteria, V53, N180, pp 35996-36005, September 16, 1988.

2) Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants, WASH-1400, NUREG 75/014, October 1975.

3) Bordelon, F.M., Massie, H.W., and Zordan, T.A., Westinghouse ECCS Evaluation Model -

Summary, WCAP-8339 (Non-Proprietary), July 1974.

4) Foster, J.P., et al., Westinghouse Improved Performance Analysis and Design Model (PAD 4.0) WCAP-15063-P-A, Revision 1, with Erratta, 2000.

5) USNRC Regulator Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performances, May 1990.

6) Bordelon, F. M. and Murphy, E. T., 1974, Containment Pressure Analysis (COCO), WCAP-8327 (Proprietary Version), WCAP-8326 (Non-Proprietary Version).

7) Bordelon, F.M., et al., LOCA-IV Program: Loss of Coolant Transient Analysis, WCAP-8301, (Proprietary), June 1974 and WCAP-8305, (Non-Proprietary), June 1974.

8) PWR FLECHT Final Report, WCAP-7931, October 1972.

Chapter 14, Page 170 of 333 Revision 04, 2011

IP3 FSAR UPDATE

9) J. R. Kobelak, D. W. Golden, Best Estimates Analysis for the Large Break Loss of Coolant Accident for Indian Point Unit 3 Nuclear Plant Stretch Power Uprate, WCAP-16178-P.

10) Boyack, B., et al., 1989 Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, NUREG/CR-5249.

11) Letter, R. C. Joes (USNRC) To N. J. Liparulo (W), Acceptance for Referencing of the Topical Report WCAP-12945(P), Westinghouse Code Qualification Document for Best Estimate Loss-of-Coolant Accident, June 28, 1996.

12) Bajorek, S. M., et al., 1998, Westinghouse Code Qualification Document for Best Estimate Loss of Coolant Accident Analysis, WCAP 12945-P-A (Proprietary), Volume 1, Revision 2 and Volumes II-V, Revision 1 and WCAP-14747 (Non-Proprietary).

13) Branch Technical Position CSB 6-1, Minimum Containment Pressure Model for PWR ECCS Performance Evaluation, July, 1981.

14) Deleted

15) Deleted

16) Deleted

17) Deleted

18) Deleted

19) Deleted

20) Deleted

21) R.J. Skwarek, Johnson, W.J. Meyer, P.E., Westinghouse Emergency Core Cooling System Small Break, October, 1975 Model, WCAP-8970, April 1977.

22) Letter from T.M. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2147, dated November 2, 1979.

23) Letter from T.M. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2163, dated November 16, 1979.

24) Letter from T.M. Anderson of Westinghouse Electric Corporation to Darrell G. Eisenhut of the Nuclear Regulatory Commission, Letter Number NS-TMA-2174, dated December 7, 1979.

25) Letter from T.M. Anderson of Westinghouse Electric Corporation to Richard P. Denise of the Nuclear Regulatory Commission, Letter Number NS-TMA-2175, dated December 10, 1979.

26) Takeuchi, K., et al., MULTIFLEX, A FORTRAN - IV Computer Program for Analyzing Thermal-Hydraulic Structure System Dynamics, WCAP- 8708, February 1976 (Westinghouse Proprietary).

Chapter 14, Page 171 of 333 Revision 04, 2011

IP3 FSAR UPDATE

27) Deleted

28) Deleted

29) Deleted

30) Deleted

31) Deleted

32) Deleted

33) Dittus, F.W., and Boelter, L.M.K., University of California (Berkeley), Publs. Eng., 2, 488 (1930).

34) Jens, W.H., and Lottes, P.A., Analysis of Heat Transfer, Burnout, Pressure Drop, and Density Data for High Pressure Water, USAEC Report ANL-4627 (1951).

35) Takashi Tagami, Interim Report on Safety Assessments and Facilities Establishment Project in Japan for Period Ending June 1965, No. 1.

36) Macbeth, R.V., Burnout Analysis, Pt. 2, The Basis Burn-out Curve, U.K. Report AEEW-R 167, Winfrith (1963). Also Pt. 3, The Low-Velocity Burnout Regimes, AEEW-R 222 (1963);

Application of Local Conditions Hypothesis to World Data for Uniformly Heated Round Tubes and Rectangular Channels, AEEW-R 267 (1963).

37) McEligot, D.M., Ormand, L.W., and Perkins, H.C. Jr., Internal Low Reynolds Number Turbulent and Transitional Gas Flow with Heat Transfer, Journal of Heat Transfer, Volume 88, pp. 239-245, May 1966.

38) IP3McAdams, W.H., Heat Transmission, 3rd Edition, McGraw-Hill Book Company, Inc., New York, 1954.

39) Dougall, R.S., and Rohsenow, W.M., Film Boiling on the Inside of Vertical Tubes with Upward Flow of Fluid at Low Quantities, MIT Report 9079-26.

40) Ranz, E.W. and Marshall, W.R. Jr., Evaporation for Drops, Chemical Engineering Progress, 48, pp. 141-146, March 1952.

41) Parsly, L.F., Spray Tests at the Nuclear Safety Pilot Plant, in: Nuclear Safety Program Annual Progress Report for Period Ending December 31,1970, ORNL-4647, 1971, p. 82.

42) Eckert, E.R.G. and Drake, P.M.J., Heat and Mass Transfer, McGraw-Hill Book Company, Inc.,

New York, 1959.

43) Kern, D.Q., Process Heat Transfer, McGraw-Hill Book Company, Inc., New York, 1950.

44) Chilton, T.H. and Colburn, A.P., Mass Transfer (Absorption) Coefficients Prediction from Data on Heat Transfer and Fluid Friction, Ind. Eng. Chem., No. 26, 1934, p 1183-1187.

Chapter 14, Page 172 of 333 Revision 04, 2011

IP3 FSAR UPDATE

45) WCAP-10325, Westinghouse LOCA Mass and Energy Release Model for Containment Design - March 1979 Version, April 25, 1979. WCAP-10325-P-A, May 1983 (Proprietary),

WCAP-10326-M (Non-Proprietary).

46) EPRI 294-2 Mixing of Emergency Core Cooling Water with Steam: 1/3 Scale Test and Summary, (WCAP-8423), Final Report June 1975.

47) WCAP-8264-PA (Proprietary), WCAP-8312-A (Non-Proprietary), Rev. 1, Topical Report Westinghouse Mass and Energy Release Data for Containment Design, August 1975.

48) ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, August 1979.

49) WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary), LOFTRAN Code Description, April 1984.

50) Eckert, E., and Gross, J., Introduction to Heat and Mass Transfer, (New York: McGraw-Hill Book Company), 1963.

51) DiNunno, J.J., Anderson, F.D., Baker, R.E., and Waterfield, R.L., Calculation of Distance Factors for Power Test Reactor Sites, TID-14844, March 1962.

52) NRC Regulatory Guide 1.7, Control of Combustible Gas Concentration in Containment Following a Loss-of-Coolant Accident, Rev. e, May 2003.

53) Cottrell, W.B., ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for July - August, 1968, ORNL-TM-2368.

54) Cottrell, W.B., ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for September - October, 1968, ORNL-TM-2425, p. 53, January 1969.

55) Fletcher, W.D., Bell, M.J., and Picone, L.F., Post-LOCA Hydrogen Generation in PWR Containments, Nuclear Technology, Volume 10, pp. 420-427, 1971.

56) Zittel, H.E., and Row, T.H., Radiation and Thermal Stability of Spray Solutions, Nuclear Technology, Volume 10, pp. 436-443, 1971.

57) Allen, A.O., The Radiation Chemistry of Water and Aqueous Solutions, (Princeton: Van Nostrand Press), 1961.

58) WCAP-9117, Analysis of Reactor Coolant System for Postulated Loss-of-Coolant Accident; Indian Point 3 Nuclear Power Plant, Westinghouse Electric Corp, June 1977

59) WCAP-7822, Bohm, G., Indian Point Unit 2 Reactor Internals Mechanical Analysis for Blowdown Excitation, Westinghouse Electric Corp.

60) WCAP-5890, Rev. 1, Creep Rupture Tests of type 304 SS Weldments with Central Axial Welds of Type 304 SS at 593 C, Westinghouse Electric Corp.

61) Deleted Chapter 14, Page 173 of 333 Revision 04, 2011

IP3 FSAR UPDATE

62) Deleted

63) NS-TMA-2448

64) Deleted

65) Deleted

66) Deleted

67) Letter from Messrs. R.M. Clark and O. Meeuwis of Westinghouse Electric Corporation, INT 635 dated November 21, 1983 to W.A. Josiger, New York Power Authority.

68) Safety Evaluation by the Office of the Nuclear Reactor Regulation related to Amendment No.

61, to Facility Operating License No. DPR-64, Power Authority of New York, Indian Point Generating Unit 3, letter dated August 27, 1985 (Docket No. 50-286), from J.D. Neighbors, Division of Licensing, USNRC, to J.C. Brons, New York Power Authority.

69) NUREG-0737, item II.K.3.31, Plant specific calculation to show compliance with 10 CFR 50.46, letter dated August 18, 1986, (IPN 86- 39) from J.C. Brons, New York Power Authority, to S.A. Varga, Division of PWR Licensing-A, USNRC.

70) Safety Evaluation of NUREG item II.K.3.31 plant specific calculations to show compliance with 10 CFR 50.46, letter dated November 13, 1986 from J.D. Neighbors, Division of PWR Licensing-A, USNRC, to J.C. Brons, New York Power Authority.

71) Deleted

72) Deleted

73) Deleted

74) Deleted

75) Deleted

76) Deleted

77) Meyer, P.E., NOTRUMP, A Nodal Transient Small Break and General Network Code, WCAP-10079-P-A, August 1985.

78) Lee, H., Rupprecht, S.D., Tauche, W.D., and Schwarz, W.R., Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code, WCAP-10054-P-A, August 1985.

79) Deleted

80) Bordelon, F.M., Massie, H.W., and Zordan, T.A., Westinghouse ECCS Evaluation Model-Summary, WCAP-8339, (Non-Proprietary), July 1974.

Chapter 14, Page 174 of 333 Revision 04, 2011

IP3 FSAR UPDATE

81) Eicheldinger, C., Westinghouse ECCS Evaluation Model, 1981 Version, WCAP-9220-P-A (Proprietary) February 1979, and WCAP-9221-A (Non-Proprietary), February 1981, Revision 1.

82) Kabadi, J.N., et al, The 1981 Version of the Westinghouse ECCS Evaluation Model Using the BASH Code, WCAP-10266-P-A, Revision 2 (Proprietary), August 1986, and WCAP-10337-A (Non-Proprietary).

83) Deleted

84) Deleted

85) Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse - Designed Operating Plants, NUREG-0611, January 1980.

86) Clarification of TMI Action Plan Requirements, NUREG-0737, November 1980.

87) NRC Generic Letter 83-35 from D.G. Eisenhut, Clarification of TMI Action Plan Item II.K.3.31, November 2, 1983.

88) Rupprecht, S.D., et al., Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, WCAP-11145-P-A (Proprietary), October 1986.

89) Kachmar, M.P., et al., Appendix F LOCA NOTRUMP Evaluation Model: ZIRLO Modifications, WCAP-12610, December, 1990.

90) Kolano, J.A., Smith, L.C., Wooten, L.A., and Ament, G.G., Containment Margin Improvement Analysis for Indian Point Unit 3, WCAP-12269 Rev. 1 (Proprietary) and WCAP-12338 (Non-Proprietary), May 1989.

91) SECL-92-131, High Head Safety Injection Flow Changes Safety Evaluation, June 1992.

92) NSE 95-03-044 PZR, Operation With a Steam Bubble in the Pressurizer and the RCS at Cold Shutdown, Rev. 4.

93) Davidson, S.L. et al., Extended Burnup Evaluation of Westinghouse Fuel, WCAP- 10125-P-A, December, 1985.

94) Deleted

95) INT-97-661, LOCA Analysis Input Data Base Error, R.R. Laubham to G. Canavan, July 1997.

96) INT-98-207, 10 CFR 50.46 Annual Notification and Reporting for 1997, S.M. Ira to R.J.

Barrett, February 1998.

97) Reload Transition Safety Report for the Indian Point Unit 3 Nuclear Station Vantage+ Fuel Upgrade, Revision 3, January 1997, Westinghouse.

98) SECL-97-135, Revision 2, Integrated Safety Evaluation of 24-Month Cycle Instrument Channel Uncertainties, March 1998, Westinghouse.

Chapter 14, Page 175 of 333 Revision 04, 2011

IP3 FSAR UPDATE

99) SECL-96-103, Safety Evaluation of 24-Month Fuel Phase/Instrument Channel Uncertainties, June 1996, Westinghouse.

100) NRC Information Notice 96-39: Estimate of Decay Heat Using ANS 5.1 Decay Heat Standard May Vary Significantly, July 5, 1996.

101) Docket No. 50-315 & 50-316, Amendment No. 126 to Facility Operating License No. DPR-58 (TAC No. 71062), for D. C. Cook Nuclear Plant Unit 1, June 9, 1989.

102) Technical Specifications, Indian Point Unit 3, Amendment 176, August 11, 1997.

103) SECL-92-255, Feedwater Regulating Valve Stroke Time Change Safety, Evaluation, November 2, 1992.

104) NRC Safety Evaluation Report Related to Amendment No. 98 to Facility Operating License No. DPR-64,5/7/90, J. S. Guo - principal contributor (addresses WCAP-12313 on the UHS temperature increase and WCAP-12269 on the Containment Margin Improvement Program).

105) INT-96-600, 24-Month Cycle Increased Initial Condition Uncertainty Evaluation, 9/6//96, R. R.

Laubham.

106) SECL-96-103, Safety Evaluation of 24-Month Fuel Cycle Instrument Channel Uncertainties, 6/18/96, R. R. Laubham (formally issued by letter INT-96-552, dated 6/19/96).

107) Letter RE-99-307, Canavan (NYPA) to Laubham (Westinghouse), June 1, 1999.

108) Letter INT-99-248, Ira (Westinghouse) to Gumble (NYPA), August 12, 1999.

109) Letter INT-00-234, Ira (Westinghouse) to Gumble (NYPA), September 25, 2000.

110) Letter INT-99-254, SLB Inside Containment Sensitivities to FCV Failure, Ira (Westinghouse) to Canavan (NYPA), October 8, 1999.

111) Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power rectors, July 2000.

112) Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), July 1997 and WCAP-10081-NP, Addendum 2, Revision 1 (non-Proprietary), August 1995.

113) Stukus, J.R. et all, Indian Point Nuclear Generating Unit No. 3 Stretch Power Uprate NSSS and BOP Licensing Report.

114) Boyack, B., et al., 1989, Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, NUREG/CR-5249.

Chapter 14, Page 176 of 333 Revision 04, 2011

IP3 FSAR UPDATE 115) Letter, R.C. Jones (USNRC) to N.J. Liparulo (W), Acceptance for Referencing of the Topical Report WCAP-12945 (P), Westinghouse Code Qualification Document for Best Estimate LOCA Analysis, June 28, 1996.

116) Westinghouse Code Qualificiation Document for Best Estimate LOCA Analysis, WCAP-12945-P (Proprietary). Volumes I-V, June 1992.

117) Letter, N.J. Liparulo (W) to R.C. Jones (USNRC), Revisions to Westinghouse Best-Estimate Methodology, NTD-NRC-95-4575, October 13, 1995.

118) Letter, N.J. Liparulo (W) to F.R. Orr (USNRC), Re-Analysis Work Plans Using Final Best-Estimate Methodology, NSD-NRC-96-4746, June 1996.

119) Best-Estimate Analysis of the Large Break Loss of Coolant Accident for Indian Point Unit 3 Nuclear Plant, WCAP-14820, June 2001.

Appendix B List of LOCA Analysis Tables Table 14.3-1: Best Estimate Large Break LOCA Key Parameters and Reference Transient Assumptions Table 14.3-2: Deleted Table 14.3-2a: Best Estimate Large Break LOCA Confirmatory Case PCT Results Summary Table 14.3-2b: Best-Estimate Large Break LOCA Results Table 14.3-3: Plant Operating Range Allowed by the Best-Estimate Large Break LOCA Analysis Table 14.3-4: Large Break LOCA Containment Data (Dry Containment)

Table 14.3-5: Large Break LOCA Structural Heat Sink Data Table 14.3-6: Deleted Table 14.3-6a: Best-Estimate Large Break LOCA Mass and Energy Releases from BCL Used for COCO Calculation at Selected Time Points.

Table 14.3-6b: Best Estimate Large Break LOCA Mass and Energy Releases from BCL Accumulator and SI.

Table 14.3-7: Rod Census Used in Best-Estimate Large Break LOCA Analysis.

Table 14.3-8: Best-Estimate Large Break LOCA Total Minimum Injected Flow from HHSI and LHSI Table 14.3-8a: Initial Parameters For Small Break LOCA Analysis Table 14.3-8b: Small Break LOCA Time Sequence Of Events Chapter 14, Page 177 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-8c: Small Break LOCA Analysis Results Table 14.3-9: Deleted Table 14.3-10: Deleted Table 14.3-12: Deleted Table 14.3-14: Deleted Table 14.3-14a Deleted Table 14.3-14b Deleted Table 14.3-14c Deleted Table 14.3-14d Deleted Table 14.3-14e Deleted Table 14.3-14h Deleted Table 14.3-15 Deleted Table 14.3-16 Deleted Table 14.3-17 Deleted Table 14.3-18 Assumptions Used in the Analysis of the Environmental Consequences of a Large-Break LOCA Table 14.3-18a: Assumptions Used in the Analysis of the Environmental Consequences of a Small-Break LOCA.

Table 14.3-23 System Parameters Initial Conditions Table 14.3-24 Total Pumped ECCS Flow Rate to All Four Loops Diesel Failure (Minimum Safeguards)

Table 14.3-25 Total Pumped ECCS Flow Rate to All Four Loops No Failure (Maximum Safeguards)

Table 14.3-26 Decay Heat Curve 1979 ANS Plus 2 Sigma Uncertainty Table 14.3-27 Double-Ended Hot Leg Break Blowdown Mass and Energy Releases (Minimum ECCS)

Table 14.3-28 Deleted Table 14.3-29 Double-Ended Hot Leg Break Mass Balance (Minimum ECCS)

Chapter 14, Page 178 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-30 Double-Ended Hot Leg Break Energy Balance (Minimum ECCS)

Table 14.3-31 Deleted Table 14.3-32 Deleted Table 14.3-33 Double-Ended Pump Suction Break Blowdown Mass and Energy Releases (Minimum ECCS)

Table 14.3-34 Double-Ended Pump Suction Break Reflood Mass and Energy Releases (Minimum ECCS)

Table 14.3-35 Containment Heat Sinks Table 14.3-36 Theromophysical Properties of Containment Heat Sinks Table 14.3-37 Double-Ended Pump Suction Break Principle Parameters During Reflood (Minimum ECCS)

Table 14.3-46 Double-Ended Pump Suction Break Post-Reflood Mass and Energy Releases (Minimum ECCS)

Table 14.3-47 Double-Ended Pump Suction Break Mass Balance (Minimum ECCS)

Table 14.3-48 Double-Ended Pump Suction Break Energy Balance (Minimum ECCS)

Table 14.3-49 Double-Ended Pump Suction Break Blowdown Mass and Energy Releases (Maximum ECCS)

Table 14.3-50 Double-Ended Pump Suction Break Reflood Mass and Energy Releases (Maximum ECCS)

Table 14.3-51 Double-Ended Pump Suction Break Principle Parameters During Reflood (Maximum ECCS)

Table 14.3-52 Double-Ended Pump Suction Break Post-Reflood Mass and Energy Releases (Maximum ECCS)

Table 14.3-53 Double-Ended Pump Suction Break Mass Balance (Maximum ECCS)

Table 14.3-54 Double-Ended Pump Suction Break Energy Balance (Maximum ECCS)

Table 14.3-55 LOCA Containment Response Analysis Parameters Table 14.3-56 Containment Fan Cooler Performance Table 14.3-57 Containment Spray Performance Table 14.3-58 Double-Ended Pump Suction Break Sequence of Event (Minimum ECCS)

Table 14.3-59 Double-Ended Pump Suction Break Sequence of Events (Maximum ECCS)

Chapter 14, Page 179 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-60 Double-Ended Hot Leg Break Sequence of Events (Minimum ECCS)

Table 14.3-61 Deleted Table 14.3-62 LOCA Containment Response Results (Loss of Offsite Power Assumed)

Table 14.3-63 Post-Accident Containment Temperature Transient Used in the Calculation of Aluminum Corrosion Table 14.3-64 Parameters Used to Determine Hydrogen Generation Table 14.3-65 Core Fission Product Energy After 830 Full Power Days (3216 MWT)

Table 14.3-66 Fission Product Decay Deposition in Sump Solution Chapter 14, Page 180 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-1 Best-Estimate Large break LOCA Key Parameters and Reference Transient Assumptions Parameter Reference Transient Uncertainty or Bias 1.0 Plant Physical Description

a. Dimensions Nominal PCTMOD1

b. Flow resistance Nominal PCTMOD1

c. Pressurizer location Opposite broken loop Bounded

d. Hot assembly location Under limiting location Bounded

e. Hot assembly type 15x15 Upgrade 0.422 OD, ZIRLO' clad, IFM Bounded Grids

f. SG tube plugging level High (10%) Bounded*

2.0 Plant Initial Operating Conditions 2.1 Reactor Power

a. Core average linear heat rate (AFLUX) Nominal - 100% of RTP (3216 MWt) PCTPD2

b. Peak linear heat rate (PLHR) FQ = 2.202, Derived from desired Tech Spec (TS) PCTPD2 limit FQ = 2.5 and maximum baseload FQ = 2.0

c. Hot rod average linear heat rate (HRFLUX) FH = 1.731, Derived from TSFH = 1.7 PCTPD2

d. Hot assembly average rate (HAFLUX) HRFLUX/1.04 PCTPD2

e. Hot assembly peak heat rate (HAPHR) PLHR/1.04 PCTPD2

f. Axial power distribution (PBOT, PMID) Figure 14.3-2 PCTPD2

g. Low power region relative power (PLOW) 0.8 Bounded*

h. Hot assembly burnup BOL Bounded

i. Prior operating history Equilibrium decay heat Bounded

j. Moderator Temperature Coefficient (MTC) Maximum (0.0) Bounded

k. HFP boron 800 ppm (at BOL) Generic Chapter 14, Page 181 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-1 (Cont.)

Best-Estimate Large Break LOCA Key Parameters and Reference Transient Assumptions Parameter Reference Transient Uncertainty or Bias 2.2 Fluid Conditions

a. Tavg Nominal Tavg = 572.0°F PCTIC3*

b. Pressurizer pressure Nominal (2250.0 psia) PCTIC3

c. Loop flow 88600 gpm PCTMOD1**

d. TUH Best-Estimate (~ Thot) 0

e. Pressurizer level Nominal (50.8% of span) 0

f. Accumulator temperature Nominal (105°F) PCTIC3

g. Accumulator pressure Nominal (674.7 psia) PCTIC3

h. Accumulator liquid volume (not including line Nominal (795 ft3) PCTIC3 or undeliverable volume)

i. Accumulator line resistance Nominal PCTIC3

j. Accumulator boron Tech Spec Minimum Bounded 3.0 Accident Boundary Conditions

a. Break Location Cold Leg Bounded

b. Break Type Guillotine PCTMOD1

c. Break Size Nominal (cold leg area) PCTMOD1

d. Offsite Power Not available (RCPs tripped) Bounded*

e. Safety injection flow Minimum Bounded

f. Safety injection temperature 78°F, slightly above nominal (77.5°F) PCTIC3

g. Safety injection delay Max delay 27.8 sec (LOOP) Bounded

h. Containment pressure Minimum based on COCO containment pressure Bounded calculation results (Figure 14.3-18) using plant conditions supplied in Tables 14.3-4 & 14.3-5, and the Reference Transient M&E release (Table 14.3-6a)

Chapter 14, Page 182 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-1 (Cont.)

Best-Estimate Large Break LOCA Key Parameters and Reference Transient Assumptions Parameter Reference Transient Uncertainty or Bias

i. Single failure ECCS: Loss of 1 SI train Bounded

j. Control rod drop time No control rods Bounded 4.0 Model Parameters

a. Critical flow Nominal (Cd = 1.0) PCTMOD1

b. Resistance uncertainties in broken loop Nominal (as coded) PCTMOD1

c. Initial stored energy/fuel rod behavior Nominal (as coded) PCTMOD1

d. Core heat transfer Nominal (as coded) PCTMOD1

e. Delivery and bypassing of ECC Nominal (as coded) Conservative

f. Steam binding/entrainment Nominal (as coded) Conservative

g. Non-condensable bases/accumulator nitrogen Nominal (as coded) Conservative

h. Condensation Nominal (as coded) PCTMOD1 Notes:

1.) PCTMOD indicates this uncertainty is part of code and global model uncertainty 2.) PCTPD indicates this uncertainty is part of power distribution uncertainty 3.) PCTIC indicates this uncertainty is part of initial condition uncertainty

• Confirmed to be limiting

• • Assumed to be result of loop resistance uncertainty Chapter 14, Page 183 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-2 Deleted Table 14.3-2a Best-Estimate Large Break LOCA Confirmatory Cases PCT Results Summary Case PCT (°F)

Blowdown 1st Reflood 2nd Reflood Initial Transient 1461 1616 1605 Low Nominal RCS Tavg (549°F) 1464 1579 1536 No Loss of Offsite Power 1400 1461 1427 Reduced SGTP (0%) 1464 1591 1534 Increased PLOW (0.8) - Reference Transient 1491 1627 1578 Decreased PLOW (0.3) 1456 1607 1573 Table 14.3-2b Best-Estimate Large Break LOCA Results Component Blowdown 1st Reflood 2nd Reflood Criteria 50th Percentile PCT (°F) <1480 <1568 <1600 N/A 95th Percentile PCT (°F) <1736 <1904 <1944 <2200 Maximum Local Oxidation (%) <7.60 <17.0 Maximum Total Hydrogen <0.62 <1.0 Generation (%)

Chapter 14, Page 184 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-3 Plant Operating Range Allowed by the Best-Estimate Large Break LOCA Analysis Parameter Operating Range 1.0 Plant Physical Description a) Dimensions No in-board assembly grid deformation during LOCA + SSE b) Flow resistance N/A c) Pressurizer location N/A d) Hot assembly location Anywhere in core interior1 e) Hot assembly type 15x15 OFA with IFMs, ZIRLO' clad IFBA or Non-IFBA2 f) SG tube plugging level < 10%

2.0 Plant Initial Operating Conditions 2.1 Reactor Power a) Core average linear heat rate Core power = 102% of 3216 MWt @ 2% Calorimetric Uncertainty b) Peak linear heat rate FQ < 2.5 c) Hot rod average linear heat rate FH < 1.7 d) Hot assembly average heat rate P HA 1.7 / 1.04 e) Hot assembly peak heat rate FQ,HA < 2.5/1.04 f) Axial power dist (PBOT, PMID) Figure 14.3-17 g) Low power region relative power (PLOW) 0.3 < PLOW < 0.8 h) Hot assembly burnup < 75,000 MWD/MTU, lead rod i) Prior operating history All normal operating histories j) MTC < 0 at HFP k) HFP boron 800 ppm (at BOL) l) Rod power census Table 14.3-7 2.2 Fluid Conditions a) Tavg 549 - 5.5 < Tavg < 572 +7.5(°F)3 b) Pressurizer pressure 2250 - 55 = Pressurizer Pressure < 2250 + 52 psia4 c) Loop flow > 88600 gpm/loop d) TUH Current upper internals, THOT UH e) Pressurizer level Nomal level, automatic controls f) Accumulator temperature 80 < TACC < 130°F g) Accumulator pressure 555 < PACC < 715 psia h) Accumulator volume 715 < VACC < 875 ft3 Chapter 14, Page 185 of 333 Revision 04, 2011

IP3 FSAR UPDATE i) Accumulator fl/D Current line configuration j) Minimum accumulator boron > 2000 ppm 3.0 Accident Boundary Conditions a) Break location N/A b) Break type N/A c) Break size N/A d) Offsite Power Available or LOOP e) Safety injection flow Table 14.3-8 f) Safety injection temperature 35 < TSI < 110°F g) Safety injection delay < 15.0 seconds (with offsite power)

< 27.8 seconds (without offsite power) h) Containment pressure Bounded, see Figure 14.3-18; Raw Data Tables 14.3-4 and 14.3-5.

i) Single Failure All trains operable5 j) Control rod drop time N/A Notes:

1) Peripheral locations will not physically be lead power assembly

2) See Section 14.3.3.3.7 for associated IFBA and fuel evaluations

3) 549°F and 572°F are nominal values. The +/- values reflect bias and uncertainty.

4) 2250 psia is nominal value. The +/- values reflect bias and uncertainty.

5) Analysis considers loss of one train of pumped ECCS.

Chapter 14, Page 186 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14.3-3B Deleted Table 14.3-4 Containment Data (Dry Containment)(Core Calculation)

Net Free Volume, ft3 2.61 x 106 Initial Conditions Pressure, psia 14.7 Temperature, °F 90.0 RWST Temperature, °F 35.0 Service Water Temperature, °F 28.0 Outside Temperature, °F -20.0 Spray System Number of Pumps Operating 2 Total Flow Rate, gpm 6783 Actuation Delay Time, seconds 20 Safeguards Fan Coolers Number of Fan Coolers Operating 5 Fastest Post-Accident Initiation of 30 Fan Coolers, seconds Chapter 14, Page 187 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3 - 5 Structural Heat Sink Data Thickness, in Material Area, ft2

1) 0.0065 Paint 0.375 Steel 36.0 Concrete 49,838

2) 0.0065 Paint 0.500 Steel 36.0 Concrete 32,072

3) 12.0 Concrete 15,000

4) 0.375 Stainless Steel 12.0 Concrete 10,000

5) 12.0 Concrete 61,000

6) 0.0065 Paint 0.500 Steel 68,792

7) 0.0065 Paint 0.375 Steel 79,904

8) 0.0065 Paint 0.250 Steel 27,948

9) 0.0065 Paint 0.1875 Steel 69,800

10) 0.125 Steel 3,000

11) 0.138 Steel 22,000

12) 0.0065 Paint 10,000 0.0625 Steel

13) 0.0065 Paint 0.75 Steel 36.0 Concrete 785

14) 0.019 Stainless Steel 1.5 Insulation 0.375 Steel 36.0 Concrete 7,461

15) 0.375 Steel 1,800 Chapter 14, Page 188 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-6 Deleted Chapter 14, Page 189 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-6a Best-Estimate Large Break LOCA Mass and Energy Releases from BCL Used for COCO Calculation at Selected Time Points Time (sec) M&E from Loop Side BCL M&E from Vessel Side BCL Mass Flow Energy Flow Mass Flow Energy Flow (lbm/s) (Btu/s) (lbm/s) (Btu/s) 0.0 9431 5054211 -9 0 0.5 25755 13690582 51011 27128438 1.0 25451 13674828 49339 26235666 1.5 24690 13551964 46268 24604286 2.0 22846 12819397 41524 22096196 4.0 11772 7377433 26953 14467051 6.0 7806 5750281 22101 12098881 8.0 6035 5043209 18040 10422447 10.0 4081 3915462 13792 8234264 12.0 3470 3153564 9823 5990187 14.0 2729 2414386 10345 4907165 16.0 1464 1483439 8215 3265073 18.0 813 884113 7337 2274947 20.0 425 487408 6432 1574623 25.0 47 58072 0 0 30.0 48 60748 -23 0 35.0 34 43605 -54 0 40.0 105 130920 172 21274 45.0 105 131402 3197 485454 50.0 199 245064 2198 762857 60.0 56 70367 167 122120 70.0 46 58072 65 49332 80.0 46 57651 107 76809 90.0 56 70496 127 101991 100.0 50 63717 130 94485 110.0 58 73674 301 158709 120.0 59 74104 280 163947 130.0 57 72174 284 155722 140.0 52 65407 172 111102 150.0 52 65305 169 83030 160.0 53 66233 294 130280 170.0 61 75761 724 251458 180.0 83 92739 1123 292854 190.0 53 65879 590 179045 200.0 47 57883 146 69221 210.0 42 52114 162 77570 220.0 53 65436 257 143531 230.0 62 74610 446 183494 240.0 81 90385 366 163008 250.0 56 69276 345 161995 Chapter 14, Page 190 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-6b Best-Estimate Large Brake LOCA Mass and Energy Releases from BCL Accumulator and SI Time (Sec) Mass Flow (lbm/s) Energy Flow (Btu/s) Enthalpy (Btu/lbm) 0.0 - 15.0 1838.7 91696 49.87 15.0 - 30.0 2299.6 93111 40.49 30.0 - end 328.84 1003 3.05 Table 14.3-7 Rod Census Used in Best-Estimate Large Break LOCA Analysis Rod Group Power Ratio  % of Core 1 1.0 10 2 0.912 10 3 0.853 10 4 0.794 10 5 0.735 10 6 0.676 10 7 <0.65 40 Chapter 14, Page 191 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-8 Best Estimate Large Break LOCA Total Minimum Injected Flow from HHSI and LHSI RCS Pressure (psig) Flow Rate (gpm) 0 3339.2 20 2877.7 40 2401.2 70 1629.7 80 1366.1 90 1016.6 100 718.1 110 544.1 200 529.2 400 441.3 600 324.4 800 174.2 1000 45 Chapter 14, Page 192 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-8a Initial Parameters For Small Break LOCA Analysis Licensed Core Power, (MWt) 3216 Total Peaking Factor,FQ 2.50 Axial Offset, % 13 Hot Channel Enthalpy Rise Factor, F H 1.70 Maximum Assembly Average Power, PHA 1.51 Fuel Assembly Array 15x15 Upgraded w/IFMs Nominal Accumulator Water Volume, ft3 795 Accumulator Tank Volume, ft3 1100 Minimum Accumulator Gas Pressure, psia 555 Loop Flow (gpm) 88600 Vessel Inlet Temperature, °F 540.37 Vessel Outlet Temperature, °F 603.63 RCS Pressure with Uncertainty, psia 2310 Steam Pressure, psia 709.19 Steam Generator Tube Plugging, % 10 Maximum Refueling Water Storage Tank Temperature, °F 110 Maximum Condensate Storage Tank Temperature, °F 120 Non-IFBA Fuel Backfill Pressure, psig 275 2.0xB10 IFBA Fuel Backfill Pressure, psig 100 Reactor Trip Setpoint, psia 1748.7 Safety Injection Signal Setpoint, psig 1648.7 Safety Injection Delay Time, s 27.8 Signal Processing Delay and Rod Drop Time, s 4.7 Feedwater Trip Processing Delay Time, s 2 Time for Main Feedwater Flow Coastdown, s 10 Auxiliary Feedwater Pump Start Delay Time, s 60 Chapter 14, Page 193 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-8b Small Break LOCA Time Sequence of Events Break Size EVENT 2 inch 3 inch 4 inch Break Initiation, sec 0.0 0.0 0.0 Reactor Trip Signal, sec. 55.9 22.8 13.0 Safety Injection Signal, sec. 71.2 30.2 16.1 Top of Core Uncovered, sec. 1738 765 601 Accumulator Injection Begins, sec. NA 1688 890 Peak Clad Temperature occurs, sec. 3518 1954 1053 Top of Core Recovered, sec N/A N/A 2560 Chapter 14, Page 194 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-8c Small Break LOCA Analysis Results EVENT BREAK SIZE 2 inch 3 inch 4 inch Peak Clad Temperature, °F 1182 1543 1380 Peak Clad Temperature Location, ft. 11.5 11.75 11.25 Local Zr/H2O Reaction (max), % 0.12 1.04 0.21 Local Zr/H2O Reaction Location, ft. 11.25 11.75 11.25 Total Zr/H2O Reaction, % <1.0 <1.0 <1.0 Hot Rod Burst Time, seconds NA NA NA Hot Rod Burst Location, ft. NA NA NA Tables 14.3-9 & 14.3-10 Deleted Chapter 14, Page 195 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-11 Maximum Deflections Allowed For Reactor Support Structures No-Loss-Of Allowable Function Component Deflections (in) Deflections (in)

Upper Barrel radial inward 4.1 8.2 radial 1.0 1.0 Upper Package 0.10 0.15 Rod Cluster Guide Tubes 1.00 1.75 NOTE:

The allowable limit deflection values given above correspond to stress levels for the internals structure well below the limiting criteria given by the collapse curves in WCAP-5890 (Reference 60).

Consequently, for the internals, the geometric limitations established to assure safe shutdown capability are more restrictive than those given by the failure stress criteria.

Table 14.3-12 Deleted Chapter 14, Page 196 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-13 Site Dispersion Factors Distance ( /Q) 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ( /Q) 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br /> ( / Q) 30 days (meters) (sec/m3) (sec/m3) (sec/m3)

• 350 10.3 x 10-4 5.4 x 10-4 1.35 x 10-4 400 9.51 x 10-4 4.75 x 10-4 1.03 x 10-4 700 5.98 x 10-4 2.99 x 10-4 3.87 x 10-5 1,000 4.20 x 10-4 2.10 x 10-4 2.07 x 10-5

• • 1,100 3.80 x 10-4 1.90 x 10-4 1.70 x 10-5 2,000 1.90 x 10-4 9.50 x 10-5 6.13 x 10-6 4,000 7.68 x 10-5 3.84 x 10-5 1.82 x 10-6 7,000 3.55 x 10-5 1.77 x 10-5 6.79 x 10-7 10,000 2.14 x 10-5 1.07 x 10-5 3.63 x 10-7 20,000 7.78 x 10-6 3.89 x 10-6 1.07 x 10-7 These are plotted vs distance on Figure 14.3-73

• Site Boundary

• • Low Population Zone Tables 14.3-14, 14.3-14a, 14.3-14b, 14.3-14c, 14.3-14d, 14.3 14e Deleted Chapter 14, Page 197 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-14f Containment Sump And Recirculation Pipings Outside Containment Source Strength At Various Times Following A Maximum Credible Accident (TID-14844 Release Fraction)

Source Strength (MeV/cc-sec)

Ey,MeV 0 0.5 HR. 2.0 HRS. 8.0 HRS. 1 DAY 7 DAYS 30 DAYS 0.2-0.4 3.12+09 1.09+09 8.76+09 7.59+08 5.65+08 2.34+08 2.92+07 0.5-0.9 1.17+10 7.79+09 4.28+09 1.64+09 7.98+08 1.50+08 7.01+07 0.9-1.35 7.01+09 3.31+09 1.95+09 8.57+08 1.95+08 8.76+06 2.34+06 1.35-1.8 6.82+09 3.31+09 1.73+09 6.04+08 1.48+08 4.48+07 1.29+07 1.8-2.2 2.92+09 1.69+09 9.93+08 2.34+08 1.25+07 1.79+06 7.20+05 2.2-2.6 3.31+09 2.14+09 1.19+09 2.53+08 1.31+07 2.73+06 7.79+05 2.6-3.0 1.58+09 2.53+08 1.17+08 1.67+07 3.70+05 4.67+04 1.34+04 3.0-4.0 1.11+09 1.44+08 4.87+07 7.01+06 1.48+05 1.83+04 5.26+03 4.0-5.0 8.18+08 6.23+06 5.06+06 0 0 0 0 5.0-6.0 3.70+06 4.67+04 0 0 0 0 0 Tables 14.3-14g, 14.3-14h, 14.3-15, 14.3-16, 14.3-17 Deleted Chapter 14, Page 198 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-18 Assumptions Used In The Analysis Of The Environmental Consequences Of A Large Break LOCA Source Term Plant Power Level 3216 MWt Core Activity Level See Table 14C-4 Fraction of activity released from core Gas Release Core Melt Iodines 0.05 0.35 Noble Gases 0.05 0.95 Alkali Metals 0.05 0.25 Tellurium Group 0.0 0.05 Strontium & Barium 0.0 0.02 Noble Metals 0.0 0.0025 Cerium Group 0.0 0.0005 Lanthanide Group 0.0 0.0002 Gap Release Timing (start / end) 30 sec / 30 min Core Melt Timing (start / end) 30 min / 1.8 hr Containment Leakage Model Fraction of airborne Iodine in Containment Atmosphere Elemental Form 0.0485 Methyl Form 0.0015 Particulate Form 0.95 Containment Free Volume 2.61 x 106 ft3 Fraction of Containment Sprayed 0.8 Spray Removal Coefficient (Injection Phase)

Elemental Iodine 20 hr-1, DF < 200 Methyl Iodine 0 hr-1 Particulate Iodine 4.6hr-1, DF < 50 Spray Injection Phase Timing (Start / End) 67 sec / 45 min Spray Recirculation Phase Timing (Start / End) 48 min / 4.0 hr Spray Removal Coefficient (Recirculation Phase)

Elemental Iodine 5 hr-1, DEF < 200 Methyl Iodine 0 hr-1 Particulates, DF <50 2.0 hr-1 Particulates, DF >50 0.22hr-1 Chapter 14, Page 199 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-18 (Cont.)

Assumptions Used In The Analysis Of The Environmental Consequences Of A Large-Break LOCA Containment Leakage Model (continued)

Sedimentation Removal Coefficient 0.1 hr-1, DF < 1000 Containment Leak Rate (0 - 24 hrs) 0.1% per day (1 - 30 days) 0.05% per day Fan Cooler Units FCU Flow Rate (per unit) 34,000 cfm Number of units assumed operating 3 of 5 Time Delay to Initiate Operation 60 seconds Flow Rate Through Filters (per unit) 8,000 cfm Filter Efficiencies No filtration credit assumed Sump Solution Leakage Outside Containment Sump Solution Water Volume 374,400 gal Leakage Through RCP Seal Leakoff Line Leak Rate 1.0 gph Timing of Leakage (start / end) 0.0 hr / 4.0 hr Iodine Partition Coefficient 0.1 ECCS Recirculation Outside Containment Leak Rate 4.0 gph Timing of Leakage (Start/end) 6.5 hr / 30 days Iodine Partition Coefficient 0.1 Iodine Species (after release to atmosphere)

Elemental 0.97 Organic Form 0.03 Control Room Model Parameters See Appendix 14C Dose Calculation Inputs and Assumptions Nuclide Data See Table 14C-5 Offsite Breathing Rate 0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 3.5E-4m3/sec 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.8E-4m3/sec

>24 hours 2.3E-4m3/sec Offsite Atmospheric Dispersion Factors See Table 14.3-13 Chapter 14, Page 200 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-18a Assumptions Used in the Analysis of the Environmental Consequences of a Small-Break LOCA Source Term Plant Power Level 3216 MWt Core Activity See Table 14C-4 Fraction of Activity Released from Core Iodines 0.05 Noble Gases 0.05 Alkali Metals 0.05 Release Timing Instantaneous Containment Leakage Release Path Fraction of airborne Iodine in Containment Atmosphere Elemental Form 0.0485 Methyl Form 0.0015 Particulate Form 0.95 Containment Free Volume 2.61E6 ft3 Fraction of Containment Sprayed No spray operation Containment Leak Rate (0 - 24 hrs) 0.1% per day (1 - 30 days) 0.05% per day Fan Cooler Units FCU Flow Rate (per unit) 34,000 cfm Number of units assumed operating 3 of 5 Time Delay to Initiate Operation 60 seconds Flow Rate Through Filters Per Unit 8,000 cfm Filter Efficiencies Elemental Iodine No credit assumed Organic Iodine No credit assumed Particulates 90%

Chapter 14, Page 201 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-18a (Cont.)

Assumptions used in the Analysis of the Environmental Consequences of a Small-Break LOCA Secondary Side Release Path Primary to Secondary Leakage 1.0 gpm Secondary Side Water Mass 281,600 lb Steam Release to Atmosphere 0 -2 hr 405,229 lb

> 2 hr 0.0 lb Iodine Partition Coefficient for Steaming 0.01 Iodine Form After Release to Atmosphere Elemental 97%

Organic 3%

Alkali Metal Partition Coefficient for Steaming 0.001 Control Room Model Parameters See Appendix 14C Dose Calculation Inputs and Assumptions Nuclide Data See Table 14C-5 Offsite Breathing Rate 0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 3.5E-4 m3/sec 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.8E-4 m3/sec

>24 hours 2.3E-4 m3/sec Offsite Atmospheric Dispersion Factors See Table 14.3-13 Chapter 14, Page 202 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-19 Containment Design Parameters Total Containment Volume 2.61 X 106 ft3 Lower Containment Volume 0.37 x 106 ft3 Upper Containment Volume 2.24 x 106 ft3 Fan Cooler Filtered Flowrate 8,000 cfm per unit Fan cooler filter efficiency for iodine - 90% elemental 70% organic 90% particulate Containment leak rate after isolation 0-24 hours 0.1% per day

>24 hours 0.05% per day Chapter 14, Page 203 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-20 Reactor Coolant System Equilibrium Activities (From Table 9.2-5)

Isotope uc / cc (573 F)

I-131 1.64 I-132 0.605 I-133 2.67 I-134 0.377 I-135 1.44 Xe-133 192.0 Xe-135 4.24 Xe-138 0.46 Kr-85 4.4 Kr-85m 1.43 Kr-87 0.83 Kr-88 2.51 Chapter 14, Page 204 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-21 Other Parameters Used in Evaluation of Environmental Consequences Of Accident Meteorology X/Q (sec/m3)

Hours After Site Boundary Low Population Breathing*

Accident Zone Rate (m/sec) 0-2 1.03 x 10-3 3.8 x 10-4 3.47 x 10-4 2-8 5.4 x 10-4 1.8 x 10-4 3.47 x 10-4 8-24 5.4 x 10-4 1.9 x 10-4 1.75 x 10-4 24-270 1.35 x 10-4 1.70 x 10-5 2.32 x 10-4

• Safety Guide 4 and TID-14844 Table 14.3-22 Doses From Rupture of Pressurizer During Containment Purging Dose (Rem)

Containment Isolation Exclusive Radius Low Population Zone Dose Time (0-2 hrs) (0-30 days)

Thyroid 15 minutes 25.2 9.3 Thyroid 50 minutes 108 39.8 Whole body 15 minutes 0.48 0.18 Whole body 50 minutes 2.05 0.78 Chapter 14, Page 205 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-23 System Parameters Initial Conditions Parameters Value Core Thermal Power (MWt) 3216 Reactor Coolant System Total Flow Rate (lbm/sec) 37,444.4 Vessel Outlet Temperature (°F) 610.5 Core Inlet Temperature (°F) 548.5 Vessel Average Temperature (°F) 572.0 Initial Steam Generator Steam Pressure (psia) 787.0 Steam Generator Design Model 44F Steam Generator Tube Plugging (%) 0 100,668.7 Initial Steam Generator Secondary Side Mass (lbm)

Assumed Maximum Containment Backpressure (psia) 61.7 Accumulator Water Volume (ft3) 807.2 N2 Cover Gas Pressure (psia) 555.0 Temperature (°F) 130.0 Safety Injection Delay From Beginning of Event (sec) 27.8 Note: RCS Coolant Temperature, and Steam Generator Secondary Side Mass include appropriate uncertainty and/or allowance.

Chapter 14, Page 206 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-24 Total Pumped ECCS Flow Rate to All Four Loops Diesel Failure (Minimum ECCS)

INJECTION MODE (REFLOOD PHASE)

RCS Pressure (psia) Total Flow (gpm) 14.7 5252.3 24.7 5115.1 34.7 4975.2 44.7 4832.7 54.7 4687.2 64.7 4536.1 74.7 4367.1 84.7 4192.8 94.7 4012.4 104.7 3825.0 114.7 3630.0 INJECTION MODE (POST-REFLOOD PHASE)

RCS Pressure (psia) Total Flow (gpm) 61.7 581.4 COLD LEG RECIRCULATION MODE RCS Pressure (psia) Total flow (gpm) 61.7 2080.0 Chapter 14, Page 207 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-25 Total Pumped ECCS Flow Rate to All Four Loops No Failure (Maximum ECCS)

INJECTION MODE (REFLOOD PHASE)

RCS Pressure (pisa) Total Flow (gpm) 14.7 7815.6 34.7 7479.7 54.7 7129.7 74.7 6745.8 94.7 6330.8 114.7 5885.9 134.7 5403.6 154.7 4866.3 174.7 4215.0 194.7 3414.7 214.7 2180.4 234.7 1332.7 314.7 1290.1 414.7 1234.6 INJECTION MODE (POST-REFLOOD PHASE)

RCS Pressure (psia) Total Flow (gpm) 61.7 6995.3 COLD LEG RECIRCULATION MODE RCS Pressure (psia) Total Flow (gpm) 61.7 4160 Chapter 14, Page 208 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-26 Decay Heat Curve 1979 ANS Plus 2 Sigma Uncertainty Time (Sec) Decay Heat Generation Rate (BTU/BTU) 1.00E+01 0.053876 1.50E+01 0.050401 2.00E+01 0.048018 4.00E+01 0.042401 6.00E+01 0.039244 8.00E+01 0.037065 1.00E+02 0.035466 1.50E+02 0.032724 2.00E+02 0.030936 4.00E+02 0.027078 6.00E+02 0.024931 8.00E+02 0.023389 1.00E+03 0.022156 1.50E+03 0.019921 2.00E+03 0.018315 4.00E+03 0.014781 6.00E+03 0.013040 8.00E+03 0.012000 1.00E+04 0.011262 1.50E+04 0.010097 2.00E+04 0.009350 4.00E+04 0.007778 6.00E+04 0.006958 8.00E+04 0.006424 1.00E+05 0.006021 1.50E+05 0.005323 4.00E+05 0.003770 6.00E+05 0.003201 8.00E+05 0.002834 1.00E+06 0.002580 1.00E+07 0.000808 Chapter 14, Page 209 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-27 DEHL Break Blowdown M&E Releases (Minimum ECCS)

Break Path No. 1* Break Path No. 2 Time (sec)

(lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 0.0 0.0 0.0 0.0 0.0 0.001 43216.1 27017.6 43213.1 27014.4 0.002 44433.6 27779.4 44164.6 27604.0 0.1 45538.9 28778 25444.9 15873.6 0.2 32791.7 21154.0 22595.2 14017.6 0.3 32084.8 20646.9 20305.9 12441.9 0.4 31280.4 20117.6 19120.5 11538.7 0.5 31012.0 19936.5 18348.2 10908.8 0.6 30970.6 19912.6 17786.9 10431.7 0.7 30879.0 19877.0 17343.9 10051.4 0.8 30588.4 19730.6 17023.3 9762.1 0.9 30227.7 19552.0 16732.0 9505.9 1.0 29827.8 19360.2 16560.6 9329.1 1.1 29559.7 19264.0 16444.0 9194.1 1.2 29306.8 19187.0 16442.2 9130.6 1.3 29048.7 19106.1 16506.8 9108.9 1.4 28718.0 18974.1 16618.7 9118.1 1.5 28330.4 18796.2 16751.8 9144.7 1.6 27926.6 18603.7 16900.6 9184.9 1.7 27555.8 18429.8 17051.8 9232.4 1.8 27184.5 18255.6 17199.2 9282.7 1.9 26773.1 18050.8 17332.3 9330.3 2.0 26314.9 17808.3 17447.9 9372.9 2.1 25851.9 17556.4 17543.1 9408.5

• mass and energy exiting from the reactor vessel side of the break mass and energy exiting from the steam generator side of the break Chapter 14, Page 210 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-27 (Cont.)

DEHL Break Blowdown M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 2.2 25391.2 17303.5 17619.5 9437.1 2.3 24938 17054.4 17679.3 9459.3 2.4 24496.9 16809.6 17722.1 9474.5 2.5 24046.1 46552.9 17750.4 9483.7 2.6 23573.2 16273.0 17766.3 9487.6 2.7 23114.2 15997.0 17771.4 9486.7 2.8 22689.1 15743.8 17768.4 9482.3 2.9 2284.5 15500.2 17756.4 9473.7 3.0 21875.4 15243.8 17734.3 9460.2 3.1 21492.2 15000.3 17702.9 9442.1 3.2 21129.3 14765.0 17663.7 9420.1 3.3 20779.2 14529.5 17615.8 9393.8 3.4 20470.4 14319.2 17561.3 9364.3 3.5 20180.8 14117.6 17501.0 9331.9 3.6 19903.1 13914.9 17434.1 9296.3 3.7 19644.4 13720.7 17361.0 9257.8 3.8 19414.0 13544.5 17283.1 9216.9 3.9 19194.4 13368.4 17199.0 9173.1 4.0 19004.3 13209.8 17109.4 9126.7 4.2 18688.3 12931.8 16914.7 9026.8 4.4 18436.2 12689.9 16696.0 8916.1 4.6 18246.3 12490.3 16458.1 8797.2 4.8 18184.6 12385.8 16197.0 8668.2 5.0 18242.3 12349.7 15914.4 8530.2 5.2 18416.6 12359.7 15630.4 8393.8 5.4 18634.4 12390.6 15313.5 8240.9 5.6 18872.2 12431.3 14943.5 8059.9 5.8 19167.6 12503.3 14553.8 7868.7 6.0 19546.1 12605.6 14202.2 7697.4 6.2 11596.1 9053.2 13865.2 7532.8

• mass and energy exiting from the reactor vessel side of the break mass and energy exiting from the steam generator side of the break Chapter 14, Page 211 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-27 (Cont.)

DEHL Break Blowdown M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 6.4 14615.2 10424.6 13543.6 7374.6 6.6 14498.6 10297.0 13191.7 7197.4 6.8 14631.6 10261.7 12824.2 7009.7 7.0 14823.9 10328.0 12479.4 6833.2 7.2 15043.6 10422.7 12161.2 6669.8 7.4 15250.0 10436.2 11845.6 6506.1 7.6 15449.4 10476.1 11532.8 6342.4 7.8 15635.7 10580.4 11228.3 6182.3 8.0 15575.1 10451.1 10941.3 6031.2 8.2 15901.5 10556.6 10677.6 5892.1 8.4 16217.3 10658.8 10419.5 5755.5 8.6 16550.9 10772.6 10167.7 5621.8 8.8 16971.8 10933.5 9920.2 5490.0 9.0 17728.7 11275.9 9678.6 5361.3 9.2 18541.3 11698.2 9442.1 5235.5 9.4 18929.1 11866.3 9206.6 5110.3 9.6 19223.8 11965.3 8971.5 4985.4 9.8 18854.0 11651.4 8726.2 4855.0 10.0 17951.0 11023.8 8481.1 4725.3 10.2 14860.8 9376.5 8233.4 4595.0 10.4 14303.8 9059.4 8004.6 4475.3 10.6 14418.5 9086.4 7784.8 4361.1 10.8 14561.4 9141.4 7592.6 4262.5 11.0 14722.8 9210.1 7417.9 4172.7 11.2 14873.7 9265.9 7245.6 4083.2 11.4 15060.7 9333.2 7079.6 3997.0 11.6 15358.1 9452.3 6918.4 3913.3 11.8 15822.0 9672.5 6752.4 3827.3 12.0 15709.9 9570.8 6587.3 3742.1 12.2 15462.5 9384.3 6419.7 3656.1 12.4 14575.9 8878.8 6246.4 3597.5 12.6 12813.6 7959.4 6076.2 3481.5 12.8 12586.2 7813.6 5909.8 3398.4 13.2 12565.4 7764.9 5614.8 3253.7 13.4 12544.7 7740.0 5481.0 3188.0

• mass and energy exiting from the reactor vessel side of the break mass and energy exiting from the steam generator side of the break Chapter 14, Page 212 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-27 (Cont.)

DEHL Break Blowdown M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 13.6 12502.3 7704.5 5356.4 3126.3 13.8 12413.7 7644.8 5235.4 3066.3 14.0 12248.4 7546.3 5115.8 3007.0 14.2 11967.8 7389.8 4998.4 2949.2 14.4 11490.4 7165.4 4884.3 2893.4 14.6 10863.9 6930.2 4767.2 2836.4 14.8 10495.2 6789.9 4653.9 2781.9 15.0 10225.7 6678.1 4544.9 2729.6 15.2 9956.4 6553.4 4433.8 2676.3 15.4 9643.3 6398.4 4323.8 2623.7 15.6 9288.3 6219.5 4213.7 2571.5 15.8 8937.9 6045.4 4099.8 2517.7 16.0 8619.6 5891.9 3979.2 2461.0 16.2 8322.4 5755.6 3846.8 2399.1 16.4 8019.5 5624.2 3698.2 23308 16.6 7695.6 5489.8 3534.0 2256.5 16.8 7342.7 5348.1 3358.3 2177.1 17.0 6962.8 5199.8 3179.0 2094.7 17.2 6557.4 5045.0 3004.6 2012.0 17.4 6136.6 4886.9 2844.0 1932.3 17.6 5701.0 4725.1 2700.7 1857.7 17.8 5260.7 4562.3 2576.3 1789.8 18.0 4822.8 4398.4 2470.4 1729.7 18.2 4368.6 4198.7 2379.7 1677.0 18.4 3966.3 3932.9 2297.4 1628.2 18.6 3702.8 3715.2 2224.0 1584.6 18.8 3502.0 3553.9 2156.6 1544.8 19.0 3337.0 3431.7 2092.0 1508.1 19.2 3175.6 3312.9 2028.2 1473.8 19.4 3006.4 3193.8 1899.5 1441.3 19.6 2833.6 3074.0 1899.5 1410.3 19.8 2659.6 2943.8 1832.2 1378.9 20.0 2476.5 2810.7 1765.5 1348.9 20.2 2279.9 2650.6 1697.5 1319.2

• mass and energy exiting from the reactor vessel side of the break mass and energy exiting from the steam generator side of the break Chapter 14, Page 213 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-27 (Cont.)

DEHL Break Blowdown M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 20.4 2105.3 2493.7 1626.0 1289.3 20.6 1969.1 2360.6 1546.6 1258.6 20.8 1835.2 2217.8 1461.5 1230.8 21.0 1703.9 2071.2 1370.8 1202.4 21.2 1582.3 1933.8 1282.9 1171.9 21.4 1471.4 1809.0 1209.5 1142.4 21.6 1373.0 1697.9 1151.9 1116.0 21.8 1298.2 1615.2 1107.2 1095.8 22.0 1257.9 1571.0 1068.6 1074.2 22.2 1194.9 1500.0 1040.6 1054.5 22.4 1119.7 1408.8 1019.6 1036.8 22.6 1047.1 1319.4 1004.2 1019.2 22.8 976.8 1232.5 995.6 1003.8 23.0 928.8 1170.9 988.5 990.1 23.2 860.1 1086.8 975.4 980.3 23.4 770.3 973.1 938.3 975.2 23.6 704.9 893.0 853.3 973.8 23.8 641.7 813.7 661.6 802.7 24.0 588.2 696.1 574.4 703.1 24.2 548.1 595.1 579.4 709.1 24.4 518.7 658.7 512.3 627.2 24.6 500.9 636.1 371.8 456.9 24.8 487.5 618.7 319.8 394.3 25.0 475.6 603.1 247.6 305.8 25.2 54.2 69.9 199.2 247.1 25.4 0.0 0.0 95.2 118.9 25.6 0.0 0.0 0.0 0.0

• mass and energy exiting from the reactor vessel side of the break mass and energy exiting from the steam generator side of the break T

Table 14.3-28 Deleted Chapter 14, Page 214 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-29 DEHL Break Mass Balance (Minimum ECCS)

Time (sec) 0.0 25.6 25.6 Mass (1000 lbm)

Initial In RCS and 732.01 732.01 732.01 Accumulator Added Mass Pumped Injection .00 .00 .00 Total Added .00 .00 .00

• • • Total Available*** 732.01 732.01 732.01 Distribution Reactor Coolant 527.21 61.26 88.21 Accumulator 204.80 158.37 131.42 Total Contents 732.01 219.63 219.63 Effluent Break Flow .00 512.36 512.36 ECCS Spill .00 .00 .00 Total Effluent .00 512.36 512.36

• • • Total Accountable 732.01 731.98 731.98 Table 14.3-30 Double-Ended Hot Leg Break Energy Balance (Minimum ECCS)

Time (sec) .00 25.60 25.60 Energy (million BTU)

Initial Energy In RCS, Accumulator, 775.34 775.34 775.34 Steam Generator Added Energy Pumped Injection .00 .00 .00 Decay Heat .00 7.72 7.72 Heat from Secondary .00 9.96 9.96 Total Added .00 17.68 17.68

• • • Total Available*** 775.34 793.02 793.02 Distribution Reactor Coolant 305.75 15.57 18.25 Accumulator 20.35 15.73 13.06 Core Stored 26.87 10.59 10.59 Primary Metal 166.26 156.28 156.28 Secondary Metal 40.98 40.06 40.06 Steam Generator 215.15 227.53 227.53 Total Contents 775.34 465.77 465.77 Effluent Break Flow .00 326.77 326.77 ECCS Spill .00 .00 .00 Total Effluent .00 326.77 326.77

• • • Total Accountable*** 775.34 792.53 792.53 Chapter 14, Page 215 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-31 & 14.3-32 Deleted Table 14.3-33 DEPS Break Blowdown M&E Release (Minimum ECCS)

Time Break Path No.1* Break Path No. 2 (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 0.0 0.0 0.0 0.0 0.0 0.001 81761.8 44233.2 40576.0 21912.8 0.1 40368.4 21885.1 19793.9 10677.7 0.2 45306.7 24772.6 22451.3 12124.9 0.3 45415.9 25096.5 23512.5 12704.7 0.4 45055.9 25215.1 23517.2 12711.4 0.5 44009.1 24945.6 22969.5 12420.5 0.6 44256.3 25378.4 22403.5 12120.2 0.7 43600.3 25252.0 22049.2 11934.2 0.8 42230.5 24671.9 21887.5 11851.0 0.9 40998.0 24158.5 21772.1 11792.1 1.0 39954.5 23761.7 21676.2 11742.9 1.1 38791.7 23329.2 21567.5 11686.1 1.2 37322.5 22738.0 21464.4 11631.9 1.3 35681.4 22020.7 21381.4 11588.1 1.4 34261.3 21372.7 21325.8 11558.9 1.5 33185.6 20878.9 21311.8 11552.2 1.6 32347.7 20502.1 21355.1 11565.8 1.7 31543.5 20137.7 21256.7 11523.4 1.8 30691.4 19737.1 21078.4 11426.5 1.9 29771.4 19286.1 20897.8 11328.4 2.0 28806.8 18796.0 20735.0 11240.3 2.1 27794.9 18268.3 20582.8 11158.0 2.2 26813.6 17759.7 20406.0 11062.5 2.3 25407.1 16959.1 20198.9 10950.3 2.4 23314.1 15671.6 19979.5 10831.5 2.5 21428.3 14504.8 19781.6 10724.5 2.6 21061.3 14354.1 19588.9 10620.6 2.7 20375.5 13940.6 19405.6 10521.9 2.8 19647.9 13490.3 19200.4 10411.3

• mass and energy exiting the SG side of the break mass and energy exiting the pump side of the break Chapter 14, Page 216 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-33 (Cont.)

DEPS Break Blowdown M&E Releases (Minimum ECCS)

Break Path No. 1* Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 2.9 19327.9 13315.2 19003.6 10305.3 3.0 18990.9 13110.6 18809.5 10201.0 3.1 18936.7 13103.3 18599.8 10088.1 3.2 18708.8 12965.8 18359.2 9958.3 3.3 18376.1 12765.8 18107.3 9822.4 3.4 18036.8 12557.7 17873.1 9696.2 3.5 17593.9 12267.4 17641.1 9571.4 3.6 17069.3 11917.1 17408.8 9446.3 3.7 16489.9 11528.9 17177.4 9321.8 3.8 15903.3 11135.1 16954.4 9202.0 3.9 15363.2 10772.2 16746.0 9090.1 4.0 14881.1 10447.4 16551.1 8985.8 4.2 14051.8 9886.3 16181.4 8787.9 4.4 13368.7 9425.1 15844.1 8607.7 4.6 12849.6 9066.2 15533.4 8442.0 4.8 12412.2 8757.6 15247.7 8289.7 5.0 12013.1 8465.4 14999.3 8157.8 5.2 11703.6 8224.2 14763.6 8032.5 5.4 11586.3 8094.8 14554.2 7921.5 5.6 11514.6 7994.2 14351.2 7813.7 5.8 11482.1 7922.8 14628.1 7971.2 6.0 11522.2 7898.5 14747.6 8037.3 6.2 12194.7 8296.4 14583.2 7949.9 6.4 12141.3 8354.3 14758.0 8049.7 6.6 10307.9 7832.3 14611.9 7971.5 6.8 9121.4 7303.9 14448.4 7884.8 7.0 9073.9 7243.1 14317.3 7815.8 7.2 9131.3 7217.0 14150.0 7726.8 7.4 8251.8 7207.9 13997.8 7646.3 7.6 9481.4 7234.9 13888.3 7588.7

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 217 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-33 (Cont.)

DEPS Break Blowdown M&E Releases (Minimum ECCS)

Break Path No. 1* Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 7.8 9840.4 7325.9 13772.0 7525.2 8.0 10359.8 7518.4 13588.0 7423.3 8.2 11037.7 7812.7 13409.2 7324.2 8.4 11803.6 8167.7 13241.4 7231.2 8.6 12593.0 8547.8 13064.4 7133.0 8.8 13245.7 8851.5 12873.9 7027.5 9.0 13483.0 8908.3 12687.9 6924.7 9.2 13276.1 8712.1 12523.4 6834.0 9.4 12965.9 8476.1 12374.3 6751.5 9.6 12574.6 8194.2 12222.6 6667.2 9.8 11645.6 7582.1 12081.1 6588.6 10.0 10593.6 6936.8 12004.7 6546.0 10.2 10208.2 6743.1 11946.2 6512.7 10.4 9933.1 6606.9 11771.6 6414.9 10.6 9558.0 6412.6 11662.9 6354.9 10.8 9363.2 6333.5 11584.3 6312.0 11.0 9110.8 6193.7 11405.8 6213.9 11.2 8843.7 6050.6 11321.2 6168.3 11.4 8611.3 5935.8 11207.4 6105.7 11.6 8331.5 5791.9 11060.1 6024.8 11.8 8094.4 5682.6 10972.5 5976.9 12.0 7841.1 5558.8 10793.8 5878.6 12.2 7631.1 5453.0 10669.0 5810.9 12.4 7447.7 5345.9 10550.1 5746.4 12.6 7300.3 5249.1 10397.4 5663.0 12.8 7176.9 5155.0 10272.0 5594.7 13.0 7066.5 5061.5 10136.5 5520.5 13.2 6964.1 4969.2 10003.1 5447.9 13.4 6860.9 4873.9 9867.7 5374.1 13.6 6756.5 4776.9 9730.9 5299.6 13.8 6652.7 4679.5 9599.0 5227.9

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 218 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-33 (Cont.)

DEPS Break Blowdown M&E Releases (Minimum ECCS)

Break Path No. 1* Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 14.0 6551.1 4582.4 9463.3 5154.1 14.2 6454.6 4487.7 9332.5 5083.2 14.4 6364.5 4396.4 9204.0 5013.5 14.6 6286.8 4312.4 9088.1 4950.7 14.8 6229.3 4241.5 8991.4 4898.8 15.0 6169.6 4171.4 8866.3 4830.2 15.2 6106.1 4106.5 8779.1 4783.6 15.4 6042.3 4043.3 8675.6 4727.6 15.6 5976.8 3981.7 8590.2 4682.1 15.8 5911.6 3925.6 8496.0 4631.6 16.0 5840.4 3870.9 8414.4 4588.8 16.2 5773.5 3823.7 8339.7 4550.2 16.4 5698.8 3775.3 8193.0 4472.2 16.6 5626.7 3739.9 8057.1 4403.0 16.8 5544.7 3720.5 7908.6 4327.8 17.0 5421.2 3692.9 7741.4 4242.5 17.2 5275.7 3658.2 7585.2 4161.0 17.4 5130.3 3623.8 7425.0 4062.6 17.6 4987.5 3591.5 7279.3 3956.0 17.8 4848.1 3560.2 7149.2 3845.8 18.0 4712.0 3529.8 7046.1 3743.0 18.2 4578.9 3500.4 6951.5 3642.4 18.4 4447.4 3473.6 6860.8 3545.2 18.6 4317.2 3448.0 6736.5 3434.4 18.8 4184.1 3423.5 6572.9 3308.7 19.0 4049.4 3401.2 6399.0 3183.7 19.2 3911.0 3380.1 6214.5 3060.8 19.4 3769.8 3361.2 6034.1 2949.3 19.6 3623.5 3344.6 5864.7 2853.8 19.8 3472.5 3330.4 5695.8 2768.6 20.0 3285.7 3291.4 5492.9 2673.1

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 219 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-33 (Cont.)

DEPS Break Blowdown M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 20.2 3023.0 3191.9 5043.3 2439.6 20.4 2764.3 3072.7 4849.5 2304.6 20.6 2543.6 2957.3 4656.1 2205.9 20.8 2393.5 2873.4 4365.2 2058.6 21.0 2180.7 2661.6 4194.5 1968.7 21.2 2028.5 2492.3 3842.0 1786.4 21.4 1885.9 2325.5 3636.1 1644.4 21.6 1764.8 2182.2 3508.4 1551.5 21.8 1659.9 2056.6 3113.1 1339.6 22.0 1549.0 1922.8 2768.0 1141.4 22.2 1453.0 1806.5 2485.3 983.1 22.4 1366.4 1701.7 2269.9 866.9 22.6 1282.0 1598.2 2098.7 777.9 22.8 1194.9 1492.1 2020.9 728.2 23.0 1119.7 1399.9 2062.5 723.2 23.2 1045.0 1307.9 2203.1 754.1 23.4 958.1 1200.9 2404.8 807.2 23.6 868.4 1089.6 2598.9 859.2 23.8 786.1 987.3 2745.0 896.0 24.0 701.2 881.4 2904.0 935.2 24.2 614.4 772.9 3064.9 971.6 24.4 528.0 664.7 3199.8 997.3 24.6 446.8 562.9 3189.0 977.5 24.8 370.2 466.8 2986.6 903.0 25.0 301.9 380.8 2789.6 834.7 25.2 239.4 302.3 2590.3 768.5 25.4 183.9 232.4 2383.7 702.3 25.6 142.6 180.4 2177.3 637.8 25.8 127.2 161.1 1969.4 574.5 26.0 105.9 134.2 1761.3 512.4 26.2 58.4 74.2 1556.4 452.4 26.4 0.0 0.0 1339.4 389.5 26.6 0.0 0.0 1082.8 315.5 26.8 0.0 0.0 724.1 211.6 27.0 0.0 0.0 25.5 7.5 27.2 0.0 0.0 0.0 0.0

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 220 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-34 DEPS Break Reflood M&E Releases (Minimum ECCS)

Break Path No. 1 Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 27.2 0.0 0.0 0.0 0.0 27.8 0.0 0.0 0.0 0.0 27.9 0.0 0.0 0.0 0.0 28.1 0.0 0.0 157.7 12.3 28.2 0.0 0.0 157.7 12.3 28.3 46.8 55.1 157.7 12.3 28.4 31.0 36.5 157.7 12.3 28.6 12.5 14.8 157.7 12.3 28.7 13.3 15.7 157.7 12.3 28.8 15.5 18.2 157.7 12.3 28.9 25.2 29.7 157.7 12.3 29.0 29.2 34.4 157.7 12.3 29.1 35.0 41.2 157.7 12.3 29.2 39.6 46.7 157.7 12.3 29.3 43.8 51.6 157.7 12.3 29.4 47.8 56.4 157.7 12.3 29.5 51.3 60.5 157.7 12.3 29.6 54.5 64.2 157.7 12.3 29.7 58.1 68.5 157.7 12.3 29.8 60.3 71.0 157.7 12.3 29.9 63.8 75.2 157.7 12.3 30.0 66.4 78.3 157.7 12.3 30.1 69.0 81.3 157.7 12.3 30.2 71.5 84.3 157.7 12.3 30.3 73.9 87.1 157.7 12.3 31.3 95.3 112.3 157.7 12.3 32.3 113.0 133.1 157.7 12.3 33.3 128.2 151.1 157.7 12.3 34.3 141.8 167.2 157.7 12.3 34.8 147.5 173.9 157.7 12.3 35.3 154.0 181.6 157.7 12.3 36.6 255.5 301.7 2311.3 359.4 37.3 364.4 431.1 3697.8 614.5 38.3 367.7 435.0 3727.8 628.4 Chapter 14, Page 221 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-34 (Cont.)

DEPS Break Reflood M&E Releases (Minimum ECCS)

Break Path No. 1 Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 39.3 362.5 428.8 3670.1 622.1 40.0 358.5 424.1 3626.2 616.7 40.3 356.8 422.1 3607.3 614.3 41.3 351.3 415.5 3545.2 606.6 42.3 345.9 409.0 3484.4 598.9 43.3 340.6 402.8 3425.0 591.4 44.3 335.6 396.8 3367.3 584.1 45.3 330.7 391.0 3311.1 576.9 46.1 327.0 386.6 3267.2 571.3 46.3 326.0 385.5 3256.4 569.9 47.3 321.5 380.1 3203.3 563.1 48.3 317.1 374.9 3151.7 566.5 49.3 312.9 369.8 3101.4 550.0 50.3 308.8 365.0 3052.5 543.7 51.3 304.9 360.3 3004.9 537.6 52.3 301.0 355.8 2958.5 531.6 53.3 297.3 351.4 2913.3 525.7 54.3 293.8 347.1 2869.2 520.0 55.3 290.3 343.0 2826.1 514.4 56.3 286.9 338.9 2784.1 509.0 57.3 283.6 335.1 2743.1 503.6 58.3 280.4 331.3 2703.0 498.4 59.3 242.9 286.7 2184.4 434.4 60.3 240.6 284.0 2153.4 430.1 61.3 238.3 281.3 2123.1 425.9 62.3 236.1 278.8 2093.5 421.9 63.3 234.0 276.3 2064.5 417.8 64.3 232.0 273.8 2036.1 413.9 65.3 229.9 271.4 2008.3 410.0 66.3 228.0 269.1 1981.1 406.2 67.3 458.8 543.7 349.1 256.1 68.3 468.5 555.3 353.1 262.1 69.3 460.9 546.2 349.5 257.2 70.3 452.9 536.7 345.8 252.2 71.3 445.0 527.3 342.0 247.2 72.3 437.1 517.8 338.3 242.1 Chapter 14, Page 222 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-34 (Cont.)

DEPS Break Reflood M&E Releases (Minimum ECCS)

Time (sec) Break Path No. 1* Break Path No. 2 (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 73.3 429.2 508.3 334.6 237.2 74.3 421.9 499.6 331.2 232.6 74.7 419.0 496.2 329.9 230.8 75.3 414.7 491.1 327.9 228.2 76.3 407.6 482.6 324.6 223.8 77.3 400.7 474.3 321.4 219.5 78.3 393.8 466.2 318.3 215.3 79.3 387.1 458.1 315.2 211.2 80.3 380.5 450.2 312.2 207.2 81.3 373.9 442.5 309.2 203.2 82.3 367.5 434.8 306.3 199.4 83.3 361.3 427.4 303.5 195.6 84.3 355.1 420.1 300.7 192.0 85.3 349.1 412.9 298.0 188.4 86.3 343.3 406.0 295.4 185.0 87.3 337.6 399.2 292.9 181.6 88.3 332.0 392.5 290.4 178.4 89.4 326.0 385.4 287.7 174.9 90.3 321.3 379.8 285.7 172.2 92.3 311.2 367.8 281.2 166.3 94.3 301.7 356.5 277.1 160.9 96.3 292.7 345.9 273.2 155.8 98.3 284.4 336.0 269.6 151.2 100.3 276.6 326.7 266.2 146.8 102.3 269.3 318.1 263.1 142.8 104.3 262.6 610.1 260.3 139.1 106.3 256.3 302.6 257.6 135.6 107.8 251.9 297.4 255.8 133.2 108.3 250.5 295.8 255.2 132.5 110.3 245.1 289.4 252.9 129.6 112.3 240.2 283.6 250.9 126.9 114.3 235.7 278.2 249.0 124.5 116.3 231.5 273.3 247.3 122.3 118.3 227.7 268.8 245.7 120.3 120.3 224.3 264.7 244.3 118.5 122.3 221.1 261.0 243.0 115.3 126.3 215.7 254.5 240.8 114.0 Chapter 14, Page 223 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-34 (Cont.)

DEPS Break Reflood M&E Releases (Minimum ECCS)

Break Path No. 1 Break Path No. 2 Time (1000 BTU/sec) (1000 BTU/sec)

(sec) (lbm/sec) (lbm/sec) 122.3 221.1 261.0 243.0 116.8 124.3 218.3 257.6 241.8 115.3 126.3 215.7 254.5 240.8 114.0 128.3 213.3 251.7 239.8 112.7 130.2 211.3 249.4 239.0 111.7 130.3 211.2 249.2 239.0 111.6 132.3 209.3 247.0 238.2 110.7 134.3 207.6 245.0 237.5 109.8 136.3 206.1 243.2 236.9 109.0 138.3 204.8 241.6 236.4 108.3 140.3 203.6 240.2 235.9 107.7 142.3 202.6 239.0 235.5 107.2 144.3 201.7 237.9 235.1 106.7 146.3 200.9 237.0 234.8 106.3 148.3 200.2 236.2 234.5 105.9 150.3 199.6 235.5 234.3 105.6 152.3 199.1 235.0 234.1 105.4 154.3 198.7 234.5 233.9 105.1 155.3 198.5 234.2 233.8 105.0 156.3 198.4 234.1 233.7 105.0 158.3 198.1 233.7 233.6 104.8 160.3 197.9 233.5 233.5 104.7 162.3 197.8 233.3 233.5 104.6 164.3 197.7 233.2 233.4 104.5 166.3 197.6 233.2 233.4 104.5 168.3 197.6 233.2 233.4 104.5 170.3 197.7 233.2 233.4 104.5 172.3 197.8 233.3 233.4 104.6 174.3 197.9 233.4 233.4 104.6 176.3 198.0 233.6 233.5 104.6 178.3 198.2 233.8 233.5 104.7 180.3 198.4 234.1 233.6 104.8 182.1 198.6 234.3 233.7 104.9 Chapter 14, Page 224 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-35 Containment Heat Sinks Heat Transfer Area Thickness No. Material ft2 ft 1 Paint 41302. 0.000625 Steel 0.03125 Concrete 1.0 2 Paint 28613. 0.000625 Steel 0.04167 Concrete 1.0 3 Paint 15000. 0.000625 Concrete 1.0 4 Stainless Steel 10000. 0.03125 Concrete 1.0 5 Paint 61000. 0.000625 Concrete 1.0 6 Paint 68792. 0.000625 Steel 0.0417 7 Paint 81704. 0.000625 Steel 0.03125 8 Paint 27948. 0.000625 Steel 0.02083 9 Paint 69800. 0.000625 Steel 0.015625 10 Paint 3000. 0.000625 Steel 0.01042 11 Paint 22000. 0.000625 Steel 0.01152 12 Paint 10000. 0.000625 Steel 0.0052 Chapter 14, Page 225 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-36 Thermophysical Properties Of Containment Heat Sinks Thermal Conductivity Volumetric Heat Capacity Material (BTU/hr - ft - °F) (BTU/ft3 - °F)

Paint 0.2083 36.86 Steel 26.0 56.35 Stainless Steel 8.6 56.35 Concrete 0.8 28.8 Chapter 14, Page 226 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-37 DEPS Break Principal Parameters During Reflood (Minimum ECCS)

Time Flooding Carryover Core Downcomer Flow Injection Fraction Height Height Fraction (ft) (ft)

(sec)

Temp Rate Total Accumulator Spill Enthalpy

(°F) (in/sec) (BTU/lbm)

(lbm/sec) 27.2 185.8 .000 .000 .00 .00 .250 .0 .0 .0 .00 28.1 184.0 21.923 .000 .77 1.04 .000 6394.7 5763.9 .0 97.24 28.2 183.6 22.509 .000 .95 1.05 .000 6374.0 5743.2 .0 97.24 28.2 183.4 22.418 .126 1.05 1.06 .225 6353.4 5722.6 .0 97.23 28.6 183.1 2.305 .095 1.31 1.49 .203 6278.0 5647.2 .0 97.20 28.8 183.1 2.493 .117 1.34 1.90 .217 6248.5 5617.7 .0 97.19 28.9 183.2 2.442 .147 1.36 2.15 .270 6209.7 5578.9 .0 97.18 29.1 183.3 2475 .186 1.40 2.56 .295 6171.6 5540.8 .0 97.17 29.8 183.5 2.375 .298 1.50 3.96 .329 6043.0 5412.1 .0 97.12 30.3 183.8 2.321 .364 1.57 5.01 .339 5946.7 5315.9 .0 97.09 34.8 185.8 2.601 .613 2.00 13.40 .359 5290.4 4659.6 .0 96.80 37.3 187.2 3.915 .675 2.24 16.11 .536 4542.5 3949.9 .0 96.56 39.3 188.3 3.760 .698 2.44 16.12 .535 4327.0 3734.5 .0 96.43 40.0 188.7 3.703 .703 2.50 16.12 .533 4268.6 3675.2 .0 96.38 46.1 192.7 3.364 .727 3.01 16.12 .518 3829.7 3228.9 .0 96.00 53.0 197.5 3.127 .735 3.51 16.12 .503 3434.8 2827.8 .0 95.58 60.6 203.0 2.748 .738 4.00 16.12 .459 2559.2 1940.3 .0 94.19 66.3 207.2 2.655 .740 4.34 16.12 .450 2374.9 1754.0 .0 93.77 67.3 208.0 4.011 .748 4.41 16.02 .599 566.8 .0 .0 78.00 68.3 209.0 4.043 .748 4.49 15.84 .600 562.2 .0 .0 78.00 Chapter 14, Page 227 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-37 (Cont.)

DEPS Break Principal Parameters During Reflood (Minimum ECCS)

Injection Time Flooding Carryover Core Downcomer Flow Fraction Height Height Fraction (ft) (ft)

(sec)

Total Accumulator Spill Enthalpy Temp Rate (BTU/lbm)

(°F) (in/sec)

(lbm/sec) 69.3 210.0 3.980 .748 4.58 15.66 .600 564.3 .0 .0 78.00 74.7 215.5 3.642 .749 5.01 14.79 .595 575.5 .0 .0 78.00 82.3 223.3 3.234 .750 5.55 13.87 .587 588.1 .0 .0 78.00 89.4 230.5 2.910 .750 6.01 13.28 .579 597.2 .0 .0 78.00 98.3 238.4 2.589 .750 6.51 12.85 .568 605.5 .0 .0 78.00 107.8 246.3 2.341 .750 7.00 12.66 .556 611.3 .0 .0 78.00 120.3 252.8 2.130 .751 7.58 12.72 .544 615.8 .0 .0 78.00 130.2 257.7 2.028 .753 8.00 12.91 .537 617.7 .0 .0 78.00 144.3 263.8 1.947 .757 8.58 13.32 .531 619.1 .0 .0 78.00 155.3 267.9 1.915 .760 9.00 13.70 .529 619.6 .0 .0 78.00 170.3 272.8 1.895 .765 9.57 14.26 .529 619.7 .0 .0 78.00 182.1 276.2 1.891 .770 10.00 14.72 .530 619.6 .0 .0 78.00 Chapter 14, Page 228 of 333 Revision 04, 2011

IP3 FSAR UPDATE Tables 14.3-38, 14.3-39, 14.3-40, 14.3-41, 14.3-42, 14.3-43, 14.3-44, 14.3-45 Deleted Table 14.3-46 DEPS Break Post-Reflood M&E Releases (Minimum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 182.2 263.5 324.2 367.2 149.7 187.2 262.8 323.3 368.0 149.5 192.2 262.4 322.9 368.3 149.2 197.2 261.9 322.3 368.8 149.0 202.2 260.9 321.0 369.9 148.9 207.2 260.3 320.3 370.4 148.6 212.2 260.1 320.0 370.7 148.3 217.2 264.3 325.1 366.5 150.5 222.2 263.8 324.6 366.9 150.2 227.2 263.1 323.7 367.7 150.0 232.2 262.5 322.9 368.3 149.7 237.2 262.0 322.3 368.8 149.4 242.2 264.4 321.6 369.3 149.2 247.2 260.8 320.8 370.0 148.9 252.2 259.9 319.8 370.8 148.7 257.2 259.5 319.2 371.3 148.4 262.2 258.5 318.1 372.2 148.3 267.2 257.9 317.3 372.9 148.0 272.2 257.4 316.6 373.4 147.7 282.2 255.9 314.8 374.8 147.3 287.2 255.1 313.9 375.6 147.0 292.2 254.5 313.1 376.3 146.8 297.2 253.9 312.3 376.9 146.5 302.2 93.7 115.3 537.0 188.4 434.5 93.7 115.3 537.0 188.4 434.6 93.5 114.5 537.2 183.2 437.2 93.4 114.4 537.3 183.0 1114.8 93.4 114.4 537.3 183.0 1114.9 76.5 88.0 554.3 48.2 1623.8 69.7 80.2 561.1 49.4 1623.9 69.7 80.2 208.3 48.4 3600.0 56.7 65.3 221.2 50.8 3601.0 49.3 56.7 228.7 39.7 3916.2 47.5 54.7 230.5 40.0 3916.3 47.8 55.0 100.2 17.9 Chapter 14, Page 230 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-46 (Cont.)

DEPS Break Post-Reflood M&E Releases (Minimum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 10,000.0 36.0 41.5 112.0 20.0 100,000.0 19.3 22.2 128.7 23.0 1,000,000.0 8.3 9.5 139.8 25.0 10,000,000.0 2.6 3.0 145.4 26.0 Chapter 14, Page 231 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-47 DEPS Break Mass Balance (Minimum ECCS)

.00 27.20 27.20 182.14 434.58 1114.8 3600.00 Time (sec)

Mass (thousand lbm)

Initial In RCS and 732.01 732.01 732.01 732.01 732.01 732.01 732.01 Accumulators Pumped Injection .00 .00 .00 94.02 253.21 682.29 1552.63 Added Mass Total Added .00 .00 .00 94.02 253.21 682.29 1552.63 732.01 732.01 732.01 826.03 985.21 1414.29 2284.64

• • • Total Available***

Reactor Coolant 527.21 40.55 67.50 134.67 134.67 134.67 134.67 Distribution Accumulator 204.80 159.14 132.19 .00 .00 .00 .00 Total Contents 732.01 199.70 199.70 134.67 134.67 134.67 134.67 Break Flow .00 532.30 532.30 691.35 850.53 1279.61 2149.98 Effluent ECCS Spill .00 .00 .00 .00 .00 .00 .00 Total Effluent .00 532.30 532.30 691.35 850.53 1279.61 2149.98 732.01 731.99 731.99 826.01 985.20 1414.28 2284.64

• • • Total Accountable***

Chapter 14, Page 232 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-48 DEPS Break Energy Balance (Minimum ECCS)

.00 27.20 27.20 182.14 434.58 1114.84 3600.00 Time (sec)

Energy (Million BTU)

Initial Energy In RCS, accumulators, and 775.34 775.34 775.34 775.34 775.34 775.34 775.34 steam generators Added Mass Pumped Injection .00 .00 .00 7.33 19.75 53.22 173.60 Decay Heat .00 7.65 7.65 25.09 47.82 98.19 235.35 Heat from Secondary .00 10.72 10.72 10.72 10.72 10.72 10.72 Total Added .00 18.37 18.37 43.15 78.29 162.14 419.68

• • • Total Available*** 775.34 793.71 793.71 818.49 853.63 937.48 1195.02 Distribution Reactor Coolant 305.75 9.37 12.05 36.23 36.23 36.23 36.23 Accumulator 20.35 15.81 13.13 .00 .00 .00 .00 Core Stored 26.87 14.68 14.68 3.95 3.78 3.55 2.71 Primary Metal 166.23 158.03 158.03 127.92 94.29 70.05 53.31 Secondary Metal 40.98 40.83 40.83 36.70 30.14 20.07 15.24 Steam Generator 215.15 232.85 232.85 205.85 165.18 106.47 80.08 Total Contents 775.34 471.57 471.57 410.65 329.61 236.37 187.56 Effluent Break Flow .00 321.67 321.67 400.48 516.66 698.75 1008.11 ECCS Spill .00 .00 .00 .00 .00 .00 .00 Total Effluent .00 321.67 321.67 400.48 516.66 698.75 1008.11

• • • Total Accountable*** 775.34 793.23 793.23 811.13 846.27 935.11 1195.67 Chapter 14, Page 233 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-49 DEPS Break Blowdown M&E Releases (Maximum ECCS)

Time Break Path No. 2 Break Path No. 1*

(Sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 0.0 0.0 0.0. 0.0. 0.0.

0.0 81761.8 44233.2 40576.0 21912.8 0.1 40368.4 21885.1 19793.9 10677.7 0.2 45306.7 24772.6 22451.3 12124.9 0.3 45415.9 25096.5 23512.5 12704.7 0.4 45055.9 25215.1 23517.2 12711.4 0.5 44009.1 24945.6 22969.5 12420.5 0.6 44256.3 25378.4 22403.5 12120.2 0.7 43600.3 25252.0 22049.2 11934.2 0.8 42230.5 24671.9 21887.5 11851.0 0.9 40998.0 24158.5 21772.1 11792.1 1.0 39954.5 23761.7 21676.2 11742.9 1.1 38791.7 23329.2 21567.5 11686.1 1.2 37322.5 22738.0 21464.4 11631.9 1.3 35681.4 22020.7 21381.4 11588.1 1.4 34261.3 21372.7 21325.8 11558.9 1.5 33185.6 20878.9 21311.8 11552.2 1.6 32347.7 20502.1 21335.1 11565.8 1.7 31543.5 20137.7 21256.7 11523.4 1.8 30691.4 19737.1 21078.4 11426.5 1.9 29771.4 19286.1 20897.8 11328.4 2.0 28806.8 18796.0 20735.0 11240.3 2.1 27794.9 18268.3 20582.8 11158.0 2.2 26813.6 17759.7 20406.0 11062.5 2.3 25407.1 16959.1 20198.9 10950.3 2.4 23314.1 15671.6 19979.5 10831.5 2.5 21428.3 14504.8 19781.6 10724.5 2.6 21061.3 14354.1 19588.9 10620.6 2.7 20375.5 13940.6 19405.6 10521.9 2.8 19647.9 13490.3 19200.4 10411.3 2.9 19327.9 13315.2 19003.6 10305.3 3.0 18990.9 13110.6 18809.5 10201.0 3.1 18936.7 13103.3 18599.8 10088.1 3.2 18708.8 12965.8 18359.2 9958.3 3.3 18376.1 12765.8 18107.3 9822.4

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 234 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-49 (Cont.)

DEPS Break Blowdown M&E Releases (Maximum ECCS)

Time Break Path No. 1* Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 3.4 18036.8 12557.7 17873.1 9696.2 3.5 17593.9 12267.4 17641.1 9571.4 3.6 17069.3 11917.1 17408.8 9446.3 3.7 16489.9 11528.9 17177.4 9321.8 3.8 15903.3 11135.1 16954.4 9202.0 3.9 15363.2 10772.2 16746.0 9090.1 4.0 14881.1 10447.4 16551.1 8985.8 4.2 14051.8 9886.3 16181.4 8787.9 4.4 13368.7 9425.1 15844.1 8607.7 4.6 12849.6 9066.2 15533.4 8442.0 4.8 12412.2 8757.6 15247.7 8289.7 5.0 12013.1 8465.4 14999.3 8157.8 5.2 11703.6 8224.2 14763.6 8032.5 5.4 11586.3 8094.8 14554.2 7921.5 5.6 11514.6 7994.2 14351.2 7813.7 5.8 11482.1 7922.8 14628.1 7971.2 6.0 11522.2 7898.5 14747.6 8037.3 6.2 12194.7 8296.4 14583.2 7949.9 6.4 12141.3 8354.3 14758.0 8049.7 6.6 10307.9 7832.3 14611.9 7971.5 6.8 9121.4 7303.9 14448.4 7884.8 7.0 9073.9 7243.1 14317.3 7815.8 7.2 9131.3 7217.0 14150.0 7726.8 7.4 9251.8 7207.9 13997.8 7646.3 7.6 9481.4 7234.9 13888.3 7588.7 7.8 9840.4 7325.9 13772.0 7525.2 8.0 10359.8 7518.4 13588.0 7423.3 8.2 11037.7 7812.7 13409.2 7324.2 8.4 11803.6 8167.7 13241.4 7231.2 8.6 12593.0 8547.8 13064.4 7133.0 8.8 13245.7 8851.5 12873.9 7027.5 9.0 13483.0 8908.3 12687.9 6924.7 9.2 13276.1 8712.1 12523.4 6834.0 9.4 12965.9 8476.1 12374.3 6751.5 9.6 12574.6 8194.2 12222.6 6667.2 9.8 11645.6 7582.1 12081.1 6588.6

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 235 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-49 (Cont.)

DEPS Break Blowdown M&E Releases (Maximum ECCS)

Time Break Path No. 1* Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 9.8 11645.6 7582.1 12081.1 6588.6 10.0 10593.6 6936.8 12004.7 6546.0 10.2 10208.2 6743.1 11946.2 6512.7 10.4 9933.1 6606.9 11771.6 6414.9 10.6 9558.0 6412.6 11662.9 6354.9 10.8 9363.2 6333.5 11584.3 6312.0 11.0 9110.8 6193.7 11405.8 6213.9 11.2 8843.7 6050.6 11321.2 6168.3 11.4 8611.3 5935.8 11207.4 6105.7 11.6 8331.5 5791.9 11060.1 6024.8 11.8 8094.4 5682.6 10972.5 5976.9 12.0 7841.1 5558.8 10793.8 5878.6 12.2 7631.1 5453.0 10669.0 5810.9 12.4 7447.7 5345.9 10550.1 5746.4 12.6 7300.3 5249.1 10397.4 5663.0 12.8 7176.9 5155.0 10272.0 5594.7 13.0 7066.5 5061.5 10136.2 5520.5 13.2 6964.1 4969.2 10003.1 5447.9 13.4 6860.9 4873.9 9867.7 5374.1 13.6 6756.5 4776.9 9730.9 5299.6 13.8 6652.7 4679.5 9599.0 5227.9 14.0 6551.1 4582.4 9463.3 5154.1 14.2 6454.6 4487.7 9332.5 5083.2 14.4 6364.5 4396.4 9204.0 5013.5 14.6 6286.8 4312.4 9088.1 4950.7 14.8 6229.3 4241.5 8991.4 4898.8 15.0 6169.6 4171.4 8866.3 4830.2 15.2 6106.1 4106.5 8779.1 4783.6 15.4 6042.3 4043.3 8675.6 4727.6 15.6 5976.8 3981.7 8590.2 4682.1 15.8 5911.6 3925.6 8496.0 4631.6 16.0 5840.4 3870.9 8414.4 4588.8 16.2 4773.5 3823.7 8339.7 4550.2 16.4 5698.8 3775.3 8193.0 4472.2 16.6 5626.7 3739.9 8057.1 4403.0

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 236 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-49 (Cont.)

DEPS Break Blowdown M&E Releases (Maximum ECCS)

Time Break Path No. 1* Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 16.8 5544.7 3720.5 7908.6 4327.8 17.0 5421.2 3692.9 7741.4 4242.5 17.2 5275.7 3658.2 7585.2 4161.0 17.4 5130.3 3623.8 7425.0 4062.6 17.6 4987.5 3591.5 7279.3 3956.0 17.8 4848.1 3560.2 7149.2 3845.8 18.0 4712.0 3529.8 7046.1 3743.0 18.2 4578.9 3500.4 6951.5 3642.4 18.4 4447.5 3473.6 6860.8 3545.2 18.6 4317.2 3448.0 6736.5 3434.4 18.8 4184.1 3423.5 6572.9 3308.7 19.0 4049.4 3401.2 6399.0 3183.7 19.2 3911.0 3380.1 6214.5 3060.8 19.4 3769.8 3361.2 6034.1 2949.3 19.6 3623.5 3344.6 5864.7 2853.8 19.8 3472.5 3330.4 5695.8 2768.6 20.0 3285.7 3291.4 5492.9 2673.1 20.2 3023.0 3191.9 5043.3 2439.6 20.4 2764.3 3072.7 4849.5 2304.6 20.6 2543.6 2957.3 4656.1 2205.9 20.8 2393.5 2873.4 4365.2 2058.6 21.0 2180.7 2661.6 4194.5 1968.7 21.2 2028.5 2492.3 3842.0 1786.4 21.4 1885.9 2325.5 3636.1 1644.4 21.6 1764.8 2182.2 3508.4 1551.5 21.8 1659.9 2056.6 3113.1 1339.6 22.0 1549.0 1922.8 2768.0 1141.4 22.2 1453.0 1806.5 2485.3 983.1 22.4 1366.4 1701.7 2269.9 866.9 22.6 1282.0 1598.2 2098.7 777.9 22.8 1194.9 1492.1 2020.9 728.2 23.0 1119.7 1399.9 2062.5 723.2 23.2 1045.0 1307.9 2203.1 754.1 23.4 958.1 1200.9 2404.8 807.2 23.6 868.4 1089.6 2598.9 859.2

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 237 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-49 (Cont.)

DEPS Break Blowdown M&E Releases (Maximum ECCS)

Time Break Path No. 1* Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 23.8 786.1 987.3 2745.0 896.0 24.0 701.2 881.4 2904.0 935.2 24.2 614.4 772.9 3064.9 971.6 24.4 528.0 664.7 3199.8 997.3 24.6 446.8 562.9 3189.0 977.5 24.8 370.2 466.8 2986.6 903.0 25.0 301.9 380.8 2789.6 834.7 25.2 239.4 302.3 2590.3 768.5 25.4 183.9 232.4 2383.7 702.3 25.6 142.6 180.4 2177.3 637.8 25.8 127.2 161.1 1969.4 574.5 26.0 105.9 134.2 1761.3 512.4 26.2 58.4 74.2 1556.4 452.4 26.4 0.0 0.0 1339.4 389.5 26.6 0.0 0.0 1082.8 315.5 26.8 0.0 0.0 724.1 211.6 27.0 0.0 0.0 25.5 7.5 27.2 0.0 0.0 0.0 0.0

• mass and energy exiting the steam generator side of the break mass and energy exiting the pump side of the break Chapter 14, Page 238 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-50 DEPS Break Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 27.2 0.0 0.0 0.0 0.0 27.8 0.0 0.0 0.0 0.0.

27.9 0.0 0.0 0.0 0.0 28.1 0.0 0.0 241.1 18.8 28.2 0.0 0.0 241.1 18.8 28.3 74.4 87.6 241.1 18.8 28.4 22.8 26.8 241.1 18.8 28.5 15.2 17.9 241.1 18.8 28.6 17.3 20.3 241.1 18.8 28.7 22.7 26.7 241.1 18.8 28.8 27.1 31.9 241.1 18.8 28.9 31.9 37.5 241.1 18.8 29.0 37.6 44.3 241.1 18.8 29.1 42.3 49.8 241.1 18.8 29.2 46.5 54.8 241.1 18.8 29.3 50.7 59.7 241.1 18.8 29.5 54.1 63.8 241.1 18.8 29.6 57.9 68.2 241.1 18.8 29.7 61.0 71.9 241.1 18.8 29.8 63.9 75.3 241.1 18.8 29.9 66.7 78.5 241.1 18.8 30.0 69.4 81.7 241.1 18.8 30.1 72.0 84.8 241.1 18.8 30.2 74.5 87.8 241.1 18.8 30.3 77.0 90.8 241.1 18.8 31.3 99.4 117.1 241.1 18.8 32.3 117.4 138.4 241.1 18.8 33.3 133.1 156.9 241.1 18.8 34.3 147.3 173.7 241.1 18.8 34.6 151.0 178.0 241.1 18.8 35.3 159.9 188.6 241.1 18.8 36.6 357.7 423.0 3654.2 570.9 37.9 393.9 466.2 4034.5 656.1 38.3 390.1 461.7 3992.6 653.5 39.3 384.2 454.7 3930.0 646.0 39.6 382.5 452.6 3911.0 643.6 Chapter 14, Page 239 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-50 (Cont.)

DEPS Break Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 39.6 382.5 452.6 3911.0 643.6 40.3 378.4 447.8 3866.8 638.1 41.3 372.7 441.0 3804.6 630.3 42.3 367.2 434.4 3743.9 622.6 43.3 361.9 428.1 3684.7 615.1 44.3 356.7 422.0 3627.1 607.7 45.3 351.8 416.0 3571.2 600.6 45.4 351.3 415.5 3565.7 599.9 46.3 347.0 410.3 3516.8 593.6 47.3 342.3 404.8 3463.9 586.8 48.3 337.9 399.5 3412.5 580.2 49.3 333.6 394.4 3362.5 573.8 50.3 329.4 389.4 3313.9 567.5 51.3 325.4 384.6 3266.6 561.4 52.0 322.6 381.4 3234.2 557.3 52.3 321.4 380.0 3220.5 555.5 53.3 317.7 375.5 3175.6 538.5 54.3 314.0 371.1 3131.8 544.0 55.3 310.4 366.9 3089.0 538.5 56.3 307.0 362.8 3047.4 533.0 57.3 303.6 358.8 3006.6 527.7 58.3 300.3 354.9 2966.9 522.6 59.3 285.7 337.7 2725.6 502.8 59.3 266.9 315.4 2402.0 470.9 60.3 259.8 306.8 2436.2 457.3 61.3 257.4 304.0 2406.0 453.2 62.3 255.2 301.3 2376.5 499.2 63.3 252.9 298.7 2347.6 445.2 64.3 250.8 296.1 2319.4 441.3 65.3 248.7 293.6 2291.7 437.5 66.3 246.6 291.1 2264.6 433.7 67.3 244.6 288.7 2238.1 430.1 68.3 363.1 429.6 374.8 189.2 69.3 363.0 429.4 375.5 189.1 70.3 362.8 429.1 376.5 188.9 71.3 362.5 428.9 377.5 188.7 72.3 362.3 428.5 378.6 188.5 Chapter 14, Page 240 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-50 (Cont.)

DEPS Break Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 73.3 362.0 428.2 379.6 188.4 74.3 361.7 427.9 380.7 188.2 74.5 361.6 427.8 380.9 188.1 75.3 361.4 427.5 381.8 188.0 76.3 361.0 427.1 382.9 187.8 77.9 360.7 426.7 384.0 187.6 78.3 360.3 426.2 385.2 187.4 79.3 359.9 425.7 386.4 187.1 80.3 359.5 425.2 387.7 186.9 81.3 359.0 424.7 389.0 186.7 82.3 358.5 424.1 390.3 186.5 83.3 358.0 423.5 391.7 186.2 84.3 357.4 422.8 393.2 186.0 85.3 356.8 422.1 394.7 185.8 86.3 356.2 421.4 396.2 185.5 87.3 355.6 420.6 397.8 185.2 88.3 354.9 419.8 399.5 185.0 88.9 354.4 419.2 400.5 184.8 90.3 353.4 418.0 403.0 184.5 92.3 351.7 416.0 406.7 183.9 94.3 349.9 413.9 410.6 183.3 96.3 348.0 411.5 414.7 182.8 98.3 345.9 409.0 419.0 182.2 100.3 343.6 406.3 423.5 181.6 102.3 341.2 403.4 428.2 181.0 104.3 338.6 400.4 433.1 180.5 104.4 338.5 400.2 433.3 180.5 106.3 335.9 397.2 438.1 179.9 108.3 333.1 393.8 443.3 179.4 110.3 330.1 390.3 448.7 178.9 112.3 327.0 386.6 454.3 178.4 114.3 323.8 382.8 460.0 177.9 116.3 320.4 378.8 465.9 177.5 118.3 316.9 374.6 472.0 177.1 120.3 313.3 370.3 478.3 176.7 121.3 311.4 368.1 481.5 176.6 122.3 309.5 365.8 484.7 176.4 Chapter 14, Page 241 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-50 (Cont.)

DEPS Break Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 124.3 305.6 361.1 491.3 176.1 126.3 301.5 356.3 498.2 175.9 128.3 297.3 351.3 505.2 175.7 130.3 292.9 346.1 512.4 175.6 132.3 288.3 340.7 519.8 175.5 134.3 283.6 335.0 527.5 175.5 136.3 278.7 329.2 535.4 175.5 138.3 273.6 323.1 543.5 175.6 140.3 268.3 316.9 551.9 175.8 142.3 262.8 310.3 560.6 176.0 144.3 257.0 303.5 569.6 176.4 146.3 251.0 296.4 578.8 176.8 150.3 238.3 281.3 598.3 177.9 152.3 231.4 273.2 608.7 178.6 154.3 224.2 264.7 619.5 179.4 156.3 216.7 255.7 630.7 180.4 158.3 208.7 246.3 642.5 181.5 160.3 200.4 236.4 654.7 182.8 162.3 191.5 225.9 667.6 184.2 163.7 185.0 218.2 677.0 185.3 Chapter 14, Page 242 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-51 DEPS Break Principal Parameters During Reflood (Maximum ECCS)

Time Flooding Carryover Core Downcomer Flow Injection (sec) Fraction Height (ft) Height (ft) Fraction Temp Rate Total Accumulator Spill Enthalpy

(°F) (in/sec) (BTU/lbm)

(lbm/sec) 27.2 185.5 .000 .000 .00 .00 .250 .0 .0 .0 .00 28.1 183.5 23.012 .000 .78 1.06 .000 6770.0 5805.3 .0 96.31 28.2 18.9 24.009 .000 1.08 1.07 .000 6728.0 5763.3 .0 96.29 28.5 182.6 2.385 .100 1.31 1.54 .235 6653.8 5689.1 .0 96.25 29.0 182.8 2.522 .190 1.40 2.60 .306 6550.3 5585.6 .0 96.21 29.7 183.0 2.420 .293 1.50 3.98 .333. 6428.3 5463.6 .0 96.15 30.3 183.2 2.360 .369 1.58 5.23 .342 6321.1 5356.4 .0 96.09 34.6 185.2 2.652 .614 2.00 13.80 .360 5670.4 4705.8 .0 95.72 37.3 186.5 4.078 .680 2.27 16.12 .550 4803.5 3892.8 .0 95.30 39.3 187.6 3.880 .701 2.47 16.12 .547 4615.3 3702.1 .0 95.13 39.6 187.8 3.854. .704 2.50 16.12 .546 4590.1 3676.5 .0 95.10 45.4 191.4 3.513 .727 3.00 16.12 .533 4164.4 3242.1 .0 94.62 52.0 195.9 3.272 .736 3.50 16.12 .467 2656.4 1708.4 .0 91.73 67.3 206.8 2.742 .741 4.49 16.12 .548 918.5 .0 .0 78.00 68.3 207.6 3.443 .747 4.56 16.12 .548 918.5 .0 .0 78.00 69.3 208.4 3.437 .747 4.63 16.12 .548 918.5 .0 .0 78.00 74.5 213.2 3.406 .749 5.01 16.12 .550 919.0 .0 .0 78.00 82.3 221.0 3.351 .752 5.55 16.12 .552 919.9 .0 .0 78.00 88.9 228.0 3.292 .755 6.00 16.12 .533 922.9 .0 .0 78.00 Chapter 14, Page 243 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-51 (Cont.)

DEPS Break Principal Parameters During Reflood (Maximum ECCS)

Time Flooding Carryover Core Downcomer Flow Injection (sec) Fraction Height Height Fraction (ft) (ft)

Temp Rate Total Accumulator Spill Enthalpy

(°F) (in/sec) (BTU/lbm)

(lbm/sec) 98.3 237.6 3.188 .759 6.62 16.12 .555 922.9 .0 .0 78.00 104.4 243.1 3.110 .760 7.01 16.12 .555 924.6 .0 .0 78.00 114.3 250.7 2.967 .763 7.60 16.12 .554 927.8 .0 .0 78.00 121.3 255.4 2.856 .765 8.00 16.12 .553 930.5 .0 .0 78.00 132.3 261.7 2.665 .768 8.60 16.12 .547 935.4 .0 .0 78.00 140.5 265.6 2.507 .769 9.00 16.12 .538 939.6 .0 .0 78.00 152.3 270.4 2.250 .771 9.54 16.12 .517 946.7 .0 .0 78.00 163.7 274.2 1.950 .771 10.00 16.12 .476 954.8 .0 .0 78.00 Chapter 14, Page 244 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-52 DEPS Break Post-Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (sec) (lbm/sec) 163.8 158.0 193.6 806.7 207.2 168.8 157.6 193.1 807.1 206.8 173.8 157.7 193.2 807.0 206.4 178.8 157.7 193.2 807.0 206.0 183.8 157.2 192.7 807.5 205.7 188.8 157.2 192.6 807.5 205.7 193.8 157.2 192.6 807.5 204.8 198.8 156.7 192.0 808.0 204.5 203.8 156.8 192.2 807.8 204.1 208.8 156.6 191.9 808.1 203.7 213.8 156.8 192.1 807.9 206.8 218.8 156.5 191.8 808.2 206.5 223.8 156.2 191.4 808.5 206.1 228.8 156.3 191.6 808.4 205.6 233.8 156.0 191.2 808.7 205.3 238.8 156.1 191.3 808.6 204.8 243.8 156.2 191.4 808.5 204.3 248.8 155.8 190.9 808.9 204.0 253.8 155.8 190.9 808.9 203.5 258.8 155.8 190.9 808.9 203.1 263.8 155.8 190.9 808.9 202.6 268.8 155.7 190.8 809.0 202.2 273.8 155.6 190.7 809.1 201.8 278.8 155.5 190.6 809.2 201.3 283.8 155.4 190.4 809.3 200.9 288.8 155.2 190.2 809.5 200.5 293.8 155.0 189.9 809.7 200.1 298.8 155.2 190.1 809.5 203.0 303.8 154.9 189.8 809.8 202.6 308.8 154.9 189.8 809.8 202.1 313.8 154.6 189.4 810.1 201.7 318.8 154.5 189.4 810.2 201.2 232.8 454.4 189.2 810.2 200.8 328.8 154.3 189.1 810.4 200.3 333.8 154.4 189.2 810.3 199.8 338.8 154.1 188.9 810.5 199.3 343.8 154.1 188.9 810.6 198.8 Chapter 14, Page 245 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-52 (Cont.)

DEPS Break Post-Reflood M&E Releases (Maximum ECCS)

Time Break Path No. 1 Break Path No. 2 (sec) (lbm/sec) (1000 BTU/sec) (lbm/sec) (1000 BTU/sec) 343.8 154.1 188.9 810.6 198.8 348.8 154.0 188.7 810.7 198.4 353.8 153.8 188.5 810.9 197.9 358.8 153.9 188.5 810.8 197.4 363.8 153.8 188.4 810.9 196.9 373.8 153.4 188.0 811.3 199.2 378.8 153.5 188.0 811.2 198.7 383.8 153.3 187.8 811.4 198.2 388.8 153.1 187.6 811.6 197.7 393.8 153.2 187.7 811.5 197.1 398.8 152.9 187.4 811.8 196.7 403.8 153.0 187.5 811.7 196.1 408.8 152.8 187.2 811.9 195.6 413.8 152.9 187.3 811.8 195.1 418.8 152.8 187.2 811.9 197.7 423.8 152.6 187.0 812.0 197.2 428.8 152.5 186.9 812.2 196.6 433.8 152.4 186.7 812.3 196.1 438.8 144.5 177.1 820.2 197.6 443.8 86.1 105.5 878.6 212.4 798.1 86.1 105.5 878.6 212.4 798.2 83.7 102.0 881.0 204.6 798.8 83.7 102.0 881.0 204.6 1033.6 83.7 102.0 881.0 204.6 1033.7 78.5 90.4 896.1 73.4 1172.7 76.6 88.1 888.1 73.8 1172.8 76.6 88.1 474.6 105.6 3119.9 60.4 69.5 233.4 108.5 3120.0 60.4 69.5 233.4 59.3 3600.0 57.7 66.3 236.1 59.7 3600.1 50.5 58.1 243.3 47.9 10000.0 36.7 42.2 257.1 50.6 100000.0 19.6 22.6 274.1 53.9 1000000.0 8.4 9.7 285.4 56.1 10000000.0 2.6 3.0 291.1 57.3 Chapter 14, Page 246 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-53 DEPS Break Mass Balance (Maximum ECCS)

Time (Sec) .00 27.20 27.20 163.73 798.20 1033.63 3600.00 Mass (Thousands Ibm)

Initial In RCS and 732.01 732.01 732.01 732.01 732.01 732.01 732.01 Accumulators Added Pumped .00 .00 .00 126.74 738.74 965.85 2314.17 Mass Injection Total Added .00 .00 .00 126.74 738.74 965.85 2314.17

• • • Total Available *** 732.01 732.01 732.01 858.74 1470.74 1697.86 3046.18 Distribution Reactor 527.21 40.55 66.31 137.06 137.06 137.06 137.06 Coolant Accumulator 204.80 159.14 133.38 .00 .00 .00 .00 Total Contents 732.01 199.70 199.70 137.06 137.06 137.06 137.06 Effluent Break Flow .00 532.30 532.30 721.67 1333.67 1560.78 2909.14 ECCS Spill .00 .00 .00 .00 .00 .00 .00 Total Effluent .00 532.30 532.30 721.67 1333.67 1560.78 2909.14 732.01 731.99 731.99 858.73 1470.73 1697.84 3046.20

• • • Total Accountable ***

Chapter 14, Page 247 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-54 DEPS Break Energy Balance (Maximum ECCS)

Time (sec) .00 27.20 27.20 163.73 798.20 1033.63 3600.00 Energy (Million Btu)

Initial Energy In RCS, Accumulators 775.34 775.34 775.34 775.34 775.34 775.34 775.34 and steam generators Added Energy Pumped Injection .00 .00 .00 9.89 57.62 75.34 321.96 Decay Heat .00 7.65 7.65 23.26 76.05 92.67 235.26 Heat from .00 10.72 10.72 10.72 10.72 10.72 10.72 Secondary Total Added .00 18.37 18.37 43.87 144.40 178.73 567.95

• • • Total Available*** 775.34 793.71 793.71 819.21 919.74 954.07 1343.29 Distribution Reactor Coolant 305.75 9.37 11.93 37.02 37.02 37.02 37.02 Accumulator 20.35 15.81 13.25 .00 .00 .00 .00 Core Stored 26.87 14.68 14.68 3.95 3.75 3.69 2.71 Primary Metal 166.23 158.03 158.03 127.18 79.50 71.49 53.32 Secondary Metal 40.98 40.83 40.83 36.27 23.54 20.26 15.22 Steam Generator 215.15 232.85 232.85 203.11 125.58 107.48 80.01 Total Contents 775.34 471.57 471.57 407.52 269.40 239.93 188.27 Effluent Break Flow .00 321.67 321.67 404.33 642.97 698.44 1144.08 ECCS Spill .00 .00 .00 .00 .00 .00 .00 Total Effluent .00 321.67 321.67 404.33 642.97 698.44 1144.08

• • • Total Accountable *** 775.34 793.23 793.23 811.85 912.38 939.37 1332.35 Chapter 14, Page 248 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-55 LOCA Containment Response Analysis Parameters SW Temperature (°F) 95 RWST Water Temperature (F) 110 Initial Containment Temperature (F) 130 Initial Containment Pressure (psia) 17.2 Initial Relative Humidity 20 Net-Free Volume (ft3) 2.61 x 106 Reactor Containment Fan Coolers Total 5 Minimum ECCS 4 Maximum ECCS 5 Fan Cooler Initiation Setpoint (psig) 5.12 Delay Time(sec) 48.21 Containment Spray Pumps Total 2 Minimum ECCS 1 Maximum ECCS 1 Flowrate (gpm)

Injection Phase See Table 14.3-57 Recirculation Phase 970 Containment High setpoint (psig) 24.63 Delay Time (sec) 60 ECCS Recircluation Switchover (sec)

Minimum ECCS 1623.4 Maximum ECCS 1172.7 Containment Spray Termination (sec)

Minimum ECCS 3355 Maximum ECCS 3119.9 ECCS Flow Rates Minimum ECCS Injection Alignment (gpm) 2871.2 Recirculation Alignment (gpm) 1864.0 Maximum ECCS Injection Alignment (gpm) 5394.5 Recirculation Alignment (gpm) 6320.5 Residual Heat Removal System RHR Heat Exchangers Total 2 Minimum ECCS 1 Maximum ECCS 2 UA (million BTU/hr °F Hx) 0.62 CCW Flow Through RHR Heat Exchanger (gpm/Hx) 1096 CCW Heat Exchangers Chapter 14, Page 249 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-56 Containment Fan Cooler Performance Containment Temperature Heat Removal Rate

( F) (BTU/sec/RCFC) 110 674.2 130 1737.0 150 2921.4 170 4162.4 190 5424.6 210 6684.4 230 8836.1 250 10986.4 271 13042.3 Table 14.3-57 Containment Spray Performance Containment Pressure Containment Spray Flow Rate (psig) (gpm/pump)

Values for LOCA 0 2750.8 10 2656.8 20 2558.0 25 2507.4 35 2403.8 45 2296.5 50 2237.9 Values for MSLB 5.0 2409.7 10.0 2367.5 20.0 2280.9 30.0 2187.5 35.0 2139.3 40.0 2090.1 45.0 2040.1 50.0 1988.9 Chapter 14, Page 250 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-58 DEPS Break Sequence of Events (Minimum ECCS)

Time (sec) Event Description 0.0 Break occurs, reactor trip and LOOP power are assumed 0.66 Reactor trip on low pressurizer pressure of 1748.7 psia 1 Fan cooler initiation pressure setpoint reached 4 Low-pressurizer pressure SI setpoint 1648.7 psia reached in blowdown 8 Containment spray initiation pressure setpoint reached 16 Main Feedwater Flow Control Valve closed 16.9 Broken-loop accumulator begins injecting water 17.5 Intact-loop accumulator begins injecting water 27.2 End of Blowdown Phase 27.8 SI begins 48.74 RCFCs actuate 58.4 Broken-loop accumulator water injection ends 66.5 Intact-loop accumulator water injection ends 67.81 Containment spray pump starts 182.1 End of reflood 1118 Peak pressure and temperature occur 1623.8 RHR/HHSI alignment for recirculation 3355 Containment spray is terminated 23400 Hot leg recirculation 1.0E+07 Transient Modeling Terminated Table 14.3-59 DEPS Break Sequence of Events (Maximum ECCS)

Time (sec) Event Description 0.0 Break Occurs, Reactor Trip and LOOP power are assumed 0.66 Reactor trip on low pressurizer pressure of 1748.7 psia 1 Fan cooler initiation pressure setpoint reached 4 Low-pressurizer pressure SI setpoint 1648.7 psia reached in blowdown 8 Containment spray initiation pressure setpoint reached 16 Main Feedwater Flow Control Valve closed 16.9 Broken-loop accumulator begins injecting water 17.5 Intact-loop accumulator begins injecting water 27.2 End-of-blowdown phase 27.3 Peak pressure and temperature occur 27.8 SI begins 48.74 RCFCs actuate 59.2 Broken-loop accumulator water injection ends 67.4 Intact-loop accumulator water inject ends 67.81 Containment Spray Pump starts 163.7 End of reflood 1172.7 RHR/HHSI alignment for recirculation 3119.9 Containment spray terminated 1.0E+07 Transient modeling is terminated Chapter 14, Page 251 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-60 DEHL Break Sequence of Events Time (sec) Event Description 0.0 Break Occurs, Reactor Trip and LOOP are assumed 0.6 Reactor trip on low pressurizer pressure of 1748.7 psia 1 Fan cooler initiation pressure setpoint reached 4 Low-presurizer pressure SI setpoint = 1695 psia reached 8 Containment spray initiation pressure setpoint reached 15.2 Broken-loop accumulator begins injecting water 15.5 Intact-loop accumulator begins injecting water 24.2 Peak pressure and temperature occur 25.6 End-of-blowdown phase 25.6 Transient modeling terminated Table 14.3-61 Deleted Table 14.3-62 LOCA Containment Response Results (Loss-of-Offsite-Power Assumed)

Case Peak Pressure Peak Steam Pressure at 24 Steam (psig) Temperature hours Temperature at (F) (psig) 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (F)

DEPS 42.00 at 260.4 at 13.27 187.8 Minimum 1118 sec 1118 sec ECCS DEPS 38.94 at 256.2 at 12.40 183.6 Maximum 23.7 sec 23.7 sec ECCS DEHL 40.38 at 258.6 at N/A N/A 24.2 sec 24.2 sec Chapter 14, Page 252 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-63 Post-Accident Containment Temperature Transient Used In The Calculation Of Aluminum Corrosion Time Internal (sec) Water Temperature (F) 0- 8 230 8 - 3500 258 3500 - 20,000 228 20,000 - 100,000 220 100,000 - 200,000 195 200,000 - 400,000 185 400,000 - 600,000 175 600,000 - 800,000 165 800,000 - 1,200,000 153 1,200,000 - 3,000,000 140 3,000,000 - 5,000,000 120 5,000,000 - 8,000,000 115 8,000,000 - 8,640,000 110 Chapter 14, Page 253 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-64 Parameters Used To Determine Hydrogen Generation Core Thermal Power Rating(1) 3281 MWt Containment Free Volume 2,610,000 ft3 Containment Temperature at Accident Initiation 130°F Fuel Cladding Mass Undergoing Zirc-Water Reaction 5.0%

Total Mass of Zirc in the Core 41,002 lbs RCS Hydrogen Concentration during Normal Operation 50 cc/kg RCS Mass (normal pressurizer level) 518,182 lbs Pressurizer Volume 1834.4ft3 Pressurizer Level (normal operation) 50%

Hydrogen Recombiner Flow Rate 100 scfm (1) 3216 MWt multiplied by 1.02 to account for source uncertainties.

Inventory of Aluminum Inside the Containment Building Item Description Weight (lbs) Area (ft2)

UFSAR Aluminum Sources Source, Intermediate, and Power Range Dectors 472 338 Process Instrumentation and Control Equipment 159 31 Paint 58 7480 Valve Parts inside Containment 230 86 Reactor Vessel Foil 269 10000 Flux Mapping Drive System 1950 335 Reactor Coolant Pump Motor Parts 125 12.8 Other Sources Included in Analysis CRDM Cooling Fan Blades 800 131.6 RCP conduit boxes 7.2 4 Rod Position Indicators 10.6 3.7 Others (filters, etc.) 25 25 Total Aluminum 4105.8 18447.1 Chapter 14, Page 254 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14.3-65 Fission Product Decay Energy in the Core Time After LOCA Energy Release Rate Integrated Energy Release Days Watts / MWt Watt-sec MWt 1 5.11E+03 6.01E+08 5 3.41E+03 1.97E+09 10 2.72E+03 3.28E+09 15 2.29E+03 4.36E+09 20 2.00E+03 5.28E+09 25 1.80E+03 6.10E+09 30 1.66E+03 6.84E+09 40 1.47E+03 8.19E+09 50 1.33E+03 9.39E+09 60 1.21E+03 1.05E+10 70 1.12E+03 1.15E+10 80 1.02E+03 1.24E+10 90 9.43 E+02 1.33E+10 100 8.68E+02 1.40E+10

• • Considers 50 percent of core halogens, no noble gases and 99 percent of other fission products in the core n.nnE+yy denotes n.nn x 10 yy Table 14.3-66 FISSION PRODUCT DECAY DEPOSITION IN SUMP SOLUTION Time After LOCA Sump Fission Product Energy*

Days Energy Release Rate Integrated Energy Release Watts / MWt Watt-sec / MWt 1 2.56E+02 4.62E+07 5 8.17E+01 8.83E+07 10 5.35E+01 1.17E+08 15 3.80E+01 1.36E+08 20 2.91E+01 1.51E+08 25 2.39E+01 1.62E+08 30 2.06E+01 1.72E+08 40 1.69E+01 1.88E+08 50 1.47E+01 2.01E+08 60 1.30E+01 2.13E+08 70 1.16E+01 2.24E+08 80 1.04E+01 2.33E+08 90 9.34E+00 2.42E+08 100 8.37E+00 2.49E+08 Considers release of 50 percent of core halogens, no noble gases and 1 percent of other fission products to the sump solution.

N.nnE+yy denotes n.nn x 10 y Chapter 14, Page 255 of 333 Revision 04, 2011

IP3 FSAR UPDATE APPENDIX 14A TURBINE MISSILE PROBABILITIES ANALYSIS

1.0 INTRODUCTION

The analysis of the consequences of a turbine operating (1800 rpm) and overspeed has demonstrated reasonable assurances that missiles would not be generated external to the low pressure turbine casing. The basic assumptions used in the analysis has let to this conclusion were deemed reasonable and conservative and backed by research and development projects especially on the low pressure turbine rotors material properties.

Indian Point 3 has installed three low pressure turbines in accordance with Modification 90-03-182 MTG. The replacement turbines are significantly improved in design as compared with previous low pressure turbines. This new design reduces the probability of a low pressure turbine rotor failure which generates an external turbine missile. The new designed rotors are of a welded discs type (Figure 3.1 eliminating shrunk on keyed discs and of a material that has high resistance to stress corrosion cracking (SCC). These two major design changes have demonstrated excellent results in operating experiences with no stress corrosion cracking and yields a low probability of external missile generation.

The turbine missile evaluation provided in this Appendix is based on an ASEA Brown Boveri report (Reference 8).

2.0

SUMMARY

OF REQUIREMENTS OF THE U.S. NUCLEAR REGULATORY COMMISSION (NRC)

The primary safety objective of the staff of the NRC is the prevention of unacceptable doses to the public from the releases of radioactive contaminants that could be caused by damage to plant safety-related structures, systems and components resulting from missile-generating turbine failures.

The criteria that must be met to demonstrate compliance with regulations is the General Design Criterion 4 of Appendix A to 10 CFR 50, nuclear power plant structures, systems, components important to safety shall be appropriately protected against effects, including the effects of missiles.

Failures of large steam turbines of the main turbine generator have the potential for ejecting large high-energy missiles that can damage plant structures, systems and components. The overall safety objective is to ensure that structures, systems and components important to safety are adequately protected from potential turbine missiles.

The NRC safety objective with regard to turbine missiles is expressed in terms of two sets of criteria applied to the missile generation probability (P1). One set of criteria is to be applied to favorably oriented turbines, and the other is to be applied to unfavorably oriented turbines. (See Table 1.1)

The present orientation of the Indian Point 3 Low Pressure turbines places it in the unfavorably oriented category.

Chapter 14, Page 256 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 1.1 Turbine System Reliability Criteria Probability, yr-1 Favorably Unfavorably oriented oriented Required licensee action turbine turbine (A) P1<10-4 P1<10-5 This is the general, minimum reliability requirement for loading the turbine and bringing the system on line (B) 10-4<P110-3 10-5<P1<10-4 If this condition is reached during operation, the turbine may be kept in service until the next schedule outage, at which time the licensee is to take action to reduce P1 to meet the appropriate A criterion (above) before returning the turbine to service. Exemptions may be granted for valid tech-nical reasons or severe economic hardship.

(C) 10-3<P1<10-2 10-4<P1<10-3 If this condition is reached during operation, the turbine is to be isolated from the steam supply within 60 days, at which time the licensee is to take action to reduce P1 to meet the appropriate A criterion (above) before returning the turbine to service.

Chapter 14, Page 257 of 333 Revision 04, 2011

IP3 FSAR UPDATE (D) 10-2<P1 10-3<P1 If this condition is reached at any time during operation, the turbine is to be isolated from the steam supply within 6 days, at which time the licensee is to take action to reduce P1 to meet the appropriate A criterion (above) before returning the turbine to service Chapter 14, Page 258 of 333 Revision 04, 2011

IP3 FSAR UPDATE

3.0 DESCRIPTION

OF ABB WELDED LP-ROTOR 3.1 Welded LP-Rotor Design The welded design used by ABB got large LP-rotors is of the welded type, see Fig. 3.1. It consists of separate relatively small discs welded together to an integral rotor. The welds are positioned at the circumference and are of submerged arc type.

The main design features with respect to the turbine missile generation probability of the welded rotor are:

(1) Low stress level with consequently low yield strength material.

(2) No shrinks fits, no keyways and no central bore.

(3) The small disc forgings used for large LP-rotors can be relatively easily forged resulting in homogenous properties throughout the rotor.

(4) The small forgings with reasonable thickness assure high resolution during ultrasonic inspection.

(5) The welding procedure provides an inert gas atmosphere inside the hollow spheres and around the center of the discs, where the net stresses are highest during operation.

3.2 Description of LP-Rotor Materials The material employed in the LP-rotors is a tempered, low alloy Cr Ni MO steel. The material used is similar to ASTM 471-65, Class 3, vacuum degassed alloy steel for forgings of turbine discs differing mainly by higher Cr and lower Ni content. The steel does not exactly correspond to ASTM steel due to the requirement of good weldability. The material was introduced in LP-rotor design in 1967 and has since then proven to have sufficient response to heat treatment and good welding properties. In addition, the impact energy, fracture appearance transition temperature FATT50, and fracture toughness are prescribed to exceed the values in the material standard used.

Cross Section of Standard LP-Rotor (Nuclear Power Plant Indian Point Unit 3) Figure 3.1 3.3 Description of Stress and Temperature Distribution in the LP-Rotor The dominant principal stress in the welded LP-rotors is the circumferential (hoop) stress due to centrifugal forces of the rotor body itself and the blading, see Fig 3.2. The ABB design criteria assures that the maximum circumferential stress at rotor center does not exceed 53% of the minimum specified yield strength at operating temperature. The maximum circumferential stress at nominal speed of 1800 rpm acts at the center of the discs while the values at the outer surface are considerably lower.

The temperature distribution is determined by the steam temperature in the blading path, see Fig. 3.3.

As a result of the moderate temperature gradient in the blade path, the temperature gradients in the rotor body are moderate too, resulting in small thermal stresses during operation.

The stress and temperature distribution in each LP-rotor type is determined by Finite Element Calculations.

Fig. 3.2 Circumferential Stress in Welded LP-Rotor [6]

(Line Number -2) . 50 + /MPa 1 ksi = 6,895 MPa Chapter 14, Page 259 of 333 Revision 04, 2011

IP3 FSAR UPDATE Fig. 3.3 Temperature in Welded LP-Rotor [6]

(Line Number -1)

• 10 = Tc TF = 1,8*Tc + 32 Tc = Temperature in °C, TF = Temperature in °F

4.0 DESCRIPTION

OF OPERATING EXPERIENCE WITH WELDED LP-ROTORS IN NUCLEAR POWER PLANTS The first turbine generator in a nuclear power plant with welded LP-rotors went into service in 1965.

At the end of 1989 there are 59 turbine generators in service with a total of 144 welded LP-rotors.

There are no reports to date on rotor failures and no indications of stress corrosion cracking. Table 4.1 summarizes the operating hours with respect to units with more and less than three years of operation.

From Table 4.1 it can be seen that the average operating hours of LP-rotors, which are in service now for more than three years, is approximately 70,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />.

Table 4.1 Operating Experience of Welded LP-Rotors in Nuclear Power Plants Number of Number of LP- Average Oper-Units Rotors ating Hours per LP-Rotor Total 59 144 More than 3 54 130 70,000 years of opera-tion Less than 3 5 14 15,000 years of opera-tion 5.0 HYPOTHETICAL FAILURE MODES OF WELDED LP-ROTORS As described in Section 4, there are no failures of welded LP-rotors in nuclear power plants up to now.

Therefore the discussion of failure modes is purely hypothetical.

Based on the experience of stress corrosion cracking (SCC) in LP-rotors of the shrunk on disc design, failures due to this type of cracking will be discussed as well as failures due to brittle fracture and fatigue crack growth.

5.1 Failure Modes Due to Stress Corrosion Cracking Stress corrosion cracking in LP-rotors is most likely to occur in the region where the transition from dry to wet steam is located, i.e., the region of the Wilson-Line.

It is assumed that a stress corrosion crack is initiated in this area.

The propagation rate of stress corrosion cracks in steam turbine rotor steels depends on the applied stress intensity [2]. This is illustrated in Fig. 5.1. At very low stress intensities, close to the threshold Chapter 14, Page 260 of 333 Revision 04, 2011

IP3 FSAR UPDATE stress intensity, KISCC cracks grow extremely slowly, i. e., slower than 10-11 m/sec (0.01 inch/year).

The stress intensity increases from KISCC and also does the stress corrosion crack growth rate until a plateau is reached where the crack growth rate no longer depends on the stress intensity for quite a range of stress intensity. This plateau crack growth rate depends on various other influential variables, for example, on the yield strength of the steel. At higher stress intensities, a further acceleration of stress corrosion cracks is observed, but unfortunately, not well documented. Available stress corrosion crack growth data [2] indicate that the plateau range extends to at least KI = 100 ksi inch.

Figure 5.1 Effect of stress intensity and yield strength on the growth rate of stress corrosion cracks in a steam turbine rotor steel. Not that KISCC is not measurably influenced by the change in yield strength; the plateau stress corrosion crack growth rate, however, is strongly influenced by the yield strength.

With respect to possible failure modes, this means that once a crack is initiated it will grow in a stable manner until the crack size reaches a value corresponding to 100 ksi inch.

In case of a welded LP-rotor, the maximum principal stress (which is the crack driving stress) is the circumferential stress. This means a possible crack is most likely to be expected in an axial/radial plane, as illustrated in Fig. 5.2.

If the critical crack size is reached, the crack propagation changes from a stable to an accelerated state. When the crack extends to the welds, it will grow in circumferential direction in these areas while in the disc the crack will grow towards the center. Finally, the disc will fracture in three 120° pieces as shown in Fig. 5.2.

It must be pointed out here, that the discussed event is purely hypothetical. It is highly likely that a crack of the considered size at the surface of the rotor will cause a loss of several blades leading to a considerable unbalance and a trip of the unit.

This can be seen easily by comparing the critical crack size, which will lead to an accelerated crack growth, with the size of the blade attachment. The blades, except L-0 and L-1, are fixed in circumferential slots having a depth of maximum 3, while the critical crack size is more than 8.

On the analogy of the leak before burst criterion for piping it can be concluded that the welded rotor is protected by a loss of blades before burst criterion with respect to SCC. Therefore, this case must be considered purely hypothetical.

5.2 Failure Modes Due to Brittle Fracture A failure as a result of a brittle fracture in a LP-rotor may occur during a cold-start or an unforeseen overspeed. The prerequisite of such an event is that an existing flow or crack inside the rotor is growing up to the critical crack size during operation. This crack growth is due to SCC for surface cracks respective to Low Cycle Fatigue (LCF) for surface and embedded cracks.

ABB assures by stringent requirements on the conditions of forgings for welded rotors that the discs do not have pre-existing flaws or inclusions of unacceptable size. The discs provided for Indian Point 3 were volumetric and surfaced examined and no unacceptable flaws existed.

Chapter 14, Page 261 of 333 Revision 04, 2011

IP3 FSAR UPDATE The fracture toughness of the LP-rotor material is now prescribed to be at least 123 ksi inch at a temperature of 35° C. The actual measured values of KIC values and the yield strength values for the discs of the three LP-rotors of the Indian Point Unit 3. The minimum value is 202 MPam (184 ksi in). According to NRC requirements, the ratio between fracture toughness and the maximum circumferential stress at overspeed (= 132% of nominal speed) shall exceed the value 2 in.

The maximum stress amounts to:

Re max = 1.32

• min 2

1.9 = 84 ksi Equ. 5.14 where:

max: Maximum allowable circumferential stress during overspeed Remin: Minimum value of yield strength, Remin = ksi at room temperature 1.9: Minimum safety factor to yield strength for welded LP-rotors at nominal speed.

With the minimum measured fracture toughness, one obtains:

184 ksi in =2.19 in > 2 in Equ. 5.2 84 ksi From these facts it can be concluded that a failure due to brittle fracture is much more unlikely than a failure due to SCC.

5.3 Failure Modes Due to Non-SCC Non-SCC failure in LP-rotors is considered to be caused by fatigue crack growth. It is assumed that a fatigue crack is initiated in a plane perpendicular to the maximum principal stress. The maximum principal stress, which is the crack driving stress, can be the hoop stress or the radial stress (in case of notches only).

Fatigue crack growth in steam turbine rotor steels depends on the applied stress intensity range VK (see Fig. 5.4). It can only occur if stress intensity range VK exceeds threshold value VKth. Above this threshold value the relation between the crack growth (da/dN) and the stress intensity range (VK) can be described by the following power-law:

da = C i VKn Equ. 5.3 dN Chapter 14, Page 262 of 333 Revision 04, 2011

IP3 FSAR UPDATE Equation 5.3 is called Paris - Equation. The values C and n are dependent on the material used.

Once a crack is initiated it will grow in a stable manner until the crack size reaches a value corresponding to VKIC. If this critical crack size is reached, the crack propagation changes from a stable to an accelerated state.

Figure 5.3 Results of KIC -and Rn - Measurements for the LP-Rotors of Indian Point Unit 3 The items and the test report number (MP.-No) of the forgings of the three LP Indian Point Unit 3 LP-rotors summarized. The actual measure Rn - (yield strength) and KIC - (fracture toughness) values at room temperature are also tabulated and the fracture toughness statistically analyzed.

Contents:

• Items and MP-numbers of the forgings

• Measured yield strength at room temperature

• Measured fracture toughness at room temperature

• Summary and statistical evaluation LOW PRESSURE ROTORS item No. 1 No. 2 No. 3 1 MP 54912 B MP 59210 B MP 59976 B 2 MP 59211 B MP 59987 B MP 60220 B 3 MP 59212 B MP 59977 B MP 59974 B 4 MP 59213 B MP 59978 B MP 65581 B 5 MP 59214 B MP 59988 B MP 68147 B 6 MP 54913 B MP 59215 B MP 59975 B MP-No. of the Forgings of the LP-Rotors of Indian Point Unit 3 LOW PRESSURE ROTORS Item No.1 No. 2 No. 3 1 97.2 103 107 2 98.9 98.6 98.5 3 103 104 101 4 104 107 99.2 5 99.9 98.2 101 6 99.6 101 106 Yield strength at room temperature in units of ksi.

(Min. value 97.2 ksi, max. value 107 ksi)

LOW PRESSURE ROTORS Item No. 1 No. 2 No. 3 1 670 708 735 2 682 680 679 Chapter 14, Page 263 of 333 Revision 04, 2011

IP3 FSAR UPDATE 3 712 718 694 4 715 735 684 5 689 677 693 6 697 698 730 Yield strength at room temperature in units of Mpa (Min. value 670 Mpa, max. value 735 Mpa)

LOW PRESSURE ROTORS Item No. 1 No. 2 No. 3 1 233 232 184 2 251 209 216 3 246 226 229 4 260 243 254 5 255 259 254 6 250 221 188 Fracture toughness at room temperature in units of ksi in (Min. value 184 ksi in, max. value 260 ksi in)

Figure 5.3 (continued)

LOW PRESSURE ROTORS Item No. 1 No. 2 No. 3 1 256 255 202 2 276 230 238 3 270 248 252 4 286 267 279 5 280 285 279 6 275 243 207 Fracture toughness at room temperature in units of MPam (Min. value 202 Mpa in, max. value 286 MPa m)

SUMMARY

OF RELEVANT MATERIAL PROPERTIES Yield strength at room temperature is in the range of 97 ksi (670 Mpa) to 107 ksi (735 Mpa).

Fracture toughness at room temperature is in the range of 184 ksi in.

(202 MPa m) to 260 ksi in (286 MPa m).

STATISTICAL EVALUATION Mean value : K IC + 234 ksi in (257 MPa m)

Chapter 14, Page 264 of 333 Revision 04, 2011

IP3 FSAR UPDATE Standard deviation: SKIC + KIC

• K IC = 0.1

• KIC Figure 5.4 - Fatigue Crack Growth 6.0 METHOD FOR CALCULATING TURBINE MISSILE GENERATION PROBABILITY (P1)

The turbine missile generation probability (P1) consists of two factors (1) the probabiliy of shaft failure producing an internal turbine missile (P1) and (2) the probability that this internal missile penetrates the casings and is ejected from out the turbine (P1).

P1 = P1 . P 1 Turbine Missile Generation Probability P 1 P 1 Internal Missile Generation Turbine Casing Perforation Probability Probability (Rotor Fragments)

The probability P1 can be determined by means of fracture mechanics such as critical crack sizes, crack growth rates, stresses and temperatures.

These properties and details are very well documented in the case of turbine rotors.

The procedures for estimating P1 are not as sophisticated as the procedures for calculating P1. The usual method is to compare the kinetic energy of a potential internal turbine missile with the energy necessary to perforate the turbine casing. The result of such an estimation will be either P1 = 0 or P1

= 1.0.

Chapter 14, Page 265 of 333 Revision 04, 2011

IP3 FSAR UPDATE Considering these facts, a conservative approach is assumed that the probability P1 to be one. This means the turbine missile generation probability equals the internal turbine missile generation probability:

P1 = P1 6.1 Method for Calculating Turbine Missile Generation Probability (P1)

Due to SCC According to the present knowledge on SCC phenomena, three ranges have to be distinguished.

(1) Crack Initiation or Incubation Phase:

It is commonly accepted that a threshold value KISCC exist. If the stress intensity KI is below this threshold SCC is not possible.

(2) Constant Crack Growth Rate:

If the stress intensity K1 clearly exceeds the threshold value KISCC the crack growth rate remains constant on a certain plateau value for quite a large range of KI.

(3) Accelerated Crack Growth Rate, Critical Crack Size:

If KI exceeds a certain amount, the assumption of a constant plateau-value is no longer valid.

Available data [2] indicates that the plateau range extends to at least 100 ksi in is used for the determination of critical crack sizes.

The method for a probabilistic approach to this problem is similar to the proposal of Clark Seth and Shaffer, presented in [3]. However, some modifications we felt necessary from todays point of view, have been introduced.

The probability of generating a missile (P1) under the conservative assumption P1 = P1, which was explained previously, is computed as a function of time as follows:

M P1 (T) = p 1 (T) q1 Equ. 6.1 i=1 (Valid for p1 q1 <<1)

Where:

M  : Number of flows in the unit T  : Time in operating years P1(T)  : Probability of missile generation in an individual flow of a LP-rotor.

Chapter 14, Page 266 of 333 Revision 04, 2011

IP3 FSAR UPDATE q1 :Probability of crack initiation in an individual flow of a LP-rotor Due to the fact that the ABB LP-rotors in a unit have the same design and the crack will initiate at the same location (Wilson-Line) Equ. 6.1 can be rewritten as:

P1 (T) = M . p (T) . q Equ. 6.2 6.1.1 Probability of Crack Initiation ,q The probability of crack initiation in the welded LP-rotors is determined from the operating experience described in Section 4. Only those LP-rotors are considered which have been in a operation for more than three years and which have been inspected at least once a year.

Up to now, there have been no indications of SCC in ABB welded LP-rotors. Therefore, the probability q is conservatively assumed to be the 95% upper confidence bound, differing from the proposal in [3], where the 50% confidence bound was used.

According to usual formulas [4], the 95% upper confidence bound is:

Q =1 - (0.05)1/L Equ. 6.3 Where L denotes the number of inspected LP-flows. As mentioned in Section 4, Table 4.1, L amounts to 2 . 130 =260, leading to:

q = 0.011 Equ. 6.3*

6.1.2 Probability of Missile Generation of an Individual LP-Flow, p (T)

The probability of missile generation of an individual LP-flow is defined as the probability that an existing crack will grow rate and critical crack size which is dependent on the loading case (nominal speed and respective overspeed), are the main parameters to be considered.

6.1.3 Influence of Nominal Speed For nominal speed calculation, it is assumed:

• Crack will grow under nominal speed condition due to stress corrosion cracking up to critical crack size.

• Critical crack size is fixed by stress intensity KIP at end of plateau range (upper limit of constant crack velocity).

For this case one obtains the following input data:

a. Crack Growth Rate, r In accordance with [3] the crack growth rate is treated as log-normal distributed random variable having a mean of :

7302 Ln (r) = - 4.968 - + 0.0278 Re Equ. 6.4 Chapter 14, Page 267 of 333 Revision 04, 2011

IP3 FSAR UPDATE TF+ 460 Where:

Ln (r): logarithm of the mean r TF: temperature in °F Re : mean of yield strength at room temperature the physical unit of Equ. 6.4 is in./hour. This equation can be rewritten in the following form:

7302 r = exp (4.110- + 0.0278 Re ) in/year Equ. 6.4*

1.8TC + 492 Where:

TC  : temperature in °C The standard deviation Sr equals 0.587 with reference to Ln (r).

In the calculation, the temperature is taken from the Finite Element Analysis and the yield strength is the average value between upper and lower bounds.

b. Critical Crack Size, aC The critical crack size aC for a semi-elliptical surface crack is given by:

. 1 K IP ac = G 2 Equ. 6.5 1.21 .

Where:

G: Flaw geometry factor KIP: Stress intensity at the end of the plateau range Generally, G, KIP, are random variables. With respect to this, the following assumptions are made:

c. Flaw Geometry Factor G In accordance with [3], G is a uniformly distributed variable ranging from 1.0 to 2.0. The mean is G =

1.5 and the standard deviation is SG = 0.289.

d. Stress Intensity at End of Plateau Range KIP Chapter 14, Page 268 of 333 Revision 04, 2011

IP3 FSAR UPDATE According to [2], the plateau values of the constant crack growth rate are only established properly to an upper limit of K IC = 100 KSI in. The currently available test results seem to be not sufficient to perform a statistical analysis with respect to the scattering of this plateau limit. Laboratory tests performed by the turbine O.E.M. indicate that the assumed limit KIP = 100 KSI in. is a reasonable conservative value.

It should be noted, that the fracture toughness, KIC, of the material employed in the LP-rotor is specified to be KIC ksi in at 35% C. For these reasons, KIP = 100 ksi in is taken as a constant and not a random variable.

e. Operational Net Stress, The maximum principal stress is the circumferential stress, which is the superposition of centrifugal and thermal stresses during operation. The steady state stresses have to be considered since during startup compressive thermal stresses at the surface are induced.

Due to the fact that all stresses and temperatures are calculated by the Finite element Method, a relative standard deviation = S = +/- 5% is realistic, whereby is assumed to be normal distribution.

The mean value is determined depending on the location of the Wilson-Line and the critical crack size based on KIP.

f. Determination of Mean a c 2

1 K IP a c = G x 1.21 Equ. 6.6

g. Determination of Sac For small relative standard deviations the following formula may be used [4]:

2 2 Sa c = SG

+ 4x S

Equ. 6.7 ac G Using the above given values one obtains:

Sac = 0.217 Equ. 6.8 ac Chapter 14, Page 269 of 333 Revision 04, 2011

IP3 FSAR UPDATE

h. Truncation-Factor A of Distribution of ac In the distribution of ac, a truncation is introduced so that the lower bound of ac corresponds to the lower bound of the random variable G, G = 1.0.

This leads to a truncation of:

Sac = G -1 Equ. 6.9 A i ac G Whereby a symmetrical distribution was assumed. This means the distribution function of ac will be truncated at the points ac + A i Sac and ac - A i Sac.

6.1.4 Influence of Overspeed (132%)

For overspeed calculation, it is assumed:

• Crack will grow under nominal speed condition due to stress corrosion cracking up to the critical crack size.

• Critical crack size is fixed by fracture toughness KIC (brittle fracture criterion) and stress at overspeed.

Therefore, it is necessary to modify some of the input data.

a) Critical Crack Size, aC In this case, the critical crack size for a semi-elliptical surface crack is given by:

=G.

1 . K xc 2 ac Equ. 6.10 1.21 .

Where:

G : Flaw geometry factor

Operational net stress at overspeed (132% of nominal speed) which is calculated by the finite element method.

KIC : Fracture toughness (critical stress intensity) b) Fracture Toughness KIC Because of test results, fracture toughness KIC can be statistically analyzed:

Mean : K IC = 234ksi ! in ( 257 MPa ! m )

Standard Deviation  : . .

SK IC = K IC K IC = 0, 1 K IC Chapter 14, Page 270 of 333 Revision 04, 2011

IP3 FSAR UPDATE For this reason KIC is taken as a random variable in contrast to KIP which is taken as a constant representing a lower bound value.

c) determination of Mean ac and Standard Deviation Sac Based on random KIC - values, random ac - values can be calculated. The mean value is given by:

2

. 1 K IC ac = G . Equ. 6.11 1.21 .

With the standard deviation:

. SG S . SK IC sa = a 2 + 4 . 2 +4 2 Equ. 6.12 G K IC Which is available for small relative standard deviations.

Using:

SG/G = 0.193 S / = 0.05 SKIC/KIC = 0.1 one obtains:

Saa/ac = 0.295 d) Truncation Factor A The modified truncation Factor A is calculated with Equ. 6.9.

6.1.5 Computer Code The procedure for calculating the probability of generating a missile was computerized, the turbine O.E.M. internal computer code HC317.

The program calculates the probability for an individual LP-flow p (T), and generates a plot showing the total probability P1 (T) according to Equ. 6.2 for a given turbine generator versus operating years.

This program was used for both cases (nominal speed condition, overspeed condition).

6.2 Method for Calculating Turbine Missile Generation Probability (P1LCF) Due to Non-SCC LP-rotors of steam turbines experience the highest stresses during cold starts or at overspeed.

Figure 6.1 and 6.2 present schematically these two operation cycles with their typical time dependent principal stresses.

Chapter 14, Page 271 of 333 Revision 04, 2011

IP3 FSAR UPDATE Figure 6.1 shows the time dependent stress during a normal operation cycle. The maximal stress occurs during the startup phase due to the thermal expansion of the rotor. During full-load rejection the stresses are higher, caused by the occurring overspeed.

Prior to welding of the rotor, the forgings will be subjected to an ultrasonic (e.g., non-destructive) examination that will locate and scale the majority of flows, though some may escape detection (below the minimum detectable crack size). The probability that such an initial crack grows to critical crack size is calculated as the probability of rotor failure, which means the probability of turbine missile generation due to Non-SCC.

The probability of generating a missile due to Non-SCC (P1LCF) under the conservative assumption:

P1LCP =$ P1 = P1 P1 and P1) is computed as a function of the load cycles as follows:

M F P 1LCF ( N ) = P ij ( N ) . r i i=I Equ. 6.13 J =I Where:

M: Number of flows in the unit F: Number of different forgings (disks, shaft-end) per flow N: Load cycle (cold, warm or hot starts, conservatively assumed That all starts are cold starts)

Pij(N): Probability of missile generation of an individual forging (i) of an individual flow (i) of an LP-Rotor ri : Probability that a crack with the maximal crack length ao in forging i is not detected during ultrasonic inspection. It is assumed that ri=1 for all forgings.

Due to the fact that the turbine O.E.M. LP-rotors in a unit have the same design and with the assumption that r i = 1 , Equ 6.13 can be rewritten as:

F P1LCF ( N ) = M P1 ( N )

Equ 6.14 i =1 Since one double flow LP-rotor of the Indian Point Unit 3 has six forgings (2 shaft-ends, 4 disks), three forgings per flow must be considered (F = 3), and so one obtains:

PILCF(N) = M * [P1 (N) + P2 (N) + P3 (N) ] Equ. 6.15 The indices correspond to the forgings (shaft-end, thin disc, thick disc) of a flow.

Figure 6.1: Normal Operation Cycle Chapter 14, Page 272 of 333 Revision 04, 2011

IP3 FSAR UPDATE Figure 6.2: Full Load Rejection With Overspeed 6.2.1 Probability of Missile Generation of an Individual LP-Rotor Forging p1 (N)

The probability of missile generation due to Non-SCC for an individual LP-rotor forging is defined as the probability that an initial crack (crack length ao) grows up to the critical crack length ac for brittle fracture.

For the determination of this probability some assumptions are made:

• Each forging has an initial crack with the length ao at the location, where the highest transient stress appears.

• The growth of this initial crack due to low cycle fatigue can be described with the Paris-Equation.

• The critical crack length ac is fixed by fracture toughness KIC and maximum principal stress at maximum overspeed.

• Consequently, the crack lengths and the crack growth behavior of the used rotor material are the main parameters to be considered:

a. Initial Crack Length, ao Prior to the welding of the LP-rotor, each forging will be subjected to a complete ultrasonic inspection.

This examination will locate and scale the majority of existing flows and cracks, though some, which are below the minimum detectable defect size, may escape detection.

For this reason, it is assumed that each forging of an LP-rotor has an initial crack at the location of the highest transient stress. The assumed initial crack length is in the magnitude of 1.25 mm radius (0.049) inch), which is nothing else than the maximum value of minimum detectable defect size of all forgings used for Indian Point Unit 3 Lp-rotors.

For the following calculations:

ac = 1.27mm - 0.05 inch was chosen for each of the 4 discs and 2 shaft-ends of the rotors.

The relative standard deviation for ao is assumed to be log-normal distribution.

b. Critical Crack Length, ac The critical crack size ac for a semi-elliptical surface crack is given by equation 5.10:

2 G . K IC a c = 1.21 .

MAX Where:

G  : Flaw geometry factor with the mean G = 1.5 and the relative standard deviation G = 0.193 Chapter 14, Page 273 of 333 Revision 04, 2011

IP3 FSAR UPDATE KIC  : Fracture toughness which is statistically analyzed from the test results of all 18 rotor forgings of Indian Point Unit 2.

MAX  : Maximum principal stress at maximum overspeed.

c. Maximum principal stress at overspeed. MAX The maximum principal stress at overspeed is the circumferential stress. For the calculation of the critical crack length, the maximum value of max is taken into account. The maximum values appear adjacent to the rotor axis [7]. The stresses are calculated by the finite Element Method, so a reliable standard deviation of max = 0.05 is realistic.

d. Crack Growth, da/dN The crack growth due to LCF can be described with the Paris-Equation. With the relation between the stress intensity range VK and the range V  :

1.21 . .

K = . a Equ. 6.16 G

One obtains the crack growth relation in the following form:

n da dN = C . 1.21 . . .

a Equ. 6.17 G

The integration of Equ. 5.17 from the initial crack length ao yields to the crack length after N load cycles:

(1 (1n / 2 ) )

n (1n / 2 )

+ (1 n / 2 ) . . 1.21 . .

aN = a o C G

N Equ. 6.18 The parameters C and n are material dependent values, which are determined from fatigue crack growth tests. C has a mean value of :

with a relative standard deviation of c = 1.08. The exponent n has a value of n = 3, which is an upper bound value.

V is the maximum stress range during the cycles.

e. Stress range, V Chapter 14, Page 274 of 333 Revision 04, 2011

IP3 FSAR UPDATE The maximum stress range V results from the different thermal expansion during start conditions, whereby the greatest ranges occur during cold starts.

These stresses are determined by a transient calculation by the Finite element Method [7]. It is assumed that the stress range is equivalent to the maximum appearing stress during a start.

The stress range has the same value for the standard deviation as the other stresses,

1. = 0.05 7.0 Low Pressure Rotor Inspection Requirement 7.1 Determination of Inspection Intervals The maximum allowable inspection intervals are determined evaluating the results for the turbine missile generation probability P1 (T) for the individual turbine generator.

In the general inspection and overhaul plans, major rotor inspection intervals of 50,000 equivalent operating hours is recommended, see Fig 7.3. If LP-0 UT inspection is successfully performed before 50,000 EOH, an additional 30,000 EOH will be available to Low Pressure Turbine without a major rotor inspection. The results obtained with the probabilistic approach reveal much longer inspection intervals of 14 years. Therefore, the risk of stress corrosion cracking is completely covered by the usual inspection and overhaul programs and no additional measures have to be introduced.

7.2 Recommended LP-Rotor Testing If a welded LP-rotor is affected by SCC, the cracks will initiate at the outer surface of the rotor body.

The usual recommended LP-rotor testing of welded rotors during major overhauls assures that any indications of SCC will be detected. The testing includes a through visual inspection for erosion and corrosion and a magnetic particle testing at selected areas. In the case of indications, additional ultrasonic examinations will be performed.

Therefore, a complete volumetric ultrasonic inspection for SCC is not necessary in the case of welded LP-rotors.

In case of sufficient high probability of failure due to fatigue crack growth, 100% volumetric ultrasonic inspection would be necessary. In case of sufficient low probability, no ultrasonic testing is necessary.

Figure 7.3 Recommendations for Inspection Intervals of Large Turbine Generators 7.3 Results for Indian Point Unit 3 Low Pressure Welded Rotor (DS92 Design) 7.3.1 Cross Section of Standard LP-Rotor DS92, see Figure 3.1.

7.3.2 Program Input for SCC-Calculation.

7.3.3 Input Data for Nominal Speed Condition.

Chapter 14, Page 275 of 333 Revision 04, 2011

IP3 FSAR UPDATE The original and determination of the input data for the nominal speed condition are summarized in Appendix 7.1.

The input variables obtained are summarized in Table 7.1.

Table 7.1 Indian Point Unit 3 (Nominal Speed) ao Sao Truncation r Sr q M inch Inch A Inch/year 8.20 1.78 1.54 0.063 0.587 0.011 6 As a result of the computation, the probability P1 is plotted versus service life in Figure 7.1.

7.3.4 Input Data for Overspeed Condition The original and determination of the input data for overspeed condition are summarized in Appendix 7.2.

The input variables obtained are summarized in Table 7.2.

Table 7.2 Indian Point Unit 3 (Overspeed 132%)

ao Sao Truncation r Sr q M inch inch A inch/year 11.20 3.31 1.13 0.063 0.587 .0011 6 As a result of the computation, the probability P1 for Overspeed Condition is plotted versus service life in Figure 7.1, too (dotted line) 7.4 Inspection Intervals Because of SCC The comparison between the two different speed conditions (Figure 7.1) shows that overspeed yields lower time dependent probabilities. This means that nominal speed conditions is dominant for determination of inspection intervals.

As the Indian Point 3 Nuclear Power Plant is in a unfavorable orientation, the 10-5 value has to be taken as a minimum limits. See Table 1.1.

From this, a maximum inspection interval of 14 years is allowed see Figure 7.1.

Figure 7.1 LP-Retrofit Indian Point 3 Assessment of the Probability of Steam Turbine Rupture from Stress Corrosion Cracking PROBABILITY P AS A FUNCTION OF TIME Chapter 14, Page 276 of 333 Revision 04, 2011

IP3 FSAR UPDATE 95% COMF. BOUND: NOMINAL SPEED

---

95% COMF. BOUND: 132% OVERSPEED 7.5 Program Input and Results for Non-SCC The determination of the input data for non-SCC condition is summarized in Appendix 7.3.

The input data is used for the OEM computer program PROBFRAC, which calculates the probability of missile generation of an individual rotor-disc. For each type of disc (thin disc, thick disc, shaft end),

this program was applied to calculate the probabilities P1 (N). With Equation 6.15, the probability of missile generation of Indian Point 3 was determined and a plot P1LCF (N) versus the numbers of load cycles N was plotted (Figure 7.2).

This figure presents that the probability of missile generation due to Low Cycle Fatigue after N = 250 cycles is in the magnitude of 7* 10-17 (here it is assumed that the unit operates approximately 40 years with six starts per year).

In comparison to Figure 7.1, this diagram also presents that SCC is the overly dominant failure mechanism and consequently no additional ultrasonic testing is necessary for detection of fatigue crack growth.

Figure 7.2 LP-Retrofit Indian Point 3 Assessment of the Probability of Steam Turbine Rupture From Low Cycle Fatigue PROBABILITY P AS A FUNCTION OF LOAD CYCLES Appendix 7.1 a.) Critical Crack Size ac and Truncation Factor A o Mean value a See Section 6.1.3. f)

G = 1.5 See Section 6.1.3. c)

KIP = 100 ksi in See Section 6.1.3. d)

=151 MPa = 21.9 ksi See Section 6.1.3. e) and Fig. 7A a c = 8.20 inch See Equation 6.6 o Standard deviation S ac See Section 5.1.2.1. g)

S ac = 0.217 a c = 1.78 inch See Equation 6.8 o Truncation Chapter 14, Page 277 of 333 Revision 04, 2011

IP3 FSAR UPDATE A = 1.54 See Section 6.1.3.1. h)

Equation 6.9 b) Crack Growth Rate r o Mean value r See Section 6.1.3 a)

T c = 148°C ( 298°F ) See Section 6.1.3 a) and Fig. 7B Re = 99ksi (mean value)

Standard deviation Sr = 0.587 See Section 6.1.3 a) r = 0.063 inch / year See Equation 6.4

• c) Crack Initiation Probability q and Number of Individual Flows per Unit M 95% upper confidence bound q = 0.011 See Section 6.1.1.

Equation 6.3

• M =6 Appendix 7.2 PROGRAM INPUT (OVERSPEED) a) Critical Crack size ac and Trucation Factor A o Mean value ac See Section 6.1.4 c)

G = 1.5 from nominal speed condition See Section 6.1.3 c)

K IC = 234 ksi in See Section 6.1. .4. b)

= 303 MPa = 43.9 ksi See Section 6.1.4 c) and Fig. 7C a c = 11.20 inch See Equation 6.11 o Standard deviation S ac See Section 6.1.4. c)

Chapter 14, Page 278 of 333 Revision 04, 2011

IP3 FSAR UPDATE S ac = 3.31 inch See Equation 6.12 o Truncation A = 1.13 See Section 6.1.3 h) b) Other Input Data All other input data such as o Crack growth rate r = 0.063 inch/year (Mean value) sr = 0.587 (standard deviation) o Crack initiation probability q = 0.011 o Number of individual flows per unit M =6 are the same values as in nominal speed condition (See Appendix 7.1.)

Appendix 7.3 PROGRAM INPUT (NON-SPEED) a) Mean and Standard Deviation of Initial Crack Length It is assumed that each forging has an initial crack with the length:

a o = 1.27 mm = 0.05 inch (See Section 6.2.1 a) and a standard deviation of:

ao = 0.41 (See Section 6.2.1 a) at the location with the highest transient stress (# ).

b) Maximal stress at Overspeed ( ) and Transient Stress (# )

max The stress values are taken from IP3s Rotor stress Report TB HTGE52245. There the FE-nodes with the highest stresses of each disk or shaft-end are tabulated. # and max are at different but adjacent locations in the FE-mesh. For that reason, it is conservatively assumed that maximum Chapter 14, Page 279 of 333 Revision 04, 2011

IP3 FSAR UPDATE transient stress # (Fig. 7D) and maximum stress at overspeed max (Fig. 7C) occur at the same FE-node.

The stress values for each forging, which were used for the calculation, are summarized in the following tables:

Table 7A Input Stress Values in MPa Disk 1/16 Disk 2/5 Disk 3/ 4 Shaft End Thin Disk Thick Disk max 492 416 403 294 250 310 Table 7B Input stress Values in ksi Disk 1/16 Disk 2/5 Disk 3/ 4 Shaft End Thin Disk Thick Disk Max 71.4 60.3 58.4 42.6 36.3 45.0 The relative standard deviations are:

max = # = 0.05 c) Fracture Toughness and Flaw Geometry Factor For the fracture toughness, the mean and the standard deviation of the actual measured values form the manufactured disk are taken (see Appendix 2.2):

K IC = 257 MPa m = 234 ksi in KIC = 0.1 Chapter 14, Page 280 of 333 Revision 04, 2011

IP3 FSAR UPDATE For the flaw geometry factor G, a surface crack in each disk is conservatively assumed, i.e., G and G are the same values as for SCC-calculation:

G = 1.5 (See Section 6.1. 3 c)

G = 0.193 d) Parameters for the Paris-Equation C and n These parameters are described in Section 6.2.1 d):

C = 3.2 . 112 c = 1.08 n = 3 (upper bound value)

Figure 7D - Transient Hoop stress Distribution at Nomial Speed and t=19,200 Sec.

References

1) Safety Evaluation Report related to the operation of Perry Nuclear Plant Unit 1 & 2, U. S. Nuclear Regulatory Commission, Office of Nuclear Reactor Regulation, April 1983.

2) Stress Corrosion Cracking and Corrosion Fatigue Fracture Mechanics, M.O. Speidel in, Corrosion in Power Generating Equipment, edited by M.O. Speidel and A. Atrens, Plenum Press, New York, 1984.

3) Procedures for Estimating the Probability of Steam Turbine Disc Rupture from Stress Corrosion Cracking, W. G. Clark, Jr., B. B. Seth and D. H. Shaffer, ASME Publication 81-JPGC-PWR-31.

4) Statistische Auswertungsmethoden, L. Sachs, Springer Valag Berlin, Heidelberg, New York, 1969.

5) Stress Corrosion Cracking of Steam Turbine Rotors, M. O. Speidel and J. E. Bertilsson in, Corrosion in Power Generating Equipment, edited by M. O. Speidel and A. Atrens, Plenum Press New York, 1984.

6) ASEA Brown Boveri, Ltd. Report, Stress Analysis of INDIAN POINT UNIT 3 Rotor, ABB TB HTGE 52 242.

7) ASEA Brown Boveri, Ltd. Report, Additional Stress Calculations for INDIAN POINT UNIT 3 Rotor, ABB TB HTGE 52 245.

8) ASEA Brown Boveri, Ltd. Report, ABBs Method for Determination of the Turbine Missile Generation Probability -

Results of the Analysis for the INDIAN POINT UNIT 3, ABB TB HTGE 52 293, dated 3-21-90.

9) ASEA Brown Boveri, Ltd. Report, Rotordynamic Integrity of the Indian Point Unit 3, LPs retrofit, ABB TB HTGE 52 232, dated 1-26-90.

10) ASEA Brown Boveri, Ltd. Report, Stress Analysis of Indian Point Unit 3 LP - Check of Blades L-O and L 1 for 132%

Overspeed, dated 1-20-90.

Chapter 14, Page 281 of 333 Revision 04, 2011

IP3 FSAR UPDATE

11) ASEA Brown Boveri, Ltd. Report, ABBs Method for the Determination of the Turbine Missile Generation Probability -

Summarized Results of the Analysis for the Indian Point Unit 3, dated 8-02-90.

Chapter 14, Page 282 of 333 Revision 04, 2011

IP3 FSAR UPDATE FSAR APPENDIX 14B CONSEQUENCES OF A TURBINE MISSILE AT INDIAN POINT 3 1.0 Introduction This study assesses the possibility of damage due to missiles resulting from steam turbine failure.

Turbine blades can fracture and fragments can be ejected at high velocities, breaking through the turbine casing. These turbine missiles could affect the safe operation of the plant. This analysis has been performed to predict the probability of compromising plant safety due to turbine missiles. The method and result of this analysis is discussed below.

2.0 Basis and Assumptions This analysis is based on the original low pressure (LP) turbines at IP3 manufactured by Westinghouse Corporation. It assumes stress corrosion cracking failure of shrunk-on rotor discs, which break up into large segments. The replacement LP turbines manufactured by ASEA Brown Boveri are of the welded rotor design. They do not have shrunk-on discs and will not produce the large missile segments assumed on turbine failure. The new rotors meet or exceed the design criteria of the Westinghouse rotors including design overspeed. This analysis is re-introduced into the FSAR as it forms the original design basis for 132 % overspeed, the LP Steam Dump system, the Back-up Service Water system, and City Water back-up for Charging Pump cooling.

Westinghouse Corporation, the manufacturer of the original turbines at Indian Point 3, calculated the probability of a turbine failure which generates external missiles as a result of stress corrosion cracking of rotor discs and keyways. In this analysis, this probability is known as P1, and is a function of crack initiation, subsequent crack growth with time, and critical crack depth. P1 values have been supplied by Westinghouse for turbine disc failure at rated speed and at 132 % overspeed, for inspection intervals of 18 months, 3 years and 5 years.

Turbine failure produces missiles from the breakup of a turbine disc and other secondary internal impacts from the disc sectors. Missiles of various sizes, shapes, and velocities result which, after leaving the turbine casing, become projected hazards to the remainder of the plant. Therefore, the major objective is to give reasonable assurance of public protection by evaluating the consequences of a turbine disc rupture. That is, determine the probability of turbine missiles causing an offsite release of radiation. As will be discussed below, this analysis shows that the risk of releasing radioactive material due to an accident involving turbine missiles does not violate the limits specified in 10 CFR 100 (1) of 10-7 events/year.

Typically, the overall probability of producing a compromise of plant safety, P4, is factored into the following separate probabilities:

P1 = probability of turbine failure which results in ejection of external missiles; P2 = conditional probability given a turbine failure that missiles from a failed turbine strike each component in a system required for safe shutdown; P3 = conditional probability given a missile strike that the function of the struck component is critically impaired.

Therefore, P4 = P1 x P2 x P3 Chapter 14, Page 283 of 333 Revision 04, 2011

IP3 FSAR UPDATE As discussed previously, P1 is a function of crack initiation, subsequent crack growth with time, and critical crack depth. P1 is not specifically addressed in this analysis. The Westinghouse determination (2) of P1 is utilized in this analysis for each disc of the low pressure system for determining P4. Values for P1 were provided by Westinghouse for several turbine inspection intervals, and are listed in Table 14B-1. The high pressure turbine is assumed to have a negligibly low probability of failure of the type, which produces external missiles.

The other two component probabilities are addressed by the analysis described herein. P2 is directly calculated by the analysis described in this document. P3 is addressed indirectly in that the energy range of missiles, which strike critical components, is computed. P3 is difficult to assess precisely because of the many variables involved. The energy of sticking missiles, however, is probably the most important of these variables and an estimate of it is provided by this analysis. For turbine missiles, P3 is typically considered to be unity since these very heavy missiles are rather damaging.

Furthermore, such an assumption is conservative.

Simulated turbine failures that result is strikes on a sufficient number of components of a critical system are considered to compromise the safety of the plant. The quantity P2 as defined above accounts for all redundant equipment, and is therefore, the probability given a turbine failure that missiles cause a safety compromise of the plant.

In determining the probability of an offsite release, it is necessary to go beyond P4 as defined above.

In plants such as Indian Point 3 with a protected spent fuel storage, damage to the reactor core is the only mechanism, which can produce an offsite release. Core damage comes from compromise of functions, which are required to achieve and maintain a safe shutdown condition.

Neither an offsite release nor damage to the core is an automatic consequence of damage to equipment, which must ultimately function in order to achieve and maintain a safe shutdown.

Generally, there is a significant length of time between damage to such equipment and the requirement that it function in the capacity required for achieving or maintaining a safe shutdown.

Repairs can be made or alternative actions taken before such equipment is actually needed. In fact, for most safety-related equipment, there is already in place a procedure for achieving a safe shutdown when the normal function provided by the equipment has been compromised. Those functions, which are predicted by this study to be compromised by turbine missiles, are considered to have a negligible probability of resulting in an offsite release if there is already in place at Indian Point 3 an established procedure for achieving a safe shutdown when plant equipment that normally performs that function has been lost.

2.1 Maximum Design Overspeed For determination of the maximum design overspeed, the following conservative sequence was assumed:

a) The unit is operating at full load with all turbine valves wide open:

b) The entire turbine load is dropped instantaneously (no credit taken for plant auxiliary load);

c) The auxiliary governor is assumed to operate improperly (i.e., does not respond to turbine load mismatch);

d) Trip is initiated at the emergency overspeed set point:

e) From this point on, the turbine valves operate in the prescribed manner.

Chapter 14, Page 284 of 333 Revision 04, 2011

IP3 FSAR UPDATE At the instant the load is dropped, the unit is assumed to accelerate at a constant maximum rate corresponding to the initial steam flow and rotational inertia of the unit until the unit reaches the emergency overspeed trip set point plus a pure time delay of 0.1 second. Flow into the turbine is then calculated during valve closure and is modified for flow versus lift characteristics. It takes approximately 0.15 second to fully close all of the turbine valves following the initial 0.1 second delay.

Once the valves close completely, additional overspeeding is calculated using the energy stored in the turbine, the moisture separators and the related piping.

The resulting maximum overspeed calculated in this manner was nominally 131%. Westinghouse P1 values are for 132% overspeed, which considers the uncertainties in valve characteristics and variation in closing times.

3.0 Calculational Methods 3.1 Methods Overview The general category of turbine missile codes used in the turbine missile analysis are designated MIS (Missile Impact Simulation). The analysis is an extension of the work embodies in the code MIDAS (3) written for Offshore Power Systems and the code MISPGE written for Portland General Electric (4) . A number of improvements in the options and calculational procedures have been incorporated for this analysis.

For designated convenience, the code used in this study is called MISIP (Missile Impact Simulation of Indian Point). It differs from the other codes primarily in the incorporation of the Indian Point 3 plant model.

The basic procedure involves the tracing of individual missile trajectories by the following sequence:

• Determination by Monte Carlo methods of the initial missile velocity and direction from the respective ranges given;

• Calculation by equations of free-flight ballistics of the missile strike locations on the walls of the plant;

• Determination by Monte Carlo methods of the projected area with which the missile impacts the wall;

• Calculation by empirical relations of the missile-barrier interaction effects;

• Calculation by energy balance and Monte Carlo means (for missile direction) of the missile state following the interaction;

• Termination of the missile trace if the missile ricochets more than three times consecutively in the same room* or exits the plant in a direction which precludes its return or its striking an adjacent plant.

All safety related component rooms (targets) penetrated during the flight of the missile are recorded.

Computer output normally lists the number of discs allowed to break up, the number of times each target is struck and penetrated by each breakup, and the characteristics (type and final energy) of the missiles which hit the targets. Detailed traces of each missile flight may be printed out, and any desired interim data are available. From the code output the probability of safety compromise is determined. The specific combination of failures, which result in safety compromises are examined, and compromises of those functions which are covered by procedures for achieving and maintaining a safe shutdown without the given function are considered to have a negligible probability of occurrence.

3.2 Initial Conditions for Turbine Missiles Chapter 14, Page 285 of 333 Revision 04, 2011

IP3 FSAR UPDATE Starting conditions required for turbine missile calculations are:

• Missile mass,

• Starting coordinates,

• Initial direction, and

• Initial magnitude of velocity.

In addition, the user inputs the number of disc segments that the simulated disc failure will result in.

The analysis looked at breakup into either four 90o segments or three 120o segments because these cases provide the most risk. Also, each segment is assumed to produce two additional fragments as they break through the turbine casting. Figures 14B-1 and 14B-2 show missile shapes for 90o segments. The shapes for 120o segments are similar.

Missile dimensions, mass, and velocity were provided by the Westinghouse Electric Products Division (6, 7) for this analysis. Data was provided for each disc segment and fragment, for breakup into 90o segments and 120o segments, and for breakup at rated speed and 132 percent overspeed. A sample of this data is shown in Table 14B-2, excerpted from Reference 5.

Figure 14B-3 indicated the coordinate system utilized in the calculations and the relationship between the turbine missile initial velocity, the position vector and its components parallel to each of the plant Cartesian coordinates. References 5 and 6 give the azimuthal ( ) range and rotational () range of turbine missiles. Inner discs emerge with a range uniformly distributed between -5o and +5o. End discs (two per turbine) emerge uniformly between 5o and 25o measured outward from the center of each turbine. = 0 corresponds to missile emergence perpendicular to the turbine axis. The rotational range is from 0 to 360 degrees, but the turbine pedestal and condenser stop any missiles emerging in a downward direction. The turbine base prevents missile emergence at angles requiring penetration of this region.

• This procedure is equivalent to a low-energy termination, but is more convenient as it obviates the need for keeping track of a potential energy reference frame.

This exclusion is justified with the assistance of Figure 14B-4.

In Figure 14B-4, the missiles generated by the breakup of disc 2 are illustrated (two of four sets for a 90o breakup). The disc sectors are located accurately in the radial dimension (prior to breakup). The location of blade ring fragments is assumed. The sizes of fragments are typical for all discs. It is obvious from the figure that only the smallest fragment could possibly exit the base region of the casting without interacting with one or both of the horizontal base plates on the top and bottom of this region. Such as exit is considered impossible for even the smallest fragment because it has a rotational component and could not maintain the precise orientation required to avoid these base plates during the perforation process. These base plants are heavy steel (three inches thick on the top and six inches on bottom). Minimum width (on top) is eight inches. The bottom plates are much wider. These plates are separated by weld gusset plates and are also welded to the outer turbine casing. A missile exiting this region would have to tear these plates or separate them. The added energy required over that to perforate the casting is so great that the probability of emergence in this region is considered negligible.

The range of in Figure 14B-3 that excludes the turbine base and the flight paths below horizontal is from 100o to 285o.

3.3 Missile Trajectories and Strike Locations Chapter 14, Page 286 of 333 Revision 04, 2011

IP3 FSAR UPDATE The equations of free-flight ballistics (Neglecting air resistance) are used to determine trajectories and strike locations on given plant walls. Exact details are contained in Reference 7. The code keeps track of each cell, or room, in which the given missile is located and determines the next wall struck by solving the velocity equations (in component form) for the minimum time to strike one of the enclosing walls. The minimum time replace in the original equations locates the strike point. Special routines are called if the missile enters cells which contain either the containment or the moisture separator reheaters, which are treated as right circular cylinders.

3.4 Missile Interaction With Walls 3.4.1 Concrete Wall Interactions The only walls which offer significant resistance to the missiles are concrete walls. The effect of walls such as office room partitions and corrugated metal is neglected.

This study used a formula for concrete penetration which was derived on the basis of tests performed by the Commissariat a lEnergie Atomique-Electricite de France (CEA-EDF) (8). The Electric Power Research Institute recommends this formula as providing the best match to experimental data over a full range of missile velocities (9). The formula is TP = 0.765 (c) ( W/D ) 1/2 vi3/4

[Equation 3.4-1]

Where:

TP = thickness of wall that is penetrated 50 percent of the time for given missile (in) c = concrete compression strength (psi)

W = missile weight (lb)

D = effective diameter (in)

D = 2 A/ where A represents an effective impact area vi = incident velocity (ft/sec)

The barrier penetration for a given missile depends upon the combination of impact area and velocity.

In the analysis, the MISIP code compared the actual thickness (T) of the barrier with TP to determine whether the missile penetrates the barrier. The velocity (VP ) required to penetrate the barriers is calculated by a rearrangement of equation (3.4-1), if TP (calculated from equation 3.4-1) exceeds T.

The velocity (VP) required to penetrate the barriers can be found by:

V p = (T p) 4/3 (c) 1/2 (D/W) 0.765 [3.4-2]

The missile state following penetration is determined by the residual velocity after penetration, Vr :

Vr = W (V i 2 - V p 2 ) 1/2 [3.4-3]

W+Ww Where: (1.4 D) 2 P c

Ww = weight of wall plug removed (lb) = 4 Pc = density of concrete = 0.086 lb/in 3 The wall thickness used in Equations 3.4-1, 3.4-2, and 3.4-3 is that parallel to the velocity vector (actual thickness divided by the cosine of the obliquity angle). If the missile penetrates the wall, it is assumed to continue without alteration of its original direction. The containment is a special case, in that the trace is terminated if the containment is penetrated, and the possibility of safety compromise examined separately from the program. (Containment penetrations are not observed with simulated missile traces for Indian Point 3).

Chapter 14, Page 287 of 333 Revision 04, 2011

IP3 FSAR UPDATE Following missile ricochet, the MISIP code calculates the missile velocity and angle of obliquity (with the normal to the surface at the point of contact). The ricochet model (10) is based on converting only elastic strain energy stored locally in the concrete wall and in the missile, when the normal velocity becomes 0, to kinetic energy of the rebounding missile. The overall structural response of the wall is ignored. The rebound contribution from the overall structural response of the wall is assumed to be manifested later in time than the local response. The elastic energy available (>) is estimated as:

> = 2V c2 + 2LA c2 6Es 6Ec [3.4-4]

Where:

V = missile volume (in) 3 c = compressive strength of concrete Es Ec = modulus of elasticity in steel and in concrete, respectively L = thickness of concrete barrier (in)

A = impact area (in) 2 In experimental work at Calspan (11) the rebound velocities of steel missiles ricocheting form concrete walls were measured. The rebound velocity is:

V = 2> 1/2 rebound M [3.4-5]

Where > is given by Equation 3.4-4 and M is the missile mass.

From the penetration equations (3.4-1 and 3.4-2) it is obvious that a significant parameter is the projected area of the missile (that projected area perpendicular to the velocity vector). These area values are picked at random from a uniform distribution between an assumed maximum and minimum calculated from data provided by Westinghouse (5, 6).

3.4.2 Steel Wall Interactions The moisture separator reheaters (MSRs) interact significantly with the missiles because they are located adjacent to the turbine at the same elevations. The MSRs are steel. Steel wall interactions differ significantly from concrete and their specification is somewhat complicated. Briefly, the steel interactions are based on a method derived from experiment by Hagg and Sankey (12) who show that steel perforations can occur in one of two stages. In the first stage, or phase, the resistance of the barrier to perforation is provided only by local compression and shear in the wall because there has been no time for a tensile wave to propagate in the plane of the barrier at significant distances from the interaction point. In the second stage, the barrier stretches in its plane perpendicular to the direction of missile penetration and tensile strength contributes significantly to perforation resistance.

Perforation can occur in either stage. The perforation conditions and expressions for residual velocity and the ricochet conditions are somewhat unwieldy and hence are not listed here (see Reference 13 for a full derivation). The equations for perforation are based upon the missile mass, velocity, and impact area, and the thickness of the wall. The equations are more complicated than those for concrete because of the inclusion of local compression and shear for the two-phase perforation process.

3.5 Plant Layout and Safety Design Figure 14B-15 is an overall layout of Indian Point 3. The plant belongs to the general category designated as an in-line plant (Figure 9-6) wherein the turbine orientation allows direct hits from low Chapter 14, Page 288 of 333 Revision 04, 2011

IP3 FSAR UPDATE trajecting missiles on vital plant components in case of turbine failure. Low Trajectory Missiles (LTMs) are whose incident velocity is less than 45o with the horizontal. High Trajectory Missiles (HTMs) emerge at angles greater than 45o with the horizontal. Any given point whose vector from the turbine axis is less than 45o with the horizontal and which is within the azimuthal and distance range of the missile can be struck by either an LTM or HTM. Protection against LTM strikes on critical components can be afforded by geometric arrangement as in the peninsula arrangement shown in Figure 14B-6, and this is, the motivation for such plant arrangements. However, for HTMs, any point within the distance range is potentially vulnerable to a missile strike.

Generally, the higher velocity LTMs present the greater risks for this category of missiles because of their greater penetration capacity, but for HTMs, the lower velocity missiles may present the greater risks because their limited distance range produces a greater number of strikes per unit area.

Indian Point 3 is unusual among in-line plants in that it is also less vulnerable to the highest velocity LTMs. This effect is caused by the separation between the turbine and the major safety areas which can be struck by LTMs (the primary auxiliary building and the water intake regions). LTMs must have an initial trajectory above horizontal to clear the turbine pedestal and turbine base.

Those with higher velocities also clear critical safety regions, but the lower velocity ones do not. For typical pants, whose safety regions directly abut the turbine hall, essentially all LTM trajectories intersect these regions and the higher-velocity missiles, of course, cause more damage.

The general model of the Indian Point 3 plant was divided into several rooms or compartments to form the input for the MISIP code. All actual walls were modeled as is. Additionally, many large rooms were divided by imaginary air walls into smaller compartments. An example is a large room with a pump on one side. In the model, such a room was divided into two compartments, one containing the pump and the other containing essentially empty space. Thus, if a simulated turbine missile entered this pump room, a determination could be made as to whether the pump itself would have been struck, or if the missile landed harmlessly in the empty part of the room. Also, rooms with redundant equipment were compartmentalized in order to determine whether all or part of the equipment in the room would be struck by missiles.

The plant is modeled in a Cartesian coordinate system with the exception of the reactor containment and the moisture separator reheaters which are modeled (as they truly are) as concrete and steel cylinders, respectively. The code accepts as plant input one line of data for each room of the plant.

The line contains the location, thickness and material specifications of each of the six walls. An additional designator for exterior plant walls indicates the potential fates of missiles which exit these walls. These fates are designated:

R - Exit through the roof (roof exits include those missiles which may fall back on plant),

G - Exit through a floor slab, E - Exit through an exterior wall below grade level, L - Exit through Xmin side of plant, W - Exit through Xmax side of plant, D - Exit through Ymin side of plant, U - Exit through Ymax side of plant.

Rectangular parallelepipeds enclose the cylindrical containment vessel and the moisture separator reheaters. These are fictitious cells which serve as a convenient artifice to facilitate calculating missile interactions with a cylindrical surface in an otherwise all-Cartesian system.

Chapter 14, Page 289 of 333 Revision 04, 2011

IP3 FSAR UPDATE The resulting model contained 152 compartments designated as targets or safety regions, and 377 non-safety regions. Table 14B-3 describes each of the safety regions. This table relates each region to regions of the plant fire protection system. Redundancy considerations, as discussed in the next section are also listed.

Figure 14B-7 is an example of a computer-drawn plot of an elevation slice of the plant, showing how the model was compartmentalized. Safety regions are shaded. Each rectangle is assigned a room number. Some of the more important hard-to-read room numbers are described on the side of the figure.

3.6 Redundancy of Plant Shutdown Equipment The safety of the plant following a turbine missile event is dependent upon the ability to safely shut down and maintain the core in a coolable configuration. In this analysis, it is that the cold or hot shutdown options are to be maintained. For this requirement, the following systems, along with their power sources and power and control activities must be maintained:

1. Reactor Control System (including control room, associated equipment and cabling);

2. Primary Cooling Systems (including boron control and makeup water);

3. Secondary Cooling Systems (following a turbine missile event, either the auxiliary feed system or the turbine bypass systems must be available and for the long term, the residual heat removal system must be available);

4. Component Cooling System.

All of these systems have redundant components, controls, and power circuitry so that no failure of a single item will compromise the ability to maintain a safe shutdown condition. These components and their redundancies are described in Table 14B-3. Some areas, such as the piping penetration area (fire protection region 59A), contain equipment too close together to model redundancy. In this analysis, strikes on such areas were considered to compromise plant safety.

Particular attention was paid to the service water system, which is a common target for turbine missiles. The plant has a backup service water system which can be used when the main service water system is unavailable. In order, to be conservative, P4 values were first calculated without taking credit for the backup system. Then P4 values were recalculated assuming the backup system could be used in an emergency. This is an example of an emergency procedure which allows the plant to achieve a safe shutdown despite the loss of a critical system. Results for each of these cases are discussed in Section 4.0.

4.0 Results of turbine Missile Analysis 4.1 Probability of Safety Compromise Using the MISIP code, a series of computer simulations were performed on the generation of turbine missiles. The 36 turbine discs were analyzed under various conditions. To provide good statistical accuracy for the calculation of probabilities, 2000 simulations (trials) per disc were performed. To reduce computer time, only the 18 most important discs were analyzed. These 18 discs were chosen from an examination of the P1 values and from the results of 100 trials for all discs. After choosing the 18 discs for further study, 2000 trials were performed for the following cases:

1. Breakup into 90o segments at rated speed

2. Breakup into 90o segment at 132 percent overspeed

3. Breakup into 120o segments at rated speed

4. Breakup into 120o segments at 132 percent overspeed Chapter 14, Page 290 of 333 Revision 04, 2011

IP3 FSAR UPDATE Tables 14B-4 and 14B-5 summarize probabilities of penetration and safety compromise for these discs. Table 14B-4 summarizes the results for the 90o breakup case and Table 14B-5 shows the results for 120o breakup. The probabilities were calculated using P1 values from Table 14B-1 for a 5-year inspection interval. Table 14B-6 summarizes the location of strikes on safety regions according to their designation in the MISIP code and their physical description in the plant.

The overall results of the simulation are given below for 90o and 120o segments, and for failure at rated speed and at 132 percent overspeed. The P4 values are the probabilities of safety compromise, and utilize the redundancy considerations discussed in Section 3.6. Redundancy was considered in two ways. First, credit was not taken for the backup service water system, so that missile strikes which disabled the main service water system were considered safety compromises. Then the backup service water system was included, resulting in fewer safety compromises. The greatest concern is disc failure at rated speed into 90o segments. The probability of compromising plant safety by this mechanism is 1.70 x 10-8/year, if no credit is taken for the backup service water system.

P4 Values with 2000 Trials for Five-Year Inspection Intervals No Credit for Credit Taken for Backup SW Backup SW 90o segments, rated speed 1.70E-8/yr 7.47E-9/yr 90o segments, 132 percent overspeed 8.14E-11/yr 4.73E-11/yr 120o segments, rated speed 8.40E-9/yr 1.33E-9/yr 120o segments, 132 percent overspeed 4.57E-11/yr 2.09E-11/yr 4.2 Plant Vulnerability As noted previously, not all penetrations of safety regions result in compromising the ability of the plant to achieve safe shutdown. The specific strike combinations which produce the safety compromise probability are summarized below for the various cases. In this summary, credit is taken for the backup service water system.

90o segments, rated speed

• Strikes on common electrical penetration area (MISIP target 226):

Disc 8 - 5 strikes Disc 9 - 2 strikes Disc 10 - 2 strikes Disc 16 - 1 strike Disc 17 - 1 strike Disc 21 - 1 strike Disc 25 - 2 strikes

• Strikes on the common cable spreading room area (MISIP target 529):

Disc 22 - 1 strike

• Strikes on the switchgear room, buses 3A, 6A:

Disc 36 - 1 strike

• Strikes on both the main service water pipes under the road and the backup service water valve pit area (MISIP) targets 516 and 198):

Chapter 14, Page 291 of 333 Revision 04, 2011

IP3 FSAR UPDATE Disc 22 - 1 strike 90o segments, 132 percent overspeed

• Strikes on the common electrical penetration area (MISIP target 226):

Disc 9 - 1 strike Disc10 - 4 strikes Disc 16 - 1 strike Disc 17 - 1 strike Disc 25 - 1 strike

• Strikes on the common cable spreading room area (MISIP target 529):

Disc 33 - 1 strike Disc 36 - 2 strikes

• Strikes on the piping penetration area (MISIP target 135):

Disc 16 - 1 strike Disc 17 - 1 strike Disc 20 - 2 strikes Disc 22 - 1 strike

• Strikes on both the lower and upper electrical tunnels (MISIP targets 64 and 488):

Disc 4 - 1 strike 120o segments, rated speed

• Strikes on the common electrical penetration area (MISIP target 226):

Disc 5 - 1 strike Disc 10 - 1 strike Disc 17 - 2 strikes

• Strikes on the common cable spreading room area (MISIP target 529):

Disc 36 - 2 strikes

• Strikes on the switchgear room, buses 3A, 6A Disc 10 - 1 strike 120o segments, 132 percent overspeed

• Strikes on the common electrical penetration area (MISIP target 226):

Disc 5 - 2 strikes Disc 8 - 1 strike Disc 10 - 2 strikes Disc 25 - 4 strikes

• Strikes on the common cable spreading room area (MISIP target 529):

Disc 36 - 2 strikes

• Strikes on the piping penetration area (MISIP target 135):

Disc 17 -1strike Disc 20 - 1 strike Chapter 14, Page 292 of 333 Revision 04, 2011

IP3 FSAR UPDATE As previously noted, there are several additional safety compromises if credit is not taken for the backup service water system. The vast majority of the cases involve strikes on the service water system piping under the road (MISIP target 516).

For all discs there were 87 such strikes for 90o segments at rated speed, 99 strikes for 90o segments at overspeed, 58 strikes for 120o segments at rated speed, and 43 strikes for 120o segments at overspeed. Since these pipes are under approximately eight feet of dirt, the number of penetrations of target room 516 was somewhat surprising. However, further study showed that the number of missiles which bounded off the road without penetrating the pipes below was much larger than the number of missiles which penetrated to the piping. For the 90o segments, rated speed case, there were only 87 penetrations due to 5465 hits on the road, or 1.6 percent. Given the number of times that turbine missiles strike the roadway, the calculated number of penetrations is felt to be reasonable.

Other safety compromises involved strikes on the pipes inside the concrete bunker downstream from the road (MISIP target 517) and a few cases where as many as five of six service water pump motors were struck. For target 517, there were five strikes for 90o segments at rated speed, seven strikes for 90o segments at overspeed, one strike for 120o segments at rated speed, and one strike for 120o segments at overspeed. With regard to the service water pump motors, the safety compromise resulted from:

• 90o segments, rated speed:

Disc 16 - motors 31, 32, 33, 34, 35 Disc 17 - all motors Disc 20 - motors 31, 32, 33, 35, 36 Disc 20 - all motors

• 120o segments, rated speed:

Disc 20 - motors 31, 32, 33, 35, 36 Strikes on spent fuel storage were eliminated as possibly safety compromises because only HTM strikes are possible. To produce an offsite release from spent fuel storage a leak below the level of the stored elements would be required. It is concluded that an HTM strike cannot produce such a leak.

The possibility of simultaneous missile strikes on components of the main and backup service water systems was investigated. (Each disc breakup generated at least nine missiles, allowing the possibility of simultaneous strikes on more than one location). However, only one trial out of 144,000 resulted in simultaneous hits, so this is not a safety concern.

4.3 Hazard Due to Turbine Missiles From Unit 2 An analysis of the hazard to Indian Point 3 due to turbine missiles emanating from Unit 2 was performed. A MISIP model for both units was prepared and the code was executed to track missiles form the Unit 2 turbines. One thousand trials for failure of disc 16 at rated speed, and 1000 trials for disc 17 at 132 percent overspeed were examined. Both cases considered 90o segments because an earlier study (14) found 90o segments to result in the greater hazard in Unit 2. The execution of these two cases resulted in no strikes on IP3. This is considered adequate demonstration that turbine missiles from IP2 do not pose a significant threat to IP3.

5.0 Assessment of Plant Capability to Withstand Postulated Turbine Missile Chapter 14, Page 293 of 333 Revision 04, 2011

IP3 FSAR UPDATE The previous section discussed the results of the turbine missile analysis in which the probability of compromising the safety of the plant was calculated. The risk was found to be concentrated in a small number of areas of the plant. In this section, the consequences of various turbine missile strikes will be discussed.

5.1 Consideration of Direct Loss of Reactor Coolant The Reactor Coolant System is contained inside the Reactor Containment structure. This is a reinforced concrete vertical right cylinder with a flat base and hemispherical dome. A welded steel liner with a minimum thickness of 1/4 inch is attached to the inside face of the concrete shell to ensure a high degree of leak-tightness. As shown in Figure 14B-8, the wall of the vertical cylinder is 4.5 feet thick and the dome is 3.5 feet thick.

In the turbine missile analysis, there were no simulated turbine failures that resulted in penetration of perforation of the containment. This is considered sufficient evidence that there is adequate protection against direct loss of reactor coolant.

5.2 Considerations to Maintain Plant In A Safe Shutdown Condition Rupture of a low pressure turbine disc at speeds below the emergency overspeed setpoint will trip the turbine due to loss of condenser vacuum resulting from the damage produced by the ruptured disc.

Rupture at or above this setpoint requires that turbine trip has occurred. Since the reactor trips automatically following a turbine trip, both turbine and reactor trip are assured in the event of the turbine missile incident. Hence, maintaining the plant in a safe shutdown condition requires only minimal performance of the decay heat removal, reactor coolant makeup and boration functions.

Before proceeding with the evaluation of the capability of maintaining the plant is a safe shutdown condition, the components related to the normal performance of these functions following a turbine trip and reactor trip will be identified, with due consideration given to system redundancy.

Decay Heat Removal With sufficient fluid in the Reactor Coolant System, adequate decay heat removal depends on the performance of the steam generator secondary side since the core decay heat removal is assured by the circulating reactor coolant. In the first few minutes, the reactor coolant is circulated by mechanical coastdown of the reactor coolant pumps and subsequently by natural circulation. Decay heat removal from the secondary side depends on the steam relief system and the Auxiliary Feedwater System.

The steam relief system removes thermal energy by releasing steam to the atmosphere via the steam relief valves or the condenser via the turbine bypass. For the turbine missile incident, credit cannot be taken for the turbine bypass since the bypass valves will not open with loss of condenser vacuum.

The steam dump to the atmosphere consists of five safety valves located on each of the four main steam lines outside the Containment and upstream of the no-return valves as illustrated in Figure 14A-9. The five safety valves in each main steam line are set to relieve at 1065, 1080, 1095, 1110 and 1120 psig, respectively. These twenty valves have a total capacity in excess of the equivalent nominal rated steam flow. In addition, there are four power-operated relief valves which are capable of releasing 10 percent of the equivalent nominal rated steam flow. These valves are automatically controlled by pressure or may be manually operated from the main control board or locally at the valves.

Chapter 14, Page 294 of 333 Revision 04, 2011

IP3 FSAR UPDATE The Auxiliary Feedwater System supplies high pressure feedwater to the steam generators in order to maintain a water inventory for heat removal from the Reactor Coolant System upon inoperability of the Main Feedwater System. Upon loss of condenser vacuum, the valves in the lines supplying steam to the turbine drive of main feed pumps close automatically. Hence, the Auxiliary Feedwater System must come into operation following the turbine missile incident.

The Auxiliary Feedwater System is basically composed of:

1. Two motor-driven feedwater pumps

2. One turbine-driven feedwater pump

3. Auxiliary steam admission to the drive of the turbine-driven feedwater pump

4. Auxiliary feedwater discharge piping

5. Main feedwater lines

6. Auxiliary feedwater suction piping

7. Auxiliary feedwater source.

This system was sized so that any of the auxiliary feedwater pumps can supply the required auxiliary feed. These components, except for the auxiliary steam admission to the drive of the turbine-driven feedwater pump, are illustrated in Figure 14B-10 through 14B-15. Steam to drive the turbine is supplied from two of the main steam lines upstream of the stop valves just outside of the Containment. The turbine is started by the opening of the pressure reducing valve located in the auxiliary feedwater pump room. This valve opens automatically upon loss of power.

Reactor Coolant Makeup Reactor coolant makeup is required to maintain sufficient fluid in the Reactor Coolant System to guarantee that decay heat is removed continuously from the core. At the same time, however, the boration concentration of the Reactor Coolant System should not be reduced substantially in order to maintain a sufficient shutdown margin. Hence, for the incident under consideration, the makeup source would normally be from the refueling water storage tank. Makeup from the refueling water storage tank involves the following components:

1. Refueling Water Storage Tank,

2. Discharge piping from the Refueling Water Storage Tank to the suction of the charging pumps,

3. Three (3) pumps (one is sufficient),

4. Discharge piping from the charging pumps,

5. Component Cooling system to provide cooling to the charging pump fluid drive, and

6. Service Water System to cool the component cooling water.

Boration Boration is required to compensate for the long-term xenon decay transient. The normal Boration system includes the following components:

1. Two boric acid tanks and boric acid batching tank and heaters,

2. Two boric acid transfer pumps (one is sufficient),

3. One boric acid filter,

4. Piping and heat tracing from the tanks to the suction of the charging pumps,

5. Three charging pumps (one is sufficient),

6. Discharge piping from the charging pumps to the RCS, Chapter 14, Page 295 of 333 Revision 04, 2011

IP3 FSAR UPDATE

7. Component Cooling Water System to provide cooling to the charging pump fluid drive coupling, and

8. Service Water System to cool the component cooling water.

The areas of the plant related to the normal performance of decay heat removal, reactor coolant makeup and boration functions that were shown by the missile simulation to be vulnerable to turbine missiles are the service water system, the auxiliary feedwater system, and the electrical penetration area. These areas are evaluated below as to their vulnerability and the identification of available backup systems and appropriate plant personnel actions. Other important areas, such as the steam relief system, the condensate storage tank and piping and the refueling water storage tank and piping, were not struck by simulated missiles, even after 144,000 trials.

5.2.1 Service Water System The components of the service water system which were found to be vulnerable were the service water pipes as they travel under the roadway and through the concrete bunker in the discharge canal, and to a lesser extent the pump motors. Figure 14B-16 is an overview of the service water system.

Figure 14B-17 shows how this system was represented in the MISIP code plant model.

The pipes under the roadway were found to be vulnerable to HTMs although only approximately 1.6 percent of HTMs which struck the road were able to penetrate to the piping. The pump motors were found to have sufficient separation, except in a very small number of trials, to preclude disabling the system. The system can operate with tow of three pumps in either train, so it would be necessary to damage at least two of three pumps in both trains. Figure 14B-18 shows the MISIP model for the pump motor enclosure.

As was discussed earlier, a backup service water system exists to replace the main service water system during emergencies. Only one case in 144,000 resulted in simultaneous missile strikes on components of both systems.

If all sources of service water were unavailable, the affected functions would be reactor coolant makeup and boration. Service water is required for cooling the diesel generators and removing heat from the component cooling system which cools the fluid drive coupling of the charging pumps.

As far as the diesel generators are concerned, they are not considered vital for safe shutdown since there is sufficient amount of time, about 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> to restore outside power in case it is lost following turbine disc rupture (see Section 5.3). Cooling to the charging pumps will be accommodated by making up spool piece connections to the charging pump cooling water heater that will allow direct cooling via the city water supply. Initial drainage flow would go to the floor drain and would be eventually piped outside the building. The operators will have sufficient time to open and close the manual valves as required and to make the necessary piping connections (see Section 5.3).

5.2.2 Auxiliary Feedwater System As illustrated in Figures 14B-10 through 14B-12, the auxiliary feedwater pumps, located in the auxiliary feedwater pump room, have the four-foot thick shield wall to stop a LTM and two floors of two-foot thick concrete to stop the HTM. In fact, no missile strikes were observed in the pump rooms during the analysis.

The present auxiliary feedwater discharge piping is illustrated in Figures 14B-13 and 14B-14. It is conceivable even though very unlikely, that the HTM could fall between the steam lines and possibly Chapter 14, Page 296 of 333 Revision 04, 2011

IP3 FSAR UPDATE damage all four auxiliary feedwater pipes. The area of concern is the piping run from the point they come up through the second concrete roof to the second main feedwater connection. The MISIP model separated each of the four pipes into separate cells. No cases were observed in which more than two of these cells were penetrated by missiles. If a missile lands on the auxiliary feedwater pipe runs, the ruptured lines can be isolated by closing valves located in the protected auxiliary feedwater pump room. Auxiliary feedwater to two steam generators provides adequate cooling.

A portion of main feedwater lines is required for the introduction of feedwater since the auxiliary feedwater lines are connected individually to these lines near the containment wall. Only two of these main feedwater lines need to be intact for the reasons discussed before, and this will be ensured by their separation.

5.2.3 Electrical Penetration Area This area is shown in Figures 14B-19 through 14B-21. Missile strikes were observed due to HTMs breaking through the roof, which is light weight concrete with no reinforcement and has a maximum thickness of eight inches. The MISIP model for the upper electrical penetration area is shown in figure 14B-22. It shows that there is an area in which cables from the lower electrical tunnel rise and join cables from the upper tunnel in a common penetration area. Strikes in the area were observed, and could cause some loss of instrumentation and control. However, due to physical separation at the penetration, (see Figure 14B-21) loss of all pressurizer pressure and level channels and loss of all steam generator level channels is unlikely.

5.3 Worst Case Turbine Missile Accident From the standpoint of maintaining the plant in a safe shutdown condition, the worst case accident is considered to be a loss of outside power coincident with the turbine disc rupture in which the missile makes the Service Water System inoperable. This implies that the only power available is from the station batteries (protected by the concrete structures of the control building) since the diesel generators require cooling by the Service Water system for their operation.

This section examines the above accident in two parts. First, conservative assumptions were used to establish estimates of the time available to perform manual actions that will ensure adequate decay heat removal, reactor coolant makeup and boration. The second part deals with defining the specific operator actions.

5.3.1 Time Requirements In estimating the time available for manual actions it was conservatively assumed that valves which require operator action to change their state initially remain in their state at the time of the accident.

However, those possible states that normally do not persist for extended periods were not included as possible states at the time of the accident. For example, the normal and excess letdown isolation valves were assumed to be open since they can be opened during periods where the plant is changing power. Alternately, the power operated pressurizer relief valves are normally not exercised during operation, and as such, they were assumed to be closed. The valve status shown in Table 14B-7 was assumed in this evaluation. Within the framework of these assumptions and the corresponding valve status, analyses were performed to establish the time available for manual actions and restoration of outside power. This is summarized as follows:

1. Decay Heat Removal Chapter 14, Page 297 of 333 Revision 04, 2011

IP3 FSAR UPDATE To ensure the decay heat removal function, feedwater must be provided to the steam generators within 30 minutes of reactor scram if steam generator boil-off is to be avoided. This will be assured because of the following:

a. The turbine-driven auxiliary feedwater starts on the automatic opening of the pressure reducing valve in the steam admission line to the drive of this pump;

b. The auxiliary feedwater control valves are open (normal position); and

c. The source of feedwater is gravity fed to the suction of the pump from the normally aligned (locked open gate valves) Condensate Storage Tank.

As indicated in Table 14B-7, the steam generator blowdown valves are assumed to be closed and the sample lines is small compared to the outflow from the safety valves and become even less important when the turbine-driven auxiliary feed pump is started. Thus, the open status of these valves is not critical but should be closed in about three or four hours to limit unwanted secondary side losses.

While adequate steam generator level is assured by operation of the turbine-driven auxiliary feedwater pump, there could be carryover from the steam generator turbine drive of this pump if left unattended. It is estimated that full feedwater flow from this pump would not produce water carryover within the first two hours of operation. Hence, within about two hours, it would be prudent to have the Auxiliary feedwater System under control by the operators. Steam generator level will be available via the battery-powered instrument buses.

2. Reactor Coolant Makeup In estimating the minimum time required to provide reactor coolant makeup, two cases were considered without charging or safety injection: the first corresponding to reactor coolant discharge from the normal letdown line, the excess letdown line and through the seals of the four reactor coolant pumps; and the second case with leakage only through the seals of the reactor coolant pumps. The total initial leakage rate for the first case is approximately 260 gpm and 40 gpm for the second.

The SLAP code employed in this analysis resulted in core uncoverage in approximately seven hours in the first case and 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> in the latter.

The rates of decrease of reactor coolant volume in both instances were found to be nearly linear in time. Hence, assuming it took the operators as long as two hours to close the required valves, it would require an additional 28 hours3.240741e-4 days <br />0.00778 hours <br />4.62963e-5 weeks <br />1.0654e-5 months <br /> to uncover the core with the seal pump leakage. This means that reactor coolant makeup would not be required for over 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

2. Boration To estimate the minimum time required to compensate for the xenon transient, it was assumed that at the time of the turbine incident, the xenon decay is at its maximum rate of approximately 0.13 percent per hour. This would correspond to operating the plant for a long period of time (xenon at its equilibrium value), going to a hot shutdown condition for 10 to 14 hour1.62037e-4 days <br />0.00389 hours <br />2.314815e-5 weeks <br />5.327e-6 months <br /> period and then returning to full power.

For the end-of-life (EOL) conditions, there is a 1.72 percent minimum shutdown margin requirement (assuming a stuck rod). At EOL, all rods inserted less the highest worth rod stuck out have a design worth of six percent. This is reduced by ten percent (0.6 percent) to satisfy nuclear design criteria leaving a worth of 5.4 percent.

Chapter 14, Page 298 of 333 Revision 04, 2011

IP3 FSAR UPDATE The required margin of 1.72 percent must be subtracted (5.4-1.72) leaving 3.68 percent worth available at accommodate any transient. Nuclear calculations on the depressurization transient result in a negative reactivity of 2.8 percent. Thus, for the end-of-life core with a stuck rod, a total of 3.68 percent negative reactivity would exist during the period of time without makeup or boration capability.

With the maximum positive reactivity addition rate of 0.13 percent per hour associated xenon decay, it would require an increase of 200ppm boron to compensate for the positive xenon reactivity. Borating from the boric acid tanks would take approximately 30 minutes to change the boration concentration by 200 ppm.

Taking into account the decreasing rate of positive reactivity addition at the time of the xenon decay, it would require more than 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> for the reactor to return to critical. Prior to this point in time, it would require an increase in boron concentration of about 100 ppm. This change in concentration could be made in about 15 minutes by borating from the boric acid tanks.

While boration capability itself is not required for more than 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />, the ability to borate from the boric acid tanks depends on the solubility of the borated water in the boric acid tanks and the piping from these tanks to the suction of the charging pumps. The tanks themselves would not freeze up before four or five days without power to the heaters. The borated water in the piping, on the other hand, could freeze within about an hour without power to the heat tracing. Hence, to assure borating capability at the required time, these lines must be flushed with clean water within this hour period.

To accomplish this flushing action, use will be made of the existing primary water flushing provisions.

These provisions will be further augmented by installing a cross connection (at the discharge of the boric acid tanks) to the city water supply.

Summarizing, the minimum time requirements are:

FUNCTION REQUIREMENT TIME Decay Heat Removal Feedwater to steam 1/2 hour generators*

Boration Flushing of piping between 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> boric acid tanks and charging pumps Decay Heat Removal Control of the Auxiliary 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Feedwater System Decay Heat Removal Closure of steam generator 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> sample isolation valves Makeup Closure of normal and excess 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> letdown isolation valves Boration Boration via boric acid tanks >21 hours Makeup Charging Capability 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />

• Feedwater to steam generators via the turbine-driven auxiliary feedwater pump is assured within a few minutes since operator action is not required.

5.3.2 Operator Actions Execution of the operator actions to follow will ensure that the decay heat removal, reactor coolant makeup and boration functions can be performed when required and the plant can be maintained in a safe shutdown condition for an excess of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> without any power sources other than the station batteries. However, it should be noted that shutdown could be maintained even in the event these batteries become depleted before outside power is restored.

Chapter 14, Page 299 of 333 Revision 04, 2011

IP3 FSAR UPDATE These actions pertain to those required in the first few hours following the postulated impact of the missile on the Control Room:

1. The operators have approximately 30 minutes to make sure there is sufficient auxiliary feedwater available (approximately 400 gpm). To be assured of this, the following steps are necessary:

a. Check that the pressure reducing valve on the steam admissions line to the turbine-driven auxiliary feedwater pump is open (located in the Auxiliary Feedwater Pump Room). This valve should automatically open upon loss of power. If this valve is closed, it can be opened manually.

b. Check that the auxiliary feedwater control valves are open. These are air-operated valves and fail open upon loss of air. These valves, located in the Auxiliary Feed Pump Room, can be opened manually.

2. To make sure that the inventory of water in the steam generators remains sufficient, within about one hour the operators must:

a. Check that the steam generator blowdown valves are closed (these valves may or may not be open depending on the mode of plant operation). These valves are air-operated and fail closed.

b. Close the normally open steam generator sample isolation valves (these valves are also air operated and fail closed).

3. To assure that boration from the boric acid tanks can be accomplished when required (>21 hours),

the operators have approximately one hour to flush the piping between the boric acid tanks and the suction of the charging pumps. This can be accomplished by connecting the city water supply to the flushing valve at the discharge of the boric acid tanks and opening the drain valves at the suction of the charging pump. Once the flushing operation is complete, these valves can be closed and the lines will be available for the boration operation.

4. To prevent water carryover from the steam generators to the drive of the turbine-driven auxiliary feedwater pump, within about two hours, the operators should have control of this system. Control can be maintained from the Control Room by remote manual operation of the air-operated auxiliary feedwater control valves. Steam generator level indicators, powered by the battery-operated instrument buses, are available in the Control Room. Flow measurement devices are installed in the discharge lines to each steam generator with indicators, also battery-operated, on the control board. The instruments provide the operator with the information necessary to properly route the discharge flow through the remote manual auxiliary feedwater flow control valves.

5. Within about two hours the Reactor Coolant Pressure Boundary must be assured. This can be accomplished from the Control Room by remote manual operation of the air-operated normal and excess letdown line isolation valves. There is no reason why these lines could not be isolated sooner; the two-hour time period is given as an estimate for how long these valves could remain open without presenting any particular problem in maintaining the plant in a safe shutdown condition.

6. Before boration and reactor coolant makeup can be initiated via a charging pump in the specified time period (21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> for borating and 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> for makeup), cooling to the drive of the charging pumps must be provided. As discussed earlier, this cooling is accommodated by making permanent connections to the charging pump cooling water header that allows drive cooling from the city water supply. To make use of these permanent connections, the operators must attach a spool piece to the permanent flange connection upstream of the new isolation valves on the inlet Chapter 14, Page 300 of 333 Revision 04, 2011

IP3 FSAR UPDATE side of the charging pump cooling water header. Cooling can be initiated by closing the existing cooling water header isolation valves and opening the new isolation and drain valves.

Upon completion of these six steps, the city water supply should be aligned to the suction of the auxiliary feedwater pumps since the Condensate Storage Tanks contain a limited supply of water (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> minimum). The air operated valve in the city water line can be opened remotely from the Control Room or from the Auxiliary Feedwater Pump Room with the nitrogen bottles located there.

With the restoration of outside power, the plant can now be maintained in the hot shutdown condition almost indefinitely.

The operators may now take steps to align the equipment required for plant cooldown.

5.4 Consequences of Radioactivity Releases The possibility of turbine missile causing release of fission product activity has been considered. The Reactor Coolant System is protected by the Containment. The gas decay tanks, the volume control tank, and demineralizers are protected by the auxiliary building structure. The liquid holdup tanks are protected by the holdup tank vault structure.

To produce an offsite release from spent fuel storage, a leak below the level of the stored elements would be required. It is concluded that a HTM strike cannot produce such a leak. However, should a HTM land in the spent fuel pit pool from above, damage to some spent fuel assemblies would occur.

The impact area of a quarter disc would affect several storage cells. The analysis considered damage to one row around four cells with a maximum of 18 cells damaged. Damage to fuel in these cells would not result in criticality. Although no credible release mechanism is envisioned, doses due to the release of this material were calculated. For the purpose of determining the limiting site boundary dose, it was assumed that these assemblies are all freshly removed from the core having decayed only 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> since plant shutdown.

Two cases were considered:

1. An expected case, in which the expected characteristics of the six highest rated assemblies normally to be discharged at end-of-life are assumed, along with best estimate behavior or fission products determined by tests.

2. A design care, in which factors are introduced to allow for uncertainties.

The expected case is summarized is Table 14B-8. The resultant maximum site boundary doses were calculated to be 16.5 rem thyroid and 2.0 rem whole body. The design case is summarized in Table 14B-9. The resultant maximum site boundary doses were calculated to be 57 rem thyroid and 4.2 rem whole body.

Assuming a turbine missile is ejected, the probability of it hitting the fuel pool was calculated to 3.2 x 10-4.

Should a turbine missile hit the vicinity of the steam lines, no more than two steam lines could be damaged. Activity release would be dependant on RCS activity from operation with fuel defects and steam generator tube leakage, if any, during the period to cool and depressurize the RCS after the accident.

With RCS activity concentration corresponding to operation with one percent clad defects and a 10 gm tube leak for eight hours, the released activity from the RCS leakage for the duration of the Chapter 14, Page 301 of 333 Revision 04, 2011

IP3 FSAR UPDATE accident is 4570 Ci equivalent Xe-133 and 4.6 Ci equivalent I-131. In addition, the iodine activity in the two steam generators which blowdown is 5.6 Ci equivalent I-131. The site boundary dose would be 5.4 rem thyroid and 0.2 rem whole body.

The Refueling Water Storage Tank and the monitor tanks, with low probability, may be struck by a turbine missile. The maximum tritium concentration in the Refueling Water Storage Tank should not exceed 2.5 uc/cc corresponding to a total of 3300 Ci tritium in the tank. The maximum concentration of tritium in the river at Chelsea form a burst release of this tritium would be 7.5 x 10 -7 uc/cc which is 2.5 x 10 -4 MPC. The release of the activity contained in a monitor tank to the river is given in Table 14B-10. The resultant river concentrations at Chelsea are less than 10 -7 MPC.

It is concluded that the probability of a turbine missile causing a large release of fission product activity is very low. Further, with worst case assumptions, the turbine missile would not cause offsite exposure in excess of the 10CFR 100 guideline.

6.0 Low Pressure Steam Bypass for Turbine Overspeed Protection 6.1 Description The Low Pressure Steam Bypass System has been provided to ensure that turbine design overspeed will not be exceeded in the event of a complete loss of electrical load. For this trip, it is necessary to divert directly to the condenser a portion of the heat energy stored within the turbine system. (The design overspeed value would be exceeded if this energy were released through the turbines). The bypass system was designed to nuclear protection system criteria of redundancy, separation, and reliability. Cables associated with dump valves operation and position indication are color-coded with the appropriate color for that channel (i.e., Red - Channel I, White - Channel II) at intervals along the cable. Each cable has a specific path through the raceway system and is provided with permanent markers at each end, cross referencing the cable schedule. In addition, the raceways in the turbine hall were laid out and installed specifically for protection systems are contained in these raceways.

Reliability has been designed into the system, primarily through the separation of the actuating signals, the multiplicity of dump valves and steam dump routes and component redundancies.

System performance is assured in the event of a single failure.

In operation, the bypass system takes steam from the moisture separator reheater steam supply lines (cross-under piping), through six 10-inch bypass lines, three on either side of the turbine, which originates from the cross-under piping. Each bypass line has a normally closed 10-inch bypass control upstream. Each dump valves discharges into a 12-inch pipe, which, in turn, communicates with its associated condenser half-section through a breakdown orifice. The total bypass capacity of the Low Pressure Steam Dump System has been designed such that for maximum calculated gross electrical power, any four of the six dump valves will have sufficient capacity to relieve the amounts of steam needed for proper turbine speed control. Each of the dump valves is provided with redundant 3-way solenoid valves (i.e., A and B solenoids installed in the individual air supply lines).

6.2 Operation The low pressure steam bypass is activated on any unit trip signal (86P and 86BU relays) or any mechanical fault that initiates a turbine auto-stop signal (loss of auto-stop oil). The primary unit trip signal (86P) or the back-up unit trip signal (86BU) operate on any electrical fault. The auto-stop oil signals originate from a two-out-of-three matrix made up of contacts on control oil pressure switches.

Chapter 14, Page 302 of 333 Revision 04, 2011

IP3 FSAR UPDATE An 86P or an 86 BU signal will initiate a circuit to energize the A solenoid, while an auto-stop signal will initiate a circuit to energize the A solenoid, while an auto-stop signal will initiate a circuit to energize the B solenoid, thereby causing the dump valve to open.

Through normally open during plant operation, the motor-operated isolation valves are used to isolate each associated dump line when testing of the dump valves is required, or when a dump valve is inoperable, or during that time when the associated main circulation pump is inoperable. This is done to preclude damage to a drained (uncooled) section of the condenser, should a dump valves open spuriously or otherwise. (Note: the turbine condenser is composed of six sections, each of which is separately cooled by its associated main circulating pump for a total of six pumps). The isolating valves are closed individually. Red and green indicating lights are located in the control / test panel to monitor the position of the isolation and dump valves. Also, valve position limit switches will provide an annunciation in the Control Room when any of the isolation valves leave their full open position.

For occasions when less than six of the Low Pressure steam dump valves and dump lines are available, limitations on plant gross electrical output are established in the Technical Requirements Manual.

6.3 Testing Provisions This system can be tested during power operation. The dump valves are to be tested individually and periodically in accordance with the Technical Requirements Manual. The signal reception and logic circuits are provided with test switches and indicating lights to permit individual testing of each channel. The actual operation of each dump valves is to be tested and monitored separately.

7.0 Conclusions This analysis is based on protection from an offsite release. In this regard, the current design coupled with emergency procedures is certainly adequate. The overall probability of compromising the plants ability to achieve a safe shutdown due to turbine missiles is less than the 10CFR100 acceptance criteria of 10-7 per year.

The area of the plant that is most at risk is the Service Water System. Of those simulated missiles that entered areas of the plant containing safety-related equipment, the majority entered Service Water System components. However, this should not be considered a source of concern because in only a few of these cases were a sufficient number of components damaged as to disable the system.

Most of these were due to strikes on the piping under the road, while a few cases resulted in strikes on 2 of 3 pump motors in each safety train. Additional shielding in these areas might reduce the number of safety compromises, but with the low frequency of safety compromises and the number of safety compromises, but with the low frequency of safety compromises and the ability of the backup water system to perform the same functions, such shielding is not considered necessary.

Besides the Service Water System, the other major areas of concern involve locations where electrical cables from both safety trains share a common room. This was found is the cable spreading room, at the start of the electrical tunnels, and in the electrical penetration area. Also, in the switchgear room, the four buses are relatively close together. Again, because of the low probability of safety compromise, no remedial action is necessary.

In fact, the model is conservative in that is does not consider the shielding effect that the upper cable trays would have relative to the lower cable trays. Therefore, the probability of safety compromise may actually be lower than was calculated in this study.

Chapter 14, Page 303 of 333 Revision 04, 2011

IP3 FSAR UPDATE In conclusion, it is felt that the results of this study show that Indian Point 3 plant is adequately protected from damage due to missiles generated by turbine failure. The probability that the plant will be unable to maintain a safe shutdown or that an offsite release will occur is well below the 10 CFR100 acceptance criteria.

References

1. Title 10, Code of Federal Regulations, Part 100 (10CFR100) Reactor Site Criteria, Office of Federal Regulations, Washington, DC.

2. Turbine Missile Report - Results of Probability Analysis of Disc Rupture and Missile Generation, Westinghouse Electric Corporation, (Proprietary Data), May 1984.

3. The MIDAS Code Volume 1, Description, SAI/SR-12, Science Applications, Inc., June 1974.

4. Johnson, B. W. et al., Analysis of the Turbine Missile Hazard to the Nuclear Thermal Power Plant at Pebble Springs, Oregon, Portland General Electric Company, PGE-2012, January 1976.

5. Turbine Missile Report (HP96 - LP81 - LP81 - LP81), CT - 24081, Rev. 2, Westinghouse Electric Corporation, August 1982.

6. Rotor Missile Report LP-3 Refurbished Rotor, CT - 25210.

7. Missile Report for Turbines with 40-Inch Last Row Blades at Design, Intermediate and Destructive Overspeed, Report 296/380, Westinghouse Electric Co., June 1975.

8. Sliter, G. E., Assessment of Empirical Concrete Impact Formulae, Journal of the Structural Division, ASCE, Vol. 106, No. ST, May 1980.

9. Sliter, G. E. Status of EPRI Turbine Missile Research Program, Eighth Water Reactor Safety Research Information Meeting, October 1980.

10. Johnson, B. W., Energy of Missiles Ricocheting from Concrete Walls. Draft Report, SAI-75-506-SV, Science Application, Inc., October 1975.

11. Vasallo, F. A., Missile Impact Testing of Reinforce Concrete Panels, Calspan Report No. HC-5609-D-1, January 1975, (Prepared for Bechtel Corporation, San Francisco, California).

12. Hagg, A. C. and G. O. Sankey, The Containment of Disc Burst Fragments by Cylindrical Shells, Research Report 73-1E7-STGRO-R1. See also Journal of Engineering for Power, TRANS.

ASME, pp. 114-123, April 1974.

13. Finn, S. P. and B. W. John, Turbine Missile Analysis for Indian Point 3 Nuclear Generating Station With Replacement LP-2 Rotor, SAIC84/3151, Science Applications International Corp., November 1984.

14. Johnson, B. W. and D. W. Buckley, Analysis of Hazards to the Indian Point 2 Nuclear Generating Station Due to Missiles Generated by Turbine Failures, SA101381-138LJ/F, Science Applications, Inc., January 1982.

Chapter 14, Page 304 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14B-1 P1 Valves for IP3 Turbine Discs 100 Percent 132 Percent Disc 18-Month* 3-Year 5-Year 18-Month 3-Year 5-Year Number 1 5.65E-10 4.60E-9 2.69E-7 1.19E-11 5.20E-10 1.47E-8 2 2.14E-14 3.58E-12 5.08E-10 1.02E-14 9.42E-13 6.48E-11 3 1.05E-13 1.43E-11 1.58E-9 1.27E-14 1.13E-12 7.38E-11 4 1.35E-8 4.84E-7 1.03E-5 4.43E-10 1.07E-8 1.41E-7 5 1.77E-8 6.15E-7 1.27E-5 3.76E-10 9.39E-9 1.29E-9 6 0 0 0 0 0 0 7 0 0 0 0 0 0 8 2.22E-9 2.25E-7 5.61E-6 1.28E-10 3.74E-9 6.21E-8 9 2.39E-8 7.92E-7 1.54E-5 7.30E-10 1.64E-8 1.97E-7 10 4.36E-12 4.06E-10 2.78E-8 3.83E-13 2.33E-11 9.46E-10 11 7.85E-12 6.78E-10 4.31E-18 5.00E-12 1.98E-10 4.97E-9 12 3.80E-13 5.32E-11 6.04E-9 1.02E-12 8.21E-12 4.79E-10 13 2.91E-13 4.24E-11 5.07E-9 6.50E-14 5.66E-12 3.59E-10 14 2.75E-16 6.77E-14 1.55E-11 3.07E-16 3.93E-14 4.04E-12 15 1.22E-14 2.05E-12 2.93E-10 1.95E-15 2.12E-13 1.76E-11 16 2.19E-12 2.38E-10 1.99E-8 1.51E-13 1.02E-11 4.78E-10 17 5.20E-11 4.22E-9 2.41E-7 1.26E-12 6.74E-11 2.36E-9 18 0 0 0 0 0 0 19 0 0 0 0 0 0 20 1.01E-10 7.79E-9 4.14E-7 1.79E-12 9.27E-11 3.12E-9 21 6.70E-12 6.61E-10 4.84E-8 3.79E-13 2.32E-11 9.49E-10 22 3.12E-12 3.00E-10 2.15E-8 2.81E-13 1.77E-11 7.52E-10 23 1.27E-13 1.75E-11 1.96E-9 7.35E-14 5.22E-12 2.62E-10 24 6.65E-11 5.42E-9 3.17E-7 9.65E-11 4.57E-10 1.40E-8 25 1.17E-12 1.46E-10 1.44E-8 2.67E-13 1.94E-11 9.94E-10 26 4.24E-14 6.53E-12 8.39E-10 2.59E-14 2.08E-12 1.21E-10 27 6.30E-15 1.14E-12 1.78E-10 9.75E-16 1.14E-13 1.04E-11 28 2.16E-8 7.26E-7 1.43E-5 6.40E-10 1.46E-8 1.80E-7 29 3.00E-8 9.75E-7 1.84E-5 6.05E-10 1.41E-8 1.78E-7 30 0 0 0 0 0 0 31 0 0 0 0 0 0 32 3.60E-8 1.14E-6 2.09E-5 6.85E-10 1.57E-8 1.93E-7 33 8.75E-9 3.33E-7 7.59E-6 2.98E-10 7.62E-9 1.08E-7 34 2.35E-15 4.66E-13 8.19E-11 3.97E-16 5.09E-14 5.18E-12 35 2.63E-13 3.36E-11 3.42E-9 1.51E-13 9.78E-12 4.40E-10 36 8.90E-11 8.91E-10 6.72E-8 2.10E-12 1.16E-10 4.32E-9 Total 1.55E-7 5.16E-6 1.017E-4 4.02E-9 8.55E-8 1.01E-6

• Length of turbine inspection interval.

Chapter 14, Page 305 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-2 Exit Disc and Fragment Missile Properties for Each Segment for LP-1 & LP-3 (Ref. 6) 90O SEGMENTS 100 PERCENT RATED 132 PERCENT OVERSPEED SPEED DISC or EXIT EXIT EXIT EXIT MISSILE FRAGMENT VELOCITY KINETIC VELOCITY KINETIC Weight (lbs.) (ft/sec) ENERGY (ft/sec) ENERGY (X106ft/sec) (X106ft/sec) 2570 Disc No. 1 2550 Contained Contained Contained Contained 2065 Fragment 1 245 Fragment 2 Fragment 3 2705 156 1.02 238 2.38 Disc No. 2 2825 155 1.05 236 2.44 350 172 0.16 251 0.34 Fragment 1a 2745 158 1.07 240 2.45 Fragment 2a 340 175 0.16 254 0.34 Fragment 1b Fragment 2b 3725 217 2.72 311 5.59 Disc No. 3 2955 217 2.14 311 4.43 390 206 0.26 - -

Fragment 1 145 - - 489 0.54 Fragment 2 Fragment 2 3040 330 5.15 471 10.47 Disc No. 4 310 330 0.52 471 1.07 705 240 0.63 342 1.28 Fragment 1 Fragment 2 3315 379 7.38 523 14.06 Disc No. 5 345 379 0.77 523 1.46 Fragment 1 (No Number 2) 3905 412 10.30 560 19.00 Disc No. 6 375 412 0.99 560 1.82 1065 167 0.46 227 0.85 Fragment 1 Fragment 2 a LP-1 b LP-3

• Exit missile of less than 100,000 ft-lb are not reported.

Chapter 14, Page 306 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-2 (Cont.)

Exit Disc and Fragment Missile Properties for Each Segment for LP-1 & LP-3 (Ref. 6) 120O SEGMENTS 100 PERCENT RATED 132 PERCENT OVERSPEED SPEED DISC or EXIT EXIT EXIT EXIT MISSILE FRAGMENT VELOCITY KINETIC VELOCITY KINETIC Weight (lbs.) (ft/sec) ENERGY (ft/sec) ENERGY (X106ft/sec) (X106ft/sec) 4325 Disc No. 1 3400 Contained Contained Contained Contained 2755 Fragment 1 330 Fragment 2 Fragment 3 3605 122 0.83 195 2.13 Disc No. 2 3825 121 0.87 193 2.21 470 142 0.15 211 0.32 Fragment 1a 3720 123 0.88 196 2.23 Fragment 2a 455 144 0.15 214 0.32 Fragment 1b Fragment 2b 4970 176 2.39 260 5.21 Disc No. 3 3970 176 1.91 260 4.16 520 * * - -

Fragment 1 195 - - *

• Fragment 2 Fragment 2 4055 256 4.12 368 8.55 Disc No. 4 410 256 0.42 368 0.86 940 202 0.59 291 1.24 Fragment 1 Fragment 2 4415 313 6.71 430 12.66 Disc No. 5 460 313 0.70 430 1.32 Fragment 1 (No Number 2) 5210 356 10.25 479 18.59 Disc No. 6 500 356 0.98 479 1.79 1425 178 0.70 240 1.27 Fragment 1 Fragment 2 a LP-1 b LP-3

• Exit missile of less than 100,000 ft-lb are not reported.

Chapter 14, Page 307 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-3 Summary of Indian Point 3 Critical Area Modeling Fire Protection Area Missile Code Designation Remarks Designation (System No.)*

1 Component Cooling Pumps 293, 294, 485 (1, 4) Each pump is redundant

& Cabling 2 Containment Spray Pumps 312, 482 (4) Each pump is redundant

1. 31, 32 2A Primary Make-up Water 298, 299, 309 (2) Protected from missile strikes System 3 RHR Pump #31 250 (2) Redundant with other RHR pump 4 RHR Pump #32 252 (2) Redundant with other RHR pumps 9A RHR Pump 249 (2) Redundant with other RGR pumps 69A RHR Piping and Valves 251 (2) 12A Valve Corridor 259, 260 (2) 3A Piping Tunnel 295, 296, (2, 3, 4) Protected from missile strikes 5A, 58A Piping Tunnels 263, 264, 265, 275, 279, 280, Protected from missile strikes 281, 283, 284, 285, 286, 287, 288, 289 (2, 3, 4) 6A Valve Room 272 (2) 7A Lower Electrical Tunnel 64, 67, 262, 267, 417, 489 (1) Redundant with upper electrical tunnel 74A Lower Electrical 90 (1) Redundant with upper Penetration Area electrical penetration area 60A Upper Electrical Tunnel 184, 185, 391, 418, 488, 490 Redundant with lower (1) electrical tunnel 73A Upper Electrical 129, 226, 227 (1) Redundant with lower Penetration Area electrical penetration area 73A Common Electrical Pen 226 (1) Cables from lower tunnel rise Area and join cables from upper tunnel 8 Boric Acid Transfer Pumps 350 (2) 8A RHR HXs 235 (2) Protected from missile strike 9 Safety Injection Pumps #31, 235 (2) Protected from missile strike 32, 33

• 1 is control system 2 is primary cooling system 3 is secondary cooling system 4 is component cooling system Chapter 14, Page 308 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-3 (Cont.)

Summary of Indian Point 3 Critical Area Modeling Fire Protection Area Missile Code Designation Remarks Designation (System No.)*

10A Valve Corridor 236 (2) Protected from missile strike 10 Diesel Generator #31 and 448, 451 (1) Redundant with other power FD Tank supplies 101A D/G #32 and FD Tank 449, 452 (1) Redundant with other power supplies 102A D/G #33 and FD Tank 450, 453 (1) Redundant with other power supplies 11 Cable Spreading Room 429, 430, 432, 434, 435, 436, Redundant with diesels -

439, 442, 443, 444, 445 (1) plant can isolate one diesel 11 Cable Spreading Room 529 (1) All cables join before entering Common Area electrical tunnels 11 MG Sets #31, 32 431, 433 (1) Redundant with other power supplies 11 Reactor Trip Breakers 440, 441 (1) Redundant with control room 12, 13 Battery Rooms 437, 438 (1) Redundant with other power supplies 14 Switchgear Room, Bus 3A 420 (1) Redundant with other buses 14 Switchgear Room, Buses 421 (1) Region overlaps the two 3A, 6A buses 14 Switchgear Room, Bus 6A 422 (1) Redundant with other buses 14 Switchgear Room, Buses 423 (1) Region overlaps the two 3A, 2A buses 14 Switchgear Room, All 424 (1) Region overlaps all buses buses 14 Switchgear Room, Buses 425 (1) Region overlaps the two 6A, 5A buses 14 Switchgear Room, 2A 426 (1) Redundant with other buses 14 Switchgear Room, Bus 2A, 427 (1) Region overlaps the two 5A buses 14 Switchgear Room, Bus 5A 428 (1) Redundant with other buses 15 Control Room 446 (1) Safe shutdown capability from local control stations

• 1 is control system 2 is primary cooling system 3 is secondary cooling system 4 is component cooling system Chapter 14, Page 309 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-3 (Cont.)

Summary of Indian Point 3 Critical Area Modeling Fire Protection Area Missile Code Designation Remarks Designation (System No.)*

17A Large PAB Area:

Motor Control Centers 314 (1)

Air Receivers 357 (1) Control valves fail in safe position.

N2 Storage 359 (1) Redundant with air system.

Component Cooling HXs 346, 352 (4) Each redundant 27A Large PAB Area:

Top of Comp. Cooling HXs 479, 480 (4) Each Redundant Comp. Cooling Surge Tanks 378, 478 (4) Each Redundant Boric Acid Tanks 386, 481 (2) Each Redundant 20A Pipe Chase 319 (2) 23A Pipe Chase 338, 382 (2) 25A Seal Water HX 373 (2) 28A Valve Corridor 365, 366 (2) 29A Volume Control Tank 363 (2) 32A Non-regenerative HX 377 (2) 23 Aux. Feedwater Pumps 100 (3) Protected from missile strikes 52A Aux. Feedwater Piping 101 (3) Protected from missile strikes Cables 57A Feedwater Stop & Check 99, 102, 232, 233 (3) All redundant Valves 55A Service Water Pump 497 (4) Two of three pumps in either Motor #33 train required 55A Service Water Pimp 498 (4) Two of three pumps in either Motor #34 train required 55A Service Water Pump 500 (4) Two of three pumps in either Motor #32 train required 55A Service Water Pump 501 (4) Two of three pumps in either Motor #31 train required 55A Service Water Pump 502 (4) Two of three pumps in either Motor #36 train required 55A Service Water Pump 504 (4) Two of three pumps in either Motor #36 train required 55A Service Water Strainer 505 (4) Two of three strainers in either

1. 36 train required

• 1 is control system 2 is primary cooling system 3 is secondary cooling system 4 is component cooling system Chapter 14, Page 310 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-3 (Cont.)

Summary of Indian Point 3 Critical Area Modeling Fire Protection Area Missile Code Designation Remarks Designation (System No.)*

55A Service Water Strainer 506 (4) Two of three strainers in either

1. 35 train required 55A Service Water Strainer 507 (4) Two of three strainers in either

1. 34 train required 55A Service Water Strainer 508 (4) Two of three strainer in either

1. 33 train required 55A Service Water Strainer 509 (4) Two of three strainers in either

1. 32 train required 55A Service Water Strainer 510 (4) Two of three strainers in either

1. 31 train required 55A Service Water Pipes 516, 517 All pipes passing under road and through concrete bunker 55A Service water Valve Pit 524, 525 Essential service water 55A Service water Valves Pit 526 Overlap of essential and non-essential service 55A Service Water Valve Pit 527 Non-essential service water Backup Service Water 197 (4) Redundant with main service Pump Yard water 198 (4) Redundant with main service Backup Service Water water Valve Pit Area 59A Piping Penetration Area 127, 130, 135 (2, 3, 4) Region 127 is empty space -

missile strikes do not cause safety compromise 105A Primary Water Storage 156 (2) Redundant with RWST Tank 106A Refueling Water 471 (2)

Storage Tank 552, 553 Condensate Storage 491 (2)

Tank Offsite Feeder 85 (1) Redundant with other power supplies 90A, 91A Spent Fuel Storage 176 Can be struck by HTMs only, but strikes cannot cause offsite release

• 1 is control system 2 is primary cooling system 3 is secondary cooling system 4 is component cooling system Chapter 14, Page 311 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-3 (Cont.)

Summary of Indian Point 3 Critical Area Modeling Fire Protection Area Missile Code Designation Remarks Designation (System No.)*

Additional control cabling 200, 201, 202, 203, 204, 205 Redundant with additional between control room and (1) control cabling between containment turbine building and containment Additional control cabling 213, 216, 218, 220 (1) Redundant with additional between turbine building and control cabling between containment control room and containment

• 1 is control system 2 is primary cooling system 3 is secondary cooling system 4 is component cooling system Chapter 14, Page 312 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-4 Chapter 14, Page 313 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-6 Chapter 14, Page 314 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-7 Chapter 14, Page 315 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-8 Chapter 14, Page 316 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-9 Chapter 14, Page 317 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14B-10 Chapter 14, Page 318 of 333 Revision 04, 2011

IP3 FSAR UPDATE APPENDIX 14C EVALUATION MODELS AND PARAMETERS FOR ANALYSIS OF RADIOLOGICAL CONSEQUENCES OF ACCIDENTS This appendix contains the parameters and models that form the basis of the radiological consequences analyses for the various postulated accidents.

14C.1 Offsite Dose Calculation Models Radiological consequences analyses are performed to determine the total effective dose equivalent (TEDE) doses associated with the postulated accidents. The determination of TEDE doses takes into account the committed effective dose equivalent (CEDE) dose resulting from the inhalation of airborne activity (i.e., the long-term dose accumulation in the various organs) as well as the effective dose equivalent (EDE) dose resulting from immersion in the cloud of activity.

14C.1.1 Immersion Dose (Effective Dose Equivalent)

Assuming a semi-infinite cloud, the immersion doses are calculated using the equation:

Dim = DCFi R ij ( /Q ) j i j where: Dim = Immersion (EDE) dose (rem)

DCFi = EDE dose conversion factor for isotope i (rem-m3/Ci-s)

Rij = Amount of isotope i released during time period j (Ci)

(/Q)j = Atmospheric dispersion factor during time period j (s/m3) 14C.1.2 Inhalation Dose (Committed Effective Dose Equivalent)

The CEDE doses are calculated using the equation:

DCEDE = DCFi R ij (BR ) j ( /Q ) j i j where: DCEDE = CEDE dose (rem)

DCFi = CEDE dose conversion factor for isotope I (rem/Ci)

Rij = Amount of isotope i released during time period j (Ci)

(BR)j = Breathing rate during time period j (m3/s)

(/Q)j = Atmospheric dispersion factor during time period j (s/m3) 14C.1.3 Total Effective Dose Equivalent (TEDE)

The TEDE doses are the sum of the EDE and the CEDE doses.

14C.2 Control Room Dose Models Chapter 14, Page 319 of 333 Revision 04, 2011

IP3 FSAR UPDATE Radiological consequences analyses are performed to determine the TEDE doses associated with the postulated accident. The determination of TEDE doses takes into account the CEDE dose resulting from the inhalation of airborne activity (that is, the long-term dose accumulation in the various organs) as well as the EDE dose resulting from immersion in the cloud of activity.

14C.2.1 Control Room Model The control room is modeled as a discrete volume. The filtered and unfiltered inflow to the control room and the recirculation cleanup flow are used to calculate the activity in the control room. The control room parameters modeled in the analyses are presented in Table 14C-1.

14C.2.2 Immersion Dose Model Due to the finite volume of air contained in the control room, the immersion dose for an operator occupying the control room is substantially less than it is for the case in which a semi-infinite cloud is assumed. The finite cloud doses are calculated using the geometry correction factor from Murphy and Campe (Reference 1).

The equation is:

1 Dim = DCFi (IAR )ij O j GF i j where: Dim = Immersion (EDE) dose (rem)

GF = Control room geometry factor

= 1173/V0.338 V = Volume of the control room (ft3)

DCFi = EDE dose conversion factor for isotope i (rem-m3/Ci-s)

(IAR)ij = Integrated activity for isotope i in the control room during time period j (Ci-s/m3)

Oj = Fraction of time period j that the operator is assumed to be present 14C.2.3 Inhalation Dose Model The CEDE doses are calculated using the equation:

DCEDE = DCFi (IAR )ij (BR ) j O j i j where: DCEDE = CEDE dose (rem)

DCFi = CEDE dose conversion factor (rem per curie inhaled) for isotope i (IAR)ij = Integrated activity for isotope i in the control room during time period j (Ci-s/m3)

(BR)j = Breathing rate during time period j (m3/s)

Oj = Fraction of time period j that the operator is assumed to be present Chapter 14, Page 320 of 333 Revision 04, 2011

IP3 FSAR UPDATE 14C.2.3 Total Effective Dose Equivalent (TEDE)

The TEDE doses are the sum of the EDE and the CEDE doses.

14C.3 General Analysis Parameters 14C.3.1 Source Terms The sources of radioactivity for release are dependent on the specific accident. Activity may be released from the primary coolant, from the secondary coolant, and from the core if the accident involves fuel failures. The radiological consequences analyses use conservative design basis source terms.

14C.3.1.1 Primary Coolant Source Term The design basis primary coolant source terms are listed in Table 9.2-5. These source terms are based on continuous plant operation with 1.0-percent fuel defects. The remaining assumptions used in determining the primary coolant source terms are listed in Table 9.2-4.

The accident dose analyses take into account a reduction in the primary coolant source terms for iodines below those listed in Table 9.2-5, consistent with the Tech Spec limit of 1.0 Ci/g dose equivalent I-131 (these iodine concentrations are provided in Table 14C-2).

The radiological consequences analyses for certain accidents also take into account the phenomenon of iodine spiking which causes the concentration of radioactive iodines in the primary coolant to increase significantly. The iodine spike may be a pre-existing spike or a spike that is initiated by the accident transient or associated reactor trip. The pre-existing spike is an iodine spike that occurs prior to the accident and for which the peak primary coolant activity is reached at the time the accident is assumed to occur. The pre-existing spike is assumed to be 60 Ci/g dose equivalent I-131 (Table 14C-2 lists the concentrations of iodine isotopes associated with a pre-existing iodine spike). The probability of this adverse timing of the iodine spike and accident is small.

Although it is unlikely for an accident to occur at the same time that an iodine spike is at its maximum reactor coolant concentration, for many accidents it is expected that an iodine spike would be initiated by the accident or by the reactor trip associated with the accident. Table 14C-3 lists the iodine appearance rates (rates at which the various iodine isotopes are released from the core to the primary coolant by way of the assumed cladding defects) for normal operation. The appearance rates during an iodine spike are assumed to be as much as 500 times the normal appearance rates.

14C.3.1.2 Secondary Coolant Source Term The secondary coolant source term used in the radiological consequences analyses is conservatively assumed to be 10 percent of the primary coolant equilibrium source term. This is consistent with the Tech Spec limit on iodine in the secondary coolant.

Because the iodine spiking phenomenon is short-lived and there is a high level of conservatism for the assumed secondary coolant iodine concentrations, the effect of iodine spiking on the secondary coolant iodine source terms is not modeled.

Chapter 14, Page 321 of 333 Revision 04, 2011

IP3 FSAR UPDATE There is assumed to be no secondary coolant noble gas source term because the noble gases entering the secondary side due to primary-to-secondary leakage enter the steam phase and are discharged via the condenser air removal system.

14C.3.1.3 Core Source Term Table 14C-4 lists the core source terms at shutdown for an assumed three-region equilibrium cycle at end of life after continuous operation at 2 percent above full core thermal power. In addition to iodines and noble gases, the source terms listed include nuclides that are identified as potentially significant dose contributors in the event of a degraded core accident. The design basis loss-of-coolant accident analysis is not expected to result in significant core damage, but the radiological consequences analysis assumes severe core degradation.

14C.3.2 Nuclide Parameters The radiological consequence analyses consider radioactive decay of the subject nuclides prior to their release, but no additional decay is assumed after the activity is released to the environment.

Table 14C-5 lists the decay constants for the nuclides of concern.

Table 14C-5 also lists the dose conversion factors for calculation of the CEDE doses due to inhalation of iodines and other nuclides and EDE dose conversion factors for calculation of the dose due to immersion in a cloud of activity. The CEDE dose conversion factors are from EPA Federal Guidance Report No. 11 (Reference 2) and the EDE dose conversion factors are from EPA Federal Guidance Report No. 12 (Reference 3).

14C.3.3 Atmospheric Dispersion Factors Section 14.3.5 lists the off-site short-term atmospheric dispersion factors (/Q). Table 14C-6 (Sheet 1 of 2) reiterates these /Q values.

The ARCON96 computer code (Reference 4) was utilized to determine the X/Q values at the control room intake. The ARCON96 analysis for Indian Point 3 considered five release locations: a containment surface leak, the side of the Auxiliary Boiler Feed Building, the safety valve discharge (also identified as organ pipes) located on the Auxiliary Boiler Feed Building, the atmospheric dump valves discharge (also identified as the silencers) located on the Auxiliary Boiler Feed Building, and the containment vent. These correspond to potential release points for various accident scenarios.

Additional conservatisms were added to the calculations:

1. The initial plume standard deviations used were equal to one-sixth of the width and available height of the containment.

2. The initial horizontal plume dimension for vent releases is the equivalent vent diameter divided by six.

3. All vertical velocities were set to zero.

The atmospheric dispersion factors (/Q) to be applied to air entering the control room following a design basis accident are specified for each potential activity release location that has been identified.

These /Q values are listed in Table 14C-7.

The control room /Q values do not incorporate occupancy factors.

Chapter 14, Page 322 of 333 Revision 04, 2011

IP3 FSAR UPDATE References

1. Murphy, K. G., Campe, K. M., "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19," paper presented at the 13th AEC Air Cleaning Conference.

2. EPA Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," EPA-520/1-88-020, September 1988.

3. EPA Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," EPA 402-R-93-081, September 1993.

4. NUREG/CR-6331, Ramsdell, J. V. and Simonen, C. A., "Atmospheric Relative Concentrations in Building Wakes," Revision 1, May 1997.

Chapter 14, Page 323 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14C-1 ASSUMPTIONS USED FOR ANALYSIS OF CONTROL ROOM DOSES Control Room Volume 47,200 ft3 Unfiltered Inleakage 700 cfm*

HVAC Normal Operating Mode Inflow (unfiltered) 1500 cfm Time to Switch HVAC from Normal to Emergency 60 sec Mode After Receipt of Actuation Signal HVAC Emergency Mode Filtered Inflow 1500 cfm HVAC Emergency Mode Filtered Recirculation Flow 0 cfm Filter Efficiency Elemental 90%

Organic 90%

Particulate 99%

Breathing Rate 3.5E-4 m3/sec Atmospheric Dispersion Factors See Table 14C-7 Occupancy Factors 0-1 day 1.0 1-4 days 0.6 4-30 days 0.4

• The 700 cfm unfiltered inleakage assumption is applied to all radiological consequences analyses for design basis accidents except for the large-break LOCA (Section 14.3.5.1) which uses a reduced value of 400 cfm.

Chapter 14, Page 324 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-2 REACTOR COOLANT IODINE CONCENTRATIONS Tech Spec 1.0 Ci/g DE I- Tech Spec 60 Ci/g DE I-131 Equilibrium 131 48-hour Iodine Nuclide Operation Limit Spike Limit (Ci/g) (Ci/g)

I-130 0.0161* 0.97 I-131 0.7849 47.09 I-132 0.5345 32.07 I-133 1.0555 63.33 I-134 0.1146 6.88 I-135 0.5126 30.76

• While I-130 is included in the dose analyses, it is not included in the definition of Dose-Equivalent I-131 contained in the Technical Specifications.

Chapter 14, Page 325 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-3 IODINE APPEARANCE RATES IN THE REACTOR COOLANT TO MAINTAIN A CONCENTRATION OF 1.0 µCI/GRAM DOSE-EQUIVALENT I-131 Equilibrium Appearance Rate Nuclide (Ci/min)

I-130* 0.0124 I-131 0.4360 I-132 0.9391 I-133 0.7134 I-134 0.4286 I-135 0.4949

• While I-130 is included in the dose analyses, it is not included in the definition of Dose-Equivalent I-131 contained in the Technical Specifications.

Chapter 14, Page 326 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-4 REACTOR CORE SOURCE TERM(1)

Nuclide Inventory (Ci) Nuclide Inventory (Ci)

Iodines I-130 3.78E+06 Sr & Ba Sr-89 8.84E+07 I-131 9.10E+07 Sr-90 8.79E+06 I-132 1.33E+08 Sr-91 1.11E+08 I-133 1.88E+08 Sr-92 1.20E+08 I-134 2.06E+08 Ba-139 1.68E+08 I-135 1.76E+08 Ba-140 1.60E+08 Noble Kr-85m 2.44E+07 Noble Mo-99 1.75E+08 Gases Metals Kr-85 1.11E+06 Tc-99m 1.53E+08 Kr-87 4.69E+07 Ru-103 1.39E+08 Kr-88 6.60E+07 Ru-105 9.58E+07 Xe-131m 9.92E+05 Ru-106 4.84E+07 Xe-133m 5.45E+06 Rh-105 8.83E+07 Xe-133 1.79E+08 Cerium Ce-141 1.52E+08 Group Xe-135m 3.68E+07 Ce-143 1.43E+08 Xe-135 4.77E+07 Ce-144 1.20E+08 Xe-138 1.55E+08 Pu-238 4.11E+05 Alkali Rb-86 2.36E+05 Pu-239 3.50E+04 Metals Cs-134 2.05E+07 Pu-240 5.21E+04 Cs-136 5.96E+06 Pu-241 1.17E+07 Cs-137 1.19E+07 Pu-241 1.17E+07 Cs-138 1.72E+08 Np-239 1.87E+09 Te Group Sb-127 9.89E+06 Pu-241 1.17E+07 Sb-129 2.97E+07 Np-239 1.87E+09 Te-127m 1.28E+06 Te-127 9.83E+06 Te-129m 4.28E+06 Te-129 2.92E+07 Te-131m 1.33E+07 Te-132 1.30E+08 Note (1): The following assumptions apply:

• Core thermal power of 3280.3 MWt (2 percent above the design core power of 3216 MWt)

• Three-region equilibrium cycle core at end of life Chapter 14, Page 327 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-4 (Cont.)

REACTOR CORE SOURCE TERM(1)

Nuclide Inventory (Ci)

Lanthanides Y-90 9.16E+06 Y-91 1.14E+08 Y-92 1.21E+08 Y-93 1.39E+08 Nb-95 1.56E+08 Zr-95 1.54E+08 Zr-97 1.55E+08 La-140 1.65E+08 La-141 1.53E+08 La-142 1.48E+08 Nd-147 6.07E+07 Pr-143 1.37E+08 Am-241 1.44E+04 Cm-242 3.47E+06 Cm-244 3.70E+05 Note (1): The following assumptions apply:

• Core thermal power of 3280.3 MWt (2 percent above the design core power of 3216 MWt)

• Three-region equilibrium cycle core at end of life Chapter 14, Page 328 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14C-5 NUCLIDE PARAMETERS A. HALOGENS EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Isotope (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

I-130 5.61E-02 1.04E-13 7.14E-10 I-131 3.59E-03 1.82E-14 8.89E-09 I-132 3.01E-01 1.12E-13 1.03E-10 I-133 3.33E-02 2.94E-14 1.58E-09 I-134 7.91E-01 1.30E-13 3.55E-11 I-135 1.05E-01 7.98E-14 3.32E-10 B. NOBLE GASES EDE Dose Decay Constant Conversion Factor Isotope (hr-1) (Sv-m3/Bq-s)

Kr-85m 1.55E-01 7.48E-15 Kr-85 7.38E-06 1.19E-16 Kr-87 5.45E-01 4.12E-14 Kr-88 2.44E-01 1.02E-13 Xe-131m 2.43E-03 3.89E-16 Xe-133m 1.32E-02 1.37E-15 Xe-133 5.51E-03 1.56E-15 Xe-135m 2.72E+00 2.04E-14 Xe-135 7.63E-02 1.19E-14 Xe-138 2.93E+00 5.77E-14 C. ALKALI METALS EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Rb-86 1.55E-03 4.81E-15 1.79E-09 Cs-134 3.84E-05 7.57E-14 1.25E-08 Cs-136 2.20E-03 1.06E-13 1.98E-09 1

Cs-137 2.64E-06 2.88E-14 8.63E-09 Cs-138 1.29E+00 1.21E-13 2.74E-11 Chapter 14, Page 329 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14C-5 (Cont.)

NUCLIDE PARAMETERS D. TELLURIUM GROUP EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Sb-127 7.50E-03 3.33E-14 1.63E-09 Sb-129 1.60E-01 7.14E-14 1.74E-10 Te-127m 2.65E-04 1.47E-16 5.81E-09 Te-127 7.41E-02 2.42E-16 8.60E-11 Te-129m 8.60E-04 1.55E-15 6.47E-09 Te-129 5.98E-01 2.75E-15 2.42E-11 Te-131m 2.31E-02 7.01E-14 1.73E-09 Te-132 8.86E-03 1.03E-14 2.55E-09 E. STRONTIUM AND BARIUM EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Sr-89 5.72E-04 7.73E-17 2.860E-04 Sr-90 2.72E-06 7.53E-18 2.786E-05 Sr-91 7.30E-02 3.45E-14 1.277E-01 Sr-92 2.56E-01 6.79E-14 2.512E-01 Ba-139 5.03E-01 2.17E-15 8.029E-03 Ba-140 2.27E-03 8.58E-15 3.175E-02 F. NOBLE METALS EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Mo-99 1.05E-02 7.28E-15 1.07E-09 Tc-99m 1.15E-01 5.89E-15 8.80E-12 Ru-103 7.35E-04 2.25E-14 2.42E-09 Ru-105 1.56E-01 3.81E-14 1.23E-10 Ru-106 7.84E-05 0 1.29E-07 Rh-105 1.96E-02 3.72E-15 2.58E-10 Note:

1. The listed average gamma disintegration energy for Cs-137 is due to the production and decay of Ba-137m.

Chapter 14, Page 330 of 333 Revision 04, 2011

IP3 FSAR UPDATE TABLE 14C-5 (Cont.)

NUCLIDE PARAMETERS G. CERIUM GROUP EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Ce-141 8.89E-04 3.43E-15 2.42E-09 Ce-143 2.10E-02 1.29E-14 9.16E-10 Ce-144 1.02E-04 8.53E-16 1.01E-07 Pu-238 9.02E-07 4.88E-18 1.06E-04 Pu-239 3.29E-09 4.24E-18 1.16E-04 Pu-240 1.21E-08 4.75E-18 1.16E-04 Pu-241 5.50E-06 7.25E-20 2.23E-06 Np-239 1.23E-02 7.69E-15 6.78E-10 H. LANTHANIDE GROUP EDE Dose CEDE Dose Decay Constant Conversion Factor Conversion Factor Nuclide (hr-1) (Sv-m3/Bq-s) (Sv/Bq)

Y-90 1.08E-02 1.90E-16 2.28E-09 Y-91 4.94E-04 2.60E-16 1.32E-08 Y-92 1.96E-01 1.30E-14 2.11E-10 Y-93 6.86E-02 4.80E-15 5.82E-10 Nb-95 8.22E-04 3.74E-14 1.57E-09 Zr-95 4.51E-04 3.60E-14 6.39E-09 Zr-97 4.10E-02 9.02E-15 1.17E-09 La-140 1.72E-02 1.17E-13 1.31E-09 La-141 1.76E-01 2.39E-15 1.57E-10 La-142 4.50E-01 1.44E-13 6.84E-11 Nd-147 2.63E-03 6.19E-15 1.85E-09 Pr-143 2.13E-03 2.10E-17 2.19E-09 Am-241 1.83E-07 8.18E-16 1.20E-04 Cm-242 1.77E-04 5.69E-18 4.67E-06 Cm-244 4.37E-06 4.91E-18 6.70E-05 Chapter 14, Page 331 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-6 OFFSITE ATMOSPHERIC DISPERSION FACTORS (/Q)

FOR ACCIDENT DOSE ANALYSIS Site boundary /Q (sec/m3) 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />(1) 1.03E-3 Low population zone /Q (sec/m3) 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 3.8E-4 2 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.9E-4 24 - 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> 1.7E-5 Note:

1. Nominally defined as the 0 to 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> interval but is applied to the 2-hour interval having the highest activity releases in order to address 10 CFR Part 50.67 requirements.

Chapter 14, Page 332 of 333 Revision 04, 2011

IP3 FSAR UPDATE Table 14C-7 CONTROL ROOM ATMOSPHERIC DISPERSION FACTORS (/Q)

FOR ACCIDENT DOSE ANALYSIS

/Q (s/m3) at HVAC Intake for the Identified Release Points Atmospheric Dump Valve Ground Level and Safety Steam Line Containment Valve Break Plant Vent (1) Release (2) Releases(3) Releases(4) 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 6.00E-4 3.57E-4 1.14E-3 9.86E-4 2 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 5.20E-4 3.12E-4 1.04E-3 8.74E-4 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 2.12E-4 1.24E-4 5.05E-4 4.50E-4 1 - 4 days 1.76E-4 1.06E-4 4.01E-4 3.50E-4 4 - 30 days 1.30E-4 7.99E-5 3.21E-4 2.80E-4 Notes:

1. These dispersion factors are used for analysis of the doses for the fuel handling accident, for the volume control tank rupture, for the gas decay tank rupture, for the holdup tank rupture, and for the large-break LOCA (the sump solution leakage to the Plant Auxiliary Building).

2. The listed values represent modeling the containment shell as a diffuse area source and are used for evaluating the doses in the control room resulting from containment leakage of activity for the loss-of-coolant accidents and for the rod ejection accident.

3. The listed values are used for evaluating the doses in the control room for the steam generator tube rupture, for the main steam line break (the intact steam generator steaming releases), for the locked reactor coolant pump rotor, and for the rod ejection accident secondary side activity release pathway. The listed /Q values bound both the release point for the atmospheric dump valves and the release point for the safety valves.

4. The listed values are used for evaluating the doses in the control room for the main steam line break (faulted steam generator release path).

Chapter 14, Page 333 of 333 Revision 04, 2011