ML080800361

Proposed Change to the Updated Final Safety Analysis Report Regarding the Emergency Core Cooling System and Component Cooling Water System Single Passive Failure Analysis and Recirculation Phase Backup Capability

ML080800361
Person / Time
Site:	Indian Point
Issue date:	03/13/2008
From:	Joseph E Pollock Entergy Nuclear Operations
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
NL-08-15
Download: ML080800361 (65)

Text

Indian Point Energy Center 450 Broadway, GSB Enffffr P.O. Box 249 Buchanan, N.Y. 10511-0249 Tel (914) 734-6700 J.E. Pollock Site Vice President Administration March 13, 2008 Re: Indian Point Nuclear Generating Unit Nos. 2 and 3 Docket No. 50-247 and 50-286 NL-08-015 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Mail Station O-Pl-17 Washington, DC 20555-0001

Subject:

Proposed Change to the Updated Final Safety Analysis Report Regarding the Emergency Core Cooling System and Component Cooling Water System Single Passive Failure Analysis and Recirculation Phase Backup Capability

Reference:

1) NRC Generic Letter 2004-02: "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors."

Dear Sir or Madam:

Pursuant to 10 CFR 50.90, Entergy Nuclear Operations, Inc. (Entergy) hereby requests NRC approval to revise the Updated Final Safety Analysis Reports (UFSAR) for Indian Point Nuclear Generating Unit Nos. 2 and 3 to reflect a revised Emergency Core Cooling System (ECCS) and Component Cooling Water System (CCWS) single passive failure analysis and the recirculation phase backup capability. The proposed changes support Entergy's resolution of Generic Letter (GL) 2004-02 (Reference 1) by establishing a licensing basis, consistent with approved regulatory positions regarding passive failure, that support meeting the regulatory requirements of the GL.

The purpose of the licensing basis change is to establish the following quantitative basis for passive failures:

1. Revise the ECCS single passive failure analysis such that passive failures are assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after event initiation

2. Revise the Unit 2 CCWS single passive failure analysis such that passive failures are assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after event initiation

NL-08-015 Page 2 of 3

3. Revise the recirculation phase backup capability such that the residual heat removal pumps would be used if backup capacity to the internal recirculation loop is required in the event of an ECCS or CCWS (Unit 2 only) passive failure 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation The requested licensing basis changes are made under current licensing basis assumptions for analyzing the effects of post-accident debris blockage. The demonstration that the recirculation and containment sump strainer designs are capable of accommodating the GL 2004-02 licensing basis debris loads, including chemical effects, will be addressed by the GL 2004-02 supplementary submittal, additional submittals as required by the granted extension requests, and resolution of NRC GSI-191 audit open items.

Entergy has evaluated the proposed changes in accordance with 10 CFR 50.91 (a)(1) using the criteria of 10 CFR 50.92(c) and has determined that this proposed change involves no significant hazards considerations, as described in Attachment 1. Attachments 2 and 3 provide the existing Unit 2 and Unit 3 UFSAR pages marked-up to show the proposed changes.

Entergy requests approval of the proposed UFSAR changes on a schedule commensurate with Entergy's plan for resolution of the issues identified in GL-2004-02.

Revisions to the Indian Point UFSARs, necessary to reflect approval of this submittal, will be made in accordance with 1 OCFR50.71 (e).

This letter contains no new regulatory commitments. In accordance with 10 CFR 50.91, a copy of this application, with attachments is being provided to the designated New York State official.

If you have any questions or require additional information, please contact Mr. R. Walpole, Licensing Manager at 914-734-6710.

I de9ee under penalty of perjury that the foregoing is true and correct. Executed on March 2008.

Sincerely, AJosep ck ie Site Vice President Indian Point Energy Center

NL-08-015 Page 3 of 3 Attachments:

1. Analysis of proposed changes to the UFSAR regarding the ECCS and CCWS single passive failure analysis and recirculation phase backup capability.

2. Unit 2 - Proposed changes to the UFSAR regarding the ECCS and CCWS single passive failure analysis and recirculation phase backup capability.

3. Unit 3 - Proposed changes to the UFSAR regarding the ECCS single passive failure analysis and recirculation phase backup capability.

cc:

Mr. John P. Boska, Senior Project Manager Project Directorate I, Division of Licensing Project Management U.S. Nuclear Regulatory Commission Regional Administrator Region I U.S. Nuclear Regulatory Commission Resident Inspector's Office IP2 Resident Inspector's Office IP3 Mr. Paul Eddy NYS Department of Public Service Mr. Paul D. Tonko, President, NYSERDA

ATTACHMENT 1 TO NL-08-015 Analysis of Proposed Changes to the Updated Final Safety Analysis Report Regarding the Emergency Core Cooling System and Component Cooling Water System Single Passive Failure Analysis and Recirculation Phase Backup Capability Entergy Nuclear Operations, Inc.

Indian Point Nuclear Generating Units Nos. 2 and 3 Docket Nos. 50-247 and 50-286

NL-08-015 Attachment 1 Page 1 of 28

1.0 DESCRIPTION

Pursuant to 10 CFR 50.90, Entergy Nuclear Operations, Inc. (Entergy) hereby requests NRC approval to revise the Updated Final Safety Analysis Reports (UFSAR) for Indian Point Nuclear Generating Unit Nos. 2 and 3 to reflect a revised Emergency Core Cooling System (ECCS) and Component Cooling Water System (CCWS) single passive failure analysis and the recirculation phase backup capability.

NRC Generic Letter (GL) 2004-02 (Reference 1) identifies the potential for the failure of the ECCS and Containment Spray System (CSS) recirculation functions and the potential degradation of these systems as a result of the effects of debris blockage or extended operation with debris-laden fluids. By letters dated September 1, 2005 (Reference 2) and December 15, 2005 (Reference 3), Entergy provided a response to GL 2004-02 for Indian Points Units 2 and 3. As required by Reference 4, a supplemental response was provided by February 29, 2008 (Reference 12).

In response to GL 2004-02 plant modifications were installed during recent refueling outages that significantly increased the performance capabilities of both the recirculation and containment sumps. These modifications represent major steps forward in the resolution of GL 2004-02. However, even when these modifications are considered, and debris loads are determined utilizing the NRC prescribed methodology of Reference 5, the GL 2004-02 final evaluations are expected to show that:

1. The internal recirculation sump would be able to perform the recirculation function at completion of the switchover to recirculation and thereafter for all initiating events including a LBLOCA.

.2. The backup containment sump would be able to assume the recirculation function at completion of the switchover to recirculation for all initiating events except a LBLOCA.

3. For LBLOCAs the backup containment sump would be able to assume the recirculation function after a short period of internal recirculation system operation and within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of event initiation. During that time the post LBLOCA generated debris settles out, is diverted by appropriate flow barriers, or is transported to the recirculation sump strainers thereby significantly reducing the debris load on the containment sump.

This expected performance capability for the containment sump represents a departure from the current ECCS design and licensing basis. For the purposes of these evaluations a LBLOCA is defined as a break in the reactor coolant pressure boundary with an total cross-sectional area greater than that of the pressurize surge line (14 inch schedule 160 line).

The current ECCS single passive failure analysis assumes a loss of flow path passive failure, at completion of the switchover to recirculation, as the result of a pipe or valve rupture. The current Unit 2 CCWS failure analysis includes a pipe severance in the component cooling loop that could result in the loss of the internal recirculation pumps. Therefore, under the current licensing basis, in order to provide the required backup function, the ECCS is arranged to allow either of the residual heat removal pumps, drawing water from the containment sump, to take over the recirculation function at the earliest time that recirculation spray is initiated.

NL-08-015 Attachment 1 Page 2 of 28 A pipe or valve rupture is extremely unlikely. Previously approved NRC staff regulatory positions support passive failures defined as fluid leakage owing to gross failure of a pump or a valve seal during the long-term cooling mode following a LOCA (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after the event) but not pipe or valve body ruptures (Reference 8). According to Reference 8, no other passive failures are required to be assumed because it is judged that compounding of probabilities associated with other types of passive failures, following the pipe break associated with a LOCA, results in probabilities sufficiently small that they can be reasonably discounted without substantially affecting overall system reliability. Therefore, in the event of a passive failure, it is proposed that the system be arranged to allow either of the residual heat removal pumps to take over the recirculation function, not at the completion of the switchover to recirculation, but 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation. Revisions to the UFSARs for both units regarding single passive failure and the recirculation phase backup capability are required to support the proposed changes.

Therefore, the purpose of the licensing basis change is to:

1. Revise the ECCS single passive failure analysis such that passive failures are assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after event initiation

2. Revise the Unit 2 CCWS single passive failure analysis such that passive failures are assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after event initiation 3 Revise the recirculation phase backup capability such that the residual heat removal pumps would be used if backup capacity to the internal recirculation loop is required in the event of an ECCS or CCWS (Unit 2 only) passive failure 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation The requested licensing basis changes are made under current licensing, basis assumptions for analyzing the effects of post-accident debris blockage. The demonstration that the recirculation and containment sump strainer designs are capable of accommodating the GL 2004-02 licensing basis debris loads, including chemical effects, will be addressed by the GL 2004-02 supplementary submittal, additional submittals as required by the granted extension requests, and resolution of NRC GSI-191 audit open items. The requested revisions to the timing of a single passive failure and to the recirculation phase backup capability have no impact under the current sump licensing basis as the containment sump will continue to be able to accommodate the currently assumed blockage at the earliest time recirculation spray is initiated.

This submittal 'is limited to the containment sump backup capability following a single passive failure. As described in section 3g.7 of Reference 12, an active failure could require the use of the containment sump prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to support hot leg recirculation at Unit 2. Any change to the current licensing basis regarding this single active failure is outside the scope of this submittal and is subject to the 10CFR50.59 process. While this single active failure is acceptable under current licensing basis sump blockage assumptions; the performance of the sump under GL 2004-02 requirements will be addressed in future GL 2004-02 supplemental responses when all supporting analyses are complete.

No new ECCS or CCWS passive failures over and above those already included in the current licensing basis are introduced due to this proposed licensing basis change.

NL-08-015 Attachment 1 Page 3 of 28

2.0 PROPOSED CHANGE

S The proposed changes are made to the licensing bases as described in Reference 6 and 7.

2.1 Proposed Chanqes to the ECCS Single Passive Failure Analysis 2.1.1 Indian Point Unit 2 UFSAR Table 6.2-11 Replace the title of the table as follows, "TABLE 6.2-11 (Sheet 1 of 2)

Loss Of Recirculation Flow Path" by, "TABLE 6.2-11 (Sheet 1 of 2)

Single Passive FailureAnalysis (Loss Of Recirculation Flow Path)"

and,

'TABLE 6.2-11 (Sheet 2 of 2)

Loss Of Recirculation Flow Path" by, "TABLE 6.2-11 (Sheet 2 of 2)

Single Passive FailureAnalysis (Loss Of Recirculation Flow Path)"

UFSAR Section 6.2.3.3 Single-Failure Analysis Replace, "In addition, an alternative flow path is availableto maintain core cooling if any part of the recirculationflow path becomes unavailable. This is evaluated in Table 6.2-11. The procedure followed to establish the alternativeflow path also isolates the spilling line.

A valve is provided in the containment recirculationline to the residualheat removal pumps to isolate this line should it be required."

by, "In addition to active failures, an alternative flow path is available to maintain core cooling if any part of the recirculation flow path becomes unavailable due to a single passive failure. This is evaluated in Table 6.2-11. The procedure followed to establish the alternativeflow path also isolates the spilling line. A valve is provided in the containment recirculationline to the residual heat removal pumps to isolate this line should it be required.

Therefore, the ECCS design incorporatesredundancy of components such that neithera single active component failure during the injection phase nor an active or passive failure during the recirculationphase will degrade the ECCS function. Only

NL-08-015 Attachment 1 Page 4 of 28 active failures are assumed to occur within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event."

2.1.2 Indian Point Unit 3 UFSAR Table 6.2-8 Replace the title of the table as follows, "TABLE 6.2-8 Loss Of Recirculation Flow Path" by, "TABLE 6.2-8.

Single Passive FailureAnalysis (Loss Of Recirculation Flow Path)"

and, "TABLE 6.2-8 (Cont.)

Loss Of Recirculation Flow Path" by, "TABLE 6.2-8 (Cont.)

Single Passive FailureAnalysis (Loss Of Recirculation Flow Path)"

UFSAR Section 6.2.3 Single-Failure Analysis Replace, "In addition, an alternative flow path is available to maintain core cooling if any part of the recirculationflow path becomes unavailable. This evaluated in Table 6.2-8. The procedure followed to establish the alternateflow path also isolates the spilling line. A valve is provided in the containment recirculationline to the residualheat removal pumps in order to isolate this line should it be required."

by, "In addition to active failures, an alternativeflow path is available to maintain core cooling if any part of the recirculationflow path becomes unavailabledue to a single passive failure. This is evaluated in Table 6.2-8. The procedure followed to establish the alternate flow path also isolates the spilling line. A valve is provided in the containmentrecirculationline to the residualheat removal pumps in order to isolate this line should it be required.

Therefore, the ECCS design incorporatesredundancy of components such that neithera single active component failure during the injection phase nor an active or passive failure during the recirculationphase will degrade the ECCS function. Only

NL-08-015 Attachment 1 Page 5 of 28 active failures are assumed to occur within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event."

2.2 Proposed Changes to the Recirculation Phase Backup Capability 2.2.1 Indian Point Unit 2 UFSAR Section 6.2.1.1 Emergency Core Cooling System Capability Replace, "Duringthe recirculationphase, the system is tolerant of a loss of any part of the flow path since backup alternative flow path capabilityis provided."

by, "Duringthe recirculationphase, the system is tolerant of a loss of any part of the flow path since backup alternative flow path capability is provided as described in Section 6.2.3.3."

UFSAR Section 6.2.2.1 System Description Replace, "The residual heat removal pumps provide backup recirculationcapability through the independent containment sump."

by, "The residualheat removal pumps provide backup recirculationcapability through the independent containment sump as described in Section 6.2.3.3."

UFSAR Section 6.2.2.1.2 Recirculation Phase Replace,

'The residualheat removal pumps would only be used if backup capacity to the internal recirculationloop is required."

by, "The residualheat removal pumps would only be used if backup capacity to the internal recirculationloop is required as describedin Section 6.2.3.3."

Replace, "The high-head external recirculation flow path via the high-head safety injection pumps is only requiredfor the range of small-break sizes for which the reactorcoolant system pressure remains in excess of the shutoff head of the recirculationpumps (or residual heat removal pumps) at the end of the injection phase."

by,

NL-08-015.

Attachment 1 Page 6 of 28 "The high-head external recirculationflow path via the high-head safety injection pumps is requiredfor the range of small-breaksizes for which the reactorcoolant system pressure remains in excess of the shutoff head of the recirculationpumps at the end of the injection phase. The recirculationpumps, or the residualheat removal pumps if backup capabilityis required,are also used to provide flow to the high-head safety injection pumps during hot leg recirculation.

Replace, "Onepump (either recirculationor residual heat removal) and one residualheat exchangerof the recirculationsystem provide sufficient cooled recirculatedwater to keep the core flooded..."

by, "Onerecirculationpump and one residual heat exchanger of the recirculationsystem provide sufficient cooled recirculatedwater to keep the core flooded..."

Replace, "With both recirculation(orresidualheat removal)pumps in operation and both spray header valves open, a recirculationspray flow rate can be establishedsuch that no containmentcooling fans (Section 6.4) are required."

by, "With both recirculationpumps in operation and both spray header valves open, a recirculationspray flow rate can be established such that no containment cooling fans (Section 6.4) are required."

Replace, "The design ensures that heat removal from the core and containment is effective in the event of a pipe or valve body rupture."

by, "The system is also arrangedto allow either of the residual heat removal pumps to take over the recirculationfunction following a passive failure as defined in Section 6.2.3.3. This design ensures that heat removal from the core and containment is effective in the event of a pipe or valve body rupture."

UFSAR Section 6.2.3.4 Reliance on Interconnected Systems Replace, "Duringthe recirculationphase of the accident for small breaks, suction to the high-head safety injection pumps is provided by the recirculationpumps or the residualheat removal pumps."

by, "Duringthe recirculationphase of the accidentfor small breaks, suction to the high-head safety injection pumps is provided by the recirculationpumps or, should backup capabilitybe required, the residualheat removal pumps."

NL-08-015 Attachment 1 Page 7 of 28 UFSAR Section 6.3.1.1 Containment Heat Removal Systems UFSAR Section 6.3.3.1 Range of Containment Protection and, UFSAR Section 6.4.1.1 Containment Heat Removal Systems and, UFSAR Section 6.4.3.1 Range of Containment Protection Replace, "Both recirculationpumps (or both residual heat removal pumps), both residual heat exchangers and both containment recirculationspray headers in operation when the level in the RWST decreasesbelow 2 feet."

by, "Both recirculationpumps, both residual heat exchangers and both containment recirculationspray headers in operation when the level in the RWST decreases below 2 feet."

UFSAR Section 6.3.1.6 Performance Obiectives (Containment Spray System) and, UFSAR Section 6.4.1.9 Performance Obnectives (Containment Air Recirculation System)

Replace, "Neithera single active component failure in such systems during the injection phase nor an active/passive failure during the.recirculationphase will degrade the design heat removal capabilityof containmentcooling."

by, "Neithera single active component failure in such systems during the injection phase nor an active/passive failure during the recirculationphase will degrade the design heat removal capabilityof containment cooling (see Section 6.2.3.3)."

UFSAR Section 9.3.3.3.1 Component Coolinq Loop (Incident Control)

Replace, "In the unlikely event of a pipe severance in the component cooling loop, backup is provided for postaccidentheat removal by the containment fan coolers."

by, "In the unlikely event of a pipe severance in the component cooling loop, backup is provided for postaccidentheat removal by the containment fan coolers. Pipe severance is a passive failure and is assumed to occur 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greaterafter event initiation."

NL-08-015 Attachment 1 Page 8 of 28 Add the following at the foot of Chapter 9, Page 48 of 99:

"Shouldthe break occur inside containment and the leak cannot be isolated the residual heat removal pumps and safety injection pumps, if required, are employed to recirculateuncooled spilled water to the core. Heat is removed from the core by boil off of the water to the containmentwith the fan coolers being used to condense the resulting steam."

UFSAR Section 14.3.2.1 Description of Large-Break LOCA Transient Replace,

'After the water level of the refueling water storage tank reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold-leg recirculationmode of operation in which spilled borated water is drawn from either the recirculationsump or containmentsump by the recirculationor residualheat removal pumps and returned to the reactorcoolant system cold legs."

by,

'After the water level of the refueling water storage tank reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold-leg recirculationmode of operation in which spilled borated water is drawn from the recirculationsump by the recirculationpumps and returned to the reactorcoolant system cold legs."

UFSAR Section 14.3.5.1.1 Design Basis (Containment Integrity Analysis)

Replace, "Engineeredsafety features systems are redundant and independent such that any single active failure in the engineered safety features system during the injection phase or any single active or passive failure during recirculationwill not affect the ability to mitigate containmentpressure as discussed in Sections 14.3.5.3.7 and 14.3.5.5."

by, "Engineeredsafety features systems are redundantand independentsuch that any single active failure in the engineeredsafety features system during the injection phase or any single active or passive failure during recirculation(see Section 6.2.3.3) will not affect the ability to mitigate containmentpressure as discussed in Sections 14.3.5.3.7 and 14.3.5.5."

UFSAR Section 14.3.5.5 Evaluation of Long Term Fan Cooler Capability Delete,

'At 12 hr 20.2 29.9"

NL-08-015 Attachment 1 Page 9 of 28 2.2.2 Indian Point Unit 3 UFSAR Section 6.2.1 Desian Basis Replace,

"... provide back-up capabilityto the recirculationpumps which comprise part of the internalrecirculationloop."

by, it... provide back-up capabilityto the recirculationpumps which comprise part of the internal recirculationloop as described in Section 6.2.3."

and, Replace, "Duringthe recirculationphase, the system is tolerantof a loss of any part of the flow path since backup alternativeflow path capabilityis provided."

by, "Duringthe recirculationphase, the system is tolerantof a loss of any part of the flow path since backup alternativeflow path capabilityis provided as described in Section 6.2.3."

UFSAR Section 6.2.2 System Design and Operation Replace,

"(The residual heat removal pumps provide backup recirculationcapability)."

by,

"(The residualheat removal pumps provide backup recirculationcapability through the independent containmentsump as describedin Section 6.2.3.)"

Replace, "The residualheat removal pumps would only be used if backup capacity to the internal recirculationloop is required."

by, "The residual heat removal pumps would only be used if backup capacity to the internal recirculationloop is requiredas described in Section 6.2.3."

Replace, "The high head external recirculationflow path via the high head safety injection pumps is only requiredfor the range of small-break sizes for which the Reactor

NL-08-015 Attachment 1 Page 10 of 28 Coolant System pressure remains in excess of the shutoff head of the recirculation pumps (or residualheat removal pumps) at the end of the injection phase or to provide hot leg flow during hot leg recirculation."

by, "The high head external recirculationflow path via the high head safety injection pumps is requiredfor the range of small-breaksizes for which the Reactor Coolant System pressure remains in excess of the shutoff head of the recirculationpumps at the end of the injection phase. The recirculationpumps, or the residual heat removal pumps if backup capabilityis required,are also used to provide flow to the high head safety injection pumps during hot leg recirculation."

Replace, "Onepump (eitherrecirculationor residualheat removal) and one residual heat exchanger of the recirculationsystem provide sufficient cooled recirculatedwater to keep the core flooded..."

by, "One recirculationpump and one residual heat exchanger of the recirculationsystem provide sufficient cooled recirculatedwater to keep the core flooded ... "

Replace, "The design ensures that heat removal from the core and Containmentis effective in the event of a pipe or valve body rupture."

by, "The system is also arrangedto allow either of the residual heat removal pumps to take over the recirculationfunction following a passive failure as defined in Section 6.2.3. This design ensures that heat removal from the core and containment is effective in the event of a pipe or valve body rupture."

UFSAR Section 6.2.3 Design Evaluation Replace, "Duringthe recirculationphase of the accident for small breaks, suction to the high head safety injection pumps is provided by the recirculationpumps."

by, "Duringthe recirculationphase of the accident for small breaks, suction to the high, head safety injection pumps is provided by the recirculationpumps or, should backup capabilitybe required,the residualheat removal pumps."

NL-08-015 Attachment 1 Page 11 of 28 UFSAR Section 6.3.1 Design Basis (Containment Spray System)

UFSAR Section 6.4.1 Design Basis (Containment Air Recirculation Cooling and Filtration System)

Replace, "Neithera single active component failure in such systems during the injection phase nor an active/passive failure during the recirculationphase will degrade the design heat removal capabilityof containment cooling."

by, "Neithera single active component failure in such systems during the injection phase nor an active/passive failure during the recirculationphase will degrade the design heat removal capabilityof containment cooling (see Section 6.2.3)."

NL-08-015 Attachment 1 Page 12 of 28

3.0 BACKGROUND

3.1 System Description

Emergency core cooling is provided by the ECCS whose components operate in three modes.

These modes are delineated as passive accumulator injection, active safety injection, and residual heat removal recirculation.

The primary purpose of the safety injection system is the automatic delivery of borated cooling water to the reactor core in the event of a design basis accident. This limits the fuel clad temperature and thereby ensures that the core will remain intact and in place, with its essential heat transfer geometry preserved. This protection is afforded for:

1. All pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends.

2. A loss of coolant associated with the rod ejection accident;

3. A steam-generator tube rupture.

The principal components of the safety injection system, which provide emergency core cooling immediately following a loss of coolant are the accumulators (one for each loop), the three safety injection (high-head) pumps, and the two residual heat removal (low-head) pumps. The safety injection and residual heat removal pumps are located in the primary auxiliary building.

The accumulators, which are passive components, discharge into the cold legs of the reactor coolant piping when reactor coolant system pressure decreases below a specified value, thus rapidly ensuring core cooling for large breaks. They are located inside the containment, but outside the crane wall, therefore each is protected against possible missiles, pipe whip or jet impingement.

The ECCS and CCWS flow diagrams are located in Sections 6.0 and 9.0 of the UFSARs, respectively.

Iniection Phase The safety injection signal opens certain of the safety injection system isolation valves, provides confirmatory open signals to system isolation valves that are normally open, and starts the safety injection pumps and residual heat removal pumps.

The three safety injection pumps (high-head) deliver borated water to two separate discharge headers. The flow from these discharge headers can be injected into the cold legs and the hot legs of the reactor coolant system. The hot-leg injection lines are provided for later use during hot-leg recirculation.

At Unit 2, the high-head safety injection system is configured with two cold leg injection lines physically connected to the reactor coolant loops and the other two lines connected to the accumulator discharge lines directly upstream of the reactor coolant pressure boundary check valves. At Unit 3, the high-head safety injection system is configured with four cold leg injection lines physically connected to the reactor coolant loops and an additional four cold leg injection lines connected to the accumulator discharge lines upstream of the reactor coolant pressure

NL-08-015 Attachment 1 Page 13 of 28 boundary check valves. However, two cold leg injection throttling valves, one on each set of injection lines, are permanently locked closed. Therefore, there are effectively three cold leg injection lines available from each high head safety injection header.

Since a small break in the reactor coolant pressure boundary can include a cold leg injection line, safety injection flow capability can be limited by the resulting flow from only three (Unit 2) or five (Unit 3) intact cold leg injection lines. Depending on the assumed single failure, either two or three safety injection pumps can be operating. To maximize the fraction of safety injection flow delivered to the reactor coolant system with a broken cold leg injection line, the four cold leg injection lines are flow balanced to within an allowable range. The resulting system flow capability is sufficient for coolant makeup following a small break that does not immediately depressurize the reactor coolant system to the accumulator discharge pressure.

For large breaks, the reactor coolant system would be depressurized and voided of coolant rapidly and a high flow rate is required to quickly recover the exposed fuel rods and limit possible core damage. To achieve this objective, one residual heat removal pump and two safety injection pumps are required to deliver borated water to the cold legs of the reactor coolant loops. Two residual heat removal and three safety injection pumps are available to provide for an active component failure. Delivery from these pumps supplements the accumulator discharge.

The residual heat removal pumps take suction from the refueling water storage tank. In addition, the charging pumps of the chemical and volume control system are available but are not required to augment the flow of the safety injection system. Because the injection phase of the accident is terminated before the refueling water storage tank is completely emptied, all pipes are kept filled with water before recirculation is initiated.

Water level indication and alarms on the refueling water storage tank give the operator ample warning to terminate the injection phase. Additional level indicators and alarms are provided in the recirculation and containment sumps, which also give alternate indication when recirculation can be initiated and injection terminated.

Recirculation Phase There are two sumps within the containment, the recirculation sump and the containment sump both located in the containment floor. Both sumps collect liquids discharged into the containment during the injection phase and during the switchover to recirculation.

After the injection operation, coolant spilled from the break and water~collected from the containment spray are cooled and returned to the reactor coolant system by the recirculation system. When the break is large, RCS depressurization occurs due to the large rate of mass and energy loss through the break to containment. In the event of a large break, the recirculation flow path is within the containment. The system is arranged so that the recirculation pumps individually take suction from the recirculation sump, discharge through a common line, and deliver spilled reactor coolant and borated refueling water back to the core through the residual heat removal heat exchangers.

For the smaller breaks in the reactor coolant system where recirculated water must be injected against higher RCS pressures for long-term cooling, the system is arranged to deliver the water

NL-08-015 Attachment 1 Page 14 of 28 from the outlet of one (Unit 2) or two (Unit 3) residual heat removal heat exchanger(s) to the high-head safety injection pump suction and by this external recirculation route to the reactor coolant loops. If this flow path is unavailable, an alternate flow path is provided. This alternate flow path is from the containment sump, via a single suction line, to the residual heat removal pumps to the high-head injection pumps via the middle safety injection pump, by-passing the residual heat exchangers as described in the respective UFSARs. Thus, if depressurization of the reactor coolant system proceeds slowly, the safety injection pumps may be used to augment the flow-pressure capacity of the recirculation pumps (or residual heat removal pumps) in returning the spilled coolant to the reactor. In this system configuration, the recirculation pump (or residual heat removal pump) provides flow and net positive suction head to the operating safety injection pumps.

Internal recirculation is initiated when the operator either closes the recirculation switch that starts the first recirculation pump (Unit 2) or manually starts the recirculation pump (Unit 3).

Should the first recirculation pump fail to start the operator would start the second recirculation pump. If minimum flow requirements are not established by the low head recirculation pumps, then high-head recirculation would be established.

The low-head external recirculation loop via the containment sump line and the residual heat removal pumps provides backup recirculation capability to the low-head internal recirculation loop. The residual heat removal pumps would only be used if backup capacity to the internal recirculation loop is required.

Recirculation and Containment Sump'Strainers The recirculation sump and containment sump strainers consist of a matrix of multi-tube top-hat modules, which are fabricated from perforated stainless steel plate and mounted in the horizontal position. The perforated plate has 3/32" diameter holes sized to limit downstream effects. The top-hat modules have four layers of perforated surfaces for straining debris from the sump fluid. Typical recirculation sump and containment sump strainer top-hat modules consist of a 12-1/2" diameter outer perforated tube with a respective 10-1/2" diameter inner perforated tube and a second set of tubes, which consist of a 7-1/2" diameter outer perforated tube with a respective 5-1/2" diameter inner perforated tube. The top-hat modules come in several lengths and feature an internal vortex suppressor, which prevents air ingestion into the piping system. Stainless steel mesh has been installed between each pair of perforated plate tubes to minimize fiber bypass through the strainers. The top-hat modules are attached to strainer water boxes. The water boxes supply recirculation flow to the suction of the recirculation or residual heat removal pumps.

Recirculation and Containment Sump Strainer Surface Areas Unit 2 The original recirculation (approx. 50 ft2) and containment sump screens (approx. 30 ft2) have been replaced. The replacement strainers are of a modular design and have respective surface areas of approximately 3200 ft2 and 412 ft2 . During the spring 2008 refueling outage it is planned to increase the containment sump strainer surface area from 412 ft to approximately 1100 ft2 .

NL-08-015 Attachment 1 Page 15 of 28 Unit 3 The original recirculation (approx. 48 ft2) and containment sump (approx. 32 ft2) screens have been replaced. The replacement strainers are of a modular design and have respective surface areas of approximately 3200 ft2 and 1000 ft2.

3.2 ECCS Single Passive Failure Analysis Under the existing licensing basis the current ECCS design incorporates redundancy of components such that neither a single active component failure during the injection phase nor an active or passive failure during the recirculation phase will degrade the ECCS function. The circumstances under which the recirculation pumps would be unavailable is determined by a single failure analysis.

The single failure analysis includes the loss of a flow path. Because a pipe or valve body rupture, at completion of the switchover to recirculation, were included in the initial ECCS licensing basis, the system was arranged to allow either of the residual heat removal pumps to take over the recirculation function at that time.

The proposed change to the ECCS single failure analysis will ensure that the design incorporates redundancy of components such that neither a single active component failure during the injection phase nor an active or passive failure during the recirculation phase will degrade the ECCS function. The principal change is that only active failures will be assumed to occur within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event.

The single failure analysis continues to include the loss of a flow path. Because a pipe or valve body rupture is extremely unlikely, the system would be arranged to allow either of the residual heat removal pumps to take ov6r the recirculation function following a single passive failure, not at the completion of the switchover to recirculation, but 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation.

3.3 CCWS Single Passive Failure Analysis The current Unit 2 licensing basis considers the unlikely event of a CCWS pipe severance in containment that cannot be isolated. Under that circumstance cooling to the internal recirculation pumps would be lost and the residual heat removal pumps and safety injection pumps, if required, would be employed to recirculate uncooled spilled water to the core. Heat would be removed from the core by boil off of the water to the containment with the fan coolers being used to condense the resulting steam.

3.4 Recirculation Phase Backup Capability Under the existing licensing basis one pump (either recirculation or residual heat removal) and one residual heat exchanger provide sufficient cooled recirculated water to keep the core flooded while simultaneously providing sufficient containment recirculation spray flow to reduce airborne activity at the earliest time recirculation spray is initiated. The residual heat removal pumps are used if backup capacity to the internal recirculation loop is required.

The proposed change to the ECCS recirculation phase backup capability would ensure that one recirculation pump and one residual heat exchanger provide sufficient cooled recirculated water to keep the core flooded while simultaneously providing sufficient containment recirculation spray flow to reduce airborne activity at the earliest time recirculation spray is initiated. The residual heat removal pumps would be used if backup capacity to the internal recirculation loop is required in the event of a passive failure 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation.

NL-08-015 Attachment 1 Page 16 of 28

4.0 TECHNICAL EVALUATION

4.1 Technical Evaluation of the Proposed Change to the ECCS Sinqle Passive Failure Analysis The circumstances under which the recirculation pumps would be unavailable due to a passive failure is determined by a single failure analysis. The ECCS single failure analysis is presented in UFSAR Section 6.2.3.3 (Unit 2) and Section 6.2.3 (Unit 3).

Within the context of single passive failures UFSAR Section 6.2.3.3 (Unit 2) and Section 6.2.3 (Unit 3) describe the "loss of a recirculation flow path" and that "an alternative flow path is available to maintain core cooling if any part of the recirculation flow path becomes unavailable." This capability is analyzed in UFSAR Table 6.2-11 (Unit 2) and Table 6.2-8 (Unit 3). Losses of certain internal recirculation low and high head flow paths are considered. The available alternate flow paths identified include the use of the residual heat removal pumps via the containment sump to supply flow to the suction of the high head safety injection pumps. The UFSAR also states that the procedure used to establish the alternate flow path "isolates the spilling line" implying that the loss of flow path has resulted from a passive failure (a spilling line). Therefore, while not explicitly stated in the UFSARs, "the loss of a recirculation flow path" is taken to be synonymous with a passive failure. Elsewhere in the UFSAR (Section 6.2.2.1.2 (Unit 2) and Section 6.2.2 (Unit 3)) it is stated that the ECCS design ensures that heat removal from the core and containment is effective in the event of a pipe or valve body rupture. Based on the foregoing, a single passive failure, as defined above, may require the use of the containment sump.

The current UFSAR ECCS single failure analysis demonstrates that the design incorporates redundancy of components such that neither a single active component failure during the injection phase nor an active or passive failure during the recirculation phase will degrade the ECCS function. Within the UFSAR there are no temporal limitations associated with "during the recirculation phase". Because residual heat removal backup capability is available at the completion of the switchover to recirculation, "during the recirculation phase" has been taken to mean from the earliest time recirculation spray is initiated. In this regard the current licensing basis is more conservative than regulatory positions summarized in SECY-77-439, "Single Failure Criterion" (References 8, 9 and 10). Excerpts from SECY-77-439 follow:

"However,in applying the Criterion,it is not assumed that any conceivable failure could occur. For example, reactorvessels or certain types of structuralelements within systems, when combined with other unlikely events, are not assumed to fail because the probabilitiesof the resultingscenariosof events are deemed to be sufficiently small that they need not be considered. In generalonly those components which are judged to have a credible chance of failure are assumed to fail when the Single Failure Criterionis applied."

and, "Duringthe short-term ECCS coolant injection mode immediately following a loss of coolant accident, the most limiting single active failure is considered in evaluating system performance capability.

"Duringthe long-term ECCS recirculationcooling mode, the most limiting active failure, or single passive failure equal to the leakage

NL-08-015 Attachment 1 Page 17 of 28 that would occur from a valve or pump seal failure, is assumed. The basis for not including other passive failures during the long term is based on engineeringjudgment that such failures (pipe or valve breaks) have an acceptably low likelihood of occurrence during the long-term phase of a loss-of-coolantaccident. Analysis of ECCS performance in WASH- 1400 indicate that passive failures of valves and piping are relatively small contributors to the ECCS unavailability during both injection and recirculationmodes of operation."

and,

"... In the study of passive failures it is currentpractice to assume fluid leakage owing to gross failure of a pump or a valve seal during the long-term cooling mode following a LOCA (24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after the event) but not pipe breaks. No other passive failures are required to be assumed because it is judged that compounding of probabilities associated with other types of passive failures, following the pipe break associated with a LOCA, results in probabilitiessufficiently small that they can be reasonably discounted without substantiallyaffecting overall systems reliability..."

The key points to note from the SECY are:

(1) Passive failures are taken to be failures of valve or pump seals (not pipe and valve body ruptures)

(2) Passive failures are taken at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> or greater after the event Therefore, based on these previously approved NRC staff's regulatory positions as summarized in SECY-77-439, the proposed ECCS design incorporates redundancy of components such that neither a single active component failure during the injection phase nor an active or passive failure during the recirculation phase will degrade the ECCS function. Only active failures will be assumed to occur within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event.

4.2 Technical Evaluation of the Proposed Change to the Recirculation Phase Backup Capability The proposed change is shown to be acceptable as described below.

4.2.1 Consideration of Recirculation Phase Backup Capability and the Single Passive Failure Analysis The ECCS system performance capabilities are described in the UFSAR (Section 6.2.2.1.2 (Unit 2), and Section 6.2.2 (Unit 3)). The recirculation phase backup capability is also described.

The UFSAR described capabilities are that one pump (either recirculation or residual heat removal) and one residual heat exchanger provide sufficient cooled recirculated water to keep the core flooded while simultaneously providing sufficient containment recirculation spray flow to reduce airborne activity at the earliest time recirculation spray is initiated. It is further stated that the design ensures that heat removal from the core and containment is effective in the event of a pipe or valve body rupture.

NL-08-015 Attachment 1 Page 18 of 28 Therefore, the recirculation phase backup capability (residual heat removal pumps(s)) would have been required in the event of a passive failure at the earliest time recirculation spray is initiated.

Because a pipe or valve body rupture is extremely unlikely, the system would be arranged to allow either of the residual heat removal pumps to take over the recirculation function following a single passive failure, not at the completion of the switchover to recirculation, but 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following event initiation consistent with the regulatory positions contained in SECY-77-439.

4.2.2 Consideration of Internal Recirculation Sump Strainer Assembly Failures Regulatory Guide (RG) 1.82 includes criteria for the physical separation of containment sumps assuming the potential for damage exists due to structural interaction (missiles, pipe whip) or other consequences (jet impingement) following an initiating event requiring use of the sump.

Indian Point is not committed to RG 1.82 but does have some of the suggested features, such as two physically separated sumps in containment, that are not subject to dynamic induced failures.

The internal recirculation sump strainers are not susceptible to any credible failures because they are not vulnerable to failure mechanisms arising from (1) the dynamic effects of piping ruptures and structural loadings, (2) inadvertent latent damage from maintenance work or other activities in containment, and (3) the effects of post-accident debris, as follows:

(1) Dynamic Effects Postulated line breaks, including ones defined as high energy (HELBs), that could potentially interact with the internal recirculation sump strainers have been reviewed.

Drawings, procedures, and design specifications were sources of information for identifying low, medium, and high energy piping and its potential for rupture in close proximity to the strainers. Isometric and piping restraint drawings were specifically reviewed to determine if the sump was a target of pipe whip or jet impingement. It was concluded that applicable piping is either too far away to create an interaction, is of energy too low to break catastrophically (i.e. not a HELB) and incur damage, could be isolated remotely, or is adequately restrained / blocked. Pipe breaks, specifically HELBs, are deemed to not produce deleterious damage to the internal recirculation sump strainers, and are thus not a viable cause of consequential damage.

The generation of missiles internal to the Containment resulting from a transient or accident was also reviewed for its impact on the internal recirculation sump passive failure. Catastrophic failure of the reactor vessel, steam generators, pressurizer, RCS piping (except the pressurizer surge line), and RCP casings leading to the generation of missiles has been previously evaluated. Based on certain design and licensing inputs, including licensure to the Leak Before Break methodology, these types of failures have been deemed incredible. Missiles generated by a potential pressurizer surge line break would not affect the sump due to the protective concrete walls of its enclosure. Robust structural barriers exist between the missile source and the strainers. The internal recirculation sump is located in its own enclosure which is protected from the rest of the Containment volume by substantial concrete walls. The enclosure's penetrations (i.e., doors, sleeves, etc) are so

NL-08-01 5 Attachment 1 Page 19 of 28 oriented that any missile's flight path will not negatively affect the sump. Any impact of a missile created by means other than the above would not be close enough to damage the internal recirculation sump strainers. Therefore, damage to the internal recirculation sump strainer structure from missiles is precluded by a combination of distance, trajectory, and protective barriers. Additionally, certain potential internal missile generation mechanisms have been analyzed to be not credible (in a probabilistic and deterministic sense). The sump strainer assembly is protected from missiles external to Containment by the reinforced structure of the Containment Building itself.

The internal recirculation sump strainer assembly is nuclear safety-related and is designed to withstand safe shutdown earthquake loadings, hydrodynamic loads, hydrostatic loads, dead weights, thermal expansion, differential pressure, and operating loads. The strainer assembly is designed for the maximum expected Containment subcompartment differential pressures. Formal analyses / calculations have been performed for all the design factors cited above. These analyses have concluded acceptable results.

The sump strainer design and installation processes, and the materials of construction, are in accordance with the QA Program for safety-related items. This ensures that the internal recirculation sump strainers, and other GSI-1 91 -related modifications associated with these strainers, meet the highest level of quality.

Elements of the QA Program fully-comply with, and in some cases exceed, 10CFR50 Appendix B requirements.

The materials of construction of the internal recirculation sump strainers and associated components were chosen to be compatible with their operating and environmental requirements. The strength of the materials is adequate, with margins, for the maximum stresses and strains the overall structure would experience under the worst-case loading combination analyzed. Corrosion resistance has been considered and included in material selection. No detrimental material interactions have been identified. Since the structure possesses no moving parts, specific wear and fatigue are not regarded as credible degradation generators. The robustness of the design and construction assures that the structure does not excessively deteriorate due to normal variations in containment conditions nor those experienced during outages or system testing.

The above demonstrates that the internal recirculation sump strainers are not subject to damage by dynamic effects.

(2) Inadvertent Latent Damage The internal recirculation sump strainer assembly is adequately protected from latent damage during refueling outages or other maintenance activities (for example, latent damage caused by dropped tools or from personnel working in the vicinity of or passing by the strainer structure). Protection from falling objects of sufficient weight to damage the strainers is afforded by properly designed and installed scaffoldin'g' and by the grating floor located above the internal recirculation sump in the RHR Heat Exchanger cell. Other structural interferences are also present that provide

NL-08-015 Attachment 1 Page 20 of 28 protection. Procedural and administrative controls (for example, the Foreign Material Exclusion (FME) and Scaffolding Programs) are in effect that when work is being performed on the strainer assembly or in its vicinity, direct or latent damage is not imposed on the structure.

As required by the Technical Specifications, periodic (every 2 years) surveillance inspections of the containment and recirculation sumps ensure that they are unrestricted and stay in proper operating condition. The intent of this surveillance is to ensure the absence of any condition which could adversely affect strainer operability. This inspection involves examination of accessible strainer surfaces for latent damage and other adverse conditions. Specific procedural guidance is provided for conducting the strainer assembly inspections as part of containment building entry and egress activities. Containment inspections that include the sump are performed prior to transitioning from Mode 5 to Mode 4 and from Mode 2 to Mode 1. Strainer surfaces that are inaccessible for inspection would be afforded additional protection from latent damage by interfering structures and components that prevent access. The inspection frequency is considered to be sufficient to detect abnormal degradation. Therefore, it is concluded that credible mechanisms for latent damage to the strainers are limited to areas that are accessible for the purposes of visual inspection. Inspection acceptance criteria are in place to ensure that the strainer design has not been degraded beyond an acceptable point.

The strainer structure is designed to minimize the necessity for disassembly during outages. The design in fact is such that several containment sump components and structures were modified and/or relocated to facilitate construction and reduce any potential future disassembly. However, if for some reason it becomes necessary to disassemble any portion of the internal recirculation sump strainer assembly, this work would be accomplished by procedure to ensure that the re-assembly meets the standards employed in its original construction.

The strainers and waterbox assemblies are constructed of stainless steel and are therefore not susceptible to corrosion during normal operation.

The above demonstrates that the internal recirculation sump strainers are not subject to inadvertent and undetected latent damage from activities in containment.

(3) Effects of Post Accident Debris Under current post accident debris licensing basis assumptions the NPSH margins for the recirculation and residual heat removal pumps are acceptable as described in the UFSAR.

The demonstration that the strainer design is capable of accommodating the new GL 2004-02 licensing basis debris loads, including chemical effects, will be addressed by the GL 2004-02 supplementary submittal, and additional submittals as required by the granted extension requests and resolution of NRC GSI-191 audit open items.

The above demonstrates that the internal recirculation sump strainers will not fail under current licensing basis assumptions for post-accident debris effects.

NL-08-015 Attachment 1 Page 21 of 28 Therefore, given that the internal recirculation sump strainers are seismically qualified, fully passive components, there are no credible failures which could adversely affect the recirculation sump strainers at Indian Point.

The containment sump strainers are also not vulnerable to the failure mechanisms cited above and therefore will be available.

4.2.3 Consideration of Internal Recirculation System Piping and Component Failures As described in the UFSAR (Section 6.2.2.1.2 (Unit 2) and 6.2.2.1 (Unit 3)), the recirculation pumps, the residual heat removal heat exchangers, piping, and valves vital to the function of the recirculation loop are either located in a missile-shielded space inside the polar crane support wall on the west side of the reactor primary shield or outside the crane wall. Therefore, these components are not vulnerable to failure mechanisms arising from the dynamic effects of piping ruptures and structural loadings. Individual injection lines pass though the missile shield and then connect to the loops. The separation of the individual injection lines is provided to the maximum extent practicable. The movement of the injection line, associated with a rupture of a reactor coolant loop, is accommodated by line flexibility and by the design of the pipe supports such that no damage outside the missile barrier is possible.

The ECCS was designed and installed as Quality Assurance Classification Class "A" or Safety Related systems. All of the criteria contained in 10CFR50 Appendix B were, and continue to be, met in the design, material procurement, installation, initial and periodic testing / inspection, and maintenance aspects of the systems. In addition, various programs have been established to ensure that systems, structures, and components are in acceptable condition and will continue to meet their functional requirements. These programs include bolting integrity, boric acid corrosion prevention, external surfaces monitoring, fatigue monitoring, heat exchanger monitoring, in-service inspection, structural monitoring, water chemistry control, periodic surveillance and preventative maintenance. /

The probability of a passive failure within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following initiation of recirculation is extremely low partly due to the application of the Appendix B criteria and the aforementioned monitoring programs.

4.2.4 Consideration of CCWS Piping Failures As described in the UFSAR (Section 9.3.3.1.1 (Unit 2) and 9.3.3 (Unit 3)), for component cooling of the reactor coolant pumps, the excess letdown heat exchanger and the residual heat exchangers inside the containment, most of the piping, valves, and instrumentation are located outside the primary system concrete shield at an elevation above the water level in the bottom of the containment at postaccident conditions. (The exceptions are the cooling lines for the reactor coolant pumps and reactor supports, which can be secured following the accident.) In this location the systems in the containment are protected against credible missiles and from being flooded during postaccident operations.

Outside the containment, the residual heat removal pumps, the spent fuel heat exchanger, the component cooling pumps and heat exchangers and associated valves, piping and instrumentation are maintainable and can be inspected during power operation. Replacement of one pump or one heat exchanger is practicable while the other units are in service. The wetted

NL-08-015 Attachment 1 Page 22 of 28 surfaces of the component cooling loop are fabricated from carbon steel. The component cooling water contains a corrosion inhibitor to protect the carbon steel. Welded joints and connections are used except where flanged closures are employed to facilitate maintenance.

The entire system is seismic Class I and is housed in structures of the same classification. The components are designed to the applicable code requirements. In addition, the components are not subjected to any high pressures or stresses. Hence, a rupture or failure of the system is very unlikely.

4.2.5 Consideration of the Proposed Backup Recirculation Capability and Core Damage Frequency The justification for this licensing basis change is based in the most part on documented NRC positions. However, as the probabilistic risk assessment model is impacted (recirculation backup capability at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for a LBLOCA), a risk analysis was performed to determine the change (delta) in core damage frequency and the change in large early release frequency.

The backup capability of the containment sump may be considered a defense-in-depth measure although that term is not used in the UFSAR. During initial plant licensing defense-in-depth measures may also have influenced ECCS design in addition to the single failure criteria.

Whether or not defense-in-depth measures are overly restrictive can be determined through probabilistic risk analysis (PRA).

As described in section 1.0 above the potential loss of backup capability for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is expected to only apply to LBLOCAs. Backup capability would be maintained at the completion of switchover to recirculation for all other LOCAs and initiating events. Defense-in-depth would be maintained for these more probable events.

To quantify the risk impact of the proposed licensing basis changes the following probabilistic risk analysis cases were run:

Case A: Large Break LOCA initiating event with current baseline model (prior to any changes)

Case B: Large Break LOCA, assuming that use of external recirculation during the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following an accident is not a success path (i.e. only internal recirculation is credited). Since the PRA treats all LOCAs greater than six inch equivalent diameters as large break LOCAs, this provides a conservative assessment.

CDF and Delta CDF Case IP2 IP3 A Large LOCA CDF CDF/year 1.58E-8 2.19E-8 Contribution Large LOCA CDF CDF/year 1.90E-8 2.47E-8 Contribution - without Delta CDF/year 3.27E-9 2.83E-9 B external recirculation  % Changein capability ~CDF capability0.018% ________________

0.025%

NL-08-015 Attachment 1 Page 23 of 28 The incremental core damage frequency is approximately 3E-9 per year for both units. This is far below the 1 E-6 incremental core damage frequency criterion of Regulatory Guide 1.174 for considering a change to have a very small impact on risk. Since this is also more than an order of magnitude below the corresponding criterion (1 E-7) for incremental large early release frequency, that criterion is also satisfied. Therefore, these Regulatory Guide criteria can be satisfied without reliance on the recirculation phase backup capability for LBLOCA events. This is true for either the current licensing basis or that to be adopted when the regulatory requirements of GL 2004-02 are met.

The demonstration that the strainer design is capable of accommodating the new GL 2004-02 licensing basis debris loads, including chemical effects, will be addressed by the additional GL 2004-02 submittals as required by the granted extension requests and resolution of NRC GSI-191 audit open items.

NL-08-015 Attachment 1 Page 24 of 28

5.0 REGULATORY ANALYSIS

5.1 No Significant Hazards Consideration In 10 CFR 50.92(c), the NRC provides the following standards to be used in determining the existence of a Significant Hazards Consideration:

.. a proposed amendment to an operating license for a facility licensed under 10 CFR 50.21 (b) or 10 CFR 50.22 or for a testing facility involves no significant hazards consideration, if operation of the facility in accordance with the proposed amendment would not: (1) involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) involve a significant reduction in a margin of safety."

Entergy has reviewed the proposed licensing basis change and has determined that its adoption does not involve a Significant Hazards Consideration as discussed below:

1. Does the proposed change involve a significant increase in the probability or consequences of an accident previously evaluated?

Response: No.

The probabilities of accidents previously evaluated are based on the probability of initiating events for these accidents.

The proposed changes to the ECCS and CCWS (Unit 2 only) passive failure and recirculation phase backup capability licensing basis do not have any impact on the integrity of any plant system, structure or component that initiates an analyzed event.

The ECCS system and the CCWS are accident mitigating systems under these conditions and therefore cannot cause accidents. Thus the probability of any accident previously evaluated is not significantly increased.

The consequences of accidents previously evaluated are determined by the results of analyses that are based on plant initial conditions, the type of accident, plant response, and the operation and potential failure of equipment and systems. Because a passive failure within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the initiating event is not a credible failure, the ECCS and the CCWS (Unit 2 only) will continue to operate as required for accident mitigation. Therefore, the consequences of the accident are not significantly impacted by this proposed change.

2. Does the proposed change create the possibility of a new or different kind of accident from any accident previously evaluated?

Response: No.

New or different kinds of accidents can only be created by new or different accident initiators or sequences. The proposed changes do not create any new or different accident initiators because these changes do not cause failures of equipment or accident sequences different from those previously evaluated. The ECCS and CCWS (Unit 2 only) systems affected by the changes are used to mitigate the consequences of an accident that has already occurred. The proposed UFSAR changes do not

NL-08-015 Attachment 1 Page 25 of 28 significantly affect the mitigative function of these systems. No new failure mechanisms will be introduced by the proposed changes. The changes do not result in any event previously deemed incredible being made credible.

Therefore, plant operation in accordance with the proposed changes will not create the possibility of a new or different type of accident from any accident previously evaluated.

3. Does the proposed change involve a significant reduction in a margin of safety?

Response: No.

The proposed amendment does not involve a significant reduction in a margin of safety. The proposed changes do not adversely affect plant safety limits, set points, or design parameters.

The proposed changes assure that the ECCS, and Containment Spray recirculation functions can be adequately accomplished. The proposed changes do not have any impact on the integrity of any plant system, structure or component that initiates an analyzed event. The proposed changes do revise the ECCS and CCWS (Unit 2 only) licensing basis. The revised licensing bases were appropriately evaluated to ensure that there was no significant reduction in the margin of safety. The ECCS and CCWS will continue to provide accident mitigation capability.

Therefore, the proposed change will not create a significant reduction in a margin of safety.

Based upon the preceding information, Entergy has concluded that the proposed amendments present no significant hazards consideration under the standards set forth in 10 CFR 50.92(c),

and, accordingly, a finding of "no significant hazards consideration" is justified.

NL-08-015 Attachment 1 Page 26 of 28 5.2 Applicable Regulatory Requirements and Guidance Regulatory and licensing requirements and guidance pertaining to the requested licensing basis changes concerning the ECCS include the following (the GDC applicable to the ECCS are those cited in Section 6 of the UFSARs):

" Paragraph (d)(3) of Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Section 50.36, "Technical Specifications," states that surveillance requirements are requirements relating to test, calibration, or inspection to assure that the necessary quality of systems and components is maintained, that facility operation will be within safety limits, and that the limiting conditions of operation will be met. LCO 3.5.2 of the Indian Point Unit 2 and 3 Technical Specifications, "Emergency Core Cooling Systems (ECCS)," states that three ECCS trains shall be OPERABLE.

• Paragraph (b)(5) of 10CFR 50.46, states that after any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be maintained at an acceptably low value and decay heat shall be removed for the extended period of time required by the long-lived radioactivity remaining in the core.

" Paragraph (d) of 10CFR 50.46, states, in part the criteria set forth in paragraph (b), with cooling performance calculated in accordance with an acceptable evaluation model, are in implementation of the general requirements with respect to ECCS cooling performance design set forth in this part, including in particular Appendix A to 10 CFR Part 50 General Design Criteria (GDC) Number 35, "Emergency core cooling."

• GDC 37 states that engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems. Such engineered safety features shall be designed to cope with any size reactor coolant piping break up to and including the equivalent of a circumferential rupture of any pipe in that boundary, assuming unobstructed discharge from both ends.

" GDC 38 states that all engineered safety features shall be designed to provide such functional reliability and ready testability as is necessary to avoid undue risk to the health and safety of the public.

" GDC 40 states that adequate protection for those engineered safety features, the failure of which could cause an undue risk to the health and safety of the public, shall be provided against dynamic effects and missiles that might result from plant equipment failures.

• GDC 41 states that engineered safety features, such as the emergency core cooling system and the containment heat removal system, shall provide sufficient performance capability to accommodate the failure of any single active component without resulting in undue risk to the health and safety of the public.

• GDC 42 states that engineered safety features shall be designed so that the capability of these features to perform their required function is not impaired by the effects of a loss of-coolant accident to the extent of causing undue risk to the health and safety of the public.

NL-08-015 Attachment 1 Page 27 of 28

" GDC 43 states that protection against any action of the engineered safety features, which would accentuate significantly the adverse after effects of a loss of normal cooling shall be provided.

• GDC 44 states that an emergency core cooling system with the capability for accomplishing adequate emergency core cooling shall be provided. This core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the emergency core cooling function and to limit the clad metal water reaction to acceptable amounts for all sizes of breaks in the reactor coolant piping up to the equivalent of a double-ended rupture of the largest pipe. The performance of such emergency core cooling system shall be evaluated conservatively in each area of uncertainty.

" GDC 52 states that where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure, this system shall perform its required function, assuming failure of any single active component.

" SECY-77-439 was issued in 1977 by the NRC Office of Nuclear Reactor Regulation to provide information on the single failure criterion to the Commissioners. It was not intended to be a regulatory guidance document but serves as a consolidated NRC source of information on how the single failure criterion may be applied to plant licensing.

Entergy has determined that the proposed changes do not require any exemptions or relief from regulatory requirements.

5.3 Environmental Considerations Entergy has evaluated the proposed changes and determined the changes do not involve (1) a significant hazards consideration, (2) a significant change in the types or significant increase in the amounts of any effluents that may be released off-site, or (3) a significant increase in individual or cumulative occupational radiation exposure. Accordingly, the proposed changes meet the eligibility criteria for categorical exclusion set forth in 10 CFR 51.22(c)(9). Therefore, pursuant to 10 CFR 51.22(b), no environmental impact statement or environmental assessment need be prepared in connection with the proposed amendment.

6.0 PRECEDENCE For several plants, the licensing bases for single failures assumes that during the short term period (i.e. within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event), the single failure is limited to the failure of an active component. Should a single failure occur during the long-term period rather than the short term, the engineered safety features are designed to tolerate an active failure or a passive failure without loss of its protective function. Examples of such plants, are Catawba Units 1 and 2 (ML073020581 and related submittal) applicable to the ECCS and Diablo Canyon Units 1 and 2 (ML003674461) applicable to the auxiliary saltwater and CCWS.

Indian Point Unit 2 and 3 will be using a single sump (internal recirculation) to mitigate the consequences of a LBLOCA. In the event of a passive failure, the containment sump would also be available 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the initiating event, should it be required. A number of plants use a single sump, albeit shared (by two independent trains), for the duration of accident recovery following a design basis accident, including Catawba (Reference 11).

NL-08-015 Attachment 1 Page 28 of 28

7.0 REFERENCES

1. NRC Generic Letter 2004-02, "Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors," dated September 13, 2004.

2. Entergy Letter NL-05-094 to the NRC, "Response to NRC Generic Letter 2004-02, 'Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors,"' dated September 1, 2005.

3. Entergy Letter NL-05-133 to the NRC, "Supplemental Response to NRC Generic Letter 2004-02, 'Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors,"' dated December 15, 2005.

4. NRC Letter to NEI, "Supplemental Licensee Responses to GL 2004-02, "'Potential Impact of Debris Blockage on Emergency Recirculation During Design Basis Accidents at Pressurized-Water Reactors,"' dated November 30, 2007.

5. Safety Evaluation by the Office of Nuclear Reactor Regulation Related to NRC Generic Letter 2004-02, published as Volume 2 of Nuclear Energy Institute Guidance Report (NEI 04-07)

"Pressurized Water Reactor Sump Performance Evaluation Methodology," dated December, 2004.

6. Indian Point Unit 2 UFSAR Revision 20, 2006.

7. Indian Point Unit 3 UFSAR Revision 02, 2007.

8. SECY-77-439, "Information Report by the Office of Nuclear Reactor Regulation on the Single Failure Criterion," August 1977.

9. NUREG-0138, Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff, USNRC, November 1976.

10.NUREG-0153, Staff Discussion of Twelve Additional Technical Issues Raised by Responses to November 3, 1976 memorandum from Director, NRR to NRR Staff, USNRC, December 1976.

11 .NRC Letter to Catawba, "Catawba Nuclear Station, Unit 1 and 2, Issuance of Amendments Regarding Emergency Core Cooling System Strainer Modification," dated November 8, 2007 12.Entergy Letter NL-08-025 to the NRC, "Supplemental Response to NRC Generic Letter 2004-02, Potential Impact Of Debris Blockage On Emergency Recirculation During Design Basis Accidents At Pressurized-Water Reactors," dated February 28, 2008.

ATTACHMENT 2 TO NL-08-015 Unit 2 - Proposed Changes to the UFSAR Regarding the ECCS and CCWS Single Passive Failure Analysis and Recirculation Phase Backup Capability Markup of current UFSAR to show changes.

The affected pages are as follows:

Chapter 6: Pages 8,9,11,12,13,32,52,53,57,59,65,73,75,83 Chapter 9: Page 48 Chapter 14: Pages 93,116,132 Entergy Nuclear Operations, Inc.

Indian Point Nuclear Generating Unit No. 2 Docket No. 50-247

IP2 FSAR UPDATE system is tolerant of a loss of any part of the flow path since backup alternative flow path capability is provided AS AC .

The ability of the safety injection system to meet its capability objectives is presented in Section 6.2.3. The analysis of the accidents is presented in Chapter 14.

6.2.1.2 Inspection of Emergency Core Cooling System Criterion: Design provisions shall, where practical, be made to facilitate inspection of physical parts of the emergency core cooling system, including reactor vessel internals and water injection nozzles. (GDC 45)

Design provisions are made to the extent practical to facilitate access to the critical parts of the reactor vessel internals, pipes, valves, and pumps for visual or boroscopic inspection for erosion, corrosion, and vibration-wear evidence and for nondestructive test inspection where such techniques are desirable and appropriate.

6.2.1.3 Testing of Emergency Core Cooling System Component Criterion: Design provisions shall be made so that components of the emergency core cooling system can be tested periodically for operability and functional performance. (GDC 46)

The design provides for periodic testing of active components of the safety injection system for operability and functional performance.

Power sources are arranged to permit individual actuation of each active component of the safety injection system.

The safety injection pumps and residual heat removal pumps can be tested periodically during plant operation using the minimum flow recirculation lines provided. The residual heat removal pumps are used every time the residual heat removal loop is put into operation. All remote-operated valves can be exercised, and actuation circuits can be tested either during normal operation or routine plant maintenance.

6.2.1.4 Testing of Emergency Core Cooling System Criterion: Capability shall be provided to test periodically the operability of the emergency core cooling system up to a location as close to the core as is practical. (GDC 47)

An integrated system test can be performed when the plant is cooled down and the residual heat removal loop is in operation. This test would not introduce flow into the reactor coolant system, but would demonstrate the operation of the valves, pump circuit breakers, and automatic circuitry upon the initiation of safety injection.

Level and pressure instrumentation is provided for each accumulator tank, and accumulator tank pressure and level are continuously monitored during plant operation. Flow from the tanks can be checked at any time using test lines as described in Section 6.2.5.3.1.

Chapter 6, Page 8 of 170 Revision 20

IP2 FSAR UPDATE 6.2.1.5 Testing of Operational Sequence of Emergency Core Cooling System Criterion: Capability shall be provided to test initially, under conditions as close as practical to design, the full operational sequence that would bring the emergency core cooling system into action, including the transfer to alternate power sources.

(GDC 48)

The design provides for the capability to test initially, to the extent practical, the full operational sequence up to the design conditions for the safety injection system to demonstrate the state of

-readiness and capability of the system. Details of the 6perational sequence testing are presented in Section 6.2.5.

6.2.1.6'Codes and Classifications Table 6.2-1 lists the codes and standards to which the safety injection system components are designed.

6.2.1.7 Service Life All portions of the system located within the containment are designed to operate without benefit of maintenance and without loss of functional performance for the duration of time the component is required.

6.2.2 System Design And Operation 6.2.2.1 System Description Adequate emergency core cooling following a loss-of-coolant accident is provided by the safety injection system shown in Plant Drawing 9321-2735 [Formerly UFSAR Figure 6.2-1]. Plant Drawing 235296 [Formerly UFSAR Figures 6.2-2] and Figures 6.2-2 through 6.2-5 depict how this system concept is translated into plant layout design. The system components operate in the following possible modes:

1. Injection of borated water by the passive accumulators.

2. Injection by the safety injection pumps drawing borated water from the refueling water storage tank.

3. Injection by the residual heat removal pumps also drawing borated water from the refueling water storage tank.

4. Recirculation of spilled reactor coolant, injected water, and containment spray system drainage back to the reactor from the recirculation sump by the recirculation pumps. The residual heat removal pumps provide backup recirculation capability through the independent containment sump The initiation signal for core cooling by the safety injection pumps and the residual heat removal pumps is the safety injection signal, which is described in Section 7.2.3.2.3.

Chapter 6, Page 9 of 170 Revision 20

IP2 FSAR UPDATE Water level indication and alarms on the refueling water storage tank give the operator ample warning to terminate the injection phase. Additional level indicators and alarms are provided in the recirculation and containment sumps, which also give backup indication when injection can be terminated and recirculation initiated.

6.2.2.1.2 Recirculation Phase After the injection operation, coolant spilled from the break and water collected from the containment spray are cooled and returned to the reactor coolant system by the recirculation system.

When the break is large, depressurization occurs due to the large rate of mass and energy loss through the break to containment. In the event of a large break, the recirculation flow path is within the containment. The system is arranged so that the recirculation pumps take suction from the recirculation sump in the containment floor and deliver spilled reactor coolant and borated refueling water back to the core through the residual heat exchangers. The system is also arranged to allow either of the residual heat removal pumps to take over the recirculation function. The residual heat removal pumps would only be used if backup capacity to the internal recirculation loop is requirec_ Water is delivered from the containment to the residual heat removal pumps from the separate containment sum:) ,,ent.

For small breaks, the depressurization of te reactor coolant system is augmented by steam dump from and auxiliary feedwater addition to the steam generators. For the smaller breaks in the reactor coolant system where recirculated water must be injected against higher pressures for long-term cooling, the system is arranged to deliver the water from residual heat removal heat exchanger 21 to the high-head safety injection pump suction and by this external recirculation route to the reactor coolant loops. If this flow path is unavailable, an alternate flow path is provided as indicated in Table 6.2-11. Thus, if depressurization of the reactor coolant system proceeds slowly, the safety injection pumps may be used to augment the flow-pressure capacity of the recirculation pumps in returning the spilled coolant to the reactor. In this system configuration, the recirculation pump (or residual heat removal pump) provides flow and net positive suction head to the operating safety injection pumps. To prevent safety injection pump flow in excess of its maximum allowable (i.e., runout) limit, variable flow orifices are installed at the discharge of the safety injection pumps and the hot and cold leg motor-operated isolation valves are preset with mechanical stops based on data from operational flow testing to limit system maximum flow capability.

The recirculation pumps, the residual heat removal heat exchangers, piping, and valves vital to the function of the recirculation loop are located in a missile-shielded space inside the polar crane support wall on the west side of the reactor primary shield.

There are two sumps within the containment, the recirculation sump and the containment sump.

Both sumps collect liquids discharged into the containment during the injection phase of the design-basis accident.

Variou**sfow channeling bar.ers. are installed in tContaimntEL6-O"to force tho reciraion flow. intothe 'Reator yt:S ,area, pand out thei-core nsttumentation Tun*nel throu th.<Crane' Wal*l.ia jht hre nominal 20',indh square openings, andri:intboth6 an'lsa~aotieth' Cra WI§ Th~e circulationý flow, will: irt oad Recirculation Sump-,Strain'er or the, Contaihetu m. Sir aIine , mnrt twards the are opoer6 ing.ý Flow cha~nneling-barriersa&is o nýh eco aiyPafrE 9-"

Chapter 6, Page 11 of 170 Revision 20

IP2 FSAR UPDATE mshinsde ithr o th to,(2) ani stahlessstel

~eiting~het-lat modules, water will flow~intc Upon to the Containmeri'tý Suni,suction line andth& R1

~ idi~issd i6Sctio n 6.7 1.2.iZ131:

The low-head external recirculation loop via the containment sump line and the residual heat removal pumps provides backup recirculation capability to the low-head internal recirculation loop. The containment sump line has two remote motor-operated normally closed valves located outside the containment and a remote motor-operated butterfly valve inside containment The high-head external recirculation flow path via the high-head safety injection pumps is(f+/-required for the range of small-break sizes for which the reactor coolant system pressure remins in excess of the shutoff head of the recirculation pump. orF rcsFuA', WP 9; c *Eý at the end of the injection phase.

"r *ý&% r-WJv ar Page of 170 Revision 20 -- .

IP2 FSAR UPDATE The external recirculation flow paths within the primary auxiliary building are designed so that external recirculation can be initiated immediately after the accident. Those portions of the safety injection system outside of the containment, which are designed to circulate, under postaccident conditions, radioactivity contaminated water collected in the containment meet the following requirements:

1. Shielding to limit radiation levels.

2. Collection of discharges from pressure-relieving devices into closed systems.

3. Means to detect and control radioactivity leakage into the environs.

These criteria are met by minimizing leakage from the system. External recirculation loop leakage is discussed in Section 6.2.3.8. The radiological consequences of external recirculation loop leakage following a design basis accident are presented in Section 14.3.6.6. Detection, and control of leakage from external recirculation loop components is also discussed in Section 6.7 One pu and one residual heat exchanger of the recirculation system provi e su rcued water to keep the core flooded with water by injection through the cold-leg connections while simultaneously providing, sufficient containment recirculation spray flow to reduce containment airborne activity. Three of the five fan cooler units prevent the containment pressure from rising above design limit. Analysis demonstrates that flow will 'be determined by system resistance provided by the physical configuration of the recirculation piping and components, and will be hydraulically balanced such that sufficient flow is established to the core and the spray header. Only one pump and one heat exchanger are required to operate for this capability at the earliest time recirculation spray is initiated. With both recirculation..84 5i---t 1pumps in operation and both spray header valves open, a recirculatioýn sraýyflow rate canbeestablished such that no containment cooling fans (Section 6.4) are required. Likewise with five containment cooling S

~j3-sglmt~fedesign ion, no containment ensures thatspray heatis removal required from to maintain the corecontainment pressure and containment below its is effective in the event of a pipe or valve body rupture. ' _.

6.2.2.1.3 CoolingW The service water system (Section .6) provides cooling water to the component cooling loop, which in turn cools the residual heat exchangers, both of which are part of the auxiliary coolant systems (Section 9.3). Three non-essential service water pumps are available to take suction from the river and discharge to the two component cooling heat exchangers. Three component cooling pumps are available to discharge through their heat exchangers and deliver to the two residual heat exchangers. During the recirculation phase following a loss-of-coolant-accident, only one residual heat removal heat exchanger, one recirculation or residual heat removal pump, one non-essential service water pump, one component cooling water pump and one component cooling water heat exchanger are required to meet the core-cooling function. All of this equipment, with the exception of the residual heat exchangers and the recirculation pumps, are outside containment.

Chapter 6, Page 13 of 170 Revision 20

IP2 FSAR UPDATE Initial response of the injection systems is automatic, with appropriate allowances for delays in the actuation of circuitry and active components. The active portions of the injection systems are automatically actuated by the safety injection signal (Chapter 7). In addition, manual actuation of the entire injection system and individual components can be accomplished from the control room. In the analysis of system performance, delays in reaching the programmed trip points and in the actuation of components are conservatively established on the basis that only emergency onsite power is available.

The starting sequence of the safety injection and residual heat removal pumps and the related emergency power equipment is discussed in sections 7.2 and 8.2.3.4 and their analyzed performance is discussed in the various Chapter 14 safety analyses.

6.2.3.3 Single-Failure Analysis A single active failure analysis is presented in Table 6.2-10. All credible active system failures are considered. This analysis is based on the worst single failure (generally a pump failure) in both the safety injection and residual heat removal pumping systems. The analysis shows that the failure of any single active component will not prevent fulfilling the design function. The analysis of the loss-of-coolant accident presented in Section 14.3 is consistent with this single-failure analysis . .. . . ,. ,

In addition, an alternative flow path is available to maintain core cooling if any part of the recirculation flow path becomes unavailable. This is evaluated in Table 6.2-11. The procedure followed to establish the alternative flow path also isolates the spilling line. A valve is provided in the containment recirculation line to the residual heat removal pumps to isolate this line should it be required.

Failure analyses of the component cooling and service water system under loss-of-coolant accident conditions are described in Sections 9.3 and 9.6, respectively.

6.2.3.4 Reliance on Interconnected Systems a,- r-.?-

During the injection phase, the high-head safety injection pumps do not depend on any portion of other systems, with the exception of the suction line from the refueling water storage tank and the component cooling loop as a heat sink for bearing and lube oil cooling. During the recirculation phase of the accident for small breaks, suction to the high-head safet injection pumps is provided by the recirculation pumps o he residual hearremoval pumps. The resi ual heat removal (low-head) pumps are normally used during reactor shutdown operations.

Whenever~the reactor is at power, the pumps are aligned for emergency duty.

6.2.3.5 Shared Function Evaluation Table 6.2-12 is an evaluation of the main components, which have been previously discussed, and a brief description of how each component functions during normal operation and during the accident.

hap er 6, Page 32 of 170 Revision 20

IP2 FSAR UPDATE TABLE 6.2-11 (Sheet 1 of 2) i ' ,

(Loss Of Recirculation Flow Path)

Flow Path Indication Of Alternative Loss Of Flow Path Flow Path1 Low head recirculation From recirculation sump to low-head injection header 1. Insufficient flow in From recirculation sump to via the recirculation pumps low-head injection lines high-head injection header and the residual heat (one flow monitor in via the recirculation pumps, exchangers each of the four one of the two residual heat low-head injection exchangers and the safety lines 2) injection pump. 3

2. As 1 above. a. From containment sump to discharge header of the residual heat exchangers via the residual heat removal pumps.

b. If flow not established in low-head injection lines, as (a), except path is from discharge of one residual heat exchanger to the high-head injection header via the safety injection pumps.

Chapter 6, Page 52 of 170 Revision 20

1P2 ESAR UPDATE TABLE 6.2-11 (Sheet 2 of' 2)

(Loss Of Recirculation Flow Path)

Flow Path Indication Of Alternative Loss Of Flow Path Flow Path, High-head recirculation From recirculation sump to 1. No flow in high-head a. From containment sump high-head injection header injection header (four to high head injection via the recirculation pumps, flow monitors, one in header via the residual one of the two residual each cold leg injection heat removal pumps, exchangers and the high- line and one pressure one of the residual heat head injection pumps monitor) exchangers and the high-head injection pumps.

b. If flow is not established in high-head injection header - as (a), except path is from discharge of the residual heat removal pumps to the high-head injection pumps via the middle safety injection pump (by-passing the residual heat exchangers 4).

2. Flow in only one of the a. As 1(b), except that flow two high-head injection from the middle safety branch headers (two injection pump is only flow monitors per supplied to the unbroken branch header) branch header.

Notes:

1. As shown in Plant Drawings 9321-2735 & 235296 [Formerly UFSAR Figure 6.2-1], there are valves at all locations where alternative flow paths are provided.

2. If minimum flow requirements have been established, the supply of recirculated water using low-head recirculation will maintain the core flooded even in the event of a low-head spilling line and one failed flow meter or other single failure.

3. Manual start

4. In this recirculation mode, water is returned to the core without being cooled by the residual heat exchangers. Heat is removed from the core by boiloff of the water to the containment; heat is then removed from the containment by either the containment fan coolers and/or the containment spray system (using cooled water from the recirculation sump via the recirculation pumps and one residual heat exchanger).

Chapter 6, Page 53 of 170 Revision 20

IP2 FSAR UPDATE 6.3 CONTAINMENT SPRAY SYSTEM 6.3.1 Design Bases 6.3.1.1 Containment Heat Removal Systems Criterion: Where an active heat removal system is needed under accident conditions to prevent exceeding containment design pressure, this system shall perform its required function, assuming failure of any single active component. (GDC 52)

Adequate containment heat removal capability for the containment is provided by two separate, full capacity, engineered safety feature systems. The containment spray system, whose components operate in the sequential modes described in Section 6.3.2, and the containment air recirculation cooling system, which is discussed in Section 6.4.

The primary purpose of the containment spray system is to spray cool water into the containment atmosphere when appropriate in the event of a loss-of-coolant accident and thereby ensure that containment pressure does not exceed its design value, which is 47 psig at 271OF. (100-percent relative humidity) This protection is afforded for all pipe break sizes up to and including the hypothetical instantaneous circumferential rupture of a reactor coolant loop as discussed in UFSAR Section 14.3.5.1.1. Pressure and temperature transients for a loss-of-coolant accident are presented in Section 14.3. Although the water in the core after a loss-of-coolant accident is quickly subcooled by the safety injection system, the containment spray system design is based on the conservative assumption that the core residual heat is released to the containment as steam.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the postaccident containment pressure below the design value, assuming that the core residual heat is released to the containment as steam.

1. Containment Spray alone as follows:

Both containment spray pumps operating up to the time the transfer to core recirculation flow begins (during injection phase).

One spray pump continuing to take suction from the RWST until the level in the RWST decreases to 2 feet.

Both recirculation pumps VQ_R.ntt both residual heat exchangers and oth conainmen recirculation spray headers in operation when the level in the RWST decreases below 2 feet.

2. All five containment cooling fans (to be discussed in Section 6.4).

3. One containment spray pump and three of the five containment cooling fans (the minimum containment safeguards case discussed in Section 14.3.5).

6.3.1.2 Inspection of Containment Pressure-Reducing Systems Criterion: Design provisions shall be made to the extent practical to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as pumps, valves, spray nozzles and sumps. (GDC 58).

Chapter 6, Page 57 of 170 Revision 20

IP2 FSAR UPDATE Capability is provided to test initially to the extent practical the operational startup sequence of the containment spray system including the transfer to alternative power sources.

6.3.1.6 Performance Obiectives The containment spray system is designed to spray at least 5000 gpm of borated water into the containment whenever the coincidence of two sets of two out of three (Hi-Hi) containment pressure (approximately 50-percent of design value) signals occur or when a manual signal is initiated. Either of two subsystems containing a pump and associated valving and spray header is independently capable of delivering one-half of the designed flow, or 2500 gpm, which exceeds the minimum containment spray flow of 2180 gpm assumed in the Containment Analysis as described in Table 14.3-40.

The design basis for the containment spray system is, full capacity flow will provide sufficient heat removal capability to maintain the post accident containment pressure below 47 psig, assuming that the core residual heat is released to the containment as steam.

A second purpose served by the containment spray system is to remove elemental iodine and particulates from the containment atmosphere should they be released in the event of a loss-of-coolant accident. The analysis, indicating the system's ability to limit the offsite dose to within applicable limits after a hypothetical loss-of-coolant accident is presented in Section 14.3.6.

To meet the above bases, the following design requirements were established:

1. All components of the system have to meet Class I seismic criteria.

2. The system's initial response has to be fully automatic.

3. Total redundancy of equipment, flow paths, and power supply.

4. Provisions for periodic testing have to be provided.

5. Equipment is to be arranged to provide maximum protection from missiles.

The spray system, including recirculation spray, is designed to operate over an extended time period following a reactor coolant system failure, as required to restore and maintain containment conditions at or near atmospheric pressure. It has the capability of reducing the containment postaccident pressure and subsequent containment leakage. A tertiary function of the system is to provide an alternative means of filling the reactor refueling cavity during reactor vessel head removal.

Portions of other systems that share functions and become part of the containment spray system, when required, are designed to meet the criteria of the containment cooling function.

Neither a single active component failure in such systems during the injection phase nor an active/passive failure during the recirculation phase will degrade the design heat removal capability of containment coolin%. ,CI -3)

System piping located within the containment is redundant and separable in arrangement unless fully protected from damage that may follow any reactor coolant system loop failure.

Chapte'r 6, Page 59 of 170 Revision 20

FSAIP2 FSAR UPDATE activity, i.e., for at least 3.4 hr after the accident; the flow, however, is also sufficient to maintain the containment pressure below the design value.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the containment as steam.

1. Containment Spray alone as follows:

Both containment spray pumps operating up to the time the transfer to core recirculation flow begins (during injection phase).

• One spray pump continuing to take suction from the RWST until the level in the RWST decreases to 2 feet.

• Both recirculation pumps *.m.va pp-" both residual heat exchangers ar1"bdh- o co--ainment r-h spray headers in operation when the level in the RWST decreases below 2 feet.

2. All five containment cooling fans (discussed in Section 6.4)

3. One containment spray pump and three of the five containment ,cooling fans (the minimum containment safeguards case discussed in Section 14.3.5).

During the injection and recirculation phases the spray water is raised to the temperature of the containment in falling through the steam-air mixture. The minimum fall path of the droplets is approximately 118-ft from the lowest spray ring headers to the operating deck. The actual fall path is longer due to the trajectory of the droplets sprayed out from the ring header. Drops of approximately 1000 micron average size will reach temperature equilibrium with the steam-air containment atmosphere after falling through less than half the available spray fall height as discussed in UFSAR Section 14.3.5.2.1.

At containment design temperature, 271 0 F, the total design heat absorption capability of one spray pump is 218 x 106 Btu/hr based on the assumption of 100OF refueling water and design flow of 2500 gpm.

When the refueling water storage tank level drops below 2 feet, injection spray is terminated and the recirculation pumps supply the flow to the containment recirculation spray headers.

Recirculation spray can be established at a flow rate that will maintain containment pressure below the design pressure of 47 psig even if no containment fan coolers are operating.

Elemental iodine and aerosols are removed by the containment spray system. Removal coefficients and the limitations on removal are discussed in Appendix 6A. A discussion of the effectiveness of containment spray as a fission product trapping process is contained in Reference 1.

A single train of containment spray will provide sufficient iodine removal capability to ensure postaccident fission product leakage that would not result in exceeding the applicable dose limits. This is evaluated in Section 14.3.6.

Chapter 6, Page 65 of 170 Revision 20

IP2 FSAR UPDATE Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the postaccident containment pressure below the design value, assuming that the core residual heat is released to the containment as steam.

1. All five containment cooling fans.

2. Containment Spray alone as follows:

Both containment spray pumps operating up to the time the transfer to core recirculation flow begins (during injection phase).

One spray pump continuing to take suction from the RWST until the level in the RWST decreases to 2 feet.

Both recirculation pumps *odth , h -_- - both residual heat exchangers na-menT-recircula-t'[n spray headers in operation when the level in the RWST decreases below 2 feet.

3. One containment spray pump and three of the five containment cooling fans (the minimum containment safeguards case discussed in Section 14.3.5).

6.4.1.2 Inspection of Containment Pressure-Reducing Systems Criterion: Design provisions shall be made to extent practical to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as pumps, valves, spray nozzles, torus, and sumps.

(GDC 58)

Design provisions are made to the extent practical to facilitate access for periodic visual inspection of all important components of the containment air recirculation cooling system.

6.4.1.3 Testing of Containment Pressure-Reducing Systems Components Criterion: The containment pressure-reducing systems shall be designed to the extent practical so that components, such as pumps and valves, can be tested periodically for operability and required functional performance. (GDC 59)

The containment air recirculation cooling system is designed to the extent practical so that the components can be tested periodically, and after any component maintenance, for operability and functional performance.

A number of air recirculation and cooling units are normally in operation and no additional periodic tests are required. The service water pumps that supply the cooling units can be part flow-tested during plant operation via the installed bypass test loop.

6.4.1.4 Testing of Operational Sequence of Containment Pressure-Reducing Systems Criterion: A capability shall be provided to test initially under conditions as close as practical to the design and the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources. (GDC 61)

Chapter 6, Page 73 of 170 Revision 20

IP2 FSAR UPDATE

2. In removing heat at the design basis rate, the coils are capable of discharging the resulting condensate without impairing the flow capacity of the unit and without raising the exit temperature of the service water to the boiling point. Since condensation of water from the air-steam mixture is the principal mechanism for removal of heat from the postaccident containment atmosphere by the cooling coils, the coil fins. will operate as wetted surfaces under these conditions.

Entrained water droplets added to the air-steam mixture, such as by operation of the containment spray system, will therefore have essentially no effect on the heat removal capability of the coils.

3. Each of the five air-handling units is equipped with moisture separators rated for full unit flow.

In addition to the above design bases, the equipment was originally specified to be capable of withstanding, without impairing operability, a pressure of 70.5 psig and 298°F for a period of one hour. The motors were further specified to be capable of running for 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> at required fan load in an atmosphere consisting of an air water vapor mixture initially at 47 psig and 271 0 F, and of continuous operation at 10 psig and 175°F. These ambient conditions and operating times have been updated and are maintained by the ongoing Environmental Qualification Program discussed in Section 7.1.4. As part of this program, the fan motors are qualified to withstand containment environment conditions following the loss of coolant accident so that the fans can perform their required function during the recovery period (1 year).

All components are capable of withstanding or are protected from differential pressures that may occur during the rapid pressure rise to 47 psig in 10 sec. Section 14.3.5.1.1 discusses the analyses that show that the calculated postaccident containment pressures are less severe than this.

Portions of other systems that share functions and become part of this containment cooling system when required are designed to meet the criteria of the containment cooling function.

Neither a single active component failure in such systems during the injection phase nor an active/passive failure during the recirculation phase will degrade the heat removal capability of containment cooling.*

Where portions of these systems are located outside of containment, the following features are incorporated in the design for operation under postaccident conditions:

1. Means for isolation of any section.

2. Means to detect and control radioactivity leakage into the environs.

6.4.2 System Desigqn And Operation The flow diagram of the containment air recirculation cooling system is shown in Plant Drawing 9321-4022 [Formerly UFSAR Figure 5.3-1].

Individual system components and their supports meet the requirement for seismic Class I structures and each component is mounted to isolate it from fan vibration.

Chapter 6, Page 75 of 170 Revision 20

IP2 FSAR UPDATE 6.4.2.2.10 Ducting The ducts -are designed- to withstand- the sudden- release- of-reactor- coolant system. energy- and-energy from associated chemical reactions without failure due to shock or pressure waves by incorporation of dampers along the ducts, which open at slight overpressure of 5 psi or less.

The ducts are designed and supported to withstand thermal expansion during an accident.

Where flanged joints are used, joints are provided with gaskets suitable for temperatures to 3000 F.

K Ducts are constructed of corrosion-resistant material.

6.4.2.2.11 [Deleted]

6.4.2.2.12 Electrical Supply Details of the normal and emergency power sources are presented in Chapter 8.

Further information on the components of the containment air recirculation cooling system is given in Section 5.3.

6.4.3 Design Evaluation 6.4.3.1 Range of Containment Protection The containment air recirculation cooling system provides the design heat removal capacity for the containment following a loss-of-coolant accident assuming that the core residual heat is released to the containment as steam. The system accomplishes this by continuously recirculating the air-steam mixture through cooling coils to transfer heat from containment to service water.

The performance of the containment recirculation cooling system for pressure reduction is discussed in Section 14.3.

Any of the following combinations of equipment will provide sufficient heat removal capability to maintain the postaccident containment pressure below the design value assuming that the core residual heat is released to the containment as steam.

1. All five containment cooling fans.

2. Containment Spray alone as follows:

Both containment spray pumps operating up to the time the transfer to core recirculation flow begins (during injection phase).

One spray pump continuing to take suction from the RWST uintil the level in the RWST decreases to 2 feet.

Both recirculation pumps 6A, ups both residual heat exchangers an bo con ame re" rcu a ion spray headers in operation when the level in the RWST decreases below 2 feet.

Chapter 6, Page 83 of 170 Revision 20

1P2 FSAR UPDATE Each of the two residual heat removal pumps is located in a shielded compartment with a floor drain. Piping conveys the drain water to a common sump. Two redundant sump pumps, each capable of handling the less than 50 gpm flow, which would result from the failure of a residual heat removal pump seal, discharge to the waste holdup tank.

9.3.3.2.3 Spent Fuel Pit Cooling Loop Whenever a leaking fuel assembly is transferred from the fuel transfer canal to the spent fuel storage pool, a small quantity of fission products may enter the spent fuel cooling water. A bypass purification loop is provided for removing these fission products and other contaminants from the water.

The probability of inadvertently draining the water from the cooling loop of the spent fuel pit is exceedingly low. The only mode would be from such actions as opening a valve on the cooling line and leaving it open when the pump is operating. In the unlikely event of the cooling loop of the spent fuel pit being drained, the spent fuel storage pit itself cannot be drained and no spent fuel is uncovered since the spent fuel pit cooling connections enter near the top of the pit. With no heat removal the time for the spent fuel pit water to rise from 180'F to 212OF with a full core in storage is at least 1.8 hr. Makeup water can be supplied within this time from the primary water storage tank, the refueling water storage tank and/or the fire protection system. The maximum required makeup rate for boiloff is 62 gpm (for a full core). Spent fuel pit temperature and level instrumentation would warn the operator of an impending loss of cooling. A local flow indicator is available to support operation of the Spent Fuel Pit Pumps.

9.3.3.3 Incident Control ?4ý 9.3.3.3.1 Component Cooling Loot) 3 r -- ~ c In the unlikely event of a pipe severance in the component cooling loop, backup is provided for postaccident heat removal by the containment fan coolers. -o Should the break occur outside the containment the leak could either be isolated by valving or the broken line could be repaired, depending on the location in the loop at which the break occurred.

Once the leak is isolated or the break has been repaired, makeup water is supplied from the reactor makeup water tank by one of the primary makeup water pumps. If the loop drains completely before the leakage is stopped, it can be refilled by a primary makeup water pump in less than 2 hr.

If the break occurs inside the containment on a cooling water line to a reactor coolant pump, the leak can be isolated. Each of the cooling water supply lines to the reactor coolant pumps contains a check valve inside and a common remotely operated valve outside the containment wall.

Each return line (combined oil coolers and combined thermal barrier coolers) has a common remotely operated valve outside the containment wall. The cooling water supply line to the excess letdown heat exchanger contains a check valve inside the containment wall and both supply and return lines have automatically isolated valves outside the containment wall.

~~LA

~~ ~ Chapter 9, Page 48 of 99

,~Revision 20, 2006 .~~~

4ýb

IP2 FSAR UPDATE generator, and the pump before it can be vented out the break. The resistance of this flow path to the steam flow is balanced by the driving force of water filling the downcomer. Shortly after reflood begins, the accumulators exhaust their inventory of water, and begin to inject the nitrogen gas, which was used to pressurize the accumulators. This results in a short period of improved heat transfer as the nitrogen forces water from the downcomer into the core. When the accumulators have exhausted their supply of nitrogen the reflood rate may be reduced and peak cladding temperatures may again rise. This heatup may continue until the core has reflooded to several feet. Approximately 3 minutes after the break, all locations in the core begin to cool. The core is completely quenched within 5 minutes, and long term cooling and decay heat removal begin. Long term cooling for the next several minutes is characterized by continued boiling in the vessel as decay power and heat stored in the reactor structures is removed.

Continued operation of the emergency core cooling system pumps supplies water during long-term cooling. Core temperatures would be reduced to long-term steady-state levels associated with the dissipation of residual heat generation. After the water. level of the refueling water storage'tank 'eaches a minimum allowable value, coolant for long-term cooling of the core is obtaihed by:, switching to the cold-leg recirculation mod of og eration in which spilled borated water is drawn froo the recirculation sUmpF.. 9- by the recirculation(f Ma_2rumps and returned to the reactor coolant system cold legs. The containment spray pumps continue to operate drawing water from the refueling water storage tank for further reduction of containment pressure. Approximately 6.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after initiation of the LOCA, the emergency core cooling system is realigned to supply water to the reactor coolant system hot legs in order to control the boric acid concentration in the reactor vessel.

The sequence of events for the large break LOCA is summarized in Table 14.3-1.

14.3.2.2 Description of Small-Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA there are only three characteristic stages, i.e., a gradual blowdown in which the water level decreases, core recovery, and long-term recirculation.

For small break LOCAs, the most limiting single active failure is the one that results in the minimum ECCS flow delivered to the RCS. This has been determined to be the loss of an emergency power train, which results in the loss of one complete train of ECCS components.

This means that credit can be taken for two out of three high head safety injection pumps, and one RHR (low head) pump. During the small break transient, two high head pumps are assumed to start and deliver flow into all four loops. The flow to the broken loop was conservatively assumed to spill to RCS in accordance with Reference 93 for a four-loop plant.

For the limiting break location analyzed (cold leg), the depressurization of the RCS causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low-pressure trip setpoint is reached. Loss-Of-Offsite-Power (LOOP) is assumed to occur coincident with reactor trip. A safety injection signal is generated when the appropriate setpoint (pressurizer low pressure SI) is reached. After the safety injection signal is generated, an additional delay ensues. This delay accounts for the instrumentation delay, the diesel generator start time, plus the time necessary to align the appropriate valves and bring the pumps up to full speed. The safety features described will limit the consequences of the accident in two ways:

Chapter 14, Page 93 of 218 Revision 20, 2006

IP2 FSAR UPDATE 14.3.5 Containment Integrity Analysis 14.3.5.1 Containment Structure 14.3.5.1.1 Design Bases The design and analysis of the Indian Point 2 containment structure are described in Chapter 5.

The design bases and design criteria are discussed in Section 5.1.1.1.6 and 5.1.2.2, respectively. The discussion contained in this Section pertains to containment response to Loss of Coolant Accidents. Containment response to secondary system pipe ruptures is discussed in Section 14.2.5.6.

Sources and amounts of energy that may be available for release to the containment are discussed in Section 14.3.5.3. To obtain a conservative pressure, energy is added to the containment in the manner most detrimental to peak pressure response for the containment response analysis.

Systems for removing energy from within the containment include the safety injection system (Section 6.2), the containment fan cooler system (Section 6.4), and the containment spray system (Section 6.3). The containment fan coolers remove energy from the containment atmosphere. Containment spray is used for rapid pressure reduction and for containment airborne activity removal. During the recirculation phase, the recirculation system removes heat from the reactor fuel via containment sump water. Heat removal by containment spray during the recirculation phase, which is part of the engineered safety features, is not assumed in the containment response analyses.

Engineered safety features systems are redundant and independent such that any single active failure in the engineered safety features system during the injection phase or any single active or passive failure during recirculation will not affect the ability to mitigate containment pressure as discussed in Sections 14.3.5.3.7 an 3 Reference 61 has provided the basis for the loss-of-coolant accident spectrum that is analyzed to provide limiting containment pressures and temperatures. These results are bounded by the transient used for design as discussed in Section 5.1.2.2. Results are provided for a Double-Ended Pump Suction (DEPS) break with minimum and maximum safeguards and a Double-Ended Hot Leg (DEHL) break. These analyses were performed at a reactor power level of 3216 MWt. Analyses, assumptions, and results are presented in sections 14.3.5.1.3 through 14.3.5.3.9 for the break spectrum analyzed.

To summarize the break cases, Tables 14.3-16 through 14.3-30 show mass and energy release information, Tables 14.3-15 and 14.3-37 show systems and containment assumptions, and the assumed containment safeguards equipment. Tables 14.3-35 and 14.3-36 show the containment passive heat sink information assumed, and Figure 14.3-115 shows the heat removal capability assumed for one RCFC. Results of the break cases are shown in Figures 14.3-109 through 14.3-114, and are summarized in Table 14.3-34. The break cases show that a reactor coolant system double-ended pump suction (DEPS) rupture, assuming operation of the minimum emergency cooling system equipment, three RCFC units, and one containment spray pump consistent with the assumption of a single failure of one diesel generator, results in the highest containment pressure after a LOCA. The chronology of events for the DEPS minimum safeguards case is shown in Table 14.3-31. (See Section 5.1.1.1.6 for a discussion of the structural containment evaluation based on the limiting case.) The selection of the limiting Chapter 14, Page 116 of 218 Revision 20, 2006

IP2 FSAR UPDATE Since the cooling units of the fans are cooled by service water, the energy from the core would be removed from the containment via the fans.

The model employed inthis analysis does not consider recirculation spray to operate and conservatively considers decay heatfrom the core to enter the containment as steam during the entire LOCA long-term transient. Therefore, the pressures calculated are not affected with a postulated component cooling system failure, because core energy is already postulated to enter the containment as boil off. Containment pressure at various times for the DEPS case with minimum safeguards is shown below:

Time After Accident Occurs 3 Fans (Psig) 2 Fans (psiq)

.At 12 hr 20,2 200 At 1 week 12.6 17.9 14.3.5.6 Radiolytic Hydrogen Formation Radiolytic hydrogen formation is discussed in Section 6.8.3.

14.3.6 Environmental Consequences Of A Loss-Of-Coolant Accident Chapters 5 and 6 describe the protection systems and features that are specifically designed to limit the consequences of a major LOCA. The capability of the safety injection system for preventing melting of the fuel clad and the ability of the containment and containment cooling systems to absorb the blowdown resulting from a major loss of coolant are discussed in Section 14.3.4. The capability of the safeguards in meeting dose limits set forth in 10 CFR 50.67 was demonstrated as documented in this section.

For the Large Break Loss-of-Coolant Accident radiological consequences, an abrupt failure of the main reactor coolant pipe is assumed to occur. It is assumed that the emergency core cooling features fail to prevent the core from experiencing significant degradation (i.e. melting).

A portion of the activity that is released to the containment is assumed to be released to the environment due to the containment leaking at its design rate.

In the following sections, the expected activity is described and the containment and isolation features are discussed. Trisodium phosphate is used to control pH in the recirculation solutions, as described in Sections 6.3.2.1.2 and 6.3.2.2.12.

14.3.6.1 Effectiveness of Containment and Isolation Features in Terminating Activity Release The reactor containment serves as a boundary limiting activity leakage. The containment is steel lined and designed to withstand internal pressure in excess of that resulting from the design-basis LOCA (Chapter 5). All weld seams and penetrations are designed with a double barrier to inhibit leakage. In addition, the weld channel and penetration pressurization system supplies a pressurized nitrogen seal, at a pressure above the containment design pressure, between the double barriers so that if leakage occurred it would be into the containment (Section 6.5). The containment isolation system, Section 5.2, provides a minimum of two barriers in piping penetrating the containment. The isolation valve seal-water system, Section 6.6, provides a water seal at a pressure above containment design pressure in the piping lines that could be a source of leakage and is actuated on the containment isolation signal within 1 Chapter 14, Page 132 of 218 Revision 20, 2006

ATTACHMENT 3 TO NL-08-015 Unit 3 - Proposed Changes to the UFSAR Regarding the ECCS Single Passive Failure Analysis and Recirculation Phase Backup Capability Markup of current UFSAR to show changes.

The affected pages are as follows:

Chapter 6: Pages 6,9,11,15,16,17,42,43,59,60,74,97 Entergy Nuclear Operations, Inc.

Indian Point Nuclear Generating Unit No. 3 Docket No. 50-286

IP3 FSAR UPDATE Criterion: Protection against any action. of the engineered safety features which would accentuate significantly the adverse after-effects of a loss of normal cooling shall be provided. (GDC 43 of 7/11/67)

The reactor is to be maintained subcritical following a pipe rupture accident. Introduction of borated cooling water into the core results in a net negative reactivity addition. The control rods are inserted and remain inserted.

The supply of water by the Safety Injection System to cool the core cladding reduces the potential for significant metal-water reaction (less than 1.0%).

The delivery of cold safety injection water to the reactor vessel following accidental expulsion of reactor coolant does not cause further loss of integrity of the Reactor Coolant System boundary.

Sharing of Systems Criterion: Reactor facilities may share systems or components if it can be shown that such sharing will not result in undue risk to the health and safety of the public (GDC 4 of 7/11/67)

The residual heat removal pumps and heat exchangers serve dual functions. Although the normal duty of the residual heat exchangers and residual heat removal pumps is performed during periods of reactor shutdown, during all plant operating periods these residual heat removal pumps are aligned to perform the low head safety injection function. In addition, during the recirculation phase of a Loss-of-Coolant Accident, the residual heat exchangers of this system perform the core cooling function and the containment cooling function as part of the Containment Spray System, and the residual heat removal pumps, which are part of the external recirculation loop, provide back-up capability to the recirculation pumps which comprise part of the internal recirculation loop Demonstration checking of the system, performed as dictated by the Technical Specifications, provides assurance of correct system alignment for the safety injection function of the components.

During the injection phase, the safety injection pumps do not depend on any portion of other systems. During the recirculation phase, if Reactor Coolant System pressure stays high due to a small break accident, suction to the safety injection pumps is provided by the internal recirculation pumps, and can also be provided by the Residual Heat Removal pumps.

The Containment Air Recirculation and Filtration System also serves the dual function of containment cooling during normal operation and containment cooling after an accident. Since the method of operation for both cooling functions is the same, the dual aspect of the system does not affect its function as an engineered safety feature.

The steam supply and city water systems at the Indian Point site were shared by all three reactor facilities. However, independent steam supply and city water systems have been installed at Indian Point 3 (See Chapter 9); the city water system for Indian Point 2 is presently used by Indian Point 3 as a backup supply. The steam supply and city water systems are used for the following purposes:

a) Steam for unit heaters for standby heating.

Chapter 6, Page 6 of 208 Revision 02,.2007

lP3 FSAR UPDATE system is tolerant of a loss of any part of the flow path since backup alternative flow path capability is prvdd The ability of the Safety Injection System to meet its capability objectives is presented in Section 6.2.3. The analysis of the accidents is presented in Chapter 14.

Inspection of Emergency Core Cooling System Criterion 45: Design provisions shall, where practical, be made to facilitate inspection of all physical parts of the Emergency Core Cooling System, including reactor vessel internals and water injection nozzles.

Design provisions are made to the extent practical in order to facilitate access to the critical parts of the reactor vessel internals, pipes, valves and pumps for visual or boroscopic inspection for erosion, corrosion and vibration wear evidence and for non-destructive test inspection where such techniques are desirable and appropriate as detailed in Section 6.2.5.

Testing of Emergency Core Cooling System Components Criterion 46: Design provisions shall be made so that components of the Emergency Core Cooling System can be tested periodically for operability and functional per formance.

The design provides for periodic testing or active components of the Safety Injection System for operability and functional performance as detailed in Section 6.2.5.

Power sources are arranged to permit individual actuation of each active component of the Safety Injection System.

The safety injection pumps can be tested periodically during plant operation using the minimum flow recirculation lines provided. The residual heat removal pumps are used every time the residual heat removal loop is put into operation and can be tested periodically. All remote operated valves can be exercised and actuation circuits can be tested during routine plant maintenance.

Testingi of Emer-aencv Core Cooling System Criterion 47: Capability shall be provided to test periodically the operability of the Emergency Core Cooling System up to a location as close to the core as is practical.

An integrated system test is performed when the plant is cooled down and the residual heat removal loop is in operation. This test would not introduce flow into the Reactor Coolant System but would demonstrate the operation of the valves, pump circuit breakers, and automatic circuitry upon initiation of safety injection.

Level and pressure instrumentation are provided for each accumulator tank, and accumulator tank pressure and level are continuously monitored during plant operation. Flow from the tanks can be checked at any time using test lines.

The accumulators and the safety injection piping up to the final isolation valve are maintained full of borated water at boron concentrations consistent with the accident analysis while the Chapter 6, Page 9 of 208 Revision 02, 2007

IP3 FSAR UPDATE

1) Injection of borated water by the passive accumulators.

2) Injection of borated water from the Refueling Water Storage Tank with the safety injection pumps. (NOTE: Technical Specification Amendment 139 eliminates the requirement to maintain a boron injection tank.)

3) Injection by the residual heat removal pumps also drawing borated water from the Refueling Water Storage Tank.

4) Recirculation of spilled reactor coolant, injected water and Containment Spray System drainage back to the reactor from the recirculation sump by the recirculation pumps. (The residual heat removal pumps provide backup recirculation capability.)')...-.--- .

The initiation signal for core cooling by the safety injection pumps and the residual heat removal pumps is the safety injection signal which is actuated by any of the following:

Low pressurizer pressure (2/3)

High containment pressure (2/3, High Pressure)

High differential pressure between any other two steam generators (2/3)

After time delay (maximum of 6 seconds): high steam flow in any two of the four steam lines (1/2 per line) coincident with low Tavg (2/4) or low steam pressure (2/4)

Manual Actuation High-High containment pressure (two sets of 2/3, High-High pressure) [energize to actuate]

In the Technical Specifications, limits are set on minimum number of operable channels and required plant status for all reactor protection and ESF instrumentation.

Iniection Phase The principal components of the Safety Injection system which provide emergency core cooling immediately following a loss of coolant are the accumulators (one for each loop), the three safety injection (high head) pumps and the two residual heat removal (low head) pumps. The safety injection and residual heat removal pumps are located in the Primary Auxiliary Building.

The accumulators, which are passive components, discharge into the cold legs of the reactor coolant piping when pressure decreases below the N 2 cover gas operating pressure (approximately 650 psig), thus rapidly assuring core cooling for large breaks. They are located inside the Containment, but outside the crane wall; therefore, each is protected against possible missiles.

The safety injection signal starts the safety injection and residual heat removal pumps and opens the Safety Injection System isolation valves (certain valves have their motor leads disconnected and are locked open). The valves on Plant Drawings 9321-F-27353 and -27503

[Formerly Figures 6.2-1A & -B] marked with a "S" receive the safety injection signal.

Separate and independent key-lock switches one for each SI train are provided in series to each of the auto SI actuation relays to allow manual blocking of the automatic Engineered Safeguards System actuation when the unit is in cold shutdown.

Chapter 6, Page 11 of 208 Revision 02, 2007

S IP3 FFSARR UPDAT *Cg*.,**  : SZA ^ 4"2.1 internal recirculation loop is require . Water is delivered from the Containment to the residual heat removal pumps from a separate sump inside the Containment.

Although the residual heat removal pump is an acceptable alternative for providing core cooling and containment spray flow in lieu of the recirculation pump, there is no single failure that would require its use. The residual heat removal pump(s) would be used only in scenarios beyond the design basis involving multiple active failures. Use of a residual heat removal pump during the long-term recovery phase could be required in the event of ECCS leakage outside Containment.

The motor operated valves in the recirculation suction lines from the containment sump are maintained in the normally closed position at all times, however, they could be opened to allow for residual heat removal pump recirculation operation if that mode was required.

The valves are exercised in accordance with Technical Specification requirements. The valves are operated one at a time and each valve is returned to its normal position before exercising the next one.

No automatic opening features are provided; hence, the probability of a spurious signal to open the valves is nil. The only time these valves are opened is for periodic testing and the procedure ensures that both valves are closed immediately after the test. In addition, the two valves are provided in series to protect against the inadvertent opening of one valve.

The procedure used for periodic testing of these valves ensures that the only water which would be drained from these lines is the small amount trapped between the two valves. This water will discharge to the containment sump. The sump contains two sump pumps which operate on level control and will periodically pump the sump contents to the waste holdup tank during normal plant operation.

For small breaks the depressurization of the Reactor Coolant System is augmented by steam dump and auxiliary feed water addition to the Steam System. For the small breaks in the Reactor Coolant System where recirculated water must be injected against higher pressures for long term core cooling, the system is arranged to deliver the water from the residual heat exchangers to the high-head safety injection pump suction and, by this external recirculation route, to the reactor coolant loops. Thus, if depressurization of the Reactor Coolant System proceeds slowly, the safety injection pumps may be used to augment the flow-pressure capacity of the recirculation pumps in returning the spilled coolant to the reactor.

The recirculation pumps, the residual heat exchangers, piping and valves vital to the function of the recirculation loop are located in a missile-shielded space inside the polar crane support wall on the west side of the reactor primary shield.

There are two recirculation related sumps within the Containment, the recirculation sump and the containment sump. Both sumps collect liquids discharged into the Containment during the injection phase of the design basis accident.

Vaious flow barriers are: installed in the '0por"Contameinihit. to channel* the recirculation flow int~othe Rieact&rCavity,: Sump'a'reý dp and dtut of th~noenstrumri~tation Tunnel,",th~odglh'.the Wlap, labythvwall .via, specially.designedopioenmging sandintothe' annulus 4re'a outsid ethe,, arne Wall.ý-.Th~recirculatio~n flow ywill m igeatetb ads' the, R66irpdainSm orýthe Containment- Sdrnip' pendýingý on whichipUrp(sý.are opý rating.,, FI6chann~e ing. bar~rier n te are intaled acto q'viySup paorr~eV. 29', -47"aro6u'n6the lncor& Instrurnbentati~r Chapter 6, Page 15 of 208 Revision 02, 2007

IP3 FSAR UPDATE p01rrora pWte*:na[ow*trUghý'thmestainespt,*

94ze"a fl go$-,if Vslae',J ""oI*umei.two."(),'n e mei" flow- 'paths!kwithin,6acft tolliat* module. exit dulf: water will flow )into. 1 strainer:iwater" box*wh~i~ i**d*tl nn~ctd;, to the* RHR-* Pump suction. hne.+ The'-wa approach yielbcitj'to the C~ontairn-mit, Snmp, ptthdn ond foot per. §econ~dl les The low head external recirculation loop via the containment sump line and the residual heat removal pumps provides backup recirculation capability to the low head internal recirculation loop. The containment sump line is contained within a concentric guard pipe. which is connected to the containment liner and terminates within a leak tight compartment. This sump line has two remote motor operated normally closed valves for containment isolation purposes, one of which is within this leak tight compartment.

The high head external recirculation flow path via the high head safety injection pumps isA3 required for the range of small break sizes for which the Reactor Coolant System pressure Chapter 6, Page 16 of 208 Revision 02, 2007

FSAR UPDATE ,-. I remains in excess of the shutoff head of the recirculation pumps i Lt at the end of the injection phase * ... 4 leg The external recirculation flow paths within the Primary Auxiliary Building are designed so that external recirculation can be initiated immediately after the accident. Those portions of the Safety Injection System located outside of the Containment which are designed to circulate under post-accident conditions radioactively contaminated water collected in the Containment meet the following requirements:

• Shielding to maintain radiation levels within the guidelines set forth in 10 CFR 100

• Collection of discharges from pressure relieving devices into closed systems

• Means to detect and control radioactivity leakage into the environs to the limits consistent with guidelines set forth in 10 CFR 100.

This criterion is met by minimizing leakage from the system. External recirculation loop leakage is discuss ne 6.2.3.

One Pu p 91....... ........... ........ 2and . . one residual heat exchanger of the recirculation system provides sufficient cooled recirculated water to keep the core flooded with water by injection through the cold leg connections while simultaneously providing, if required, sufficient containment spray flow to prevent the containment pressure from rising above design limits because.of the boiloff from the core. Only one pump and one heat exchgar are required to operate for this capability at the earliest time recirculation is initiated. esign ensures that heat removal from the core and Containment is effective in the event of a pipe or valve body rupture. 1 ,

111*'. o.)r%* w ,

Cooling Water V1 .;1;  ; *,.

The Service Water System (Section 9.6.1) provides cooling water to the component cooling loop, which in turn, cools the residual heat exchangers, all of which are part of the Auxiliary Cooling Systems (Section 9.3). Three conventional service water pumps are available to take suction from the river and discharge to the two component cooling heat exchangers. Three component cooling pumps are available to discharge through their heat exchangers and deliver to the two residual heat exchangers. With the component cooling water system in long term recirculation mode, the following components are required in order to meet core cooling requirements, one residual heat removal pump and heat exchanger, one component cooling water pump, one component cooling water heat exchanger, one service water pump on the nonessential header, and two essential service water pumps on the essential header. All of this equipment with the exception of the residual heat exchangers is located outside Containment.

Containment Building Water Level Monitoring Continuous indication of containment water level during and after an accident is provided by three systems with redundant measuring loops distributed as follows:

• Containment Sump (El. 38' 3"), narrow range, 0' to 10' of water.

• Recirculation Sump (El, 34' 0"), narrow range, 0' to 14' of water.

• Containment Building (El, 46' 0"), wide range, 0' to 8' of water.

Each loop consists of a sensor and a transmitter located inside the containment building, a recorder and power supply at the control room. Refer to Plant Drawing 9321-F-27353 [Formerly Figure No. 6.2-1A].

Chapter 6, Page 17 of 208 Revision 02, 2007

IP3 FSAR UPDATE Initial response of the injection systems is automatic with appropriate allowances for delays in actuation of circuitry and active components. The active portions of the injection systems are automatically actuated by the safety injection signal (Chapter 7). In addition, manual actuation of the entire injection system and individual components can be accomplished from the Control Room. In analysis of system performance, delays in reaching the programmed trip points and in actuation of components are conservatively established on the basis that only emergency onsite power is available.

The starting sequence of the safety injection and residual heat removal pumps and the related emergency power equipment is designed so that delivery of the full rated flow is reached within 27 seconds after the process parameters reach the set points for the injection signal.

EVENT SECONDS Time to initiate the safety injection signal 2 Time for diesel generators to come up to speed 10 Time for safety injection pumps to come up to speed 10 Time for Residual Heat Removal Pumps to come up to speed 5 Total 27 Motor control centers are energized and injection valves are opened during this time to allow pumped ECCS delivery.

This delay is consistent with the 25 second delay which is assumed in the analysis of the Loss-of-Coolant Accident as described in Chapter 14. The modeling of a 25 second SI delay time is conservative for this action sequence since no credit is taken for Charging or SI flow prior to 25 seconds (although these pumps are actually up to speed), and credit is not taken for partial RHR flow up to 25 seconds. On this basis, the integral injection flow for the assumed 25 second delay time remains less than the actual injection flow that would be delivered if partial credit for pumps on prior to 25 seconds was assumed.

To reduce inadvertent Safety Injection System Actuations due to instrumentation lags in the engineered safeguards system high steamline flow, low average temperature Tavg/Low steamline pressure coincidence circuitry, a time delay will be installed in each train (a maximum time delay of 6 seconds will meet the acceptance criteria for a steamline rupture).

Single Failure Analysis A single active failure analysis is presented in Table 6.2-7. All credible active system failures were considered. The analysis of the Loss-of-Coolant Accident presented in Chapter 14 is consistent with the single failure analysis.

It is based on the worst single failure (generally a pump failure) in both the safety injection and residual heat removal pumping systems. The analysis shows that the failure of any single active component will not prevent fulfilling the design function.

In addition- erna-ivelowpath is available to maintain core cooling if any part of the recirculation flow path becomes unavailable. This evaluated in Table 6.2-8.

Chapter 6, Page ý42of 20 Revision 02, 2007

IP3 FSAR UPDATE S The procedure followed to establish the alternate flow path also isolates the spilling line. A valve is provided in the containment recirculation line to the residual heat removal pumps in order to isolate this line should it be required.

Failure analyses of the Component Cooling and Service Water Systems under Loss-of-Coolant Accident conditions are described in Sections 9.3 and 9.6, respectively.

Reliance on Interconnected Systems During the injection phase, the high head safety injection pumps do not depend on any portion of other systems with the exception of the suction line from the refueling water storage tank.

During the recirculation phase of the accident for small breaks, suction to the hiqh head safety injection pumps is provided by the recirculation pumps . ,r, ...

The residual heat removal (low head) pumps are no a use during the reactor shutdown operations. Whenever the reactor is at power, the pumps are aligned for emergency duty.

Shared Function Evaluation Table 6.2-9 is an evaluation of the main components, which have been previously discussed, and a brief description of how each component functions during normal operation and during the accident.

Passive Systems The accumulators are a passive safety feature in that they perform their design function in the total absence of an actuation signal or power source. The only moving parts in the accumulator injection train are in the two check valves.

The working parts of the check valves are exposed to fluid of -relatively low boric acid concentration. Even if some unforeseen deposition accumulated, a reversed differential pressure of about 25 psi can shear any particles in the bearing that may tend to prevent valve functioning. This is demonstrated by calculation.

The isolation valve at each accumulator is only closed when the reactor is intentionally depressurized, or momentarily for testing when pressurized. The isolation valve is normally opened and an alarm in the Control Room sounds if the valve is inadvertently closed. It is not expected that the isolation valve will have to be closed due to excessive leakage through the check valves.

The check valves operate in the closed position with a nominal differential pressure across the disc of approximately 1650 psi. They remain in this position except for testing or when called upon to function. Since the valves operate normally in the closed position and are, therefore, not subject to the abuse of flowing operation or impact loads caused by sudden flow reversal and seating, they do not experience any wear of the moving parts, and therefore, function as required.

When the Reactor Coolant System is being pressurized during the normal plant heat-up operation, the check valves are tested for leakage as. soon as there is about 100 psi differential across the valve. This test confirms the seating of the disc and whether or not there has been Chapter 6, Page 43 of 208 Revision 02, 2007

Insert A Chapter 6, Page 43 of 208 Therefore, the ECCS design incorporates redundancy of components such that neither a single active component failure during the injection phase nor an active or passive failure during the recirculation phase will degrade the ECCS function. Only active failures are assumed to occur within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the initiating event.

IP3 FSAR UPDATE TABLE 6.2-8 (LOSS OF RECIRCULATION FLOW PATH)

Flow Path Indication of Loss of Flow Path Alternate Flow Path Low Head Recirculation 1. Insufficient flow in low head From recirculation pump injection lines (one flow to high head injection From recirculation sump to monitor in each of the four low header via the recircula-low head injection header head injection lines*) tion pumps, one of the via the recirculation pumps two residual heat ex-and the residual heat changers and the safety exchanger. injection pump.**

2. As 1 above, a. From containment sump to discharge header of the residual heat exchanger via the residual heat removal pumps.

b. If flow is not established in low head injection lines -

as (a), except path is from discharge of one residual heat ex-changer to the high head injection header via the safety injection pumps.

High Head Recirculation 1. No flow in high head injection a. From containment header (three flow monitors, sump to high head From recirculation sump to one in each injection line, and injection header via high head injection header one pressure monitor). (Note: the residual heat via the recirculation pumps, One of the four cold leg lines removal pumps, one one of the two residual heat per header has been isolated of the two residual exchangers and the high by a locked closed valve.) heat exchangers and head injection pumps. the high head injection pumps.

Note: As shown on Plant Drawings 9321-F-27353 and 27503 [Formerly Figures 6.2-1A and -

B], there are valves at all locations where alternative flow paths are provided.

With the flow meters on three or more lines indicating greater than zero and with the lowest of these flows at least 360 gpm, + 10 gpm, or with zero flow indicated on two lines and the lowest flow meter for each of the remaining lines reading at least 360 gpm, + 10 gpm, the supply of recirculated water using low head recirculation will maintain the core flooded even in the event of a low head line spilling and one failed flow meter or other single failure.

Chapter 6, Page 59 of 208 Revision 02, 2007

IP3 FSAR UPDATE TABLE 6.2-8 (Cant.

(LOSS OF RECIRCULATION FLOW PATH)

Flow Path Indication of Loss of Flow Path Alternate Flow Path

b. If flow is not established in high head injection header

-as (a) except path is from discharge of the residual heat removal pumps to the high head injection pumps via safety injection pump 32 (by-passing the residual heat exchangers*).

2. Flow in only one of the two a. as 1 (b) except that high head injection branch flow from safety.

headers (three flow monitors injection pump 32 is per branch header). (Note: only supplied to the One-of the four cold leg lines unbroken branch per header has been isolated header.

______________________ by a locked closed valve.) ____________

NOTE: As shown on Plant Drawings 9321-F-27353 and 27503 [Formerly Figures 6.2-1A and

-B],, there are valves at all locations where alternative flow. paths are provided.

• In this recirculation mode, water is returned to the core without being cooled by the residual heat exchangers. Heat is removed from the core by boil-off of the water to the Containment; heat is then removed from the Containment by either the containment fan coolers or/and the Containment Spray System (using cooled water from the recirculation sump via the recirculation pumps and one residual heat exchanger).

Chapter 6, Page 60 of 208 Revision 02, 2007

IP3 FSAR UPDATE Capability was provided to test initially, to the extend practical, the operational start-up sequence of the Containment Spray System including the transfer to alternate power sources.

Performance Obiectives The Containment Spray System was designed to spray at least 5200 gpm of borated water, to which sodium hydroxide may be added when necessary, into the Containment whenever the coincidence of two sets of two-out-of-three (high-high) containment pressure (approximately 50% of design value) signals occurs or a manual signal is given. Either of two subsystems containing a pump and associated valving and spray header are independently capable of delivering more than one-half of the design delivery- flow, or at least 2600 gpm, based on a pump design flow of at least 2600 gpm at a containment back pressure of 47.0 psig. Actual flow is reduced by up to 150 gpm due to the effect of eductor flow, resulting in a delivered flow of 2450 gpm per pump at a containment back pressure of 47.0 psig.

The design basis was to provide sufficient heat removal capability to maintain the post-accident containment pressure below 47 psig, assuming that the core residual heat is released to the Containment as steam.

A second purpose served by the Containment Spray System is to remove elemental airborne iodine from the containment atmosphere should it be released in the event of a Loss-of-Coolant Accident. The analysis showing the system's ability to limit offsite thyroid dose to within 10 CFR 100 limits after a hypothetical Loss-of-Coolant Accident is presented in Chapter 14. If all engineered safety features operate at design capacity, offsite doses will be limited to within the limits of 10 CFR 20.

The Containment Spray System was designed to operate over an extended time period following a Reactor Coolant System failure, as required to restore and maintain containment conditions at or near atmospheric pressure. It has the capability of reducing the containment post-accident pressure and consequent containment leakage.

Portions of other systems, which share functions and become part of the Containment Spray System when required, were designed to meet the criteria of this section. Neither a single active component failure in such systems during the injection phase, nor an active passive failure during the recirculation phase, will degrade the design heat removal capability of containment cooling.

System piping located within the Containment is redundant and separable in arrangement unless fully protected from damage which may follow any Reactor Coolant System loop failure.

System isolation valves relied upon to operate for containment cooling are redundant, with automatic actuation.

Service Life All portions of the system located within the Containment were designed to withstand, without loss of functional performance, the post-accident containment environment and operate without benefit of maintenance for the period of time needed to restore and maintain containment conditions at near atmospheric pressure.

Chapter 6, Page 74 of 208 Revision 02, 2007

IP3 FSAR UPDATE (CH31). These are the iodine removal efficiencies assumed in the analysis of containment capability to retain fission product iodine under the post-accident design conditions in Chapter 14.

In addition to the above design bases, the equipment was designed to operate at the post-accident conditions of 47 psig and 271' F for three hours, followed by operation in an air-steam atmosphere at 20 psig, 2190 F for an additional 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br />. The equipment design will permit subsequent operation of an air-steam atmosphere at 5 psig, 152 F for an indefinite period. See Appendix 6F for details of the IP3 Equipment Qualification Program.

All components are capable of withstanding or are protected from differential pressures which may occur during the rapid pressure rise to 47 psig in ten (10) seconds.

Portions of other systems which share functions and become part of this containment cooling system when required were designed to meet the criteria of this section. Neither a single active component failure in such systems during the injection phase nor an active/passive failure during the recirculation phase will degrade the heat removal capability ofLcontainment cooling O-"

Where portions of these systems are located outside of containmer , me following teatures were incorporated in the design for operation under post-accident conditions:

a) Means for isolation for any section b) Means to detect and control radioactivity leakage into the environs, to the limits consistent with guidelines set forth in 10 CFR 100.

6.4.2 System Design and Operations The flow diagram of the Containment Air Recirculation Cooling and Filtration System is shown on Plant Drawing 9321-F-40223 (Formerly Figure 6.4-2].

Individual system components and their supports meet the requirement for Class I (seismic) structures and each component is mounted to isolate it from fan vibration.

Containment Cooling System Characteristics The air recirculation system consists of five 20% capacity air handling units, each including motor, fan, cooling coils, moisture separators, HEPA filters, carbon filters with spray and fire detection, dampers, duct distribution system, instrumentation and controls. The units are located on the intermediate floor between the containment wall and the primary compartment shield walls. The moisture separators, HEPA filters and activated carbon filter assembly is normally isolated from the main air recirculation stream. Part of the air flow (air-steam mixture) is bypassed through the filtration section of the units (moisture separators, HEPA filters, and carbon filter assembly) to remove volatile iodine following an accident.

Each fan was designed to supply 69,500 cfm at approximately 6.3" s.p. (0.075 Ib/ft 3 density) during normal operation and 34,000 cfm, at approximately 8.6" s.p. (0.175 lb/ft3 density), during accident operation.

The fans are direct driven, centrifugal type, and the coils are plate fintube type. Each air handling unit is capable of removing 49.0 x 106 Btu/hr from the containment atmosphere under accident conditions. A flow of 1400 gpm of service (cooling) water is supplied to each unit during accident conditions. The design maximum river water inlet temperature is 95 0 F.

Chapter 6, Page 97 of 208 Revision 02, 2007