ML19331B838

Compliance Study in Response to NRC 800211 Confirmatory Order Re Ucs Petition to Suspend Operation.Demonstrates Methods by Which Safety Rules & Regulations Are Implemented. Financial & Reporting Requirements Not Addressed

ML19331B838
Person / Time
Site:	Indian Point
Issue date:	08/31/1980
From:	CONSOLIDATED EDISON CO. OF NEW YORK, INC.
To:
Shared Package
ML19331B834	List: ML19331B833 ML19331B838
References
ISSUANCES-CO, NUDOCS 8008130388
Download: ML19331B838 (393)

Text

-

/m ATrKETNT A

()

-O F. .Within six tronths of date of the Order, the licensee shall:

V

1. Conduct a review of past Licensee Event Reports (LERs) at Indian Point Units 2 and 3. These LERs shall be reviewed tc identify design inadequacies (ccamon node failures, systems interactions, etc.), procedural and training inadequacies, and man-machine / human factor inadequacies. Reconrendations shall be subnitted for cor-rection of the base cause of the subjc-at LERs. Inmediate cc.rections of deficiencies will be made when possible, with the required not'.-

fications to be made to the NBC.

Response

A review of past Licensee Event Reports (LERs) at Indian Point Units 2 and 3 has been conducted jointly, by Consolidated Edison and the Power Authority. The results of this review are de-tailed in Enclosure 1 of this subnittal.

2. Maet meteorological acceptance criteria for energency preparedness contained in Annex 1 to this Appendix.

Response

Consolidated Edison and the Power Authority have taken action to (q_/ meet the meteorological acceptance criteria for energency prepared-ness contained in Annex 1 of the Appendix to the Confirmatory Onler.

The details as to how the acceptance criteria were met are docununted in Enclosure 2 of this subrittal.

3. Conduct a study to determine and docununt the method by which its

. plant conplies with current safety rules and reg 21ations, in par-ticular those contained in 10 CFR Parts 20 and 50.

Response

A study has been conducted to deteratine and docunent the method by which Indian Point Unit No. 2 cmplies with current safety rules and regulations, in particular those contained in 10 CFR Parts 20 and 50.

,10 CFR 20, which pertains to regulations at the site, was reviewed in detail. All procedures, training directives and instructions were reviewed to verify conformance with the rmnrements of 10 CFR 20. Certain of these documents were revised to more clearly describe how certain requirements are satisfied. Documentation of the review conducted and the methods by which 1D CFR 20 require-ments are met is available at the plant site for the NRC Resident (m,) Inspector's review.

The results of this stuly with regard to cmpliance with the requirements of 10 CFR_50 are detailed in Enclosure 3 of this subnittal. . . . . -

.ToolrQO.3?? _ .J

4. Evaluate the reliability and failure modes of selected systems /ccm-ponents as follow:::

e 1

a. Failure Mode Effects Analysis: Examine the failure nodes (randcm failures and consequences of outages in support systems) of '-he activa caponents on the reactor coolant pressure boundary. Assess the acceptability of these failure modes.

b. inpleJrent Failure Mode Effects Analysis for minor departures from operating, maintenance and emergency procedures.

c. Explore ways to improve the reliability of those conponents with a particularly high failure rate as delineated in NUREG/CR-1205.

Resqxmse:

TM required evaluation of the reliability and failure nodes of selected systems /cmponents has been prxformed jointly by Con-solidated Edison and the Power Authority. 'Ihe results of this evaluation are detailed in Enclosure 4 of this subnittal.

5. Attain full cmpliance with NRC letters concercLng AFNS reliability inprovements.

, Response:

^

O Full cmpliance with NBC letters concerning AFli6 reliability inprove-ments for Indian Point Unit No. 2 has been attai.ned. Refex to NRC letters dated Novelrber 7,1979, March 5,1980 a d June 13, 1980 and to Consolidated Edison letters dated December 29, 1979, April 14, 1980, June 30, 1980, July.30, 1990, and August 11,15EO.

./

\_j A-2

.r ENCLOSURE 1

\

ITEM F.1: LICENSEE EVENT REPORT (LER) REVIEW D I. INTRODUCTION:

Licensee-Event Reports (LERs) arc submitted by licensees in accordance with reporting requirements set fcrth in the plant technical specifications.' For the most part, the events reported have minimal, if any, impact'on plant safety. The LER reporting requirement establishes an operational feedback mechanism by which design deficiencies, systems interactions, procedural, training, operational, equipment and other inadequacies can be identified and corrected to improve plant reliability.

Due to similarities in the design and construction, common equipment types, procedural guldelines and personnel histories between Indian Point Units 2 and 3, the LERs for both units were combined for this study in order to przvide a broader data base for examinction and to better identify commonalities in the events reported for each unit. LERs for Units 2 and 3 submitted during the period 1971-1979 were reviewed to identify potential design, procedural and training, and man-machine /

human factors inadequacies as required by Item F.1 of the February 11, 1980 Confirmatory Order. Each LER so identified was placed into one of the following three categories as appropriate:

( (1) Design / Fabrication / Installation Events-The events in this category are those ihich could be attributable to equipment design, fabrication and/or installation.

(2) Procedural and Training Events-This category includes all events whict could be at-tributable to operating, maintenance, ralibration, testing, training cr administrative prrcedures and/or the training of operators in these proredures.

(3) Man-machine / Human Factor Events-The events identified in this category are those which could be attributable to any operation, maintenance ,

~

and/or testing activities conducted by plant personnel.

For. those LERs which could be classified indo one of the above three numbered categories of interesty the corrective action taken.or planned to prevent recurrence was once again reviewep for adequacy and appropriateness. This report ad-

' dresses' tSo- re-review of these corrective actions.

Those LERs which' could 'not be classified into one of the above three numbered categories of interest generally involved events which were due to isolated causes not affecting unit safety, O_41 such as random mechanical or electrical equdgment malfunctions, El-1

__- ___ __-m

inctrum3ntation setpoint drift, generic analytical errors and external causes. ,

.It should b'e emphasized that no events were identified fcr O'- which appropriate corrective action has not been planned or completed.

1 1

Y 1

I 1

O .

i l

f-3 d

i 4

El-2 j

II.-

SUMMARY

OF IDENTIFIED EVENTS AND CORRECTIVE ACTIONS f- 1. - Design / Fabrication / Installation Events:

v A total.of 10S items (72 for Unit 2, 36 for Unit 3) were identified as attributable to causes fr.lling within this general category. These events were divided among the sub-categories identified in Table 1.1.

Table 1.1 Design / Fabrication / Installation Event Sub-Categories Sub-Category Number of Items Reported Vibration Induced Weld Failures 22 Charging Pump Failure / Degradation 15 Condensate Storage Tank Level Control 12 Containment Air Sample Monitors R-ll/R-12 Failures 9 Boric Acid Transfer Pump Degradation 8 Service Water Pump Failure / Degradation 5 Wiring Installation 4 Refueling Water Storage Tank Level Control 4 Fan Cooler Unit Filter Plugging 3

., Motor Control Centers 34 and 39 Overload 3

(

' ') Instrument Air Failure Pressurizer Power Operated Relief Valve 2

Design 2 Steam Generator Level Indication Design 2 Control Rod Drive Obstructions 2 Electrical Power Supply Redundancy 2 Other (Individual items) 13 1.1 Vibration Induced Weld Failures A major source of reported items is vibration induced fatigue i failure at welded connections between system main piping '

sections and small diameter vent or sample lines. (22 items reporting 3'6 failures or need for repair). Most of the reported failures have occurred.in piping associated with the charging system, which is subject to vibrational stresnes due to the nearly continuous operation of the positive dis-placement charging pumps. In addition to these vibrational stresses,'the installation of certain flanges and manual valves in these small diameter lines has aggrevated the  !

observed failure mode by providing further loading moment l applied to the weld connection. The consequences of any i leaks resulting from these failures have been generally

(~\

El-3 i

i 4

n gligible dua to tha small size of the lines and the fact that the charging-system is not an engineered safe-guard system. Nevertheless, unit shutdowns have been f'T

' made to facilitate repairs whenever necessary. These lines are presently inspected as per ASME Code Section XI ISI criteria which should detect' potential problems prior to failure.

This failure cause was identified during early operation at both units, and a program was instituted to remove heavy flanges and valves, where possible, and to cap the remaining small lines, thereby reducing the loading movements.

This program has resulted in a reduction of these failures.

Additional efforts at both units are being focused on reducing vibrations in the charging system, which have contributed to all but two of the failures reported since 1976. At present, Unit 2 is planning installation of suction stabilizers and discharge pulsation dampeners on each of '.ts charging pumps during the upcoming refueling outage; Unit 3 has installed suction stabilizers and is planning installation of discharge pulsation dampeners during the next refueling outage. These two modifications (that is, removal of heavy flanges and installation of charging pump sucticn stabilizers and discharge pulsation dampeners) should be successful in further reducing overall system vibration resulting in a significant reduction in this failure cause.

P)

\- 1.2 Charging Pump Failure / Degradation The 15 LERs (8 for Unit 2, 7 for Unit 3) concerning charging pump problems include a total of 20 reported failures, summarized in Table 1.3.

Table 1.3 Charging Pump Failure / Degradation

' Failure Type Number of Events Excessive Seal Leakage 13 Head Gasket Leaks 4 Cracked Fluid Head 2 Broken Coupling 1 These failures are of a periodic nature, although the in-cidence of seal degradation has been substantially reduced by an aggressive preventive maintenance program in effect at both units. The failures have been generally attributed to cyclical pulsations of the pumps and associated piping induced by flow surges at each pump stroke. Both units are currently pursuing the installation of suction stabi-r-

\-}, lizers and discharge pulsation dampeners on each of the charging ;

El-4

)

pumps as described above in item 1.1. Both licensees have

. jointly undertaken an engineering analysis and determined that the addition of suction stabilizers and pulsation dampeners

[') should preclude such failures. In addition, both Unit 2 and Unit 3 have installed a charging pump recirculation system to allow break-in of new packing and thus pre-clude early failure.

1.3 Condensate Storage Tank Level Control There have been 12 reported events (6. for Unit 2, 6 for Unit 3) of condensate storage tank level friling below the minimum level stated in the Technical Specifications.

The majority (9) occurred during blowdown of the steam generators to maintain acceptable steam generator and condenser hotwell water quality. The remaining events occurred due the inadequate water makeup capacity during normal operating or hot shutdown conditions. It should be noted that a common source of demineralized makeup water is provided for both units. Unit 3 is arrently tenting an independent water makeup system which will eliminate its dependence upon the common water makeap facility. This will reduce the total demand upon that facility and dedicate the existing supply capability to Unit 2 except under abnormal conditions. In addition, an aggressive condenser inspection and tube plugging program has been

-instituted at both units in an effort to minimize condenser tube leakge, the primary initiator necessitating increased

("T Nl makeup volumes. This program consistr of a helium leak testing technique and eddy current inspection of condenser tubes.

1.4 Containment Air Sample Monitors R-11/2-12 Failures The nine (9) reported events (5 for Odit 2, 4 for Unit 3) involved the seizure or . overload of the samplo pump used to motivate containment air through these monitors.

An engineering evtluation determined the need for replace-ment of the pump. During these pump failures, the diversity of monit oring equipment was available to provide indications of the containment environment. The number _ of events reported for both un3ts has been sharply reduced since 1977 because a more rel5able pump and motor unit was installed.

1.5 Boric Acid Transfer Pump Degradation Excessive seal leakage from the boric acid transfer pumps is a continuing problem at both units and is attributable

, to the pumps' constant operation and to degradation caused by pumping highly concentrated boric acid. It should be noted that seal leakage does not render a pump inoperable in the same manner as would shaft rupture, bearing failure, etc. Each unit has two redundant pungs, and thus, the

(~/}

x- inoperability of any one of these pumps does not affect unit operation or safety systems avaiEability. An El-5

cggraccivs preventive maintenance program and consultations with the vendor have been instituted at both units in an effort system.

to reduce the failures associated with the existing 73 V

1.6 Service Water Pump Failure / Degradation only five instances of service water pump failure have been reported from both units during the period cf this review. These failures have included bearing seizure and broken shafts. Adequate redundancy is provided at both units'for multiple pump failures. Unit 3 is currently

' installing a new design discharge strainer in an attempt '

to reduce strainer plugging and back pressure at the pump discharge. Unit 2 is installing improved pump bearings, bearing sleeves and bearing cooling water equipment and is evaluating improved discharge strainer designs. The pre-ventive maintenance programs for these pumps has also been upgraded to reduce strainer plugging.

1.7 Wiring Installation Although four instances of improper wiring installation were reported at Unit 2 during the period from March-August 1974, all of these instances were discovered during eithe; pre-operational or initial routine systems testing intended to identify any such conditions and were corrected imme-diately following identification. There have been no f,

(_j reports of any further such instances at either unit since August 1974.

1.8 Refueling Water Storage Tank Level Control The four reported instances of slightly deficient RWST level a.t Unit 2 were due to the very small cperating margin which existed between the maximum RWST capacity (i.e., approx. 354,000 gallons) and the minimum volume required by the technical specifications'(i.e., 350,000 gallons). While the RWST appeared to be slightly deficient in naximum capacity, the required technical specification mininum volume was re-cognized to be overly conservative. ln 1976, the Unit 2 minimum required volume was reduced to 345,000 gallons thereby gaining more operational flexhility while main-taining a more than adequate water supply to insure oper-ability of all associated systems. This technical specification change in conjunction with revised RWST level s control procedures has been effective in preventing recurrence of this item since 1976.

1.9 Fan Cooler Unit Filter Plugging Three LERs submitted for Unit 2 between July 1975 and May 1976 reported excessive differential pressure buildup

,s

.across the containment fan cooler units due to dust (v) accumulation on the demisters. These events were all El-6

. ~ . . . . . . . . - - .. . .

l _

fdiscovered(during routine-surveillance designedLto identify this condition. The filter units upstream of.the fan cooler

demisters were replaced and no additional items of this type "rm _have.been reported since11976. Unit 3 has reported no i )E s .. anomalies of.this nature as'the design of the Unit 3 fan y cooler units precludes-this type of event.

1.10 Motor Control Centers 34 and 39 Cverload.

The'three. reported instances of,MCC's-34 and. 39 tripping

• on an overload condition occurred during.a 20 day period of pre-startup testing on Unit 3. No similar items have occurred on Unit 2. In all cases, MCC 39 tripped-following a design load transfer from MCC 34. (The trips of MCC 34 initiating this transfer vere due to a combination of overload relay setpoints adjusted below operating conditions during the -

.

construction effort.) The overload trip setpoints'on both MCC's were found to be set too. low for normal operating and design load transfer conditions and were reset to. provide adequate protection capability within the range of normal 1

^

operating parameters. No further items eAating to-these relays were reported after June 1976.

1

1.11 Instrument Air Failure

' Two. incidents of reactor coolant system pressure transients >

initiated by loss of instrument air pressure with reeulting

-closure of the air operated letdown valves occurred at Unit 2 during May 1973 and September 1976. Following the first s,/ event, the air-dryers were modified to provide bypass cap-ability to minimize moisture accumulation in the air lines

. following dryer dessicant saturation. The second event j

occurred following failure of an' air dryer valve during a

, period in which the dryer bypass path was inoperable. The f

low frequency of this general cause category demon-strates the overall reliability of the' instrument air system at.. Unit 2. It should also be noted that a loss of air-pressure will not result in degradation o'f any safety systems- capabilities, since all air operated safety system valves _failitoltheir safeguards actuation positions on loss.cf pressure. Furthermore, in'1977/1978 both Units 2 and 3' installed automatic overpressure protection systems which i

.are designed to preclude this type of event from causing

.RCS pressure transients.

l 1.12~ Pressurizer Power Operated Relief Valve Design

~

l c

Following-installation of new pressurizer' power operated relief valves at each unit in 1977/1978, it was discovered that :

the vendor had' supplied vali3s with a relieving capacity LlessLthan specified but still adequate to handle transient

.- conditions. . The valves-on both units were retrimmed to pro-

. vide design rlow capacity by changing valve' internal

, -

El-7

4 3,13 Steam. Generator Level Indication Design A~ reanalysis-by. Westinghouse ofcpotential effects resulting

.(])) from the adverse environment following a high energy line

' break inside the containment identified that the steam generator level instrurnentation- for each unit could produce artificially high indicated levels. Since the protection system. trip setpoints at each unit were-within the band of concervatism affected by.this condition, only procedures dealing with post-accident monitoring

.needed to be modified to' correct for this condition.

, 1.141 Control Rod Drive Obstructions 1 During pre-operational testing of Unit 2 control rod

drives, two instances of' control rod obstruction were reported. Investigation revealed that foreign debris which remained-in the reactor vedsel following construc-tion had bound-the affected components. This debris was removed during subsequent defueling and syttem inspection prior to initial criticality.

4 1.15 Electrical Power Supply Redundancy A review of containment-isolation valve solenoid power supplies during 1976 and 1977 identified two cases at Unit 2 in which a shorted' supply or a failure to de-energize power could produce a multiple component failure

- 'd

("T and result in minor leakage paths remaining open.- These i

deficiencies were . corrected- to meet the revised single failure criteria. Unit 3 has reported no such deficiencies.

l- 1.16 Other Events 3

The thirteen items classified in this sub-category are

' distinguished as being non-recurring and unique to the unit for which they were reported and, as such, have

^ been considered as isolated cases. The majority of these items were l identified during pre-operational and early 1 operational system testing, and the affected components were replaced, modified or repaired to prevent' recurrence.

However, four of the reports, all associated with Unit 2, merit discussion.

a.- Condensate Storage Tank ,

In February 1974, it was. reported that the Unit 2 condensate- storage tank experiened failure of 8 anchor bolts and a 120* failure of the~ tank dome weld. Although no specific failure cause was -identified, ' improper fabrication of the tank

i. ~- El-8 a

f 9 - y- p -e-y-+gi e g- --

myrrr- * - r---

w2s datermined to be the probable cause. The tank was repaired and no other failures of this type have been subsequently identified in any tanks at the site.

FN The Unit 3 condensate storage tank was modified prior s) to plant operation to preclude a similar failure,

b. - Steam. Generator Feedwater Line Failure Following initial unit criticality in May 1973, a unit trip occurred in November 1973, after which it was discovered that the feedwater line to steam ocnerator 22 had experienced a 180* circumferential Ack . All feedwater lines and the containment liner were thoroughly inspected for damage and/or additional fabrication flaws and repairs to the damaged line were completed. In addition, J-tubes were installed on the feedwater rings of all four steam generators and limits placed on auxiliary feedwater flow to reduce the potential for water-hammer. These mod-

!"ications were made to both Units 2 and 3 and there

h. re been no subsequent reports of similar piping fu.tlures or degradation in the six years following this incident at either unit.

c. Reactor Vessel and Steam Generator Support Defects Following installation of the reactor vessel and steam generator support assemblies, the fabricator g identified possible minor tolerance deviations

(~J

( associated with the vessel support ring and steam generator supports. These deviations were evaluated and their effects upon system structural integrity were determined to be negligible by both Consolidated Edison and the AEC at that time (1972) .

d. Residual Heat Removal System Leak In August, 1978, a minor leak was discovered at a piping support weld joint in the discharge line from RHR pump 22. The cause of the leak was a small crack attributed to stresses induced by the improper installation of the piping support.

The support was relocated .and the crack was repaired.

No other failures of this type have been experienced and the overall seismic design verification program conducted 'during the unit's 1979 refueling outage did not . identify any other potential locations in which supports or restraints could lead to the im-position of abnormal stresses.

El-9 p

d

2. Procndural and Training Events: 1 A-total--of:19 events (16 for Unit 2, 3 for Unit 3) were 1 .

IdentifiedLas attributable to causes falling within this s 1 general category and were divided among the sub-categories listed in Table 2.1. Note that no events for either unit were attributable to training deficiencies.

' Table 2.1 Procedural Event Sub-Categories Sub-Category Number of Items Reported

~ Sampling / Qualification Procedural Events 6 Administrative Procedural Events 6 Instrument Calibration Procedural Events 4 Testing Procedural Events 2 Operating Procedural Events 1 2.1 Sampling / Qualification Procedure Events Of the six items reported in this sub-category, three addressed four instances of minor deviations of boric acid storage tank concentration which occurred during 1976 and 19i7. In all three items, the cause of the-deviation was identified as an inadequate sampling procedure to monitor concentration changes during boric acid solution transfer operations.

Both the sampling and the transfer procedures have been

("ss_) revised-and no other incidents of this nature have been reported since 1977. Two other event reports addressed inaccuracies in_the methodology specified in the site environmental technical specifications used to quantify heat rejected to the Hudson River. The quantification method and the technical specifications have since been revised to accurately compute the heat rejection rate, and no additional items have been reported. The final

. event in this sub-category addresced non-representative sampling techniques employed by a contractor in the collection of offsite water activity data in April 1978.

2.2 Adminstrative Procedural Events Three of the event reports classified in this sub-category addressed deviations in the performance of routine sur-veillanc. tests from the frequencies specified in the Technical Specifications. One of these items resulted in a' revision to administrative controls in effect at Unit 3 to insure that testing was performed according to a reviewed' schedule. The remaining items addressed l tests which were not performed as scheduled during a Unit l

2 shutdown in August 1975 due to the equipment they were l to test being out of service for maintenance personnel

(

El-10 i l

protection. The tests were performed prior to unit startup and administrative procedures and plant tech-

,s nical specifications were revised to account for this

! ) situation. A fourth item addressing the general area of surveillance testing occurred as a result of an administrative oversight in failing to revise a test procedure to accurately reflect component hardware changes made in the affected system in 1975. Admin-istrative procedures for system modification document control were revised to include timely revisions to any impacted testing or operation procedures, and no further items of this type have been since reported. The final two items reported in this sub-category addressed administrative controls over personnel access. In one instance, maintenance personnel were allowed to briefly open both personnel air lock doors with the Unit 2 reactor critical in September 1973 due to lack of adequate definition of the requirements for monitoring containment integrity.

The other instance resulted in a significant radiation dose being received by an operator who entered the reactor cavity sump area of Unit 2 while the moveable incore neutron detector thimbles were withdrawn from the core.

Following this incident, the area was posted and lockca, and strict administrative controls were applied to the allowable status of these detector thimbles during personnel entries into the containment. In addition, a gamma monitor has been installed in the reactor cavity g sump area to provide advance ~d warning of suddenly in-(_3 y creasing radiation levels.

2.3 Instrument Calibration Procedural Events Of the four items reported in thic sub-category, two refer to a common inaccuracy in the accumulator level instrumentation calibraticn methods in use at both units in February 1978.

The calibration procedures were revised to account for the minor deviations identified, and no further items have occurred. The remaining events identified a miscalibration of the high steam flow safeguards actuation setpoint discovered during Unit 2 startup testing in 1974 and an inaccuracy in the calibration curves applied to the Unit 2 rod position indication system. These were both corrected and no further items have occurred.

2.4 Testing Procedural Events The events reported in this sub-category both occurred during special tests performed at each of the units and resulted in minima 1 impact upon unit operation or safety systema status.

, El-ll

\

,1

1-2;5 Operating Procedural Events N 'The single event identified in this sub-category resulted in an inadvertent minor dilution of the Unit 2 boric acid storage tanks'during a transfer operation in 1975. The i

procedure changes instituted in response to this event and the related items discussed in sub-category 2.1 1

'have effectively precluded recurrence.

J f

d e

0 i

i O

9 1

t J

El-12 4

, , , - .--...<.-_y., .- .y. w -- , -- - - - . - - . ~ ., - -w--w. - - - - , , , . - ,- www -

1

3. Man-machine / Human Factors Events:

(;

A total of 30 items (23 for Unit 2, 7 for Unit 3) were identified as attributable to causes falling within this general category. In order to facilitate a more detailed review and analysis of these items, this broad category was divi'ded into the sub-categories identified in Table 3.1. These sub-categories were chosen to differentiate among types of activities during -which the reported events occurred and among generalized personnel cl msifications, in order to identify possible unique susceptibilities for specific performance categories and/or personnel work groups.

Table 3.1 1 Man-machine / Human Factors Event Sub-Categories Number of Items Reported

)_ub-Category Unit 2 Unit 3 Information Misinterpretation / Lack of Attention Events 7 2 Repair / Reassembly / Installation Eventa 6 1 Equipment Alignment Events 3 2 Component Adjustment / Calibration Events 3 -

Operational Activity Events 3 -

~

Other Events 1 2

(%

'J -

Although the absolute numbers of events reported for Unit 2 and Unit 3 differed significantly, the relative frequency of occurrence by st a-categories was not substantially different for the two units, indicating the application of essentially uniform per-formance standards to all personnel at the site. The higher number of items reported for Unit 2 may be generally attributed ,

to the facts that the Cata base includes approximately five '

more years of information for Unit 2 than for Unit 3. and that a certain level of knowledge and proficiency obtained as a result of experience at Unit 2 was transferred to person-nel at Unit 3.

3.1 o rmation Misinterpretation / Lack of Attention Events Inf~

This sub-category of events applies generally to control room operations personnel and their sugervisors. It in-cludes instances of misinterpretation, lack of attention, or misapplication of information supplied by data die. plays, '

operational guidelines, procedural limitations, etc.

Table 3.2 summarizes the events reported from both units '

which were identified as applicable to this sub-category.

(Note that six of the seven Unit 2 events and one of the two Unit 3 events occurred during the snits' respective initial cycles of operation).  !

/]

l l

El-13 I

Table 3.2

,es .Information Misinterpretation / Lack of Attention Events

\]

Date Events Cause Unit 2 1/23/74 RCS pressure transient Reactor coclant pumps started with inadequate nitrogen bubble in pressurizer 1/25/74 Critical with rods Incorrect calculation below insertion limit of estimated critical condition 9/27/74 Accumulator level out Incorrect benchmark of limits used to check level 1/5/75 Reactor made critical Failure to interpret with two inoperable highaP ac condition fan coolers of inoperability 3/11/76 Critical with rods Failure to correctly below insertion limit compensate for xenon burnout 12/12/76 Power increase above

~

Failure to correctly 50% withal out of band interpret liraits 9/27/77 Power increase above Failure to correctly withaI out of band apply limits Unit 3 10/1/76 Pressurizer oxygen Failure to verify con-concentration out of centration prior to

(_s) limits exceedina temperature.

limit 10/14/78 Ouadrant flux tilt Lack of understanding during load reduction of impact of boration As is evident from the above Table, all of the events in this sub-category have occurred during plant startup or load change transients, during whiah the operators are responsbile for the assimilation and application of a relatively large number of varying parameters with different levels of operational signi-ficance. Excluding the first item in the 7%ble, the remaining events were of negligible significance to oTerall plant safety and stability and, although generally specidied in operational procedures and limitations, are indicative af parameters to which secondary importance is applied during major plant operational evaluations. The first item is simply attributable to lack of operational experience, since it was reported during the initial startup period and has not been a recurring problem.

The item associated with accumulator level feviation represents a minor departure from established limits with minimal impact upon the capability of this safeguards system to perform its design Im.ctions. For all the above items, it is noted that cumulative operator experience together with proper emphasis in operator training have effectively elimiaated these types of events.

v?

El-14 l'

L

3.2 Repair /Retesembly/ Installation Evento This sub-category of items applies to maintenance and

- ('N construction personnel involved with the physical con-kl struction and/or reassembly of plant equipment. Table 3.3 summarizes the events reported for both units which were identifed as applicable to this sub-category.

Table 3.3' Repair / Reassembly / Installation Events Date Event Unit 2 9/11/72 Steam generator nozzle debris plug left in place during pre-operational test.

9/11/72 Stainless steel debris left in upper core interna's following pre-operational assembly.

8/8/74 Main stema isolation valve packing gland follower misadjusted 12/30/76 Reactor coolant flow transmitter fitting improperly installed 4/1/78 Auxiliary feedwater pump turbine temperature control valves wiring disconnected 7/28/78 Main steam isolation valve packing gland follower misadjusted Unit 3 12/17/76 Main steam isolation valves packing misadjusted O

(_/ The first two items in the Table occurred during plant construction during assembly of the reactor core and steam generators. The flow transmitter installation event was due to'an oversight in tightening a tubing fitting and resulted in a minor leak. The disconnected temperature control valve wiring was discovered during a refueling outage surveillance test of the affected valves and could have, therefore, persisted for a significant period of t!.me prior to detection. However, since the valves are normally open and designeo to fail open on a loss of power, only the automatic closing circuitry.to the valves was de-feated and the operability of the turbine-driven auxiliary fe'edwater pump was not affected. Reinstruction of maintenance personnel has been effective in preventing recurrence of this type of item. The three events associated with the misadjustment of main steam- isolation valve packing apply to four separate valves and were discovered when the asso-ciated valves failed to close. As a result of these events,

. specialized instructions were provided regarding adjustment of valve. packing. Detailed procedures also cover maintenance work performed on these valves. Administrative. controls exist that require that valve stroke testing is performed at normal operating temperatures following any maintenance on these valves.

-Ov El-15

}

3.3 Equipment Alignment Events ,

This sub-category of events applies generally to in-plant

(~') operations personnel assigned the tasks of performing the necessary valving and electrical suAtching operations to place equipment into normal service or testing configurations according to written prccedures and general equipment operation practices. Tabic 3.4 sunmarizes the events reported from both units which were identified as applicable to this sub-category.

Table 3.4 Equipment Alignment Events Date Event Unit 2 5/19/73 Safety injection pumps suction valve MOV-1810 left closed following maintenance and not reopened for pump operation 8/22/74 Diesel generator 23 speed and droop set in-correctly 8/5/76 Safety injection pumps manuct suction valve 846 left closed during pump test Unit 3 4/29/76 Incorrect valve lineup during containment spray pump test 8/30/76 - Diesel generator 31 oil drain valve not closed tightly ,

These incidents,-with one exception, have occurred during initial unit 'startup and early operating periods. (The item reported for 8/5/76 cacurred during a prolonged cold shutdown period in which many systems were taken out of their normal alignment for maintenance and testing

-purposes). Increased operator experience levels, improve-monts to-procedures and an aggressive training program at each unit have been effective in precluding this sub-category of events during the past four years.

3.4 Component Adjustment / Calibration Events 4

This sub-category of events applies generally to instrumentation technicians assigned the tasks of routine component cal-ibration, adjustment and testing. All three of the items reported in this sub-category were identified during initial safety systems instrumentation testing and were attributed to initial miscalibration following installation. No events of this type have been reported since August 1973.

3.5 Operational Activity Events This sub-category of events applies generally to improper performance of a sequence of manual c;erations according (3

'uJ to either written procedural or general operating practice guidelines. Table 3.5 summarizes the three events El-16

1 Table 3.5 Operation Activity Events Date Event 12/27/76 Operator placed wrong bistable in tripped mode following instrumentation failure 8/21/77 Operator transferred liquid from holdup tank 23 too quickly, causing tank to buckle 6/26/78 Operator inadvertently isolated gas compressor during search for system leakage Because of th@ isolated nature of these events and their relatively minor impact upon plant operations, they are considered to be insignificant contributors to this event category for ei ther unit.- General operating procedures have been revised to preclude recurrence of the holdup tank. incident,

3. 6. Other Events Table 3.6 summarizes the three events which were identified as applicable to this sub-category.

Table 3.6 Other' Events Date Event Unit 2 2/22/74 Inadvertent safety injection during test at cold shutdown Unit 3 6/15/76 Mechanic caused electrical fault at cir-cuit breaker 10/30/78 Contractor drcve vehicle into fire hydrant f

U El-17

'III. CONCLUSIONS Our review of the Licensee Event Reports and su,nporting plant

(~r documentation from Indian Point Units 2 and 3 has identified no design, procedural and training, or man-machine / human factors inadequacies which could lead to significant degradation of unit operating reliability or safety systems capabilities.

The data was reviewed and analyzed to develop possible failure cause commonalities, systems interactions effects, and human error susceptibilities. In all such identified cases, the af fected licensee (s) has been aware of the problem and has implemented either engineering solutions or hardware modifi-cations designed to correct the cauce of the reported event.

It should be emphasized that no events were identified for which appropriate corrective action has not been planned or completed.

(G El-18 1

I

e

,. ENCLOSURE 2 RESPONSE TO: CONFIRMATORY ORDER ITEM F.2 (ANNEX I)

Annex 1 item:

1. (1.) The ' Indian Point site has an operational meteorological measurement program. This program utilizes an instru-mented 122 tueter tower on the site.

(a) Wind direction and speed are measured at a minimum of two levels, one of which is representative of the 10 meter level.

Applicable sections of Regulatory Guide 1.23 are complied with.

(b) Thg standard deviation of wind direction fluctuations is calculated for all measured levels.

(c) Vertical temperature difference is provided

() for at least one layer.

(d) Ambient temperature is measured represen-tative of the 10 meter level.

(e) Dew point. temperature is measured representative of the 10 meter level.

(f) Precipitation is measured near the ground level.

(g) Pasquill stability clabses are calculated using f1T.

(2.) The applicable acceptance criteria stated in Revision i l

Section 2.3.3 of NUREG-75/087 are complied with.

(3.) A Quality Assurance Program consistent with the applicable l provisions of Appendix B to 10CFR50 has been established.

br' i Applicable acceptance criteria stated in Revision 1, Section l 17.2 of NUREG-75/087 are complied with.

-1_

-(4.) - The m:tcorological maasurements system and associated -

controlled environmental housing for the equipment is 3 connected to a power system which is supplied from a redundant power source.

(5.) A backup diesel generator has been installed to provide immediate power to the meteorological tower system in the event of power outage. The diesel generator starts via an automatic transfer switch and comes up to speed in 15 seconds.

2. (1) A viable backup meteorological measurement program is provided utilizing a backup instrumented meteorological tower at the Buchanan Service Centar at the Indian Point site. This system is independent of the primary system and provides measurements representacive of the 10 meter i

level of wind direction and speed, and an estimator of (G) atmospheric stability (Pasquill category using sigma Beta which is standard deviation of wind fluctuation) .

(2) The backup system provides informatica representative of the site environs.

(3) The backup system provides information in a real time mode. Changeover from the primary system to tne backup system occurs within five minutes. 7te information is presented in place of the lost record as outlined in Enclosure 1 of NUREG-0654/ FEMA-REP-1.

(4) The remaining applicable criteria stated in Revision 1 Section 2.3. 3 of NUREG-75/087 are conplied with.

(5)- A Quality Assurance Program consistent with the applica-m ble provisions of Appendix B to 10CFRI,0 has been

{s)-

~

established. The applicable acceptante criteria stated in Revision 1, Section 17.2 of NUREG-75/087 are complied with.

l (6) The b ckup meteorological measurements and associated  !

controlled environmental housing system for the equip-(-)

_ ment is connected to a power system which is supplied from redundent power sources.

3. (1) Two real-time, cite specific atmospheric transport and diffusion models have been developed and will be used in the determination of environmental impact when accidental airborne radioactive raleases occur.

The Class A (Gaussian model) model and calculational capability can produce initial transport and diffusion estimates within fifteen minutes following classification of an incident.

The Class B (CRACRT code, a modified version of CRAC) model and calculational capability can produce refined rg estimates for the duration of the release. The models

, V incorporate th'e following features as applicable:

i (a) Site area topography, local meteorological anomalies, and local meteorological measure-ments. ,

i (b) Variations in time and space of the parameters affecting transport and diffusion, including forecasts of changing meteorological concitions.

ic) Wind speed and direction, sigma theta, and delta-T from on-site meteorological measuring systems are used in making the transport and diffusion estimates. The data from these systems can be transmitted at 30 minute intervals A

\l during an incident.

(2) fli3 trcneport- nd diffusion estimatos include current and forecast plume position, dimensions and normalized concentrations at 30 minute intervals. Forecast capa-()

bility (provided directly to the couputer by contract with ACCU-WEATHER) up to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> in the future is provided in three hour increments. These estimates are included as a portion of the information accessible for remote interrogation.

(3) The accuracy and conservatism of the models has been determined from many years of site specific meteoro-logical research. Further determination of accuracy and conservatism is planned by a demonstration of the ARAC system at the Indian Point site. In addition a field tracer experiment is being developed in cooperation with NRC Research, NQAA, FEMA, and DOE. The objective of O the program will be to obtain direct data to confirm computer diffusion models both in the near field

(<l5 miles) and frcm the far field (cut to 50 miles) from the site. This program is currently planned for the first half of 1981.

4. (1) h The meteorological system has the capability of being remotely interrogated simultaneously by Con Edison /PASNY, emergency response organization and the NRC.

(2) The meteorological data and effluent transport and dif fu-sion estimates are in the format indicated in Enclosure 1 1

of NUREG-0654/ FEMA-REP-1. ,

(3) The systems have a dial-up connection for 300 BAUD ASCII

([) - terminal of 80 columns via telephone lines (e.g., output format of RS232C in FSK). l i

I l

A. functional backup communications link io provided on an interim basis via telephonc linos routed through a separate telephone company central office from the primary (3j circuits. The permanent functional backup communications link will consist of a microwave radio system utilizing towers to Manhattan. Access to the meteorological system will be able to be made via telephone to Manhattan.

This permanent backup system is scheduled to be operational by January 1981.

(4)- The system has the capability of recalling 15-minute averages of meteorological parameters from at least the previous 12-hour period.

(5) The resolution of the data meets the system specifications of accuracy given in Section C.4 of Regulatory Guide 1.23.

The capabilit'.es to satisfy Annex 1 to the Confirmatory g-}

us Order described above represent only part of the capabi-lities being provided at the Indian Point site to support emergency response activities. A Sperry-Univac V77-800 mini computer has been installed at the Buchanan Service Center at the site. The MIDAS computer program package supplied by Pickard, Lowe and Garrick, Inc. is also available in this computer. Various support systems for the meteorological systems include an uninterruptable power supply dedicated ventilation systems, halon fire protection, an6 new dedicated communications.

Con Edison and the Power Authority recognize that the requirements contained in Annex 1 to the Confirmatory Order represent the latest draft of proposed criteria as

/~S kl they existed in February 1980. Since then, changes in Proposed requirements have occurred. We have provided

' sufficient excess capabilities in our systems to accomo-A V . date_reascnable changes in requirements. Our personnel are ready to work directly with the NRC Regulatory Staff to accomplish such desired changes.

1 1

i i

4 0

9 e

O

'I o e 4

f L

f O

f j

! ( .

10 CFR PART 50 COMPLIANCE STUDY in response to i

NRC CONFIRMATORY ORDER

]

for 4 INDIAN POINT UNIT NO. 2

)

FEBRUARY 11, 1980 I

(ITEM NO. F3)

($)

l 1

l 1

\

l N- l

. CONSOLIDATED EDISON COMPANY OF NEW YORK, INC.

~

INDIAN POINT UNIT NO. 2 DOCKET NO.'50-247 AUGUST 1980 I i.

Oz

- .. . _ _ . l

FOREWORD On February 11, 1980, in connection with a Union of Concerned Scientists' petition to suspend operation of Indian Point Unit No# 2, NRC issued a Confirmatory. Order requiring the implementa-tion of a number of interim measures pending completion of addi-tional NRC review.

Item No. F3 of the February 11, 1980 Confirmatory Order reads as follows:

" Conduct a study to determine and document the method by which its plant complies with current safety rules and regulations, in particular those contained in 10CFR Parts

() 20 and 50."

This study has been prepared to demonstrate compliance with the safety rules and regulations contained in 10CFR Part 50 of the ,

Commission's regulations as they appeared and were published on June 23, 1980. Accordingly, portions of the regulations having no direct or immediate significance with respect to the safe operation of Indian Point Unit No. 2 (e.g. financial requirements and reporting, etc.) have not been addressed.

I l

- 1

TABLE OF CONTENTS c

(_)

10CFR50.34(c) Contents of Application:

Technical Information (c) Physical Security Plan 10CFR50.34(d) Contents of Application:

Technical Information (d) Safeguards Contingency Plan

, 10CFR50.34a(c) Design Objectives for Equipment to Control Releases of Radioactive Materials in Effluents - Nuclear Power Reactors (c) Operating License 10CFR50.36 Technical Specifications 10CFR50.36a Technical Specifications on Effluents from Nuclear Power Reactors 10CFR50.44 Standards for Combustible Gas Control System in Light-Water Cooled Power Reactors rm

(,_) 10CFR50.46 Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors 10CFR50.54(a)-(o) Conditions of Licenses (a)-(o) General 10CFR50.54(p) Conditions of Licenses (p) Safeguards Contingency Plan 10CFR50.55a(g) Codes and Standards:

(g) Inservice Inspection Requirements 10CFR50.59 Changes, Tests and Experiments 10CFR50.70 Inspections 1

10CFR50.71 Maintenance of Records, Making of deports 10CFR50.72 Notification of Significant Events

~

( ~) -

(/ ,

I BE- --v ep _

TABLE OF CONTENTS - (CONT'D)

N>

10CFR50- General Design Criteria for Nuclear Appendix A Power Plants 10CFR50- Quality Assurance Criteria for Nuclear Appendix B Power PILnts and Fuel P,cprocessing Plants 10CFR50- Emergency Plans for Production and Appendix E Utilization Facilities o Final Safety Analysis Report o Content of Emergency Plans 10CFR50- Fracture Toughness Requirements Appendix G 10CFR50- Reactor Vessel Material Surveillance Appendix H Program Requirement 3 10CFR50- Numerical Guides for Design Objectives Apppendix I and Limiting Conditions for Operation

(~)' 10CFR50- Primary Reactor Containment Leakage Ns Appendix J Testing for Water-Cooled Power Reactors 10CPR50- ECCS Evaulation Models Appendix K.

C'i v

g ,,7 ,_ __

,~ 10CFR50.34(c) - Contents of Applications: Technical Informa-

, k) m tion, (c) Physical Security Plan o- "(c) Physical Security Plan. Each application for a license to operate a production or utilization facility shall include a physical security plan. The plan shall consist of. two parts. Part I shall address vital equip-ment, vital areas, and isolation zones, and shall demon-strate how the applicant plans to comply with the require-ments of Part 73 of this chapter, if applicable, at the i

proposed facility. Part II shall list tests, inspections, i

and other means to be used to demonstrate compliance with such requirements, if applicable,"

() Response: Consolidated Edison submitted to the NRC, by letter dated May 25, 1977, the Indian Point Unit Nos. 1 and 2 Physical Security Plan. Revisions to that plan were submitted to the NRC by letters dated November 2, 1977, May 26, 1978, June 28, 1978, November 9, 1978 and February 7, 1979. By letter dated February 27, I 1979 the NRC informed Consolidated Edison of the following:

"We have completed our review and evaluation of your physical security plan and have concluded that the physical security plan for your facility, when fully implemented, will provide the protec-(]p tion needed to meet the general performance re-l

- i 1

8 I

i quirements of 10CFR 73.55(a) and the objectives 3: .

i of the specific requirements of 10 CFR 73.55, i '

{ paragraphs (b) .through (h), without impairing ,.

i l

!~ your ability. to safely operate your facility. l

. . i

( We therefore further conclude that the plan is l

.

acceptable."

+ t

j.  !

d i.

e i  !

1 t t

l i-l I

!O 1

i.

1 l

l l

.t 4

h

(

4 4

v

,

,- l l

101

,h

10CFR50.34(d) - Contents of Applications: Technical Inform-

{;

ation, (d) Safeguards Contingency Plan o "(d) Safeguard Contingency Plan. Each application for a license to operate a production or utilization facility that shall be subject to 5S73.50,73.55, or 73.60 of this chapter shall include a license safe-guards contingency plan in accordance with the criteria eet forth in Appendix C to 10 CFR Part 73.

The safeguard contingency plan shall include plans for dealing with threats, thefts, and industrial 4'

sabotage, as defined in Part 73 of this chapter, relating to the special nuclear material and nuclear s facilities licensed under this chapter and in the ap-U plicant's possession and control. Each application

, for such a license shall include the first four cate-gories of information contained in - the applicant's safeguards contingency plan. (The first four catego-ries of information, as set forth in Appendik C to

. 10 CFR Part 73, are Background, Generic Planning Base, Licensee Planning Base, and Responsibility Matrix. The fif th category of information, Proce-dures, does not have to be submitted for approval)."

Response: Consolidated Edison submitted to the NRC on March 22, 1979 the Safeguards Contingency Plan for Indian Point

-,-). Unit Nos. 1 and 2. Subsequently, revisions to that

(/

i 4

l i

plan were submitted 'to the NRC on August 13, 1979,

March 7, 1980 and April 29, 1980. By letter dated May i '20, 1980 the NRC found "...the Safeguards Contingency t

Plan acceptable..."

i s

1 t L 4

4 .

) ,

1 l

l l

l

).

I t

+

4

!O i

.s .1 i

'l i

1 i

t i

i i

1 P

,A l

O;

• g ,. , W ---, . , , . . . , , _ - .,:-y. -.-..-....-..-,3- - , , , ..,,,.m.,,.__ ,..,_,,.e-_ ..,,._,~,,-,,,-,y .,,.-r,,---.+,- --.e*,*,.,-

's

,_ 10CFR50.34a(c) - Design Objectives for Equipment to Control

\ ')

Releases of Radioactive thterial in Effluents -

Nuclear Power Reactors o "(c) Each application for a license to operate a nuclear power reactor shall include (1) a description of the

, equipment and procedure for the control of gaseous and liquid effluents and for the maintenance and use of equip-ment installed in radioactive waste systems, purusant to paragraph (a) of this section;..."

f Response: The information is contained in the FSAR Section 11.

V

~

Additional information is contained in Safety Eval-uations issued as required per 10CFRSO.59. Summarie s 4

of Safety Evaluations are incorporated in the Semi-Annual Operating Reports.

o "

...(2) a revised estimate of the information required in paragraph (b) (2) of this section if the expected releases and exposures differ significantly from the estimates submitted in the application for a construc-  !

. tion permit."

Response: The information is contained in the FSAR, Section 11.

The quantities of radio-nuclides in liquid and gaseous effluents actually released to unrestricted areas are listed in the Semi-Annual Operating Report.

(h x._)

l

\

10CFR50.36 - Technical Specifications l-)

(a) Each applicant for a license authorizing operation of a production of utilization facility shall include in his dpplication proposed technical specifications in accordance with the requirements of this section. A summary statement of the bases or reasons for such specifications, other than those covering administrative controls, shall also be included in the application, but shall not become part of the technical specifications.

(b) Each license authorizing operation of a production or utiliza-I tion f acility of a type described in S50.21 or S50.22 will include technical specifications. The Technical Specifications

{) will be de. rived from, the analyses and evaluation included in the safety analysis report, and amendments theret7, submitted pursuant to S50.34. The Commission may include such additional technical specifications as the Commission finds appropriate.

(c) Technical specifications will include items in the following categories:

(1) Safety liniits, limiting safety system settings, and limiting control settings. (i)(A) Safety limits for nuclear reactors are limits upon important process variables which are found to be necessary to reasonably protect the integrity of certain of the physical barriers which guard against the uncontrolled release of radio-activity. If any safety limit is exceeded, the reactor

will be shut down. The licensee shall notify the Com-(^l N- mission, review e matter and record the results of the review, including the cause of the condition and the basis fo- corrective action taken to preclude re-occurrence. Operation shall not be resumed until authorized by the Commission.

(B) Safety limits for fuel reprocessing plants are those bounds within which the process variables must be main-tained for adequate control of the operation and which must not be exceeded in order to protect the integrity of the phycical system which is designed to guard again ,

the uncontrolled release of radioactivity. If any safety limit for a fuel reprocessing plant is exceeded, cor rective action shall be taken as stated in the technical specification or the affected part of the process, or the entire process if required shall be shut down, unless such action would further reduce the margin of safety.

l The licensee shall notify the Commission, review the '

matter and record the results of the review, including l the cause of the condition and the basis for corrective I

action taken to preclude reoccurrence. If a portion of the process or the entire process has been shut down, operation shall not be resumed until authorized by the l

Commission. l l

v i

(ii)(A) Limiting safety system settings for nuclear

_(,] '

reactors are settings for automatic protective devices related to those variables having significant safety functions. Where a limitt s safety system setting is t

specified for a variable on which a safety limit has been placed, the sett.'aa shall be so chosen that auto-matic protective action will correct the abnormal situa-tion before a safety limit is exceeded. If, during operation, the automatic safety system does not function as required, the licensee shall take appropriate action, which may include shutting down the reactor. He shall notify the Commission, review the matter and record the results of the review, including the cause of the condi-tion and the basis for corrective action taken to preclude

,({}

reoccurrence.

(B) Limiting control settings for fuel reprocessing plants are settings for automatic alarm or protective devices related to those variables having significant safety functions. Where a limiting control setting is specified for a variable on which a safety limit has been placed, the setting shall be so chosen that protective action, 1

either automatic or manual, will correct the abnormal situation before a safety limit is exceeded. If, during t

operation, the automatic alarmor prJtective devices do not function as required, the licensee shall take appro-

.priate action to maintain the variables within the

/}

limiting control-setting values and to repair promptly

/^3

(_/ the automatic devices or to shut down the affected part of the process and if required to shut down the entire process for repair of automatic devices. The licensee shall notify the Commission, review the matter, and record the results of the review, including the cause of the condition and the basis for corrective action taken to preclude reoccurrence.

, (2) Limiting conditions for operation. Limiting condi-tions for operation are the lowest functional capability or performance levels of equipment required for safe operation of the facility. When a limiting condition for operation of a nuclear reactor is not met, the

() licensee shall shut down the reactor or follow any remedial action permitted by the technical specification until the condition can be met. When a limiting condi-tion for operation of any process step in the system of a fuel reprocessing plant is not met, the licensee shall shut down that part of the operation or follow any remedial actic7 permitted by the technical specification until the condition can be met. In the case of either a nuclear reactor or a fuel reprocessing plant, the licensee shall notify the Commission, review the matter, and record the results of the review, including the cause of the condition and the basis for corrective g, action taken to preclude reoccurrence.

(

l l I

(3) Surveillance requirements. Surveillance requirements

(^).

(~ are requirements relating to test, calibration, or in-spection to assure that the necessary quality of systems and components is mair tained , ' that facility operation will be within the safer.y limits, and that the limiting conditions of operation will be met.

(4) Design features. Design features to be included are those features of the facility such as materials of construction and geometric arrangements, which if altered or modified, would have a significant effect on safety and are not covered in categories described in sub-paragraphs (1), (2), and (3) of this paragraph (c).

("'S (5) Administrative controls. Administrative controls V

are the provisions relating to organization and manage-ment, procedures, recordkeeping, review and audit, and reporting necessary to assure operation of the facility in a safe manner.

(d) (1) This section shall not be deemed to modify the tech-nical specifications included in any license issued prior to January 16, 1969. A license in which technical specifi-cations have not been designated shall be deemed to include the entire safety analysis report as technical specifications.

l

(~)%

l l

I

? _ . _ - - _ _ . _ . _ _ __ - - - . .- ----

=>1

I

_ (2) An applicant for a license authorizing operation

(_) of a prcduction or utilization facility to whom a con-struction permit has been issued prior to January 16, 1969, may submit technical specifications in accordance f: with this section, or in accordance with the require-

, ments of this part in eLfect prior to January 16, 1969.

(3) At the initiative of the Commission or the licensee, any license may be amended to include technical specifica-tions of the scope and content which would be required if a new license were being issued.

Kesponse: (a) Proposed Technical Specifications were submitted as part of the IP-2 application for an operating license, as amended. A summary statement of the' bases for those

(])

technical specifications was included with the appro- -

priate sections.

(b) 'The Technical Specifications were derived from the 1 analyses and evaluations included as part of, or referenced by, the IP PSAR and various amendments to the operatir, License. )

4 I

(c)(1)(i)' A) Safety limits, as defined in this section, l l

fc; the 7.P2 reactor were detailed in Section 2 of the technical specifications, Specifically addressed are -

I reactor core safety limits, reactor coolant system pres-sure limits, and limiting safety system settings for N

(~J

\_

protective instrumentation. If any safety limit is

(_/ exceeded, the reactor will be shutdown and the action required by this section will be taken as stated in Section 6.7 of the IP-2 Technical Specifications.

(c)(1)(i)(b) Not applicable to nuclear power units.

4 (ii)(A) Limiting safety systen settings for automatic protection devices related to significant safety function variables were submitted in Section 2.3, Instrumentation, of the IP-2 Technical Specifications. Failure of a system subject to a limiting safety system setting will be reported to the Commission per Section 6.9.1.7 of the IP-2 Technical Specifications.

() (b) Not applicable to nuclear power units.

.(:2) Limiting conditions for operation of IP-2 facility are contained in Section 3 of the IP-2 Technical Specifi-cations. Included in this section are performance levels or functional limits for the reactor coolant system, i

chemical and volume control system, engineered safety features, steam and power conversion system, instrument systems, the containment system, auxiliary electrical systems, refueling, control rod and power distribution limits, moveable in-core instrumentation, shock suppres-sors and fire protection and detection systems. Reporting

(

l 1

u -

- - -J :

requirements are speci.fied in Section 6.9.1.7 of the IP-2 Tecchnical Specifications.

(3) Surveillance requirements to assure tiaat the quality of systcms and components is maintained through tests, calibration or inspection were detailed in Section 4 of the IP-2 Technical Specifications. Included were operational safety review, primary system surveillance, reactor coolant system integrity testing, containment tests, engineered safety feature tests, emergency power

system periodic tests, niain steam stop valve surveillance, auxiliary feedwater system surveillance, steam generator 5

tube inservice surveillance, reactivity .cnomalies, radio-active materials surveillance, shock suppressors fire protection and detection systems.

-(4) Other design features of the IP-2 facility including site attributes, containment, reactor, and fuel storage which could have a significant effect on safety were detailed in Section 5 of the IP-2 Technical Specifications.

(5) Administrative controls relating to the safe opera-tion of the IP-2 facility were submitted in Section 6 of the IP-2 Technical Specifications. Included in Section 6 are administrative controls regarding responsi-bilitypstation staff organization, personnel qualifica-tions, review and audit, reportable occurrence actions, safety limit violations procedures, record retention, i

.(]}

' radiation and. respiratory program high radiatiort area-i, . O

I requiremerfts.

i

! (d)(1) No response required.

i I

(2) The present Technical Specifications are in accor-

dance with the regulations.  ;

l 5

l +

i

6 1

l~

! i O

1 e

i I

I

! i l

1 I

{' I i

t I

LO i

1-l

(-

\;

[- .

b -' -

.-.__;__.. ..~._~~~,-.._:.._._._........-._--._-_.,-._.._.-

l l 10CFR50.36a - Technical Specification on Effluents From Nuclear

' Power Reactors 1

(a) In order to keep releases of radioactive materials to unre-stricted areas during normal reactor operations, including expected operational occurrences, as low as is reasonably achieveable, each license authorizing operation of a nuclear power reactor will include technical specifications that, in addition to requiring compliance with applicable pro-visions of S20.106 of this chapter, require:

(1) That operating procedures developed pursuant to S50.34a(c) for the control of effluents be established and followed and that equipment installed in the radio-

{} active waste system, pursuant to S50.34a(a) be main-tained and used.

(2) The submission of a report to the appropriate NRC Regional Office shown in Appendix D of Part 20 of this chaptee within sixty (60) days after January 1 and July 1 of each year specifying the quantity of each of the principal radio-nuclides released to unrestricted areas in liquid and in gaseous effluents during the previous six (6) months of operation, and such other information as may be required by the Commission to estimate maximum potential annual radiation doses to the public result-ing from effluent releases. Copies of such report shall be sent to the Director of Inspection and Enforcement, s-l Li

- , n u 2

U.S. Nuclear Regulatory Commission, Washington, D.C.

A/ 20555. If quantities of radioactive materials released during the reporting period are significantly above design objectives, the report shal3 cove this specifi-cally. Ga the basis of such reports any additional information the Commission may obtain from the licensee or others, the Commission may from time to time require the licensee to take such action as the Commission deems appropriate.

(b) In establishing and implementing the operating procedures described in paragraph (a) of this section, the licensee shall be guided by the following considerations: Experience with the design, construction and operation of nuclear power

) reactors indicates that compliance with the technical speci-fications described in this section will keep average annual releases of radioactive material in ef fluents at small per-centages of the limits specified in S20.106 of this chapter and in the operating license. At the same time, the licensee is permitted the flexibility of operation, compatible with considerations of health and safety, to assure that the public is provided a dependable source of power even under unusual operating ccnditions which may temporarily result in releases higher than such small percentages, but still within the limits specified in S20.106 of this chapter and the operating license.

It is expected that in using this operating flexibility under unusual operating conditions, the licensee will exert his e]

us

% - ,a

l i

best efforts to. keep levels of radioactive material in j O_ effluents as low as is reasonably achievable.

The guides set out in Appendix I provide numerical guidance on limiting conditions for operation for light-water-cooled

, nuclear power reactors to meet the requirement that radio-t active materials in effluents release to unrestricted areas be kept as low is reasonably achievable.

4 Response: In March 1977 Consolidated Edison and The Power Authority of the State of New York submitted to the Nuclear Regulatory Commission a report entitled "An Evaluation to Demonstrate the Compliance of the Indian Point Reactors with the Design Objectives of 10 CFR Part 50, Appendix I". This document specifically addresses com-(])

pliance with 10 CFR 50.36a, as well as 10 CFR 50.34a and Appendix I to 10 CFR 50. In addition, the require- i 1

ments established in the present site environmental i

technical specifications (Appendix B to DPR-5, 26 and )

.64) implement the requirements of Appendix I and are consistent with the requirements of 10 CPR 50.36a.

For further information see response to 10 CFR 50.34a and Appendix I.

d

10CFR50.44 - Standards for combustible gas control systems in

(]) light-water-cooled power reactors.

o "(a) Each boiling or pressurized light-water nuclear power reactor fueled with oxide pellets within cylindrical zircaloy cladding, shall, as provided in paragraphs (b) through (d) of this section, include means for control of hydrogen gas that may be generated,, following a postulated loss-of-coolant accident (LOCA), by (1) metal-water reac-tion involving the fuel cladding and the reactor coolant, (2) radiolytic decomposition of the reactor coolant, and (3) corrosion of metals."

Response: A flame recombiner system is installed in the Indian Point No. 2 as an engineered safety feature in order to control the hydrogen evolved in the containment following a loss-of-coolant accident.

Inside the containment are two (2) full-rated flame recombiner systems. Each is capable of maintaining the ambient H2 concentration at or below two volume percent (v/o). (FSAR Q6.8(a)-1)

In addition, a Post Accident Containment Venting System is installed which concists of a common penetration line which acts as a aupply line through

, which hydrogen free air can be admitted to the con-tainment and an exhaust line with parallel valving

(~% and piping, through which hydrogen bearing gases G

i

from containment may be vented through a filtration

() system.

o "(b) Each boiling or pressurized light-water nuclear power reactor fueled with oxide pellets within cylindrical zirc-aloy cladding shall be provided with the capability for (1) measuring the hydrogen concentration in the containment, (2) insuring a mixed atmosphere in the containment, and (3) controlling combustible gas concentrations in the containment following a postulated LOCA."

Response: (1) A sample line originates in each of the reactor containment f an cooler units at a location downstream of the fan but upstream from the charcoal filter. A pump is used to provide sufficient head to bring con-(])

tainment air in a loop from the fan cooler through a containment penetration to a sample vessel outside the containment, and then through a second peneira-tion to the sample line termination inside the c :41- . .

tainment. Before a sample is taken, the line is purged by allowing containment gas to circulate

.through the loop for a few minutes. Samples are taken in a closed, pressure tight vessel which can be removed from the line for transfer to the labora-tory. (FSAR 6.8b(1)-1)

(2) To assure that stratification effects or sample errors would not permit all or parts of the contain-

[ }-

.

t l

ment to hold hydrogen in excess of the lower flammable

~

O limit (4.1 v/o) when the measured concentration is 2.0 v/o, the following checks were made. First, it was determined that the minimum reliable air circu-lation rate by three of the main ventilating blowers within the containmene had the capacity to tecirculate the entire containment air volume on the average 4.8 times an hour (or 210,000 cfm). But the calculated hydrogen generation rate during the first day post accident is 16,300 sef yielding a ratio of air cir-culation to hydrogen generation in excess of 18,500:1.

Due to the decreased rate of hydrogen generation with time, the ratio increases to an even greater value  :

before the hydrogen concentration in the containment

(])

reaches two percent. At the conservatively predicted generation rate, 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> are required to produce >

hydrogen in the amount of one percent of containment volume. During this same period, the entire atmo-sphere of the containment has been recirculated on the average 115 times. Furthermore, the air handling system is designed to promote the interchange of air in all regions of the containment to avoid the possi-bility of accumulation of hydrogen in stagnant pockets or strata. For example, in the highest part of the containment dome (above the top spray ring), minimum air recirculation provides one air change approxi-O 1

g, mately every 61 seconds. For these three reasons it is concluded that the stratification error is negligible. (FSAR Q. S.8b(1)-3)

The fan cooler units would continue in operation

.during the long-term recirculation phase during which

the containment fission products, primarily organic iodide, and pressure are continually reduced. In addition, effective recirculation is provided to all parts of the containment. Suction to the fan cooler units is taken from the upper portion of the contain-ment and dir, charged f rom the f an coolers through a ring header to various compartments below the oper-ating dec}.. (FSAR Q. 6.9-2)

(3) A flame recombiner system is installed in the Indian Point No. 2 as an engineered safety feature in order to control the hydrogen evolved in the containment following a loss-of-coolant accident. I Inside the containment are two '2) full-rated flame l

recombiner systems. Each is capable of maintaining the ambient H2 concentration at or below two volume percent (v/o). ( FSAR- p. Q. 6. 8 (a)-1)

In addition, a-Post Accident Containment Venting system is installed. This system serves to provide l

hydrogen free air to containment as required, or i

l l

or permits the venting of hydrogen bearing gases from containment through a filtration system.

o "(c) For each boiling or pressurized light-water nuclear power reaccor fueled with oxide pellets within cylindri-cal zircaloy cladding, it shall be shown that during the time period following a postulated LOCA but prior to ef-fective operation of the combustible gas control system, 1 either: (1) An uncontrolled hydrogen-oxygen recombina-cion would not take place in the containment; or (2) the plant could withstand the consequences of uncontrolled hydrogen-oxygen recombination without loss of safety function. ~.Cf neither of these conditions can be shown, the containment shall be provided with an inerted atmo-sphere or an oxygen deficient condition in order to pro-vide protection against hydrogen burning and explosions during this time period."

l Response: (1) It is intended that the combustor will be ignited when the hydrogen in the containment atmo-sphere reaches about 2 v/o. It may be run full throttle until the hydrogen is reduced to about 1.5 i

v/o and then it may be cut back by reducing the I amount of hydrogen fuel to the combustor or by put-l ting the unit on pilot burner only. (FSAR Q6.8(a)-4) '

+ - ,- . - .

l 73 The calculated containment hydrogen concentration

%-)

does not reach two volume percent until 13 days post

accident, so it is unlikely that any sie,nificant concentration gradient will exist in the containment when the recombiner is started. Furthermore, since tests have been run with a full scale recombiner system at hyarogen concentrations up to and including J 3.5 volume percent hydrogen, a hydrogen concentra-i tion between 2 and 3.5 volume percent at the recom-biner suction would have no adverse effect on the recombiner operation. (FSAR Q 6.8b(1)-3) '

O

10CFR50.46 - Acceptance . criteria for emergency core cooling

() systems for light water n: clear power reactors Response: Emergency core cooling system analyses are performed in accordance with the requirements and acceptance criteria of 10CFR50.46 as follows:

Approved Westinghouse evaluation models are employed.

The number, size, and location of postulated breaks considered are sufficient to provide assurance that the entire spectrum of postulated loss-of-coolant accidents is covered. Small breaks (hot and cold leg), up to and including e a break equivalent in size to the double-ended rupture of the largest pipe in the reactor coolant system are considered, and the limicing break size bracketed. Additional sensitivity studies have been performed by Westinghouse and subm'.tted to NRC on a generic basis.

The performance criteria for emergency core cooling systems are mat. In particular:

(1) Peak clad temperature is maintained less o

than or equal to 2200 F.

(2) Maximum clad oxidation dcas not exceed 17%

of the total clud thickness.

(~)

v

(3) Ma43 mum hydrogen generation does not exceed c

(-), 1% L: all non-plenum cladding were to react.

(4) Celculated changes in core geometry are such th?t the core temains amenable to cooling.

(5) Long-term core cooling capability is main-tained.

In cddition to meeting the 10CFR50.46 criteria concerning peak clad temperature, NRC's Confirm-atory Order of February 11, 1980 requires that o

peak clad temperature not exceed 2000 F during a large loss-of-coolant accident. This requirement has been accomplished by maintaining a reduced peaking factor (F ). The currently applicable 0

, 73 emergency core cooling system analyses satisfying V

the requirements of 10CFR50.46 for small break and large break LOCA's were submitted to NRC by lettern dated July 13, 1976 and January 5, 1979, respectively.

/~)

V l

y -m _.,7- ,m ...-,,y--

,n v .-. - - ,,m - - --

r-10CFR50.54(a) through (o) - Conditions of Licenses Whether stated therein or.not, the following shall be deemed conditions in every license issued:

(a) (Deleted 32 FR 2562.)

(b) No right to the special nuclear material shall be con-ferred by the license except as may be defined by the license.

(c) Neith'er the license, nor any right thereunder, nor any right to utilize or produce special nuclear material-shall be transferred, assigned, or disposed of in any manner, either voluntarily or involuntarily, directly or indirectly, through transfer of control of the li-cense to any person, unless the Commission shall, after securing full information, find that the transfer is in accordance with the provisions of the act and give its consent-in writing.

(d) The-license shall be subject to suspension and to the rights of recapture of the material or control of the facility reserved to the Commission under section 108 of the act in a state of war or national emergency de-clared by Congress.

(e) The' license shall be subject to revocation, suspension,

, modification, or amendment for cause as provided in the j act and regulations, in accordance with the procedures I- provided by the act and regulations.

A i N-]

L

r

-s (f) The licensee will at any time before expiration of the (s_J\

license, upon request of the Commission submit written statements, signed under oath or affirmation, to enable the Commission to determine whether or not the license should be modified, suspended or revoked.

(g) The issuance or existence of the license shall not be deemed to waive, or relieve the licensee from compli-ance with, the antitrust laws, as specified in subsec-tion 105a of'the act. In the event that the licensee should be found by a court of competent jursidiction to have violated any provision of such antitrust laws in the conduct of the licensed activity, the Commis-sion may suspend or revoke the license or take such O other action with respect to it as shall be deemed necessary.

(h) The license shall be subject to the provisions of the act now hereafter in effect and to all rules, regula-tions, and orders of the Commission. The terms and conditions of the license shall be subject to amend-ment, revision, or modification, by reason of amend-ments of the act or by reason of rules, regulations,  !

1 and orders issued in accordance with the terms of the 1

act.

4

'(i) Except as provided in S55.9 of this cha.ter, the licensee

(). shall not permit the manipulation of the controls of

any facility by any person who is not a licensed operator or senior operator as provided in Part 55 of this chapter.

(1-1) Within three months after issuance of an Operat-ing License, the licensee shall have in effect an operator requalification program which shall, as a minimum, meet the requirements of Appendix A of Part 55 of this chapter. Notwithstanding the pro-visions of S50.59, the licensee shall not, except as specifically authorized by the Commission, make a change in an approved operator requalification program by which the scope, time alloted for the program or frequency in conducting differer.t parts of the program is decreased.

{]l)

Holders of operating licenses in effect on September 17, 1973 shall implement an operator requalification pro-gram which, as a minimum, meets the requirements of Appendix A of Part 55 of this chpater which was sub-i mitted for approval by the Atomic Energy Commission.

(j) Apparatus and mechanisms other than controls, the i

operation of which may affect the reactivity or power level of a reactor, shall be manipulated only with the knowledge and consent of an operator or senior operator licensed pursuant to Part 55 of this chapter present at the controls.

l l

[u >) l l

i

' l

(k) An operator or senior operator licensed pursuant to O Part-55 of this chapter shall be present at the con-trols at all times during the operation of the faci-lities.

(1) The licensee shall designate individuals to be re.

sponsible for directing the licensed activities of licensed operators. These individuals shall be licensed as senior operators pursuant to Part 55 of this chapter.

(m) A senior operator licensed pursuant to Part 55 of this chapter shall be present at the facility or readily available on call at all times during its operation, and shall be present at the facility during initial

(]) start-up and apprcach to power, recovery from an un-planned or unschedtled shutdown or significant reduc-

' tion in power, and refueling, or as otherwise prescribed in the facility license.

(n) The licensee shall not, except as authorized pursuant to a construction permit, make any alteration in the 4

facility constituting a change from the technical spec-ifcations previously incorporated in a license or con-struction permit pursuant to S50.36.

(o) Primary reactor containments for water cooled power re-actors shall be subjected to the requirements set forth in Appendix J.

2

Response: (a)-(h) No response required.

!NE (i)-(l) In response to NRC letters dated August 22, 1973 and July 19, 1974, Consolidated Edison submitted its operator requalification pro-gram by latters dated December 17, 1973, August 15, 1974 and October 21, 1974. By letter dated October 31, 1974 from Mr. Paul Collins (NRC) to Mr. William J. Cahill, Jr.

(Consolidated Edison), the NRC approved the operator requalification program and in do-ing so stated that they "... have determined the program meets the requirements of Section 50.54 (i-1) of 10CFR Part 50 and Appendix A of 10CFR Part 55..." Consolidated Edison fC/w' has and will continue to provide the Commis-sion with full information regarding any and all proposed changes to the operator requali-fication program in advance of their effective date.

(j)-(m) Consolidated Edison has in effect administra-tive controls which assure manning of reactor controls pursuant to these sections.

l (n) Consolidated Edison has made no changes to the IP-2 facility that could be considered as a change from technical specifications without 1

full knowledge and approval of the Commission.

Lj (o) See the response to 10CFR50, Appendix J.

() 10CFR50.54(p) - Conditions of Licenses o "The licensee shall prepare and maintain safeguards

~

contingency plan procedures in accordance with Appendix C of 10 CFR Part 73 for effecting the actions and de-cisions contained in the Responsibility Matrix of the safeguards contingency plan."

f I Response: Consolidated Edison's implementing procedures for the' Indian Point Unit Nos. 1 and 2 Safeguards Con-tingency Plan are contained in the Security Guard Manual which is maintained onsite, o "The licensee may make no change which would decrease

(]) the effectivenes of a security plan prepared pursuant to S50.34(c) or Part 73 of this chapter, or of the first four categories of information (Background, Generic Planning Base, Licensee Planning Base, Responsibility Matrix) contained in a licensee safeguards contingency plan prepared pursuant to S50.34(d) or Part 73, as ap-plicable, without prior approval of the Commission. A licensee desiring to make such change shall submit an )

application for an amendment to his license purauant to S50.90."

Response: Consolidated Edison does not plan on making any change ~s to the Physical Security Plan or the first four categories of information contained in the

(}

(}]} Safeguards Contingency Plan that would decrease the effectiveness of either document. If at any time such changes are comtemplated Consolidated Edison will submit the proper applications pursuant to S50.90.

.o "The licensee may make changes to the security plan or to safeguards contingency plan without prior Commission approval if the changes do not decrease the safeguards effectiveness of the plan. The licensee shall maintain records of changes to the plans made without prior Com-mission approval for a period of two years from the date of the change, and shall furnish to the Director of Nuclear Material Safety and Safeguards (for enrichment

(])

and reprocessing facilities) or to the Director of Nuclear Reactor Regulation (for nuclear reactors), U.S.

Nuclear Regulatory Commission, Washington, D.C. 20555, with a copy to the appropriate NRC Regional Office speci-fled in Appendix A of Part 73 of this chapter, a report containing a description of each change within two months after the change is made."

Response: Consolidated Edison will maintain records of changes for at least two years from the date of the change, of any change made to the Security Plan or Safeguards

' Contingency Plan. Consolidated Edison will submit to the appropriate NRC of fices copies of any change within

{'}

two months af ter the change is made.

({}

o " Prior to the safeguards contingency plan being put ,

I into effect, the licensee shall~have:  !

1 (1) All safeguards capabilities specified in the safeguards contingency plan available and functional."

Response: The safeguards capabilities specified in the safe-guards contingency plan were available and func-tional prior to that plan being put into effect.

o " Detailed Procedures developed according to Appendix C to Part 73 available at the licensee's site,..."

O Response: Implementing procedures for Con Edison's Plan i are contained in the Security Guard Manual which is

maintained onsite.

o ... and; All apppropriate personnel trained to respond to safeguards. incidents as outlined in the plan and specified in the detailed Procedures..."

Response: All appropriate personnel are being trained and re-trained to respond to safeguards incidents as out-lined in the plan and specified in the procedures.

o "The licensee shall provide for the development, re-

-t' vision, implementation, and maintenance of his safeguards

-%]s -

contingency plan. To this end, the licensee shall pro-(_

vide for a review at least every 12 months of the safe-guards contingency plan by individuals independent of both secur ity program management and personnel who have direct renponsibility for implementation of the security program. 1 l

Response

The !;nfeguards Contingency Pian will be reviewed every 12 months. The review will be conducted by individuals independent of the security program l management and implementation.

o "The review shall include a review and audit of safe- 1 i

guards contingency procedures and practices, an audit

(]) of the security system testing and maintenance program, and a test of the safeguards system along with commit-ments establish for response by local law enforcement l l

authoritics." '

Response: The review shall include an audit of the Security l Systems Testing and Maintenance Program, of Safe-guar.' . Contingency Procedues, a test of the Saf e-guai. Systems and a review of local law enfor s-ment .tgencies' response commitments.

o "The resu;;s of the review and audit, along with ree:caenda-tions for tmprovements, shall be documented, reported to the licensee . .' porate and plant management, and kept 2 2.;sble r^

(_)s

. . . - _ -.. - _= -.

f'

at the plant for inspection for a period of two years."

i

. Response:- - The results of the review and audit, along with 4

- recommendations - for improvement, will .be documented, reported to the Consolidated Edison plant management and kept available for inspection for a period of two years.

4 s

, O J

t

!O

(

i

(

l r

. . . . - , ,a . .. . . - - . - - - , - - - - - , . - - . -

,.s 10CFR50.55a(g) - Codes and Standards: Inservice Inspection f i w/ -

Requirements Response: The inservice inspection and testing program for Indian Point Unit No. 2 complies with the requirements of 10CFR 50.55a(g).

The current inservice inspection and testing program was developed as required by Section 50.55a(g) of 10CFR 50 as amended February 1976. The program as submitted to NRC in August 1977 was intended to be applicable to the inservice inspection of Quality Group A, B, and C systems and components for the Unit's second forty month inspection period and the inservice testing of

(]) Quality Group A, B, and C pumps and valves for the Unit's third twenty month inspection period. A subsequent re-

' vision to 10CFR50.55a, effective Nov. 1, 1979 has extended the applicability of the current program in its entirety, to the expiration of the current ten year inspection l interval.

In accordance with Section 50.55a(g), the applicable ASME B& PV Code Section XI, Division I, edition and addenda

~

for the current inspection period and the subsequent in-spection periods up to the expiration of the current ten year inspection interval is the 1974 edition with addenda through summer 1975.

l

(~)

s.-

I

- e _ . _ _ . ~ ,_-.=s~. . _ . _ . s. .. _ . . . _ _ -m _.a

fs Indian Point Unit No. 2 was designed and constructed L) prior to the inception of the ASME B & PV Code Section XI. Consequently, some examinations are limited due  ;

to considerations of design, access or materials of construction. Radiation levels in certain areas or of certain components may also restrict the access to perform examinations or tests. In such instances, the examinations or tests are performed to the extent practical. Such specific limitaticns have been noted l within the program documents to the extent that they have been previously identified.

Details of the inservice inspection and testing pro-

, gram including requests for relief f rom those ASME B &

%) PV Code Section XI requirements which have been deter-mined to be impractical for tha facility are contained in the " Inservice Inspection and Testing Program -

Indian Point Nuclear Generating Unit No. 2" submitted to NRC by letter dated August 3, 1977 and supplement 1, 2 and 3 thereto submitted to NRC by letters dated

! September 22, 1977, October 25, 1977 and February 28, 1979 respectively.

p

. _ , 2

s 10CFR50.59 - Changes, Test and Experiments d

Response: All proposed changes , tests , and experiments are re-viewed to determine if the proposed change, test or experiment involves a change in the technical speci-fications incorporated in the license or an unre-viewed safety question.

No change in the facility as described in the safety analysis report, which involves a change in the tech-nical specifications incorporated in the license or an unreviewed safety question is made without prior Commission approval.

Adherence to the above requirements is assured through b administrative procedures which specify the depart-ments responsible for accomplishing such reviews, the methods of accomplishing such reviews, and the means for processing such reviews. In addition administra-tive controls applicable to the processing of modifi-cation documents provide assurance that modifications will not be performed if such a modification con-l stitutes an unreviewed safety question.

All safety evaluations pursuant to 10CFR50.59 receive j i

the review and concurrence of the Nuclear Facilities  !

i Safety Committee. l

()

l

Records of changes in the facility and of changes in

) the procedures made pursuant to 10CFR50,59, to the extent that such changes constitute changes in the facility or changes in the procedures, as described in the safety analysis report are maintained. Records of tests and experiments are also maintained. These records include a written safety evaluation which pro-vides the basis for the determination that the change, test or experiment does not involve an unreviewed safety question. A report, containing a brief de-scription of such changes, tests, and experiments, in-cluding a summary of tae safety evaluation of each is submitted annually to the appropriate NRC offices. The

) records of changes in the facility will be maintained until the date of termination of the licensee. Records

.of changes in procedures and records of tests and exper-iments shall be maintained for a period of five years.

An application for amendment to the license is made whenever it becomes necessary to (1) change the tech-nical specifications or (2) m'ake a change in the faci-lity or the procedures described in the safety anal.ysis report or to conduct tests or experiments not described in the safety analysis report, which involve an unre-viewed safety question or a change in the technical

. specifications.

l

l l

l l

.. 10CFR50.70 - Inspections Response: Appropriate office space for the exclusive use of Commission inspection personnel has been provided.

l Inmmediate unfettered access, equivalent to access provided regular plant employees , following proper - I 1

identification and compliance with applicable access control measures for security, radiological pt:otec-tion 'and personal safety is af forded any NRC resident or other inspectors identified by the Regional Director i

as likely to inspect the facility.

4 O

+

4 J

lo 1

i i

L.

p- -& % _ f- w - -- -

. . _ _ _ _ 2- -

"- - ~D

10CFR50.71 - Maintenance of Records, Making of Reports Y<~y Sec.50.71. Maintenance of records, making of reports.

(a) Each licensee and each holder of a construction .

permit shall maintain such records and make such reports, in connection with the licensed activity, as may be required by the conditions of the license or permit or by the rules, regulations, and orders of the Ccmmission in effectuating the purposes of 1

the Act, including section 105 of the Act.

I i

(c) Records which are required by the regulations in this I

)

part, by license condition, or by technical specifica-es tion, shall be maintained for the period specified by

(> the appropriate regulation, license condition, or technical specification. If a retention period is not otherwise specified, such records shall be maintained until the Commission authorizes their disposition.

(d) (1) Records which must be maintained pursuant to this part may be the original or a reproduced copy or microform if such reproduced copy or microform is duly authenticated by authorized personnel and l the microform is capable of producing a clear and ,

i legible copy af ter storage for the period specified  !

by Commission regulations.

I O

_ ,_ (2) If there is a conflict between the Commission's V' regulations in this part, license condition, or technical specification, or othar written Com-mission approval or authorization pertaining to the retention period for the same type of record, the retention period specified in the regulations  ;

in this part for such records shall apply unless the Commission, pursuant to S50.12, has granted a specific exemption from the record retention j 1

requirements specified in the regulations in this l

part. ,

(e) Each person licensed to operate a nuclear power reactor pursuant to the provisions of 50.21 and. 50.22 shall up-

' date periodically, as provided in paragraph (e3) and (e4) of this section, the final safety analysis report (FSAR) originally submitted as part of the application for the operating license. . .

o "(a) Each licensee. . . shall maintain such records and make such reports, in connection with licensed activity, as may be required by the conditions of the licensee. . . or by the rules, regulations and orders of the Commission in ef fectu-ating the purposes of the Act, including section 105 of the Act."

l l

4 us  !

l l

i 1

- '% W  %. _ . _, - ,-- - --

,_3_ . , z yn _ - -_ D

l i

I

-3 f Response: Con Edison's policy is to maintain documentary evi-V dence of the quality of items and activities affect-ing plant safety, consequently, a system for records preparation and retention, as necessary, has been established. This record system has been implemented by procedures established by the organizations parti-cipating in the quality assurance program. The pro-cedures prescribe the requirements and responsibilities for record maintenance and retention subsequent to completion of work, including that the records are filed and maintained to minimize deterioration and/

or damage and to prevent loss. Examples of organi-zations and records they maintain are:

i v

o NPG Quality Assurance maintains records which include inspection results, retest on work com -

pleted, certain personnel qualification records purchase orders, receipt inspection results and backup data, and deficiency reports, o Operations subsection maintains various operat-ing logs, o Test and Performance Engineer maintains test procedures and results. l (OA Program, Revised 6/3/77 - Par. 5.2.12, p.

_ 23 & 24)

-u y .

The reports made to the NRC by Con Edison are those specified in the Technical Specifications and are identified as follows:

o Routine Reports (Scheduled)

Monthly Operating Report Annual Radiation Exposure Reports o Routine Reports (Unscheduled):

Summary Report of Plant Startup and Power Escalation Reports of Defects and Nonconformances with Regulatory Requirements per Title

.10, Part 21, Code of Federal Regulations

(~)

v o Reportable Occurrences:

Safety Limit Violation Report. (Type requiring immediate notification of the event to the NRC with written followup in 10 days)

Reportable Occurrance Report. (Type requiring notification of event to the NRC within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> with written follow-up in 14 days)

Reportable Occurrence Report. (Type reguring written report to the NRC within (O

\J

y , , ,.

~- - - -. .-. . . - - ~ . - - .- -

(_) 30 days-'oftheevent.)-

o Special Reports:

Summarized reports of various tests and con-ditions as required by the Technical Speci-fications.

(IP Unit 2 Technical Specifications - sec. 6.9) o "(c) Records which are required by the regualations in this part, by license conditions, or by technical speci-fications, shall be maintained for the period specified by the appropriate regulation, license condition or tech-nical specifications."

() Response: The quality assurance program established for Indian Point Unit 2 conforms to the requirements of 10CFR 50, Appendix B, Criterion XVII, " Quality Assurance Records."

(QA' Program, Revised 6/3/77 - FOREWARD, p. i)

Certain records, e.g., Reportable Occurrence Reports, are retained for at least five years. (IP Unit 2 Technical Specifications - Par. 6.10.1), p. 6-20)

Other records, e.g. , records of facility radiation and contamination surveys, are retained for the dura-tion of the Facility Operating License. (IP Unit 2  !

Technical Specifications - Par. 6.10.2, p. 6-20 & 6-21)

}

1 s .s ._r.n...m-- " - - ^^^

^A

7 o "(c)... if a retention period is not otherwise specified, U such records shall be maintained until the Commission authorizes their disposal."

Response: Record retention period reflecting the requirements of 10CFR50, the IP Unit 2 Technical Specifications and other regulations are specified in appropriate quality assurance documents. (OA Program, Revised 6/3/77 -

FOREWORD, p.i; par. 5.2.12, p. 24 and Unit 2 Technical Specifications - Par. 6.10, p. 6 6-20 & 6-21) o "(d) (1) Records which must be maintained pursuant to this part may be the original or a reproduced copy or microfilm if such reproduced copy or microfilm is duly authenticated by authorized personnel and

(])

the microfilm is capable of producing a clear and i

legible copy af ter storage for the period specified by Commission regulations."

Response: Records maintained pursuant to 10CFR50 are either the original, a reproduced copy, microfilm or any com-bination of these prescribed in the appropriate quality assurance documents. (OA Program, Revised 6/3/77 -

FOREWORD, p. ii, Ref. 421.10) o "(d) ( 2 )- If there is a conflict between the Commission's regulations'in this part, license conditions, or

(~)

N)

L2 .-, , , _ _ _ -

- -.- =

technical specification, or other written Commis-sion approval or authorization pertaining to the retention period for the same type of record, the retention period specified in the regulation s in this part for such records shall apply unless the Commission, pursuant to Sec. 50.12, has granted a specific exemption from the record requirements specified in the regulations in this part."

t Response: The program descriptions for identification of records and their retention periods by Con Edison are given in foregoing responses to subparagraphs (c) and (d)(1).

L If any conflict would exist pertaining to the reten- l tion period of the same type of record in any of the I

() documents tha t impose such requirements on Con Edison, l

, the requirements of these documents shall prevail as modified by Table A of the QA Program, revised 6/3/77.

(In this case the conflict shall be resolved in the "same manner as that" where any discrepancies exist between... [ Con Edison's) . . . program description and the [ imposed] requirements..." as prescribed in the OA Program, Revised 6/3/77 - FOREWORD, p. ii, Ref.

! 4-21.9.) Currently there are no known conflicts pertaining to record retention periods, so Table A

contains no specific interpretation / alternate /excep-tion of requirements for such conflict occurrence.

,3 o "(e) Each person licensed to operate a nuclear power reactor pursuant to the provisions of 50.21 and 50.22 shall up-date periodically, as provided in paragraph (e3) and (e4) of this section, the final safety analysis report (FSAR) originally silbm.itted as part of the application for the operating license..."

Response: The Final Safety Analysis Report (FSAR) will be updated to assure that the information contained in the FSAR is the latest material developed. Included in this update will be all changt? made to the Facility or procedures as described in FSAR, Safety Evaluations performed, and Analyses performed on new safety issues, since the last

(]) -FSAR supplement.

The July 22, 1982 submittal will include all required copies, will be properly certified, and will be in the same format as was the original IP2-FSAR suhaittal.

This updated FSAR will be current to within six months of July 22, 1982.

Thereaf ter, revisions will be stibmitted annually and will reflect all changes up to six months prior to the filing date.

t

(')

s-I e _ - -

-- __ ._A

10CFR50.72 - Notification of significant events o "(a) . Each licensee of a nuclear power reactor licensed under S50.22 shall notify the NRC Operations Center as soon as possible and in all cases within one hour by telephone of the occurrence of any of:the following significant events and shall identify that event as being reported pursuant to this section ..."

i Response: Compliance with the reporting requirements of 10CFR50.72

' ~

is implemented in accordance with Station Administrative Order (SAO) No.124, Revision 7, dated May 11, 1980 i

entitled " Reporting of Anomolot.u Conditions."

t

Jo.

t.

l l

9

l I

, f i

1

^

_ _ , -- - w , .

..A

a-m - , --mA-6 ..A a a u-. --. a a m- a m I

1 J  !

s

!O l l 1

i l

l

. \

f i

1 h

i l

l 7

APPENDIX A -- GENERAL DESIGN CRITERIA FOR 1 NUCLEAR POWER PLANTS l

!O 1

i i

1 1~

I I

e l

.f I

1 I

t

.) -

.i J

N

-o, O

)

f l

a 1

1 0 I

J l

l l

T

(

l 1

I I

I I

I l

3 i

?

?

4

' I. Overall Requirements i

s O

1 1

l i

i s

(

i 4

i t

t k

3 I

E I

I I }

T l l l

l l

t I

. , . - - - = -

Criterion 1 - Quality Standards-and Records. Structures,

-(") systems and components important to safety shall be de-s_

signed, fabricated, erected, and tested to quality stan-dards commensurate with the importance of the safety functions to be performed. Where generally recognized

~

codes and standards are used they shall be identified and evaluated to determine their applicability, adequacy and suf ficiency and shall be supplemented or modified as necessary_ to assure a quality product in keeping with tSe required safety function. A quality assurance program shall be established and implemented in ordet to provide adequate assurance that'these structures, systems and components will satisfactorily perform their safety f unc-tions. Appropriate records of the design, fabrication, 4

O erection, and testing of structures, systems and compo-nents important to safety shall be maintained by or ander the control of .the nuclear power licensee throughout the life of-the unit.

i o " Structures, systems and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the 1

-safety. f unctions to be performed. "

Response: Structures, systems and components of the nuclear power plant important to safety are designed, fabri-cated, erected and tested to quality requirements, standards and guidelines commensurate with their

{';

u

importance to safety. These requirements, standards e

ImJ and guidelines form the basis of the " Quality Assur-ance Program, Revised June 3, 1977" (hereinafter "QA Program") and are referenced therein. In an evalua-tion of the QA Program, provided by letter, NRC-(Reid) to Con Edison (Cahill) , dated August 5,1977, NRC found the program in compliance with Appendix B to 10CFR50 and the appropriate supplemental guidance.

The structures, systems and components addressed by the QA Program are those items of the nuclear plant that could prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. These items

{) have been designated as Con Edison Class " A" and are identified in the QA Program.

i For Class "A" items, the QA Program provides controls of activities affect-ing safety and their operation consistent with their importance to safety. (QA Program - Foreword, p. i

& 11; Par. 3.1, p. 1; Appendix A, p.2) o- "Where generally recognized codes and standards are used, they shall be identified and evaluated to determine their applicability, adequacy and sufficiency and shall be supplemented or modified as necessary to assure a quality product-in keeping with the required safety function."

O v

i l'

l

- 3 ;-

Response: Design' activities related to modification of Class

(~)/

"A" items of the nuclear power plant are performed in accordance with a documented control system requiring that where generally recognized codes and standards are used, they be identified and their applicability, adequacy and suf ficiency considered. In determining

?

ff ev the applicability, adequacy and suf ficiency of recog '

l . t l

nized codes and standards, consideration is given to

/

plant design characteristics such as:

j #

o Design Conditions - pressure, temperaturd, -

humidity, voltage, seismic, etc.

o Functional and physical interfaces of equf.p-ment.

'(~ .

o Applicable operation, maintenance and testing l requirements.

l l o Material requirements.

1 o Safety requirements and evaluation.

o Performance characteristics.

l l o Compatibility of materials with each other and the environment.

o Control of radiation exposure. l l

o Provisions for handling, storage, cleaning l

i i

and shipping.

o Design analysis results.

l 1

o Integration of modification design with r

kxJ criginal plant design.

o Welding requirements.

(QA Program - Par. 5. 2. 7, p. 14 and Par. 5.2.7.2,

p. 17, 18 and 19)

Other recognized standards provide programmatic con-trols (requirements, standards and guidelines) for quality assurance applications. These controls were evaluated to determine their applicability, adequacy and sufficiency in relationship to requirements of 10 CFR 50, Appendix B and were incorporated into the program as applicable. Thus the QA Program conforms with the requirements of 10 CFR 50, Appendix B and (G/ with the requirements, standards and guidelines for controls given in additional documents cited in the QA Program with certain changes to provisions of i the documents as given in Tables A and B therein.

Changes were necessary for proper application to the operations phase of nuclear plants because the pajor-ity of the documerts addressed or.ly the design and construction phases. The QA Program also contains developed provisions for certain operations phase conditions not addressed in the additional documents.

The implemented. total program provides adequate assurance that the nuclear plant will conform with safety requirements.

m

(QA Program - Foreward, p. i & 11; Table A, p. A-1...

A-27; Table B, p. 8.2.. 8.6) o "A quality assurance program shall be established and implemented in order to provide adequate assurance that these structures, systems, and components will satisfac-torily perform their safety function."

Response 4 To ensure that Class "A" items will satisfactorily perform their safety function, Con Edison has estab-lished a quality assurance progran as implemented by the provisions of the " Quality Assurance Program, revised June 3, 1977", with requirements, standards and guidelines cited therein. The quality assurance

{} program for the nuclear plant has been implemented and is being maintained through corporate instructions, administrative orders and station procedures developed by participating organizations. These documents com-prising the implemented quality assurance program are identified in a summary document that is maintained current.

(OA Program - Foreward, p. i& ii; Par. 3.1, p. 1; Par. 5.1, p. 9; Par. 5.2.15, p. 34; Table A,

p. A-1... A-27; Table B, p. B-1...B-6) o " Appropriate records of the design, f abrication, erection and testing of structures and components important to i

\

,, safety shall be maintained by or under the control of the nuclear power licensee throughout the life of the unit."

Response: Con EdicO ' policy is to maintain documentary evi-dence of the quality of items and activities affect-ing plant safety; consequently, a system for records preparation and retention, as necessary, has been established. These records include design documents, inspection results, test procedures and results, retest on completed work, certain personnel qualifi-cation records, purchase orders, receipt inspection results and back-up data, deficiency reports, oper-ating logs, and others. Documented procedures estab-lish the. responsibilities and requirements for record O'

's maintenance and retention subsequent to the comple-l tion of work. The records are filed and maintained I to minimize deterioration and damage and to prevent i l

loss. These procedures assure that, where appropri- l l

ate, records are retained for the life of the plant.

(OA Program - Par. 3.1, p. 1.; Par. 5.2.7.2, p. 17; Par. 5.2,12, p. 23 & 24)

\

Y j i

Criterion 2 - Design bases for protection against natural

() phenomena. Structures, systems and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurri-1 canes, floods, tsunami, and seiches without loss of capa- I bility to perform their safety functions. The design bases for these structures, systems, and components shall reflect: (1) Appropriate consideration of the most severe l of the natural phenomena that have been historically re-ported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated, (2) appropriate combinations of the effects of normal and accident conditions with the effects of the natural phenomena and (3) the importance of the safety functions to be performed.

o " Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes floods, tsunami, and seiches with'out loss of capability to perform their safety f unctons."

i Response: Structures, systems and components including instru-ments and controls vital to safe shutdown and isolation of the reactor or whose failure might cauce or increase the severity of a loss-of-coolant accident or result

~

in an uncontrolled release of excessive amounts of radioactivity are designated Class I (FSAR, Appendix l- A, p. A-2). A more detailed elaboration of this criteria is contained in Question 1.2 of the IP-2 FSAR.

, All systems and components desig.ated Class I are designed so that there is no loss of function in the event of the maximum potential cround acceleration i acting in the horizontal and vertical directions simultaneously. (FSAR p. 1.3-2)

In addition, the Atomic Safety and Licensing Appeal Board appointed to review the seismology and geology around the Indian Point site concluded that the plant

() design need only be adequate to withstand an Intensity VII earthquake and that a value of 0.15g was appro-priately assigned to the maximum vibratory ground motion (acceleration) which might result from such an earthquake.

The containment has been analyzed and shown capable of sustaining tornado effects. Details of this evaluation are provided in Appendix B of the Containment Design Report (FSAR-Volume 6).

A discussion of the as-built tornado resistance of other Class I structures is contained in Question 1.11 l

_ of the IP-2 FSAR. Reinforced concrete portions of both d

mY - _ _ ._ ,-

{} the primary auxiliary building and intake structure are shown capable of sustaining winds in the range of 300 miles per hour. The spent fuel pit, also a reinforced concrete Class I structure, is capable of sustaining similar ' wind loads. Soperstructures of various Class I buildings are constructed of structural

' steel with composite metal panel siding which are esti-mated to be capable of sustaining wind loads of a magnitude approximately 50 percent of those speSAfied for the reinforced concrete structures. Protection from high winds is somewhat afforded by the physical characteristics of the site and surrounding terrain including the 500 foot high Palisades on the west

() bank of the Hudson river and the structures of the other two units at the site. In addition, most safety-related systems are protected by enclosure within Class I structures or by redundancy from the effcci of tornadoes or tornado missiles.

The tornado protection inherent in the plant design will afford protection from the high winds associated with a hurricane. High tides of ten coincident with j i

hurricanes as a cause of flooding have been evaluated as discussed below. ,

i The effects of flooding have been extensively studied.

-) The results of these studies are summarized in Section l 3 j l

l

(")

v 2.5 of the IP-2 FSAR along with a 1970 report of Lawler, Matusky and Skelly (formerly Quirk, Lawler and Matusky), consultants, commissioned to make an in depth study of the Hudson River under various flooding conditions. The results of this and other studies indicate that the potential for flooding damage at the site appears to be extremely remote, the maximum water elevation due to flooding is below the critical elevation that would cause seepage into the lowest floor elevation of any of the Indian Point buildings and therefore no special flood protection is required.

The acceptability of flooding evaluations performed for Indian Point is documented in the commission's

(~>S

\- Safety Evaluation Report for IP-2 (pg-ll).

Tsunami and seiches are not specifically identified in the flooding studies noted above which considered historical data for the prior 150 years. Accordingly, the effects of these phenomena, if any, are considered to fall within the maximum water level identified under flood conditions.

In its Safety Evaluation Report for Indian Point #2 (pgs. 30-31), dated November 16, 1970, the Commission has concluded that the environmental conditions con-sidered in the plant structural design were used in rm3 an acceptable manner.

V

(~l v o "The design bases for these structures, systems and com-ponents reflect: (1) Appropriate consideration of the l

most severe of the natural phenomena that have been '

historically reported for the site and surrounding area, with sufficient margin for the limited accuracy, quantity, and period of time in which the historical data have been accumulated."

Response: A discussion of the site and environemental studies performed to characterize and quantify the design bases is contained in Section 2 of the IP-2 FSAR:

Geology /Semismology, As noted,above, structures, systems, and components p> important to safety are designated Class I and designed so there is no loss of function in the event of the maximum potential ground acceleration acting in the horizontal and vertical directions simulta-

! neously.

The following ground acceler.ations have been specified as the design basis; Design Earthquake or - 0.05g vertical Operating Basis Earth- 0.109 horizontal 4

quake Design Basis or Safe - 0.10g vertical i

Shutdown Earthquake - 0.159 horizontal em

In establishing these values, the seismological his-

{ tory and geology of the site were considered. Sub-sequently, Appendix A to 10CFR100 was issued estab-lishing the seismic and geologic criteria for siting a nuclear power plant. Accordingly, these values were reevaluated based on the requirements of Appendix A. Extensive geologic and seismologic studies were per-formed and a seismic monitoring network was established. < These studies and the data from the seismic network confirmed the original seismic design basis for the site. Furthermore, the appropriatencss of these design bases was adjudicated before the Nuclear [} Regulatory Commission's Atomic and Safety Licensing Appeal Board during 35 days of public hearings. The Appeal Board's decision ( ALAB 436) supported the

seismic design basis for the plant in all instances.  ;

Meteorology / Hydrology

     .The meteorology of the Indian Point site has been thoroughly studied by two years of observations at 1

the site itself and surrounding locations. Severe weather climatology has been studied in detail and 1 reported (Con Edison, Environmental Report, Indian j Point Unit No. 1, Section 4.4). This meteorological program and the precipitation information gathered r3 by the National Weather Records Center from the nearby

 \-)

f'x Bear Mountain Weather Station, constitute the solid O basis upon which the safety analysis of the Loss-of-Coolant Accident has been made.

        "The atmospheric dispersion factors required for the safety analysis of Section 14 have been computed for the worst possible meteorological conditions which could prevail at the Indian Point site."

(FSAR Sec. 2.6.2) The effects of meteorological characteristics (e.g. wind velocity, snow loads, etc. ) on the structural design of plant structures are based upon nationally recognized codes, standards and technical papers () and in addition are consistent with currently accepted regulatory criteria concerning characteristics of tornadoes for the eastern United States. Reports detailing the studies performed to establish maximum flood water elevations at the site are pro-vided in Section 2.5 of the IP-2 FSAR and Questions 2.1 and 2.2 thereto. The information presented has as its basis the available historical data for the site and surrounding terrain. The probable maximun hurricane determines the maximum flood levels for Indian Point. The maximum probable r- hurricane for the area has been defined by the United

, _ N.

t

                                                                       )
                                                                           \

States Weather Service from historical data, charac-(]) teristics of which are presented in Appendix A to the flooding evaluation report prepared by Lawler, Matusky l and Skelly in 1970 (refer to Section 2.5 of the IP-2 FSAR and the IP-1 Environmental Report) , From that data and the discussion of as-built plant tornado protection in Question 1.1 of the IP-2 FSAR and pre-viously, it can be concluded that Indian Point Unit

              #2 is adequately protected from the high winds asso-ciated with hurricanes. Also as previously discussed, the lowest elevation of the plant is above the maximum water elevation anticipated as a result of any flood-ing condi.tions.

\~) o "... The design bases for these structures, systems, and components shall reflect (2) appropriate combinations of the effects of normal and accident conditons with the , effects of the natural phenomena..." Response: The design bases of IP-2 structures, systems and components important to safe't y (Clas s I) reflect appropriate combinations of the effects of normal conditions with the effects of natural phenomena. As mentioned previously, all such items important to safety are designated Class I and designed so that t there. is no loss of function in the event of the {) maximum potential ground acceleratiirn acting in the

horizontal and vertical directions simultaneously. {} Similarly the analysis of tornado effects demon-strates that the facility can sustain such phenomena. The design of the containment considers corabined effects o'. accident conditions coincident with natural phenomona. A summary of the loading criteria utilized is provided in the Containment Design Report (FSAR Volume 6 - Tab IV). The containment is shown capable of sustaining the following loading conditons;

1) loading at least 50 percent greater than those calculated for the postulated loss-of-coolant accident alone.

O

2) loading at least 25 percent greater than those calculated for the design basis acci-dent with a coincident operational basis ,

earthquake.

3) loads at least equal to those calculated for the design basis accident coincident with a design basis earthquake.

In addition, an analysis of the IP-3 Reactor Coolant ! System which is identical to IP-2 has been performed considering the combination loading of Design Basis Earthquake and Design Basis Accident. A discussion ("/T

 ,_   of the analysis, demonstrating the ability of the

system to sustain such load combinations is contained ({} in Question 1.9 (Fg. Q.l.9-15) of the IP-2 FSAR. Similarly the reactor coolant system supports were re-analyzed to determine their ab511ty to withstand combined deadweight, seismic and blowdown loads. A summary of that analysis is provided in Question 1.5 (Pg. Q1.5-1) of the IP-2 FSAR. An analytical study of the behavior of the reactor internals under simultaneous blowdown and seismic loadings has also been performed. The results of the study (WCAP-7302-L) indicate that for the com-bined blowdown and design basis earthquake loadings, (~N the resulting deflections are acceptable. The

 .O acceptability of this analysis is evidenced in the Commission's Safety Evaluation Report for Indian Point #2 (Pgs. 20-21), dated November 16, 1970.

The reactor coolant system and it's supports are completely enclosed within the containment and as such the combination of seismic and blowdown loads is the only load combination requiring appropriate consideration, the containment building being in-herently resistant to other natural phenomona. o "... The design bases for these structures, systems and components shall reflect: (3) the importance of the safety

  % . functions to be performed..."

u

Structures, systems and components important to safety are Or^ designated Seismic Class I, II or III commensurate with the safety function to be performed. The following criteria provide the basis for deteraining the classification of particular structures, systems and components; Class I Those structures and components including instruments and controls whose failure might cause or increase the severity of a loss-of-coolant accident or result in an uncontrolled release of excessive amounts of radioactivity. Also, those structures an components vital to safe shutdown and isola-tion of the reactor. ( Class II P Those structures and components which are important to reactor operation but not essential to safe shutdown and isolation of the reactor and whose f ailure could not result in the release of substantial amounts of radio-activity. Class III Those structures and components which are not directly related to reactor operation or containment. A more detailed elaboration of this criteria is contained in Question 1.2 of the IP-2 FSAR. Classification of parti-

  -)

x_/ cular structures and equipment is provided in Appendix A of the IP-2 FSAR and f urther elaborated in Question 1.2 as well.

Criterion 3 - Fire protection. Structurcs, systems, and (]) components important to safety shall be designed and located to minimize, consistent with other safety require-ments, the probability and ef fect of fires and explosions. Noncombustible and heat resistant materials shall be used wherever practical throughout the unit, particularly in

           . locations such as the containment and control room. Fire detection and fighting systems of appropriate capacity and capability shall be provided and designed to minimize the advetse ef fects of fires on structures, systems, and com-ponents important to safety.      Fire-fighting systems shall be designed to assure that their rupture or inadvertent operation does not significantly impair the safety capa-bility of these structures, systems, and components.

O Response: Following the 1975 fire at Browns Ferry the Nuclear Regulatory Commission issued now guidelines for fire protection in nuclear power plants. These guidelines were presented in Standard Review Plan 9.5-1 dated May 1, 1976 and Branch Technical Posi-tion APCSB 9.5-1 Appendix A (for plants docketed prior to July 1, 1976) dated August 23, 1976. By letter dated May 11, 1976, the Commission re-quested Con Edison to compare the existing fire protection provisions at Indian Point Unit 2 with the above noted guidelines and to:

a) Describe the implementation of guidelines s fy met. b) Describe modifications or changes under-way or proposed for implementation to meet the guidelines. c) Describe the guidelines that will not - be met and the basis therefore. 4 The response to the Commission's request was provided in Con Edison's submittal entitled "Reviee of the Indian Point Station Fire Protection Program - Rev. 1" dated April 1977. The N.R.C. review of the program, including a field inspection by a fire protection re-view team, resulted in additional commitments and (],') proposed modifications by Con Edison. The total acceptability of the final fire protection plan in meeting the guidelines was noted by the l 1 N.R.C. In the " Fire Protection Safety Evaluation j Report by the Of fice of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission in the Matter of Consolidated Edison Company Indian Point Unit Mc. 2 Plant Docket No. 50-247", dated January 31, 1979, which was issued by the N.R.C. without any open or non-conforming items. l (~s)

   ~

1 l l L_-

Criterion 4 - Environmental and missile design bases. () Structures, systems, and components important to safety shall be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postu-lated accidents, including loss-of-coolant accidents. These structures, systems, and components shall be appro-priately protected against dynamic effects, including the effects of missiles, pipe whipping, and discharging fluids, that may result from equipment failures and from events and conditions outside the nuclear power unit. o " Structures, systems, and components important to safety shall be designed to accommodate the effects of and to be () compatible with the environmental conditions associated with normal operation, maintenance, teshing, and postu-lated accidents, including loss-of-coolant accidents. Response: Environmental conditions associated with normal oper-ation, maintenance, testing, and postulated accidents-including loss of coolant accidents are considered in the design of structures, systems and components im-portant to safety. . A discussion of the loading combinations and stress limits considered for the containment structure is contained in the " Containment Design Report" FSAR, 4 Volume 6. i I

Similarly, a discussion of the loading combinations () and stress limits applicable to the piping, vessels and supports comprising the Reactor Coolant and associated systems is contained in the " Design Criteria for Structures and Equipnent" FSAR, Appen-dix A. The environmental parameters associated with normal operation, maintenance, testing and postulated accidents are identified and incorporated in the design. Equipment within cont ainment, required to be operable during and subsequent to a loss-of-coolant or a steam-line-break accident have been identified and the environmental conditions to which () this equipment could be subjected quantified. The ability of this equipment to sustain these extreme environmental conditions has been evaluated. A discussion of the environmental qualification of this equipment is contained in Question 7.8 to the PSAR and more recently in the " Electric Equipment Qualification Report" submitted to NRC by letter dated May 9, 1980. o "These structures, systems, and components shall be appro-priately protected against dynamic effects, including the effects of. missiles, pipe whipping, and discharging

e fluids, that may result from equipment failures and from o-events and conditions outside the nuclear power unit." Response: A loss-of-coolant accident or other equipment failure might result in dynamic effects or missiles. For engineered safety features which are required to ensure safety in the event of such an accident or equipment failure, protection is provided primarily by the provisions which are taken in the design to prevent the generation of missiles. In addition, protection is also provided by the layout of plant  ; equipment or by missile barriers in certain cases. (FSAR p. 6.1-4) () Injection paths leading to unbroken reactor coolant loops are protected against damage as a result of the maximum reactor coolant pipe rupture by layout and structural design considerations. Injection lines penetrate the main missile barrier, which is the crane wall, and the injection headers are located in the missile-protected area between the crane wall and the containment wall. Individual injection lir _a, connected to the injection header, pass through the barrier and then connect to the loops, Separation of the individual injection lines is pro-vided to the maximum extent practicable. Movement of the injection line, associated with rupture of a (a's l m.

reactor coolant loop, is accommodated by' line flexi-bility and by the design of the pipe supports such that no damage outside the missile barrier is pos-sible. (FSAR p. 6.1-4) The containment structure is capable of withstanding the effects of missiles originating outside the con-tainment and which might be directed toward it so that no loss-of-coolant accident can result. (FSAR p. 6.1-4) The dynamic effects during blowdown following a loss-of-coolant accident are evaluated in the detailed layout and design of the high pressure equipment and (]) barriers which afford missile protection. Support structures are designed with consideration given to fluid and mechanical thrust loadings. (FSAR P. 4.1-4) The steam generators are supported, guided and re-strained in a manner which prevents rupture of the steam side of a generator, the steam lines and the feedwater piping as a result of forces created by a Reactor Coolant System pipe rupture. These supports, guides and restraints also prevent rupture of the primary side of a steam generator as a result of forces created by a steam or feedwater line rupture. (])- (FSAR p. 4.1-4).

                               ,e,q   All hangers, stops and anchors are designed in accor-V dance with ANSI B31.1 Code for Pressure Piping and ACI 318 Building Code Requirements for Reinforced Concrete which provide minimum requirements on mate-rial, design and fabrication with ample safety mar-gins for both dead and dynamic loads over the life of the equipment.    (FSAR p. 6.1-5)

Reactor coolant pump flywheels, as a source high energy missiles, have been the subject of consider-able study. Information relating to this concern is contained in Question 4.2 to the FSAR and the JCAE l testimony on pages 1082-1086 and 1136-1138 of the document entitled " Investigation of Charges Relating to Nuclear Reactor Safety-Hearings before the Joint Committee on Atomic Energy, Congress of the United States. The effect of turbine missiles has been evaluated in a _ report entitled " Likelihood and Consequences of Turbine Overspeed at the Indian Point Nuclear Generating Unit No. 2", contained in Appendix 14A of the FSAR. The effects-of pipe break, pipe whipping and jet impingement have been considered in the design. A discuacion of these considerations is contained in

                                                    \          . . . . .

I con Edison Reporty " Analysis of High Energy Lines" dated April 9, 1973, Docket No. 50-247. The areas

investigated in this report were

Turbine Building, Control Building, Primary Auxiliary Building, Diesel

{ Generator Building and Fuel Storage Building. 4 4 4 4 4 i O 't i 4 a ip 4 n

                               +

i l l l- ' ! . . , .... = ,- , ., . . . . . - , - _ _ . . . . - . _ . _ . . . , . . . . _ _ _ _ - - . . - ..- __ .~ _ _~_ _ _. -- .

Criterion 5 - Sharing of structures, systems and compo-

  )       nents. Structures, systems, and components important to safety shall not be shared between nuclear power units unless it is shown that their ability to perform their safety functions, including, in the event of an accident in one unit, an orderly shutdown and cooldown of the remaining units.

l Response: Structures, systems, and components important to safety that are shared among the operating units at the site are as follows: a) Cooling water discharge channel b) Backup fuel oil storage tank for the emergency diesel generators () c) Fire protection systems The cooling water discharge channel carries the ser-vice water discharge to the river. Since the channel , is designed to handle the discharge flow from both operating units, sharing of this structure will not impair the ability of safety systems in either of the nuclear units to perform their design safety function. Each nuclear unit is provided with its own on-site emergency diesel fuel oil storage capacity for short term' operation. cx

7- Technical specification limits for Unit No. 2 require that 22,000 gallons of fuel oil be maintained available as backup, in addition to the normal on-site inventory. Similarly, technical specification limits for Unit No. 3 require 26,300 gallons of f uel oil. This backup fuel oil storage capacity for long term operation can be provided from a 200,000 gallon capacity fuel oil storage tank, common to both unit, located at Buchanan substation. Fuel oil from this back up storage tank is transported by truck to either nuclear unit. Administrative procedures provide assurance that the minimum required fuel oil inventory is maintained and therefore sharing of this tank will in no way impair (]) the ability of the diesel generators in either unit from fulfilling their safety function. Additional fuel oil can be provided from several other local supplies. The existing fire protection system is common to Units 2 and 3, however a separate system, now under construction and dedicated to Unit No. 3 will result in the existing system serving Unit No. 2 alone. In addition the present Unit No. 2 fire protection system is being upgraded to meet current fire protection guidelines. (Refer to the response to General Design Criterion 3.) O

i t In addition to the shared items described above, both the three gas turbine generators and the city water t supply system are common to both nuclear units. These i 1 systems. serve as backup to other independent safety . i

systems. ' i i 1

e i

                                      ~

lO i I 4 l l l 1 O L_-

    ;

l i 1 . l \@ i i 6 i 4 i k i i J , 1 f t i l 1 II. Protection by Multiple Fission Product Barriers 1 4 I 4 1 4 i I q I i h G f l _ - - . ~ . _ . _ . - - - - - - - . = - - - - - . . . - - _ _ _ , ._..~,_m. - , , - .- . _ ._ ._ , - - _ - . . - .- - - - -_- -- ---- ~,..,.,

_=_____x: Criterion 10 Reactor Design - The reactor core and (])- associated coolant, control and protection systems shall be designed with appropriate margin to assure that speci-fled acceptable fuel design limits are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences. Response: The reactor core, with its related control and pro-tection system, is designed to function throughout its design lifetime without exceeding acceptable fuel damage limits. The core design, together with reliable process and decay heat removal systems, provides for this capability under all expected conditions of normal operation with appropriate mar-(V't gins for uncertainties and anticipated transients. ( FSAR p. 3.1.2-1) The Reactor Control and Protection System is designed to actuate a reactor trip for any combination of plant conditions, when necessary, to ensure a minimum Departure from Nucleate Boiling Ratio (DNBR) equal to or greater than 1.30. ( FSAR p. 3.1.2-1) The integrity of fuel cladding is ensured by prevent-ing excessive fuel swelling, excessive clad heating,  ; l excessive cladding stress and strain. This is achieved by designing the fuel rods so that the fol-('%~ , kl lowing conservative design limits are not exceeded i l l l I

                . _ ~ . . .    .- -    ._   .   ,, . , _ . . . _ ~ _ . _ _ . . .~.

o ,_] during normal operation or any anticipated transients (FSAR 3.1.2-2): a) Minimum DNBR equal to greater than 1.30. b) Fuel Center temperature below melting point of UO ' 2 These are ensured by maintaining hot channel f actors N T ( F,g H and Fg ) during plant operation within Technical Specification limits. The ability of fuel designed and operated to these criteria to withstand postulated normal and abnormal service conditions is shown by analyses submitted in O' support of NRC licensing basis for Indian Point Unit

2. These inlcude FSAR (Chapter 14), fuel densifica- '

tion reports, reload safety evaluation reports and other documents provided to NRC to meet licensing basis requirements.

                . - - ~ ~ . - - -,ac.- . ._ u . __ _. .      . .                , .

4 (_) u Criterion 11 - Reactor inherent protection. The reactor core and associated coolant systems shall be designed so that in the power operating range the net effect of the prompt inherent nuclear feedback characteristics tends to compensate for a rapid increase in reactivity. Response : The reactor core and associated coolant systems are designed so that in the power operating range the net ef fect of the prompt inherent nuclear feedback char-acteristics tends to compensate for a rapid increase in reactivity. The reactor core is designed with negative Doppler coefficient and operated with negative moderator temperature coefficient as required by the unit's Technical Specifications. Core power coef ficients (Doppler and moderator temperature) are verified during cycle start up tests, thus assuring that prompt negative nuclear feedback is available to compensate for a rapid rise in reactivity in the power operating range. /~'T U

_,m. = ~ . .m m..... ._ _,m ,

                                                             ,c        _  . _ _ . .

() Criterion 12 - Suppression of reactor power oscillations. The reactor core and associated coolant, control, and pro-tection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified acceptable fuel design limits are not possible or can be reliably and readily detected and suppressed. Response: During start up tests it was demonstrated that axial power changes due to axial xenon oscillations can be successfully controlled using full length control rods. The core is stable with respect to axial xenon oscilla-tions, when the plant is operated with the Constant Offset Axial Control (COAC) strategy. Load follow () tests carried out as part of the start up test program on Indian Point Unit No. 2 demonstrated that the core is stable with respect to axial xenon oscillations and that these oscillations can be controlled using boron shim and full length control rods. The COAC strategy ensures that specified hot channel factors (F g T vs core height and F NH ) are not exceeded during plant operation. Tests have also demonstrated that the core is stable with respect to X-Y xenon oscilla-tions. Out-of-core instrumentation is provided to obtain necessary information concerning power distribution. (m () This instrumentation together with the axial flux tilt monitor provides fer adequate detection and

       .. ---u-   -
                      ~x.,,_, .: . ._; _;._.

_,_ , . , _ , . __ ~.- .. _ .- =... 2 -- O subsequent control of xenon induced oscillations. Out of core instrumentation is calibrated using in-core instrumentation on a periodic basis. e, O

_ _ _ _ _ _ _ _, _ _,_ . ,_ _ , _ _; a - (). Criterion 13 - Instrumentation and conto 1. Instrumenta-tion and control shall be provided to monitor variables and systems over their anticipated ranges for normal operation, for anticipated operational occurrences, and for accident conditions as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactor core, the reactor coolant pressure boundary, and the con-tainment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges. Response: Instrumentation and controls essential to avoid undue , ([) risk to the health and safety of the public are pro-vided to monitor and maintain neutron flux, primary coolant pressure, flow rate, temperature, and control rod positions within prescribed operating ranges. In addition, systems to provide information with i respect to reactor coolant margin to subcooling and position of pressurizer relief valves have been I provided in accordance with NRC's " Lessons Learned t Requirements" of January 1, 1980. The non-nuclear regulating process and containment l instrumentation measures temperatures, pressures, ) flows, and levels in the Reactor Coolant System, Steam (~) v- Systems, Containment and other Auxiliary Systems. Process variables required on a continuous basis for l

p). s- the startup, power operation, and shutdown of the plant are controlled and indicated or recorded from the control room, access to which is supervised. The quantity and types of process instrumentation provided ensures safe and orderly operation of all systems and processes over the full operation range of the plant. (FSAR, p. 7.1-1,2) In accordance with NUREG-0578, additional instrumen-tation will be installed to monitor the containment atmosphere following an accident, for hydrogen and oxygen concentration and gross gamma radioactivity levels. In addition, the capability will be provided () to sample and analyze reactor coolant to determine isotopic inventory and composition (which can provide an assessment of the degree of core damage) as well as chemical concentrations (e.g. boron, chlorides, dissolved gases). l l l l l l r n v

__ _- __ - - . _ _ _ _ m.m m m _ m _ _ _ a ., , _ c.. . - ;;_,_ :._------ () p. Criterion 14 - Reactor coolant pressure boundary. The reactor coolant pressure boundary shall be designed, fabricated, erected and tested so as to have an extremely low probability of abnormal leakage, of rapidly propa-gating failure, and of gross rupture. Response: The Reactor Coolant System in conjunction with its control and protective provisions is designed in ac-cordance with the applicable codes to accommodate the system pressures and temperatures attained under all expected modes of plant operation or anticipated sys-tem interactions, and maintain the stresses within applicable code stress limits. (F.S.A.R. p. 4.1-5) System conditions resulting from anticipated tran-sients or malfunctions are monitored and appropriate action is automaticall'y initiated to maintain the re-quired cooling capability and to limit system condi-tions so that continued safe operation is possible. The system is protected from overpressure by means of pressure relieving devices, as required by the applicable edition of Section III of the ASME Boiler and Pressure Vessel Code. Isolable sections of the system are provided with overpressure relieving devices l discharging to closed systems such that the system i code allowable pressure within the protected section () is not exceeded. (F.S.A.R. p. 4.1-6)

_ _ _ . - - - . ~ ._ . -_ . ._ ._ _ g-)

 \ 

The mechanical consequences of a pipe rupture are restricted by design such that the functional capa-bility of the engineered safety features is not impaired. (F.S.A.R. p. 4.1-5) Fabrication of the components which constitute the pressure retaining boundary of the Reactor Coolant System in also carried out in strict accordance with the applicable codes. In additics, there are areau where equipment specifications for Reactor Coolant System components go beyond the applicable codes. (F.S.A.R. p. 4.1-5) Details are given in F.S. A.R. Section 4.5.1. Quality standards of material selectica, design, fabrication and inspection conform to t'.e applicable provisions of recognized codes and good nuclear practice. Details of the construction stage quality assurance programs, test procedures and inspection acceptance levels are given in F.S. A.R. Sections 4.3.1 and 4.5. Particular emphasis is placed on the assurance of quality of the reactor vessel to obtain material whose properties are uniformly within tolerances appropriate to the application of the design methods of the code. ( F. S. A. R. p. 4.1-2) l (^}

 %,/

Positive indications in the control room of leakage l of coolant from the Reactor Coolant System to the l l

       - _ - ~   .~.    .-. . - .       - -.    . . . , . _ , , , , , .. ~ :. _ _

n

 ;
  )          containment are provided by equipment which permits continuous monitoring of containment air activity and humidity, and of runoff from the condensate collect-ing pans under the cooling coils of the containment air recirculation units.        This equipment provides indication of normal background which is indicative of a basic level of leakage from primary systems and components.        Any increase in the observed parameters is an indication of change within the containment and the equipment provided is capable of monitoring this change.        The basic design criterion is the detection of deviations from normal containment

(]) environmental conditiens including air particulate j activity, radiogas activity, humidity, condensate runoff and in addition, in the case of gross leakage,  ; the liquid inventory in the process systems and con-tainment sump. Further details are supplied in  : F.S.A.R. Section 4.2.7. (F.S.A.R. p. 4.1-6)  ! l Protection against rapid failure and gross rupture is discussed in response to Criterion 31. 1 i rm

 \. ,)

_..m __ .. ..___..m_._ _ ,. m . _ - - . _ - = - r- - _

 -n

() Criterion 15 - Reactor coolant system design. The reactor coolant system and associated auxiliary, control, and pro-tection systems shall be designed with sufficient margin to assure that the design conditions of the reactor coolant pressure boundary are not exceeded during cny condition of normal operation, including anticipated oper-ational occurrences. Response: The Reactor Coolant System design and asrociated pertinent systems includes sufficient margin to assure that the appropriate design limits of the reactor coolant pressure boundary are not exceeded during normal operation, including transients. (') ' The sele.cted design margins include operating tran-sient changes due to thermal lag, coolant transport , times , pressure drops , system relie f valve char-acteristics, and instrumentation and control response characteristics. System conditions resulting from anticipated tran-sients or malfunctions are monitored and appropriate action is automatically initiated to maintain the required cooling capability and to limit system con-ditions so that continued safe operation is possible. (FSAR p. 4.1-6) (~) The system is protected from overpressure by means u of automatic controls , and pressure relieving

           ~~ -
                   .. _~        ..

_..~u. , _ .

                                                             ,_. .._ ,. _ _, u . _ w __ _
                                        <-)

devices, as required by the applicable edition of Section III of the ASME Boiler and Pressure Vessel Code. (FSAR p. 4.1-6) Isolable sections of the system are provided with overpressure relieving devices discharging to closed systems such that the system code allowable relief pressure within the protected section is not ex-ceeded. (FSAR p. 4.1-6) O s._., l l

     /~'T       Criterion 16 - Containment design.              Reactor containment U

and associated systems shall be provided to establish an essentially leak-tight barrier against the uncontrolled  ! release of radioactivity to the environment and to assure  ;

                                                                                                   ;

that the containment design conditions important to safety are not exceeded for as long as postulated accident con-ditions require. o " Reactor containment and associated systems shall be provided to establish an essentially leak tight barrier against the uncontrolled release of radioactivity to the environment..." Response: The design objective of the containment structure and associated systems is to contain all radioactive material which might be released from the core fol-lowing a loss-of-coolant accident. The structure serves as both a biological shield and a pressure container. (FSAR, Vol. 2, Sec. 5, pgs. 5.1.1-5 - 5.1.1-6) All piping systems which penetrate the vapor barrier are anchored so that the penetration is stronger than the piping system and that the vapor bat'rier will not be breeched due to a hypothesized pipe rupture. The lines connected to the Primary Coolant System that penetrate the vapor barrier are anchored in the i () secondary shield walls and are each provided with at

gy;- 4 - - . - - _ . _. . _ _ _ . ._ (\ s'~'/ least one valve between the anchor and the coolant system. These anchors are designed to withstand the thrust moment and torque resulting from a hypothe-sized rupture of the attached pipe. ( FSAR p. 1. 3-5 ) Integrated leakage rate tests performed in accordance with the requirements of 10CFR50, Appendix J, during the first and third refueling outages serve to verify the leak-tight integrity of containment. o . . .and to assure that the containment design conditions important to safety are not exceeded for as long as postu-lated accident conditions require."

 /m

( , Response: Many types of credible accidents have been postulated for the containment design. The analysis of all these accidents, including the rupture of a reactor coolant pipe which is the most severe, demonstrates that the ple.nt can be operated safely and that ex-posures do not exceed the guide lines of 10CFR100. (FSAR, Vol. 4, Sec. 14) o

(m,) Criterion 17 - Electric power systems. An onsite electric power sys2em and an offsite electric power system shall be provided to permit functioning of structures, systems, and components important to safety. The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and Containment integrity and other vital functions are main-tained in the event of postulated accidents. () The onsite electric power sources, including the bat-teries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single fail-ure. Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on sepa-  ! rate rights of way) designed and located so as to minimize , l to the extent practical the likelihood of their simulta-neous failure under operating and postulated accident and 1 l environmental conditions. A switchyard common to both l

                                                                                                     \

f') v circuits is acceptable. Each of these circuits shall be ) l designed to be available in sufficient time following a - l 1

_ .___ _---m.----=- m: =. = =:m_ = (~)

 \/          loss of all onsite alternating current power supplies and the other of fuite electr'ic power circuit, to assure that specified acceptabic fuel design limits and design con-ditions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integ-rity, and other vital safety f unctions are maintained.

Provisions shall be included to minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power gen-erated by the nuclear power unit, the loss of power from A

 \-)         the transmission network, or the loss of power from the onsite electric power sources.

o An onsite electric power system and an offsite electric power system shall be provided to permit functioning of structures, systems and components important to safety. Response: The plant is supplied with normal, standby and emer-gency power sources as follows: The normal source of auxiliary power during plant operation is the generator. Power is supplied via the unit auxiliary transformer which is connected to the main leads of the generator. ( FSAR p. 8.1-2)

  ~\

(J

() Standby power required during plaat startup, shut-down and after reactor trip is supplied from the Consolidated Edison Co.138 kv system by overhead line from a substation approximately 3/4 miles from the plant to the station auxiliary transformer. In addition, three gas turbines are provided as an emergeacy blackout startup power supply. The capa-city of the gas turbine generator requires that the station load be reduced to a minimum for startup. (FSAR p. 8.1-2) Three diesel generator sets are connected to the engineered safety features buses to sopgAy emergency O x.s shutdown power in the event of loss of all o'.her a.c. auxiliary power. The three gas turbines discussed above may also serve to supply emergency shutdown power. Emergency power supply for vital iestruments and con-trol and supplies for emergency lighting is from the four 125 volt dc station batteries. (FSAR p. 8.1-3) The diesel-generator sets are located adjacent to the primary auxiliary building and are connected to sepa- l

                                                                   ;

rate 480 volt auxiliary system buses. Each set will j be started automatically on a safety injection signal or upon the occurrence of undervoltage on the outside plant source of power. Any two diesels have adequate { i l

                      - _ _ - .    - _ - ,_. . -.,     , ~       ~. ,_ .

([) capacity to supply the engineered safety features for the hypothetical accident concurrent with loss of outside power. This capacity is adequate to provide a safe and orderly plant shutdown in the event of loss of outside electric power. ( FSAR p. 8.1-3) o The safety function for each system (assuming the other system is not functioning) shall be to provide sufficient capacity and capability to assure that (1) specified acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded as a result of anticipated operational occurrences and (2) the core is cooled and containment integrity and other vital (') x_- functions are maintained in the event of postulated accidents. Response: All electrical systems and components vital to plant safety, including the emergency diesel generators are designed as Class I and designed so that their integ-rity is not impaired by the maximum potential earth-quake, wind, storms, floods or disturbances on the external electrical system. Power, control and in-strument cabling, motors and other electrical equip-ment required for operation of the engineered safety features are suitably protected against the effects of either a nuclear system accident or of severe (') xs external environment phenomena in order to assure a high degree of confidence in the operability of such i

t \- components in the event that their use is required. (FSAR p. 8.1-2) The electrical system equipment is arranged so that no single contingency can inactivate enough safe-guards equipment to jeopardize the plant safety. The 480-volt equipment is arranged on 4 buses. The 6900-volt equipment is supplied from 6 buses. (FSAR p. 8.2-16) The plant auxiliary equipment is arranged electri-cal.1.y so that multiple items receive their power from diff erent sources. The charging pumps are supplied from the 480-volt buses Nos. 3A, 5A and 6A. The six [} service water pumps and the five containment fans are divided among the four 480-volt buses. Valves are supplied from motor control centers, Nos. 26A and 26B, which are supplied from buses SA and 6A. (FSAR 8.2-17) The outside source of power is adequate to run all normal operating equipment. The 138 - 6.9 kv station transformer car. supply all the auxiliary loads. (FSAR 8.2-17) The bus arrangements specified for operation ensure that power is available to an adequate number of  ; safeguards auxiliaries. (FSAR 8.2-17) () ) i l l l

      -       -     . ~ .            .
                                          =    _, w _ _ _ _ . _ . _ _ _ _ . . . .., _ _ .

l 1

c. l t

k- Two diesel generators have capacity enought to start and run a fully loaded set of engineered safeguards equipment. These safeguards can adequately cool the core for any loss-of-coolant incident, and they also maintain the containment pressure within the design value. (FSAR 8.2-17) Each battery charger supplie5 one D.C. bus while maintaining its associated battery at full charge. If a charger or bus is out of service, the " swing bus" transfer will be utilized whereby a transfer is initiated from batteries 21 or 22 to batteries 23 or 24, respectively, to provide D.C. control power to o k_J the 480 volt safeguards breakers and emergency diesel generators. This design will eliminate any transfer between redundant batteries 21 and 22 and ensure that adequate D.C. power is available for starting the emergency generators and other emergency uses. (NRC Letter, Varga to Cahill, NRC Safety Evaluation of Proposed Modification of 125 VDC Battery System, dated May 2, 1980) o The onsite electric power sources, including the batteries and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure. A t l v

G Response: The plant's generator serves as the main source of auxiliary electrical power during "on-the-line" operation of the plant. Power to the auxiliaries is , supplied via a 22-6.9 kv two winding unit auxiliary transformer that is connected to the main leads from the generator. Power to the 480 volt buses is fed through 4-6900/480 volt station service transformers. (FSAR p. 8.2-2) The 6900 volt system is divided into six buses. Two buses, numbers 5 and 6, are connected to the 138 kv system via bus main breakers and the station auxil-iary transformer. Buses 1, 2, 3, and 4 are connected O N/ to the generator leads via bus main breakers and the unit auxiliary transforcer. Buses 1 and 2 can be tied to bus 5 and buses 3 and 4 can be tied to bus 6 via bus tie breakers. Buses 2, 3, 5 and 6 each serve one 6900-480 volt station service transformer. (FSAR p. 8.2-4) The 480 volt system is divided into four buses. The 480 volt buses are supplied from the 6900 volt buses buses as follows: 2A from 2; 3A from 3; SA from 5;  ! and 6A from 6. Tie breakers are provided between 480 volt buses 2A and 3A, 2A and 5A, 3A and 6A. (FSAR p. 8.2-4) n N- , 1 i i

m O (_/ The required safeguards equipment circuits are dis-persed among the 480 volt buses. The normal source of power for buses 5A and 6A is the 138 kv system (via station auxiliary transformer, and 6900 volt buses 5A and 6A), and no transfer is required in the event of an incident. Buses 2A and 3A are tied to buses 5A and 6A in the event of an incident. FSAR p. 8.2-4) One emergency diesel-generator set is connected to bus SA, one to 6A and the other to buses 2A and 3A. Each set will be automatically started upon under-voltage on one of the 6900 volt buses associated with () outside power. ( FSAR p. 8.2-4) Power for the safeguards valve motors is supplied from two motor control centers which in turn are sup-plied from the 480 volt system. Each motor control center bus is fed through a circuit breaker on the 480 volt system. These circuit breakers are on different 480 volt buses and the bus that supplies each breaker is supplied by an emergency diesel generator. (FSAR p. 8.2-4) Each of the four 480 volt switchgear buses which sup-ply power to the safeguards equipment receives DC control power from Batteries 21 & 23 or 22 & 24. An f-) u) automatic transfer device on each bus seeks whichever

__.-,.m m._ _ _ m __ _ _ _ _ _ ___ . . . _ _ .. _ _ _ (m.) DC source is energized with battery source 21 being the preferred source for buses 5A and 3A and battery source 22 being the preferred source for buses 6A and 2A. (FSAR p. 8.2-5 and NRC letter, Varga to Cahill, NRC Safety Evaluation of Proposed modifica-tion of 125 VDC Battery System, dated May 2,1980) The 120 volt a-c instrument supply is split into four buses. All four of the buses are fed by inverters which are in turn supplied from separate 125 volt d-c buses. In the event an inverter is taken out of ser-vice, a backup supply from the a.c. system through constant voltage transformers is available to feed (_) its associated bus. ( FSAR p. 8.2-5 and NRC letter, Varga to Cahill, NRC Safety Evaluation of Proposed Modification of 125 VDC Battery System, dated May 2, 1980) o Electric power from the transmission network to the onsite electric distribution system shall be supplied by two physically independent circuits (not necessarily on sepa-rate rights of way) designed and located so as to minimize to the extent practical the likelihood of their simulta-neous failure under operating and postulated accident and enviornmental conditions. A switchyard common to both circuits is acceptable. Each of these circuits shall be rm () designed to be available in sufficient time following a

D (_ J loss of all onsite alternating current power supplies and the other offsite electric power circuit, to assure that specified acceptable fuel design limits and design condi-tions of the reactor coolant pressure boundary are not exceeded. One of these circuits shall be designed to be available within a few seconds following a loss-of-coolant accident to assure that core cooling, containment integ-rity, and other vital safety f unctions are maintained. Provisions shall be included to minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident with, the loss of power gen-erated by the nuclear power unit, the loss of power from () the transmission network, or the loss of power from the onsite electric power sources. Response: There are several sources of offsite power available to Indian Point #2, consisting of a 138 kv supply from the Buchanan 138 kv substation, two 13 kv under-ground connections from the Buchanan 13.8 kv substa-tion with three 13.8 kv gas turbines connected to each feeder. The 138 kv supply to Indian Point No. 2 is obtained from the Buchanan 138 kv station. This station has two connections to the Millwood 138 kv station and to

                 -the 345 kv Buchanan substation. The Indian Point No.

2 345 kv connection to the system goes to the Buchanan

                                                      ...--n-       .- . _ . . - . -

O V 345 kv substation and then directly to the Millwood 345 kv station. System stability studies have been made that show that the system is stable for the loss of any generating unit including Indian Point No. 2. (FSAR Q. 8.l(a)-1) The 138 kv connection, supplies one station auxiliary transforner at Indian Point No. 2 and the loss of this transformer would int.errupt the 138 KV supply to the station. For this reason, an alternate 13.8/ 6.9.kv supply is provided. This supply is manually connected in the event that the 138 KV supply is lost. (FSAR Q. 8.l(a)-1) The gas turbines are started manually at the gas turbines when required. Technical Specification requirements assure that adequate onsite and offsite fuel oil inventories are maintained. I I 1 Each of these circuits is designed to be available in sufficient time following a loss of all onsite alternating current power supplies and the other off- , site electric power circuits, to assure that speci-fied acceptable fuel design limits and design conditions of the reactor coolant pressure boundary are not exceeded. The 138 kv system is designed to be available instantaneously following a loss of (~) x_ j l 1

                         ~

coolant accident to assure that core cooling, con-tainment integrity and other vital safety functions are maintained. This is accomplished by a dead fast transfer scheme using stored energy breakers to transfer the auxiliaries on the four 6900 volt buses suplied by the unit auxiliary transformer to the station auxiliary transformer which is supplied from the 138 kv system. The diversity and redundancy inherent in the com-bination of onsite/offsite electrical systems minimize the probability of losing electric power from any of the remaining sources as a result of, or coincident O with, the loss of power generated by the nuclear power unit, the loss of power from the trancmission net-work, or the loss of onsite power sources. l l (v~\ 1 1

Criterion 18 - Inspection and testing of electric power \' systems. Electric power systems important to safety shall be designed to permit appropriate peroidic inspection and testing of important areas and features, such as wiring, l insulation, connections, and switchboards, to assess the continuity of the systems and the condition of their com-ponents. The systems shall be designed with a capability to test peroidically (1) the operability and functional performance of the components of the systems, such as onsite power sources, relays, switches, and buses, and (2) the operability of the systems as a whole and, under con-ditions as close to design as practical, the full opera-tion sequence that bringe the systems into operation, (")N s s including operation of applicable portions of the protec-tion system, and the transfer of power among the nuclear power unit, the offsite power system, and the onsite power system. Response: To verify that the 480 volt emergency power system will respond within the required time limit and pro-perly when required, the following tests are per-formed periodically:

1. Emergency diesel generator testing in accordance with the requirements of NRC Regulatory Guide 1.108 Revision 1 " Periodic Testing of Diesel Generator Units Used as Onsite Electric Power Systems of Nuclear

  )

Power Plants."

_, _- - - -- _. . x -.

l i I p

 \v/

2. Demonstration of the readiness of the system and control systems of vital equipment to automatically start or restore to operation particular vital equipment by initiating an actual loss of all nocmal AC station service power supplies. This test will be conducted during each refueling interval.

Testing of station batteries is accomplished per the plant Technical Specifications as follows:

1. Every month the voltage of each cell, the specific gravity and temperature of a pilot n

() cell in each battery and each battery volt-age shall be measured and recorded.

2. Every 3 months each battery will be sub-jected to a 24 hour equalizing charge, and the specific gravity of each cell, the tem-perature reading of every fif th cell, the height of electrolyte, and the amount of water added shall be measured and recorded.

3. At each time data is recorded, new data shall be compared with the old to detect signs of abuse or deterioration.

  .. /

A mm G 2 4. At each refueling interval, each battery shall be subjected to a load test and a visual inspection of the plates. Functional testing and inspection is performed on the DC Control Power Throw over contactors for 480 volt buses 2A, 3A, 5A and 6A. This test will 1) determine that throw-over contactors will transfer DC Control Power from normal to emergency source when normal source voltage is inadequate, 2) demonstrate that nor-mal and emergency feederr are available for Control power supply and 3) demonstrate tha t the throw-over contactor will return to the normal position when '-) normal voltage is adequate. (Performance Test Procedure (PT-R25D.) In addition, a test is performed to verify that the automatic transfer circuits throw-over to an alter-nate D.C. power supply upon detection of low voltage on the normal supply. This test assures the auto-matic diesel transfer to an alternate D.C. power supply. r's

• m __ _ _ __, ._ __ _

                                                  /~)

The Safety Injection System is tested:

1) To verify that the various valves and pumps associated with the engineered safeguards system will respond and perform their re-quired safety functions. (Performance Test Procedure PT-R13.)

2) To assure that each diesel generator will automatically start and assume the required load within 60 seconds af ter the initial start signal by simulating loss of all nor-mal AC station service power supplies and simultaneously simulating an S.I. signal.

({} (Performance Test Procedure PT-R14.)

3) To verify that the required bus load shedding takes place. (Performance Test Procedure PT-R14.)

4) To verify the restoration to operation of particular vital equipment. (Performance Test Procedure PT-R14.)

O O

m __,, __ _ m- --

                             ..    - .m   _ _m _
                                                         .m.m.__..._m._.
      -s (x_-)          Criterion 19 - Control room. A control room shall be pro-vided from which actions can be taken to operate the nuclear power unit safely under normal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant accidents. Adequate radiation protection shall be provided to permit access and occu-pancy of the control room under accident conditions with-out personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident.

Equipment at appropriate locations outside the control room shall be provided (1) with a design capab.lity for c)

  ;

prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and ( 2) with a potential capability for subsequent cold shutdown of the reactor through the use of suitable procedures. o " A control room shall be provided from which actions can be toaen to operate the nuclear power unit safely under nor-mal conditions and to maintain it in a safe condition under accident conditions, including loss-of-coolant ac-cidents. Adequate radiation protection shall be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation (]) exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident."

m (~ h V Response: The plant is equipped with a control room which con-tains those controls and instrumentation necessary for safe operation of the reactor and turbine gen-erator under normal and accident conditions. (FSAR p. 7.2-1) Suf ficient shielding, distance, and containment integrity are provided to assure that control room personnel shall not be subjected to doses, under postulated accident conditions, in excess of 5 rems, whole body or its equivalent to any part of the body for the duration of the accident. (Letter dated 3 July 1, 1980 from W. J. Cahill (Con Edson) to A.

 \_)

Schwencer (NRC) concerning control room habitability information) o " Equipment at approprir.te locatiet.s outside the control room shall be provided (1) with a design capability for prompt hot shutdown of the reactor, including necessary instrumentation and controls to maintain the unit in a safe condition during hot shutdown, and (2) with a poten-tial capability for subsequent cold shutdown of the renc-tor through the use of suitable procedures." Response: If the control room should be evacuated suddenly without any action by the operators, the reactor can () be tripped by either of the following:

              . _ - - __        -._ . m.

m 3-(^')

l. Open rod control breakers in the control build-ing.

2. Actuate the manual turbine trip at the control panel in the turbine building.

Following evacuation of the control room the follow-ing systems and equipment are provided to maintain the plant in a safe shutdown condition from outside the control room: (a) Residual heat removal (b) Reactivity control. i.e., boron injection

 ,_                                   to compensate for fission product decay V                            (c)     Pressurizer pressure and level control (d)     Electrical system as required to supply the above systems (e)     Auxiliary feedwater (f)     Other auxiliary equipment.

The specific indication and controls provided outside the control room for the above capability are sum-marized as follows ( FSAR p. 7.7-5, 7.7-8 through 7.7-11): l Indication j

1) Level and Flow Indication for the Individual Steam Genera tors.

(^]' L \ l l

__ . > - - _m . _ _ _ _ . _ _ _ . _ _ _.. _ _ _ . _. u__ . _ One set visible from the auxiliary feed pumps One set visible from the main feed conts,1 valves

2) Pressure Indication for the Individual Steam Generators.

Visible from the auxiliary feed pumps.

3) Pressurizer Level and Pressure Indicators.

One set visible from the auxiliary feed pumps One set visible from the charging pump local con-trol point All instruments at the aOniliary feed pumps are grouped on a local gauge board. Controls <~ Local stop/ start push button notor controls with a selector switch are provided at each of the following motors. The selector switch will transfer control of the switch gear from the control room to local at the motor. Placing the local selector switch in the local operating position will give an annunciator alarm in the control room and will turn out the motor 1 l control position lights on the control room panel.

1) Motor Driven Auxiliary Feedwater Pumps. I

2) Steam Driven Auxiliary Feedwater Pump.

3) Charging Pumps.

4) Boric Acid Transfer Pumps.

o)

_ , __ _ >1m _- a _ _ _ _ _ _-

                                                 . _ _ _ _ __ _ _  ,m ._        _ , _ _ . . _ _

m f~'s () Remote stop/ start push button motor controls with a selector switch are provided for each of the compon-ents below. These controls are grouped at one point in the switch gear room convenient for operation. The selector switch will transfer control of the switch gear from the control room to the remote point. Placing the selector switch to local opera-tion will give an annunciator alarm in the control room and will turn out the motor control position lights on the control room panel.

1) Service Water Pumps.

()

2) Containment Air Recirculation Fans.

3) Control Room Air Handling Unit Including Control for the Air Inlet Dampers.

Alternate motor control points are not required for the fo11 ewing:

1) Component Cooling Water Pumps. (Automatically restarted on a blackout once the diesel genera-tors are operating.)

2) Instrument Air Compressors and Cooling Pumps.

(These will start automatically on low pressures

  ,                        in the air and wucer services, once the diesel I        ;

automatically energizes the bus and the motor

O control centers are manually energized. The con-trol point is local to the compressors.) Speed control is provided locally for:

1) The Auxiliary Turbine Driven Feed Pump

2) The Charging Pump Local Valve Control is provided at the:

1) Main Feed Regulators.

2) Auxiliary Feed Control Valves. (These valves are located local to the auxiliary feed pumps.)

O 3) Atmospheric Dump. ( Auto control normally at hot shutdown.)

4) All other valves requiring operation during hot standby can be locally operated at the valve.

5) Letdown orifices isolation valves locally to the charging pumps. Local stop and start buttons with selector switch and position lamp.

Pressurizer Heater Control Stop and start buttons with selector switch and posi-tion lamp local to the charging pumps for one 485KW backup heater group. o

t . - . .. . - _.- -- _. ._ c , _- ..._ Lighting Emergency lighting is provided in all operating areas as defined by the foregoing. Communications The communication network provides communications between the area of the auxiliary feed pumps and the charging pumps, boric acid transfer pumps, diesel generators, and the outside telephone exchange without requiring the control room. The start-up testing program for Indian Point Unit No. 2 successfully demonstrated the ability to shutdown the plant () from outside the control room by actually conducting such a test. O

O l III. Protection and Reactivity Control Systems

                                                  \

• l 1

i n 1 O

a Criterion 20 - Protection system functions. The protec-() tion system shall be designed (1) to initiate automati-cally the operation of appropriate systems including the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences and (2) to sense accident conditions and to initiate the operation of sys-tems and components important to safety. o "The protection system shall be designed (1) to initiate automatically the operation of appropriate systems in-cluding the reactivity control systems, to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences . .. ." r w- Response: The protective systems described below are initiated automatically. J The protective systems consist of both the reactor protection system and the engineered safety features. Equipment supplying signals to any of these protec-tive systems is considered a part of that protective system. (FSAR, p. 7.2-1) The basic reactor tripping philosophy is to define a region of power and coolant temperature conditions allowed by the primary tripping functions, the over-power & T trip, the over-temperature f T trip and the nuclear overpower trip. The allowable operating

region within these trip settings is provided to pre-(V) vent any combination of power, terperature and pres-sure which would result in DNB with all reactor coolant pumps in operation. Additional tripping functions such as a high pressurizer pr essure trip, low pres-surizer pressure trip, high pressurizer water level trip, loss of primary flow trip, steam and feedwater flow mismatch trip, steam generator low-low water level trip, turbine trip, safety injection trips, nuclear source and intermediate range trips, and manual trip are provided to back up the primary trip-ping functions for specific. accident condition and mechanical failures. (FSAR p. 7.2-2) A dropped rod signal blocks automatic rod witadrawal and also provides a turbine load cutback if above a given power level. The dropped rod is indicated from individual rod position indicators or by a rapid flux decrease on any of the power range nuclear channels. (FSAR p. 7.'2-2) Nuclear overpower, overpower /lT, over-temperature llT, and Tgyg deviation rod stops prevent abnormal power conditions which could result from excessive control rod withdrawal initiated by a malfunction of the reactor control system or by operator violation of administra- ' (~% tive procedures. (FSAR, p. 7.2-2) ()

 - ( ,j   o       ... and (2) to sense accident conditions and to initiate the operation of systtams and components important to safety."

Response: The engineered safety features systems are actuated by the engineered safety features actuation channels. Each coin $1dence network energizes an engineered safety features actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. The channels are designed to combine redundant sensors, and in-dependent channel circuitry, coincident trip logic and different parameter measurements so that a safe (} and reliable system is provided in which a single failure will not defeat the channel function. The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isola-tion System, the Containment Air Recirculation System, the Containment Ventilation Isolation System and the Containment Spray System. (FSAR p. 7.2-3) The containment air recirculation coolers are nor-mally in use during plant operation and would there-

fore not normally require an initiating signal. i l These units are, however, in the automatic sequence which actuates the engineered safety features upon (s ')'/ j i 1

                       .- . .-.                - . _. -       ..                                     _                    . . -   ..          . - - . ~.                 -

r receiving the necessary actuating signals indicating. (f , 4 an accident condition. (FSAR p. 7.2-3) l 1 Containment spray is actuated by coincident and redundant high containment pressure signals. 1 (FSAR p. 7.2-3) The Containment Isolation System provides the means

                 ,            of isolating the various pipes passing through the containment walls as required to prevent the release I

of radioactivity to the outside environment in the j event of a loss-of-coolant accident. The actuation of the containment isolation is by coincident and 4 - redundant containment high pressure signals.

!                             ( FSAR p. 7. 2-3 )

4 , i l i i 1 'I s 1 D a

  -  4   ~ , wwi - , ,           -
                                   ,r.,_-w.ns,    .      _.
                                                             - , . . . . . . . . . , . , , . < . _ = , , _ . . , . . _ . .               . . . , ,        .,--_...--~.,v-.

_ Criterion 21 - Protection system reliability and test-

 's   /       ability. The protection system shall be des-gned for high functional reliability and inservice testability commen-surate with the safety functions to be performed. Redun-dancy and independence designed into the protection system shall be sufficient to assure that (1) no single failure results in loss of the protection function and (2) removal f rom service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability of operation of the protection system can be otherwise demonstrated. The prntection system shall be designed to permit periodic testing of its functioning w..en the reactor is in operation, including a capability to test channels independently to determine

{~)'S failures and losses of redundancy that may have occured. o "The protection system shall be designed for high func-tional reliability and inservice testability commensurate with the safety functions to be performed." Eesponse: The reactor uses a version of the Westinghouse magnetic-type control rod drive mechanisms used in the San Onofre, Connecticut Yankee, North Anna I and D.C. Cook II plants. Upon a loss of power to the coils, the rod cluster control assemblies with full length absorber rods are released and fall by gravity into the core. ( FSAR p. 7.2-4) G (/

("N The reactor internals, fuel assemblies, RCC assem- .Q) blies and drive system components are designed as Seismic Class I equipment. The RCC assemblies are fully guided through the fuel assembly and for the maximum travel of the control rod into the guide tube. Furthermore, the RC assemblies are never fully withdrawn from their guide thimbles in the f uel assembly. Due to this and the flexibility designed into the RCC assemblies, abnormal loadings and mis-alignments can be sustained without impairing opera-tion of the RCC assemblies. ( FSAR p. 7.2-4) The Rod Cluster Control (RCC) assembly guide :.ystem is locked together with pins throughtout its length g-)g to ensur'e against misalignments which might impair control rod movement under normal operating condi-tions and credible accident conditions. An analogous system has successfully undergone 4132 hours of test-ing in the Westinghouse Reactor Evaluation Channel during vi.ich about 27,200 feet of step-driven travel and 1461 trips were accomplished with test misalign-

        ' ments in excess of the maximum possible misalignment   i that may be experienced when installed in the plant.

( FSAR p. 7.2-4)  ; All reactor trip protection channels are supplied

   -3    with suf ficient redundancy to provide the capability v

I

for channel calibration and test at power. U'~^ ' (FSAR p. 7.2-4) Removal of one trip circuit is accomplished by placing that circuit in a half-tripped moder i.e. , a two-out-of-three circuit becomes a one-out-of-two circuit. Testing does not trip the system unless a trip conditon exists in a concurrent channel. (PSAR p. 7.2-5) Reliability and independence is obtained by redundancy within each tripping function. In a two-out-of-three circuit, for example, the three channels are equipped with separate primary sensors. Each channel is con-tinuously fed from its own independent electrical () source. Failure to de-energize a channel when re-quired would be a mode of malfunciton that would affect only that channel. The trip signal furnished by the two remaining channels would be unimpaired in this event. (FSAR p. 7.2-5) o " Redundancy and independence designed into the protection system shall be suf ficier t to assure that (1) no single failure results in loss of the protection function and (2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless l the acceptable reliability of operation of the protection  ; system can be otherwise demonstrated." ) r^x. ' U l l 1

_4-Response: The reactor protection systems are designed so that p2 (- the most probable modes of failure in each protec-tion channel result in a signal calling for the pro-tective trip. Each protection system design combines redundant sensors and channel independence with coin-cident trip philosophy so that a safe and reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant trip, or violate reactor protection criteria. ( FSAR p. 7.2-5) Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control () functions when combined are combined only at the sensor. Both of these functions are fully isolated in the remaining part of the channel, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protec-tion channel. This approach is used for pressurizer pressure and water level channels, steam generator water level, Tgyg and 4T channels, steam flow-feed-water flow and nuclear source, power range channels. (FSAR p. 7.2-5, 7.2-6) The engineered safety features equipment is actuated l /^ l (_)N by one or the other of the engineered safety features I , . -

m

    )    actuation channels. Each coincidence network actu-ates an engineered safety actuation device that operates the associated engineered safety features equipment,  motor starters and valve operators.        As an example, the control circuit of a safety injection pump is typical of the control circuit for a large pump operated from switchgear. The actuation relay, energized by the Engineered Safety Features Instru-mentation System has normally open contacts.        These contacts energize the circuit breaker closing coil to start the pump when the control relay is energized.

The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isola-tion System, Containment Air Recirculation System and Containment Spray System. (PSAR p. 7.2-6) In the Reactor Protection System, two reactor trip breaker are provided to interrupt power to the full length rod drive mechanisms. The breaker main con-tacts are connected in series (with power supply) so that opening oither breaker interrupts power to all full length rod mechanisms, permitting them to fall by gravaty into the core. In the event of a loss of rod control power, the reactor trip breaker is de-

 ,      . energized and trips to an open mode.     ( FSAR p. 7.2-6)    ,

s_ )

                                                                        ;
      ,                                          -                ~ . -

() Redundancy and independence are more than achieved by protection channel designs which combine more than one sensor and parameter measurement with coincident trip circuitry (e. g. pressur e coincident with level , and interlocked with flow or nuclear flux) . (FSAR p. 7.2-6) , o "The protection system shall be designed to permit peri-odic testing of its functioning when the reactor is in operation, including a capability to test channels in-dependently to determine failures and losses of redun-dancy that may have occurred." Response. The signal conditioning equipment of each protection d t i

  \/                   channel in service at power is capable of being tested and tripped independently by simulated analog input signals to verify its operation.       This includes-checking through to the trip breakers which neces-sarily involves the trip logic.       Thus, the operability of each trip channel can be determined conveniently and without ambiguity.   ( FSAR p. 7.2-7)

Testing of the diesel-generator starting may be per-formed from the diesel-generator control board. The generator breaker is not closed automatically af ter starting during this testing. The generator may be manually sychronized to the 480 volt bus for loading.

  /~'g-(_/.                 Complete testing of the starting of diesel generators
        -                                     _     -         -           ._ .   -~ .

(} can.be accomplished by tripping the associated 6900 volt undervoltage relays and providing a coincident simulated safeguards signal. The ability of the units to start within the prescribed time and to carry load can be periodically checked. (PSAR p. 7.2-8.) In addition, testing of the diesel generators satisfies the requirements of Regulatory Guide 1.108. I O 1 4

Criterion 22 - Protection System Independence. The pro-A/ tection system shall be designed to assure that the effects of natural phenomena and of normal operating, maintenance, testing and postulated accident conditions on redundant channels do not result in loss of the pro-n tection function or shall be demonstrated to be acceptable on some other defined basis. Design techniques, such as functional diversity or diversity,in component design and [ principles of operation, shall be used to the extent practical to prevent loss of the protection f unction. Response: Reliability and independence is obtained by redun-dancy within each tripping function. In a two-out-of-three cir-cuit,.for example, the three channels are equipped with separate primary sensors. Each channel is continuously fed from its own independent electrical source. Failures to de-energize a channel when required would be a mode of malfunction that would affect only that channel. The trip signal furnished by the two remain-ing channels would be unimparied in this event. (FSAR p. 7.2-5) The reactor protection systems are designed so that the most probable modes of failure in each protection channel result in a signal calling for the protective trip. Each protection system , design combines redundant sensors and channel independence with coincident trip philosophy so that a safe and reliable system is provided in which a single failure will not defeat the channel function, cause a spurious plant trip, or violate reactor pro-bsJ tection criteria. (FSAR p. 7.2-5) l _ - ,__ ~ _ _ . .

(} Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control functions when combined are combined only at the sensor. Both of these functions are fully isolated in the remaining part of the channel, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protec-tion channel. This approach is used for pressureizer , pressure and water level channels, steam generator water level, Tgyg and f T channels, steam flow, feed-water flow, and nuclear source, power range channels. (~ (FSAR p.,7.2-5, 7.2-6) i The engineered safety features equipment is actuated by one or the other of the engineered safety features actuation channels. Each coincidence network actuates an engineered safety actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. As an example, the control circuit for a large pump operated from switchgear. The actuation relay, energized by the Engineered Safety Featu7es Instrumentation System has normally open contacts. These contacts energize the circuit breaker closing coil to start the pump when C), (. the control relay is energized. The Engineered Safety

() ( Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injec-tion System, the Containment Isolation System, Con-tainment Air Recirculation System and Containment Spray System. ( FSAR p. 7.2-6) i In the Reactor Protection System, two reactor trip breakers are provided to interrupt power to the full length rod drive mechanisms. The breakers main con-tacts are connected in series (with power supply) so that opening either breaker interrupts power to all full length rod mechanisms, permitting then to fall by gravity into the core. In the event of a loss of (^ rod control power, each reactor trip breaker is de-(_T/ energized and trips to an open mode. ( FSAR ' p. 7.2-6) Redundancy and independence are more than achieved by protection channel designs which combine more than one sensor and parameter measurement with coincident i trip circuitry (e.g. presssure coincident with level and interlocked with flow or nuclear flux) . (FSAR p. 7.2-6) The Engineered Safety Features System are actuated by the Engineered Safety Features actuation channels. Each coincidence network energizes an engineered l Safety features actuation device that operates the {a'}

_4-(') v associated engineered safety features equipment, motor starters and valve operators. The channels are designed to combine redundant sensors and independent channel circuitry, coincident trip logic and dif ferent parameter measurements so that a safe and reliable system is provided in which a single failure will not defeat the channel function. ( FSAR p. 7.2-3) System Safety Features Separation of Redundant Protection Channels - The re-actor protection system is designed on a channelized basis to achieve separation between redundant protec-tion channels. The channelized design, as applied to the analog as well as the logic portions of the pro-tection system is discussed below. Although described for four (4) channel redundancy, the design is appli-i cable to two and three channel redundancy. Separation of redundant analog channels originates at the process sensors and continues through the field wiring and containment penetrations to the analog protection racks. Physical separation is used to the maximum practical extent to achieve separation of redundant transmitters. Separation of field wiring I is achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel. Analog equipment is separated by (~)x

   \_

i m a. -y_ r,

locating redundant components in different protection {} racks. Each channel is energized from a separate AC power feed. ( FSAR p. 7.2-15) The reactor trip bistables are mounted in the protec-tion racks and are the final operational component in an analog protection channel. Each bistable drives two logic relays ("C" & "D"). The contacts from the "C" relays are interconnected to form the required actuation logic for Trip Breaker No.1 through DC power feed No. 1. The transition from channel identity to logic identity is made at the logic relay coll / relay contact interface. As such, there is both {'; electrical and physical separation between the analog and the iogic portions of the protection system. The above logic network is duplicated for Trip Breaker No. 2 using DC power feed No. 2 and the contacts from the " D" relays. Therefore, the two redundant reactor trip logic channels will be physically separated and electrically isolated from one another. Overall, the Protection System is comprised of identifiable channels which are physically, electrically and func-tionally separated and isolated from one another. (FSAR p. 7.2-16) i I (/

                                                                      ~m

() Physical Separation - The physical arrangement of all elements associated with the protective system reduces the probability of a single physical event impairing the vital functions of the system. (FSAR p. 7.2-16) System equipment is distributed between instrument cabinets so as to reduce the probabilty of damage to the total systems by some single event. Wiring between vital elements of the system outside of equipment housing is routed and protected so as to maintain the true redundancy of the systems with respect to physical hazards. ( FSAR p. 7.2-16) {} Loss of Power - A loss of power in' the Reactor Pro-tective System causes the affected channel to trip. All bistables operate in a normally energized state and go to a de-energized state to initiate action. Loss of power automatically forces the bistables into the tripped state. ( FSAR p. 7 2-16) s_-

Criteria 23 - Protection System Failure Modes. The pro-7..s tection system shall be designed to fail into a safe state

 \.)         or into a state demonstrated to be acceptable on some other defined basis if conditions such as disconnection of the system, loss of energy (e.g. , electric power, instrument air), or postulated adverse environments (e.g., extreme heat or cold, fire, pressure, steam, water and radiation) are experienced.

Response: Each reactor trip circuit is ' designed so that trip occurs when the circuit is de-energized; therefore, loss of channel power causes the system to go into

       \

its trip mode. In a two-out-of-three circuit, the three channels are equipped with separate primary i sensors and each channel is energized from an in-A J dependent electrical bus. Failure to de-energize when required is a mode of malfunction that af fects only one channel. The trip signal furnished by the two remaining channels is unimpaired in this event. (FSAR p. 7.2-8) Reactor trip is implemented by interrupting the power to the magnet latch mechanisms on all control rod drives allowing the full length rod clusters to insert by gravity. The protection system is thus inherently safe in the event of a loss of power. ( FSAR p. 7.2-8) t_s l l

i

  /'D   The Engineering Safet?.. Features actuation circuits are designed on the same "de-energized to operate" prin-           t ciple as the reactor trip circuits with the exception of the containment spray actuation circuit which is energized to operate in order to avoid spray operation on inadvertent power failure.        (FSAR p. 7.2-8) 4 The components of the protection systems are designed and laid out so that the mechanical and thermal envir-onment accompanying any emergency aituation in which the components are required to f unction does not l

interfere with that function. (FSAR p. 7.2-7)

,       Separation of redundant analog protection channels originates at the process sensors and continues back through the field wiring and containment penetrations to the analog mrotection racks.        Physical separation is used to the maximum practical extent to achieve separation of redundant transmitters.         Separation of field wiring is achieved using separate wireways, cable trays, conduit runs and containment penetrations for each redundant channel.        Redundant analog equipment is separated by locating redundant components in differ-ent protection racks.        Each channel is energized from a separate AC instrument bus.        ( FSAR p. 7.2-7) l n                                                -

() Automatic starting _ of all emergency diesel generators is initiated by undervoltage relays on any 480 volt bus or by the safety injection signal. Engine crank-ing is accomplished by a stored energy system sup-plied solely for the associated diesel-generator. The undervoltage relay scheme is designed so that loss of 480 volt power does not prevent the relay scheme from f unctioning to start the emergency diesel generators. (FSAR P. 2.7-9) A loss of power in the Reactor Protection System causes the affected channel to trip. All bistables operate i in a normally energized state and go to a de-energized 1 q( } state to initiate action. Loss of power automatically i forces the t'; stables into the tripped state. (FSAR

p. 7.2-16) f I

l 4 2

_ Criterion 24 - Separation of Protection and Control Systems. \- ' The protection system shall be separated from control systems to the extent that failure of any single control system com-ponent or channel, or failure or renoval from service of any single protection system component or channel which is com-mon to the control and protection systems leaves intact a system satisfying all reliability, redundancy, and indepen-dence requirements of the protection system. Interconnec-tion of the protection and control systems shall be limited so as to assure that safety is not significantly impaired. Response Channel independence is carried throughout the system extending from the sensor to the relay actuating the protective function. The protective and control func-

~

tions when combined are combined only at the sensor. Both of these functions are fully isolated in the re-ma ining part of the channel, control being derived from the primary protection signal path through an isolation amplifier. As such, a failure in the control circuitry does not affect the protection channel. This approach is used for pressurizer pressure and water level chan-nels, steam generator water level, T AVG and jdT channels, steam flow-feedwater flow and nuclear source, power range channels. ( FSAR p . 7. 2-5, 7. 2-5 ) The engineered safety features equipment is actuated by one or the rther of the engineered safety features actuation channels. Each coincidence network actuates

p ( ,) an engineered safety actuation device that operates the associated engineered safety features equipment, motor starters and valve operators. As an example, the con-trol circuit of a safety injection pump is typical of the control circuit for a large pump operated from switchgear. The actuation relay, energized by the En-gineered Safety Features Instrumentation System has normally open contacts. These contacts energize the circuit breaker closing coil to start the pump when the control relay is energized. The Engineered Safety Features Instrumentation System actuates (depending on the severity of the condition) the Safety Injection System, the Containment Isolation System, Containment Air Recirculation System and Containment Spray System. ( FSAR p. 7.2-6) In the Reactor Protection System, two reactor trip breakers are provided to interrupt power to the full length rod drive mechanisms. The breakers main con-tects are connected in series (with power supply) so that opening either breaker interrupts power to all full length rod mechanisms, permitting them to fall by gravity into the core. In the event of a loss of rod control power the reactor trip breaker is de-energized and trips to an open mode. ( FSAR p. 7.2-6) b v l

(} Redundancy and independence are more than achieved by protection channel designs which combine more than one sensor and parameter measurement with coincident trip circuitry (e.g. , pressure coincident with level and interlocked with flow or nuclear flux). (FSAR p. 7.2-6) Failure of a Sensor or other Component of the Protective System The design basis for the control and protection system permits the use of a detector for both protection and control functions. Where this is done, all equipment common to both the protection and control circuits are classified as part of the protection O (_/ system. Isolation a.mplifiers prevent a control system failure from affecting the protection system. In addition, where failure of a protection system component can cause a process excursion which requires protective action, the protection system can withstand another, independent failu. 3 without loss of function. Generally, this is accomplished with two-out-of-l four trip logic. Also, wherever practical, provisions are included in the protection system to prevent a plant outage because of single failure of a sensor (FSAR p. 7.2-35) i

                                                                         ;

(_/ l

Criterion 25 - Protection System Requirements For Reactiv-ity Control Malfunctions.

    )                                     The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such.as accidental withdrawal (not ejection or dropout) of control rods.

Response: Reactor shutdown with rods is completely independent of the normal control functions since the trip break-ers completely interrupt the power to the full length rod mechanisms regardless of existing control signals. , Effects of continuous withdrawal of a rod control assembly and of deboration are described in IP2 FSAR Sections 7.3.1 and 7.3.2, and Sections 9 and 14. Specified acceptable fuel design limits are not ex- {~/}

  ~

ceeded for any single malfunction of the reactivity control systems. (FSAR p. 7.2.-9) The protective systems are redundant and independent for all vital inputs and functions. Each channel is functionally independent of every other channel and receives power from an independent source. (FSAR p. 7.2-10) Means are provided for manual initiation of protec-tive system action. Failures in the automatic system do not prevent the manual actuation of protective f unc-tions. Manual actuation requires the operation of a ' ,bJ minimum of equipment. ( FSAR p. 7.2-10)

                      -2,

() The system is depigned to permit any one channel to be maintained, and when required, tested or cali-brated during power operation without system trip. During such operation the active parts of the system continue to meet the single f ailure criterion, since the channel. under test is either tripped or super-imposed test signals -are used which do not negate the process signal. (FSAR p. 7.2-10) Channel bypass of "one-out-of-two" systems is permitted provided that acceptable reliability of operation can be otherwise demons.trated and bypass time interval is short. O N 's The bistable portions of the protective system (e.g., relays , bistables , e tc. ) provide trip signals only af ter signals from analog portions of the system reach preset values. Capability is provided for cali-brating and testing the performance of the bistable portion of protective channels and various combinations of the logic _ networks during reactor operation. (FSAR

p. 7.2-10)

The analog portion of a protective channel provides analog signals of reactor or plant parameters. The following means are provided to permit checking the p. (_/

analog portion of a protective channel during re-(J) actor opre ion (FSAR p. 7.2-10):

a. Varying the monitored variable

b. Introducing and varying a substitute transmitter signal

c. Cross checking between identical channele or be-tween channels which bear a known relationship to each other and which have readouts available.

The design permits the administrative control of the means for manually bypassing channels or protective functions. o U The design permits the administrative control of access to all trip settings, module calibration adjustments, test points, and signal injection points. The protective systems are designed to provide the operator with accurate, complete, and timely informa-tion pertinent to their own status and to plant safety. ( FSAR p. 7.2-11) Indication is provided in the control room if some part of the system has been administrative 1y bypassed or taken out of service. ( FSAR p. 7.2-11)

   /~1 Trips are indicated and identified down to the

(.)

channel level. (FSAR p. 7-2-11)  ! i 1

Criterion 26 - Reactivity Control System Redundancy And (~) (/ Capability. Two independent reactivity control systems of different design principles shall be provided. One of the systems shall use control rods, perferably includ-ing a positive means for inserting the rods, and shall be capable of reliably controlling reactivity changes to as-sure that under conditions of normal operation including anticipated operational occurrences and with appropriate margin for malfunctions such as stuck rods, specified acceptable fuel design limits are not exceeded. The second reactivity control system shall be capable of reli-ably controlling the rate of reactivity changes resulting from planned, normal power changes (including xenon burn-out) to assure acceptable fuel design limits are not exceeded. One of the systems shall be capable of holding the reactor core subcritical under cold conditions. o "Two independent reactivity control systems of different design principles shall be provided." Response: Two independent reactivity control systems are pro-vided, one involving rod cluster control (RCC) assem-bilies and the other involving chemical shimming. (FSAR, pp 1.3-12, 3.2.1-1, 7. 2-9, and 9. 2-1) o "One of the systems shall use control rods preferably in-cluding a positive means for inserting the rods, ... [s_s ' 4

                                       --    _ , .        . , - -             - . . . _ , ,                            p.             - -, .

l l f( )) Response: The control cod drive mechanisms are used for with-drawal and insertion of the rod cluster control as-semblies into the reactor core and to provide suf-ficent holding power for stationary support. Fast I total insertion (reactor trip) is obtained by simply removing the electrical power allowing the rods to fall by gravity. Typical total insertion time is about 2 seconds. (FSAR 3.2.3-24b thru - 35) o . . . and shall be capable of reliably controlling reactiv-ity changes to assure that under conditions of normal op-eration including anticipated operational occurrences, and with appropriate margin for malfunctions such as stuck rods, () specified acceptable fuel design limits are not exceeded." Response: The reactor core, together with the reactor control rod and protection system is designed such that the mini-mum allowable DNBR is at least 1.30 and there is no fuel melting during normal operation, including anti-cipated transients. The shutdown groups are provided to supplement the control groups of RCC assemblies to make the reactor at least one per cent subcritical at the hot zero power condition (keff = 0.99) following trip from any credible operating condition assuming the most reactive RCC assembly is in the fully with-drawn position. ( FSAR p. 3.1.2-5) l. l

f~s In the unlikely event of a control rod withdrawal U incident, whether it be from suberitical condition, from full power operation, or at any other power level between these two extremes, the core and re-actor coolant system are not adversely affected. Protection is provided by the nuclear overpower re-actor trips, and the overtemperature J1T trip, as well as-by the overpower }}T trip, the fixed high and low pressure trips and high pressurizer level trips. (FSAR 14.1.2-4 through 14.1.2-5) o "The second reactivity control system shall be capable of reliably controlling the rate of reactivity changes result-ing from planned, normal power changes (including xenon , burnout) to assure acceptable fuel design limits are not exceeded." Response: The second reactivity control system consists of boron addition via the chemical and volume control system used in conjunction with the RCC assemblies. Control is provided by neutron absorbing control rods and by a soluble chemical neutron absorber (boric acid) in the reactor coolant. The concentration of boric acid is varied as necessary during the life of the core to compensate for: (1) changes in reactivity which occur with change in temperature of the reactor coolant 7s - ( from cold shutdown to the hot' operating, zero power

                                    . condition; (2) changes in reactivity associated with

()T

 \~

changes in the fission prcduct poisons xenon and samarium; (3) reactivity losses associated with the depletion of fissile inventory and buildup of long-lived fission product poisons (other than xenon and samarium); and (4) changes in reactivity due to burnable poison burnup. The control rods provide reactivity control for: (1) fast shutdown; (2) reactivity changes associated with changes in the average coolant temperature above hot zero power (core average coolant temperature is increased with power level); (3) reactivity associated with any void formation; (4) reactivity changes assoc-iated with the power coeffficent of reactivity. (FSAR

p. 3.2.1-1)

Any time that the reactor is at power, the quantity of boric acid retained in the boric acid tanks and ready for injection always exceeds that quantity required for the normal cold shutdown. This quantity always exceeds the quantity of boric acid required to bring the re-actor to hot shutdown and to compensate for subsequent xenon decay. The boric acid solution is transferred from the boric acid tanks by boric acids pumps to the suction of the

 ~Q A_j    charging pumps which inject boric acid into the reactor i

l

1

 /~N   coolant. Any charging pump and boric acid transfer V

pump can be operated from diesel generator power on loss of off-site AC power. Boric acid can be in-jected by one charging pump and one botic acid trana-fer pump at a rate which shuts the reactor down with no rods inserted in less than sixteen minutes. In sixteen additional minutes, enough boric acid can be injected to compensate for xenon decay although xenon decay below the equilibrium operating level will not begin until approximately 12-15 hours af ter shutdown. If two boric acid pumps and two charging pumps are available, these time periods are halved. Additional boric acid is employed if it is desired to bring the O(../ reactor to cold shutdown conditions. On the basis of the above, the injection of boric acid is shown to af ford backup reactivity shutdown capabil-ity, independent of control rod clusters which normally serve this f unction in the short term situation. Sh u t-down for long term and reduced temperature conditions can be accomplished with boric acid injection using redundant components. ( FSAR p. 9.2-2 through 9.2-3) A high degree functional reliability is assured in this system by providing standby components where per-formance is vital to safety and by assuring failure j s., safe response to the most probable mode of failure. (,) Special provisions include duplicate heat tracing with

                                           -                 alarm protection of lines, valves, and components
 %)                 normally containing concentrated boric acid.
                   ~The system has three high pressure charging pumps, each capable of supplying the normal reactor coolant pump seal and makeup flow.

The electrical equipment of the Chemical and Volume Control System is arranged so that multiple items receive their power from various 480 volt buses. Each of the three charging pumps are powered from separate 480 volt buses. The two boric acid trans-fer pumps are also powered from separate 480 volt buses. One charging pump and one boric acid transfer () pump are capable of meeting cold shutdown requirements j shortly after full-power operation. In cases of loss of AC power, a charging pump and a boric acid transfer pump can be placed on the emergency diesels if neces-sary. ( FSAR p. 9. 2-31) 1 o "One of the systems shall be capable of holding the reactor core subcritical under cold conditions." Response: Manually controlled' boric acid addition is used to , maintain the shutdown margin for the long term con- q l ditions of xenon decay and plant cooldown. Redundant

                   - equipment is provided to guarantee the capability of           l adding boric acid to the reactor coolant system.
 -( -)

(FSAR p. 3.1.2-4) 1 1 o I _

Criterion 27 - Combined reactivity control systems capa- , l's

 \/         bility. The reactivity control systems shall be designed to' have a combined capability, in conjunction with poison addition by the emergency core cooling system, of reliably controlling reactivity changes to assure that under postu-lated accident conditions and with appropriate margin for I

stuck rods the capability to cool the core is maintained. Response: Two independent reactivity control systems are provided, one involving rod cluster control (RCC) assemblies and the other involving chemical shimming. (FSAR p. 3.1.2-3) Sufficient shutdown capability is also provided to maintain the core subcritical assuming the most reac-(v~} tive rod to be in the fully withdrani position for the most severe anticipated cooldown transient asso-ciated with a single active failure,, e.g. , accidental opening of a steam bypass, or relief valve, or safety valve stuck open. This is achievea by the combina-tion of control and shutdown rods and automatic boric acid addition via the emergency cora cooling system. The minimum shutdown margin is calculated to be 1.95% assuming the maximum worth control zod in the fully withdrawn position allowing 10% uncertainty in the control rod calculation. ( FSAR 3.1.2-5 ) (^h V-

_2_ () The boron injection tank of the Safety Injection System (which constitutes ECCS) comtains boric acid at a nominal value of 20,000 ppm bacon (12% boric acid solution). This concentration of boric acid is adequate to prevent the reactor fran becoming critical following RCS cooldown during any credible steamline break accident. Manually controlled boric acid addition is used to maintain the shutdown margin for the long term con-ditions of xenon decay and plant carldown. Redundant equipment is provided to guarantee the capability of adding boric acid to the reactor coolant system. () (FSAR p. 3.1.2-5) The response to GDC 26 discusses Reactivity Control System redundancy and capability. 1

Criterion 28 - Reactivity limits. The reactivity control

 .O        systems shall be designed with appropriate limits on the potential amount and rate of reactivity increase to assure that the effects of postulated reactivity accidents can neither (1) result in damage to the reactor coolant pres-sure boundary greater than limited local yielding nor (2) suf ficiently disturb the core, its support structures or other reactor pressure vessel internals to impair signi-l'icantly.the capability to cool the core. These postu-lated reactivity accidents shall include consideration of rod ejection (unless prevented by positive means), rod dropout, steam line rupture, changes in reactor coolant temperature and pressure, and cold wster addition.

O Response: The reactor core and reactor coolant pressure boundary I are protected against the postulated reactivity accidents described by designing the control system with appropriate limits on the potential amount and rate of reactivity increase. Conservatively high values of the potential anorat and rate of reactivity addition are used in the safety analyses of postulated reactivity accidents given in documents (e.g. , Plant FSAR, Reload Safety Evaluation reports, fuel densifi-cation reports, etc.) provided to NRC as part of Indian Point 2 licensing basis requirements. During startup tests ejected rod worth, drop rod worth, t

   )            minimum shutdown boron and mode .a tor temperature

(') v coefficients were measured to verify the con-servative values of parameters used in the accident analyses. The reactor core and reactor coolant boundary are pro-tected against the postulated reactivity accidents by diverse and redundant trips including high flux and overpower and overtemperature AT trips. The nega-tive reactivity following a reactor trip is a function of the acceleration of control rods and variation in rod worth as a function of rod position. Control rod positions during trip were determined experimentally as a function of time using an actual prototype assembly (} under simulated flow conditions. The rod positions were combined with rod worth to define the negative reactivity insertion as a function of time used in safety analyses of reactivity accidents. The design value of shutdown margin is conservative enough so as to ensure that the reactor will not become critical following a credible steamline break accident. Also, the most limiting reactivity acci-dent involving the RCCA ejection does not result in core disruption. The peak reactor coolant pressure is less than that which would cause stresses to exceed faulted condition stress lindts and the O L)

4-f 3- , f

                                   - resulting pressure surge following this accident is insufficient to produce consequential damage to the primary coolant system.

i. } } i i. i i g i i i i - iO e i 4 1 i I i 1 4 1 -i .. i i i I 9

2. 4 a

                        -E  =                                 --ee.,

Criterion 29 - Protection against anticipated operational O)

 \_       occurrences. The protection and reactivity control sys-tems shall be designed to assure an extremely high pro-bability of accomplishing   their safety functions in the event of anticipated operational occurrences.

Response: The protection and reactivity control systems are designed to assure extremely high reliability in 4 performing their required safety functions in any anticipated operational occurrence. Likely failure modes of system components are designed to be safe modes. Equipment used in these systems is designed, constructed, operated, and maintained with a high , level of reliability. Loss of power to the protec-tion system results in a reactor trip. Details of system design are covered in Chapter 3 of the FSAR. Also refer to responses to General Design Criteria 20 through 26. , b u

   -. . . = .        .        ._. ... --.          - ..- . -- .-..,.. _           - .   - _ . ._   _. _ __ ___

r

                                                                                                               ;

O 1 I i i 1 IV. Fluid Systems t , i < l t O 4 4 I la i I i i + 1 I 4 l

9 i

1 l r l l 1 i 1

              ,,w---   - -,-,               ,, --,                 - - - ,-,

Criterion 30 - Quality of reactor coolant pressure boundary. Components which are part of the reactor coolant pressure k')s-- boundary shall be designed, f abricated, erected, and tested to the highest quality standards practical. Means shall be provided for detecting and, to the extent practical, identi-fying the location of the source of reactor coolant leakage. o " Components which are part of the reactor coolant pressure boundary shall be designed, f abricated, erected and tested to the highest quality standards p'ractical." Response: Quality standards of material selection, design, fabrication and inspection conform to the applicable provisions of recognized codes and good nuclear prac-tice, and all pressure-containing components of the () Reactor Coolant System have been designed, fabricated, inspected and tested in conformance with the appli-cable editions of the codes listed below: Requirements Pressure-Containing Items Component Piping Reactor Coolant Pump Volute ASME III, Class A ANSI B31.1 Pressurizer ASME III, Class A ANSI B31.1 Pressurizer Relief Tank ASME III, Class C ANSI B31.1 Pressurizer Safety Valves ASME III ANSI B 31.1 Steam Generators: Tube Side ASME III, Class A ANSI B 31.1 Shell Side ASME III, Class C ANSI B31.1 Reactor Vessel ASME III, Class A ANSI B31.1 Rod Drive Mechan' ism Housing ASME III, Class A --- Reactor Coolant Piping --- ANSI B31.1 ASME III - ASME Boiler and Pressure Vessel Code, SectionIII, Nuclear Vessels ANSI B31.1 - Code for Pressure Piping

   \#                  (FSAR p. 4.1-1 through 4.1-3, p. 4.1-14 , p. 4.1-23)

o "Means shall be provided for detecting and, to the extent practical, identifying the locations of the source of reactor coolant leakage. " Response: Positive indications in the control room of leakage of coolant from the Reactor Coolant System to the containment are provided by equipment which permits continuous monitoring of containment air activity and humidity, and of runoff from the condensate col-lecting pans under the cooling coils of the contain-ment air recirculation units. This equipment provides indication of normal background which is indicative of a basic level of leakage f rom primary systems and com-ponents. Any increase in the observed parmeters is rs

' (_)            an indication of change within the containment, and the equipment provided is capable of monitoring this change. The basic design criterion is the detection of deviations from normal containment environmental conditons including air particulate activity, radio-gas activity, humidity, condensate runof f and in

! addition, in the case of gross leakage, the liquid inventory in the process systems and containment sump. (FSAR p. 1.3-8, p. 6.7-1) l rm

   %J 1

Criterion 31 - Fracture prevention of reactor coolant (~)

   /         pressure boundary. The reactor coolant pressure boundary shall be designed with sufficient margin to assure that when stressed under operating, maintenance, testing and              '

postulated accident conditions 1) the boundary behaves in a non-bri ttle manner and 2) the probability of rapidly propagating fracture is minimized. The design shall reflect consideration of service temperatures and other conditions of the boundary material under operating, main-tenance, testing and postulated accident conditions and the uncertainties in determining 1) material properties,

2) the effects of irradiation on material properties, 3) residual, steady-state and transient stresses and 4) size of flaws.

Response: Margins-Operating Conditions The design pressure allows for operating transient changes. The selected design margin considers core thermal lag, coolant transport times and pressure drops, instrumentation and control response charac-teristics, and system relief valve characteristics. The design temperature for each component is se-

                     .cted to be above the maximum coolant temperature in that component under all normal and anticipated transient load conditions. The design and oper-ating pressure and temperatures of the respective i

(a)

(~}- V system components are listed in Tables 4.1.2 through 4.1.6 of the F.S.A.R. (F.S.A.R. p. 4.1-10) Transients All components in the Reactor Coolant System are designed to withstand the ef fects of cyclic loads due to reactor system temperature and pressure changes.- These cyclic loads are introduced by normal unit load transients, reactor trip, and startup and shutdown operation. The number of thermal and loading cycles used for design purposes and the bases thereof are given in Table 4.1.8 of the F.S.A.R. During unit startup and shutdown, the , rates of temperature and pressure changes are limited as indicated in F.S.A.R. Section 4.4.1. The effect of loss of flow and loss of load tran-sients have been analytically evaluated and are included in the fatigue analysis for primary system components. Over the range from 15% full power up to and including but not exceeding 100% of full power, the Reactor Coolant System and its compo-nents are designed to accommodate 10% of full power step changes in plant load and 5% of full power per minute ramp changes without reactor trip. The Re-actor Coolant ' System will accept a complete loss of load from full power with reactor trip. In addi-( )- tion, the turbine bypass and steam dump system

                             /~}  makes it possible to, accept a step load decrease v

of 50% of full power without reactor trip. Postulated Accicent Conditions-Seismic The Reactor Coolant System is classified and de-i signed as Class I for seismic design, requiring that there will be no loss of function of such equipment in the event of the assumed maximum potential ground acceleration acting in the horizontal and vertical directions simultaneously, when combined with the primary steady state stresses. The seismic loading conditons are established by (% a m) the " operating basis earthquake" and " design basis earthquake." The former is selected to be typical of the largest probable ground motion based on the site seismic history. The latter is selected to be the largest potential ground notion at the site based on seismic and geological factors and their uncertainties. l l 1 For the " design basis earthquake" loading condition, j the nuclear steam supply system is Eesigned to be l capable of continued safe operation. Therefore, for this loading conditon critical structures and equipment needed for this purpose are required to O) (_ operate within normal design limits. The aseismic

1 l () design for the " maximum potential earthquake" is intended to provide a margin in design that assures capability to shut down and maintain the nuclear facility in a safe conditon. In this case, it is only necessary to ensure that the Reactor Coolant System components do not lose their capability. to perform their safety f unction. In addition, the Atomic Safety and Licensing Appeal Board appointed to review the seismology and geology around the Indian Point site concluded that the plant design need only be adequate to withstand an Intensity VII earthquake and that a value of 0.159 ( }) was appropriately assigned to the maximum vibratory ground motion (acceleration) which might result from such an earthquake. The criteria adopted for allowable stresses and stress intensities in vessels and piping subjected to normal loads plus seismic loads are defined in the F.S.A.R. Appendix A. These criteria assure the integrity of the Reactor Coolant System under seismic loading. For the combination of normal and design earthquake loadings, the stresses in the support structures are kept within the limits of the applicable codes. ( F. S. A. R. p. 4.1-11) . () . For 'the combination of normal and no-loss-of-

(~) v function earthquake loadings the stresses in the , support structures are limited to values as necessary to assure their integrity and to main-tain the -stresses in the Reactor Coolant System components within the allowable limits as pre-viously established. Irradiation Effects The service life of Reactor Coolant System Pres-sure components depends upon the end-of-life mate-rial radiation damage, unit operational thermal cycles, quality manufacturing standards, environ-mental protection, and adherence to established (~'g operating procedures. v The reactor vessel is the only component of the Reactor Coolant System which is exposed to a significant level of neutron irradiation and it is therefore the only component which is subject to material radiation damage effects. The NDTT shif t of the vessel material and we3ds, due to radiation damage effects is monitored by a radia-tion damage surveillance program which conforms with ASTM-E185 standards. Reactor sessel design , is based on the transition temperatare method of l

                                                                   \

i evaluating the possibilicy of brittDe fracture of I l i (~) u

( ) the vessel material, as a result of operations such as leak testing and plant heatup and cooldown. In the core region of the reactor vessel it is expected that the notch toughness of the material will change as a result of f ast neutron exposure. This change is evidenced as a shif t in the Nil Ductility Transition Temperature (NDTT) which is factored into the operating procedures in such a manner that full operating pressure is not obtained until the affected vessel material is above the Design Transition Temperature (DTT) and in the ductile material region. The pressure during () startup and shutdown at the temperature below NDTT is maintained below the threshold of concern for safe operation. The DTT is a minimum of NDTT plus 60 F and dictates the procedures to be followed in the hydrostatic test and in station operations to avoid excessive cold stress. The value of the DTT is increased during the life of the plant as required by the expected shift in NDTT, and as confirmed by the experimental data obtained from irradiated speci-mens of reactor vessel materials during the plant lifetime. Further details are given in Section f') v 4.1.6 of the F.S.A.R.

Criterion 32 - Inspection of reacter coolant pressure

    -       boundary. Components which are part of the reactor coolant pressure boundary shall be designed to permit 1) periodic inspection and testing of important areas and features to assess their structural and leak-tight integrity and 2) an appropriate material surveillance program for the reactor pressure vessel.

Response: Periodic Inspection The design of the reactor vessel and its arrange-ment in the system provides the capability for accessibility during service life to the entire internal surfaces of the vessel and certain exter-nal zones of the vessel including the nozzle to r

 \               reactor coolant piping welds and the top and bottom heads. The reactor arrangement within the containment provides suf ficient space for inspec-tion of the external surfaces of the reactor ,

coolant piping, except for the area of pipe within the primary shielding concrete. Surveillance Program Monitoring of the Nil Ductility Transition Tem-perature properties of the core region plates forgings, weldments and associated heat treated zones are performed in accordance with ASTM E185 (Recommended Practice for Surveillance Tests on

s_/ Structural Maerials in Nuclear Reactors) . Samples i

i

r3 of reactor vessel plate materials are retained V and catalogued in case f uture engineering develop-ment shows the need for f urther testing.

               ~

The material properties surveillance program in-cludes not only the conventional tensile and impact tests, but also fracture mechanics specimens. The fracture mechanics specimens are the Wedge Opening Loading (WOL) type specimens.

To define permissible operating conditions, pres-sure/ temperature curves are established for warm-up and cool-down which satisfy reactor vessel stress criteria. These are based on the most

  - ()   limiting anticipated reference nil ductility temperature (RTndt) at the end of a given period.

, Since the normal operating temperature of the re-actor vessel is well above the maximum expected DTT, brittle fracture during normal operation is not considered to be a credible mode of failure. Two capsules containing samples of reactor vessel plate materials have already-been withdrawn from the reactor vessel. Refer to the response to 10CFR50, Appendix H for details. 4 a I v

  -           Criterion 33 - Reactor Coolant Makeup. A system to supply (s' ')       reactor coolant makeup for protection against small breaks in the reactor coolant pressure boundary shall be provided.

The system safety function shall be to assume that speci-fled acceptacle fuel design limits are not exceeded as a result of reactor coolant loss due to leakage from the reactor coolant pressure boundary, and rupture of small piping or other small components which are part of the boundary. The system shall be designed to assure that for on-site electrical power system operation (assuming of f-site power is not available) and for of f-site electrical power system opeation (assuming on-site power is not available) the system safety f unction cam be accomplished "T (J using the piping, pumps, and valves, used to maintain coolant inventory during normal reactor operation. o " A system to supply reactor reactor coolant makeup for protection against small breaks in the reactors coolant pressure boundary shall be provided." , Response:. The Chemical and Volume Control System and the Safety Injection System provide makeup for protection against small breaks. Ruptures of very small cross sections will cause expulsion of coolant at a rate whici can be accommo-dated by the charging pumps. ( FSAR p. 14. 3.1)

  <~

v

g3 The flow from one (1) of the three (3) safety injec-V tion pumps is sufficient to meet design requirements for make up of coolant following a small break which does not immediately depressurize the Reactor Coolant System to the accumulator discharge pressure. (FSAR p. 6.2.2) o "The system safety ' unction shall be to assure that speci-fled acceptable fuel design limits are not exceeded as a result of reactor coolant loss due to leakage from the

reactor coolant pressure boundary and rupture of small piping or other small components which are part of the boundary." m (,). Response: For small breaks, the Safety Injection System, even when operating on emergency power, limits the cladding temperature of the fuel to below the melting tempera-ture of Zircoloy-4 and below the temperature at which gross core geometry distortion, including clad frag-mentation, may be expected. For very small ruptures (leakage), the charging pumps would maintain an oper-ational level in the pressurizer permitting the oper-ator to execute an orderly shutdown. ( FSAR p. 14. 3.1) o "The system shall be designed to assure that for on-site electrical power system operation (assuming off-site power is not available) and for of f-site electric power () system operation (assuming on-site power is not available)

 -( )       the system safety function can be accomplished using the

, piping, pumps, and valves used to maintain coolant inven-tory during normal reactor operation." Response: The Chemical and Volume Control System and the Safety Injection System are normally powered f rom the ! off-site electrical power system. In the event of the loss of the off-site electrical power system, both systems can be powered from the on-site diesel

                      . generator system.                       ( FSAR p. 6.2.3,                     9.2.3) l l

l l l

l I

                              ,           _ . _ _, . . . - - -        y-, -, - - . _ - - - -   -
                                                                                                           - - - - - - *   * * * ~ * ' ~ ~'

_ Criterion 34 - Residual heat removal. .A system to remove

 \/         residual heat shall be provided. The system safety func-tion shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the de-sign conditions of the reactor coolant pressure boundary are not exceeded.

Suitable redundancy in components and features, and suit-able interconnections, leak detection, and isolation capa-bilities shall be provided to assure that for onsite electric power system operation (assuming odfsite power is not available) and for offsite electric power system oper-ation (assuming onsite power is not available) the system ( safety function can be accomplished, assuming a single failure. o "A system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. " Response: A system to remove residual heat is provided. The residual heat removal (RHR) system, in conjunction with the steam and power conversion system, is designed to trnasfer the fission product decay heat

J (}' -and other residual heat from the reactor core at a rate such that specified acceptable design limits are not exceeded. The residual heat removal loop is designed to remove residual and sensible heat from the core and reduce the temperature of the Reactor Coolant System during the second phase of plant cooldown. During the first 1 phase of c6oldown, the temperature of the Reactor Coolant System is reduced by transferring heat from the Reactor Coolant System to the Steam and Power 4 Conversion System. (FSAR p. 9.3.-1) j The Steam and Power Conversion System can receive (4 and dispose of, in its cooling systems and through atmospheric relief valves, the total heat existent or produced in the Reactor Coolant System following an i emergency shutdown of the turbine generator from a full load conditon. ( FSAR p. 10.1.1) One turbine and two electric driven auxiliary feedwater pumps are provided to ensure.that adequate feedwater i is supplied to the steam generators for reactor decay heat removal under all circumstances, including loss of power and normal heat sink. Feedwater flow can be maintained until either, power is restored, or reactor

  .. decay heat removal can be accomplished by other means.

l (FSAR p. 10.1.1)

Criterion 38 - Containment heat removal. A system to re-

~N       move heat from the reactor containment shall be provided.

(C The system safety function shall be to reduce rapidly, consistent with the functioning of other associated sys-tems, the containment pressure and temperature following any loss-of-coolant accident and maintain them at accept-ably low levels. Suitable redundancy in components and features, and suit-able interconnections, leak detection, isolation, and containment capabilities shall be provided to assure that for onsite electric power system operation (assuming off-site power is not available) and for offsite electric power system operation (assuming onsite power is not ('T available) the system safety function can be accomplished, U assuming a sin'gle failure. Response: ' Adequate heat removal capability for the Containment is provided by two separate, full capacity, engi-neered safety features systems. These are the Con-tainment Spray System, and the Containment Air Recirculation Cooling and Filtration System. These systems are of different engineering principles and , serve as independent backups for each other. l 1 (FSAR p. 6.4-1) I l Containment Air Recirculation System The Contaimment Air Recirculation Cooling and Filtra-p) ( tion System is designed to recirculate and cool the

() containment atmosphere in the event of a loss-of-coolant accident and thereby ensure that the con-tainment pressure will not exceed its design value of 47 psig at 271 F (100% relative humidity). Although the water in the core af ter a loss-of-coolant accident is quickly subcooled by the Safety Injection System, the Containment Air Recirculation Cooling and Filtra-1 tion System is designed on the conservative assump-tion that the core residual heat is released to the containment as steam. (FSAR p. 6.4-1) Any of the following combinations of equipment will provide sufficient heat removal capability to main-() tain the post-accident containment pressure below the design value, assuming that the core residual heat is released to the containment as steam. (FSAR p. 6.4-1) I

1) All five containment cooling f ams

2) Both containment spray pumps (azd one of the two spray valves in the recirculation path) .

3) Three of the five containment cooling fans and one containment spray pump.

3 Containment Cooling System Characteristics The air recirculation system consists of five 20%

 ' ')- capacity air handling units, each imcluding a motor,

(} _ fan, cooling coils, moisture separator, roughing filters and HEPA filters, duct distribution system, instrumentaiton and controls. The units are located on the intermediate floor between the containment wall and the primary compartment shield walls. In addition, each of the five air-handling units is equipped with an activated charcoal filter unit, normally isolated from the main air recirculation stream. The air flow (air-steam mixture) is bypassed through the charcoal filter units to remove volatile iodine following an accident. (FSAR p. 6.4-8) i Each fan is designed to supply 65,000 cfm at approxi-mately 22.8" s.p., 2710 F, 0.175 lb/ft 3 density. The {} fans are direct driven, centrifugal type, and the coils are plate fin-tube type. Each air handling, unit is capable of removing 76.32 x 10 6 Btu /hr from the. containment atmosphere under accident conditions. Two thousand gpm of service (cooling) water is supplied to each unit during accident conditions. The design i maximum river water inlet temperature is 85 F which results in a maximum outlet temperature of 161 F. (FSAR p. 6.4-8) Air operated, tight closing, 125 lb USAS' butterfly valves isolate.any inactive air handling unit from the duct distribution system. Duct work distributes

   )

i

(~N the cooled air to the various containment compartments and areas. During normal operation, the flow sequence through each air handling unit is as follows: Mois-ture separator, cooling coils, roughing filters, HEPA filters, f an, discharge header. (FSAR p. 6.4-9) In the event of an accident, the flow sequence would

       , be the same except that the f an discharge would be automatically diverted by air operated butterfly valves to a compartment containing the charcoal filters before entering the discharge header for distribution.   ( FSAR p. 6.4-9)

Cooling Water for the Fan Cooler Units

     )   The cooling water requirements for all five fan cool-ing units during a major loss of primary coolant ac-cident and recovery are supplied by two of the three nuclear service water pumps.     (FSAR p. 6.4-12)

The cooling water discharges from the cooling coils to the discharge canal and is monitored for radioac-tivity by routing a small bypass flow from each unit through a common radiation mor.itor. Upon indication of radioactivity in the ef fluent, each cooler dis-charge line is monitored individually to locate the defective cooling coil, which when identified would remain isolated, operation would continue with the e (n). remaining units. The service water system pressure

at locations inside the containment is 15 to 20 psig,

 . t( ')

which is below the containment design pressure of 47 psig. However, since the cooling coils and service water lines are completely closed inside the contain-4 ment, no contaminated leakage is expected into these units. (FSAR p. 6.4-12) Local flow and temperature indication is provided outside containment, for service water flow to each cooling unit. Abnormal flow alarms are provided in the control room. (FSAR p. 6.4-13) During normal plant operation, flow through the cool-ing units is throttled for containment temperature 1 C control purposes by a valve on the common discharge header from the cooling units. Two independent, full flow, isolation valves open automatically in the' event of a high containment pressure signal or safety injec-tion signal to bypass the control valve. Both valves fail in the open position upon loss of air pressure and either valve is capable of passing the full flow required for all five fan cooling units. (FSAR p. 6.4-13) A failure analysis has been made on all active compo-nents of the system to show that the failure of any single active component will not prevent f ulfilling C> s m the design function.

                           3   Containpent Spray System

,_) The containment spray system also separately provides adequate containment cooling. The design basis is to provide sufficient heat removal capability to maintain the post-accident containment pressure below 47 psig, assuming that the core residual heat is released to the containment as steam. (FSAR p. 6.3-4) The principal components of the Containment Spray Sys-tem which provides containment cooling and iodine re-moval following a loss-of-coolant accident consist of two pumps, one spray additive tank, spray ring () headers and nozzles, and the necessary piping and valves. The containment spray pumps are located in the primary auxiliary building. The spray pumps take suction directly from the refueling water storage tank and recirculate water from the containment sump by the diversion of a portion of the recirculation flew from the Safety Injection System to the spray headers .inside the containment af ter injection from the refueling water storrage tank has been terminated. (FSAR p. 6.3-5) The spray system is des igned to operate over an extended time period, following a Reactor Coolant O () System failure, as required to restore and maintain

() containment conditons at or near atmospheric pres-sure. It has the capability of reducing the con-tainment post-accident pressure and consequent containment leakage. (FSAR p. 6.3-4) Neither a single active component failure in such systems during the injection phase nor an active / passive failure during the recirculation phase will de: :ade the design heat removal capability of con-tainment cooling. (FSAR p. 6.3-4) System piping located within the containment is re-dundant and separable in arrangement unless fully protected from damage which may follow any Reactor

  )

(_/ x- Coolant System loop failure. ( FSAR p. 6.3-4) System isolation valves relied upon to operate for containment cooling are redundant, with automatic actuation.- (FSAR p. 6.3-4) All associated components, piping, structures, and power supplies of the Containment Spray System are designed to Class I seismic criteria < Both the containment spray system and the contain-ment air _ recirculation cooling and filtration system are operable from either of the onsite or of fiste electric power systems, in the event that either one (m. x-) of those systems are unavailable.

i

3-l' g A discussion of the onsite and offsite power systems - is contained in the response to General Design i i- ' Criteria 17. t I 1 > i l .! 1' l

                                                                                                                                                                                                                                                                                                               ;

t i ~! ,r i t' i N ll 1 r I i  : e. - t L l k i f i  ! t , j-i- i t s-l. L ! L r 1 I - ( ! i f i..

 ,x Criterion 39 - Inspection of containment heat removal I ')        system.- The containment heat removal system shall be designed to permit appropriate periodic inspection of important components, such as the torus, sumps, spray nozzles, and piping to assure the integrity and capa-bility of the sytem.

o ... The containment heat removal system shall be designed to permit appropriate periodic inspection of important components ... to assure the integrity and capability of the system ..."

Response

The containment heat removal system has been designed to permit appropriate periodic inspection of important

() system components. Access is available for visual inspection of the containment fan-cooler and recir-culation filtration components including fans, cool-ing coils, butterfly valves, filter units and duct-work. Provision has been made for ready removal of a section of the filter banks for inspection and testing. ( FSAR p. 6.4-25) Where practicable, all active coraponents and passive components of the Containment Spray system are in-spected periodically to demonstrate system readiness. The pressure containing components are inspected for leaks from pump seals, valve packing, flanged joints and safety valves. During operational testing of v(') .

i - 2;-

• t' I

i 1' .

                                                                . the . containment spray pumps, the portions of the l-1 system . subjected to pump pressure are inspected for-                                                                                                                                                   ;

1 l leaks.. ( FSAR p. 6. 3-17 ) r  ! I i a -

!                                                                                                                                                                                                                                                                          I

j.  !

t i } l 1 t t i r !, .l , k - } l I l  ! i i t i . j9 4

                                                                                                                                                                                                                                                                       -l l~

4 l

I i

-

t } 'I i j' .[ l 1 i i i l 1 i j- , i I 1 l l

;

)  : i l l g , i j i , A l

3 Criterion 40 - Testing of containment heat removal system. Y Thc containment heat removal system shall be designed to permit appropriate periodic pressure and functional test-ing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the system, and (3) the opera-bility of the system as a whole, and, under conditions as close to the design as practical, the performan e of the i full operational sequence that brings the system'into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of the asso-ciated cooling water system. O

 \   Response:   The Containment Air Recirculation Cooling and Filtra-tion System is designed to the extent practical so

, that the components can be tested periodically, and af ter any component maintenance, for operability and functional performance. (FSAR p. 6.4-2) The air recirculation and cooling units, and the t,6rvice water pumps, which supply the cooling units, are in operation on an essentially continuous schedule during plant operation, and no additional periodic tests are required. ( FSAR p. 6.4-2) Means are provided to test initially to the extent f~ V) practical the fall operational sequence of the Air

Recirculation System including transfer to alternate [V'T power sources. (FSAR p. 6.4-2) The charcoal filters of the Filtration System are bypassed during normal operation by closed butterfly valves. The valves in a non-operating unit can be periodically tested by actuating the controls and verifying deflection by instruments in the Control Room. ,Since the fans are nor-mally in operation, no additional periodic fan tests are necessary. (FSAR p. 6.4-3) i Representative sample elements in each of the activated charcoal filter plenums are removed periodically during shutdowns and laboratory tested to verify their continued efficiency. After reinstallation the filter units will be tested in place by aerosol injection to determine integrity of the flow path. (FSAR p. 6.4-3) Means are provided to test initially under condicions as close to design as is practical the full operational sequence that would bring the Containment Air Recircula-tion Cooling and Filtration System into action, including i transfer to the emergency diesel-generator power source. (FSAR p. 6.4-4) Containment Spray System Capability is provided to test initially to the extent practical the operational start-up sequence of the

     }

                                        ' (O
       )   Containment Spray System including the transfer to alter-nate power sources. A test signal simulating the contain-ment spray signal is used to demonstrate the operation of the spray system up to the isolation valves on the pump discharge using the test steps. The isolation valves are blocked closed for the test. These isolation valves are checked separately.

Permanent test lines for the containment spray loops are located so that all comnonents ! , to the isolation valves at the spray nozzles may be tested. These isolation valves are checked separately. 4 The air test lines, for checking that spray nozzles are x not obstructed, connect downstream of the isoldtion valves. Air flow through the nozzles is monitored periodically to verify proper f unctioning of the nozzles. . . )

Criterion 41 - Containment atmosphere cleanup. Systems to (_.

     \

control fission products, hydrogen, oxygen, and other sub-stances which may be released into the reactor containment shall be provided as necessary to reduce, consistent with the functioning of other associated systems, the concen-tration and quality of fission products released to the environment following postulated accidents, and to control the concentration of hydrogen or oxygen and other sub-stances in the containment atmosphere following postulated accidents to assure that containment integrity is main-tained. Each system shall have suitable redundancy in components and features, and suitable interconnections, leak detec-s/ tion, isolatio.n, and containment capabilities to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not i available) its safety function can be accomplished, assuming a single failure.  ; o " Systems to control fission products, hydrogen, oxygen, and other substances which may be released into the reac- , tor containment shall be provided as necessary to reduce, consistent with the f unctioning of other associated systems, the concentration and quality of fission products released to the environment following postulated accidents." p) q

Response: Following a loss-of-coolant accident both the contain-ment spray system and reactor containment fan cooler systems are placed in operation for fission product reduction, heat removal and containment air recircu-lation. The Containment Air Recirculation Cooling and Filtra-tion System provides the design heat removal capacity and the design iodine removal capability for the containment following a loss-of-coolant accident assuming that the core residual heat is released to the containment as stean. The system accomplishes this by continuously recirculating the air-steam mixture: 1) through cooling coils to transfer heat from containment to service wcter, and 2) through activated charcoal filters to transfer methyl iodide to the filters from the air-steam mixture. The principal components of the Containment Spray System which provide containment cooling and iodine removal following a loss-of-coolant accident consists of two pumps, one spray additive tank, spray ring headers and nozzles, and the necessary piping and valves. The containment spray pumps and the spray additive tank are located in the primary auxiliary building and the spray pumps take suction directly r3 from the refueling water storage tank. .V

() The Containment Spray-System also utilizes the two 100% capacity recirculation pumps, two residual heat exchangers and associated valves and piping of the Safety Injection System for the long term recircula-tion phase of containment cooling and iodine removal after the refueling water storage tank has been exhausted. The spray water is injected into the containment through spray nozzles connected to four 360 degree ring headers located in the containment dome area. Each of the spray pumps supplies two of the ring i headers. p). (_ Any of the following combinations of equipment will 4 provide suf ficient heat removal capability to main-tain the post-accident containment pressure below the design value assuming that the core residual heat is released to the containment as steam.

1) All five containment cooling fans.

2) Both containment spray pumps (and one of the two

. spray valves in the recirculation path).

3) Three of the five containment cooling fans and one containment spray pump.

Any of the combinations of equipment (spray pumps and fans) required for containment beat removal will

 =pY

() provide sufficient iodine trapping capability to ensure post-accident fission product leakage (based on TID - 14844 release fractions) which would not result in exceeding the dose limits of 10 CFR 100. (FSAR p. 6.3-5, 6.3-6, 6.3-15 and 6.4 21) In addition to the systems mentioned above, a Post-Accident Venting System is provided for removal of combustible hydrogen from the containment as well. This system consists of a common penetration line which acts as a supply line through which hydrogen free air can be admitted to the containment, and an exhaust line, with parallel valving and piping, () through which hydrogen bearing gases from contain-ment may be vented through a filtration system o "and to control the concentration of hydrogen or oxygen and other substances in the containment atmosphere follow-ing postulated accidents to assure that containment integ-rity is maintained." Response: Two independent diverse systems are provided for re-moval of combustible hydrogen from the containment building atmosphere: (a) the hydroien recombiners, and (b) the post-accident containmeat venting system. Either of the two (2) hydrogen recombiners or the post-accident containment venting s3 stem are capable

of wholly providing this f unc' ion in the event of a (} design basis accident. l Two full rated hydrogen recombination systems are provided in order to control the hydrogen evolved in the containment following a loss-of-coolant accident. Either system is capable of preventing the hydrogen concentration from exceeding 2% by volume within the containment. Each of the hydrogen recombination sys-tems is separate from the other. Each system consists of the following major items.

a. Combustor unit located inside of the containment.

b. Control panel located outside of the containment.

c. Hydrogen gas stand located outside of the con-tainment.

Each combustor system includes two (2) ignitors (one { is a spare) with an excitor for each ignitor. Each combustor has two (2) temperature detectors (one is a spare) to monitor combustor temperature. Each combustor has two (2) differential pressure measuring

                                                                                            ?

instruments to detect blower operation, only one  ! instrument is requried for operation. Power supplies for the blowers and ignitors are separate, so that O

                                        /~'s             loss of one power supply will not af fect the remain-V ing system.    (FSAR Question 6.8b(2)-1)

The post-accident venting system is used only in the absence of hydrogen recombiners and only when absolutely necessary, consistent with minimizing offsite radiation doses. o "Each system shall have suitable redundancy in components and features, and suitable interconnections, leak detec-tion, isolation, and containment capabilities to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not avail-able) its safety function can be accomplished, assuming a single failure." Response: A failure analysis has been made on all active compo-nents of the containment spray and fan cooler systems to show that the

• failure of any single active component will not prevent fulfilling the design function. '

Independent alternate power systems are provided with adequate capacity and testability to. supply the re-quired engineered safety features and protection sys-tems. (FSAR p. 6.3-15 and 6.4-22) The normal source of auxiliary power during plant f\ (_/ operation is the generator.- Power is supplied via i I l . l t o i

                               /^S  the unit auxiliary transfermer which is connected to U

the main leads of the generator. Standby power required during plant startup, shut-down and after reactor trip is supplied from the Consolidated Edison Co.138 kv system by overhead line from a substation approximately 3/4 mile from the plant to the station auxiliary transformer. In addition, three gas turbines are available, each with g emergency blackout startup capability. (FSAR p. 8.1-2) Gas turbine power can be provided to Indian Point I Unit 2 from any of the three gas turbines via either of the two 13.8 kv underground feeders or two 138 kv sverhead feeders which connect of f-site power to the unit. Maximum flexibility of routing is provided by interties at the Buchanan Substatioe (138 kv and 13.8 kv buses) and at the Indian Point s5te (138 kv site switchyard and gas turbine substation 6.9 kv bus tie). (Letter dated 4/11/80 from J. D. O'Toole (Con Ed) to H. R. Denton (NRC) concerning. 60 Interim Action items.) l The diesel genrators are each connected to their re-l spective engineered safety features buses to supply l l emergency shutdown power in the evert of loss of all other a.c. auxiliary power.

(} Emergency power supply for vital instruments and controls and supplies for emergency lighting is from four 125 volt de station batteries.

The diesel-generators are located adjacent to the primary auxiliary building and each are connected to three (3) separate 480 volt auxiliary system buses. Each diesel will be started automatically on a safety injection signal or upon the occurrence of undervoltage on any 480 volt bus. Any two diesels have adequate capacity to supply the engineered safety features for the hypothetical accident

concurrent with loss of outside power. (FSAR p. 8.1-3) l l

1 l { l O i

                                        ,   . . _.-. - ,- -,       .r  - - - - . , .      - - - ----e

Criterion 42 - Inspection of containment atmosphere cleanup

  .O        systems. The containment atmosphere cleanup systems shall be designed to permit appropriate periodic inspection of important components, such as filter frames, ducts, and piping to assure the integrity and capability of the sys-tems.

Response: The atmospheric cleanup systems have been designed to permit appropriate periodic inspections of the impor-tant components of the systems. Access is available for visual inspection of the containment fan-cooler and recirculation filtration components including fans, cooling coils, butterfly () valves, filter units and ductwork. Provision has been made for ready removal of a section of the , filter banks for inspection and testing. (FSAR p. 6.4-25) All components of the Containment Spray System are inspected periodically to demonstrate system readiness. The pressure containing systems are inspected for leaks from pumps seals, valves packing, flanged joints and safety valves during system testing. During the operational testing of the containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks.

   %-              (FSAR p. 6.3-17)

        .. .~.           -        -.       - - . . _ _    -~ .   .-

_.2 - The pressure containing systems are inspected for leaks from pumps seals, valves packing, flanged joints and safety valves during system testing.

• During the operational testing of the containment spray pumps, the portions of the system subjected to pump pressure are inspected for leaks.

( FSAR p. 6 3-17)

;                               .
]

i t O O

Criterion 43 - Testing of containment atmosphere cleanup s- systems. The containment atmosphere cleanup systems shall be designed to permit appropriate periodic pressure and functional testing to assure (1) the structural and leak-tight integrity of its components, (2) the operability

and performance of the active components of the systems such as fans, filters, dampers, pumps, and valves and (3) the operability of the systems as a whole and, under con-ditions as close to design as practical, the performance of the full operational sequence that brings the systems into operation, including operation of applicable portions of the protection system, the transfer between normal and emergency power sources, and the operation of associated A systems.

V Response: Any of the activated charcoal filter absorbers in the i air handling units can be removed and tested periodi- ! cally for effectiveness in removing methyl iodine i forms. In addition, periodic, inplace testing of the filtration assemblies can be made by injection of a freon aerosol in the air stream at the filter inlet I to verify the leak-tightness of individual filter l elements and their frame seals. After reinstalla- 1 tion, following testing, the filter charcoal units can be tested in place by aerosol injection to deter-mine integrity of the flow path. The butterfly valves on each air handling unit can be operated i I

l j i I () periodically to assure continued operability. The degree of leak tightness of the valves was estab-lished by test at the time of installation. (FSAR p. 6.4-26, 6.4-27)  ;

                                                                      )

l The functional test of the Safety Injection System I will demonstrate proper transfer and sequencing of the fan motor supplies from the diesel generators in the event of loss of power. A test signal will be used to demonstrate proper valve motion and fan starting prior to installation of the charcoal filters. This test will varify proper functioning of the vane-switch flow indicators. (FSAR p. 6.4-27) O'- The containment spray pumps are tested singly by opening the valves in the miniflow line. Each pump in turn is started by operator action and checked for flow establishment. The spray injection valves are tested with the pumps shutdown. ( FSAR p. 6.3-18) The spray eductors are tested singly by opening the valves in the pump miniflow lines, the valves in the . eductor bed line from the RWST and running the respective pump. The operator observes the eductor suction flow. (FSAR p. 6.3-18) The spray additive tank isolation valve can be opened j {s') s period . ally for testing. The contents of the tank

3 () are periodically sampled to determine that the required solution is present. (FSAR p. 6.3-19) The valves in the dousing lines to the charcoal filter units may be exercised during a shutdown after the spray header drains are opened to ensure that the header is empty. (FSAR p. 6.3-19) During these tests the equipment is visually inspected for leaks. Leaking seals, packing or flanges are tightened to eliminate the leak. valves and pumps are operated and inspected after any maintenance to ensure proper operation. (FSAR p. 6.3-19) () The functional test of the Safety Injection System demonstrates proper transfer to the emergency diesel generator power source in the event of a loss of power. A test signal simulating the containment spray signal is used to demonstrate the opcration of the spray system up to the isolation valves on the pump discharge using the test pumps. The isolation valves are blocked closed for the test. These isola-tion valves are checked separately. (FSAR p. 6.3-18) O

Criterion 44 - Cooling water. A system to transfer V heat from structures, systems, and components important to safety, to an ultimate heat sink shall be provided. The system safety function shall be to transfer the com-bined heat load of these structures, systems, and com-ponents under normal operating and accident conditions. Suitable redundancy in components and features, and suit-able interconnections, leak detection, and isolation capabilities shall be provided to asure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety f unction can be accomplished, assuming a single failure. o "A system to transfer heat from structures systems and components important to safety to an ultimate heat sink shall be provided." Response: A component cooling loop is provided to remove re-sidual and sensible heat from the Reactor Coolant i System,- via the residual heat removal loop, during plant shutdown; cool the letdown flow to the Chemical Volume and Control System during power operation; and to provide cooling to dissipate waste heat from various primary plant components. (FSAR p. 9.3-1) 0

2.- {'}

  .s The service water system is provided to supply cool-ing water from the Hudson River to various heat loads in both the primary (i.e. component cooling loop) and secondary portions of the' plant.  (FSAR 9.6-1) i       o      "The systems safety f unction shall be to transfer the com-bined heat load of these structures systems and components under normal operating and accident conditions."

Response: The service wa ter and component cooling system have provisions to ensure a continuous flow of cooling water to those systems and components necessary for  ! plant safety either during normal operation or under abnormal and accident conditons. (FSAR p. 9.6-1) o " Suitable redundancy in components and features, and suit-able interconnections, leak detection and isolation capa-bilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished assuming a signal failure." Response: Active loop components in the service water and com-

                   . ponent cooling systems which are relied upon to per-form the cooling function are redundant. Redundancy of components in the process cooling loop does not

(~)/

 \_

4

(~) v degrade the reliability of any system which the pro-cess loop serves. (FSAR p. 9.3-1 and 9.6-1) The component coolant loop design provides for detec-tion of radioactivity entering the loop from reactor coolant sources and also provides for isolation means. The service water system has six identical vertical, centrifugal sump-type pumps, each having a capacity of 500 gpm at 220 ft TDH, to supply service water to two independent discharge headers, each header being supplied by three of the pumps. An automatic , con-tinuous, rotary type strainer is in the discharge of each pump, and is capable of removing solids down to 1/8 inch diameter. Each header is connected to an independent supply line. Either of the two supply lines can be used to supply the essential loads, with the other line feeding the non-essential loads. The essential loads which must be scpplied with cool-ing water immediately, in the event of a blackout and/or loss-of-coolant accident are supplied by the nuclear service water header. During normal operation, the essential loads are sup-plied by one of the three pumps available. The non-essential loads are supplied by two of the three (7) pumps provided. s ._) t

_4_

 <N Following a simultaneous incident. and blackout, the    !

bus]

                                                                 \

cooling water requirements for essential loads can be 1 supplied by any two of the three service water pumps l l on the header designated to supply the nuclear and essential secondary load supply lines. Any two of these three pumps can be powered by the emergency diesels. These emergency powered pumps are those necessary and sufficient to meet blackout and emer-gency conditons. Either one of the two sets of three

pumps can be placed on the diesel starting logic. (FSAR p. 9.6-3) O

    \

L-)

Criterion 45 - Inspection of cooling water system. The (~N cooling water system snall be designed to permit appro-U priate periodic inspection of important components, such as heat exchangers and piping, to assure the integrity and capability of the system. Response: The active components of the component cooling and service water sytems are in either continuous or intermittent use during normal plant operation. (FSAR p. 9.3-19) The routine operation of these systems serves to verify their continued functional and structural integrity. With the exception of buried portions of the service water system piping, these systems are designed ,to permit appropriate periodic inspection of important system components, such as heat ex-changers and piping, to assure the integrity and capability of the system. Periodic visual examination of system components is performed in accordance with the requirements of the AbME B&PV Code Section XI, as applicable. System leakage can be determined by several means: (FSAR p. 9.3-3) a) A pressure detector on the line between the com-ponent cooling pumps and the component cooling () heat exchangers

( b) A temperature and flow indicator in the outlet line from the heat exchangers c) A radiation monitor and temperature indicator on the main inlet line to the component cooling pumps. In addition any leakage occurring inside containment can be detected by: a) containment humidity monitors 3 b) containment radiation monitors c) sump level indication. O C:1 4

Criterion 46 - Testing of cooling water system. The cool-

 ~O-N-

ing water system shall be designed to permit appropriate periodic pressure and functional testing to assure (1) , the structural and leaktight integrity of its components, (2) the operability and the performance of the active components of the system, and (3) the operability of the system as a whole and, under conditions as close to design as practical, the performance of the full operational se-quence that brings the system into operation for reactor shutdown and for loss-of-coolant accidents, including operation of applicable portions of the protection sys-tem and the transfer between normal and emergency power sources. _/ Response: The activ.e components of the Auxiliary Coolant and Service Water Systems are in either continuous or intermittent use during normal plant operation and no additonal periodic tests are required. Periodic visual inspections and preventative maintenance are conducted following normal industrial practice. ( FSAR p. 9.3-19) Each service water pump has undergone a hydrostatic test in the shop in which all wetted parts were subjected to a hydrostatic pressure of one and one-1 half times the shut-off head of the pump. In addi-tion, the normal capacity vs. head tests have been made on each pump. i l

All valves in the service water system have undergone (} a shop hydrostatic test of 250 psi on the body and 175 psi on the seat. Service water system design pressure is 150 psig. All service water pipir.g has been hydrostatically tested in the field at 225 psig or one and one-half times design. The welds in shop fabricated service water piping have been liquid penetrant or magnetic particle inspected in accordance with the ASME Boiler and Pressure Vessel Code, Section VIII. I Electrical components of the service water system are tested periodically. (FSAR p. 9.6-5)

 ]-

1 1 I i 4 j l y - ,-r ,- -- -- , , , - - - ,

i 1 l l l l l l l l l l l l l l V. Reactor Containment [

9 4 a i i i I i l l ) i 1 k a l I 5 t 1 1

i. i l l i

i. e l

Criterion 50 - Containment Design Basis. The reactor con-O k) tainment structure, including access openings, penetra-tions, and the containment heat removal system, shall be designed so that the containment structure and its internal compartments can accomodate, without exceeding the design leakage rate and with suf ficient margin, the calculated pressure and temperature conditions resulting from any loss-of-coolant accident. This margin s, hall reflect con-sideration of (1) the effects of potential energy sources that have not been included in the determination of the peak conditions, such as energy in steam generators and, as required by 50.44, energy from metal-vater and other chemical reactions that may result from degradation, but not total failure, of emergency core cooling functioning; (2) the limited experience and experimental data available for defining accident phenomena and containment responses; and (3), the conservatism of the calculational model and s input parameters. o "The reactor containment structure including access open-ings penetrations, and the containment heat removal system, shall be designed so that the containment structure and its internal compartments can accomodate, without exceeding the design leakage rate and with suf ficient nargin, the cal-culated pressure and temperature conditiens resulting from i any loss-of-coolant accident." L

_2-Response: The following criteria are followed to assure con- _{~} v servatism in computing the required structural load capacity of the containment structure. (FSAR p. 5.1.1-6) a) In calcuating the containment pressure, rupture sizes up to and including a double-ended severance of a reactor coolant pipe are considered. b) In considering post-accident pressure effects, various malfunctions of the emergency systems are evaluated. Contingent mechanical or electric 1 failures are assumed to disable one of the diesel generators, two of the five fan-cooler units and i e one of the two containment spray units. c) The pressure and temperature loadings obtained by analyzing various loss-of-coolant accidents, when combined with operating loads and maximum wind or 4 seismic forces, do not exceed the load-carrying capacity of the structure, its access opening or penetrations. 1 The most stringent case of these analyses is sum-marized below: Discharge of reactor coolant through a double-ended 4 rupture of the main loop piping, fol3 owed by operation 0)

    \_             of only those engineered safety features which can run i

                                              .( };              simultaneously with power-from two of the three on-site diesel generators results in a sufficiently low radioactive materials leakage from the containment structure that there is no undue risk to the health and safety of the public.

i o "This margin shall reflect consideration of (1) the effects of potential energy sources that have not been included in the determination of the peak conditons, such as energy in steam generators and, as required by 50.44, energy f rom metal-water and other chemical reactions that may result from degradation, but not total failure of emergency core cooling functioning..." Response: The design pressure is not exceeded during any sub-

 ;                   sequent long term pressure transient determined by the combined effects of heat sources such as residual heat and metal-water reactions, structural heat sinks and the operation of other engineered safety features utilizing only the emergency on-site electric power supply.     ( FSAR 5.1.1-8 )

The design pressure and temperature on the containment structure are those created by the hypothetical loss- , of-coolant accident. The reactor coolant system

contains approximately 512,000 lbs. of coolant at a O

i

_4-

  -)    weighted average enthalpy of 595 Btu /lb for a total w/

energy of 304,000,000 Btu. In a hypothetical acci-dent, this water is released through a double-ended break in the largest reactor coolant pipe, _ causing a rapid pressure rise in the containment. (FSAR 5.1.1-8) Additional energy release is considered from the fol-lowing sources: (FSAR 5.1.1-8) a) Stored heat in the reactor core. b) Stored heat 'in the reactor vessel piping and other reactor coolant system components. c) Residual heat production. A V d) Limited metal-water reaction energy and resulting hydrogen-oxygen reaction energy. The following loadings are considered in the design of the containment in addition to the pressure and temperature conditio1s described above: (FSAR p. 5.1.1-9) 4 a) Structure dead load, b) Live loads. c) Equipment loads, d) Internal _ test pressure.

     , e)   Earthquake

() f) Wind

c o- "... (2) the limited experience and experimental data available for defining accident phenomena and containment responses and (3) the conservatism of the calculational model and input parameters." , Response: Conservatism in the calculational models is illus-trated in the material presented above. The internal pressure transient used for the contain-ment design is more severe than those calculated for the various loss-of-coolant accidents. ( FSAR p. 5.1.2-4) The containment structure is designed based upon limiting load factors which are used as the ratio by which accident and earthquake loads are multiplied for design purposes to ensure that the load /deforma-tion behavior of the structure is one of elastic, low strain behavior. This approach places minimum emphasis on fixed gravity loads and maximum emphasis on accident and earthquake loads. Because of the refinement of the analysis and the restrictions on construction procedures, the load factors primarily provide for a safety margin on the load assumptions. ( FSAR p. 5.1. 7-1) In a recent review of the containment design, a sum-f3 mary of which was presented to the NRC staf f on U I

June 17, 1980, it was demonstrated that using realistic b'~) bases including actual material properties, the con-tainment can withstand pressures up to 2.7 times the design accident pressure without impairing its func-tional capability. This factor of 2.7 directly cor-responds' to conservatisms applied in the original design as follows:

1. Application of load factors (1.5)

2. Application of capacity reduction factors (1.11)

3. Strength of liner not accounted for (1.15)

4. Minimum strength of materials considered (1.18)

5. Seismic rebar resisting LOCA loads (1.12) r~s 6. Designer conservatism (1.06)

L] The producc of these factors; 2.7, represents a con-fident lower bound of functional capability and the limit of elastic response. l l

Criterion 51 - Fracture prevention of containment pressure bj s boundary. The reactor containment boundary shall be de-signed with sufficient margin to assure that under oper-ating, maintenance, testing, and postulated accident conditions (1) its ferritic materials behave in a non-brittle manner and (2) the probability of rapidly pro-pagating fracture is minimized. The design shall reflect consideration of service temperatures and other conditions of the containment boundary material during operation, maintenance, testing, and postulated accident conditions, and the uncertainties in determining (1) material proper-ties, (2) residual, steady-state, and transient stresses, and (3) size of flaws. () o "The reactor containment boundary shall be designed with suf ficient margin to assure that under operating, mainte-nance, testing and postulated accident conditions (1) its ferritic materials behave in a nonbrittle manner." Response: The loads and combinations thereof used for the design of the containment steel liner are enumerated in Appendix C of Vol. 4 of the FSAR pgs. C C-8. The non-brittle behavior of the steel liner is assured by the design stress criteria that no gross deformation beyond the elastic limit occurs for all loading con-ditions previously referenced. ( FSAR, Vol . 4, Appendix C, pgs. C C20, Vol. 2, Sec. 5, () pg. 5.1.1-7). I

2- ['} o ... and the probability of rapidly propagating fracture v is minimized." Response: The rapid propagation of fracture of the steel liner is minimized by the stud anchorage system design. (FSAR, Vol. 4, Appendix C, pgs. C C18) o "The design shall reflect consideration of service tem-peratures and other conditions of 'the containment boundary material during operation, maintenance, testing, and postulated accident conditions..." Response: The stresses of the steel liner for principle compres-sion and tension and shear at normal operating tem-() peratures are less than the allowable maximum. (FSAR, Vol. 4, Appendix C, pg. C-10) The containment liner is enclosed within the contain-ment and thus is not exposed to the temperature extremes of the environs. The containment ambient temperature during operation is between 50 and 120 F. This includes both hot operating and cold shutdown conditons. The minimum service metal temperature of the containment liner is well above the NDT tem-perature + 300 F for the liner material. Containment penetrations which can be exposed to the environement are also designed to the NDT + 30 0 F Criterion. (FSAR p. 5.1.1-7) U t l

3-({) The concrete containment is not susceptible to a low temperature brittle fracture. (FSAR p. 5.1.1-7) Other conditions of the containment boundary considered are buckling and the effect of penetrations on the steel liner. Also, stresses during overpressuriza-tion testing and thermal expansion of the liner during accident are considered. (FSAR, Vol. 4, Appendix C, pgs. C C-33) o "... and the uncertainties in determing (1) material pro-perties (2) residual steady state and transient stresses and (3) size of flaws". Response: The material properties of the steel liner are well (]) known. The plate steel liner is carbon steel con-forming to ASTM Designation A442-65. (FSAR Vol. 4, Appendix A, pg. M-8) The uncertainties in determining residual steady state and transient stresses is accounted for by the use of the limiting load f actor concept. This con-cept places the greatest conservatism on those loads most subject to variation. ( FSAR, Vol. 4, Appendix C, pg. C-5) The uncertainties in the size of flaws in the liner plate is controlled by ASTM Designation A442-65. The size of flaws in welds of the liner plate was

                                  .m      _        _

i i

                        . controlled by the inspection and testing conducted during the course of construction.                                                                (FSAR, Appendix   i C, pg s. C-4 7 - C-4 8 )

L o l I O l i 1

                                                                                                                                           .i t
                                                                                                                                             ;

l I I i i i i

l' . t .l

l. l

   .g r-

Criterion 52 - Capability for containment leakage rate testing. The reactor containment and other equipment which may be subjected to containment test conditions shall be designed so that periodic integrated leakage rate testing can be conducted at containment design pressure. Respcase: The IP-2 containment and other equipment which may be subjected to containment test conditions are designed to permit periodic integrated leakage rate testing in accordance with the criteria of 10CFR50 Appendix J. The results of integrated leakage rate testing per- {) formed as required, during the first and third refueling outages were submitted to NRC by letters dated December 1, 1976 and January 29, 1980 respectively. 4 O.

Criterion 53 - Provisions for Containment Testing and O Inspection. The reactor containment shall be designed to permit (1) appropriate periodic inspection of all important areas such as penetrations, (2) an appropriate surveillance program, and ( 3) periodic testing at containment design pressure of the leak tightness of penetrations which have resilient seals and expansion bellows. Response: Indian Point Unit No. 2 meet's the requirements of 10CFR 50, Appendix J. Af ter completion of the containment structure and installation of all pene trations and weld channels, an initial integrated leakage rate test was conducted at containment design pressure (47 psig) . []} A sensitive leak rate test is conducted with the containment penetrations, weld channels, and certain double gasketed seals and isolation valve interspaces at a minimum pressure of 47 psig and with the con-tainment building at atmospheric pressure. A detailed visual examination of the accessible interior and exterior surfaces of the containment structure and its components is performed to uncover any evidence of deterioration which may affect either the containment structural integrity or leak tight- . ness. [ v> i

Containment air locks are tested at a minimum ({} pressure of 47 psig. A low pressure gross leak test of containment is conducted as required by the Confirmatory Order dated February 11, 1980. A surveillance program is in affect at Indian Point Unit No. 2. A set of three full pressure integrated leakage tests are performed at approximately equal intervals during each 10 year service period. The third test of each set is conducted when the plant is shutdown for the 10 year plant inservice inspection. (]) A sensitive leakage rate test is performed at a fre- _quency of at least every other refueling but in no case at intervals greater than 3 years. The containment air locks are tested at a frequency

     .of every 6 months with verification of repressurization to at least 47 psig whenever containment integrity is required.

Any major modifications or replacement of components of the containment require either an integrated leak-age rate test or a local leak detection test. O

A detailed visual inspection is performed at each (]) refueling shutdown and prior to any integrated leak test. The low pressure gross leak test is conducted prior I to any startup from cold shutdown conditions. A permanently piped monitoring system is provided to continuously measure leakage from all penetrations. Leakage from the monitoring _ system is checked by continuous measuremert of the integrated makeup air flow. In the event excessive leakage is discovered, each penetration can then be checked separately at any time. (FSAR Section 5.1.8) ( . 0 1 i

                                                                        )

l 1

(_) Criterien 54 - Piping Systems Penetrating Containment. Piping systems penetrating primary reactor containment shall be provided with leak detection, isolation, and containment capabilities having redundancy, reliability, and performance capabilities which reflect the importance to safety of isolating these piping nystems. Such piping shall be designed with a capability to test periodically

                                 ~

the operability of the isolation valves and associated apparatus and to determine if valve leakage is within ac-ceptable limits. Response: Piping systems which penetrate the reactor containment have . isolation capabilities commensurate with the sys-O tem' design in accomplishing safety related functions or providing isolation of the containment from the out-side environment under postulated accident conditions. Piping penetrating the containment is designed for pressure at least equal to the containment design pressure. Each containment penetration is designed as an extension of containment and is Seismic Category 1 and missile protected from the penetration or, if located inside containment, from the inboard isolation barrier to and including the outboard barrier. Where automatic or remotely operable isolation valves are provided, the valve -is designed to fail in the safe position. (]) U-

Ts For those systems which require isolation, redundant G barriers are utilized to ensure that the failure of one valve to close will not prevent isolation of the penetration. The containment isolation provisions are discussed in detail in FSAR Section 5.2 and also in Consolidated Edison's December 31,197 9 TMI-2 Lessons Learned Submittal. Isolation valves which are located in lines connecting to the Reactor Coolant System or which could be exposed to the containment atmosphere under postulated accident conditions are sealed by an Isolation Valve Seal Water System which injects water or gas at a pressure slightly {) higher than the containment design pressure between the isolation barriers. Containment penetrations and welds are sealed by the Containment Penetration and Weld Chan-nel Pressurization System. In addition to providing seals on penetration isolation barriers, these systems may be utilized for leakage detection. The design and operation of the seal systems are described in FSAR Sec-tion 6.5 and 6.6. Leakage and operability testing is performed on the con-tainment isolation valves periodically as required by Technical Specification Sections 4.1 and 4.4 and as re-required by the ASME Code Section XI inservice testing j"; requirements for pumps and valves. Provisions for leakage V

i 3- l !+  :

i i

fg i testing are illustrated in the updated FSAR Figures  !

                                              - provided in the December 31, 1979 submittal and are                                                                                                                       !
                                                                                                                                                                                                                           \

j discussed in FSAR Section 5.1. l 1 t  ! I h

;

t-f 6 i' t G J I l 4 . 1 I ( ! i t. i i-d l l 1 -l 1 I i. I l i l 1 - i i k I k i i.0 t i i i l

-,

                              .._.,._,.__,._,.*n             '-
                                                            .-....,,..,..--.-v -
                                                                                                         ,s   _r---....-m.,-we,,,---,-,-,emyr,w                       ,,-,w-    wm yey y yt+e e . . . . . . . - . , + *

• Criterion 55 --Reactor Coolant Pressure Boundary Penetrating

',_')
   /

Containment. Each line that is part of the reactor coolant pressure boundary and that penetrates primary reactor con-tainment shall be provided with containment isolation valves as follows, unless it can be demostrated that the contain-ment isolation provisions for a specific class of lines, such as instrument lines, are acceptable on some other de-fined basis: (1) One locked closed isolation valve inside and one locked closed isolation valve outside containment; or (2) One automatic isolation valve inside or one locked closed isolation valve outside containment; or (3) One locked closed insolation valve inside and one auto-1r')s matic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment; or (4) One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve

            -outside containment.

Other appropriate requiremente to minimize the probability or consequences of an accidental rupture of these lines or of lines connected to them shall be provided as necessary to. assure adequate safety. Determination of the appropriate-ness of-these requirements, such as higher quality in design, 1

fabrication, and testing, additional' provisions for in-j{]) service inspection, protection against more severe natural phenomena, and additional isolation valves and containment, shall include consideration of the population density, use characteristics, and physical characteristics of the site environs. Response: Indian Point Unit No. 2 was designed and constructed prior to the establishment of GDC-55. However, this Criterion is satisfied " . . . on some other defined

                             "  since at least two barriers are provided basis  ...

for redundancy against leakage of radioactive fluids to the environment in the event of a loss of coolant accident. These barriers are in the form of isolation {~} valves or closed systems. With regard to isolation valves, the following additional criteria are used: (1) Manual isolation valves that are locked closed or otherwise closed and under administrative control during power operation qualify as auto-matic trip valves. (2) A check valve qualifies as an automatic trip valve in certain incoming lines not requir-ing seal water injection. (3) The double disk type of gate valve is used to isolate certain lines. When sealed by water in-jection, this valve provides two barriers against

     }

f

                          ,_           leakage of radioactive liquids or containment U            atmosphere.

The containment isolation provisions for individual lines are selected such that the containment isolation criterion of two barriers is satisfied and that they are consistent with the required function (s) of the line(s) during normal operation and with any safety function (s) of the line(s) during and after the design basis accident. The differences in the design of the containment iso-lation systems for both Indian Point Units 2 and 3 from the specific requirements of the General Design Criteria were reviewed before the Congressional (]) Joint Committee on Atomic Energy (JCAE) in early 1976. The NRC Regulatory Staff's evaluation of the design of the Indian Point units' containment isolation sys-tems were contained in a document entitled, " Report to The Director Office of Nuclear Reactor Regulation Concerning R. Pollard's Allegations," dated February 28, 1976. The following paragraphs are excerpted f rom that document which was presented to the JCAE:

       "The containment isolation systems ace designed to iso-
      ' late the containment atmosphere from the outside environ-ment under accident conditions. Mr. Pollard stated that

.() there are dif ferences in the designs of the isolation

_4_ {} systems for Indian Point from the specific require-ments of the General Design Criteria (GDC). These differences can be summarized as follows: (a) The GDC require valves to be located with one valve inside containment and one outside con-tainment. The Indian Point Units in some cases have both valves located outside containment. (b) Manual valves are relied on in some cases for containment isolation. However, the GDC requires, as a minimum, remotely operated valves. (c) The Indian Point Units in some cases rely on administrative procedures to ensure that manual (~)s (_ valves are closed. The GDC requires that these valves be locked in a close position. (d) The Indian Point Units rely on closed systems outside containment, but the GDC does not recog-nize this kind of closed system. The General Design Criteria permit containment isola-tion provisions for lines penetrating the primary containment boundary that differs from the specific

                                                                     )

requirements of General Design Criteria 55 and 56 if they are acceptable on some other defined basis. In < l its review of the Indian Point license application, the staf f reviewed the isolation information provided (,,) by the applicant to justify its design. The bases for p_.

1 3 the staff's conclusions related to the Indian Point (V isolation systems are discussed below. The isolation systems are designed to the same seis-

mic criteria as the containment and other safety-related systems, and are considered to be extensions of containment. The isolation valves inside contain-ment are protected against missiles which could be generated under loss-of-coolant accident conditions. . The design of the containment isolation system in-cludes an Isolation Valve Seal Water System which seals and limits leakage through most of the isola-tion valves. This feature provides additional assur-() ance th'at leakage through valve is minimized. The i Isolation Valve Seal Water System is also designed to Seismic Class I criteria. Technical Specifications have been developed with surveillance requirements to ensure the operability of the seal system. The leak-age limiting capability of the system, for conserva-tism, is not con'sidered in the calculation of the radiological consequences of a postulated loss-of-coolant accident.- Indian Point Units 2 and 3 are two of the few plants that have provided this kind of ad-ditional protection. Some containment isolation valves are open during nor-O X_s mal plant operation and are not automatically closed

{J following an accident. Most of these valves are located in engineered safety' feature systems that are required to function after a postulated accident or whose inadvertent closure results in a decrease in reliability of a safety-related system. However, in each case, other isolation provisions have been provided. These provisions consist of added check valves in the lines, or a gas 'or water seal system, or a closed piping system either inside or outside of containment or a combination of such provisions. The staff reviewed the differences between the Indian Point Unit 3 design and the General Design Criteria. r They concluded that the features described in the de-sign provided an acceptable "other defined basis" for variation from the automatic closure arrangements specified in GDC 55 and 56. The staff has concluded that the containment isola-J tion system provides adequate protection for the health and safety of the public. The staff also judged that modifications which would be required to satisfy the specific requirements of the General Design Criteria would result in increased safety margin but would not result in substantial, additional protection that is required for the public O ts health-and safety. Since the design of the isolation

nystems for both units is virtually identical, the g V ntaff conclusions also cover Unit 2." More recently, in Consolidated Edison's December 31, 1979 and February 15, 1980 submittals to NRC, a de-tailed reevaluation of the Indian Point Unit No. 2 containment isolation system was provided in response to TMI-2 Lessons Learned Item 2.1.4. Each containment penetration procees line was classified as " essential",

        "non-essential" or " safety" and was functionally re-ovaluated. A listing of containment isolation systems along with the bases for the classifications were pro-vided in Table 2.14-1 of the Decea ber 31, 1979 submit-tal. Also, Attachment 3 of that submittal provided for reference and clarification updated FSAR schematics for all of the containment    isolation systems. Further clarification of isolation provisions for certain spec-ific process lines was provided in item 2.1.4 of our February 15, 1980 submittal.

The results of these recent reevaluation demostrate once

        .i<Jain that the Indian Point Unit No. 2 containment iso-1.ition design is acceptable and satisfies regulatory requirements. The NRC Regulatory Staff's concurrence with these findings was documented in their " Evaluation of Licensee's Compliance with Category "A" Items of NRC l

Recommendations Resulting from TMI-2 Lessons Learned" l G

 \/      lor Indian Point Unit No. 2, dated February 21, 1980.
    '7m     e

Criterion'56 - Primary Containment Isolation. Each line {}}j that connects directly to the containment atmosphere and penetrates primary reactor containment shall be provided with containment isolation valves as follows,.unless it can be demonstrated that the containment isolation pro-visions for a specific class of lines, such as instru-ment lines, are accepted on some other defined basis: (1) One locked closed isolation valve inside and one locked closed isolation valve outside containment; or (2) One automatic isolation valve inside and one locked closed isolation valve outside containment; or (3) One locked closed isolation valve inside and one auto-matic isolation valve outside containment. A simple check valve may not be used as the automatic isolation [} valve outside containment; or (4) One automatic isolation valve inside and one automatic isolation valve outside containment. A simple check valve may not be used as the automatic isolation valve outside containment. Isolation valves outside containment shall be located as close to the containment as practical and upon loss of actuating power, automatic isolation valves shall be de-signed to take the position that provides greater safety. Response: The discussion provided in response to General Design Criterion 55 is di'rectly applicable to and envelopes con-sideration of the compliance of Indian Point Unit tio. 2 with GDC-56. 4

                                                                  -   T

() Criterion'57'- Closed' System' Isolation Valves. Each line that penetrates primary reactor containment and is neither part of the reactor coolant pressure boundary nor connected directly to the containment atmosphere shall have at least one containment isolation valve which shall be either auto-matic, or locked closed, or capable of remote manual opera-tion. This valve shall be outside containment and located as close to the containment as practicel. A simple check valve may not be used as the automatic isolation valve. Response: The discussion provided in response to General Design Criteria 55 is applicable to and envelopes consider-ation of the compliance of Indian Point Unit No. 2 (' with GDC-57. As discussed in the GDC-55 response, a V) closed system is an acceptable isolation barrier and, therefore, GDC-57 is basically a special case of the more general containment isolation criteria.

 /~.

U

4 i 1 1 5 I r i L t

I \ f 1 4 a f I l 1 i i l t i s VI. Fuel and Radioactivity Control l i. !O i .I I i 4 i 1 l i 4 9 j i i I \O f P

        . . - - . . _ . .   . . , . - . .                    _ . . ~ .                  . . . . . - . . . _ . - , - _ , ._,            .      .. - - .. _ ..                                             .-- - - . - - - . . . . . . . . . -

~7 . . w Criterion 60 - Control of releases of radioactive mate-rd rials to the environment. The nuclear power unit design shall include means to control suitably the release of radioactive materials in gaseous and liquid effluents and to handle radioactive solid wastes produced during normal reactor operation, including anticipated operational occur-rences. Sufficient holdup capacity shall be provided for retention of gaseous and liquid effluents containing radioactive materials, particularly where unfavorable site environmental conditons can be expected to impose unusual operational limitations upon the release of such effluents to the environment. Response: Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and off-site shipments are in accordance with applicable governmental regulations. (FSAR p. 11.1-1) Radioactive fluids entering the Waste Disposal System are collected in sumps and tanks until determination of subsequent treatment can be made. They are sampled and analyzed to determine the quality of radioac-tivity, with an isotopic breakdown if necessary. Before any attempt is made to discharge radioactive waste, they are processed as required and then re-leased under controlled conditions. The system design and operation are characteristically directed toward Discharge ( )) minimizing releases to unrestricted areas.

O streams are appropriately monitored and safety features are incorporated to preclude releases in excess of the limits of 10 CFR 20. The bulk of the radioactive liquids discharged from the Reactor Coolant System are processed and retained inside the plant by the Chemical and Volume Control System recycle train. This minimizes liquid input to the Waste Disposal System which processes relatively small quantities of generally low-activity level wastes. The processed water from waste disposal, from which most of the radioactive material has been removed, is discharged through a monitored line into D O the circulating water discharge. (FSAR p.ll.1-1, 11.1-2) In order to achieve a higher capacity for processing of radioactive liquids, two additional systems are installed. They are the Secondary Boiler Blowdown Purification System (SBBPS) and the Integrated

     . Liquid Radwaste System (ILRWS). THE SBBPS system treats the blowdown liquid by filtration and demineral-ization. The ILRWS processes the liquid radwaste utilizing filters and evaporators.                       l Radioactive gases are pumped by compressors through a

(~3 manifold to one of the gas decay tanks where they are

 \)

held a suitable period of time for decay. Cover gases in the nitrogen blanketing system are re-used to minimize gaseous wastes. During normal operation, gases are discharged intermittently at a controlled rate from these tanks through the monitored plant vent. The system is provided with discharge controls so that the release of radioactive effluents to the atmosphere is controlled within the limits set in the Technical Specifications. (FSAR p. 11.1-1, 11.1-2) Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and off-site shipments are in accordance with applicable () governmental regulations. (FSAR p. 11.1-1) The spent resins from the demineralizers, the filter cartridges and the concentrates from the evaporators are packaged and stored on-site until shipment of f-site for disposal. Suitable containers are used to package these solids at the highest practical con-centrations to minimize the number of containers shipped for burial. All solid waste is placed in suitable containers and stored on-site until shipment off-site is made for disposal. (FSAR p. 11.1-1 through 2) O (j

g' o " Suitable redundancy in components and features, and suit-able interconnections, leak detection, and isolation capabilities shall be provided to assure that for onsite electric power system operation (assuming offsite power is not available) and for offsite electric power system operation (assuming onsite power is not available) the system safety function can be accomplished, assuming a single failure." Response: Two pumps and two residual heat exchangers are avail-able to perform the decay heat cooling functions for the second phase of plant cooldown. All active RHR loop components which are relied upon

 ,s

(_) to perform their function are redundant. (FSAR p. 9.3-2) The RHR loop design provides means to detect radio-activity migration to the ultimate heat sink environ-ment and includes provisions which permit adequate action for continued core cooling when required, in ~ the event radio-activity limits are exceeded. (FSAR p. 9.3-2)

                   .RHR loop components, whose design pressure and tem-perature are less than the Reactor Coolant System design limits, are provided with overpressure pro-s,             tective devices and redundant isolation means.

V (FSAR p. 9.3-2)

() The Auxiliary Feedwater System (subsystem of the Steam , and Power Conversion system) supplies high pressure feedwater to the steam generators in order to maintain a water inventory for removal of heat energy from the reactor coolant system by secondary side steam release in the event of inoperability of the main feedwater system. The head generated by the pumps is sufficient to deliver feedwater into the steam generators at safety valve pressure. Redundant supplies are pro-vided by using two pumpi.ng systems, using dif ferent sources of power for the pumps. ( FSAR p . 10. 2-2 0 ) The steam and power conversion system design provides () means to monitor and restrict radioactivity discharge to normal heat sinks or the environemeht such that the limits of 10 CFR 20 are not exceeded under normal operating conditions nor in the event of anticipated system malfunctions. ( FSAR p. 10.1-1) The RHR System, in conjunction with the steam and power conversion system accommodate the single failure criterion. Active components of both systens, can be powered from either of the onsite or offsite electric power systems. (3 s) l l

Criterion 35 - Emergency Core Cooling. A system to pro-

 /~')'

vide abundant emergency core cooling shall be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is pre-vented and (2) clad metal-water reaction is limited to negligible amounts. , o " A system to provide abundant emergency core cooling shall be provided." Response: Adequate emergency core cooling is provided by the Safety Injection System (which constitutes the () emergency core cooling system) whose components operate in 3 modes. These modes are delincated as passive accumulator injection, active safety injec- , tion, and residual heat removal recirculation. (FSAR 6.2-1) o "The system safety function shall be to transfer heat from the reactor core following any loss of reactor cool-ant at a rate such that (1) fuel and clad damage that could interfere with continued e t(cerive core cooling is prevented, and ..." Response: The primary purpose of the Safety Imjection System is to automatically deliver cooling water to the reactor core in the event of a loss-of-coolant i  ; l

(} accident. This limits the fuel clad temperature and thereby ensures that the core will remain intact and in place, with its essential heat transfer geometry preserved. This protection is afforded for: a) All pipe break sizes up to and including the hypotheti-cal instantaneous circumferential rupture of a reactor coolant loop, assuming unobstructed discharge from both ends. b) A loss of coolant associated with the rod ejection accident. c) A steam generator tube rupture. , (FSAR 6.1-1, 6.1-2) o "

          ...  (2) Clad metal-water reaction 1. limited to negligible
    +

amounts." The basic design criteria for loss of coolant accident evaluations are:

1. The cladding temperature is .to be less than:

a. The melting temperature of Zircalogy-4.

b. The temperature at which gross core geometry distortion, including clad fragmentation, may be expected.

2. The total core metal-water reaction will be limited to less than 1 percent.

3.- () These criteria will assure that the core geometry remains in place and substantially intact to such an extent that effective cooling of the core is not impaired. For any rupture of a steam pipe and the associated uncon-trolled heat removal from the core, the Safety Injection System adds shutdown reactivity so that with a stuck rod, no off-site power and minimum engineered safety features, there is no consequential damage to the Reactor Coolant , System and the core remains in place and intact. j Redundancy and segregation of instrumentation and compo-l nents is incorporated to assure that postulated malfunc-1 ~ tions will not impair the ability of the system to meet O the design objectives, The system is effective in the event of loss of normal station auxiliary power coincident with the loss of coolant, and is tolerant of failures of

 ;     any single component or instrument channel to respond actively in the system.      During the recirculation phase of
                  ~

a loss of coolant, the system is tolerant of a loss of any part of the flow path since back up alternative flow path capability is provided.  ; The ability of the Safety Injection System to meet its capability objectives is presented in Section 6.2.3 of the FSAR. The analysis of the accidents is presented in Section 14 of the FSAR. (FSAR 6.1-2) bs/

Criterion 36 - Inspection of emergency core cooling sys-O tem. The emergency core cooling system shall be designed to permit appropriate periodic inspection of important components, such as spray rings in the reactor pressure vessel, water injection nozzles, and piping, to assure the  ! integrity and capability of the system. l Response: Design provisions are made to the extent practical to facilitate access to the critical parts of the reac-tor vessel internals, pipes, valves and pumps for i visual or boroscopic inspection for erosion, corrosion and vibration wear evidence, and for non-destructive i test inspection where such techniques are desirable and appropriate. (FSAR p. 6.2-3) Inspection of portions of the emergency core cooling system have been performed as part of the Inservice Inspection program required by 10CFR50.55a(g) during refueling outages. The results of these in-I spections have received the concurrence of the

                    . Authorized Inspection Agency as required.       Summary                      l reports of these inspections for the first tnree re-fueling outages, have been submitted to NRC by letters dated December 10, 1976, September 8, 1978 and December 28, 1979. In addition, portions of the emergency core cooling system have been subject to additional inspections as required by NRC IE Bulle-(")T

(- tins 76-06 and 79-17.

Criterion 37 - Testing of emergency core cooling system.

   /~~%        The emergency core cooling system shall be designed to V

permit appropriate periodic pressure and f unctional test-ing to assure (1) the structural and leaktight integrity of its components, (2) the operability and performance of the active components of the system, and (3) the opera-bility of the system as a whole and, under conditions as close to design as practical, the performance of the f ull operational sequence that brings the system into operation, including operation of applicable portions of the protec-tion system, the transfer between normal and emergency power sources, and the operation of the associated cooling water system. r- o "The emergency core cooling system shall be designed to C} permit approrlate periodic pressure and functional testing to assure (1) the structural and leaktight ir tegrity of its components, (2) the operability and performance of the active components of the system, ... Response: The emergency core cooling system is designed to permit appropriate periodic pressure and functional testing to assure the struct' ural and leaktight integrity of its components and the operability and performance of the active components of the system. The design provides for periodic testing of active components of the Safety Injection System for opera-l > () (_, bility and functional performance. ( FSAR p. 6.2-3) l l l

(} The safety injection pumps can be tested periodically ' during plant operation using the minimum flow recir-culation lines provided. The residual heat removal pumps are used every time the resional heat removal

loop is put into operation. All remote operated t

valves can be exercised and actuation circuits can

be tested during routine plant maintenance.

j. (FSAR p. 6.2-3)

The recirculation pumps are normally in a dry sump. l i These pumps are started periodically and allowed to

reach full speed. Minimum flow testing of these pumps can be performed during refueling operations by filling the recirculation sump and opening the l{) , minimum valve on the discharge of tie pump and 4 i directing the flow back to the sump. Those service water and component cooling pumps not running during normal operaton may be tested by alternating with the operating pumps. (FSAR p. 6.2-50) , j The content of the accumulators, the boron injection

tank and the refueling water storage tank are sampled i periodically to determine' that the required boron f concentration is present. (FSAR p. 6.2-50) r, Routine periodic testing of the safety injection sys-tem components and all necessary support systems at

    )         power can be accomplished.                   No inflew to the Reactor I

V

r~' . Coolant System will occur whenever the reactor coolant pressure is above 1500 psi. If such testing indicates a need for corrective maintenance, the redundancy of equipment in these systems permits such maintenance to be performed without shutting down or reducing load under conditions defined in the Techanical Specifications. These conditons include such matters as the period within which the component should be restored to service and the capability of the remain-ing equipment to meet safety limits withia such a period. (FSAR p. 6.2-49) The operation of the remote stop valves in the accumu-s lator tank discharge line may be tested by opening the (b remote test valves j ust downstream of t'he stop valve. Flow through the test line can be c6 served on instru-1 ments and the opening and closing of the discharge line stop valves can be sensed on tAis instrumenta-tion. Test circuits are provided to. periodically examine the leakage back through the check valves and to ascertain that these valves seat whenever the re-actor system pressure is raised. (ISAR p. 6.2-49) This test can be routinely performed when the reactor is being returned to power af ter an outage at 3 the reactor pressure is raised above the accumulator 7-- pressure. If -leakage through a cherk valve should V) .

1 become excessive, the isolation valve would be closed. (

     }

(The safety injection actuation signal will cause this valve to open should it be in the closed position at the time of a loss-of-coolant accident. ) The perfor-mance of the check valves has been carefully studied

        ,           and it is concluded that it is highly unlikely that the accumulator lines would have to be closed because of leakage.    (FSAR p. 6.2-49)~

o- ... (3) the operability of the system as a whole and, under conditions as close to design as practical, the per-formance of the full operational sequence that brings the system into operation, including operation of applicable portions of the protection system, the transfer between (~} normal and emergency power sources, and the operation of the associated cooling water system." Response: System testing can be conducted during plant shutdown to demonstate proper automatic operation of the Safety Injection System. A test signal is applied to initiate automatic action and veriffcation made that the safety injection and residual heat removal pumps attain required discharge heads. Tte test demon-stratus the operation of the valves, pump circuit breakers, and automatic circuitry. Isolation valves in the injection line will be blocked closed so that (~T V flow is not introduced into the reactor coolant

(} system. The test is considered satisfactorv if con-trol board indication and visual observations indicate all components have operated and sequenced properly. (FSAR 6. 6.2-50) The accumulators and the injection piping up to the final isolation valve are maintained full of borated water while the plant is in o.peraton. The accumula-tors and the high head injection lines are refilled with borated water as required by using the safety injection pumps to recirculate refueling water through the injection lines. A small test line is provided for this purpose in each injection header. {} (FSAR p. 6.2-50) Flow in each of the safety injection headers and in the main flow line for the residual heat removal pumps is monitored by a local flow indicator. Pres-sure instrumentation is also provided for the main flow paths of the safety injection and residual heat removal pumps. Accumlator isolation valves are blocked closed for this test. ( FSA1 p. 6.2-51) The eight-switch sequence for recirculation operation may be tested following the above izjection phase test to demonstrate proper sequencimg of valves and pumps. The recirculation pumps are blocked from ,O) \_/ starting during this test. ( FSAR p. 6. 2-51)

 /)  The external recirculation flow paths are hydrotested V

during periodic re-tests at the operating pressures. This is accomplished by running each pump which could be utilized during external recirculation (safety injection and residual heat removal pumps) in turn at near chutoff head conditions and checking the dis-charge and recirculation test lines. The suction lines are tested by running the residual heat removal pumps and opening the flow path to the safety injec-tion pumps in the same manner as described above. ( FSAR p. 6.2-51) During the above test, all system joints, valve pack-ings, pump seals, leakof f connections or other poten-tial points of leakage are visually examined. Valve gland packing, pump seals, cnd flanges are adjusted or replaced as required to reduce the leakage to accetable proporticos. For power operated valves, final packing adjustments are made, and the valves are put through an operating cycle before a final leakage examination is made. ( FSAR p. 6.2-51) The entire recirculation loop except the recircula-tion line to the residual heat removal pumps is pres-surizdd during periodic testing of the engineered safety features components. The recirculation line (~) g to the residual heat removal pump is capable of being l l

hydrotested during plant shutdown and it is also leak

  )   tested at the time of the periodic retests of the containment.    (FSAR p. 6.2-51)

At each refueling outage to assure that each diesel generator will automatically start and assume the re-quired load within 60 seconds af ter the initial start signal the following test is accomplished - by simu-lating a loss of all normal AC station service power supplies and simultaneously simulating a Safety In-jection signal observations shall verify automatic start of each diesel generator, required bus load shedding and restoration to operation of particular vital equipment. To prevent Safety Injection flow to () the core certain safeguard valves will be closed and made inoperable. (Technical Specifications p. 4.6-1) 1 At each refueling interval, each battery shall be 4 subjected to a load test and a visual inspection of the plates. (Technical Specifications p. 4.6-2) At monthly intervals, at least one gas turbine gen-erator shall be started and synchronized to the power distribution system for a minimum of thirty (30)

minutes with a minimum electrical output of 750 FN.

(Technical Specifications p. 4.6-2) l The tests specified are designed to demonstrate that () the diesel generators will provide power for operation

of equipment. They also assure that the emergency a diesel' generator system controls and the control sys-tems for the safeguards equipment will function auto-matically in the event of a loss of all normal 480v AC station service power. (Technical Specifications

p. 4.6-3)

The refueling interval load test for each battery together with the visual inspection ,of the plates will assure the continued integrity of the batteries. The batteries are of the type that can be visually inspected, and this method of' assuring the continued integrity of the battery is proven standard power plant practice. (Technical Specifications p. 4.6-4) (q > The tests specified for the gas turbine generators 4 are designed to assure that at least one gas turbine will be available to provide power for operation of i equipoment if required. Since equipment required for safe shutdown power supply demands a maximum electrical load of approximately 750 KW, the required minimum test load will demonstrate adequate capability. (Technical Specifications p. 4.6-4) The Safety Injection System is a principal plant safeguard that is normally inoperative during reactor l operation. Complete systems tests cannot be per-formed when the reactor is operating because a safety

  ~f)\

( l

l () injection signal causes reactor trip, main feedwater isolaton and containment isolation. The method of assuring operability of this system is therefore to combine systems tests to be performed during plant refueling shutdowns, with more frequent component tests, which can be performed during reactor opera-tion. (Technical Specifications p. 4.5-4) The refueling systems tests demonstrate proper auto-matic operation of the system. With the pumps blocked from starting a test signal signal is applied to initiate automatic acton and verification made that the components receive the safety injection signal in the proper sequence. The test demonstrates the opera-t, tion of the valves, pump circuit breakers , and auto-matic circuitry. (Technical Specifications p. 4.5-4) During reactor operation, the instramec .= 6 ion which is depended on to initiate safety imjection and con-tainment spray is generally checked daily and the initiating circuits are tested monthly. The testing i of the analog channel inputs is acccmplished in the same manner as for the reactor protection system. The engineered safety features logir system is tested by means of test switches to simulade inputs from the analog channels. The test switches interrupt the logic matrix output to the master relay to prevent {}; l

() actuation. Verification that the logic is accomp-lished is indicated by the matrix test light. Upon completion of the logic checks, verification that the circuit from the logic matrices to the master relay is complete is accomplished by use of an ohmmeter to check continuity. (Technical Specifica-tions p. 4.5-5) Other systems that are also important to the emergency cooling function are the accumulators, the Component Cooling System, the Service Water System and the i containment fan coolers. The accumulators are a passive safeguard, the water volume and pressure in

 ]   the accumulators are checked periodically. The other
   )

systems mentioned operate when the reactor is in operation and by these means are continuously moni-tored for satisfactory performance. (Technical Specifications p. 4.5-5)

1 l n Criterion 61 - Fuel storage and handling and radioactivity I 'l \- control. The fuel storage and handling, radioactive waste, and other systems which may contain radioactivity shall be designed to assure adequate safety under normal and postu-lated accident conditions. These systems shall be designed (1) with a capability to permit appropriate periodic in-spection and testing of components important to safety, (2) with suitable shielding for radiation protection, (3) with appropriate containment, confinement, and filtering systems, (4) with a residual heat removal capability having reliability and testability that reflects the importance to safety of decay heat and other residual heat removal, and (5) to prevent significant reduction in fuel storage coolant pJ~ inventory under accident conditions. o "The fuel storage and handling radioactive waste, and other systems which may contain radioactivity shall be designed to assure adequate safety under normal and postulated accident conditions. " Response: Detailed analyses have been performed in designing

                 .the fuel storage racks. These analyses demonstrate that-for all anticipated normal and abnormal con-figurations, for fuel assemblies within the fuel storage racks, adequate safety under normal and postulated accident conditions is ensured.     (Sub-mittal to NRC dated March 4, 1975 and supplements

/~~') \- dated May 9, 1975, July 23, 1975, Augus t 19, 1975,

~ {} September 11, 1975, October 1,1975 and October 10, 1975 concerning a proposed modification to the spent fuel storage racks.) Liquid, gaseous, and solid waste disposal facilities are designed so that discharge of effluents and off-site shipments are in accordance with applicable governmental regulations. ( FSAR p. 11.1-1) Before any attempt is made to discharge liquid radio-active waste, they are processed as required and then released under controlled conditons. The system de-sign and operation are characteristically directed toward minimizing releases to unrestricted areas. A () Discharge streams are appropriately monitored and safety features are incorporated to preclude releases in excess of the limits of 10 CFR 20. ( FSAR p. 11.1-1) During normal' operation, gases are discharged inter-mittently at a controlled rate from the gas decay tanks through the monitored plant vent. The system is provided with discharge controls so that the release of radioactive effluents to the atmosphere is controlled within the limits set in the Technical Specifications. (FSAR p. 11.1-2) Measurements are made to determine or estimate the total curie quantity and principle radionuclide

() comp:sition of all radioactive soliJ. waste shipped offsite. (Environmental Technical Specifications

p. 2.4-17)

Reports of the radioactive solid wa .< te shipments, volenes, principle radionuclides, a .d total curie quantity, are submitted to NRC, as voquired. (Environmental Technical Spec.ificat '.ons p. 2.4-17) The environmental technical specification require-ments for solid radioactive waste handling and dis-posal provide assurance that solid radioactive materials stored at the plant and snipped offsite are packaged in conformance with 10 CFR Part 20,10 CFR O Part 71, and 49 CFR Parts 170-178. (Environmental l Technical Specifications p. 2.4-18) i All waste handling and storage facilities are con-tained and equipment designed so that accidental releases directly to the atmosphere are monitored and will not exceed the limits of 10 CFR 100. i (FSAR, p. 11.2-3, 14.2.2-1 through 14. 2. 3-4) o "These systems shall be designed (1) with a capability to permit appropriate. periodic inspection and testing of com-ponents important to safety..."

 /'%

V

                                                                          ;

_4_ () ' Response: The spent fuel racks are located in the spent fuel pit which is maintained full of water and always accessible to operating personnel. Inspection of new or spent fuel, the new or spent fuel racks and other components located in the spent fuel pit are generally accessible for inspection by either direct observation from the surface of the pit or by use of underwater camera. Similarly, piping, pumps, valves and filters servicing

   ,              the spent fuel pit are generally accessible for in-spection by direct or indirect means.      These compo-nents are in continuous or intermittant operation, b
 \-

this routine operation serves to verify their con-tinued functional capability and no additional test-a ing is required. Waste disposal system components are located in the auxiliary building except for the reactor coolant drain tank which is in the containment and the waste holdup tank which is in the liquid holdup tank vault. ( FSAR p. 11.1-9 ) Plant layout permits varying degrees of accessibility to the components and piping of the Waste Disposal System. Physical inspection of system components for evidence of leakage or structural distress can (G~h

                                   /'               generally be accomplished by direct or indirect

(_l/ means. The waste disposal systems are used on a routine basis and do not require specific testing to assure operability o ... (2) with suitable shielding for radiation protec-tion..." Response: The spent fuel assemblies and control rod clusters are remotely removed from the reactor containment through the horizontal spent fuel transfer tube and placed in the spent fuel pit. Concrete, 6 ft. thick, shields {} the spent fuel transfer tube. This shielding is de-signed to protect personnel from radiation during the time a spent fuel assembly is passing through the main concrete support of the reactor containment and the transfer tube. (FSAR p. 11.2-8) Radial shielding during fuel transfer is provided by the water and concrete walls of the fuel transfer pit. An equivalent of 6 feet of regular concrete is pro-vided to insure a maximum dose value of 0.75 mr/hr. in the areas adjacent to the spent fuel pit. (FSAR p. 11.2-8) O

Spent fuel is stored in the spent fuel pit which is t")

 \-

located adjacent to the containment building. Shielding for the spent f uel storage pit is provided by 6 feet thick concrete walls and is flooded to a level such that the water height is greater than 13 ft. above the spent fuel assemblies. (FSAR p. 11. 2-8 ) Auxiliary shielding for the Waste Disposal System and its storage components is designed to limit the dose rate to levels not exceeding .75 mr/hr in normally occupied areas, to levels not exceeding 2.0 mr/hr in intermittently occupied areas and to levels not exceeding 15 mr/hr in limited occupancy areas. ( FSAR p. 11. 2-2 ) O Gamma radiation is continuously monitored in the 4 auxiliary building. A high level signal is alarmed locally and annunciated in the control room. ( PSAR p . 11. 2-3 ) o " (3) with appropriate containment, confinement, and filtering systems, ... Response: All fuel and waste storage facilities are contained and equipment designed so that accidental releases of radioactivity directly to the atmosphere are monitored and do not exceed the guidelines of 10 CFR 100. ( FSAR p. 9. 5-3 ) O

() The reactor cav'ty, refueling canal and spent fuel storage pit are reinforced concrete structures with a seam-welded stainless steel plate liner. These structures are designed to withstand the anticipated earthquake loadings as Class I structures so that the liner prevents leakage even in the event the rein-forced concrete develops cracks. (FSAR p. 9.5-3) A spent fuel filter removes particulate matter larger than 5 microns from the spent- fuel pit water. A demineralizer sized to pass 5% of the spent fuel pit cooling loop circulation flow is provided for purifi-cation of the fuel pit water for unrestricted access (]) to the working area and optical clarity. (FSAR p. 9.3.11) o ... (4) with a residual heat removal capability having reliability and testability that reflects the importance to safety of decay heat and other residual heat removal, . . ." Response: The refueling water provides a reliable and adequate cooling medium for spent fuel transfer and heat re-moval from the spent fuel pit is provided by an auxiliary cooling system. Natural radiation and con-vection is adequate for cooling the holdup tanks. (FSAR p. 9.5-2) 0

i

 /{}}  Up to 2 1/3 cores can be stored in the pool. When 2 1/3 cores are present, the pump and spent fuel heat exchanger will hanc;1e the load and maintain a pit water temperature less than 1250F. The pool is initially filled with water from the refueling water storage tank.

The spent fuel pit is located outside the reactor containment and is not af fected by any loss-of-coolant accident in the containment. The water in the pit is connected during refueling to that in the refueling canal by a valve. Only a very small amount of inter-change of water occurs as fuel assemblies are trans-

ferred.

The spent fuel pit cooling loop consists of parallel pumps, a heat exchanger, filter, demineralizer, piping and associated valves and instrumentation. The pumps draw water from the pit, circulate it through the heat exchanger and return it to the pit. Another 1 l pump is used to circulate refueling water through the demineralizer and filter for purification. Compo-nent cooling water cools the heat exchanger. Redun-dancy of this equipment is not required because of the large heat capacity of the pit and the slow heat up rate as shown in Table 9.3-3 of the FSAR. However, r"}. in the event of failure of the spent fuel pump, xs o

(~} v alternate connections are provided for connecting a temporary pump to the spent fuel pit loop. This con-sists of blind flange connections in the suction and discharge piping. The clarity and purity of the spent fuel pit water is maintained by passing approximately 5 percent of the loop flow through a filter and demineralizer. The spent fuel pit pump suction line, which is used to drain the pit, penetrates the spent fuel pit wall above the fuel assemblies. The penetration location prevents loss of water as a result of a possible suction line rupture. (FSAR p. 9.3-7) ( The spent fuel pit cooling loop removes residual heat from fuel stored in the spent fuel pit. The loop can safely accomodate the heat load from 2-1/3 cores, for which there is storage space available. The spent fuel is placed in the pit during refueling and is stored until it is shipped to a reprocessing facility. The current pool design is 1500F maximum for the spent fuel pool temperature as indicated in Section 9. 3.1 of the FSAR (Letter from Carl L. Newman to George W. Knighton of NRC, dated August 19, 1975). o ... and (5) to prevent significant reduction in fuel stor-age coolant inventory under accident conditions."

Response : Alternate cooling capability can be made available

    -(])

j- under anticipated malfunctions or failures (expected fault conditons) . Loop piping is so arranged that failure of any pipe-line does not drain the spent fuel pit below the top of the stored fuel elements.

The design basis -for the loop provides the capability to totally unload the reactor vessel for maintenance or inspection at the time that 1 1/3 core already occupies the spent fuel storage pool.

1 I

i i i b l

i l I l Criterion 62 - Prevention of criticality in fuel storage  ! () and handling. Criticality in the fuel storage and handling l system shall be prevented by physical systems or processes, preferably by' use of geometrically safe configurations. Response: The fuel is stored vertically in an array with suffi-cient center-to-center distance between assemblies to assure Keff f 0.90 even if unborated water was used to fill the pit. (FSAR p. 9.5-2) In'the current spent fuel storage racks the center- l to-center spacing is 14.0 inches (reduced from 20.5 inches in the original design). The increase in reactivity caused by the reduction in spacing will be offset by using 1.0 w/o borated stainless steel Os

in the rack design. The calculated coefficient of i  !

reactivity for this design is 0.87. (Letter, dated j May 9, 1975 concerning proposed modification to

spent fuel storage racks, Con Edison, Cahill to NRC, I

                                                                                               ;

Lear.) l 4  ; i . I

                                                       , . . , - - . , .         -   ~ ~ - ~

Criterion 63 - Monitoring Puel and Waste Storage. Appro-O's / priate systems shall be provided in fuel storage and radioactive waste systems and associated handling areas (1) to detect conditons that may result in loss of residual heat removal capability and excessive readiation levels and (2) to initiate appropriate safety actions. o " Appropriate systems shall be provided in fuel storage and radioactive waste systems and associated handling areas (1) to detect conditions that may result in loss of residual heat removal capability and excessive radiation levels, ... Response: Monitoring and alarm instrumentation are provided for fuel and waste storage and handling areas to detect inadequate cooling and to detect excessive radiation levels. Radiation monitors are provided to maintain surveillance over the release operation, but the permanent record of activity releases is provided by radiochemical analysis of known quantities of waste. (FSAR p. 11-2. 2) o ... and (2) to initiate appropriate safety actions." Response: The spent fuel pit cooling loop flow is monitored to assure proper operation. ( FSAR p. 11-2. 2 and 11-2. 3) A controlled ' ventilation system removes gaseous radio-s activity from the fuel storage building and waste

 %)

l

treatment areas of the auxiliary building and dis-(]) charges it to the atmosphere via the plant vent. Radiation monitors are in continuous service in these areas to actuate high-activity alarms on the control board annunciator, as described in Section 11.2.3 of the FSAR. All waste handling and storage facilities are con-tained and equipment designed so that accidental releases directly to the atmosphere are monitored and will not exceed the limits of 10 CFR 100. The compon-ents of the Waste Disposal System are not subjected to any high pressures cr stresses and are Class I {} seismic design. In addition, the tanks, which have a design pressure greater than atmospheric pressure, piping and valves of the system are designed to appro-priate codes. Hence the probability of a rupture or failure of the system is exceedingly low. (FSAR pp. 11-2.2, 11-2.3) (. ) I I

II 7s Criterion 64 - Monitoring radioactivity releases. Means (_) shall be provided for monitoring the reactor containment atmosphere, spaces containing components for recirculation of loss-of-coolant accident fluids, ef fluent discharge paths, and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences, and from postulated accidents. Response: The containment atmosphere, the ventilation exhausts from the primary auxiliary building, the containment fan-coolers service water discharge, the component cooling loop liquid, the liquid phase of the secondary side of the steam generator and the condenser air ejector exhaust are monitored for

   )            radioactivity concentration during normal operation, anticipated transients and accident conditions.

(FSAR p. 6.7-2) The containment a'tmospshere, the plant vent, the containment fan-coolers service water discharge, the Waste Disposal System liquid effluent and the component cooling loop are monitored for radioactivity concen-tration during all normal operations, anticipated transients, and accident conditions. For the case of leakage from the reactor containment under accident conditions the plant area radiation monitoring system supplemented by portable survey (])  ; l

sJ equipment to be kept in the control room provides adequate monitoring of accident releases. (FSAR p. 1.3-9) There is an ongoing off-site Indian Point Radio-logical Environmental Monitoring Program which routinely includes direct gamma measurements, air particulate and radioiodine sampling, water sampling and seasonal aquatic and land vegetation sampling at various locations within a seven and a half mile radius of t:.e plant. A description of the Indian Point Radiological Environmental Monitoring Program is contained in Section 4.2.1 of the Indian Point () Unit No. 2 Environmental Technical Specifications. A network of radiation monitoring devices are being installed in the four counties surrounding Indian roint at utility-owned sites and public safety facilities operable on a 24 hour basis; twenty (20) area monitors have been installed to date. Additional radiation monitoring devices will be installed at locations around the Indian Point site. These devices will continuously telemeter radiation level readings to a central location. The NRC may interrogate the central location and obtain data directly. f uJ l

e 4 O l APPENDIX B -- QUALITY ASSURANCE CRITERIA FOR NUCLEAR POWER PLANTS O O

                  /

Introduction. Every applicant for a construction permit is (~3 required by the provisions of S 50.34 to include in its prelimi-U nary safety analysis report a description of the quality assurance and testing of the structures, systems, and components of the facility. Every applicant for an operating license is required to include, in its final safety analysis report, information per-taining to the managerial and administrative controls to be used to assure safe operation. Nuclear power plants include structures, systems, and components that prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public. This appendix establishes quality as-surance requirements for the design, construction, and operation of those structures, systems, and components. The pertinent re-quirements of this appendix apply to all activities affecting the r'% (J safety-related functions of those structures, systems, and com-ponents; these activities include designing, purchasing, fabricat-ing, handling, shipping, storing, cleaning, erecting, installing, inspecting, testing, operating, maintaining, repairing, refueling, and modifying. As used in this appendix, " quality assurance" comprises all those planned and systematic actions necessary to prcvide adequate confidence that a structure, system, or component will perform satisfactorily in service. Quality assurance includes quality control, which comprises those quality assurance actions related to the physical characteristics of a material, structure, com-ponent, or system which provide a means to control the quality

r-() of the material, structure, component, or system to predetermined requirements. o "Every applicant for a construction permit is required . . . to include in its preliminary safetp analysis report a descrip-tion of the quality assurance program to be applied to the design, fabrication, construction, and testing of the structures, systems, and components of the facility." Response: The quality assurance program that was implemented for the construction phase of the nuclear plant is given in the Indian Point Unit 2 FSAR, Appendix B, pages B-1 through B-32, which applied for the design, fabri-cation, construction and testing of the structures,

  '~'

systems and components of the nuclear plant. o "Everp' applicant for an operatirg license is required to e include ... information pertaining to the managerial and administrative controls to be used to assure safe operation."

                ... include structures, systems, and components that prevent or mitigate the consequences of postulated acci-dents that could cause undue risk to the health and safety of the public."
              "'.   . . quality assurance requirements for the design, construc-tion, and operation of those structures, systems, and components."
                ... activities affecting the safety-related functions of A

kJ those structures, systems, and components; ... include

(]]) designing, purchasing, fabricating, handling, shipping, storing, cleaning, erecting, installing, inspecting, testing, operating, maintaining, repairing, refueling, and modifying." Response: -The quality assurance program for Indian Point Unit 2 is given in Con Edison document, Quality Assurance Program, Revised June 3, 1977 (hereinafter QA Program). All items (structures, systems and components) that prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public are identified as Con Edison Class

                 " A" in Appendix A of the QA Program. The managerial and administrative controls prescribed throughout the

(}} QA Program apply to the Class "A" items. These con-trols apply to activities involving design, construction and oparation which affect safety related functions of Class "A" items. Activities controlled include design-ing, purchasing, fabricating, handling, shipping, stor-ing, cleaning, erecting, installing, inspecting, testing, ! operating, maintaining, repairing, refueling and modi-fying Class "A" items. These activities of the program are implemented, reviewed, monitored and audited by means of corporate instructions, administrative orders, operating procedures and station procedures developed (3

 \_/.

by the participating organizations. (QA Program - Par. 3.1, p.1; Par. 3. 2, p.1; Appendix A, p.2. O l l O. l l

IT

 %i I. ORGANIZATION The applicant shall be responsible for the establishment and execution of the quality assurance program. The applicant may delegate to other organizations the work of establishing and exe-cuting the quality assurance program, or any part thereof, but shall retain responsibility thereof. The authority and duties of persons and organizations performing quality assurance functions shall be clearly established and delineated in writing.         Such persons and organizations shall have sufficient authority and organizational freedom to identify quality problems; to initiate, recommend, or provide solutions; and to verify implementation of solutions. In ganeral, assurance of quality requires management measures which provide that the individual or group assigned the
 .R kJ   responsibility for checking, auditing, inspecting, or otherwise verifying that an activity has been correctly performed is independent of the individual or group directly responsible for performing;the specific activity.

> o "The applicant shall be responsible for the establishment and execution of the quality assurance program." Response: The quality assurance program established and imple-mented by Con Edison is given in the document " Quality Assurance Program, Revised June 3, 1977" (QA Program). o "The applicant may delegate to other organizations the work of establishing and executing the quality assurance program, O (J' or any part thereof, but shall retain responsibility thereof."

p) (_ . Response: Lines of authority, responsibility, and communication among the organizations participating in the quality assurance program are shown in Chart A (corporate relationship) and Chart B (on-site organization) of the QA Program. The major organizations or groups partici-pating in this program are: Power Supply, Engineering, Construction, Purchasing, Quality Assurance and Reli-ability (QA&R), Nuclear Facilities Safey Committee, and Station Nuclear Safety Committee. Changes to the QA program, which is described in a corporate instruction, may be initiated by any of these organizations; how-ever, QA&R coordinates overall development of the QA program manual and obtains concurrences of the organi-O zations affected by the changes. The approval of the Senior Vice President in charge of QA&R is required for all changes to this corporate instruction. (QA Program

                     - par. 3.2, p.1 & 2; chart A, Chart B.)

o "The authority and duties of persons and organizations per-forming quality assurance functions shall be clearly estab-lished and delineated in writing. Such persons and organi-  ; zations shall have suf ficient authority and organizational 1

             -freedom to identify quality problems; to initiate, recommend, or provide solutions; and to verify implementation of solu-tions. In general, assurance of quality requires management

,_ measures which provide that the individual or group assigned

 ~

the responsibility for checking, auditing, inspecting, or 1 l

I) otherwise verifying that an activity has been correctly per-formed is independent of the individual or group directly responsible for performing the specfic activity." Response: All personnel involved in activities associated with the safety of the nuclear power plants participate in the quality assurance program. The duties and respon-i sibilities of the parti ipants are described in Position Guides, procedures or manuals. These duties and respon-sibilities are designed. to assure that the attainment of program objectives is verified by qualified personnel who do not perform or directly supervise the work. Duties and responsibilities of persons and organizations O participating in the quality assurance program in general are: o The Officer, Power Generation Operations and,

                            . under him, the Manager Nuclear Power Generation (NPG) and the Plant Manager are responsible for the day-to-day operation, safety, security and maintenance of the plant by NPG personnel.

o The NPG Quality Assurance Engineer reports to the - Manager, Nuclear Power Generation. He and his staff administer the quality program of the plant and have direct access for technical support to the corporate Quality Assurance organization t

    -(~)..
    - w,
                            -(OA&R).

i I' l

() o 'An on-site group known as the Station Nuclear Safety Committee (SNSC) functions within the on-site organization and advises the Plant Manager on all matters related to nuclear safety. The organization and duties of the SNSC are de-scribed in a charter forming part of Plant Technical Specifications. o The~ Nuclear Facilities Safety Committee (NFSC) is essentially an offsite group responsible for advising the Senior Officer, Power Supply re-garding plant safety. The organization and duties of this Committee are described in a charter forming part of the Plant Technical Spe .ations and approved by the President of the Company. o Engineering is responsible for the design acti-vities included in system and component modi-fication, including preparing, issuing, revising and controlling specifications, drawings, and other design documents. o_ Cons truction is responsible for plant modifica-tions funded from the company's capital budget, utilizing either company forces or outside con-tractor labor, and may also be given responsibility J for-selected repairs. O

_9_ o (]) Purchasing is responsible for preparing, issuing and controlling purchase orders, for the inventory control of Class A stock items and for maintaining an approved vendors' list and handling vendor negotiations. o QA&R is responsible for assuring that quality assurance programs are established consistent with this program and Company policy and assures that these programs are properly implemented. QA&R carries out these responsibilities primarily through program development and by auditing those activities which affect plant safety. QA&R de-(} velops audit plans and schedules, and administrates other activities associated with auditing. The Director QA&R reports directly to a Senior Vice President of the Company. This provides QA&R with the authority and organizational freedom to identify quality problems; to initiate, recommend or provide solutions through designated channels; and to verify implementation of solutions.

         ' (QA Program - Par. 3.2, p.1, 2, 3& 4) e~

p. . . - .-

0 11- oua'1rr ^ssua^"c= vaoca^" The applicant shall establish at the earliest practicable time, consistent with the schedule for accomplishing the activities, a quality assurance program which complies with the requirements of this appendix. This program shall be documented by written policies, procedures, or instructions and shall be carried out throughout plant life in accordance with those poli-cies, procedures, or instructions. The applicant shall identify the structures, systems, and components to be covered by the quality assurance program and the major organizations participat-ing in the program, together with the designated functions of these organizations. The quality assurance program shall provide control over activities affecting the quality of the identified O structures, systems, and components, to an extent consistent with their importance to safety. Activities affecting quality shall be-accomplished under suitably controlled conditions. Controlled conditions include the use of a' propriate J equipment; suitable environmental conditions for accomplishing the activity, such as adequate cleanness; and assurance that all prerequisites for the given activity have been satisfied. The program shall take into account the need for special controls, processes, test equipment, tools, and skills to attain the required quality, and the need for verification of quality by inspection and test. The program shall provide for indoctrination and training of personnel per-forming activities affecting quality as necessary to assure that ({}; suitable proficiency is achieved and maintained. The applicant 1

im (_) shall regularly review the status and adequacy of the quality assurance program. Management of other organizations participat-ing in the quality assurance program shall regularly review the status and adequacy of that part of the_ quality assurance program which they are executing. i o "The applicant shall establish ... a quality assurance pro-gram which complies with the requirements of this appendix. This program shall be documented by written policies, pro-cedures, or instructions and shall be carried out throughout plant life ..." Response: The " Quality Assurance Program, revised June 3, 1977" O (QA Program) establishes Con Edison's quality assurance program for the nuclear plant. This program conforms with the requirements of 10CFR50, Appendix B. This program is in ef fect at all times (i.e. , for the life of the plant) to assure that operational phase activi-ties are carried out without undue risk to the health and safety of the public. .This program is documented through corporate instructions and administrative proce-dures developed by the participating organizations and provides the required controls. (QA Program Foreward,

p. i; par. 3.1, p.l.)

4

(]) o "The applicant shall identify the structures, systems, and components to be covered by the quality assurance program and the major organizations participating in the program, to-gether with the designated functions of these organizations." Response: Nuclear power plant structures, systems, components and consumables covered by this program are identified as

                   " Class A items" and are those that prevent or mitigate the consequences of postulated accidents that could cause undue risk to the health and safety of the public.

A list of " Class A" items appears in Appendix A of the QA Program. The major organizations or groups partici-pating in the program are Nuclear Power Generation () (NPG), NPG Quality Assurance, Nuclear Facilities Safety Committee, Station Nuclear Safety Commit' tee, Engineer-ing, Construction, Purchasing and Corporate QA (QA&R). The functions and responsibilities of these organiza-tions or groups are given in the response to criterion I. ORGANIZATION. (QA Program - Par. 3.1, p.1; Par. 3.2, p.1, 2, 3& 4; par. 5.1, p. 9& 10; Appendix A, p.2) o "The quality assurance program shall provide control over activities affecting the quality of the identified struc- , l I tures, systems, and components, to an extent consistent with their importance to safety [and these] activities ...

 ' n/

(') shall be accomplished under suitably controlled conditions." I I

                                    /~N Response:   This program is documented through corporate instructions G

and administrative procedures developed by participating organizations and provides control of activities affect-ing the quality of structures, systems, and components t of the' nuclear plants and their operation consistent with their importance to safety. These activites are I accomplished under suitably controlled conditions in that they are performed in accordance with applicable procedures, manuals, instructions, drawings, specifica-tions and other documents that take into account, as appropriate, planning requirements, guidance of codes

               ' and standards, the levels of skills required to do the work, and the assurance that properly identified accept-()              able material is used. Preparation involves considera-tion of such factors as assigning responsibilities, identification of instructional-type documents, sched-uling and interfacing with other applicable operations activities. Included in the instructional-type docu-ments are precautions to be observed, installation instructions, identification of equipment (s), pro-cedures, travelers, step check lists, inspection points, and cleaning, handling and housekeeping requirements, as applicable. Particular attention is paid to necessary prerequisites such as assignment of personnel,

, assurance that proper documentation and materials are gs available, need for manufacturer's manuals and V

(~') x, preparation for documenting results. Pre-installation activites extend to assuring that only properly accepted material is used, instructional material is available and work permissions have been granted. (OA Program - Par. 3.1, p.1; par. 5.2.7, p. 14 & 15.) o "The program shall take into account the need for special controls, processes, test equipment, tools, and skills to attain the required quality, and the need for verification of quality by inspection and test." Response: This program takes into account the need for special controls, processes, tests, equipment, tools and ' skills to attain the required quality and the need for verification of quality by inspection, evaluation or test. These needs are accommodated through the issuance of and compliance with procedures, such as: o Non-Destructive Examination Procedures o Welding Procedures o Operating Procedures o Start-up Testing Procedures o Calibration of Measuring and Test Equipment o Receiving Inspection Procedures o Vendor Evaluation Procedures o Maintenance and Modification Procedures (QA_ Program - Par. 5.1, p. 10.)

 .n U

o "The program shall provide for indoctrination and training d(' of_ personnel performing activities affecting quality as necessary to assure that suitable proficiency is achieved and maintained." Response: Indoctrination and training in the administrative con-trols and quality assurance program is conducted for Con Edison Engineering, Purchasing, Construction, Operations, Maintenance and Quality Assurance personnel who perform activities which affect quality. This training includes: (1) company policies, procedures and instructions which establish the program, (3 (.s (2) procedures or instructions which implement the program. -. Additional special training for these personnel, as applicable, includes: (1) Personnel participating in the Quality Assurance Program are conversant with the requirements of Appendix B to 10CFR50 and the ANSI Standards and Regulatory Guides, as appropriate, listed in the l l Foreword. To further their understanding of this document, such personnel participate in industry-technical society discussion groups and maintain con'cact with latest industry literature. pd

_v (') (2) Training of Quality Assurance personnel is based on the individual' needs to improve or develop new skills in performing their jobs. Accordingly, selected courses are attended by Con Edison QA Examiners and Consultants at various times. These courses are in the areas of QA management, QA re-quirements for the nuclear industry, engineering, auditing, reliability, n6n-destructive examina-tion techniques, and welding technology. When required by Code, detailed and specific training is given to examiners in non-destructive examina-tion in accordance with SNT specifications.

   ~N       (3)  Per corporate policy, each line organization (J

trains its personnel. Accordingly, the NPG Quality Assurance Engineer trains station person-nel who report to him. (4) For Station Staff retraining and replacement training, a program is maintained under the direction of the Nuclear Training Director. A record of training sessions, including a list of those attending and a description of the materials discussed, is maintained. (QA Program - Par. 3.2, p.4; Par. 3.3, p. 4 & 5.) A V ==. .

                                                    /~T    o-
                    "The applicant shall regularly review the status and adequacy

(_/ Management or other of the quality assurance program. organizations participating in the quality assurance program shall regularly review the status and adequacy of that part of the quality assurance program which they are executing." Response: The total program definition is reviewed by Corporate QA (QA&R) at least every two years to assure continued program adequacy. This review involves the documents identified in the index discussed below. Provisions have been made for periodic review and up-dating of administrative orders and directives of the program. Station Administrative Orders are reviewed O~s biennially. The Plant Manager and the NPG Quality Assurance Engineer ensure that these reviews are accomp-lished and report the results to the Department Manager. In addition, these managers review biennially the administrative directives of their respective subsec-tions and report upon their adequacy and consistency to the Manager, Nuclear Power Generation. Each organi-zation participating in this administrative controls and quality assurance program identifies to QA&R , administrative documents judged necessary to implement

 '                          the administrative controls and quality assurance pro-gram. The organizations responsible for these documents include' QA&R on distribution as each is issued or O%w

changed. QA&R, in a timely manner, reviews these documents to assure that each includes adequate quality assurance principles. In addition, QA&R maintains an index of documents that define the basic structure of the administrative controls and quality assurance program. (QA Program - Par. 3,2, p.4; Par. 5.2.3, p. 12; Par. 5.2.15, p. 33 & 34.) 4 j i. h

1 1; i l

                 ...              . _ . .          .    . ._    ...   .., _--..\

                                      ~ 19 -

III. DESIGN CONTROL (. . Measures shall be established to assure that applicable regulatory requirements and the design basis, as defined S 50.2 and as specified in the license application, for those structures, systems, and components to which this appendix applies are cor-rectly translated into specifications, drawings, procedures, and instructions. These measures shall include provisions to assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled. Measures shall also be established for the selection and review for _ suitability of application of materials, parts, equipment, and processes that are essential to the safety-related functions of the structures, systems and components. Measures shall be established for the identification and control of design interfaces and for coordination among partici-pating design organizations. These measures shall include the establishment 1of procedures among participating design organiza-tions for the review, approval, release, distribution, and re-vision of documents involving design interfaces. The design control measures shall ' provide for verifying or checking the adequacy of design, such as by the performance of design reviews, by the use of alternate or simplified calcula-tional methods, or by the performance of a suitable testing pro-gram. The verifying or checking process shall be performed by individuals or groups other than those who performed the original d

7N design, but who may be from the same organization. Where a test \-) program is used to verify the adequacy of specific design feature in lieu of other verifying or checking processes, it shall include suitable qualification testing of a prototype unit under the most adverse design conditions. Design control mea-sures shall be applied to items such as the following: reactor physics, stress, thermal, hydraulic, and accident analyses; compatibility of materials; accessibility for inservice inspec-tion, maintenance, and repair; and delineation of acceptance criteria for inspections and tests. Design changes, including field changes, shall be subject to design control measures commensurate with those applied to the g-) original design and be approved by the organization that performed U the original design unless the applicant designates another re-sponsible organization. o " Measures shall be established to assure that applicable regulatory requirements and the design basis ... for ... structures, systems, and components ... are correctly translated into specifications, drawings, procedures, and instructions. These measures shall include provisions":

                ",--   s assure that appropriate quality standards are specified and included in design documents and that deviations from such standards are controlled."
               " . . . for the selection and review for suitability of
 ,_            spplication of materials, parts, equipment, and processes U

t

that are essential to the safety-related functions of O the ... [ Class A items)."

                 ... for the identification and control of design inter-faces and for coordination among participating design organizations."
                 ...  [for] establishment of procedures among participat-ing design organizations for the review, approval, release, distribution, and revision of documents involving design interfaces."

Response: The design activities related to modifications to plant Class A items are performed in accordance with a docu-mented control system. Usually, there is a three stage process for a given modification; (1) the development O of design criteria, (2) the determination of the need for concee .ual arrangements, and (3) the preparation of the various detailed design documents that will be used in the work. Generally, the extent to which each of these applies is dependent on the complexity of the work. Engineering procedures are in effect concerning the control and implementation of these design activites, which include:

               - Design requirements and standards and their control:
                   -- Requirements of codes, standards, and regulatory agencies.
                   -- Safety requirements.

IO v

(~1 -- Environmental, cleanness and quality assurance (_/ ' requirements.

        -- Control of radiation exposure, both to the public and plant personnel.
        -- Provisions for handling, storage, cleaning and        )

i shipping, as applicab3e.

        -- Requirements for welding.

1 -- Deviations f rom design requirements and standards controlled in accordance with system for control of nonconforming items and corrective action. (See response to Criterion XV and Criterion XVI.)

      - Design selection:
        -- Conditions affecting design such as pressure, temperature, voltage, stress and seismic loads.
        -- Functional and physical interfaces between systems.
        -- Suitability of parts, equipment or processes for the application.
        -- Compatibility of materials with each other and with the design environment.
        -- Analytic methods (computations and calculations).

Determining the reasonableness of results in com-parison to design bases.

        -- Performance characteristics.
        -- Electrical. layouts.

Design Interfaces: [h s'J -- Responsibilities within the Central Engineering organizational unit and its various disciplines.

       -- Managing the flow of technical information between internal supporting disciplines such as Civil, Electrical and Mechanical Engineering and the design and drafting group of Central Engineering.

Externally supported design activities are con-trolled through procurement of subcontracted services as the need arises. 4

       -- Guidance for performing design verification.
       -- Defining operating, maintenance, testing and inspection requirements, as applicable.

(} -- Approval of vendor design submittals.

       -- Evaluating safety significance to assure com-pliance with regulatory requirements.
       -- Verification that pertinent quality provisions i

have been incorporated.

       -- Rules for utilizing original Architect-Engineer and NSSS design details in plant replacement items, additions or modifications.
       -- Prerequisites.
       -- Rules for development of design criter.ia, design concepts, detailed designs, integration of field Engineering forces, and review by affected Engi-neering disciplines; as applicable to the scope

' (x- of the particular modification.

                                      - (-ss-)             - Design document control:
                      -- Document controls on the preparation review, approval, release, had distribution of documents and their changes, including field changes.
                      -- Rules concerning retention of design documents.

(OA Program - Par. 5.2.7, p. 16, 17, 18 & 19; Par. 5.2.11, p. 22 & 23; Par. 5.2.14, p. 31 & 32.) o "The design control measures shall provide for verifying or checking the adequacy of design . . .":

                      "The verifying or checking process shall be performed by individuals or groups other than those who per-formed the original design, but who may be from the
/"3                   same organization."

V "Where a test program is used to verify the' adequacy ... in lieu of other verifying . . . processes, it shall include suitable qualification testing ... under the most adverse design condition. " Response: Engineering prepares, issues, revises, and controls design documents including. specifications , drawings, i and modification procedures. These documents are re-viewed by other than the originating individual. , Included in the review organizations are Engineering, Nuclear Power Generation,-and other affected inter-facing organizational units. When applicable, design adequacy verification is by pre-operational performance (~)N

s. -

1

(v ') testing which provides an added measure of confidence that systems and components will continue to perform their intended functions af ter maintenance or modifica-tion. The Plant Technical Specifications incorporate various engineering requirements and parameter limits that are applicable during operation of the plant. Permissibility of qualification testing alternatives as a verification technique is considered in design activities. (QA' Program - Par. 5.2.7, p. 14; Par. 5.2.7.2, p. 18

                      & 19; Par. 5.2.15, p. 33; Par. 5.2.19, p. 37.)

o " Design control measures shall be applied to items such as the following: reactor physics , stress , thermal,

        )'

hydraulic, and accident analyses; compatibility of materials; accessibility for inservice inspection, maintenance, and repair; and delineation of acceptance criteria for inspections and tests." Response: Engineering procedures are in effect which establish , rules for development of design criteria, design con-cepts, detailed designs, integration of field Engineer-ing. forces, and review by affected Engineering dis-ciplines; as applicable to the scope of the particular design which includes defining operating, maintenance, testing and. inspection requirements, as applicable.

    /~'s              (OA Program - Par. 5.2.7.2, p. 17)

LI

o- " Design changes , including field changes, shall be subject to design control measures commensurate with those applied to the original design and be approved by the organization that performed the original design unless the applicant designates another responsible organization."

                 ~

Response: Engineering procedures are in effect for document con-trols on the preparation, review, approval, release, - and distribution of documents and their changes. These measures assure that documents, including changes, are reviewed for adequacy and approved for release by authorized personnel and are distributed

to and used at the location where the prescribed activity is performed.

(QA Program - Par. 5.2.7.2, p. 17; Par. 5.2.15, p. 33.) l l l l

                                       -\_/

(^)- IV. PROCUREMENT DOCUMENT CONTROL Measures shall be established to assure that applicable regulatory requirements, design bases, and other requirements which are necessary to assure adequate quality are suitably in-cluded or referenced in the document for procurement of material, equipments and services, whether purchased by the applicant or by its contractors or subcontractors. To the extent necessary, pro-curement documents shall require contractors or subcontractors to provide a quality assurance program consistent with the pertinent provisions of this appendix. o " Measures shall be established to assure that applicable regulatory requirements, design bases, and other require-ments which are necessary to assure adequate quality are

     }

suitably included or referenced in the document for pro-curement of material, equipment, and services, whether purchased by the applicant or by its contractors or sub-contractors." Response: Measures have been established for procurement docu-mentation and control of materials and components which effect plant safety, including spare and re-placement parts. Procedures and appropriate instruc-tions assure that purchased materials and components associated with safety-related structures or systems are purchased to appropriate specifications and ('N codes; produced or fabricated to proper requirements;

  %-)

l

packaged and transported in a manner that will maintain (x, '] their quality; properly documented, completed, identified and stored; and correctly controlled to assure the identification, segregation, and disposition of non-conforming material. These procedures, as appropriate, provide for procurement document preparation, review and change control; selection of procurement sources; bid evaluation and award; control of suppliers' per-formance, verification of material quality, control of nonconforming items, acceptance of items and ser-vices, maintenance of quality assurance records; evaluc 'on of the procurement process, corrective action, and QA requirements imposed by the vendor on fi s/ his subcontractors. (QA Program - Par. 5.2.13, p. 24; Par. 5.2.13. 2, p.27) o "To the extent necessary, procurement documents shall require contractors or subcontractors to provide a quality assurance program consistent with the pertinent provisions of this appendix." Response: Procurement documents include, as appropriate, pro-visions for the scope of work to be accomplished; technical requirements; quality assurance program requirements; a statement of' right of access to a supplier's plant, facility and records; special quality assurance requirements; documentation and, (~)N

(} as applicable, provisions for processing noncon-formances and QA requirements imposed by the vendor on his subcontractors. These quality assurance program requirements are imposed on a vendor by means , such as specifying applicable provisions of Con Edison's quality assurance specifications, pertinent Code quality assurance requirements, such as, ASME Section III, ANSI N45.2 or unique requirements for the specific purchase order. (QA Program - Par. 5.2.13, p. 24; Par. 5.2.13.1, p. 24) O

V. INSTRUCTIONS, PROCEDURES, AND ORAWINGS (']

      \_/

Activities affecting quality shall be prescribed by docu-mented instructions, procedures, or drawings, of a type appro-priate to the circumstances and shall be accomplished in accordance with these instructions, procedures, or drawings. Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished. o Requirements for instructions, procedures, and drawings assure that:

                      " Activities affecting quality shall be prescribed by documented instructions , procedures, or drawings, of a type appropriate to the circumstances and shall be

(~} v accomplished in accordance with these instructions, procedures, or drawings."

                      " Instructions, procedures, or drawings shall include appropriate quantitative or qualitative acceptance criteria for determining that important activities have been satisfactorily accomplished."

Response: Activities involving Class A items are performed in accordance with applicable procedures, manuals, I instructions, drawings, specifications and other documents that take into account, as appropriate, planning requirements, guidance of codes and standards,

       ~                   the levels of skills required to do the work, and the l (v}

assurance that properly identified acceptable material p) (_ is used. Preparation involves consideration of such factors as assigning responsibilities, identification of instructional-type documents, scheduling and inter- i facing with other applicable operations activities. Included in the instructional-type documents are pre-  ; cautions to be observed, installation instructions, identification of equipment (s), procedures, travelers, step check lists, inspection points, and cleaning, handling and housekeeping requirements, as applicable. Particular attention is paid to necessary prerequisites such as assignment of personnel, assurance that proper documentation and materials are available, need for 73 manufacturer's manuals and preparation for documenting .!') results. Pre-installation activities extend to assur-ing that only properly accepted material is used,

        . instructional material is available and work permissions have been granted. The instructions and procedures are prepared by organizations participating in the program (e.g., Nuclear Power Generation, Engineering, Construc-tion, Puryhasing and VA&R) are reviewed, approved and controlled in accordance with established administra-tive procedures-to ensure their propriety. The require-ment that procedures be adhered to is both a plant administrative requirement and a Plant Technical Specification requirement.
        .(QA Program - Par. 5.2.2, p. 11;-Par. 5.2.7, p. 14 & 15;

(~-s! . Par. 5.3, p.38)

5 VI. DOCUMENT CONTROL Measures shall be' established to control the issuance of documents, such as instructions, procedures, and drawings, in-cluding changes thereto, which prescribe all activities af fect-ing quality. These measures shall assure that documents, including changes,: are reviewed for adequacy and approved for release by authorized personnel and are distributed to and used at the loca-tion where the prescribed activity is performed. Changes to documents shall be reviewed and approved by the same organizations

that performed the original review and approval unless the appli-cant designates another responsible organization.

o " Measures shall be estabished":

                   '- "tc control the issuance of documents, ... including                                                                              .

{ changes thereto, which . prescribe all activities af fecting  ? quality."

                      ' "to assure that documents, -including changes, are reviewed.
                       -for adequacy and approved for release by authorized per-sonnel and are distributed to and used at the location                                                                           j where the. prescribed activity is performed."                                                                                    f t
                        "that changes to documents shall be reviewed and approved                                                                       l

{ by the same organizations that performed the original l review and ' approval unless the applicant designates another responsible. organization." Response.: The administrative controls and quality assurance pro--

                           . gram provide measures which control and coordinate

{ l

                                                                                                                                                      'l l
   ~-     ,,a,     -                 _ ,      - , , , , . . . _ . . _ , - , _ _ _ _ . . -                 . _ _ , _ - _ _ . .              .       _,

()

  ~

the approval and issuance of documents, including changes thereto, which prescribe activities affecting quality. These documents include those which describe organizational interfaces or which prescribe activi-ties affecting safety-related structures, systems, or components. These documents also include operating and special orders, operating procedures, test pro-cedures, equipment control procedures, maintenance or modification procedures, refueling and material con-trol procedures. These are in the form of documents s such as station adrainistrative orders, general admin-istrative directives, administrative directives, corporate Quality Assurance operating procedures, t\-')T Purchasing, Engineering and Construction procedures and corporate instructions. Procedures or instructions are reviewed by other than the originating individual. Included in the review organizations are Nuclear Power Generation, Engineering, Construction, Purchasing, and QA&R. Changes to procedures or instructions are re-viewed and approved by th6 appropriate organization. The system for review, approval and control of instruc-tions or procedures provides for the identification of individuals and organizations involved, identification, as appropriate, of documents to be used in performing the activity, coordination and control of interface o.

r I documents and the maintenance and updating of distri-bution lists. Measures. assure that documents, including changes, are ' reviewed for adequacy and approved for  ; i release by authorized personnel and are distributed to and used at the location where the prescribe,d activity I is performed. l (QA Program - Par. 5.2.15, p. 32 & 33) i d 1 i h a t-4 !O 4 2 4 1 i r 4 4 i ' ee O.

                                   /^

VII. CONTROL OF PURCHASED MATERIAL, EQUIPMENT, alD SERVICES ()N Measures shall be established to assure that purchased material, equipment, and services, whether purchased directly or through contractors and subcontractors, conform to the pro-curement documents. These measures shall include provisions, as appropriate, for source evaluation and selection, objective evidence of quality furnished by the contractor or subcontractor, inspection at the contractor or subcontrdctor source, and exami-nation of products upon delivery. Documentary evidence that material and equipment conform to the procurement requirements shall be retained at the nuclear power plant site and shall be sufficient to identify the specific requirements, such as codes,

 -   standards, or specifications, met by the purchased material and l equipment. The effectiveness of the control of quality by con-tractors and subcontractors shall be assessed by the applicant or designee at intervals consistent with the importance, com-plexity, and quantity of the product or services.

o " Measures shall be established to assure that purchased material, equipment, and services, whether purchased directly 7r through contractors and subcontractors, con-form to the procurement documents. These measures shall include provisions, as appropriate, for:

             " Source evaluation and selection, objective evidence of quality furnished by the contractor or subcontractor, inspection at the contractor or subcontractor source,

/~3 \ >' and examination of products upon delivery." 7

(} " Documentary . evidence that material and equipment conform to the procurement requirements . . . available at . . . plant site prior to installation or use of such. . ."

              ". . . Documentary evidence . . . retained at . . . plant site sufficient to identify the specific requirements . . . met by the purchased material and equipmer.t."
              " ... Effectiveness of the contro] of quality by contractors          l and subcontractors . . . assessed . . . at intervals consistent with the~importance, complexity, and quantity of the pro-             ,

duct or services. " Response: Measures have been established which assures that pur-chased items and services, whether purchased directly {} or through contractors, conform to procurement docu-ments. These' measures include provisions, as appro-priate, for source evaluation and selection, ::jective evidence of quality furnished by the contracter, in-spection and audit at the source and examination of items upon delivery. Representatives from Purchasing, Engineering, and QA&R evaluate the capabilities of vendors on the :.;; roved vendor's list. The Engineering Department r i ,; r i sen t a-tive evaluates the overall manuf acturing ca.ca:-lity . of the vendor, including his parcicular tech..;:al ability to produce the item or. component delineated - the (~T specification. The Purchasing Department re. r r * 'en ta t iVO T._/

I~N : evaluates the vendor's financial and administrative x_) capabilities. The QA&R representative evaluates the vendor's quality assurance program. For a vendor to be maintained on the approved vendors' list, an evaluation of that vender is made at least once every five years. Additional reviews of a vendor's facili-ties or his performance may be conducted by QA&R on a more frequent basis. During the course of production, manufacturing or service activities, surveillance of the vendor's performance may be conducted. Vendor surveillance plans are prepared for complex equipment. These surveillance plans identify the areas

(~} such as, tests and records to be reviewed. The

 %/

applicable purchase order, including the specifications and drawings, forms the basis for determining the areas for review. Material received at the site is inspected by NPG Quality Assurance in accordance with approved written instructions. Documentary evidence that material and equipment conform to the procurement requirements is available at the Nuclear Power Plant site prior to use of such material and equipment. Receiving inspec-tion written instructions require, as appropriate, checking that objective evidence of quality required (^} (/ from the vendor has been received. Results of receiving

P inspections are documented on a checklist, which in-i cludes, as a minimum, the identity of the inspector, i the type and results of inspection, the acceptability,

and the action taken in connection with any deficiencies

noted.

(OA Program - Par. 5.2.13.2, p. 26 & 27) 4 5 4 4 O 1 i o a 1 e i h i. E 4

O j

1

        ,     ,-,. w       - - - -      y- + ,r w,, w -,n --,,,-,,---.-,---,,--,--,w,se-- ,-- , , -,- ----.~r+ -,

f) x' VIII.- IDENTIFICATION AND CONTROL OF MATERIALS, PARTS, AND COMPONENTS Measures shall be established for the identification and control' of materials , parts , and components , including partially fabricated assemblies. These measures shall assure that identi-fication of the item is maintained by heat number, part number, serial number, or other appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installation, and use of the item. These identification and control measures shall be designed to prevent the use of incorrect or defective material, parts, and components. o " Measures shall be established for the identification and control of materials, parts, and components, including partially fabricated assemblies. These measures shall assure that":

               " Identification of the item is maintained by heat number, part number, serial number, or other appropriate means, either on the item or on records traceable to the item, as required throughout fabrication, erection, installa-tion, and use of the item."
               " . . . Identification and control measures shall be designed to prevent the use of incorrect or defective material, parts, and components."

Response: Measures have been established for the identificacian and control of material, parts and components. Pro- ) I^') (_) cedures are provided by Nuclear Power Generation,

Eng'ineering, QA&R and, as appropriate, other involved ( ) organizations which insure that only accepted items are used and installed and which, where applicable, relate an item to an applicable drawing, specifica-tion or other pertinent technical document. Identi-fication marking is applied by suppliers and/or Con Edison organizations in a clear, unambiguous manner which does not adversely affect the function of the item. When groups of items are sub-divided, identi-fication marking is appropriately transferred to smaller groups or individual items by NPG storeroom personnel except for indication of inspection status identification (" accept" tags, etc. ) which is trans-ferred by NPG QA personnel. 1 i

f~)

 \_/

IX. CONTROL OF SPECIAL PROCESSES Measures shall be established to assure that special pro-cesses, including welding, heat treating, and nondestructive testing, are controlled and accomplished by qualified personnel

     -using qualified procedures in accordance with applicable codes, standards, specifications, criteria, and other special requirements.

o " Measures shall be established to assure that special pro-cesses ... are controlled and accomplished by qualified personnel using qualified procedures in accordance with applicable ... requirements." Response: Measures have been established and documented which assure that special processes are accomplished under controlled conditions employing appropriately quali-fied personnel and procedures. Engineering prepares in-house welding procedures and acceptance criteria. Power Generation Maintenance qualifies welding procedures and personnel to applicable ASME Codes and maintains appropriate records in accordance with ASME Code Section IX. Welding materials are specified, purchased, receipt inspecteG, stored, identified, and issued in accordance with written procedures. Engineering provides weld joint identification and authorizes weld modifications or repair. Welding performed b'y contractors requires nv

rw prior Engineering approval. Heat treatment is con-V ducted in accordance with approved procedures. Nuclear Power Generation provides Engineering with weld "as-built" information identifying weld locations and identification numbers when they are generated. The NPG Quality Assurance Engineer assures the proper completion of weld inspection forms, that welds have been inspected and accepted, provides permanent record of weld acceptability and monitors welding activities to assure compliance with approved procedures. Con Edison Non-Destructive Examination personnel are qualified in accordance with ASME Code Section III and

   ) S.N.T. TC-1A.

The Director, Quality Assurance or his designee certi-fies Level III Non-Destructive Examiners. Level III examiners are responsible for examinations of Level I and Level II personnel. All NDE personnel must meet the required physical fitness criteria, pass a written s examination, satisfactorily operate test equipment and interpret or analyze collected indications. Engineer-ing identifies the type of NDE to be performed. The j NPG Quality Assurance Engineer monitors NDE services to assure compliance with requirements and maintains appropriate records of worked performed. D , C/ l l 1

. - 43.- ,

-

I) . Chemical cleaning may be required during certain main-tenance or modification work. The maintenance pro- , cedure identifies the approved process to.be followed i i as well as any inspections and other controls required. (OA Program - Par. 5.2.18, p. 36) O , l O

{} X. INSPECTION A program for inspection of activities affecting quality shall be established and executed by or for the organization performing the activity to verify conformance with the documented instruc-tions, procedures, and drawings for accomplishing the activity. Such inspection shall be performed by individuals other than those who performed the activity being inspected. Examinations, measurements, or tests of material or products processed shall be performed for each work operation where necessary to assure quality. If inspection of processed material or products is impossible or disadvantageous, indirect control by monitoring processing methods, equipment, and personnel shall be provided. Both inspection and process monitoring shall be provided when () control is inadequate without both. If mandatory inspection hold points, which require witnessing or inspecting by che applicant's designated representative and beyond which work shall not proceed without the consent of its designated representative are required, the specific hold points shall be indicated in appropriate documents. o "A program for inspection of activities affecting quality shall be established and executed by or for the organiza-tion performing the activity to verify conformance with the documented instructions, procedures, and drawings for accomplishing the activity." v)

3 Programs for inspection of items and activities affect- [~}

   \_/

Response

ing safety have been established and are implemented by personnel reporting to the Maintenance Engineer, the NPG Quality Assurance Engineer, under the direction of the Construction Department or by other properly autho-rized personnel. Quality requirements are established by Engineering, the NPG Quality Assurance Engineer or the Maintenance Engineer. The NPG Quality Assurance Engineer assures that requirements are identified and determines the independent inspections to be performed to assure compliance. (QA Program - Par. 5.2.17, p. 35) o "Such inspection shall be performed by individuals other than those who' performed the activity being inspected. Examinations, measurements, or tests of material or products processed shall be performed for each work operation where necessary to assure quality." Response: For plant maintenance and modification, examination, checks and inspections are normally. accomplished by foremen responsible for the work. When independent examinations are deemed necessary the examinations are accomplished by personnel who did not perform the work and who did not directly supervise the work, The NPG Quality Assurance Engineer determines the indepen-dent inspection required and prepares work inspection

7-s instructions. Work inspection instructions specify b the inspections, documentation required and hold points for a job. For large and complex work, travelers are issued by the pro:ect managing activity (Construction or' Power Supply). The NPG Quality Assurance Engineer concurs in the traveler. The traveler identifies the operations to be performed on an item af ter it is drawn from Stores. Mandatory independent inspection hold points are identified on the traveler. The NPG Quality Assurance Engineer maintains records, of re-quired independent inspection activities. (QA Program - Par. 5.2.17, p. 35) g o "If mandatory inspection hold points, which require witness-(G ing or inspecting by the applicant's designated representa-tive and beyond which work shall not proceed without the consent of its designated representative are required, the specific hold points shall be indicated in appropriate ~ documents." Response: See the proceeding response giving requirements for j inspection control documents and hold points; then in addition, inspection personnel reporting to the NPG Quality Assurance Engineer have the authority to order < cessation of work by maintenance personnel where con-tinuation of work would lead to unacceptable conditions, Work may be' resumed if approved by Plant Quality g-] V

ew Assurance supervision or the Plant Manager or manage-V) f ment levels above the Plant Manager. (QA Program - Par. 5.2.17, p. 35) o "If inspection of processed material or products is impossible or disadvantageous, indirect control by monitoring processing methods, equipment, and personnel shall be provided. Both inspection and process monitoring shall be provided when control is inadequate without both.'" Response: QA&R evaluates the vendor's quality assurance program and prepares vendor surveillance plans for complex

equipment. These surveillance plans identify the areas such as, tests and records to be reviewed. The

() applicable purchase order, including the specifica-tions and drawings, forms the basis for determining the areas for review, which may include indirect process control surveillance as required. (QA Program - Par. 5.2.13.2, p. 26 & 27) U(3

4 (~h XI. TEST CONTROL

 'V A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and acceptance limits contained in applicable design documents. The test program shall include, as appropriate, proof tests prior to installation, preoperational tests, and operational tests during nuclear power plant opera-tion, of structures, system and components. Test procedures shall include provisions for assuring that prerequisites for the given test have been met, that adequate test instrumentation-is available and used, and that the test is performed under suitable environmental conditions. Test results shall be documented and e/aluated to assure that test requirements have been satisfied.

o "A test program shall be established to assure that all testing required to demonstrate that structures, systems, and components will perform satisfactorily in service is identified and performed in accordance with written test procedures which incorporate the requirements and accep-tance limits contained in applicable design documents." Response: The Plant Technical Specifications incorporate various engineering requirements and parameter limits that are applicable during operation of the plant. Procedures include measures to report conditions adverse to quality (mq,,) t r - - -

                                       /~              and to assure adequate corrective action. The NFSC

(_)N reviews proposed changes to procedures which involve an unreviewed safety question as defined in Section 50.59, 10CFR. Nuclear Power Generation establishes procedures for indicating the status of inoperable equipment; for example, tagging valves and switches to prevent inadvertent operation. Power Supply pro-vides, and maintains control over, operating procedures and test procedures to assure that they are appro-priately. prepared, authorized, implemented, documented and evaluated. A series of periodic tests have been prepared to satisfy the requirements of the Plant Tech Specs. (QA Program - Par. 5.2.19, p. 37) l o "The test program shall include as appropriate, proof tests prior to installation, preoperational tests, and operational , 1 tests during nuclear power plant operation, of structures, system and components." ) l Response: Maintenance and preoperational test control consists of the following: o Each Maintenance Work Request (MWR) issued for Class A items is evaluated for retest requirements by the Test And Performance Engineer who provides i such requirements as necessary.

   %g

  .(               o   Prior to the test, the Operations Engineer insures that all MWR's to which the test applies have been
                      -signed 'of f for work . completion. He also assures that there are no unresolved conditions adverse to

- quality for any item within the boundary of the test.

o For refueling or other major shutdowns, a total test program is developed including an overall schedule for tests to be performed. The program is based on a review of all MWR's and associated test require-ments by the appropriate organizational units. o Test procedure results are submitted to the Test And Performance Engineer for review. The Test And

'   b' s-                 Performance Engineer monitors test results to assure that data meet acceptance requirements.

(QA Program - Par. 5.2.19, p. 37 & 38) o " Test procedures shall include provisions for assuring that prerequisites for the given test have been met, that adequate

             ' test instrumentation is available and used, and that the test is performed under suitable environmental conditions."

Response: Test procedures contain: o The test objective o The acceptance or operability criteria to' be used in evaluating test results. o Pertinent references, as appropriate

1

    ~                   o  Precautions
  '~' ~

o Limitations o Check-off. sheets, as appropriate o Technical specifications, as required o Special equipment, as required o Step-by-step instructions Each test procedures is approved by the Test And Per-formance Engineer, and he sends a copy of the test procedure to the chairman of the Station Nuclear Safety Committee who arranges a SNSC review. Once approved, these test procedures are maintained in a central file and updated, as required, for possible future use, (QA Program - Par. 5.2.19, p. 37) o

      ~
                " Test results shall be documented and evaluated to assure that test requirements have been satisfied."

Response: The Test And Performance Engineer or his representative monitors the performance of test procedures, as necessary, to assure that the tests are performed in accordance with written procedures. Post-maintenance test results are evaluated by station personnel. When test results are deemed satisfactory, the Watch Supervisor certifies the test results by signing and dating the appropriate sections of the l approval sheet. The record copy of the test results 4

 ,   ,  )            and the applicable MWR covered by that test are filed

in the central record file. Test results are reported to the Test And Performance Engineer for his evaluation. Power Supply prepares and controls operating records in accordance with requirements of the Plant Technical Specifications. These records provide documentation for all operations, test inspections, shutdowns,

changes and other pertinent activities associated with

. daily operations listed in the Plant Technical Specifica-tions. These records are maintained at the site in a manner convenient for review and are retained for five years or longer, as required by applicable codes or

                                                                ;

regulations. l (QA Program - Par. 5.2.19, p. 38) O { i l l l l I I l u

                                                                \

O l l

                                           /~N s   s-XII.'  CONTROL OF MEASURING AND . TEST EQUIPMENT V

Measures shall be established to assure that tools, gages, instruments, and other measuring and testing devices used in activities affecting quality are properly controlled, calibrated, and adjusted at specified periods to maintain accuracy within necessary limits. o " Measures shall be established to assure that ... measuring and testing devices used in activities affecting quality are properly controlled, calibrated, and adjusted at speci-

;               fled periods to maintain accuracy within necessary limits."

Response: Measuring tools, gages and test equipment used at the site on items which affect plant safety are controlled es (,) and recalled for calibration at prescribed intervals. Power Supply maintains required standards, conducts calibrations, adjustments, and approves calibration procedures. Appropriate subsections within Power Supply maintain records of measuring and test equip-ment under their control. These records include: o Identification number o Description of the item t o Manufacturer's nau.a and model number i o Calibration frequency o Reference to method or procedure Only after items are listed on the measuring and test-ing list can they be used on Class A systems. Each

  -v(h.

1

(~g measuring tool, gage, and test equipment bears a tag or U a sticker which indicates the next calibration due date. Calibration requirements are based on the type of equipment, usage, and any other conditions af fecting accuracy control requirements. Calibrations are made against certified measurement standards which have known relationship to national standards where such standards exist. Where no such standards exist, the basis for calibration is documented. The accuracy of each calibrating standard is at least equal to the accuracy requirement for the equipment being calibrated. If called for by engineering specification or drawing or other written instruction, calibrating standards V of a specified greater accuracy will be used. Discrepancies discovered in examination or test equip-ment are reported in accordance with procedures for reporting nonconformances and corrective actions. In those cases, the NPG Quality Assurance Engineer issues a QCIR to initiate review of all work accomplished with the equipment since the previous calibration. To deter-mine if applicable requirements have been satisfied, a review is conducted of all material, components and equipment checked with discrepant examination or test equipment since its last acceptable calibration or .f-q periodic check.

~'

(QA Program - Par. 5.2.16, p. 34 & 35)

____~ XIII. HANDLING, STORAGE AND SHIPPING /^\ \~/ Measures shall be established to control the handling, storage, shipping, cleaning and preservation of material and equipment in accordance with work and inspection instructions to prevent damage or deterioration. When necessary for particular products, special protective environmente such as inert gas atmosphere, specific moisture content levels, and temperature levels, shall be specified and provided. o " Measures shall be established to control the handling, storage, shipping, cleaning and preservation of material and equipment in accordance with work and inspection in-structions to prevent damage or deterioration. When necessary for particular products , special protective en-l') (/ vironment ... shall be specified and provided. l l Response: Measures have been established which provide control i l of handling, storage and shipping. These measures . include, where applicable, provisions for cleaning, packaging and preservation of material and equipment in accordance with appropriate instructions, proce-dures, drawings or other documents to prevent damage, deterioration and loss. Included are measures for very expensive, critical, sensitive and perishable items. Engineering and other organizations, such as NPG, establish or reference requirements for handling, storage and shipping. These requirements are identi-t ws fied in applicable requisitioning / procurement documents.

56 - (.-

   .f g-       Items are packaged in a manner adequate.to protect them
              ~agains t - corrosion, contamination, physica l .lamage or any effect which would lower their quality or cause- the
              ' item Lto deteriorate during shipping, handling and storage. The specific requirements for packaging, etc. ,

are. determined by the procurement document ieview i system and the' requirements identified or inrerenced

. .in the procurement document by NPG, Engine" sing, etc.

The degree of protection varies according to storage condition and duration, shipping environment and j handling conditions. Items are protected aqainst damage during loading, shipping, and handling by the supplier, shipper, and appropriate Con Edinon organi-O

    -( )      zation. Modes of transportation are consiHl.ent with
            ,the degree of protection required and with tiie packaging methods employed.

Upon.their arrival at the site, items are checked for damage, required marking and general compliance with purchase order requirements or internal dociiments where items are manufactured by Con Edison. Restil ts of inspec-tion are documented in a receipt inspection citecklist by the receiving inspector. Storage is accomplished in a manner sufficinnt to minimize the possibility of damage or lowei Ing quality

      ,s     due to corrosion, contamination, deteriorat ion or-C/ -

y

                                                                  -.-s. ---.w- ,           ,m--

fs physical damage from the time an item is stored until ( the time the item is removed from storage and installed at its final location. Storage requirements are based on supplier recommendations, NPG requirements and/or instructions supplemented, as appropriate, by Engineer-ing recommendations. I l Power Generation Maintenance, NPG and Transportation maintain handling equipment in accordance with appro-priate procedures, methods and instructions. As appropriate, handling instructions and procedures have been established by Nuclear Power Generation and Engineering for items requiring special handling. As ( )) appropriate, hoisting equipment used for handling is certified by the manufacturer. Except for test pur-poses, hoisting equipment is not loaded beyond its rated load as certified by the manufacturer. Safety requirements for material hoists are adhered to by NPG, Power Generation Maintenance and Central Trans-portation. Re-rated equipment is given a dynamic load test over the full range of the lif t. Records pertaining to packing, shipping, receiving, storage and handling, including procedures, reports, personnel qualification, test equipment calibration, nonconformances and inspection and examination are () prepared and maintained by NPG, Power Generation

l - 58'- i Maintenance, Central Transportations, etc. , in accor-I;~ dance with established procedures. t, [ (QA Program - Par. 5.2.13.4, p. 29, 30 & 31) l' l i

                                    <N   XIV. INSPECTION, TEST, AND OPERATING STATUS

1

\d Measures shall be established to indicate, by the use of markings such as stamps, tags, labels, routing cards, or other suitable means, the status of inspections and tests performed upon individual items of the nuclear power plant. These mea-sures shall provide for the identification of items which have satisfactorily passed required inspections and-tests, where necessary to preclude inadvertent bypassing of such inspections and tests. Measures shall also be established for indicating the operating status of structures, systems, and components of the nuclear power plant, such as by tagging valves ar.d switches, to prevent inadvertent operation. o " Measures shall be established to indicate, by the use of U (-) markings . . . or other suitable means, the status of inspec-tions and tests performed upon individual items of the nuclear power plant ... for the identification of items which have satisfactorily passed required inspections and tests, where necessary to preclude inadvertent bypassing of such inspections and tests." Response: Incoming items are receipt-inspected by NPG Quality Assurance. Items which are acceptable are given an

                  " accept" tag and put in separate locked storage. Items which cannot be accepted are " hold" tagged and stored in segregated locked storage to await disposition.        ;

gs Items " hold" tagged but too large for segregated, d i l 1 l

                             ,_           locked storage or indoor storage are suitably identi-fled to prevent their use. Items which are to be scrapped are " reject" tagged and kept in separate locked storage. Only items which have been properly receipt inspected and accepted-can be used.

Status of inspections in association with work on equipment or systems is controlled through utilization of procedures, travelers, work step lists, tags and labeling. Nonconformances associated with maintenance are documented on inspection reports. Satisfactory disposition of nonconformances by NPG Quality Assurance is required prior to release of material. Usually, tests are conducted upon completion of work as a pre-operational activity. Test requirements are determined by the Test And Performance Engineer. Completion of

           . tests are certified by Watch Supervisors. Upon com-e pletion of servicing work, operations personnel are responsible for verifying that the work is complete and that operating items are restored to prerequisite positions in accordance with applicable procedures.

(OA Program - Par. 5.2.6, p. 14; Par. 5.2.14, p. 31) o " Measures shall also be established for indicating the operating status of structures, systems, and components of

      -the nuclear power plant ... to prevent inadvertent operation."

O v

gs. Response: Temporary alterations which include such items as by-V pass devices, lifted electrical contacts, varying of setpoint limits, jumping, and opening of trip links require prior approval from, and are controlled by, Watch Supervisors acting in accordance-with approved directions. Entries are documented in log books. Prior approval by Operations personnel is required for the release of equipment or systems for maintenance or repair. Normally, for interfacing station activi-ties, Maintenance Supervisors, Instrument and Control Supervision, and Watch Supervisors meet beforehand to plan the work. They verify that equipment or systems can be released and determine the time required to do

  -()

the job, and safety considerations to personnel and the public. Essential elements of these details are documented in work permits. When permission is granted to remove equipment for servicing, the equipment is rendered inoperative and protected for work. Operations Watch Supervisors verify that the work is completed prior to readying the equipment or system for return to service. Shutdown and subsequent start-up procedures guide-the preparation of equipment or systems for maintenance. 'They include cognizance of such para-meters as monitoring and control of reactivity, load reduction and cooldown rates,. sequencing in activating or de-activating, provisions for decay heat - removal and

    -)

tj

;                                                          -

62 - 4 s i emergency operating situations. - Specific check-lists r

                        . provide the assurance that relative factors are con-i sidered.           Entries into closed systems or vessels are

! controlled. This extends to accountability for. items 5 2

                        - taken in and out by Maintenance personnel.

't

• (OA Program - Par. 5.2.6, p. 13 & 14)

E 1

O.

l i 1 h' a i k i r 9 ,-+-y e--y-- , . , , - ,-y, -,,,,4m, , < _ - , . + , . _

                                                                                   ,g.,,,-.,,,,.,.a,,--.-,,v_   -r.,-,,i,     - , , , , - ,,...,q ,%v.,w.,,,,,._,_.yr.~,

  \\\\
       <> +   )                                 *     #

k IMAGE EVALUATION NNN TEST TARGET (MT-3) l.0 gangg eM m na Bu 1.1 L'"E

                                     !M l.25   1.4    1.6
          $                                       v MICROCOPY RESOLUTION TEST CHART
       #4 #                                         4%

+$fy,, Axxx)x# , k+&g.

                                                ,4
            ;

y t - m.=, .. I

TEST TARGET (MT-3)

1. 0 'g m a u

                                '" l8 HE I.I  J,'8 IME
                                           .8 1.25    1.4   ' i.6 l

4 6" -

                                                       =

MICROCOPY RESOLUTION TEST CHART

  #4                                                 +4%
                                                 *% g 4 Qf[>,,,f y4,,;              y                    .

e,++,

                                                     ;

i i. .

                       % = . == = ,            -

XV.- NONCONFORMING MATERIALS, PARTS, OR COMPGNENTS Measures shall be established to control materials, parts, or components which do not conform to requirements in order to prevent their. inadvertent use or installation. These measures shall include, as appropriate, procedures for identification, documentation,- segregation, disposition, and notification to 4 affected organizations. Nonconforming items shall be reviewed and accepted, rejected, repaired or reworked in accordance with documented procedures. o " Measures shall . . . control mat.erials, parts, or components which do not conform to requirements in order to prevent their. inadvertent use ... These measures shall include --- p procedures for:":

    \_/        -  " Identification, documentation, segregation, disposition, and notificat. ion to affected organizations, as appro-priate."
                  " Nonconforming items ... [being]    .s. reviewed and accepted, rejected, repaired or reworked..."

Response: A system, including appropriate instructions, have been established for identifying, documenting, segregating and dispositioning Class A nonconformances. This system provides for notification of affected organi-zations, for review and acceptance, rejection, repair or re-work of nonconforming items and establishes the

                      -responsibilities for the disposition of nonconforming m)
   - w!

I

 ~

L_

o items. This system also provides for identifying an

   /

item as nonconforming and controlled and as accepted "as is", as scrap or as held for further disposition. This system pcovides for documenting the acceptability of nonconforming items which have been repaired, re-worked or used "as is". J Incoming items are tagged as received. The items are receipt-inspected in accordance with documented in-structions by an inspector reporting to the NPG i Quality Assurance Engineer. Items which are acceptable are given an " accept" tag and put in separate locked storage. Items which cannot be accepted are " hold"

         -tagged and stored in segregated locked storage to
     \
 \/        await disposition. Items " hold" tagged but too large for segregated, locked storage or indoor storage are suitably identified to prevent their use.      Items which are to be scrapped are " reject" tagged and kept in         i separate locked storage. Only items which have been properly receipt-inspected and accepted can be used.
                                        ~

Items which do not meet acceptance criteria are evaluated for dispositior.. The NPG Quality Assurance Engineer, as appropriate, prepares a Quality Control Inspection Report.(QCIR). The QCIR identifies the nonconformance and recommends _ corrective action to the organization (action w/

65 -

-

' addressee; responsible to- initiate action or resolve the nonconformance. Copies are forwarded or made available to other affected organizations, such as Power Supply, QA&R, Engineering and Purchasing. Non-conforming; items are ' accepted, rejected or re-worked in accordance with documented procedures specified by the organizations involved in resolving the deficien-cies identified.

t When significant nonconformances are identified, Indian i Point Station Quality Assurance personnel, or QA&R personnel, as applicable, investigate and initiate a

                            . Deficiency-Report (DR).        The DR is used to document
                               'significant nonconformances with specified quality JO                              requirements when found during plant testing, or j                               plant modification, maintenance and repair activities.

! The DR identifies the de'ficiency and recommends cor-

_ rective action to the organization (action addressee) responsible to' ir.itiate action or . resolve the de-ficiency. Copies are forwarded to other affected organizations such as Power Generation, QA&R, Engineer-ing, Purchasing, the Authorized Inspector and/or con-tractors. Nonconforming items are accepted, rejected, repaired or re-worked in accordance with doce

aented procedures specified by the organizations involved in

                            . rnsolving the deficiencies identified.               Items which-
  .u)

F I

                                                                                                        ~.yv ,~+ m--g--.. -m .

i.w we. - -.+m~.- .% a - , .m y , ye , ----v-.-ge.r-

have been reworked or repaired are reinspected and/or retested in a manner identical to the original in-spection and/or test or in an _alternste manner approved by NPG, QA&R or Engineering , as aptlicable. Noncon-formance reports are analyzed for quality trends when potential problems are highlighted by personnel in-volved with the particular work activity. Additionally, analyses of trends may be initiated independently by QA&R as a consequence of its auditing and program development functions. (QA Program - Par. 5.2.14, p. 31 & 32) O r~> m

XVI. CORRECTIVE ACTION f-m(

 %.J Measures shall be established to assure that conditions adverse to quality, such as failures, malfunctions, deficiencies, deviations, defective material and equipment, and nonconformances are promptly identified and corrected.       In the case of signifi-cant conditions-adverse to quality, the measures shall assure that the cause of the condition is' determined and corrective action taken to preclude repetition. The identification of the significant condition adverse to quality, the cause of the con-dition, and the corrective action taken shall be documented and reported to appropriate levels of management.

o " Measures shall be estaolished to assure that conditions n V adverse to quality ... are promptly identified and corrected. In~the case of significant conditions adverse to quality."

                "The measures shall assure that the cause of the condi-tion is determined and corrective action taken to pre-clude repetition."
                "The identification of the . . . condition . . . , the cause of the condition, and the corrective action taken shall be documented and reported to appropriate levels of          i management."                                                 ,

l Response: Measures have been established which ensure that condi-tions adverse to plant safety which may occur during g- work, e.g., maintenance, are promptly identified in a ()g w

Quality Control Inspection Report (QCIR) or a Deficiency

      -      Report (DR) and corrected. In~the case of significant
     \#

conditions adverse to safety, a DR is initiated to assure that the cause of the condition is determined and cor-rective action taken and appropriately documented and reported. The action addressee on the QCIR is responsible for either correcting the nonconformance or designating the organization responsible for completing the neces-sary corrective actions. The managements of these designated organizations are rasponsible for taking the necessary corrective actions. The NPG Quality Assurance Engineer is responsible for ('\

     \_)    assuring that corrective actions are implemented at the site. QA&R has overall responsibility for assuring that corrective action is taken and then reviews cor-rective actions taken during auditing operations.

OA&R prepares and distributes a monthly report indi-cating tne status of all unresolved Deficiency Re-ports (DR's). This report is routed to appropriate management concerned with correcting the deficiency. The distribution of the monthly status report of un-resolved DR's assures that the identification of significant conditions adverse to quality and cor-rective actions initiated are documented and reported (~} v to appropriate levels of management. jm..

                              -; The action addressee on the DR is responsible for either V'

correcting the deficiencies or designating the organi-zation responsible for completing the necessary correc-tive actions. The managements of these designated organizations are responsible for taking the necessary corrective actions. When corrective action has been completed, this will be identified on the DR and for-warded to QA&R, .via the NPG Quality Assurance Engineer, c- by the action addressee. Corrective action shall include determination of the nonconformance and the measures necessary to preclude repetition. QA&R reviews the action taken and takes the initiative

  ,,s  to resolve disputes and disagreements, if any. After U    agreement has been achieved, QA&R comple'tes the DR by noting concurrence. Copies of a completed DR are then routed to the action addressee and other appropriate Con Edison organizations.

Conditions adverse to safety found during operations are reported as required by the Plant Technical Speci-fication. This report includes a description of the condition, its cause and corrective action taken or recommended. The distribution of this report includes the Nuclear Facilities Safety Committee (NFSC). O

70 - r-C XVII. QUALITY ASSURANCE RECORDS f i G Sufficient records shall be maintained to furnish evidence of activities affecting quality. The records shall include at least the following: operating logs and the results of reviews, inspections, tests, audits, monitoring of work performance, and materials analyses. The records shall also include closely-related data such as qualifications of persannel, procedures and equipment. Inspection and test - records shall, as a minimum, identify the inspector or data recorder, the type of observation, the results, the acceptability, and the action taken in connection with any deficiencies noted. Records shall be identifiable and retrievable. Consistent with applicable regulatory requirements, the applicant shall establish requirements concerning record re-( A) tention, such as duration, location, and assigned responsibility. o ... records shall be maintained to furnish evidence of activities affecting quality. The records shall include

                   ...the following:"
                         " Operating li.gs and the results of reviews, inspections, tests, audits, monitoring of work performance, and materials analyses."
                           ... related data such as qualifications of personnel, procedures and equipment.
                         " Inspection and test records ... identify the inspector or data recorder, the type of observation, the results, the acceptability, and the action taken in connection

' vf') with any deficiencies noted."

  ,r   sng,            _                                                             .-

('s., -

                     " Records shall be identifiable and retrievable V           -   "
                       . . . requirements concerning record retention. . . "

Response: Con Edison's policy is to maintain documentary evidence of the quality of items and activities affecting plant i safety, consequently, a system for records preparation and retention, as necessary, has been established. The NPG Quality Assurance Engineer maintains records which include inspection results, retest on work com-pleted, certain personnel qualification records, pur-chase orders, receipt inspection results and back-up data, and deficiency reports. Operating logs are maintained by the Operations subsections. Test pro-() cedures and resulto are maintained by the Test And Performance Engineer. Inspection reports include the signature of the inspector, the type of observation, the results, the acceptability, and the action taken in connection with deficiencies noted. Documented procedures establish the requirements and responsibilities for record maintenance and retention subsequent to completion of work. The records are filed and maintained to minimize deterioration, damage and to prevent loss. fg (QA Program - Par. 5.2.12, p. 23 & 24) (ul ww .

O XVIII. AUDITS

    ;

A comprehensive system of planned and periodic audits shall be carried out to verify compliance with all aspects of the quality assurance program and to determine the effective-ness of the program. The audits shall be performed in accordance with written procedures or check lists by appropriately trained personnel not having direct responsibilities in the areas being audited. Audit results shall be documented and reviewed by management having responsibility in the area sudited. Followup action, including re-audit of deficient areas, shall be taken where indicated. o " A comprehensive system of planned and periodic audits shall be carried out to verify compliance with all aspects

     %)
        -)

of the quality assurance program and to determine the ef fec-tiveness of the program. The audits shall be performed":

                       -   "In accordance with written procedures or check lists."
                           "By appropriately trained personnel not having direct responsibilities in the areas being audited."
                             ...[with]   ... results ... documented and reviewed by management having responsibility in the area audited."           ,
                           " ...[ requiring] . . . followup action . . . of deficient areas ... where indicated."

Response: The audit program conlucted by QA&R provides for a comprehensive system of planned and periodic audits to assure that operating nuclear facilities are

      ,s
     !    l v
  ' * *"Ty_h  _

operated, administrated, and managed in accordance () with applicable requirements and to assure quality program effectiveness. QA&R documents audit plans and establishes a schedule of periodic audits. These audits are designed to verify compliance with all aspects of the quality assurance program and are conducted at least once every two years or more f requently commensurate with their safety significance. These audits include the following: The conformance of station operation to all provisions contained within the Plant Technical Specifications and applicable license conditions at least once per . O year. The performance, training and qualifications of the entire station Staf f at least once per year. The results- of all actions taken to correct deficien-

   .cies occurring in station equipment, structures, systems or method of operation that affect nuclear safety-at least once per six months.

The Station Emergency Plan and implementing procedures at least once per two years. The Station. Security' Plan and its implementing pro-f)) x-cedures at least once per two years.

S Any other area of station operation considered appro-

      ~

priate by the NFSC, Ser.ior Of ficer, Power Supply or QA&R. The audits are conducted by QA&R who may utilize other

             *>olidated Edison employees (except those having direct responsibility in the area being audited) and/

or consultants or specialists from outside the Company. The results of each audit are reviewed by the auditors wi S the management of the activity audited at the con-clusion of the audit. A written report containing the audit findings and recommendations is issued by QA&R within thirty days of the completion of each audit. The audit report is issued to the management of the

     '")  audited group (s) for reply to the audit findings and includes the Chairman, Nuclear Facilities Safety Com-mittee; the Senior Vice President in charge of QA&R; the Senior Officers of the activities audited; the Manager, Nuclear Power Generation; the Director, QA&R; end, when it involves ASME, Section III Code Require-ments, to the Authorized Insp.ector. It is the respon-sibility of the activity audited to review the report and reply, in writing, within thirty days to the Senior Vice President in charge of QA&R concerning the actions to be taken to resolve each finding. QA&R is respon-sible for verifying the effectiveness of these actions,

Rt O'

l

4 i i including reaudit when necessary. The Nuclear Facili-j- O. ties Safety Committee reviews the adequacy of the

i- audit program at least. semi-annually. 1 (QA Procram - Par. 4.1, p. 8& 9)  : 4 , t I j i 1 s I 4 1 I f f 4 I i T 4 1-1 i

3 t l l l. 1 . .

            . . -.~ , _.. . _           ,, . ~..,,.. _ .. ..... .    -

4 2 i i, . i i 1 l i i APPENDIX E -- EMERGENCY PLANS FOR PRODUCTION AND ! UTILIZATION FACILITIES l l l l J l l i t f s 4 l I l t i l I i l r.

     ~N   10CFR50, Appendix E - Emergency Plans for Production and
  -(Q Utilization 7acilities o     "The Final Safety Analysis Report. The Final Safety Analysis Report shall contain plans for coping with emergencies. The details of these plans and the details of their implementation need not be included, but the plans submitted must include a description of the elements set out in sectica IV to an extent suf-                 '

ficient to demonstrate that the plans provide reason-able assurance that appropriate measures can and will be taken in the event of an emergency to protect public health and safety and prevent damage co property."

                                                                                      ;

O (_) Response: The Indian Point Unit No. 2 Final Facility Descrip-tion and Safety Analysis Report (PSAR) contains, in the response to Question 12.5, the Consolidated j Edison emergency plan that was in effect at the time the FSAR was written. The aforer.entioned emergency j plan contained the following four (4) contingency plans; earthquake, fire, tornado and radiation. Revisions have been made to that plan to incorporate changes that were required by NRC regulations and 1 requests, and submitted to the NRC for aoproval. ' The emergency plan that is in effect currently is not the plan contained in the FSAR.

   /'"%                                                                               l L ,!

f)

      ~/

o " Content of Emergency Plans. The emergency plans shall contain, but not necessarily be limited to, the follow-ing elements: A. The organization for coping with radiation emer-gencies, in which specific authorities, responsi-bilities, and duties are defined and assigned, and the mean of notification, in the event of an emer-gency, of: (1) Persons asaigned to the licensee's emergency organization, and (2) appropriate State. and Federal agencies with responsibilities for coping with emergencies; B. Written identification, by position or function, of other employces of the licensee with special quali-fications for coping with emergency conditions which may arise. Other persons with special qualifications who are not employees of the licensee and wno may be called upon for assistance shall also be identified. l The special qua;1fications of these employees and persons shall be described; C. Means for determining the magnitude- of the release of radioactive materials, including criteria for Y determining the need for notification and partic-ipation of local and State Agencies and the Atomic Energy Commission and other Federal agencies, and ' 'O> m criteria for determining when protective measures

(~3 should be considered within and outside the site V boundary to protect health and safety and prevent damage to property; D. Procedures for notifying, and agreements reached with, local, State, and Federal officials and agencies for the early warning of the public and  ; for public evacuation or other protective measures should such warning, evacuation, or other protective , l d measures become necessary or desirable, including identification of the principle officials, by title and agencies, E. Provisions for maintaining up to date: 1. The n (,) organization for coping with emergencies, 2. the procedures for use in emergencies, and 3. the list of persons with special qualifications for coping q I with emergency conditions; l l F. Emergency first aid and personnel decontamination facilities, including:

1. Equipment at the site for personnel monitoring;

2. Facilities and supplies at the site for decon-tamination of personnel; l

3. Facilities and medical supplies at the site for l

appropriate emergency first aid treatment; l l l n- _ l

                                         /~')
   \J

4. Arrangements for the services of a physican and other medical personnel qualified to handle radi-ation emergencies; and

5. Arrangements for transportation of injured or contaminated individuals to treatment facilities outside the site boundary; G. Arrangements for treatment of individuals at treat-ment facilities outside the site boundary; H. Provisions for training of employees of the licensee who are assigned specific authority and responsibil-ity in the event of an emergency and of other persons whose assitance may be needed in the event of a radi-ation emergency; I. Provisions for testing, by periodic drills, of radi-ation emergency plans to assure that employees of the licensee are familiar with their specific duties, and provisions for participation in the drills by other persons whose assistance may be needed in the event of a radiation emergency; J. Criteria to be used to determine when, following an accident, reentry of the facility is appropriate or when operation should be continued.

The Commission has developed a document entitled " Guide to the b(,- Preparation of Emergency Plans for Production and Utilization

                                          ~'

Facilities" to help applicants establish adequate plans required ' [us) pursuant to $50.34 and this Appendix, for coping with emergencies." [ Appendix E as added December 11, 1970, effective January 22, 1971 (35 F.R. 19567); amended effective January 11, 1973 (38 F.R. 1271).] o "The emergency plans shall contain, but not necessarily be limited to, the following elements: A. The organization for coping with radiation emergen-cies, in which specific authorities, responsibilities, and duties are defined and assigned, and the means of notification, in the event of an emergency, of: (1) Persons assigned to the licensee's emergency organization,...." Response: Consolidated Edison's organization for coping with radiation emergencies is described in Section 5 of the Emergency Plan for Indian Point Unit Nos.1 and 2 which states the following on page 5 of the plan:

                   "Uning the normal shif t operating organization as a base, this section of the Plan describes the emer-tjency organization that may be activated ONSITE l

along with the augmentation of Power Authority per- l sonnel and OFFSITE forces when necessary. Authorities 1 and responsibilities of key individual and groups are rn. (_) delineated. The communication links for notifying, 1. u

r-'. alerting and mobilizing emergency personnel are (_) identified." o "

                   ... and (2)   appropriate State, and Federal agencies with responsibilities for coping with emergencies;"

Response: Coordination with appropriate government agencies is described in Section 5.4. On page 5.13, Section 5.4, , the following is stated:

                       "In the event of a Site or General Emergency, as de-fined in Section 4.1, various Federal, State, and County organizations must be notified. Some of these organizations have immediate action responsibilities
  -,-~g                while others respond upon request by the NUCLEAR V

FACILITY OPERATOR. The New York State' Bureau of Radiological Health would notify contiguous State governments, as necessary. This section identifies the principal state agency and other government agencies having planning and/ or action responsibilities for emergencies, parti-cularly for radiological emergencies, in the Wast-d chester, Orange, Putnam and Rockland County areas of New York State." In addition, the New York State and the Westchester County emergency response plans are appended to the ()' Emergency Procedures Document.

o "B. Written identification, by position or function, of {} other employees of the licensee with special qualifi-cations for coping with emergency conditions which may arise." Response: Section 5.3 of the plan describes the offsite support available to the onsite organization:

                   "This section describes the OFFSITS support available to the ONSITE emergency organization.      OFFSITE support would be available from three (3) sources:      corporate headquarters, local services, and the Power Authority of the State of New York.      The need for this augmen-tation would be avaluated by the EMERGENCY DIRECTOR.

O(,j The names and phone numbers of the OFFSITE support contacts are listed in the EMERGENCY PROCEDURES DOCUMENT which is maintained in the Unit 1-2 Control Room and in the EMERGENCY CONTROL CENTERS." i In addition, Figure 5.2.1 shows the offsite Con Edison forces that would be available should they be needed during an emergency. l l o "Other persons with special qualifications who are not employees of the licensee and who may be called upon for assistance shall also be identified." Response: Appendix A to the Plan provides copies of letters 1 () of agreements with non-Con Edison emergency response L -

c . e i. response supporting organizations. In addition, V(~g . Figure _5. 2.-l shows the non-Con Edison forces that would be available should they be needed during an emergency.

o. "The special qualifications of these employees and persons shall be described;"

Response: The special qualifications of these employees and persons are either described in or implied by section 5 of the emergency plan, Figure 5.2-1, or the letters of agreement which were discussed above. o "C. Means for determining the magnitude of the release of radioactive materials, including criteria for deter-

  ' (_

mining the need for notification and participation of local and State agencies and the Atomic Energy Com-mission and other Federal agencies, and criteria for determining when protective measures should be con-sidered within and outside the site boundary to pro-tect health and safety and prevent damage to property;" Response: The means of determining the magnitude of the release

                    'of radioactive materials during a postulated radio-logical emergency is described in the Emergency Pro-        i 4

cedures Document (EPD). The procedure in the EPD, that describes the means for determining the magnitude ) ( of release states in part: m _ .

r~s "In the event of an accidental release of radioactive V material-to the environment, it is important for the Watch Supervisor to assess the accident as soon as possible and determine the exposure to the population offsite. The exposure may only be tic the whole body due to the fields created by the noble gas cloud or it may include expcsures to the thyroid from the radio-todines that are present. It is important to make an early assessment of the potential exposure and have it available for the State and County officials when they call back to verify the initial notification." o "D. Procedures for notifying, and agreements reached with, local, State, and Federal officials and agencies for (f'~' 3) the early warning of the public and for public evacua-tion or other protective measures should such warning, evacuation, or other protective measures become necessary of desirable, including identification of the principal officials, by title and agencies;" Response: The Emergency Procedures Document contains procedures for notifying Federal, State and local agencies. The procedure for Site Emergency sta tes in part:

                 "4. NOTIFY N.R.C., STATE & LOCAL AUTHORITIES o Unit 1 N.P.O. using IP-1002" r~3

()

                               <~            The New York State and Westchester County emergency NNI response plans, which are appended to the Emergency Procedures Document, describe protective measures that could be initiarad during a radiological emer-gency. Both the New York State and Westchester County emergency response plans include identifica-tion of the principal agencies whose services could be utilized during a radiological emergency.

o "E. Provisions for maintaining up io date: 1. The organi-zation for coping with emergencies, 2. the procedures for use in emergencies, and 3. the lists of persons with special qualifications for coping with emergency a conditions; Response: Section 8 of the Indian Point Units 1 and 2 Emergency Plan describes the provisions for maintaining the plan and the Emergency Procedures Document up to date. Specifically, Sectionc 8.2.1 and 8.2.2 state:

             "8.2.1  The Station Nuclear Safety Committee shall annually review the. Plan  and the EMERGENCY PROCEDURES DOCUMENT to determine if there are needed additions or changes to increase their effectiveness. This review shall include the prior year's drill critiques and Emergency Plan Corrective Action Reports. A report

()_ shall be sent to the Plant Manager, and the

           .                      ~                                         .

Chairman of the Nuclear Facilities Safety 61 (/~h 1 / Committee incorporating ar2y recommended changes. 8.2.2 Updating of the Plan and the EMERGENCY PRO-CEDURES DOCUMENT shall be accomplished by the Emergency Planning Coordinator. He shall make all changes to the Plan and the EMERGENCY PROCEDURES DOCUMENT necessitated by the re-sults of training and drills, or changes to site and environs physical parameters. All changes to the Plan and the EMERGENCY PROCE-DURES DOCUMENT shall be reviewed and approved by Con Edison's Station Nuclear Safety Com-l mittee and the Power Authority's Plan Oper-ating Review Committee." o F. Emergency first aid and personnel decontaminating facilities, includi.19 : 1. Equipment at the site for personnnel monitoring; Response: Stored emergency equipmant and supplies , including personnel monite, ring devices are listed in Appendix E to the Indian Point Unit Nos. 1 and 2 Emergency Plan. o "2. Facilities and supplies at the site for decontamination of personnel;"

(3

 \/      Response: Facilities an'd supplies for decontamination of person-nel are described in Section 7.5.1 of the plan which states:
                   " Medical facilitieg at the Con Edison Indian Point STATION are housed in a two room First Aid-Decontami-nation Suite located on the 72 foot elevation of the Unit No. 1 Nuclear Service Building. This suite con-sists of a decontamination room and an examination room and includes a stainless steel decontamination table, shower facilities, foot sink and hand sink, stainless steel flooring with drains to holdup tank, and first aid and medical supplies for life support a (                 and minor surgery."

o "3. Facilities and medical supplies at the site for appro-priate emergency first aid treatment;" Response: Section 7.5.2 of the plan describes the first aid facilities:

                   "There is a small First Aid Room located in a non-RACIATION AREA on EL.15 of the Unit 1 Administration Build ing . This room contains general first aid equip-ment, oxygen breathing apparatus and an examination table where non-contaminated patients may be treated."

o- "4. Arrangements for the services of a physician and other

  ~>
    )

medical personnel qualified to handle radiation emer-

                                                                           - ~ - - _ _
~
                                      ; .p
  - s-       gencies; and..."

4 Response: Section 6.5.2 dcscribes the provisions for handling radiation emergencies:

                  "The medical and first aid f acilities available ONSITE for the treatment of injured and/or contaminated per-sonnel are described in Section 7.5.       With these facilities a medical team consisting of a doctor, a nurse, a first aid technician and a health physics technician can treat a spectrum of medical emergencies from first aid to minor surgical procedures with con-comitant radiological problems.
  .)              There is at least one individual (the WATCH SUPERVISOR or a Nuclear Plant Operator) on every WATCH who is trained in first aid techniques.       A Health Physics Technician who has received training in decontamina-tion procedures is on duty 24 hours a day.       During-weekday shift hours, there is a doctor and a nurse on duty. During of f-hours, they can be called in from home. Their telephone numbers are listed in the EMERGENCY PROCEDURES DOCUMENT.       There are also first aid technicians and emergency medical techni-cians on duty during weekday day shif t bours."

o "S. Arrangements for transportation of injured or contami-(). nated inoividuals to treatment facilities outside the

7' . jQ V- site boundary;" Response: Section 6.5.3 of the plan describes the arrangements for transportation of injured or contaminated in-dividuals to treatment facilities:

                    " Arrangements have been made for transporting injured /

contaminated / irradiated personnel to the hospital via the Verplanck Ambulance Association who provides 24 hour service and who has backup through a mutual aid syetem. A written agreement is contained in Section 10, Appendix A. The Verplanck Ambulance Association participates at least once per year in the annual

        ,           medical emergency drill."

o "G. Arrangements for treatment of individuals at treatment facilities outside the site boundary;" Response: The arrangements for treatment of individuals at treatment facilities outside the site boundary are described in Section 6.5.4:

                    "The Peekskill Community Hospital has agreed to accept an injured / contaminated / irradiated patient (s) from the Indian' Point Site. This is a modern 100 bed hospital      ,

l with facilities such as an emergency room, a labora-tory, a radiology department and a nuclear medicine department. In addition, Brookhaven National Labora-tory Hospital would serve as a backup in the highly 1

um k-) unlikely situation of a massive exposure. In addi-tion, a highly qualified and experienced medical doctor from Brookhaven National Laboratory Hospital (Chairman, Medical Dept. ) has been retained as a consultant to the Consolidated Edison Medical Depart-ment'to supervise special cases of massive whole body exposures or extreme contamination problems. Written agreements for the hospital and the medical consultant are contained in Section 10, Appendix A. Physicians and nurses at the nearby Peekskill Com-munity Hospital participate in at least one drill per year and are also given a seminar to acquaint them n (/ with the special precautions and techniques required for care of contaminated patients." o "H. Provisions for training of employees of the licensee who are assigned specific authority and responsibility in the event of an emergency and of other persons whose assistance may be needed in the event of a radiation emergency;" j Response: The provisions for training of employees is described in Section 8.1, Section 8.1.1 states, in part:

                   " Con Edison has an Emergency Plan Training Program to maintain the proficiency of emergency personnel. The 3

training program consists of formal classroom lectures J and field exercises. The type and extent of training

                                                       =

                                                    ,a
     -)                each individual receives depends upon the specific duties assigned to that individual in the Emergency Plan. Drills are utilized to evaluate the effective-ness of the training accomplished.

Each of the following categories of emergency person-nel receive training under the program: (a) EMERGENCY DIRECTORS (b) Radiological Monitoring Teams (c) Accident Assessment Personnel (Control Room Operators and WATCH SUPERVISORS) + (d) Fire Brigade (o) Repair and Damage Control Teams { ( (f) First Aid and Rescue Teams (g) Local Services Personel (h) Medical Support Personnel . . . " o "I. Provisions for testing, by periodic drills, of radiation emergency plans to assure that employees of the licenses

                      .are familiar with their specific duties, and provisions for participation in the drills by other persons whose assistance may be needed in the event of a radiation eme rg e n',y ; "

Response: Section 8.1.2 describes the provisions for periodic drills -of the emergency plans. This section states, s (,) in part:

                                                                  " Annual drills are conducted by Con Edison at the
  '({})'

Indian Point Station for each of the.following scenarios, a medical emergency, a fire emergency and a radiological emergency. The annual radiological emergency drill is conducted each calendar year nine to fifteen months after the last annual radiological emergency drill. Additional drills, designed to , test various aspects of the Plan, may be initiated . by the Plant Manager. In addition to the annual radiological emergency drill, a joint radiological emergency drill involving the activation of both Con Edison and Power Authority emergency organizatiens is conducted on an annual basis." n v o "J. Criteria' to be used to determine when, following an accident, reentry of the f acility is appropriate or when operation should be continued." Response: Sect. 9 of the plan describes the recovery criteria. Secticas 9.1 - 9.3 state:

                       "9.1  The Manager, Nuclear Power Ger.eration Department or his designee will supervise the reentry pro-cedure. The general plan w. ild be to handle the sita problems first, there'c , making the site tenable to all. This would be accomplished through a series of radiation surveys progress-O)-

(_ ing towards the source (s) of the hazard. This

                                           ,          .              . _ . . - - -     w

e V! /m k- will allow uninhibited accessibility for the work force required to restore the STATION to normal status. 9.2 All actions will be preplanned. This means t each specific action will be thought out in advance and discussed with responsible and know-ledgeable personnel. The Nuclear Facilities Safety Committee, which is composed of Con Edison Company personnel knowledgeable in the disciplines related to nuclear safety, will re-view and approve recommended recovery operations in accordance with its charter and the require-em (~) ments of the Technical Specifications for the Units 1 and 2. A written log of all actions taken and by whom is preferred if conditions permit. 9.3 Other than the exposure guidelines discussed in Section 6.5.1, radiation exposure to personnel involved in the recovery will be kept at a minimum and within the stated limits of 10 CFR , 20.101. Affected areas will be roped off and posted with warning signs indicating radiation levels and permissible entry times based on survey results. Access to such areas will be n (_) controlled, and exposures to personnel enter-

ww. < 1

                                                                                                               ;

ing such areas will be documented. 3 Shielding will be employeed to the fullest extent 1 . possible. Survey results, interviews of individuals with direct knowledge of recent conditions in the affected area (s) and all l other pertinent information collected from logs and other records or indicators in the Control i t ! Room and/or in the EMERGENCY CONTROL CENTER j will be used to evaluate the advisability and the timing of reentry to affected areas." i ( 4 i. l l l l

     -e  .;_-__-2. -
                     -_~.-_%..        44 ea .a m...-A .m wc m. a - _             .q~.. a e.m     -            ..ae aw4.        _- . --. m4          weu.2_.s          s                      --- 2 ...__A- . -_-,4 i

i d

APPENDIX G -- FRACTURE TOUGHNESS REQUIREf!ENTS l l i G 1 4 4 J 4 Y 4 4 r- + e - -- =- - - - - - - --, - ----- - -- -.-4-- - , . ,. _ . - - -- - - ---, - ---- -- - ~

    ,                    APPENDIX G--FRTCIURE 7tJUGICESS RDOUIREMENTS_

d I. Introduction & Scope this appendix specifies minimum fracture toughness requirements fcr ferritic materials of pressure-retaining ccutponents cf the reactor coolant pressure boundary of water coeded rower reactors to provich adequate margins of safety during any cordition of nornal operatics, including anticipated operational occurrences and system hycrostatic tests, to which the pressure boundary may be subjected over its ser-vice lifetime. The requirunents of this apperdix apply to the following materials: A. Carbon and low-alloy ferritic steel plate, forgings, caatin]s and pipe with specified minimum yield strengths not over 30,000 psi. B. Welds and weld heat-affected zones in the materials sp eified in section I.A. C. Materials for bolting and other types of foteners with specified minimum yield strengths not over 130,000 psi. For Indian Point Unit #2, this includes the following: Conponent Section Materials Beactor Vessel Pressure Plate SA-302, Gr. B Shell & Nozzle Forgings A-508 Class 2 O . . Ste Generetor Pressure Piete SA-302, Gr. B Channel !!ead Castings SA-216 WCC 4 Pressurizer Shell SA-302 Gr. B heads SA-216 WCC External Plate SA-302, Gr. B Pressurizer F411ef Tank Shell A-285 Gr. C Heads A-285 Gr. C (II. Definitions, no ecmmntn) III. Fracture ibughness Tests A. Ib demonstrate compliance with tle minimum fracture toughness re-quirenents of sections IV and V of this appendix, ferritic mat-erials shall be tested in accordance with the ASME: Code, section NB-2300, " Fracture toughness requirements for materials." Bcth unirradiated and irradiated ferritic materials shall be tested for

                                                                                          ;

i 1

4 P I fracture toughness sur:ri.ies by means of the Charpy V-notch test specified by paragraph NB-2321.2 of the ASME Code. In

;                   addition, when required by the ASLT. Code, unirradiated ferritic materials shall be tested by means cf the dropweight tcut speci-fled by paragraph NB-2321.1 of the ASME Code. Provision shall be _:pade for supp1 mental tests in crucial situations such as j                   that described in Section V.C.

Indian Point Unit #2 cmponents were fabricated before appendix G was issueci. Materials were tested in ac-

cordance with ASME specificaticn SA370 which is equiv-

alent to the current code.

B. Charpy V-notch impact tests and dropweight ten.s shall be con ~ ducted in accordance with the following requiranents: 4- 1. Iocation and orientation of impact test apeimns shtl1 comply ] with the requirenanta of paragraph NB-2322 of the ASME Code. Wiens for forgings and plate material are required 1 to be oriented in a direction normal to the principtl i direction in which the material was worked. Specimens for reactor vessel materials were taken in the direction parallel to the principal direction in which the mat-erial was worked, but a correction factor 1::: applied to

'  'O                         the results. th= bese 1ine of the notch cf the ime,ce specimen was machined perpendimlar to the inajor surfaces j                            of _ the plate, as required.
                   - 2. Materials used to prepare test specimens rhill be repmsent*
 .                      .ativa of the actual materials of the finished ccacocnent as required by the' applicable rules of_the construction code under which the wur Ant is built pursuant to                          50.5Sa,.

except that ferritic materials intended for the reactor vessel beltline region shall ocanply with the additional requi.mmets l of section III.C of this appendix. 1 Plate material was obtained frczn an end of each shell plate of the reactor vessel after thermal heat treat-j ment and prior to welding the three plates together to-i form the intermdiate shell course. All test speimem were machined fim the thickness locacion of the plate

,                             after streOs relieving. The test specimens repres mt                                                                !

a material' taken at least one plate thichness (9 S/8") i from the quenched edges of the plates. spe t= ns were machined from weld-metal and heat affectad zone metal r of a stress relieved weldment joining tm plates.

3. Calibration of tarporature instruments and Charpy V-notch inpact test machines used in inpact testing shall conply with h ~ the requirenents of paragraph NB-2360 of the ASME Code.

                    ' 4.~ Individuals performing fracture toughness tests shtll be qualified by training and experience and shall have deton-
                         . strated comoetency to perform the tests in accord with
                                                 ,  -   , +-n,.x.nv.,-                                  , - , , , , , ---m-, - - - ,r- --- r --

                                      ~                                           _     _

l r p written pwcuiures of the component manufacturer. V Calibration was acompliedad and individuals wae qualified in accordance with applicable ASME sp m-ifications.(see 5d below)

5. Fracture toughness test results shall be recorded and s2all include a certification by the licensee or person perfcrming the tests for the licensee that:

a. The tests have been perfonned in empliance with the require-ments of this appendix,

b. nc test data are correctly reported and identified with the mt-erial intended for a pressure-rctaining cmponent,

c. The tests have been conducted using machines and instrummtaticn with available records of periodic calibration, and

d. Records of the qualifications of the individuals performinJ the tests are available upon request.

Testing was done by Combustion Engineeriny and Westirglotse and results are reported in NCAP 7323, dated May ,19f5. C. In ailition to the test requirements of section III.A. of this appendix, tests on materials of the reactor vessel beltline stall be conducted in accordance with the following minimrn recpiremmts:

1. Charpy V-not:ch (Cv) impact tests shall be conducted at appropriate temperatures over a temperature range sufficient to define the Cv test curves (including the upper-shelf levels) in . terms of both fracture energy and lateral expansion of specimens. Location and orientation of impact test specimens shall comply with the require-ments of pangraph NB-2322 of the ASMS Code.

2. Mt.erials used to prepare test specimens for the reactor vese1 belt-line region shall be taken directly frcxn excess material and welds in the vessel shell course (s) following ocnpletion of the p2oducticn longitudinal weld joint, and subjected.to a heat treatment that produces metallurgical effects equivalent to those prod 1ced in the vessel material throughout its fabrication process, in accordance with paragraph NB-2211 of the ASME Ccxle. Mmre seamless slull f crgi.m s are used, or w1ere the same welding process is used for longitudinal <

and circumferential welds in plates, the test specirens may be takm from a separate weldment provided that such a weldment is prepared using excess material frczn the shell forging (s) or plates, as applicable, the same heat of filler material, and tin same prxiuct. ion weld-ing conditicns as those used in joining the corresIond2ng siell me-erials. O Charry v-notch tese curves were deve1oved, ena ere r2>orted in NCAP 7323 dated May 1969. As stated above, orientaticn of the specimens was parallel to the direction of rolling.

[ p IV. Fracture Toughness Beauirments V A. 'Ihe pressure- . Aining components of the reactor coolant pmstre

               . boundary tha, are made of ferritic materials shall meet tlx1 following requir .cnts for fracture toughness during sy<tcm hy-drostatic tests and any condition of noral operation, including anticipv        operational occurrences:

1. The mtalais shall ; met the acceptance standards of paragmph NB-2330 of the ASE Code, and the requiremnts of sections IV.A.2,3 and 4 and IV.B. of this appendix.

As stated above, the Indian Point Unit #2 cmponents were fabricated before Appendix G ms issued. In a method established by Westinghouse RCAP-7924 dated July 1972) the estimated upper shelf energy in the

                         " weak" direction is taken to be 65% of that in the strong direction. On this basis, the reactor vesel materials meet the acceptance standards of paragraph NB-2330 of the AS E Code.

2. For vessels, exclusive of Irlting or other fasteners:

a. Calculated stress intensity factors shall be lower than the reference stress intensity factors by the surgins specified in the ARE Code Appendix G, " Protection Against Non-Ducti'_

Failure." The calculation procedures shall emply with the bm procedures specified 11. the A9E Code Appendix G, but additiona1 and alternative procedures may be used if the mmmission de-termines th ' they provide equivalent margins of safety against fracture, making appropriate allowance for a31 uncertairties in the data and analyses. Amendment 28 to the Indian Point 42 Operating License dated February 18, 1977 cantains heat-up and cool-down curves calculated im compliance with the procedures specified in the ADE Code Appendix G.

b. For nozzles, flanges and shell regions near geometric dis-continuiths, the data and procedures requiredin addition to tlose specified in the ADE Code shall provide margins of saf &y emparable to those required for shells and heads rmote frca discontinuities.

                        'Ihe Analytical Report for Indian Point Init #2 Reactor Vessel by Cmbustion Engineering dmonmrates that this criterion is met.

c. Whenever the core is critical, the metal temperature of the reactor vessci shall be high enough to providic an adeqtate mar-gin of protection against fracture, taking irto account such factors as the potential for overstress and tiermal stock during hs . anticipated operational occurrences in the etntrol of reactivity.

In no case when the core is critical (other enn for the per-pose of the low-level physics tests) shall tle tapcrature of the reactor vessel be less than the minimum permissible temp-erature for the inservice systm hydrostatic pressure test nor less than 40oF. above that tmperature required by section IV.A.2.a.

                                                               -                                  1 i
                                            ~5-                   .

() 73 As indicated above, Amend;ient 28 to the Indian Point #2 operating license dated February 18, 1977, contains heat-up and cwl-down curves calculated in empliance with the procedures specified in A9E Code Appendix G and pr des the 40 F man. gin re-quired. Furthennore, siendment 49 to the operating license, dated March 1, 1979, contains a revised warm-up and cool-down curve based on the results of tlu examination of the reactor vessel material surveillance cougn. cmoved during the 1976 re-fueling outage.

d. If there is no fuel in the reactor during the initial preopcrational system leakage and hydrostatic pressure tests, the minimum permis-sible test tcrperature shall be determined in accordance with para-graph G2410 of the ASME Code except that the factor of safety applial to each term m iing up the calculated stress intensity factor may be reduced to 1.0. In no case shall the test tmperature be less than arnm+600F.

The Indian Point Unit #2 Vessel containa fuel. In the event that systm leakage and hydrostatic presinre tests are required when the vessel is unloaded, this requirement will be observed. h' 3. Materials for piping, pumps and valves shall meet the requirments of paragraph NB-2332 of the ASME Code. Materials for bolting and other fasteners shall meet the requirements of paragraph NB-2333 of tin ASSE Code.

• At Indian Point Unit #2, the piping, pu:gs, and valves in the primary system are not ferritic, and are not in-cluded in the scope of this Appendix G. Stock material authcrizations (SMA) for bolting for the press tre re-taining cmponents of the primary system meet the re-quirments of paragraph NB-2333 of the A9E Code.

B. Reactor vessel beltline materials shall have minimum uppcr-shelf energ , as determined frm Charpy.V-notch tests.on unirradiated specimens in accordance with paragraph NB-2322.2(a) of the A9E Code of 75 ft. lbs. unless it is demanstrated to the Ccmission by appropriate data and analyses thzt lows values of upper-shelf fracture energy still provide adequate margin for deterioration for irradiation. As stated previously, the Indian Point Unit #2 reactor vessel was fabricated before Appendix G was issued, and the Charpy V-notch specimens ut e taken in the " strong" direction. Applying the 65% correction factor to the upper shelf energy values obtained yields values eqtal

  ,                     to 75 ft. lbs. or more.

c - . . -

O C. Reactor vessels for which the predicted value of adjusted reference C temperature exceeds 2004. shall be designed to permit a thermal annealing treatment to recover material tougMess properties of ferritic materials of the reactor vessel beltline.

                        '1he predicted value of the adjusted reference tenp-erature at end-of-life for the Indian Fbint Unit #2 reactor vessel exceeds 2004. Criterion for a design to permit a thermal annealing treatment are not fully defined as yet, and possible effects of the elevzted temperatures required on associated ccraponents and structures have to be evaluated. Furthernore, it is suggested that predicted wilues (insed on accelerated irradiation surveillance cmpass) do not recognize the self-annealing effect at reactor vessel operating tanp-eratures, and may be over-conservative (Ref: " Utility Experience with Reactor Vessel Surveillance", IIEA Rcpcrt IWG-RRPC-79/3, Vienna, Austria, S. Rothstein, Furch 1979.

V. Inservice Bel]uirements Peactor Vessel Beltline Material A. The properties of rcactor vessel beltline region materials, includirg I welds , shall be monitored by a ruterial surveillance program con-forming to the " Reactor Vessel bhterial Surveillance Program Fequire- ' s ments" set forth in Appendix H. l Indian Point Unit #2 Reactor Vessel Radiation Sarveillance Program is described in NCAP-7323, dated May, 1969. A l first surveillance capsule was renoved during the re- l fueling outage in 1976 and the results of the exa.unation  : of the specimens w re reported June 30, 1977. A secord surveillance capsule was reoved during the refueling cut-ago in 1978, and the report of the results of the exam- l ination is in preparation. B. Reactor vessels may continue to be operated only for that service per-iod within which the requirements of section IV.A.2. cre satiefied, using the predictcr1 value of the adjusted reference temperature at the end of the se.vice pririoti to account for the effects of irrad- ] lation on the fracture toughness of the beltline materials. The basis for the prediction shall include results from pertinent rad-iation effects studies in addition to the results of the surveillance program of section V.A. Tae Indian Point Unit #2 reactorvessels satisfy the re-quirements of section IV A 2, as indicatai by the results of the surveillance capsule specimen examinations. l O l l

e fl C. In th0 esent that the requirments of section V.B. cannot be d satisfied, reactor vessels may continue to be operated .c ro-vided all of the follcuing requirments are satisfied:

1. An essentially complete volumetric emination of the belt-line region of the vessel inchxling 100 percent of any weld-ments shall be made in accordanm with the regairments of Section XI of the ASFE Code.

2. Additional evidence of the changes in fracture toughness of the beltline materials resulting fr m exposure to neutron irradiation shall be obtained frm results of rupplcnental tests, sr.h as measurements of dynamic fracture touginess or archive material that has been subjected to accelerated irradiation.

3. A fracture analysis shall be performed that conservatively de-monstrates, making appropriate allowances for all uncertaintics, the existence of adequate margins for continued operaticn.

D. If the procedures of section V.C. do not indicate the existence of an adequate safety margin, the reactor vessel beltline region shall be subjected to a therrral annealing treatmect to of fect recovery of traterial toughness properties. 'Ihe degree of sich recovery shall be measured by testing additional specimens that have been withdrawn frcm the surveillance program capsules and O annealed under the same time-at-tmperature conditions as those U given the beltline material. The results shall pavide the basis for establislTaent of the adjusted reference tapcrature after annealing. The reactor vessel may continue to be operated only for that service period within which the predicted fracture toughness of the beltline region materials satisfies the re-qui.rments of section IV.A.2., using the values of adjustai reference tmperature that include the effects of annealirg and subsequcnt irradl e ion. E. The proposed programs for satisfying the requirerrets of scctions V.C. And V.D. shall be reported to the Director of Nuclear Reactor Regulation, U.S. ftcc3 car Regulatory Comnission, Washington, D.C. 20555, for review and approval on an individual case basis at least three years prior to the date when the predicted fracture toughness levela vill no longer satisfy the requirements of section " 9 Prell ainary results of the Itost recent rcactor vessel surveillance specimen eminations irvW:ca that the Indian Point Unit #2 reactor vessel plates in the core beltline region will retain sufficient tcughness at the T and 3/4 T positions to meet the current minimum Ci shelf energy requirements of this Appendix G for at least 17 EFPY of operation. (3

 ~)

l } t t. O h I { t. APPENDIX 11 -- REACTOR VESSEL MATERIAL } SURVEILLANCE PROGRAF 1 REQUIREMENTS 0 k I' i A 1 0 f i _

3PPENDIX H--REACIOR VESSEL MATERIAL SlRVEIIIREE PROGPN4 DEQUIREMEMS

                                  I. Introduction
       'Ihe purpose of the material surveillance progmm reaui.Iod by this appendix is to monitor changes in the fracture touginess propatics of ferritic materials in the reactor vessel beltline regios of went cooled power reactorc resulting frun their expmure to neutron irradiation and the thermal environment. Under this progmm, f meture toughness test data are obtained from material specinens withdraen periodically frcm the reactor vessel. 'Ihese data will pcrnit the determination of the conditions under which the vesel can to opcrated with adequate margins of safety against fracture th:ougtout its service life.                                        .

It should be noted that the material specix.ns in the surveillance program are expoced to a higher f h2x than the reactor vessel. Consequently, when they are rmoval for examination, they may have received nore fluence that the reactor vessel wall, but were expcsed to the thernal environmr nt essentially equal to that of vessel wall. Con-sequently, the decrease in fracture toughnes of the speci-mens probably exceed the projected decrease in toughiess of the reactor vessel plates. b II. Surveillance Program Criteria A. Ib material surveillance program is required for reactcr vcssle, for which it can be conservatively demonstrated bf analytical methods, applied to experimental data and tests performal on com-parable vessels, making appropriate allohnnce.c for all uncertairties in the measurcrents, that the peak neutron fluence (E> 1Md!) at the end of the design life of the vessel will not exceed 1017 n/cm2 . It is projected that the neutron fluence (E>1Md7) at the endvessel reactor of thewill design life ofpcmIf(anEPairt be 2.3x10 Unit 7 IneV) . #2 B. Reactor vessels constructed of ferritic materials whi.ch do not meet the conditions of section II.A. shall have their beltliru regiais monitored by a surveillance program complying with the Anerimn Society for Testing and Materials (AS'IM) Standard Ibcnnmcnded Practice for Surveillgcc Tests for Nuclear Reactor Ve sels, AS'M Designation: E-185-73, except as nodified by this apInnlix.

                   'Ihe Indian Ibint Unit #2 Surveillance Progam is des-cribed in NCAP 7323 dated May 1969. Except for the f a:t that the Charpy V-notch specimens are taken with the principal axis parallel to the directicn of wcrking tle reactor vessel plates, the surveillance pmgmm ccraplies pd                with the AS'IM Standard Recomended Practice fcr Strvcillance
                   'tsts, E185-73.

O' c. ae surveii, ,ee -, e she1] meet the fo110 ina resuirmets :

1. Surveillance specimens shall be taken from locations alongside the fracture tougtness test specimens requitcd by section III of Appendix G. TWe siccimen types shall comply with the requi.m-ments of sectjon III.A. of Appendix G (except that drop weig1t spec- '

inens am not required) . Surveillance specinens weretaken as descriled above (IIB). Specimen types cceply with the requirements af sectici IIIA of Appendix G,

2. Surveillance specinnn capsules shall be located near the imide vessel wall in tin beltline region, so that the speimes irraliation history duplicates to the extent practicable, within the plysi.m1 constraints of the system, the neutron spectrum, te@crature history, and maximum neutron fluence experienced by the reactor vesel inmr surface. If the capsule holders are attached to the vessel wall or to the vessel cladding, construction and inservim instecticn of ti.e attachnents and attachment welds shall be done accordirg to the r e-quirments for permanent structural attachments to reactor vcsmis given in the IGE Code,2 Fections III and XI. The design and location of the capsules shall pennit insertion of replacement capsules. Ac-celerated irradiation capsules may be used in aMition to the re-quired number of surveillance capsules specified in pragmph II.C.3.

J Sirveillance .capsules are mounted on the thxual shi. eld near the inside vessel wall in the beltline region, as shown in the sketch, Figure 1.

3. The required number of surveillance capsules and their withcraval schedules are as follows:

a. For reactor vessels for which it can be conservativdy demcnstmted by experimental data and tests performed on cmprable vesel steel, making appropriate allowances for all uncertaintics in the mealmnents ,

that the adjusted reference tmperature establishal in accordance with section III.B. will not exceed 1000F at the endo f t1D sErvim lifetine of the reactor vessel, at least three surveillance capsules shall be provided for subsequent withirawal as folicws : Withlrawal Schedule l l First Capsule--One-fourth service life i Second Capsule--Three-fourths service life l hird Capsule--Standby I 1 In the event that the surveillance specimens exhibit, at one-qtnrtnr of the vessel's service life, a shift of the refererce tempxztum greater than originally predicted for similar material as recorled hs in the applicable technical specification, the remaining withdravi schedule shall be nodified as follows:

Itwised Withdrawal Schedule g V second Capsule--Coe-half service life mird capsule-StaW l It is projected that the adjusted reference tmpcrattre will exceect 100 0 F at the end of the service lifctine of the Indian Point Unit #2 reactor vessel.

b. For reactor vesso'.s which do not meet the conditions of secticn II.C.3.a. but fo:c which it can be conservatively d:monstrated by experimental data and tests performed on cmparable vessel steels that the adjosted reference temperature will not execul 2000F at tin end of the service lifetim of the reactor vessel, at least fo r surveillance capsules shall be provided for the stbs:quent withirawil as follows:

Withdrawal Schedule First Capsule-At the time when the predicted shif t of the adjusted reference tenperature .% approximately 50% or at one-fourth service life, whichever is earlier. Second Capsule-At approximately one-half of the dme interval betwen first and third capsule withdrawal. O 1dird Ceesute--Three-fourths service life. Fourth Capsule-Standby. It is currently projected that the maxinum adjusted reference tecperature for the Indian Ibint Unit # 2 reactor vessel beltline materials at the bT and the 3/4 T positions may be 3400F and 2000F respecti wly.

c. For reactor vessels which do not neet the conditions of sectial II.C.3.b at least five surveillance capsules shall be provided fcr stbse;[ tert withdrawal as follows:

Withdrawal Schedule First Capsule-At the time when the predicted shift of the adjtsted { reference taperature is aoproximtely 50 0F or zt one-fourth service life, whichever is earlier. Second and Third Capsule-- At approximtely one-third and two-thirch of the tine interval between first ard fcurth capsule withdrawl. Fourth Capsule--W ree-fourths of service life. Fifth rap 9Bn--Standby. Eight surveillance capsules are provided at Indian Pcirt Unit #2. ,

 .( s)                %e first capsule accelerated was withdrawn in 1976 at l

the end of 1.42 EFPY ( <.1/20. service life) at which time the actual shift in reference taperatures of the surveillance coupons ranged frcm 850F to 1300F. The l

n- estimated shift in the adjusted reference tarperatures V- of the reactor vessel plates ranged fran 45 0F to 700F. he second capsule (accelerated) was withdrawn in 1978 at the end of 2.34 FEPY D1/15 service life) at whi.ch time the actual shift in reference tarperatures of the ' surveillance catpass ranged fran 1750F to 2250F. Se

                      .W==ted shift in adjusted reference tenperatures of the reactor vessel plates ranged fran 750F to 1200P.

A third capsule (accelerated) is scheduled to be with-

drawn in 1981 at the end of approximately 4.27 EFPY or in 1982 at the end of approximately 5.39.

+ 2e fourth capsule is scheduled to be withdrawn af ter ten years exposure. 110 wever, it is anticipated that review of results of the Indian Point capsules as well as those of other PWR's will lead to a revisiot in that schedule. j Four more capsules are available for standby or other uses.

d. Provision shall also be made for additional surveillance tests to mat-

         'itor the effects of annoaling and subsequent irradiation.
>                      One ormore of the " spare" serveillance capsules may be designated for use for additional surveili mce test to monitor the effects of annealing when a decision in made to consider anacaling.

e. Wittrirawal schedules may be modified to coincide with those refuelirg outages or plant shutdown nost closely approaching the withirawal schedule.'

Current practice at Indian' Point Unit #2 is to withdraw surveillance capsules at refueling outages closely

approaching the withdrawal schedule.  ;

f. If accelerated irradiation capsules are enployed in addition to the minimum required number of surveillance capsules, the withdrawal scludule may be nodified, :taking into account the test results ob-tained fran testing of the specimens in the accelerated caps 11es. The proposed nodofied withdrawal schedule in such cases shall te appromd by the Ccrmission on an individual case basis.

As indicated in IIC3c above, accelerated caps 11es are arployed, and consideration will be given to modification of the withdrawal schedule as deemed necessary. In . that event, Consnission approval will be regtested.  ! i

9. F4-M _ withdrawal schedules that differ from those specifiel in pra- i h graphs a. through f. shall be subnitted, with a techeical justification therefore, to the Commission for approval. _The proposed schedule I

I shall not be. implemented without prior Camission ap;roval. l 1 , - _ . _ _ . _ _ _ _ ,_

I l

                                                               .              1
   )                 Per the conment to paragraph f above, Conmission approval will be t.ecpested in the event a change            l in withdrawal schalale is technically justified.

4. For nultiple reactxs located at a single site, an integrated surveillance program may be authorized by the Camnission on an in-dividual case basis, depending on the degree of ccrsaonality and the predicted . severity of irradiation.

This does not apply to indian Point Unit #2. III. Fracture 'Ibughness 'Ibsts A. Fmeture toughness testing of the specimens withdrawn frcxn the cap-sules shall be conducted in accordance with the requirements of section III of Appendix G, " Fracture Toughness Pequirements." Except for the orientation of the Charpy V-Jotch specimenc, frecture testing of tin specimens with-drawn frun the capsule is conducted in acccredance with the requirements of Appendix G Sectica III. B. The adjusted reference tmperatures for the base metal, heat-affected zone, and weld metal shall be obtained from the test results by adding to tle reference tmperature the annunt of the tempcrture shift (3') in the Charpy test curves betmen the unirradiated naterial and the irradiated material, measured at the 50 foot-pound level or the measured at the 35 mil lateral expansion level, whictever tempcrature shift is greater. The highest adjusted reference tcrperature and the lowest upper-shelf energy level of all the beltline materials shall be used to verify that the fracture toughness requirements of section V.B. of Appendix G are satisfied.

                    'ntis requirement was followed in the evaluation of the surveillance specimens withdrawn frcm the Indian Point Unit #2 reactor vessel, and will continue to be followed.

IV Peport of Test Results A. Each capsule withdrawal and the results of the fracture touginess tests shall be the subject of a sumary technical report to be provicbd to the Director of Nuclear Reactor Regulation, U.S. Nuclear Regulatory Otmnission, Washington, D.C. 20555. The report slull include a schematic diagram of the capsule locations in the reactor vessel, iden-tification of specimens withdrawn, the test results, and the relation-ship of the measured results to those predicted for the reactor vcse1 beltline region. B. The report sinll also include the dosimetry measurcr.cnts pcrformal at ,, each specimen withdrawal, analyses of the results which y.ield the ca1-L) culated neutron fluence which the reactor vessel beltline region hm received at the time of the tests, and ccxqnrisons with the originally predicted values of fluence.

C. 'Ihe operating pressure and tanperature limitations establisbad for the period of operation of the reactor vessel between any two surveillance specimen withdrawals shall be specified in the report, including any changes made in operational pro-cedures to assure meeting such temperature limitations. A first capsule was withdrawn frm the reactor vessel in 1976, and a om technical report of the results of tha examination of the capsule was provided to the Director of Nuclear Ibhctor Regulation, UShTC in December 1978. All the infcnnation required was in-cluded in the report. A second capsule was withdrawn frcm the reactor vesml in 1978 and a suninary technical repcrt of the results is being prepared. On completion, it will be pxuvided to the Director of Nuclear Reactor Regulation. , O O e

Z (Type I) 270* Q

                                           /4f/
                                                                                         ~

V (Type II) - S (Type II) l', f' g U (Type ' 180*_ / J ,

                                                                    \/

d

                                                                                /    0 *
                  / g       .
                                                                    ,-     /

O - W (T ype : 4 f, j - Y (Type II) 90' T (Type I) - Reacto: Vessel c Thermal Shield Core Barrel 1 n FIGURE 1. ARRANGEMENT OF SURVEILLANCE CAPSULES IN THE PRESSURE VESSEL I

O. l I APPENDIX I -- NUMERICAL GUIDES FOR DESIGN OBJECTIVES AND LIMITING CONDITIONS FOR OPERATION TO MEET THE CRITERION " AS LOW AS IS REASONABLY ACHIEVABLE" FOR RADIOACTIVE MATERIAL IN LIGHT-WATER-COOLED NUCLEAR O ro"ca at^croa tercue"Ts i D

l

 ,     10CFR50, Appendix I - NUMBERICAL GUIDES FOR DESIGN OBJECTIVE AND

('~s) LIMITING CONDITIONS FOR OPEATION TO MEET THE CRITERION "AS LOW AS IS REASONABLY ACHIEVABLE" FOR RADIOACTIVE MATERIAL IN LIGHT-WATER-COOLED NUCLEAR POWER REACTOR EFFLUENTS By letter dated March 14, 1977 Con Edison (Cahill) provided a report to NRC (Reid) entitled " An Evaluation to Demonstrate the Compliance of the Indian Point Reactors with the Design Objec-tives of 10CFR Part 50, Appendix I." That report had as its conclusion the following:

       "In addition to meeting the criteria of Appendix I to 10CFR50 for determining when releases of radioactive materials from nuclear power reactor's are "as low as reasonably achievable", this evaluation has shown that the Indian Point Reactors meet the

more stringent guidelines of the staff's proposed Appendix I (RM 50-2). Estimated radioactive discharges from any or all of the Indian Point units are well within these guides and thus are indeed "ALARA". It is, therefore, concluded that no modifica-ticris to or augments of the various radwaste systems at any of the Indian Point reactors will be required or could be cost effective in reducing integrated population doses."

v

O-APPENDIX J -- PRIMARY REACTOR CONTAINMENT LEAKAGE TESTING FOR WATER-COOLED POWER REACTORS i O 4 i I O

t () 10CFR50, Appendix J - Primary Reactor Containment Leakage Testing for Water-cooled Power Reactors Respeaset Consolidated Edison has conducted and will continue to conduct all visual examinations and Type A, B and C lea'4 rate tests in full compliance with the require-ments.of Appendix.J to 10CFR Part 50 to assure the continued leak-tight integrity of the primary reactor containment. All testing is performed within the ,

required intervals and summary technical reports are provided to NRC as specified in the Appe.idix.

O (:) l f l l

O

 ;                                                                                         ,
                                                                                           ;

i 4 APPENDIX K -- ECCS EVALOATION MODELS O l

     .O

_ ~ . - . . - __ - - . - - _- 4 f() 10CFRBD, Appendix K - ECCS Evaluation Models i Response: As noted in response to 10CFR50.46, Indian Point Unit i No. 2 emergency core cooling system analyses utilize approved Westinghouse evaluation models. That is,

                                    ~

I they are in compliance with the requirements of

                                                                                                                                                   ;

Appendix K. These models provide both required and , acceptable features of evaluation models, and the required documentation.

k j l < !; J i 4

  <:)

ENCLOSURE 4

 . (~x ITEM F.( EVALUATION OF THE RELIABILITY AND FAILURE MODES OF A    SELEC{ED SYSTEMS /CCjPONENTS F.4a.       Fnilure Modq and Effects Analysis of Active Coaponents on the Reactor Coolant Pressure Boundary:

A failure mode and effects analysis of all active com-ponents qn or within the reactor coolant boundary has been performed. The review included: reactor coolant pumps; pressurizer relief and safety valves; pressurizer sprcy valves; control rod drive mechanisms and housings; drain valves; and check, air operated and ruotor operated valves interfacing with other systems. No failure modes were identified during the review which have not been considered and/or analyzed in previous plant reviews. In particular, Chapter 14 of the FSAR addresses the following items: Control Rod Withdrawal; Control Rod Mechanism Housing Ruptures; Reactor Coolant Pump Trips; Startup of an Inactive Reactor Coolant Pump; and Primary System Pipe Ruptures that Bound Ruptures in Active Components on the Reactor Coolant Pressure Boundary. In addition, Westinghouse has performed post-TMI generic reanalyses for both Small Break LOCAs (WCAP-9600) and all FSAR transients (WCAP-9691) which a're applicable to all Westinghouse nuclear plants. Furthermore, the O, issue of ATWS has been analyzed by both the NRC and the NSSS vendors on a generic basis and the results of these enalyses are in the process of being applied to individual plants including Indian Point Units 2 and 3. It has therefore been determined that existing analyses bound the effects of failures on the reactor coolant pressure boundary, including the effects of coincident limiting single failures, and have satisfactorily demon-strated acceptable system performance following such failures. Existing analyses have neither evaluated the likelihood of. failures on the reactor coolant system boundary nor the

                 . impacts of such events when compounded by other plant failures beyond the regulatory single failure criterion.

The long term risk assessment study being performed by Pickard, Lowe and Garrick, Inc. (PLG) , will provide a detailed assessment of the dominant contributors to risk from the Indian Point Units 2 and 3 nuclear power plants. Failures on the reactor coolant pressure boundary are considered in that work along with equipment and human

                 ' failures in all other areas of the plant. We believe that a plant risk assessment is the proper vehicle for assessing
 'o                                         E4-1 4

the effects on risk of specific plant failures. The PLG study will apply the basic techniques of WASH-1400

 ; )
   to determine the public risk due to operation of the Indian Point Unit 2 and Unit 3 reactors. The analysis will be site specific:    the hardware systems in place at each unit are being analyzed using fault tree techniques; modeling of human interaction is based on the existing plant pro-cedures; local terrain, meteorology, and demography are being used in the consequence assessment. Actual operating and maintenance histories from the units will be used to update generic industry data to obtain plant specific data. Causes of equipment failure are being examined in detail and the final analysis will include random failures, '

human interaction, test and maintenance, environmental factors, and various combinations of these. Results of the study will include identification of dominant con-tributors to risk--systems, com'ponents, causes, etc. The - work is presently scheduled to be completed in October, 1980 and will be reviewed in detail by the NRC as it progresses. O . O E4-2

F.4b. Fnilura Modo and Effects Analysis for Minor Departures from Operating, Maintenance and Emergency Procedures:

-s        Detailed review of the effects of these procedures on

() power plant risk is included in the PLG risk analysis. Minor departures from operating and maintenance pro-cedures can lead to early equipment failures and to plant trip, but more often only to abnormal conditions that can be corrected before components or systems are lost. The more severe problems manifest themselves in the plant specific failure rate and initiating event frequency data developed for the plant risk study. Detailed review of that data, especially where it differs sub-stantially from generic data, should provide clues to help identify problems that have developed due to de-partures from procedures and, more importantly, indicate ways in which procedures can be modified to help avoid problems. Departures from emergency procedures have potentially more serious effects since the plant is in a degraded condition when these procedures are in use. However, most critical actions described in the emergency pro-cedures occur automatically and cre backed up by the human operator. Before minor dep.2rtures from emergency procedures could have great significance, some failures in the automatic equipment must have already occurred. Errors such as securing an automatic function (ECCS for example) when still required must be considered major f~) departures from emergency procedures and are handled explicitly in the forthcoming PLG risk assessment. Once again, review of plant data (specifically LERs and reactor trip records) can provide valuable information. The emergency procedures are receiving considerable detailed attention at this time. Both Consolidated Edison and the Power Authority are reviewing the procedural re-commendations of the Westinghouse Owners' Group whose desire was to restructure the emergency procedures in a way that will significantly enhance the likelihood of successful diagnosis and recovery. Furthermore, in response to 120-day Interim Action Item E.2, the Essex Corporation has recently completed an extensive review of the Indian Point Unit 2 and Unit 3 control rooms and emergency procedures. Significant improvements may be expected to follow in-house review of that work. The review of plant data is progressing. For example, in our review of LERs (see response to Item F.1), the human event and procedural event subcategories identified a number of cases in which minor departures from pro-cedures occurred--either people deviating from written procedures or written procedures deviating from intended actions. The identified items have beca of minimal sig-(~ nificance. As discussed in response to Item F.1, the identified occurrences have been corrected by revising procedures, improving training or improved testing. E4-3

F.4c. Explore Ways to improve Reliability of the Components With a Particularly High Failure Rate as Delineated in NUREG/CR-1205: s-- The question is most properly addressed in the context of the complete plant risk assessment study. "Particularly high failure rate" of a component has no real meaning except in the context of system performance. When used in combination with other equipment, a component with a seemingly low reliability, may provide an essential and acceptably reliable system function. Moreover, redundancy a7c repairability can compensate for high failure rate leading to a high reliability group of low reliability components. A major result of the PLG risk study will be a ranking of components with respect to each one's con-tribution to overall risk. High failure rate is not necessarily linked to safety importance. However, it is at least an operational problem and is addressed when identified. The plant specific LER review presented in the response to Item F.1 and the generic LER review of NUREG/CR-1205 have identified service water pumps and charging pumps as components experiencing higher than expected opera-tional malfunctioning. Both Consolidated Edison the Power Authority have accordingly implemented modification gs programs to improve pump reliability as follows: k u) o Service Water Pumps--IP2 is currently performing bearing, bearing sleeve, and bearing cooling water modifications on a priority basis; IP3 is evaluating similar changes. IP3 is installing a new discharge strainer design; IP2 is evalua-ting this change. o Charging Pumps--IP2,is planning to install suction stabilizers and discharge pulsation dampeners during the next refueling outage; IP3 has installed suction stabilizers and is planning to install pulsation dampeners during the next refueling outage. Consolidated Edison and the Power Authority cooperate to reduce equipment repair times by sharing spare parts. Complete spare rotating internals for all safety related equipment--reactor coolant pumps, RHR pumps, SI pumps, etc.-- , are maintained available. Finally, the new ISI test re-quirements for pumps and valves (AS!!E code Section XI) should help ensure that maintenance errors and equipment degradation are detected early on.

   ,m E4-4}}