ML19114A191
Text
PBAPS UFSAR APPENDIX H - CONFORMANCE TO AEC (NRC) CRITERIA H.1
SUMMARY
DESCRIPTION This appendix contains an evaluation of the design bases of the nuclear facility as measured against the General Design Criteria (GDC) for Nuclear Power Plant Construction Permits that were proposed to be added to 10CFR50 as Appendix A in July 1967. In addition, this appendix includes an updated evaluation of the conformance of PBAPS to 10CFR 50 Appendix A and other criteria that was captured in the NRC Safety Evaluation Report (SER) for the Extended Power Uprate (EPU) for PBAPS.
During the construction licensing process for Peach Bottom Atomic Power Station Units 2 and 3, the units were evaluated against the then current Atomic Energy Commission (AEC) draft of the 27 General Design Criteria for Nuclear Power Plants (November, 1965) rather than the 70 criteria proposed in July 1967. Section H.2 contains an evaluation of the design bases of the facility relative to each of the nine groups of the 70 criteria. In each group, a statement of the licensees understanding of the intent of the criteria of that group is made and a discussion of the plant design conformance is presented. A list of references to appropriate sections of the Updated FSAR is presented at the end of each group. Explanatory notes are included where required.
It was concluded that Units 2 and 3 conform with the intent of the AEC (NRC) proposed General Design Criteria for Nuclear Power Plants, 10CFR50, Appendix A, July 1967.
During the licensing of Extended Power Uprate (EPU) for PBAPS (license amendment 292/295 dated 8/25/14), an evaluation of the current licensing basis with respect to conformance with 10 CFR 50 Appendix A and other criteria was performed. Section H.3 contains an evaluation of the NRC acceptance criteria, including the applicable General Design Criteria that were evaluated for the EPU license amendment.
H.1.1 RESTATEMENT OF PROPOSED GENERAL DESIGN CRITERIA (GDC)
(July 1967)
The following is a quotation of the proposed GDC published in the Federal Register (32 FR 10213) on July 11, 1967 by the AEC, predecessor to the NRC. This has been reproduced here for ease of reference. The GDC have been amended since July 1967; however, PBAPS Units 2 and 3 were licensed to the July 1967 version of the GDC. The quotation begins immediately hereafter.
APPENDIX H H.1-1 REV. 26, APRIL 2017
PBAPS UFSAR INTRODUCTION Every applicant for a construction permit is required by the provisions of Section 50.34 {of 10 CFR} to include the principal design criteria for the proposed facility in the application.
These General Design Criteria are intended to be used as guidance in establishing the principal design criteria for a nuclear power plant. The General Design Criteria reflect the predominating experience with water power reactors as designed and located to date, but their applicability is not limited to these reactors.
They are considered generally applicable to all power reactors.
Under the Commission's regulations, an applicant must provide assurance that its principal design criteria encompass all those facility design features required in the interest of public health and safety. There may be some power reactor cases for which fulfillment of some of the General Design Criteria may not be necessary or appropriate. There will be other cases which these criteria are insufficient, and additional criteria must be identified and satisfied by the design in the interest of public safety. It is expected that additional criteria will be needed particularly for unusual sites and environmental conditions, and for new and advanced types of reactors. Within this context, the General Design Criteria should be used as a reference allowing additions or deletions as an individual case may warrant.
Departures from the General Design Criteria should be justified.
The criteria are designated as "General Design Criteria for Nuclear Power Plant Construction Permits" to emphasize the key role they assume at this stage of the licensing process. The criteria have been categorized as Category A and Category B.
Experience has shown that more definitive information is needed at the construction permit stage for the items listed in Category A than for those in Category B.
I. OVERALL PLANT REQUIREMENTS CRITERION 1 - QUALITY STANDARDS (CATEGORY A)
Those system and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to {the} mitigation of their consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes or standards on design, materials, fabrication, and inspection are used, they shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary. Quality assurance APPENDIX H H.1-2 REV. 26, APRIL 2017
PBAPS UFSAR programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of sufficiency and applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is required.
CRITERION 2 - PERFORMANCE STANDARDS (CATEGORY A)
Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to {the} mitigation of their consequences shall be designed, fabricated, and erected to performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appropriate consideration of the most severe of these natural phenomena that have been recorded for the site and the surrounding area and (b) an appropriate margin for withstanding forces greater than those recorded to reflect uncertainties about the historical data and their suitability as a basis for design.
CRITERION 3 - FIRE PROTECTION (CATEGORY A)
The reactor facility shall be designed (1) to minimize the probability of events such as fires and explosions and (2) to minimize the potential effects of such events to safety.
Noncombustible and fire resistant materials shall be used whenever practical throughout the facility, particularly in areas containing critical portions of the facility such as containment, control room, and components of engineered safety features.
CRITERION 4 - SHARING OF SYSTEMS (CATEGORY A)
Reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
CRITERION 5 - RECORDS REQUIREMENTS (CATEGORY A)
Records of the design, fabrication, and construction of essential components of the plant shall be maintained by the reactor operator or under its control throughout the life of the reactor.
II. PROTECTION BY MULTIPLE FISSION PRODUCT BARRIERS CRITERION 6 - REACTOR CORE DESIGN (CATEGORY A)
The reactor core shall be designed to function throughout its design lifetime, without exceeding acceptable fuel damage limits APPENDIX H H.1-3 REV. 26, APRIL 2017
PBAPS UFSAR which have been stipulated and justified. The core design, together with reliable process and decay heat removal systems, shall provide for this capability under all expected conditions of normal operation with appropriate margins for uncertainties and for transient situations which can be anticipated, including the effects of the loss of power to recirculation pumps, tripping out of a turbine generator set, isolation of the reactor from its primary heat sink, and loss of all offsite power.
CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS (CATEGORY B)
The core design, together with reliable controls, shall ensure that power oscillations which could cause damage in excess of acceptable fuel damage limits are not possible or can be readily suppressed.
CRITERION 8 - OVERALL POWER COEFFICIENT (CATEGORY B)
The reactor shall be designed so that the overall power coefficient in the power operating range shall not be positive.
CRITERION 9 - REACTOR COOLANT PRESSURE BOUNDARY (CATEGORY A)
The reactor coolant pressure boundary shall be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime.
CRITERION 10 - CONTAINMENT (CATEGORY A)
Containment shall be provided. The containment structure shall be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other engineered safety features as may be necessary, to retain for as long as the situation requires the functional capability to protect the public.
III. NUCLEAR AND RADIATION CONTROLS CRITERION 11 - CONTROL ROOM (CATEGORY B)
The facility shall be provided with a control room from which actions to maintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit access, even under accident conditions, to equipment in the control room or other areas as necessary to shut down and maintain safe control of the facility without radiation exposures of personnel in excess of 10 CFR 20 limits. It shall be possible to shut the reactor down and maintain it in a safe condition if access to the control room is lost due to fire or other cause.
APPENDIX H H.1-4 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 12 - INSTRUMENTATION AND CONTROL SYSTEMS (CATEGORY B)
Instrumentation and controls shall be provided as required to monitor and maintain variables within prescribed operating ranges.
CRITERION 13 - FISSION PROCESS MONITORS AND CONTROLS (CATEGORY B)
Means shall be provided for monitoring and maintaining control over the fission process throughout core life and for all conditions that can reasonably be anticipated to cause variations in reactivity of the core, such as indication of position of control rods and concentration of soluble reactivity control poisons.
CRITERION 14 - CORE PROTECTION SYSTEMS (CATEGORY B)
Core protection systems, together with associated equipment, shall be designed to act automatically to prevent or to suppress conditions that could result in exceeding acceptable fuel damage limits.
CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEMS (CATEGORY B)
Protection systems shall be provided for sensing accident situations and initiating the operation of necessary engineered safety features.
CRITERION 16 - MONITORING REACTOR COOLANT PRESSURE BOUNDARY (CATEGORY B)
Means shall be provided for monitoring the reactor coolant pressure boundary to detect leakage.
CRITERION 17 - MONITORING RADIOACTIVITY RELEASES (CATEGORY B)
Means shall be provided for monitoring the containment atmosphere, the facility effluent discharge paths, and the facility environs for radioactivity that could be released from normal operations, from anticipated transients, and from accident conditions.
CRITERION 18 - MONITORING FUEL AND WASTE STORAGE (CATEGORY B)
Monitoring and alarm instrumentation shall be provided for fuel and waste storage and handling areas for conditions that might contribute to loss of continuity in decay heat removal and to radiation exposures.
APPENDIX H H.1-5 REV. 26, APRIL 2017
PBAPS UFSAR IV. RELIABILITY AND TESTABILITY OF PROTECTION SYSTEMS CRITERION 19 - PROTECTION SYSTEMS RELIABILITY (CATEGORY B)
Protection systems shall be designed for high functional reliability and in-service testability commensurate with the safety functions to be performed.
CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE (CATEGORY B)
Redundancy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Different principles shall be used where necessary to achieve true independence of redundant instrumentation components.
CRITERION 21 - SINGLE FAILURE DEFINITION (CATEGORY B)
Multiple failures resulting from a single event shall be treated as a single failure.
CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION SYSTEMS (CATEGORY B)
Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any control instrumentation system component or channel, or of those common to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels.
CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION SYSTEMS (CATEGORY B)
The effects of adverse conditions to which redundant channels or protection systems might be exposed in common, either under normal conditions or those of an accident, shall not result in loss of the protection function.
CRITERION 24 - EMERGENCY POWER FOR PROTECTION SYSTEMS (CATEGORY B)
In the event of loss of all offsite power, sufficient alternate sources of power shall be provided to permit the required functioning of the protection systems.
APPENDIX H H.1-6 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 25 - DEMONSTRATION OF FUNCTIONAL OPERABILITY OF PROCTECTION SYSTEMS (CATEGORY B)
Means shall be included for testing protection systems while the reactor is in operation to demonstrate that no failure or loss of redundancy has occurred.
CRITERION 26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN (CATEGORY B)
The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced.
V. REACTIVITY CONTROL CRITERION 27 - REDUNDANCY OF REACTIVITY CONTROL (CATEGORY A)
At least two independent reactivity control systems, preferably of different principles, shall be provided.
CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY (CATEGORY A)
At least two of the reactivity control systems provided shall independently be capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes, sufficiently fast to prevent exceeding acceptable fuel damage limits.
CRITERION 29 - REACTIVITY SHUTDOWN CAPABILITY (CATEGORY A)
At least one of the reactivity control systems provided shall be capable of making the core subcritical under any condition (including anticipated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margins greater than the minimum worth of the most effective control rod when fully withdrawn shall be provided.
CRITERION 30 - REACTIVITY HOLDDOWN CAPABILITY (CATEGORY B)
At least one of the reactivity control systems provided shall be capable of making and holding the core subcritical under any conditions with appropriate margins for contingencies.
APPENDIX H H.1-7 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 31 - REACTIVITY CONTROL SYSTEMS MALFUNCTION (CATEGORY B)
The reactivity control systems shall be capable of sustaining any single malfunction, such as unplanned continuous withdrawal (not ejection) of a control rod, without causing a reactivity transient which could result in exceeding acceptable fuel damage limits.
CRITERION 32 - MAXIMUM REACTIVITY WORTH OF CONTROL RODS (CATEGORY A)
Limits, which include considerable margin, shall be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.
VI. REACTOR COOLANT PRESSURE BOUNDARY CRITERION 33 - REACTOR COOLANT PRESSURE BOUNDARY CAPABILITY (CATEGORY A)
The reactor coolant pressure boundary shall be capable of accommodating without rupture, and with only limited allowance for energy absorption through plastic deformation, the static and dynamic loads imposed on any boundary component as a result of any inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless prevented by positive mechanical means), rod dropout, or cold water addition.
CRITERION 34 - REACTOR COOLANT PRESSURE BOUNDARY RAPID PROPAGATION FAILURE PREVENTION (CATEGORY A)
The reactor coolant pressure boundary shall be designed to minimize the probability of rapidly propagating type failures.
Consideration shall be given (a) to notch-toughness properties of materials extending to the upper shelf of the Charpy transition curve, (b) to the state of stress of materials under static and transient loadings, (c) to the quality control specified for materials and component fabrication to limit flaw sizes, and (d) to the provisions for control over service temperature and irradiation effects which may require operational restrictions.
APPENDIX H H.1-8 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 35 - REACTOR COOLANT PRESSURE BOUNDARY BRITTLE FRACTURE PREVENTION (CATEGORY A)
Under conditions where reactor coolant pressure boundary system components constructed of ferritic materials may be subjected to potential loadings, such as a reactivity-induced loading, service temperature shall be at least 120°F above the nil ductility transition (NDT) temperature of the component material if the resulting energy release is expected to be absorbed by plastic deformation or 60°F above the NDT temperature of the component material if the resulting energy release is expected to be absorbed within the elastic strain energy range.
CRITERION 36 - REACTOR COOLANT PRESSURE BOUNDARY SURVEILLANCE (CATEGORY A)
Reactor coolant pressure boundary components shall have provisions for inspection, testing, and surveillance by appropriate means to assess the structural and leak-tight integrity of the boundary components during their service lifetime. For the reactor vessel, a material surveillance program conforming with ASTM-E-185-66 shall be provided.
VII. ENGINEERED SAFETY FEATURES CRITERION 37 - ENGINEERED SAFETY FEATURES BASIS FOR DESIGN (CATEGORY A)
Engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems. As a minimum, much engineered safety features shall be designed to cope with any size reactor coolant pressure boundary break up to and including the circumferential rupture of any pipe in that boundary assuming unobstructed discharge from both ends.
CRITERION 38 - RELIABILITY AND TESTABILITY OF ENGINEERED SAFETY FEATURES (CATEGORY A)
All engineered safety features shall be designed to provide high functional reliability and ready testability. In determining the suitability of a facility for a proposed site, the degree of reliance upon and acceptance of the inherent and engineered safety afforded by the systems, including engineered safety features, will be influenced by the known and the demonstrated performance capability and reliability of the systems, and by the extent to which the operability of such systems can be tested and inspected where appropriate during the life of the plant.
APPENDIX H H.1-9 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 39 - EMERGENCY POWER FOR ENGINEERED SAFETY FEATURES (CATEGORY A)
Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features.
As a minimum, the onsite power system and the offsite power system shall each, independently, provide this capacity assuming a failure of a single active component in each power system.
CRITERION 40 - MISSILE PROTECTION (CATEGORY A)
Protection for engineered safety features shall be provided against dynamic effects and missiles that might result from plant equipment failures.
CRITERION 41 - ENGINEERED SAFETY FEATURES PERFORMANCE CAPABILITY (CATEGORY A)
Engineered safety features such as emergency core cooling and containment heat removal systems shall provide sufficient performance capability to accommodate partial loss of installed capacity and still fulfill the required safety function. As a minimum, each engineered safety feature shall provide this required safety function assuming a failure of a single active component.
CRITERION 42 - ENGINEERED SAFETY FEATURES COMPONENTS CAPABILITY (CATEGORY A)
Engineered safety features shall be designed so that the capability each component and system to perform its required function is not impaired by the effects of a loss-of-coolant accident.
CRITERION 43 - ACCIDENT AGGRAVATION PREVENTION (CATEGORY A)
Engineered safety features shall be designed so that any action of the engineered safety features which might accentuate the adverse after-effects of the loss of normal cooling is avoided.
CRITERION 44 - EMERGENCY CORE COOLING SYSTEMS CAPABILITY (CATEGORY A)
At least two emergency core cooling systems, preferably of different design principles, each with a capability for accomplishing abundant emergency core cooling, shall be provided.
Each emergency core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the emergency core cooling function and to limit the clad metal-water APPENDIX H H.1-10 REV. 26, APRIL 2017
PBAPS UFSAR reaction to negligible amounts for all sizes of breaks in the reactor coolant pressure boundary, including the double-ended rupture of the largest pipe. The performance of each emergency core cooling system shall be evaluated conservatively in each area of uncertainty. The systems shall not share active components and shall not share other features or components unless it can be demonstrated that (a) the capability of the shared feature or component to perform its required function can be readily ascertained during reactor operation, (b) failure of the shared feature or component does not initiate a loss-of-coolant accident, and (c) capability of the shared feature or component to perform its required function is not impaired by the effects of a loss-of-coolant accident and is not lost during the entire period this function is required following the accident.
CRITERION 45 - INSPECTION OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)
Design provisions shall be made to facilitate physical inspection of all critical parts of the emergency core cooling systems, including reactor vessel internals and water injection nozzles.
CRITERION 46 - TESTING OF EMERGENCY CORE COOLING SYSTEMS COMPONENTS (CATEGORY A)
Design provisions shall be made so that active components of the emergency core cooling systems, such as pumps and valves, can be tested periodically for operability and required functional performance.
CRITERION 47 - TESTING OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)
A capability shall be provided to test periodically the delivery capability of the emergency core cooling systems at a location as close to the core as is practical.
CRITERION 48 - TESTING OF OPERATIONAL SEQUENCE OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)
A capability shall be provided to test under conditions as close to design as practical the full operational sequence that would bring the emergency core cooling systems into action, including the transfer to alternate power sources.
APPENDIX H H.1-11 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 49 - CONTAINMENT DESIGN BASIS (CATEGORY A)
The containment structure, including access openings and penetrations, and any necessary containment heat removal systems shall be designed so that the containment structure can accommodate without exceeding the design leakage rate the pressures and temperatures resulting from the largest credible energy release following a loss-of-coolant accident, including a considerable margin for effects from metal water or other chemical reactions that could occur as a consequence of failure of emergency core cooling systems.
CRITERION 50 - NDT REQUIREMENT FOR CONTAINMENT MATERIAL (CATEGORY A)
Principal load carrying components of ferritic materials exposed to the external environment shall be selected so that their temperature under normal operating and testing conditions are not less than 30°F above nil ductility transition (NDT) temperature.
CRITERION 51 - REACTOR COOLANT PRESSURE BOUNDARY OUTSIDE CONTAINMENT (CATEGORY A)
If part of the reactor coolant pressure boundary is outside the containment appropriate features as necessary shall be provided to protect the health and safety of the public in case of an accidental rupture in that part. Determination of the appropriateness of features such as isolation valves and additional containment shall include consideration of the environmental and population conditions surrounding the site.
CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEMS (CATEGORY A)
Where active heat removal systems are needed under accident conditions to prevent exceeding containment design pressure, at least two systems, preferably of different principles, each with full capacity, shall be provided.
CRITERION 53 - CONTAINMENT ISOLATION VALVES (CATEGORY A)
Penetrations that require closure for the containment function shall be protected by redundant valving and associated apparatus.
CRITERION 54 - CONTAINMENT LEAKAGE RATE TESTING (CATEGORY A)
Containment shall be designed so that an integrated leakage rate testing can be conducted at design pressure after completion and installation of all penetrations and the leakage rate measured APPENDIX H H.1-12 REV. 26, APRIL 2017
PBAPS UFSAR over a sufficient period of time to verify its conformance with required performance.
CRITERION 55 - CONTAINMENT PERIODIC LEAKAGE RATE TESTING (CATEGORY A)
The containment shall be designed so that integrated leakage rate testing can be done periodically at design pressure during plant lifetime.
CRITERION 56 - PROVISIONS FOR TESTING PENETRATIONS (CATEGORY A)
Provisions shall be made for testing penetrations which have resilient seals or expansion bellows to permit leaktightness to be demonstrated at design pressure at any time.
CRITERION 57 - PROVISIONS FOR TESTING OF ISOLATION VALVES (CATEGORY A)
Capability shall be provided for testing functional operability of valves and associated apparatus essential to the containment function for establishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits.
CRITERION 58 - INSPECTION OF CONTAINMENT PRESSURE-REDUCING SYSTEMS (CATEGORY A)
Design provisions shall be made to facilitate the periodic physical inspection of all important components of the containment pressure-reducing systems, such as, pumps, valves, spray nozzles, torus, and sumps.
CRITERION 59 - TESTING OF CONTAINMENT PRESSURE-REDUCING SYSTEMS COMPONENTS (CATEGORY A)
The containment pressure-reducing systems shall be designed so that active components, such as pumps and valves, can be tested periodically for operability and required functional performance.
CRITERION 60 - TESTING OF CONTAINMENT SPRAY SYSTEMS (CATEGORY A)
A capability shall be provided to test periodically the delivery capability of the containment spray system at a position as close to the spray nozzles as is practical.
APPENDIX H H.1-13 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 61 - TESTING OF OPERATIONAL SEQUENCE OF CONTAINMENT PRESSURE-REDUCING SYSTEMS (CATEGORY A)
A capability shall be provided to test under conditions as close to the design as practical the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources.
CRITERION 62 - INSPECTION OF AIR CLEANUP SYSTEMS (CATEGORY A)
Design provisions shall be made to facilitate physical inspection of all critical parts of containment air cleanup systems, such as, ducts, filters, fans, and dampers.
CRITERION 63 - TESTING OF AIR CLEANUP SYSTEMS COMPONENTS (CATEGORY A)
Design provisions shall be made so that active components of the air cleanup systems, such as fans and dampers, can be tested periodically for operability and required functional performance.
CRITERION 64 - TESTING OF AIR CLEANUP SYSTEMS (CATEGORY A)
A capability shall be provided for in situ periodic testing and surveillance of the air cleanup systems to ensure (a) filter bypass paths have not developed and (b) filter and trapping materials have not deteriorated beyond acceptable limits.
CRITERION 65 - TESTING OF OPERATIONAL SEQUENCE OF AIR CLEANUP SYSTEMS (CATEGORY A)
A capability shall be provided to test under conditions as close to design as practical the full operational sequence that would bring the air cleanup systems into action, including the transfer to alternate power sources and the design air flow delivery capability.
VIII. FUEL AND WASTE STORAGE SYSTEMS CRITERION 66 - PREVENTION OF FUEL STORAGE CRITICALITY (CATEGORY B)
Criticality in new and spent fuel storage shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls.
APPENDIX H H.1-14 REV. 26, APRIL 2017
PBAPS UFSAR CRITERION 67 - FUEL AND WASTE STORAGE DECAY HEAT (CATEGORY B)
Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities that could result in radioactivity release to plant operating areas or the public environs.
CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING (CATEGORY B)
Shielding for radiation protection shall be provided in the design of spent fuel and waste storage facilities as required to meet the requirements of 10CFR20.
CRITERION 69 - PROTECTION AGAINST RADIOACTIVITY RELEASE FROM SPENT FUEL AND WASTE STORAGE (CATEGORY B)
Containment of fuel and storage shall be provided if accidents could lead to release of undue amounts of radioactivity to the public environs.
IX. PLANT EFFLUENTS CRITERION 70 - CONTROL OF RELEASES OF RADIOACTIVITY TO THE ENVIRONMENT (CATEGORY B)
The facility design shall include those means necessary to maintain control over the plant radioactive effluents, whether gaseous, liquid, or solid. Appropriate holdup capacity shall be provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be expected to require operational limitations upon the release of radioactive effluents to the environment. In all cases, the design for radioactivity control shall be justified (a) on the basis of 10CFR20 requirements for normal operations and for any transient situation that might reasonably be anticipated to occur and (b) on the basis of 10CFR100 dosage level guidelines for potential reactor accidents of exceedingly low probability of occurrence except that reduction of the recommended dosage levels may be required where high population densities or very large cities can be affected by the radioactive effluents.
APPENDIX H H.1-15 REV. 26, APRIL 2017
PBAPS UFSAR H.2 CRITERIA CONFORMANCE H.2.1 Group I - Overall Plant Requirements (Criteria 1-5, Table H.2.1)
The criteria in Group I establish standards for the quality and performance of systems and components essential to the prevention of accidents or the mitigation of their consequences, fire protection, safety of shared systems and components, and recordkeeping.
The quality assurance program directed by the licensee covers the design, procurement, fabrication, manufacture, erection, and testing of essential systems and components for the plant. This program also ensures the use of applicable design and construction codes and standards (Criterion 1). Essential structures and equipment are designed to performance standards which enable the facility to withstand, without loss of capability to protect the public, the additional forces that might be imposed by natural phenomena such as earthquakes, tornados, floods, wind, ice, and other local effects (Criterion 2). For tornados, essential structures and equipment are designed to withstand winds, pressure change and horizontal missiles from tornados. Non-combustible and fire resistant materials are used whenever necessary throughout the facility (Criterion 3).
The design of safety-related systems shared by Units 2 and 3 ensures that safety is not impaired as a result of the system sharing (Criterion 4).
Records of design, fabrication, and construction for this facility are stored or maintained by the licensee, or are available to the licensee for inspection (Criterion 5).
TABLE H.2.1 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP I (OVERALL PLANT REQUIREMENTS)
Conformance (Reference Criterion to Sections of FSAR)
- 1. Quality Standards 1.5, 1.10, 3.2-3.8, 4.2-4.8, 5.2, 5.3, 6.1-6.6, 7.2-7.5, 8.4, 8.5, 8.7, 12.2, App. D
- 2. Performance Standards 1.5, 2.2, 2.3, 3.3, 5.3, 8.4, 8.5, 8.7, 10.2, 10.3, 12.2, App. C
- 3. Fire Protection 7.18, 9.4, 10.12, 12.2, 13.4 APPENDIX H H.2-1 REV. 27, APRIL 2019
PBAPS UFSAR Conformance (Reference Criterion to Sections of FSAR)
- 4. Sharing of Systems App. F
- 5. Records Requirements 1.0, App. D H.2.2 Group II - Protection by Multiple Fission Product Barriers (Criteria 6-10, Table H.2.2)
The criteria in Group II require that nuclear power facilities be provided with multiple barriers to protect the public against the inadvertent release of fission products to the environs.
This reactor plant is provided with multiple fission product barriers to contain or mitigate the release of fission products as follows:
- 1. The fuel barrier, consisting of high density ceramic fuel sealed in high integrity cladding.
- 2. The nuclear system process barrier, consisting of vessels, piping, pumps, and other process components which contain the steam, water, gases, and radioactive materials coming from, going to, or in communication with the reactor core.
- 3. The primary containment.
- 4. The secondary containment system, which includes the reactor building, the reactor building heating and ventilating system, and the standby gas treatment system.
- 5. The stack for controlled elevated release.
The primary containment is designed, fabricated, and erected to accommodate without failure the pressures and temperatures resulting from, or subsequent to, the instantaneous circumferential break of any coolant pipe within the primary containment. The reactor building encompasses the primary containment, and in conjunction with the standby gas treatment system and reactor building heating and ventilation system, provides secondary containment when the primary containment is in service, and provides for containment when the primary containment is open. The containment systems and the other engineered safeguards ensure that offsite doses which result from postulated design basis accidents are below the guideline values stated in 10CFR100 (Criterion 70).
APPENDIX H H.2-2 REV. 27, APRIL 2019
PBAPS UFSAR The reactor core, with its controls, is designed so that there is no inherent tendency for sudden divergent oscillation of operating characteristics, or for divergent power transients in any mode of plant operation, or for uncontrolled oscillations (Criteria 6, 7).
The basis of the reactor core design, in combination with the plant equipment characteristics, nuclear instrumentation system, and the RPS, is to provide margins to ensure that fuel damage does not occur during normal operation or operational transients (Criteria 6, 7). The reactor is designed so that the overall power coefficient in the operating range is not positive (Criterion 8).
The primary system pressure boundary design considers system dead weight and specified live loads acting separately or concurrently.
These live loads include pressure and temperature loads, vibrations, and seismic loads prescribed for the plant. The reactor vessel and support structures are designed to withstand the forces created by the plant design seismic loads. The reactor vessel and support structures are designed to withstand the forces resulting from the postulated design LOCA inside the drywell with the reactor vessel at design temperature and pressure (Criterion 9).
TABLE H.2.2 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP II (PROTECTION BY MULTIPLE FISSION PRODUCT BARRIERS)
Conformance (Reference Criterion to Sections of FSAR)
- 6. Reactor Core Design 1.5, 1.7, 3.2, 3.6, 3.7, 4.3, 4.7, 4.8, 7.2, 14.2, 14.4, 14.5, 14.6
- 7. Suppression of Power 1.5, 3.4, 3.6, 3.7, 4.4, 7.2, Oscillations 7.5, 7.7, 7.17, 14.5
- 8. Overall Power 1.5, 1.7, 3.6, 3.7, 7.17 Coefficient
- 9. Reactor Coolant 1.5, 4.2-4.4, 4.10, 4.11, Pressure Boundary 7.8, 14.5, App. A, App. C APPENDIX H H.2-3 REV. 27, APRIL 2019
PBAPS UFSAR Conformance (Reference Criterion to Sections of FSAR)
- 10. Containment 5.2, 5.3, 14.4, 14.6 H.2.3 Group III - Nuclear and Radiation Controls (Criteria 11-18, Table H.2.3)
The criteria in Group III identify and define the plant instrumentation and control systems which are necessary to maintain the plant in a safe operational status and determine the adequacy of radiation shielding, radiation monitoring, fission process controls, and the effective sensing of abnormal conditions for initiation of engineered safety features.
The plant is provided with a common control room having shielding protection, air conditioning, and facilities to permit access and continuous occupancy within 10CFR20 dose limits during design basis accident situations. The plant design, therefore, does not contemplate the necessity for evacuation of the main control room.
Nevertheless, equipment is provided to bring the plant to a safe shutdown from outside the main control room in the event that it is necessary to evacuate the control room (Criterion 11).
Safe shutdown can be achieved from the Remote Shutdown System (RSS) or by using Alternate Shutdown (ASD) panels at various plant locations. ASD panels are added in response 10 CFR 50, Appendix R requirements.
The necessary plant controls, instrumentation, and alarms for safe and orderly operation are located in the control room (Criteria 11, 12, 13, 16).
The performance of the reactor core and the indications of reactor power level are continuously monitored by the nuclear instrumentation system (Criterion 13). The RPS, independent from the plant process control systems, overrides all other controls to initiate required safety actions. The core protection systems automatically initiate appropriate action whenever the plant conditions approach pre-established limits. The systems act specifically to initiate the CSCSs (Criteria 12, 13, 14, 15).
The plant radiation and process monitoring systems are provided for monitoring significant parameters from specific plant process systems and specific areas, including the plant effluents, and to provide alarms and signals for appropriate corrective actions.
Monitoring and alarm instrumentation are provided for fuel and waste storage and handling areas (Criteria 17, 18).
APPENDIX H H.2-4 REV. 27, APRIL 2019
PBAPS UFSAR TABLE H.2.3 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP III (NUCLEAR AND RADIATION CONTROLS)
Conformance (Reference Criterion to Sections of FSAR)
- 11. Control Room 1.5, 7.2-7.5, 7.7-7.10, 7.12, 7.18, 12.3, 14.9
- 12. Instrumentation and 1.5, 2.6, 3.4, 3.8, 4.10, 7.2-7.5, Control System 7.7-7.10, 7.12, 7.17, 9.2-9.4
- 13. Fission Process 1.5, 3.4, 3.8, 7.2, 7.5, Monitors and Controls 7.7-7.9, 7.16
- 14. Core Protection 1.5, 3.4, 3.5, 4.4-4.8, 6.1-6.7, Systems 7.2-7.5, 7.7, 7.12, 14.1-14.7
- 15. Engineered Safety 1.5, 7.2-7.5, 7.12 Features Protection Systems
- 16. Monitoring Reactor 1.5, 4.10, 5.2, 7.3, 7.8, 9.2, Coolant Pressure 10.6, 10.7, 10.9 Boundary
- 17. Monitoring Radio- 1.5, 2.6, 4.10, 7.12, 9.2, 9.4, active Releases 10.13
- 18. Monitoring Fuel 1.5, 7.6, 7.12, 9.2, 9.4, 10.4, and Waste Storage 10.5 H.2.4 Group IV - Reliability and Testability of Protection Systems (Criteria 19-26, Table H.2.4)
The criteria in Group IV identify and establish requirements with regard to the functional reliability in-service testability, redundancy, physical and electrical independence, separation, and fail-safe design of the protection systems, which are essential to the reactor protection functions: scram, isolation, and core standby cooling.
The protection systems act to shut down the reactor, close primary containment isolation valves, and initiate the operation of the CSCS's. The protection systems automatically override the plant APPENDIX H H.2-5 REV. 27, APRIL 2019
PBAPS UFSAR normal operational controls to initiate appropriate protective action whenever the plant conditions monitored by the system (e.g., neutron flux, containment pressure, reactor vessel pressure) exceed established limits (Criterion 22). A dual-channel protection system, with complete redundancy in each channel, allows for component failure with no loss of protection.
The RPS is designed so that a plant accident is sensed by different parametric measurements (e.g., LOCA is detected by high drywell pressure and reactor low water level monitors). At least two instrument channels are provided to initiate each protection function (Criterion 20). Components of the redundant subsystems can be removed from service for testing and maintenance without negating the ability of the protection system to perform its function upon receipt of the appropriate signals (Criteria 19, 20, 21). The design of the protection systems provides means for testing during power operation without affecting planned operation or impairing safety functions (Criterion 25). The systems' electrical power requirements are supplied from independent, redundant sources. Alternate sources of power are provided so as to permit the required functioning of equipment required for safe shutdown of the plant in the event of loss of all off-site power (Criterion 24). The system circuits are separated to preclude a circuit fault from inducing a fault in another circuit, and to reduce the likelihood that adverse conditions will encompass more than one circuit. Sensors and electrical circuits necessary to the functioning of these systems are physically and electrically separated so that no single event can compromise the protection function. The system internal wiring and external cable routing are arranged to reduce any external influence on the system performance (Criteria 23, 24). Systems essential to the protection function are designed to fail-safe in their likely failure modes.
A failure of any one RPS input or subsystem component produces a trip in one of the two protection channels; this condition is insufficient to produce a reactor scram, but the system is ready to perform its protective function upon another trip (either by failure of or by exceeding the preset trip in the other channel)
(Criterion 26).
APPENDIX H H.2-6 REV. 27, APRIL 2019
PBAPS UFSAR TABLE H.2.4 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP IV (RELIABILITY AND TESTABILITY OF PROTECTION SYSTEMS)
Conformance (Reference Criterion to Sections of FSAR)
- 19. Protection Systems 1.5, 3.4, 7.2-7.5, 7.12, 14.0, Reliability App. G
- 20. Protection Systems 1.5, 3.4, 7.2-7.5, 7.12, 8.5, Redundancy and 14.0, App. G Independence
- 21. Single Failure 1.2, 14.4, App. G Definition
- 22. Separation of Protection 1.5, 3.4, 7.2-7.5, 7.12, 8.5 and Control Instrumen-tation Systems
- 23. Protection Against 1.5, 3.4, 7.2-7.5, 7.12, 8.5, Multiple Disability 14.0, App. G for Protection Systems
- 24. Emergency Power for 1.5, 3.4, 6.4, 7.2-7.5, 7.12, Protection Systems 8.5, 14.0, App. G
- 25. Demonstration of 1.5, 3.4, 4.6, 4.8, 5.2, 5.3, Functional Operability 6.7, 7.2-7.5, 7.12, 8.5, 13.0 of Protection Systems
- 26. Protection Systems 1.5, 6.1-6.5, 7.2-7.5, 8.5, 8.7 Fail-Safe Design H.2.5 Group V - Reactivity Control (Criteria 27-32, Table H.2.5)
The criteria in Group V establish the reactor core reactivity insertion and withdrawal rate limitations and the means to control the plant operations within these limits.
The plant design contains two independent reactivity control systems employing different principles. Control of reactivity is operationally provided by a combination of movable control rods, APPENDIX H H.2-7 REV. 27, APRIL 2019
PBAPS UFSAR burnable poisons, and reactor coolant recirculation system flow, which accommodate fuel burnup, load changes, and long-term reactivity changes. Reactor shutdown by the CRDS is sufficiently rapid to prevent violation of fuel damage limits for normal operation and abnormal operating transients. The standby liquid control system provides an independent shutdown capability, if needed. This system is designed to shut down the reactor and maintain it in the shutdown condition during cooldown (Criteria 27, 28, 29). The reactor core is designed to have (Criteria 27, 31):
- 1. A reactivity response which regulates or dampens changes in power level and spatial distributions of power production to values consistent with safe and efficient operation.
- 2. A negative reactivity feedback consistent with the requirements of overall plant nuclear-hydrodynamic stability.
- 3. A strong negative reactivity feedback under severe power transient conditions.
The reactivity control system is designed such that, under conditions of normal operation, sufficient reactivity compensation is always available to make the reactor adequately subcritical from its most reactive condition, and means are provided for continuous regulation of the reactor core excess reactivity and reactivity distribution. Shutdown margins provided are greater than the maximum worth of the most effective control rod when fully withdrawn (Criteria 29, 30). This system is also designed to be capable of compensating for positive and negative reactivity changes resulting from changing nuclear coefficients, fuel depletion, and fission product transients and buildup (Criterion 29). The system design is such that control rod worths and the rate at which reactivity can be added are limited to assure that the design basis reactivity accident is not capable of damaging the reactor coolant system or disrupting the reactor core, its support structures, or other vessel internals sufficiently to impair the CSCS effectiveness if needed.
Acceptable fuel damage limits are not exceeded for any reactivity transient resulting from a single equipment malfunction or single operator error (Criteria 29, 31, 32).
APPENDIX H H.2-8 REV. 27, APRIL 2019
PBAPS UFSAR TABLE H.2.5 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP V (REACTIVITY CONTROL)
Conformance (Reference Criterion to Sections of FSAR)
- 27. Redundancy of 1.5, 3.4, 3.8, 7.7 Reactivity Control
- 28. Reactivity Hot 1.5, 3.4, 3.6, 3.8, 7.7, Shutdown Capability 14.0, App. G
- 29. Reactivity Shutdown 1.5, 3.4, 3.6, 7.2, 14.0, Capability App. G
- 30. Reactivity Holddown 1.5, 3.4, 3.6, 3.8 Capability
- 31. Reactivity Control 1.5, 3.4, 3.6, 3.7, 7.2, Systems Malfunction 7.7, 14.0, App. G
- 32. Maximum Reactivity 1.5, 3.4, 3.6, 3.7, 7.7, Worth of Control Rods 14.0, App. G H.2.6 Group VI - Reactor Coolant Pressure Boundary (Criteria 33-36, Table H.2.6)
The criteria in Group VI establish the reactor coolant pressure boundary design requirements and identify the means used to satisfy these design requirements. The reactor coolant pressure boundary is referred to in this FSAR as the nuclear system primary barrier (see subsection 1.2, "Definitions").
The inherent safety features of the reactor core design, in combination with certain engineered safety features (control rod velocity limiter and control rod housing) and the plant reactivity control system, are such that the consequences of the most severe potential nuclear excursion accident, caused by a single component failure within the reactivity control system (rod drop accident), cannot result in damage (either by motion or rupture) to the reactor coolant pressure boundary (Criterion 33). The applicable ASME and ANSI codes are used as the established and acceptable criteria for design, fabrication, and operation of components of the reactor coolant pressure boundary (Criterion 34).
APPENDIX H H.2-9 REV. 27, APRIL 2019
PBAPS UFSAR Brittle fracture failure of reactor coolant pressure boundary system components is prevented by the judicious selection of ferritic steels for fabrication which have notch toughness properties suitable for the system service temperatures.
Appropriate consideration is given in the design to the mechanical properties of the materials to ensure that, at the service temperatures, there is:
- 1. Complete energy absorption with fully ductible behavior (e.g., in the energy absorption region of 100 percent shear fracture) whenever the boundary can be pressurized beyond the systems safety valve setting by operational transients in postulated accidents.
- 2. An NDT temperature at least 60°F below the service temperature whenever the boundary can be pressurized beyond 20 percent of its design pressure by operational transients, hydro tests, and postulated accidents.
It is believed that Criterion 35 should be applicable only to those components or systems whose failure would result in a loss of coolant in excess of the normal makeup capability of the reactor coolant system.
In this way it is ensured that brittle fracture is prevented in the above defined components and systems under all potential service loading conditions (Criterion 35).
The reactor coolant pressure boundary is given a hydrostatic test in accordance with code requirements prior to initial reactor startup. The system is checked for leaks, and abnormal conditions are corrected before reactor startup. The minimum vessel temperature during the hydrostatic test shall at least be 60°F above the calculated NDT temperature prior to pressurizing the vessel. The reactor coolant pressure boundary also has provisions for hydrostatic testing during the service lifetime of the boundary components. An extensive quality assurance program is also followed during the entire fabrication of the reactor coolant pressure boundary (Criterion 36). Surveillance samples of vessel material are located within the reactor primary vessel to enable periodic monitoring of the effects of radiation on material properties. The program includes specimens of the base metal, heat-affected zone metal, weld metal specimens, and standard specimens. Leakage from the reactor coolant pressure boundary is monitored during reactor operation (Criterion 36).
APPENDIX H H.2-10 REV. 27, APRIL 2019
PBAPS UFSAR TABLE H.2.6 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VI (REACTOR COOLANT PRESSURE BOUNDARY)
Conformance (Reference Criterion to Sections of FSAR)
- 33. Reactor Coolant Pressure 1.5, 3.3-3.6, 4.2, 4.4-4.6, Boundary Capability 14.4-14.6, App. A, C, G
- 34. Reactor Coolant Pressure 3.3, 4.2, 4.3, 7.8, Boundary Rapid Propagation App. A, C Failure Prevention
- 35. Reactor Coolant Pressure 4.2, App. A Boundary Brittle Fracture Prevention
- 36. Reactor Coolant Pressure 4.2, 4.3, 4.10, 7.3, App. A Boundary Surveillance H.2.7 Group VII - Engineered Safety Features (Criteria 37-65, Table H.2.7)
The criteria in Group VII establish requirements with respect to:
- 1. Incorporation of engineered safety features.
- 2. Independence, redundancy, capability, testability, inspectability and reliability of engineered safety features.
- 3. Suitability of each engineered safety feature for its intended duty.
- 4. Justification that each engineered safety feature's capability envelops all the anticipated and credible phenomena associated with the plant operational transients or design basis accidents considered.
The engineered safety features are referred to in this FSAR as engineered safeguards and nuclear safety systems (see subsection 1.2, "Definitions").
The normal plant control systems maintain plant variables within operating limits. These systems are thoroughly engineered and APPENDIX H H.2-11 REV. 27, APRIL 2019
PBAPS UFSAR backed up by a significant amount of experience in system design and operation. Even if an improbable maloperation or equipment failure were to occur, including the instantaneous circumferential break of any pipe in the reactor coolant boundary, the nuclear safety systems and engineered safeguards limit effects to levels below those which are of public safety concern (Criterion 37).
These engineered safety features include those systems which are essential to the isolation and core standby cooling functions (Criterion 37). Sufficient offsite and standby (redundant, independent, and testable) auxiliary sources of electrical power are provided to attain prompt shutdown and continued maintenance of the plant in a safe condition. The capacities of the offsite and onsite power sources are independently adequate to accomplish all required engineered safety functions, assuming a failure of a single active component in a power system (Criterion 39).
The engineered safety features are designed to provide high reliability and testability. Specific provisions are made in each engineered safety feature to demonstrate operability and performance capabilities (Criterion 38). Components of the engineered safety features which are required for function after a design basis accident are designed to withstand credible environmental effects from a LOCA and are protected from credible missiles which might impair their performance capability (Criteria 40, 42, 43). The CSCSs are designed to provide at least two different systems of different principles to prevent excessive fuel clad temperature over the entire spectrum of postulated coolant boundary breaks. Such capability is available notwithstanding the loss of all offsite AC power.
The CSCSs are designed to various levels of component redundancy such that no single active component failure in addition to the accident can prevent core cooling (Criteria 41, 44). To assure that the CSCSs function properly, specific provisions have been made to provide capability for testing the sequential operability and functional performance of each individual system (Criteria 46, 47, 48). Design provisions have also been made to facilitate physical and visual inspection of the CSCS's components (Criterion 45).
The primary containment structure, including access openings and penetrations, is designed to withstand the peak pressures and temperatures which could occur due to the postulated design basis LOCA. The containment has the capability to accommodate energy addition from metal-water reactions beyond conditions that could exist following the accident (Criterion 49).
Pressure boundary materials associated with the primary containment and penetrations have a maximum NDT temperature of 0°F as determined by tests conducted in accordance with Section III of APPENDIX H H.2-12 REV. 27, APRIL 2019
PBAPS UFSAR the ASME Boiler and Pressure Vessel Code. It is intended that the drywell will not be pressurized or subjected to substantial stress at temperatures below 30°F above the NDT temperatures for the primary containment and penetration materials (Criterion 50). The effects of an accidental rupture of a line outside the primary containment are limited by the engineered safety features such that offsite doses will be below the guideline values of 10CFR100 (Criterion 51). Provisions are made for the removal of heat from within the plant containment and to isolate the various process system lines as may be necessary to maintain the integrity of the plant containment systems as long as necessary following the various postulated design basis accidents. Process lines that penetrate the primary containment and which connect to the reactor coolant system, or to the primary containment free space, are provided with at least two isolation valves or equivalent in series (Criterion 53). The plant design includes pre-operational and post-operational pressure and leak rate testing capability (Criteria 54, 55). Provisions are made for demonstrating the functional performance of the primary containment isolation valves and leak testing of penetrations having seals or expansion bellows, other than solidly welded connections (Criteria 56, 57).
The pressure-suppression system and the containment cooling system provide two different means for containment heat removal under accident conditions so that the peak containment pressure would be less than the primary containment maximum allowable pressure. In addition, periodic integrated leakage rate testing will be conducted in accordance with Technical Specifications in Appendix B (Criterion 52).
Ability to demonstrate operability, test the functional performance, and inspect the active components of containment pressure reducing systems and the containment cooling system is provided (Criteria 58, 59, 60, 61). The standby gas treatment system facilities permit the onsite testing of the filter components with acceptable methods (Criterion 64). All major components of the containment heating, cooling, and ventilating systems can be physically inspected and tested. The standby gas treatment system can be physically inspected and its operability demonstrated using a tracer injection (Criteria 62, 63, 65).
APPENDIX H H.2-13 REV. 27, APRIL 2019
PBAPS UFSAR TABLE H.2.7 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VII (ENGINEERED SAFETY FEATURES)
Conformance (Reference Criterion to Sections of FSAR)
- 37. Engineered Safety 1.5, 3.3, 3.4, 4.2, 4.4, 4.6, Features Basis 5.2, 5.3, 6.1-6.7, 7.2-7.4, for Design 8.5, 8.7, 10.7, 10.9, 10.13, 10.14, 12.3, 14.1-14.7, App. G
- 38. Reliability and Testa- 1.5, 3.4, 3.5, 4.6-4.8, 5.2, bility of Engineered 5.3, 6.6, 7.2-7.5, 7.12, 8.5, Safety Features 8.7, 10.7, 10.9, 10.13, 10.14
- 39. Emergency Power for 7.2-7.4, 8.4, 8.5, 8.7 Engineered Safety Features
- 40. Missile Protection 5.2, 12.2
- 41. Engineered Safety 4.7, 4.8, 6.1-6.5, 7.4, 8.5, Features Performance 14.1-14.6, App. G Capability
- 42. Engineered Safety 3.4, 4.7, 4.8, 5.2, 5.3, Features Components 6.1-6.5, 7.2-7.4, 8.5, 8.7, Capability 14.1-14.6
- 43. Accident Aggravation 3.4, 5.2, 5.3, 6.1-6.5, 7.3, Protection 7.4, 8.5, 8.7, 14.9
- 44. Emergency Core Cooling 4.7, 4.8, 6.1-6.5, 7.4, 14.6, Systems Capability App. G
- 45. Inspection of Emergency 3.3, 4.2, 6.6 Core Cooling Systems APPENDIX H H.2-14 REV. 27, APRIL 2019
PBAPS UFSAR Conformance (Reference Criterion to Sections of FSAR)
- 46. Testing of Emergency 1.5, 4.7, 4.8, 6.6, 7.4, 13.4 Core Cooling Systems Components
- 47. Testing of Emergency 6.6, 7.4, 13.4 Core Cooling Systems
- 48. Testing of Operational 1.5, 6.4, 6.6, 7.4, 8.5, 8.7, Sequence of Emergency 10.9, 13.0 Core Cooling Systems
- 49. Containment Design 1.5, 4.8, 5.2, 6.1, 6.2, 6.5, Basis 7.3, 7.4, 13.4, 14.2-14.7, App. A, App. M
- 50. NDT Requirement for 5.2 Containment Material
- 51. Reactor Coolant Pressure 1.5, 2.2, 2.3, 4.6, 5.2, 7.2, Boundary Outside 7.3, 12.3, 14.6 Containment
- 52. Containment Heat 1.5, 4.8, 5.2, 6.1-6.5, 7.4, Removal Systems 10.7, 14.0
- 53. Containment Isolation 1.5, 4.6, 5.2, 7.3 Valves
- 54. Containment Leakage 5.2, 13.4 Rate Testing
- 55. Containment Periodic 5.2 Leakage Rate Testing
- 56. Provisions for Testing 5.2 of Penetrations
- 57. Provisions for Testing 4.6, 5.2, 7.3, 7.12 of Isolation Valves
- 58. Inspection of Contain- 4.8, 5.2, 6.4, 6.6, 10.7 ment Pressure Reducing Systems
- 59. Testing of Containment 4.8, 5.2, 6.1-6.6, 7.3, Pressure Reducing 7.4, 10.7 Systems Components APPENDIX H H.2-15 REV. 27, APRIL 2019
PBAPS UFSAR Conformance (Reference Criterion to Sections of FSAR)
- 60. Testing of Containment 4.8, 6.4, 6.6, 7.4 Spray Systems
- 61. Testing of Operational 5.2, 6.4, 6.6, 7.4, 8.4, 8.5 Sequence of Containment Pressure-Reducing Systems
- 62. Inspection of 5.2, 5.3, 10.13 Air Cleanup Systems
- 63. Testing of Air Cleanup 5.2, 5.3, 10.13 Systems Components
- 64. Testing of Air Cleanup 5.2, 5.3, 10.13 Systems
- 65. Testing of Operational 5.3, 7.12, 10.13, 13.4 Sequence of Air Cleanup Systems H.2.8 Group VIII - Fuel and Waste Storage Systems (Criteria 66-69, Table H.2.8)
The criteria in this group establish requirements applicable to fuel and waste storage systems.
Plant fuel handling and storage facilities preclude accidental criticality and provide sufficient cooling for spent fuel (Criteria 66, 67). The new fuel storage vault racks (located in the reactor building) are top entry and are designed to prevent an accidental critical array even in the event the vault becomes flooded or subjected to seismic loadings (Criterion 66). Spent fuel handling and storage of fuel that is less than 10 years old is entirely within the reactor building which provides containment (Criterion 69). The spent fuel storage pool has provisions to maintain water clarity, temperature control, and has instrumentation to monitor water level. Water depth in the pool provides sufficient shielding for normal reactor building occupancy by operating personnel. The racks in which spent fuel assemblies are placed are designed and arranged to ensure subcriticality in the storage pool (Criteria 66, 67, 68, 69). The spent fuel pool cooling and demineralizer system is designed to maintain the pool water temperature (decay heat removal), to control water clarity (safe fuel movement), and to reduce radioactivity (shielding and effluent release control) (Criteria APPENDIX H H.2-16 REV. 27, APRIL 2019
PBAPS UFSAR 66, 67, 68). Accessible portions of the reactor and radwaste buildings have sufficient shielding to maintain dose rates within 10CFR20 limits (Criterion 68). The radwaste systems and buildings prevent the release of undue amounts of radioactive materials to the environs (Criterion 69).
Fuel that is ten years old or more may be stored in the plant's spent fuel pools of in dry storage casks at the Independent Spent Fuel Storage Installation (ISFSI) located on the Peach Bottom site. Design of the ISFSI is not covered under the AEC general design criteria that apply to the power plant; ISFSI design is covered under 10 CFR 72 and was addressed in the 10 CFR 72.212 Report prepared by PECO in accordance with 10 CFR 72.
TABLE H.2.8 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VIII (FUEL AND WASTE STORAGE SYSTEMS)
Conformance (Reference Criterion to Sections of FSAR)
- 66. Prevention of Fuel 7.6, 10.2, 10.3 Storage Criticality
- 67. Fuel and Waste 4.8, 10.5 Storage Decay Heat
- 68. Fuel and Waste Storage 9.3, 10.3, 10.5, 12.3 Radiation Shielding
- 69. Protection Against 5.3, 7.12, 9.2, 9.3, 10.2, Radioactive Release 10.3, 10.5, 12.3 from Spent Fuel and Waste Storage H.2.9 Group IX - Plant Effluents (Criterion 70, Table H.2.9)
The criterion in this group establishes requirements to limit releases of radioactive materials.
The plant radioactive waste control systems (which include the liquid, gaseous, and solid radwaste subsystems) are designed to limit the potential offsite radiation exposure to levels below the limits of 10CFR20. The plant engineered safeguards are designed to limit the offsite exposure under the postulated design basis accidents to levels below 10 CFR 100 (Criterion 70).
APPENDIX H H.2-17 REV. 27, APRIL 2019
PBAPS UFSAR The radioactive effluents of the Independent Spent Fuel Storage Installation (ISFSI) are not covered under the AEC general design criteria. Any release of effluents from the ISFSI constitutes a design basis accident whose limits are controlled by 10 CFR 72.106. The radiological consequences of dry storage cask leakage were addressed in the 10 CFR 72.212 Report in accordance with 10 CFR 72.212 and were found to be acceptable.
TABLE H.2.9 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP IX (PLANT EFFLUENTS)
Conformance (Reference Criterion to Sections of FSAR)
- 70. Control of Releases 1.5, 5.2, 5.3, 7.3, 7.12, 7.13, of Radioactivity to 9.2, 9.4, 14.2-14.7, App. G the Environment APPENDIX H H.2-18 REV. 27, APRIL 2019
PBAPS UFSAR H.3 EXTENDED POWER UPRATE (EPU) GENERAL DESIGN AND OTHER CRITERIA CONFORMANCE The NRC staffs review of the PBAPS EPU application was based on NRC Review Standard RS-001, Review Standard for Extended Power Uprates. RS-001 contains guidance for evaluating each area of review in the application, including the specific GDC used as the NRCs acceptance criteria. Since the guidance in RS-001 is based on the final GDC and PBAPS, Units 2 and 3, were designed and constructed based on the draft GDC, Exelon submitted a supplement to the EPU application dated February 15, 2013, which replaced references to the final GDC with the corresponding design criteria that constitute the current licensing basis for PBAPS.
The NRC safety evaluation dated 8/25/14 for the EPU license amendment reflected the current licensing basis of PBAPS with respect to conformance with the GDC and other criteria current at the time of EPU licensing. The paragraphs below summarize that evaluation, including the NRC acceptance criteria for operation at the EPU power level.
H.3.1 MATERIALS AND CHEMICAL ENGINEERING H.3.1.1 Reactor Vessel Material Surveillance Program The reactor vessel material surveillance program provides a means for determining and monitoring the fracture toughness of the reactor vessel beltline materials to support analyses for ensuring the structural integrity of the ferritic components of the reactor vessel. The NRC staffs review primarily focused on the effects of the proposed EPU on the licensees reactor vessel surveillance capsule withdrawal schedule. The NRCs acceptance criteria are based on: (1) final General Design Criterion (GDC)-
14, insofar as it requires that the reactor coolant pressure boundary (RCPB) be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (2) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; (3) 10 CFR Part 50, Appendix H, which provides for monitoring changes in the fracture toughness properties of materials in the reactor vessel beltline region; and (4) 10 CFR 50.60, which requires compliance with the requirements of 10 CFR Part 50, Appendix H.
H.3.1.2 Pressure-Temperature Limits and Upper-Shelf Energy Appendix G of 10 CFR Part 50 provides fracture toughness requirements for ferritic materials in the RCPB, including requirements on the upper-shelf energy (USE) values used for APPENDIX H H.3-1 REV. 26, APRIL 2017
PBAPS UFSAR assessing the safety margins of the reactor vessel materials against ductile tearing and requirements for calculating pressure-temperature (P-T) limits for the plant. These P-T limits are established to ensure the structural integrity of the ferritic components of the RCPB during any condition of normal operation, including anticipated operational occurrences and hydrostatic tests. The NRC staffs review of P-T limits covered the P-T limits methodology and the calculations for the number of EFPY specified for the proposed EPU, considering neutron embrittlement effects and using linear elastic fracture mechanics. The NRCs acceptance criteria for P-T limits are based on: (1) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (2) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; (3) 10 CFR Part 50, Appendix G, which specifies fracture toughness requirements for ferritic components of the RCPB; and (4) 10 CFR 50.60, which requires compliance with the requirements of 10 CFR Part 50, Appendix G.
H.3.1.3 Reactor Internal and Core Support Materials The reactor internals and core supports include structures, systems, and components (SSCs) that perform safety functions or whose failure could affect safety functions performed by other SSCs. These safety functions include reactivity monitoring and control, core cooling, and fission product confinement (within both the fuel cladding and the reactor coolant system (RCS)).
The NRC staffs review covered the materials specifications and mechanical properties, welds, weld controls, nondestructive examination procedures, corrosion resistance, and susceptibility to degradation. The NRCs acceptance criteria for reactor internal and core support materials are based on draft GDC-1 and 10 CFR 50.55a for material specifications, controls on welding, and inspection of reactor internals and core supports.
H.3.1.4 Reactor Coolant Pressure Boundary Materials The RCPB defines the boundary of systems and components containing the high-pressure fluids produced in the reactor. The NRC staffs review of RCPB materials covered its specifications, compatibility with the reactor coolant, fabrication and processing, susceptibility to degradation, and degradation management programs. The NRCs acceptance criteria for RCPB materials are based on: (1) 10 CFR 50.55a and draft GDC-1, insofar as they require that those systems and components which are essential to the prevention of accidents which could affect APPENDIX H H.3-2 REV. 26, APRIL 2017
PBAPS UFSAR the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (3) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; and (4) 10 CFR Part 50, Appendix G, which specifies fracture toughness requirements for ferritic components of the RCPB.
H.3.1.5 Protective Coating Systems (Paints) - Organic Materials Protective coating systems (paints) provide a means for protecting the surfaces of facilities and equipment from corrosion and radionuclide contamination. Coatings also provide wear protection during plant operation and maintenance activities. Considering temperature, radiation and pressure, the NRC staffs review covered Service Level 1 protective coating systems used inside the containment for their suitability and stability under design basis loss-of-coolant accident (DBLOCA) conditions. The NRCs acceptance criteria for protective coating systems are based on: (1) 10 CFR Part 50, Appendix B, Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants, which covers quality assurance requirements for the design, fabrication, and construction of safety-related SSCs; and (2) RG 1.54, Revision 2, Service Level I, II, and III Protective Coatings Applied to Nuclear Power Plants, which covers application and performance monitoring of coatings in nuclear power plants.
H.3.1.6 Flow-Accelerated Corrosion Flow-accelerated corrosion (FAC) is a corrosion mechanism that occurs in carbon steel components exposed to single-phase or two-phase water flow. Components made from stainless steel are immune to FAC, and FAC is significantly reduced in components containing even small amounts of chromium or molybdenum. The rates of material loss due to FAC depend on the system flow velocity, component geometry, fluid temperature, steam quality, oxygen content, and pH. During plant operation, it is not normally possible to maintain all of these parameters in a regime that minimizes FAC; therefore, loss of material by FAC can occur.
The NRC staff reviewed the effects of the proposed EPU on FAC and the adequacy of the licensees FAC program to predict the rate of material loss so that repair or replacement of damaged components could be made before reaching a critical thickness. The NRCs APPENDIX H H.3-3 REV. 26, APRIL 2017
PBAPS UFSAR acceptance criteria are based on the structural evaluation of the minimum acceptable wall thickness for the components undergoing degradation by FAC.
H.3.1.7 Reactor Water Cleanup System The reactor water cleanup (RWCU) system provides a means for maintaining reactor water quality by filtration and ion exchange and a path for removal of reactor coolant when necessary.
Portions of the RWCU system comprise the RCPB. The NRC staffs review of the RWCU system included component design parameters for flow, temperature, pressure, heat removal capability, and impurity removal capability; and the instrumentation and process controls for proper system operation and isolation. The NRCs acceptance criteria for the RWCU system are based on: (1) draft GDC-9 and 34, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (3) draft GDC 51, insofar as it requires that systems that may contain radioactivity be designed with appropriate confinement.
H.3.2 MECHANICAL AND CIVIL ENGINEERING H.3.2.1 Pipe Rupture Locations and Associated Dynamic Effects SSCs important to safety could be impacted by the pipe-whip dynamic effects of a pipe rupture. The NRC staff conducted a review of pipe rupture analyses to ensure that SSCs important to safety are adequately protected from the effects of pipe ruptures. The NRC staffs review covered: (1) the implementation of criteria for defining pipe break and crack locations and configurations; (2) the implementation of criteria dealing with special features, such as augmented inservice inspection (ISI) programs or the use of special protective devices such as pipe-whip restraints; (3) pipe-whip dynamic analyses and results, including the jet thrust and impingement forcing functions and pipe-whip dynamic effects; and (4) the design adequacy of supports for SSCs provided to ensure that the intended design functions of the SSCs will not be impaired to an unacceptable level as a result of pipe-whip or jet impingement loadings. The NRC staffs review focused on the effects that the proposed EPU may have on items (1) thru (4) above. The NRCs acceptance criteria are based on draft GDC-40 and 42 insofar as they require that protection be provided for engineered safety features (ESFs) against the dynamic effects that might result from plant equipment failures.
APPENDIX H H.3-4 REV. 26, APRIL 2017
PBAPS UFSAR H.3.2.2 Pressure-Retaining Components and Component Supports The NRC staff has reviewed the structural integrity of pressure-retaining components (and their supports) designed in accordance with the ASME Boiler and Pressure Vessel Code (B&PV Code),
Section III, Division 1, final GDC 14 and draft GDCs 1, 2, 9, 33, 34, 40, and 42. The NRC staffs review focused on the effects of the proposed EPU on the design input parameters and the design-basis loads and load combinations for normal operating, upset, emergency, and faulted conditions. The NRC staffs review covered: (1) the analyses of flow-induced vibration; and (2) the analytical methodologies, assumptions, ASME Code editions, and computer programs used for these analyses. The NRC staffs review also included a comparison of the resulting stresses and cumulative fatigue usage factors (CUFs) against the code-allowable limits. The NRCs acceptance criteria are based on:
(1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a loss-of-coolant accident (LOCA); (4) draft GDC-9 and 33, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (5) draft GDC-34 insofar as it requires that the RCPB be designed to minimize the probability of rapidly propagating type failures; and (6) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture.
H.3.2.3 Reactor Pressure Vessel Internals and Core Supports Reactor pressure vessel internals consist of all the structural and mechanical elements inside the reactor vessel, including core support structures. The NRC staff reviewed the effects of the proposed EPU on the design input parameters and the design-basis loads and load combinations for the reactor internals for normal operation, upset, emergency, and faulted conditions. These include pressure differences and thermal effects for normal operation, transient pressure loads associated with LOCAs, and APPENDIX H H.3-5 REV. 26, APRIL 2017
PBAPS UFSAR the identification of design transient occurrences. The NRC staffs review covered: (1) the analyses of flow-induced vibration for safety-related and non-safety-related reactor internal components; and (2) the analytical methodologies, assumptions, ASME Code editions, and computer programs used for these analyses. The NRC staffs review also included a comparison of the resulting stresses and CUFs against the corresponding Code-allowable limits. The NRCs acceptance criteria are based on: (1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (4) draft GDC-6, insofar as it requires that the reactor core be designed with appropriate margin to assure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.
H.3.2.4 Safety-Related Valves and Pumps The NRCs staffs review included certain safety-related pumps and valves typically designated as Class 1, 2, or 3 under Section III of the ASME Code and within the scope of Section XI of the ASME Code and the ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code), as applicable. The NRC staffs review focused on the effects of the proposed EPU on the required functional performance of the valves and pumps. The review also covered any impacts that the proposed EPU may have on the licensees motor-operated valve (MOV) program related to GL 89-10, GL 96-05, and GL 95-07. The NRC staff also evaluated the licensees consideration of lessons learned from the MOV program and the application of those lessons learned to other safety-related power-operated valves. The NRCs acceptance criteria are based on (1): draft GDC-1, insofar as they require that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be APPENDIX H H.3-6 REV. 26, APRIL 2017
PBAPS UFSAR performed; (2) draft GDC-38, 46, 47, 48, 59, 60, 61, 63, 64, and 65, insofar as they require that the emergency core cooling system (ECCS), the containment heat removal system, the containment atmospheric cleanup systems, and the cooling water system, respectively, be designed to permit appropriate periodic testing to ensure the leak-tight integrity and performance of their active components; (3) draft GDC-57, insofar as it requires that piping systems penetrating containment be designed with the capability to periodically test the operability of the isolation valves to determine if valve leakage is within acceptable limits; and (4) 10 CFR 50.55a(f), insofar as it requires that pumps and valves subject to that section must meet the inservice testing program requirements identified in that section.
H.3.2.5 Seismic and Dynamic Qualification of Mechanical and Electrical Equipment Mechanical and electrical equipment covered by this section includes equipment associated with systems that are essential to emergency reactor shutdown, containment isolation, reactor core cooling, and containment and reactor heat removal. Equipment associated with systems essential to preventing significant releases of radioactive materials to the environment are also covered by this section. The NRC staffs review focused on the effects of the proposed EPU on the qualification of the equipment to withstand seismic events and the dynamic effects associated pipe-whip and jet impingement forces. The primary input motions due to the safe shutdown earthquake (SSE) are not affected by an EPU. The NRCs acceptance criteria are based on: (1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) 10 CFR Part 100, Appendix A, which sets forth the principal seismic and geologic considerations for the evaluation of the suitability of plant design bases established in consideration of the seismic and geologic characteristics of the plant site; (4) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (5) draft GDCs 9 and 33, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (6)
APPENDIX H H.3-7 REV. 26, APRIL 2017
PBAPS UFSAR draft GDC-34, insofar as it requires that the RCPB be designed to minimize the probability of rapidly propagating type failures; and (7) 10 CFR Part 50, Appendix B, which sets quality assurance requirements for safety-related equipment.
H.3.2.6 Replacement Steam Dryer Structural Integrity The steam dryer is a reactor internal component and is located in the steam dome portion of the reactor pressure vessel (RPV). The function of the steam dryer is to dry the steam to very high quality, approximately 99.9% quality (or 0.1% moisture carryover), when it exits the dryer. Even though the steam dryer does not perform any safety function, it must retain its structural integrity to avoid the generation of loose parts that may adversely impact the ability of other SSCs from performing their safety functions. The NRC staffs review was focused on the effects of the proposed EPU on the qualification of the replacement steam dryers (RSDs) to withstand seismic events and the dynamic effects associated with flow induced vibration, MSL break, and turbine stop valve closure. Since the steam dryer is a safety significant component, the NRC's acceptance criteria is based on: (1) 10 CFR 50.55a and draft GDC-1, insofar as they require that SSCs important to safety be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that SSCs important to safety be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; and (4) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects and missiles that might result from plant equipment failures, as well as the effects of a LOCA.
H.3.3 ELECTRICAL ENGINEERING H.3.3.1 Environmental Qualification of Electrical Equipment Environmental qualification (EQ) of electrical equipment demonstrates that the equipment is capable of performing its safety function under significant environmental stresses which could result during and following design-basis accidents (DBAs).
The NRC staffs review focused on the effects of the proposed EPU on the environmental conditions that the electrical equipment will be exposed to during normal operation, anticipated operational occurrences, and accidents. The NRC staffs review was conducted to ensure that the electrical equipment will APPENDIX H H.3-8 REV. 26, APRIL 2017
PBAPS UFSAR continue to be capable of performing its safety functions following implementation of the proposed EPU. The NRCs acceptance criteria for EQ of electrical equipment are based on 10 CFR 50.49, which sets forth requirements for the qualification of electrical equipment important to safety that is located in a harsh environment.
H.3.3.2 Offsite Power System The offsite power system includes two or more physically independent circuits capable of operating independently of the onsite standby power sources. The NRC staffs review covered the descriptive information, analyses, and referenced documents for the offsite power system; and the stability studies for the electrical transmission grid. The NRC staffs review focused on whether the loss of the nuclear unit, the largest operating unit on the grid, or the most critical transmission line will result in the loss of offsite power (LOOP) to the plant following implementation of the proposed EPU. The NRCs acceptance criteria for offsite power systems are based on final GDC-17.
H.3.3.3 Alternating Current Onsite Power System The alternating current (AC) onsite power system includes those standby power sources, distribution systems, and auxiliary supporting systems provided to supply power to safety-related equipment. The NRC staffs review covered the descriptive information, analyses, and referenced documents for the AC onsite power system. The NRCs acceptance criteria for the AC onsite power system are based on final GDC-17, insofar as it requires the system to have the capacity and capability to perform its intended functions during anticipated operational occurrences and accident conditions.
H.3.3.4 Direct Current Onsite Power System The direct current (DC) onsite power system includes the DC power sources and their distribution and auxiliary supporting systems that are provided to supply motive or control power to safety-related equipment. The NRC staffs review covered the information, analyses, and referenced documents for the DC onsite power system. The NRCs acceptance criteria for the DC onsite power system are based on final GDC-17, insofar as it requires the system to have the capacity and capability to perform its intended functions during anticipated operational occurrences and accident conditions.
APPENDIX H H.3-9 REV. 26, APRIL 2017
PBAPS UFSAR H.3.3.5 Station Blackout (SBO)
Station blackout (SBO) refers to a complete loss of AC electric power to the essential and nonessential switchgear buses in a nuclear power plant. SBO involves the LOOP concurrent with a turbine trip and failure of the onsite emergency AC power system.
SBO does not include the loss of available AC power to buses fed by station batteries through inverters or the loss of power from alternate ac sources (AACs). The NRC staffs review focused on the impact of the proposed EPU on the plants ability to cope with and recover from an SBO event for the period of time established in the plants licensing basis. The NRCs acceptance criteria for SBO are based on 10 CFR 50.63.
H.3.4 INSTRUMENTATION AND CONTROLS H.3.4.1 Reactor Protection, Safety Features Actuation, and Control Systems Instrumentation and control systems are provided: (1) to control plant processes having a significant impact on plant safety; (2) to initiate the reactivity control system (including control rods); (3) to initiate the engineered safety features (ESF) systems and essential auxiliary supporting systems; and (4) for use to achieve and maintain a safe shutdown condition of the plant. Diverse instrumentation and control systems and equipment are provided for the express purpose of protecting against potential common-mode failures of instrumentation and control protection systems. The NRC staff conducted a review of the reactor trip system, engineered safety feature actuation system (ESFAS), safe shutdown systems, control systems, and diverse instrumentation and control systems for the proposed EPU to ensure that the systems and any changes necessary for the proposed EPU are adequately designed such that the systems continue to meet their safety functions. The NRC staffs review was also conducted to ensure that failures of the systems do not affect safety functions. The NRCs acceptance criteria related to the quality of design of protection and control systems are based on 10 CFR 50.55a(a)(1), 10 CFR 50.55a(h), final GDC-19 and draft GDCs 1, 12, 13, 14, 15, 19, 20, 22, 23, 25, 26, 40, and 42.
H.3.5 PLANT SYSTEMS H.3.5.1 Internal Hazards H.3.5.1.1 Flooding The NRC staff conducted a review in the area of flood protection to ensure that SSCs important to safety are protected from flooding. The NRC staffs review covered flooding of SSCs APPENDIX H H.3-10 REV. 26, APRIL 2017
PBAPS UFSAR important to safety from internal sources, such as those caused by failures of tanks and vessels. The NRC staffs review focused on increases of fluid volumes in tanks and vessels assumed in flooding analyses to assess the impact of any additional fluid on the flooding protection that is provided. The NRCs acceptance criteria for flood protection are based on draft GDC-2.
H.3.5.1.1.2 Equipment and Floor Drains The function of the equipment and floor drainage system (EFDS) is to assure that waste liquids, valve and pump leak-offs, and tank drains are directed to the proper area for processing or disposal. The EFDS is designed to handle the volume of leakage expected, prevent a backflow of water that might result from maximum flood levels to areas of the plant containing safety-related equipment, and protect against the potential for inadvertent transfer of contaminated fluids to an uncontaminated drainage system. The NRC staffs review of the EFDS included the collection and disposal of liquid effluents outside containment.
The NRC staffs review focused on any changes in fluid volumes or pump capacities that are necessary for the proposed EPU and are not consistent with previous assumptions with respect to floor drainage considerations. The NRCs acceptance criteria for the EFDS are based on draft GDC-2 insofar as it requires the EFDS to be designed to withstand the effects of earthquakes and to be compatible with the environmental conditions (flooding) associated with normal operation, maintenance, testing, and postulated accidents (pipe failures and tank ruptures).
H.3.5.1.1.3 Circulating Water Systems The circulating water system (CWS) provides a continuous supply of cooling water to the main condenser to remove the heat rejected by the turbine cycle and auxiliary systems. The NRC staffs review of the CWS focused on changes in flooding analyses that are necessary due to increases in fluid volumes or installation of larger capacity pumps or piping needed to accommodate the proposed EPU.
H.3.5.1.2 Missile Protection H.3.5.1.2.1 Internally Generated Missiles The NRC staffs review concerns missiles that could result from in-plant component overspeed failures and high-pressure system ruptures. The NRC staffs review of potential missile sources covered pressurized components and systems, and high-speed rotating machinery. The NRC staffs review was conducted to ensure that safety-related SSCs are adequately protected from internally generated missiles. In addition, for cases where APPENDIX H H.3-11 REV. 26, APRIL 2017
PBAPS UFSAR safety-related SSCs are located in areas containing non-safety-related SSCs, the NRC staff reviewed the non-safety-related SSCs to ensure that their failure will not preclude the intended safety function of the safety-related SSCs. The NRC staffs review focused on any increases in system pressures or component overspeed conditions that could result during plant operation, anticipated operational occurrences, or changes in existing system configurations such that missile barrier considerations could be affected. The NRCs acceptance criteria for the protection of SSCs important to safety against the effects of internally generated missiles that may result from equipment failures are based on draft GDC-40.
H.3.5.1.2.2 Turbine Generator The turbine control system, steam inlet stop and control valves, low pressure turbine steam intercept and inlet control valves, and extraction steam control valves control the speed of the turbine under normal and abnormal conditions, and are thus related to the overall safe operation of the plant. The NRC staffs review of the turbine generator focused on the effects of the proposed EPU on the turbine overspeed protection features to ensure that a turbine overspeed condition above the design overspeed is very unlikely. The NRCs acceptance criteria for the turbine generator are based on draft GDC-40 and relates to protection of SSCs important to safety from the effects of turbine missiles by providing a turbine overspeed protection system (with suitable redundancy) to minimize the probability of generating turbine missiles.
H.3.5.1.3 Pipe Failures The NRC staff conducted a review of the plant design for protection from piping failures outside containment to ensure that: (1) such failures would not cause the loss of needed functions of safety-related systems; and (2) the plant could be safely shut down in the event of such failures. The NRC staffs review of pipe failures included high and moderate energy fluid system piping located outside of containment. The NRC staffs review focused on the effects of pipe failures on plant environmental conditions, control room habitability, and access to areas important to safe control of post-accident operations where the consequences are not bounded by previous analyses. The NRCs acceptance criteria for pipe failures are based on draft GDC-40, insofar as it requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures.
APPENDIX H H.3-12 REV. 26, APRIL 2017
PBAPS UFSAR H.3.5.1.4 Fire Protection The purpose of the fire protection program (FPP) is to provide assurance, through a defense-in-depth design, that a fire will not prevent the performance of necessary safe plant shutdown functions and will not significantly increase the risk of radioactive releases to the environment. The NRC staffs review focused on the effects of the increased decay heat on the plants safe shutdown analysis to ensure that SSCs required for the safe shutdown of the plant are protected from the effects of the fire and will continue to be able to achieve and maintain safe shutdown following a fire. The NRCs acceptance criteria for the FPP are based on: (1) 10 CFR 50.48 and associated Appendix R to 10 CFR Part 50, insofar as they require the development of an FPP to ensure, among other things, the capability to safely shut down the plant; (2) final GDC-3, insofar as it requires that (a) SSCs important to safety be designed and located to minimize the probability and effect of fires, (b) noncombustible and heat resistant materials be used, and (c) fire detection and fighting systems be provided and designed to minimize the adverse effects of fires on SSCs important to safety; and (3) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
H.3.5.2 Fission Product Control H.3.5.2.1 Fission Product Control Systems and Structures The NRC staffs review for fission product control systems and structures covered the basis for developing the mathematical model for DBLOCA dose computations, the values of key parameters, the applicability of important modeling assumptions, and the functional capability of ventilation systems used to control fission product releases. The NRC staffs review primarily focused on any adverse effects that the proposed EPU may have on the assumptions used in the analyses for control of fission products. The NRCs acceptance criteria are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.5.2.2 Main Condenser Evacuation System The main condenser evacuation system (MCES) generally consists of two subsystems: (1) the "hogging" or startup system which initially establishes main condenser vacuum; and (2) the system which maintains condenser vacuum once it has been established.
The NRC staffs review focused on modifications to the system that may affect gaseous radioactive material handling and release assumptions, and design features to preclude the possibility of APPENDIX H H.3-13 REV. 26, APRIL 2017
PBAPS UFSAR an explosion (if the potential for explosive mixtures exists).
The NRCs acceptance criteria for the MCES are based on:
(1) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (2) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences and postulated accidents.
H.3.5.2.3 Turbine Gland Sealing System The turbine gland sealing system is provided to control the release of radioactive material from steam in the turbine to the environment. The NRC staff reviewed changes to the turbine gland sealing system with respect to factors that may affect gaseous radioactive material handling (e.g., source of sealing steam, system interfaces, and potential leakage paths). The NRCs acceptance criteria for the turbine gland sealing system are based on: (1) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (2) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences and postulated accidents.
H.3.5.3 Component Cooling and Decay Heat Removal H.3.5.3.1 Spent Fuel Pool Cooling and Cleanup System The spent fuel pool (SFP) provides wet storage of spent fuel assemblies. The safety function of the spent fuel pool cooling and cleanup system is to cool the spent fuel assemblies and keep the spent fuel assemblies covered with water during all storage conditions. The NRC staffs review for the proposed EPU focused on the effects of the proposed EPU on the capability of the system to provide adequate cooling to the spent fuel during all operating and accident conditions. The NRCs acceptance criteria for the spent fuel pool cooling and cleanup system are based on:
(1) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown that safety is not impaired by the sharing; (2) draft GDC-67, insofar that reliable decay heat removal systems are necessary to prevent damage to stored spent fuel; and (3) final GDC-61, insofar as it requires that fuel storage systems be designed with RHR capability reflecting the importance to safety of decay heat removal, and measures to prevent a significant loss of fuel storage coolant inventory under accident conditions.
APPENDIX H H.3-14 REV. 26, APRIL 2017
PBAPS UFSAR H.3.5.3.2 Station Service Water Systems The station service water system (SWS) provides essential cooling to safety-related equipment and may also provide cooling to non-safety-related auxiliary components that are used for normal plant operation. The SWS includes the emergency service water (ESW) and HPSW systems. The NRC staffs review covered the characteristics of the station SWS (i.e., ESW and HPSW systems) components with respect to their functional performance as affected by adverse operational (i.e., water hammer) conditions, abnormal operational conditions, and accident conditions (e.g., a LOCA with the LOOP). The NRC staffs review focused on the additional heat load that would result from the proposed EPU.
The NRCs acceptance criteria are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-41, insofar that the SWS is relied upon by engineered safety features for performing their safety functions; and (3) draft GDC-52, insofar that the SWS is relied upon by containment heat removal systems for performing their safety functions; and (4) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
H.3.5.3.3 Reactor Auxiliary Cooling Water Systems The NRC staffs review covered reactor auxiliary cooling water systems that are required for: (1) safe shutdown during normal operations, anticipated operational occurrences, and mitigating the consequences of accident conditions; or (2) preventing the occurrence of an accident. These systems include closed-loop auxiliary cooling water systems for reactor system components, reactor shutdown equipment, ventilation equipment, and components of the ECCS. The NRC staffs review covered the capability of the auxiliary cooling water systems to provide adequate cooling water to safety-related ECCS components and reactor auxiliary equipment for all planned operating conditions. Emphasis was placed on the cooling water systems for safety-related components (e.g., ECCS equipment, ventilation equipment, and reactor shutdown equipment). The NRC staffs review focused on the additional heat load that would result from the proposed EPU.
The NRCs acceptance criteria for the reactor auxiliary cooling water system are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; and (3) draft GDC-41, insofar that the Reactor Auxiliary Cooling Water Systems APPENDIX H H.3-15 REV. 26, APRIL 2017
PBAPS UFSAR are relied upon by engineered safety features for performing their safety functions.
H.3.5.3.4 Ultimate Heat Sink The ultimate heat sink (UHS) is the source of cooling water provided to dissipate reactor decay heat and essential cooling system heat loads after a normal reactor shutdown or a shutdown following an accident. The NRC staffs review focused on the impact that the proposed EPU has on the decay heat removal capability of the UHS. Additionally, the NRC staffs review included evaluation of the design-basis UHS temperature limit determination to confirm that post-licensing data trends (e.g.,
air and water temperatures, humidity, wind speed, water volume) do not establish more severe conditions than previously assumed.
The NRCs acceptance criteria for the UHS are based on: (1) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; (2) draft GDC-41, insofar that the UHS is relied upon by engineered safety features for performing their safety functions; and (3) draft GDC-52, insofar that the UHS is relied upon by containment heat removal systems for performing their safety functions.
H.3.5.4 Balance-of-Plant Systems H.3.5.4.1 Main Steam The main steam supply system (MSSS) transports steam from the NSSS to the power conversion system and various safety-related and non-safety-related auxiliaries. The NRC staffs review focused on the effects of the proposed EPU on the systems capability to transport steam to the power conversion system, provide heat sink capacity, supply steam to drive safety system pumps, and withstand adverse dynamic loads (e.g., water steam hammer resulting from rapid valve closure and relief valve fluid discharge loads). The NRCs acceptance criteria for the MSSS are based on: (1) draft GDC-40 insofar as it requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
H.3.5.4.2 Main Condenser The main condenser (MC) system is designed to condense and de-aerate the exhaust steam from the main turbine and provide a heat sink for the turbine bypass system (TBS). For BWRs without a main steam isolation valve (MSIV) leakage control system, the MC APPENDIX H H.3-16 REV. 26, APRIL 2017
PBAPS UFSAR system may also serve an accident mitigation function to act as a holdup volume for the plate out of fission products leaking through the MSIVs following core damage. The NRC staffs review focused on the effects of the proposed EPU on the steam bypass capability with respect to load rejection assumptions, and on the ability of the MC system to withstand the blowdown effects of steam from the TBS. The NRCs acceptance criteria for the MC system are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.5.4.3 Turbine Bypass The TBS is designed to discharge a stated percentage of rated main steam flow directly to the MC system, bypassing the turbine.
This steam bypass enables the plant to take step-load reductions up to the TBS capacity without the reactor or turbine tripping.
The system is also used during startup and shutdown to control reactor pressure. For a BWR without an MSIV leakage control system, the TBS could also provide an accident mitigation function. A TBS, along with the MSSS and MC system, may be credited for mitigating the effects of MSIV leakage during a LOCA by the holdup and plate out of fission products. The NRC staffs review for the TBS focused on the effects that the proposed EPU have on load rejection capability, analysis of postulated system piping failures, and the consequences of inadvertent TBS operation. The NRCs acceptance criteria for the TBS are based on draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA.
H.3.5.4.4 Condensate and Feedwater The condensate and feedwater system (CFS) provides feedwater at a particular temperature, pressure, and flow rate to the reactor.
The only part of the CFS classified as safety-related is the feedwater piping from the NSSS up to and including the outermost containment isolation valve. The NRC staffs review focused on how the proposed EPU affects previous analyses and considerations with respect to the capability of the CFS to supply adequate feedwater during plant operation and shutdown, and isolate components, subsystems, and piping in order to preserve the systems safety function. The NRCs acceptance criteria for the CFS are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
APPENDIX H H.3-17 REV. 26, APRIL 2017
PBAPS UFSAR H.3.5.5 Waste Management Systems H.3.5.5.1 Gaseous Waste Management System The gaseous waste management system (GWMS) involves the gaseous radwaste system, which deals with the management of radioactive gases collected in the offgas system or the waste gas storage and decay tanks. In addition, it involves the management of the condenser air removal system; the gland seal exhaust and the mechanical vacuum pump operation exhaust; and the building ventilation system exhausts. The NRC staffs review focused on the effects that the proposed EPU may have on: (1) the design criteria of the GWMS; (2) methods of treatment; (3) expected releases; (4) principal parameters used in calculating the releases of radioactive materials in gaseous effluents; and (5) design features for precluding the possibility of an explosion if the potential for explosive mixtures exists. The NRCs acceptance criteria for the GWMS are based on (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the boundary of the unrestricted area do not exceed specified values; (2) final GDC-3, insofar as it requires that (a) SSCs important to safety be designed and located to minimize the probability and effect of fires, (b) noncombustible and heat resistant materials be used, and (c) fire detection and fighting systems be provided and designed to minimize the adverse effects of fires on SSCs important to safety; (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; (4) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement; and (5) 10 CFR Part 50, Appendix I, Sections II.B, II.C, and II.D, which set numerical guides for design objectives and limiting conditions for operation to meet the as low as is reasonably achievable (ALARA) criterion.
H.3.5.5.2 Liquid Waste Management System The NRC staffs review for liquid waste management system (LWMS) focused on the effects that the proposed EPU may have on previous analyses and considerations related to the system design, design objectives, design criteria, methods of treatment, expected releases, and principal parameters used in calculating the releases of radioactive materials in liquid effluents. The NRCs acceptance criteria for the LWMS are based on: (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the boundary of the unrestricted area do not exceed specified values; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; APPENDIX H H.3-18 REV. 26, APRIL 2017
PBAPS UFSAR (3) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement; and (4) 10 CFR Part 50, Appendix I, Sections II.A and II.D, which set numerical guides for dose design objectives and limiting conditions for operation to meet the ALARA criterion.
H.3.5.5.3 Solid Waste Management System The NRC staffs review for the solid waste management system (SWMS) focused on the effects that the proposed EPU may have on previous analyses and considerations related to the design objectives in terms of expected volumes of waste to be processed and handled, the wet and dry types of waste to be processed, the activity and expected radionuclide distribution contained in the waste, equipment design capacities, and the principal parameters employed in the design of the SWMS. The NRCs acceptance criteria for the SWMS are based on: (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the boundary of the unrestricted area do not exceed specified values; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; (3) final GDC-63, insofar as it requires that systems be provided in waste handling areas to detect conditions that may result in excessive radiation levels, (4) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences (AOOs), and postulated accidents; and (5) 10 CFR Part 71, which states requirements for radioactive material packaging.
H.3.5.6 Additional Considerations H.3.5.6.1 Emergency Diesel Engine Fuel Oil Storage and Transfer System Nuclear power plants are required to have redundant onsite emergency power supplies of sufficient capacity to perform their safety functions (e.g., power diesel engine-driven generator sets), assuming a single failure. The NRC staffs review focused on increases in emergency diesel generator electrical demand and the resulting increase in the amount of fuel oil necessary for the system to perform its safety function. The NRCs acceptance criteria for the emergency diesel engine fuel oil storage and transfer system are based on: (1) draft GDC-40, insofar as it requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired APPENDIX H H.3-19 REV. 26, APRIL 2017
PBAPS UFSAR by the sharing; and (3) final GDC-17, insofar as it requires onsite power supplies to have sufficient independence and redundancy to perform their safety functions, assuming a single failure.
H.3.5.6.2 Light Load Handling System (Related to Refueling)
The light-load handling system (LLHS) includes components and equipment used in handling new fuel at the receiving station and the loading of spent fuel into shipping casks. The NRC staffs review covered the avoidance of criticality accidents, radioactivity releases resulting from damage to irradiated fuel, and unacceptable personnel radiation exposures. The NRC staffs review focused on the effects of the new fuel on system performance and related analyses. The NRCs acceptance criteria for the LLHS are based on: (1) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement and with suitable shielding for radiation protection; and (2) final GDC-62, insofar as it requires that criticality be prevented.
H.3.6 CONTAINMENT REVIEW CONSIDERATIONS H.3.6.1 Primary Containment Functional Design The containment encloses the reactor system and is the final barrier against the release of significant amounts of radioactive fission products in the event of an accident. The NRC staffs review for the primary containment functional design covered:
(1) the temperature and pressure conditions in the drywell and wetwell due to a spectrum of postulated LOCAs; (2) the differential pressure across the operating deck for a spectrum of LOCAs (Mark II containments only); (3) suppression pool dynamic effects during a LOCA or following the actuation of one or more RCS safety/relief valves; (4) the consequences of a LOCA occurring within the containment (wetwell); (5) the capability of the containment to withstand the effects of steam bypassing the suppression pool; (6) the suppression pool temperature limit during RCS safety/relief valve operation; and (7) the analytical models used for containment analysis. The NRCs acceptance criteria for the primary containment functional design are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-10, insofar as it requires that reactor containment be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other engineered safety features as may be necessary, to retain functional capability for as long as the situation requires; APPENDIX H H.3-20 REV. 26, APRIL 2017
PBAPS UFSAR (3) draft GDC-49, insofar as it requires that the containment and its associated heat removal systems be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA, including considerable margin for effects from metal-water or other chemical reactions that could occur as a consequence of failure of emergency core cooling systems; (4) draft GDC-12, insofar as it requires that instrumentation and controls be provided as required to monitor and maintain variables within prescribed operating ranges; and (5) final GDC-64, insofar as it requires that means be provided to monitor the reactor containment atmosphere for radioactivity that may be released from normal operations and from postulated accidents.
H.3.6.2 Sub-compartment Analysis A sub-compartment is defined as any fully or partially enclosed volume within the primary containment that houses high-energy piping and would limit the flow of fluid to the main containment volume in the event of a postulated pipe rupture within the volume. The NRC staffs review for sub-compartment analyses covered the determination of the design differential pressure values for containment sub-compartments. The NRC staffs review focused on the effects of the increase in mass and energy release into the containment due to operation at EPU conditions, and the resulting increase in pressurization. The NRCs acceptance criteria for sub-compartment analyses are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-49, insofar as it requires that the containment be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA.
H.3.6.3 Mass and Energy Release Analysis for LOCA The release of high-energy fluid into containment from pipe breaks could challenge the structural integrity of the containment, including sub-compartments and systems within the containment. The NRC staffs review covered the energy sources that are available for release to the containment and the mass and energy (M&E) release rate calculations for the initial blowdown phase of the accident. The NRCs acceptance criteria for mass and energy release analyses for postulated LOCAs are based on: (1) draft GDC-49, insofar as it requires that the containment and its associated heat removal systems be designed so that the containment structure can accommodate, without APPENDIX H H.3-21 REV. 26, APRIL 2017
PBAPS UFSAR exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA; and (2) 10 CFR Part 50, Appendix K, insofar as it identifies sources of energy during a LOCA.
H.3.6.4 Combustible Gas Control in Containment Following a LOCA, hydrogen and oxygen may accumulate inside the containment due to chemical reactions between the fuel rod cladding and steam, corrosion of aluminum and other materials, and radiolytic decomposition of water. If excessive hydrogen is generated, it may form a combustible mixture in the containment atmosphere. The NRC staffs review covered: (1) the production and accumulation of combustible gases; (2) the capability to prevent high concentrations of combustible gases in local areas; (3) the capability to monitor combustible gas concentrations; and (4) the capability to reduce combustible gas concentrations. The NRC staffs review primarily focused on any impact that the proposed EPU may have on hydrogen release assumptions, and how increases in hydrogen release are mitigated. The NRCs acceptance criteria for combustible gas control in containment are based on: (1) 10 CFR 50.44, insofar as it requires that plants be provided with the capability for controlling combustible gas concentrations in the containment atmosphere; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
H.3.6.5 Containment Heat Removal Fan cooler systems, spray systems, and residual heat removal (RHR) systems are provided to remove heat from the containment atmosphere and from the water in the containment wetwell. The NRC staffs review in this area focused on: (1) the effects of the proposed EPU on the analyses of the available net positive suction head (NPSH) to the containment heat removal system pumps; and (2) the analyses of the heat removal capabilities of the spray water system and the fan cooler heat exchangers. The NRCs acceptance criteria for containment heat removal are based on draft GDCs 41 and 52, insofar as they require that a containment heat removal system be provided, and that its function shall be to prevent exceeding containment design pressure under accident conditions.
H.3.6.6 Secondary Containment Functional Design The secondary containment structure and supporting systems of dual containment plants are provided to collect and process radioactive material that may leak from the primary containment following an accident. The supporting systems maintain a APPENDIX H H.3-22 REV. 26, APRIL 2017
PBAPS UFSAR negative pressure within the secondary containment and process this leakage. The NRC staffs review covered: (1) analyses of the pressure and temperature response of the secondary containment following accidents within the primary and secondary containments; (2) analyses of the effects of openings in the secondary containment on the capability of the depressurization and filtration system to establish a negative pressure in a prescribed time; (3) analyses of any primary containment leakage paths that bypass the secondary containment; (4) analyses of the pressure response of the secondary containment resulting from inadvertent depressurization of the primary containment when there is vacuum relief from the secondary containment; and (5) the acceptability of the mass and energy release data used in the analysis. The NRC staffs review primarily focused on the effects that the proposed EPU may have on the pressure and temperature response and drawdown time of the secondary containment, and the impact this may have on offsite dose. The NRCs acceptance criteria for secondary containment functional design are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-10, insofar as it requires that reactor containment be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other ESFs as may be necessary, to retain functional capability for as long as the situation requires.
H.3.6.7 Containment Review Considerations H.3.6.7.1 Containment Isolation The NRC staff acceptance criteria for the containment isolation are based on draft GDC-49, insofar as it requires that the containment be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA.
H.3.6.7.2 Generic Letter 89-13 NRC GL 89-13, Service Water System Problems Affecting Safety-Related Equipment requested licensees to establish a routine inspection and maintenance program to ensure that corrosion, erosion, protective coating failure, silting, and biofouling/tube plugging cannot degrade the performance of the safety-related systems supplied by service water. These issues relate to the evaluation of safety-related HXs using service water and whether they have the potential for fouling, thereby causing degradation in performance, and the mandate that there exist a permanent APPENDIX H H.3-23 REV. 26, APRIL 2017
PBAPS UFSAR plant test and inspection program to accomplish and maintain this evaluation.
H.3.6.7.3 Generic Letter 89-16 Generic Letter 89-16, Installation of a Hardened Wetwell Vent discusses the advantages of installing a hardened containment (wetwell) vent and requested information from licensees on installation of such a vent. This was a result of the NRCs BWR Mark I Containment Performance Improvement Program.
H.3.6.7.4 Generic Letter 96-06 NRC GL 96-06, Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions identifies the following potential problems with equipment operability and containment integrity during DBA conditions: (1) cooling water systems serving the containment air coolers may be exposed to water hammer during postulated accident conditions; (2) cooling water systems serving the containment air coolers may experience two-phase flow conditions during postulated accident conditions; and (3) thermally induced overpressurization of isolated water-filled piping sections in containment could jeopardize the ability of accident-mitigating systems to perform their safety functions and could also lead to a breach of containment integrity via bypass leakage. GL 96-06 questioned whether the higher heat loads at accident conditions could potentially cause steam bubbles, water hammer, and two-phase flow due to the higher outlet temperatures from cooled components, particularly the containment fan coolers.
H.3.7 HABITABILITY, FILTRATION AND VENTILATION H.3.7.1 Control Room Habitability System The NRC staff reviewed the control room habitability system and control building layout and structures to ensure that plant operators are adequately protected from the effects of accidental releases of toxic and radioactive gases. A further objective of the NRC staffs review was to ensure that the control room can be maintained as the backup center from which technical support center personnel can safely operate in the case of an accident.
The NRC staffs review focused on the effects of the proposed EPU on radiation doses, toxic gas concentrations, and estimates of dispersion of airborne contamination. The NRCs acceptance criteria for the control room habitability system are based on:
(1) final GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with postulated accidents, including the effects of the release of APPENDIX H H.3-24 REV. 26, APRIL 2017
PBAPS UFSAR toxic gases; and (2) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident.
H.3.7.2 Engineered Safety Feature Atmospheric Cleanup Engineered safety feature (ESF) atmosphere cleanup systems are designed for fission product removal in post-accident environments. These systems generally include primary systems (e.g., in-containment recirculation) and secondary systems (e.g., standby gas treatment systems and emergency or post-accident air-cleaning systems) for the fuel-handling building, control room, shield building, and areas containing ESF components. For each ESF atmosphere cleanup system, the NRC staffs review focused on the effects of the proposed EPU on system functional design, environmental design, and provisions to preclude temperatures in the adsorber section from exceeding design limits. The NRCs acceptance criteria for ESF atmosphere cleanup systems are based on: (1) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident; (2) draft GDC-69, insofar as it requires that systems that may contain radioactivity be designed to assure adequate safety under normal and postulated accident conditions; and (3) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including AOOs, and postulated accidents.
H.3.7.3 Control Room Area Heating, Ventilation and Air Conditioning System The function of the control room area heating, ventilation and air conditioning (HVAC) system is to provide a controlled environment for the comfort and safety of control room personnel and to support the operability of control room components during normal operation, AOOs, and DBA conditions. The NRCs review of the control room area HVAC system focused on the effects that the proposed EPU will have on the functional performance of safety-related portions of the system. The review included the effects of radiation, combustion, and other toxic products; and the expected environmental conditions in areas served by the system.
The NRCs acceptance criteria for the control room area HVAC system are based on: (1) final GDC-4, insofar as it requires APPENDIX H H.3-25 REV. 26, APRIL 2017
PBAPS UFSAR that SSCs important to safety be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; (2) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident; and (3) final GDC-60 , insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.7.4 Spent Fuel Pool Area Ventilation System The PBAPS design does not contain a separate spent fuel pool area ventilation system. Ventilation in this area is provided by the reactor building HVAC system under normal conditions. The SGTS provides ventilation in this area during accident conditions.
The reactor building HVAC system is evaluated in Section H.3.7.5.
The SGTS is evaluated in Sections H.3.5.2.1 and H.3.6.6.
H.3.7.5 Reactor, Turbine, Drywell and Radwaste Area Ventilation Systems The function of the reactor building, turbine building, drywell and radwaste building HVAC systems is to maintain ventilation in the reactor, turbine, drywell, and radwaste buildings to permit personnel access, and control the concentration of airborne radioactive material in these areas during normal operation, during AOOs, and after postulated accidents. The NRC staffs review focused on the effects of the proposed EPU on the functional performance of the safety-related portions of these systems. The NRCs acceptance criteria for the systems are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.7.6 Engineered Safety Feature Heating, Ventilation and Air Conditioning Systems The function of the ESF HVAC system is to provide a suitable and controlled environment for ESF components following certain anticipated transients and DBAs. The NRC staffs review for the ESF HVAC systems focused on the effects of the proposed EPU on the functional performance of the safety-related portions of the system. The NRC staffs review also covered: (1) the ability of the ESF equipment in the areas being serviced by the ventilation system to function under degraded system performance; (2) the capability of the systems to circulate sufficient air to prevent accumulation of flammable or explosive gas or fuel-vapor mixtures from components (e.g., storage batteries and stored fuel); and APPENDIX H H.3-26 REV. 26, APRIL 2017
PBAPS UFSAR (3) the capability of the systems to control airborne particulate material (dust) accumulation. The NRCs acceptance criteria for the ESF HVAC systems are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) final GDC-17, insofar as it requires onsite and offsite electric power systems be provided to permit functioning of SSCs important to safety; and (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.8 REACTOR SYSTEMS H.3.8.1 Fuel System Design The fuel system consists of arrays of fuel rods, burnable poison rods, spacer grids and springs, end plates, channel boxes, and reactivity control rods. The NRC staff reviewed the fuel system to ensure that: (1) the fuel system is not damaged as a result of normal operation and AOOs; (2) fuel system damage is never so severe as to prevent control rod insertion when it is required; (3) the number of fuel rod failures is not underestimated for postulated accidents; and (4) coolability is always maintained.
The NRC staffs review covered fuel system damage mechanisms, limiting values for important parameters, and performance of the fuel system during normal operation, AOOs, and postulated accidents. The NRCs acceptance criteria are based on: (1) 10 CFR 50.46, insofar as it establishes standards for the calculation of ECCS performance and acceptance criteria for that calculated performance; (2) final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of AOOs; and (3) draft GDCs 37, 41, and 44, insofar as they require that a system to provide abundant emergency core cooling be provided to prevent fuel damage following a LOCA.
H.3.8.2 Nuclear Design The NRC staff reviewed the nuclear design of the fuel assemblies, control systems, and reactor core to ensure that fuel design limits will not be exceeded during normal operation and anticipated operational transients, and that the effects of postulated reactivity accidents will not cause significant damage to the RCPB or impair the capability to cool the core. The NRC staff's review covered core power distribution, reactivity coefficients, reactivity control requirements and control provisions, control rod patterns and reactivity worths, criticality, burnup, and vessel irradiation. The NRCs APPENDIX H H.3-27 REV. 26, APRIL 2017
PBAPS UFSAR acceptance criteria are based on: (1) final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs; (2) draft GDC-8, insofar as it requires that the reactor core be designed so that the overall power coefficient in the power operating range shall not be positive; (3) final GDC-12, insofar as it requires that the reactor core be designed to assure that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can be reliably and readily detected and suppressed; (4) draft GDCs 12 and 13, insofar as they require that instrumentation and controls be provided, as required, to monitor and maintain variables within prescribed operating ranges through the core life; (5) draft GDCs 14 and 15, insofar as they require that the protection system be designed to initiate the reactivity control systems automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and to initiate operation of ESFs under accident situations; (6) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits; (7) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (8) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; and (9) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the reactor coolant pressure boundary; or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.
H.3.8.3 Thermal and Hydraulic Design The NRC staff reviewed the thermal and hydraulic design of the core and the RCS to confirm that the design: (1) has been accomplished using acceptable analytical methods; (2) is equivalent to or a justified extrapolation from proven designs; (3) provides acceptable margins of safety from conditions which would lead to fuel damage during normal reactor operation and AOOs; and (4) is not susceptible to thermal-hydraulic instability. The NRCs acceptance criteria are based on: (1)
APPENDIX H H.3-28 REV. 26, APRIL 2017
PBAPS UFSAR final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs; and (2) final GDC-12, insofar as it requires that the reactor core and associated coolant, control, and protection systems be designed to assure that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can reliably and readily be detected and suppressed.
H.3.8.4 Emergency Systems H.3.8.4.1 Functional Design of Control Rod Drive System The NRC staffs review covered the functional performance of the control rod drive (CRD) system to confirm that the system can affect a safe shutdown, respond within acceptable limits during AOOs, and prevent or mitigate the consequences of postulated accidents. The review also covered the CRD cooling system to ensure that it will continue to meet its design requirements.
The NRCs acceptance criteria are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-26, insofar as it requires that the protection system be designed to fail into a safe state; (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits; (4) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (5) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (6) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the reactor coolant pressure boundary; or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling; and (7) 10 CFR 50.62(c)(3), insofar as it requires that all BWRs have an alternate rod injection (ARI) system diverse from the reactor trip system, and that the ARI system have redundant scram air header exhaust valves.
APPENDIX H H.3-29 REV. 26, APRIL 2017
PBAPS UFSAR H.3.8.4.2 Overpressure Protection During Power Operations Overpressure protection for the RCPB during power operation is provided by relief and safety valves and the reactor protection system. The NRC staffs review covered relief and safety valves on the main steamlines and piping from these valves to the suppression pool. The NRCs acceptance criteria are based on:
(1) draft GDC-9, insofar as it requires that the RCPB be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime; and (2) final GDC-31, insofar as it requires that the RCPB be designed with sufficient margin to assure that it behaves in a non-brittle manner and that the probability of rapidly propagating fracture is minimized.
H.3.8.4.3 Reactor Core Isolation Cooling System The reactor core isolation cooling (RCIC) system serves as a standby source of cooling water to provide a limited decay heat removal capability whenever the main feedwater system is isolated from the reactor vessel. In addition, the RCIC system may provide decay heat removal necessary for coping with a station blackout (SBO). The water supply for the RCIC system comes from the condensate storage tank, with a secondary supply from the suppression pool. The NRC staff's review covered the effect of the proposed EPU on the functional capability of the system. The NRCs acceptance criteria are based on: (1) draft GDC-40, insofar as it requires that protection be provided for ESFs against dynamic effects; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; (3) draft GDC-37, insofar as it requires that ESFs be provided to back up the safety provided by the core design, the RCPB, and their protective systems; (4) draft GDCs 51 and 57, insofar as they require that piping systems penetrating containment be designed with appropriate features as necessary to protect from an accidental rupture outside containment and the capability to periodically test the operability of the isolation valves to determine if valve leakage is within acceptable limits; and (5) 10 CFR 50.63, insofar as it requires that the plant withstand and recover from an SBO of a specified duration.
H.3.8.4.4 Residual Heat Removal System The RHR system is used to cool down the RCS following shutdown.
The RHR system is typically a low pressure system which takes over the shutdown cooling function when the RCS temperature is reduced. The NRC staff's review covered the effect of the proposed EPU on the functional capability of the RHR system to cool the RCS following shutdown and provide decay heat removal.
APPENDIX H H.3-30 REV. 26, APRIL 2017
PBAPS UFSAR The NRCs acceptance criteria are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against dynamic effects; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.
H.3.8.4.5 Standby Liquid Control System The standby liquid control (SLC) system provides backup capability for reactivity control independent of the control rod system. The SLC system functions by injecting a boron solution into the reactor to effect shutdown. The NRC staffs review covered the effect of the proposed EPU on the functional capability of the system to deliver the required amount of boron solution into the reactor. The NRCs acceptance criteria are based on: (1) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (2) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; and (3) 10 CFR 50.62(c)(4), insofar as it requires that the SLC system be capable of reliably injecting a borated water solution into the reactor pressure vessel at a boron concentration, boron enrichment, and flow rate that provides a set level of reactivity control.
H.3.8.5 Accident and Transient Analyses H.3.8.5.1 Decrease on Feedwater Temperature, Incr4ease in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Main Steam or Safety Valve Excessive heat removal causes a decrease in moderator temperature, which increases core reactivity and can lead to a power level increase and a decrease in shutdown margin. Any unplanned power level increase may result in fuel damage or excessive reactor system pressure. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) postulated initial core and reactor conditions; (2) methods of thermal and hydraulic analyses; (3) the sequence of events; (4) assumed reactions of reactor system components; (5) functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design APPENDIX H H.3-31 REV. 26, APRIL 2017
PBAPS UFSAR lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection system be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-29, insofar as they require that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.2 Decrease in Heat Removal by the Secondary System A number of initiating events may result in unplanned decreases in heat removal by the secondary system. These events result in a sudden reduction in steam flow and, consequently, result in pressurization events. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staffs review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29 insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.2.1 Loss of External Load; Turbine Trip; Loss of Condenser Vacuum; Closure of Main Steam Isolation Valve; and Steam Pressure Regulator Failure (Closed)
A number of initiating events may result in unplanned decreases in heat removal by the secondary system. These events result in a sudden reduction in steam flow and, consequently, result in pressurization events. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staffs review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29 insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.2.2 Loss of Non-Emergency AC Power to the Station Auxiliaries APPENDIX H H.3-32 REV. 26, APRIL 2017
PBAPS UFSAR The loss of non-emergency AC power is assumed to result in the loss of all power to the station auxiliaries and the simultaneous tripping of all reactor coolant circulation pumps. This causes a flow coastdown, as well as a decrease in heat removal by the secondary system, a turbine trip, an increase in pressure and temperature of the coolant, and a reactor trip. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.2.3 Loss of Normal Feedwater Flow A loss of normal feedwater flow could occur from pump failures, valve malfunctions, or a LOOP. Loss of feedwater flow results in an increase in reactor coolant temperature and pressure, which eventually requires a reactor trip to prevent fuel damage. Decay heat must be transferred from fuel following a loss of normal feedwater flow. Reactor protection and safety systems are actuated to provide this function and mitigate other aspects of the transient. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.3 Decrease in Reactor Coolant System Flow H.3.8.5.3.1 Loss of Forced Reactor Coolant Flow A decrease in reactor coolant flow occurring while the plant is at power could result in a degradation of core heat transfer. An increase in fuel temperature and accompanying fuel damage could then result if SAFDLs are exceeded during the transient. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the postulated initial core and reactor conditions; (2) the methods of thermal and hydraulic analyses; (3) the sequence of events; (4) assumed APPENDIX H H.3-33 REV. 26, APRIL 2017
PBAPS UFSAR reactions of reactor systems components; (5) the functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses.
The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.3.2 Reactor Recirculation Pump Rotor Seizure and Reactor Recirculation Pump Shaft Break The events postulated are an instantaneous seizure of the rotor or break of the shaft of a reactor recirculation pump. Flow through the affected loop is rapidly reduced, leading to a reactor and turbine trip. The sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer, which could result in fuel damage. The initial rate of reduction of coolant flow is greater for the rotor seizure event. However, the shaft break event permits a greater reverse flow through the affected loop later during the transient and, therefore, results in a lower core flow rate at that time. In either case, reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the postulated initial and long-term core and reactor conditions; (2) the methods of thermal and hydraulic analyses; (3) the sequence of events; (4) the assumed reactions of reactor system components; (5) the functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling; and (2) draft GDCs 33, 34, and 35, insofar as they require that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of rapidly propagating fractures is minimized.
APPENDIX H H.3-34 REV. 26, APRIL 2017
PBAPS UFSAR H.3.8.5.4 Reactivity and Power Distribution Anomalies H.3.8.5.4.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical of Low Power Startup Condition An uncontrolled control rod assembly withdrawal from subcritical or low power startup conditions may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion. The NRC staff's review covered:
(1) the description of the causes of the transient and the transient itself; (2) the initial conditions; (3) the values of reactor parameters used in the analysis; (4) the analytical methods and computer codes used; and (5) the results of the transient analyses. The NRCs acceptance criteria are based on:
(1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits.
H.3.8.5.4.2 Uncontrolled Control Rod Assembly Withdrawal at Power An uncontrolled control rod assembly withdrawal at power may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion.
The NRC staff's review covered: (1) the description of the causes of the AOO and the description of the event itself; (2) the initial conditions; (3) the values of reactor parameters used in the analysis; (4) the analytical methods and computer codes used; and (5) the results of the associated analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of APPENDIX H H.3-35 REV. 26, APRIL 2017
PBAPS UFSAR sustaining any single malfunction without causing a reactivity transient which could result in exceeding acceptable fuel damage limits.
H.3.8.5.4.3 Startup of a Recirculation Loop at an Incorrect Temperature and Flow Controller Malfunction Causing an Increase in Core Flow Rate A startup of an inactive loop transient may result in either an increased core flow or the introduction of cooler water into the core. This event causes an increase in core reactivity due to decreased moderator temperature and core void fraction. The NRC staffs review covered: (1) the sequence of events; (2) the analytical model; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses.
The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; (3) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling; and (4) draft GDC-29, insofar as it requires that at least one of the reactivity control systems be capable of making the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits.
H.3.8.5.4.4 Spectrum of Rod Drop Accidents The NRC staff evaluated the consequences of a control rod drop accident in the area of reactor physics. The NRC staffs review covered the occurrences that lead to the accident, safety features designed to limit the amount of reactivity available and the rate at which reactivity can be added to the core, the analytical model used for analyses, and the results of the analyses. The NRCs acceptance criteria are based on draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or APPENDIX H H.3-36 REV. 26, APRIL 2017
PBAPS UFSAR large change of reactivity cannot (a) rupture the reactor coolant pressure boundary, or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.
H.3.8.5.5 Inadvertent Operation of ECCS or Malfunction that Increases Reactor Coolant Inventory Equipment malfunctions, operator errors, and abnormal occurrences could cause unplanned increases in reactor coolant inventory.
Depending on the temperature of the injected water and the response of the automatic control systems, a power level increase may result and, without adequate controls, could lead to fuel damage or overpressurization of the RCS. Alternatively, a power level decrease and depressurization may result. Reactor protection and safety systems are actuated to mitigate these events. The NRC staffs review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC 29, insofar as it requires that at least one of the reactivity control systems be capable of making the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits.
H.3.8.5.6 Decrease in Reactor Coolant Inventory H.3.8.5.6.1 Inadvertent Opening of a Pressure Relief Valve The inadvertent opening of a pressure relief valve results in a reactor coolant inventory decrease and a decrease in RCS pressure. The pressure relief valve discharges into the suppression pool. Normally there is no reactor trip. The pressure regulator senses the RCS pressure decrease and partially closes the turbine control valves (TCVs) to stabilize the reactor at a lower pressure. The reactor power settles out at nearly the initial power level. The coolant inventory is maintained by the feedwater control system using water from the condensate storage tank via the condenser hotwell. The NRC staffs review covered:
(1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRCs acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29, insofar as it requires that a APPENDIX H H.3-37 REV. 26, APRIL 2017
PBAPS UFSAR reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.
H.3.8.5.6.2 Emergency Core Cooling System and Loss-of-Coolant Accidents LOCAs are postulated accidents that would result in the loss of reactor coolant from piping breaks in the RCPB at a rate in excess of the capability of the normal reactor coolant makeup system to replenish it. Loss of significant quantities of reactor coolant would prevent heat removal from the reactor core, unless the water is replenished. The reactor protection and ECCS systems are provided to mitigate these accidents. The NRC staffs review covered: (1) the licensees determination of break locations and break sizes; (2) postulated initial conditions; (3) the sequence of events; (4) the analytical model used for analyses, and calculations of the reactor power, pressure, flow, and temperature transients; (5) calculations of peak cladding temperature, total oxidation of the cladding, total hydrogen generation, changes in core geometry, and long-term cooling; (6) functional and operational characteristics of the reactor protection and ECCS systems; and (7) operator actions.
The NRCs acceptance criteria are based on: (1) 10 CFR 50.46, insofar as it establishes standards for the calculation of ECCS performance and acceptance criteria for that calculated performance; (2) 10 CFR Part 50, Appendix K, insofar as it establishes required and acceptable features of evaluation models for heat removal by the ECCS after the blowdown phase of a LOCA; (3) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (4) draft GDCs 37, 41, and 44, insofar as they require that a system to provide abundant emergency core cooling be provided so that fuel and clad damage that would interfere with the emergency core cooling function will be prevented.
H.3.8.5.7 Anticipated Transients Without Scrams ATWS is defined as an AOO followed by the failure of the reactor portion of the protection system specified in draft GDCs 14 and
- 15. The regulations in 10 CFR 50.62 require, in part, that:
Each BWR have an alternate rod injection (ARI) system that is designed to perform its function in a reliable manner and be independent (from the existing reactor trip system) from sensor output to the final actuation device.
Each BWR have a standby liquid control (SLC) system with the capability of injecting into the reactor vessel a borated water solution with reactivity control at least equivalent to the control obtained by injecting 86 gpm of a 13 weight-APPENDIX H H.3-38 REV. 26, APRIL 2017
PBAPS UFSAR percent sodium pentaborate decahydrate solution at the natural boron-10 isotope abundance into a 251-inch inside diameter reactor vessel.
Each BWR have equipment to trip the reactor coolant recirculation pumps automatically under conditions indicative of an ATWS.
The NRC staffs review was conducted to ensure that: (1) the above requirements are met; (2) sufficient margin is available in the setpoint for the SLC system pump discharge relief valve such that SLC system operability is not affected by the proposed EPU; and (3) operator actions specified in the plants Emergency Operating Procedures are consistent with the generic emergency procedure guidelines/severe accident guidelines (EPGs/SAGs),
insofar as they apply to the plant design. In addition, the NRC staff reviewed the licensees ATWS analysis to ensure that: (1) the peak vessel bottom pressure is less than the ASME Service Level C limit of 1500 psig; (2) the peak clad temperature is within the 10 CFR 50.46 limit of 2200ºF; (3) the peak suppression pool temperature is less than the design limit; and (4) the peak containment pressure is less than the containment design pressure. The NRC staff also evaluated the potential for thermal-hydraulic instability in conjunction with ATWS events using the methods and criteria approved by the NRC staff. For this analysis, the NRC staff reviewed the limiting event determination, the sequence of events, the analytical model and its applicability, the values of parameters used in the analytical model, and the results of the analyses.
H.3.8.6 Fuel Storage H.3.8.6.1 New Fuel Storage Nuclear reactor plants include facilities for the storage of new fuel. The quantity of new fuel to be stored varies from plant to plant, depending upon the specific design of the plant and the individual refueling needs. The NRC staffs review covered the ability of the storage facilities to maintain the new fuel in a subcritical array during all credible storage conditions. The review focused on the effect of changes in fuel design on the analyses for the new fuel storage facilities. The NRCs acceptance criteria are based on final GDC-62, insofar as it requires the prevention of criticality in fuel storage systems by physical systems or processes, preferably utilizing geometrically safe configurations.
H.2.8.6.2 Spent Fuel Storage Nuclear reactor plants include storage facilities for the wet storage of spent fuel assemblies. The safety function of the SFP APPENDIX H H.3-39 REV. 26, APRIL 2017
PBAPS UFSAR and storage racks is to maintain the spent fuel assemblies in a safe and subcritical array during all credible storage conditions and to provide a safe means of loading the assemblies into shipping casks. The NRC staffs review covered the effect of the proposed EPU on the criticality analysis (e.g., reactivity of the spent fuel storage array and boraflex degradation or neutron poison efficacy). The NRCs acceptance criteria are based on:
(1) final GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; and (2) final GDC-62, insofar as it requires that criticality in the fuel storage systems be prevented by physical systems or processes, preferably by use of geometrically safe configurations.
H.3.9 SOURCE TERMS AND RADIOLOGICAL CONSEQUENCES ANALYSES H.3.9.1 Source Terms for Radwaste Systems Analyses The NRC staff reviewed the radioactive source term associated with EPUs to ensure the adequacy of the sources of radioactivity used by the licensee as input to calculations to verify that the radioactive waste management systems have adequate capacity for the treatment of radioactive liquid and gaseous wastes. The NRC staffs review included the parameters used to determine: (1) the concentration of each radionuclide in the reactor coolant; (2) the fraction of fission product activity released to the reactor coolant; (3) concentrations of all radionuclides other than fission products in the reactor coolant; (4) leakage rates and associated fluid activity of all potentially radioactive water and steam systems; and (5) potential sources of radioactive materials in effluents that are not considered in the plants UFSAR related to liquid waste management systems and gaseous waste management systems. The NRCs acceptance criteria for source terms are based on: (1) 10 CFR Part 20, insofar as it establishes requirements for radioactivity in liquid and gaseous effluents released to unrestricted areas; (2) 10 CFR Part 50, Appendix I, insofar as it establishes numerical guides for design objectives and limiting conditions for operation to meet the as low as is reasonably achievable criterion; and (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.
H.3.9.2 Radiological Consequences Using Alternate Source Term The licensee reviewed the design-basis accident (DBA) radiological consequences analyses to determine the impact of the EPU. The radiological consequences analyses reviewed were the APPENDIX H H.3-40 REV. 26, APRIL 2017
PBAPS UFSAR LOCA, fuel handling accident (FHA), control rod drop accident (CRDA), and main steam line break accident (MSLBA). The licensees review for each accident analysis included: (1) the sequence of events; and (2) models, assumptions, and values of parameter inputs used by the licensee for the calculation of the total effective dose equivalent (TEDE). The NRC staff reviewed the results of the licensees analyses. The NRCs acceptance criteria for radiological consequences analyses using an alternative source term (AST) are based on: (1) 10 CFR 50.67, insofar as it describes reference values for radiological consequences of a postulated maximum hypothetical accident; (2)
Regulatory Guide 1.183, insofar as it describes accident specific dose guidelines for events with a higher probability of occurrence; and (3) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem TEDE, as defined in 10 CFR 50.2, for the duration of the accident.
H.3.10 HEALTH PHYSICS H.3.10.1 Occupational and Public Radiation Doses The NRC staff conducted its review in this area to ascertain what overall effects the proposed EPU will have on both occupational and public radiation doses and to determine that the licensee has taken the necessary steps to ensure that any dose increases will be maintained as low as is reasonably achievable (ALARA). The NRC staffs review included an evaluation of any increases in radiation sources and how this may affect plant area dose rates, plant radiation zones, and plant area accessibility. The NRC staff evaluated how doses to personnel needed to access plant vital areas following an accident are affected. The NRC staff considered the effects of the proposed EPU on nitrogen-16 levels in the plant and any effects this increase may have on radiation doses outside the plant and at the site boundary from skyshine.
The NRC staff also considered the effects of the proposed EPU on plant effluent levels and any effect this increase may have on radiation doses at the site boundary. The NRCs acceptance criteria for occupational and public radiation doses are based on 10 CFR Part 20; 10 CFR 50.67; 10 CFR Part 50, Appendix I; and final GDC-19.
H.3.11 HUMAN PERFORMANCE H.3.11.1 Human Factors The area of human factors deals with programs, procedures, training, and plant design features related to operator performance during normal and accident conditions. The NRC APPENDIX H H.3-41 REV. 26, APRIL 2017
PBAPS UFSAR staffs human factors evaluation was conducted to ensure that operator performance is not adversely affected as a result of system changes made to implement the proposed EPU. The NRC staffs review covered changes to operator actions, human-system interfaces, and procedures and training needed for the proposed EPU. The NRCs acceptance criteria for human factors are based on final GDC-19, 10 CFR 50.120, 10 CFR Part 55, and the guidance in GL 82-33.
APPENDIX H H.3-42 REV. 26, APRIL 2017