ML20053B153

Forwards Comments on Plant Principal Design Criteria & Differences w/ANSI/ANS-54.1

ML20053B153
Person / Time
Site:	Clinch River
Issue date:	03/08/1982
From:	Lipinski W ARGONNE NATIONAL LABORATORY
To:	Carbon M Advisory Committee on Reactor Safeguards
References
ACRS-CT-1428, NUDOCS 8205280121
Download: ML20053B153 (21)

Text

PAP- &lf-2su 8

US Dipewa d Eg ARGONNE NATIONAL LABORATORY 9 00 SoudiCAss AtaE, ARCpfE,lliNOis 604W Tdghore M2/972-4639 March 8, 1982

~

o Dr. Max W. Carbon p

9 Advisory Comittee on Reactor Safeguards DECEll/ED U. S. Nuclear Regulatory Comission v;

201982x I Washington, DC 20555 C$$N$lEQfu

~

Dear Dr. Carbon:

roc

//

g

Subject:

CRBR Plant Principal Design Criteria q,

fa

Reference:

Memo, P. S. Check, NRC-NRR, to R. F. Fraley, ACRS,

~

Subject:

"CRBR Plant Principal Design Criteria,"

dated February 9,1982.

At your request, I reviewed the CRBR Plant Principal Design Criteria transmitted by the above referenced memorandum.

In addition, I compared the NRC criteria against the draft industry standard: ANSI /ANS-54.1, " Proposed American National Standard General Safety Design Criteria for a Loop Type LMFBR Nuclear Power Plane," July 1981 draft. A copy of the ANSI /ANS-54.1 draft standard was sent to Mr. Paul Boehnert on March 4,1982.

My comments and notations on ANSI /ANS-54.1 differences with the NRC proposed CRBR Plant Principal Design Criteria are attached.

Sincerely,

[

Ewh Walter C. Lipinski, Ph.D.

WCL/at Reactor Analysis & Safety Division cc:

P. Boehnert, ACRS i

DESIGNATED ORIGINAI, Cortifica By ^ j 8205280 g/ / 1 O Tk %ERSITy Of Orego ARcpeE %ERslTEs AssocunON /I

Review Comments on CRBR Plant Principal Design Criteria by Walter C. Lipinski March 8, 1982 i

Criterion 4,- Protection against sodium reactions ANS 54.1-adds: "Two barriers shall be provided between reactor coolant and fluids not compatible with sodium unless the :onsequences of failure of a single barrier can be shown to be acceptable." This implies double tube steam generators. 5. Environmental and Missile Design Bases ANS 54.1 adds: "The effects of possible sodium impingement on components, support structures, cell liners, and containment shall be considered in the design." 8. Reactor Design ANS 54.1 adds: " Positive means shall be provided to prevent fuel management errors that could result in fuel damage limits being exceeded." 9. Reactor Inherent Protection My comment: This criteria should be expanded to cover the issue as to whether the overall power coefficient shall be negative from zero to full power and what the corresponding coolant flow conditions shall be. 11. Instrumentation and Control My conment: This criteria should be expanded to state that the instrumenta-tion shall be qualified to function in the environmental conditions associated with the accidents. 14. Containment Design My comment: The criterion ends with "to assure that the containment design conditions important to safety are not exceeded for as long as postulated accident conditions require." This is ambiguous and should be more specific. 15. Electric Power Systems My comment: The statement, "The onsite electric power supplies, including the batteries, and the onsite electric distribution system, shall have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure," is ambiguous. Is a single failure to be assumed and redundancy to be provided in the remaining equipment? 1

1 ANS 54.1 deleted the underlir,ed portion in paragraph 3: "One of these cir-cuits shall be designed to be available within a few seconds following any postulated accident to assure tiiit core cooling, containment integrity, and other vital safety functions are maintained.

17. Control Room ANS 54.1 modified the first sentence:

---under normal operation and antici-pated operational occurrences" and deleted the parenthetical statement. After the second sentence the following was added: "The control room shall also provide protection from chemical substances such as sodium oxide which might be released to the local environment under postulated accident conditions in concentrations sufficient to require evacuation of the control room." The last part of the last sentence was modified to read: "with a potential capa-bility for subsequent shutdown of the reactor to the refueling temperature through the use of suitable procedures."

19. Protection System Reliability and Testability My Comment: The statement, "(2) removal from service of any component or channel does not result in loss of the required minimum redundancy unless the acceptable reliability ofoperation of the protection system can be otherwise demonstrated," is vague. What is the required minimum redundancy? Should the remaining portion of the system be able to withstand a single failure?

23. Protection System Requirements for Reactivity Control Malfunctions ANS 54.1 added a qualifying parenthetical expression:

"(not ejection or dropout)."

24. Reactivity Control System Redundancy and Capability ANS 54.1 deleted the parenthetical reference:

"(including xenon burnout)." My comment: This criteria should be rewritten for the LMFBR and should clearly identify what the requirements are for reactivity control.

28. Quality of Reactor Coolant Boundary ANS 54.1 deleted:

"Means shall be provided for detecting and, to the extent practical, identifying the location of the source of reactor coolant leakage.

35. Reactor Residual Heat Extraction System ANS 54.1 added the following after the second sentence:

"Any fluid in the ~ residual heat extraction system that is separated from the reactor coolant by a single passive barrier shall not be chemically reactive with the reactor coolant." My coment: This criterion should be rewritten to accommodate a station blackout event.

37. Testing of Reactor Residual Heat Extraction System My coment:

If natural circulation is included in Criteria 35, then this criterion should explicitly address testing of this system.

38. Additional Cooling Systems My coment:

If accommodating station blackout is a requirement, then this criterion should be modified. 43, Capability for Containment Leakage Rate Testing ANS 54.1 changed the last part of the criterion from "can be conducted at containment design pressure." to "Can be conducted to verify the design leak rate."

47. Primary Containment Isolation ANS 54.1 changed the title to read:

" Reactor Containment Isolation." My comment: This criterion should be expanded to include a specific statement that containment vent or purge valves which are open during normal operation shall be designed to close against dynamic loads which occur during accident conditions.

49. Containment Atmosphere Cleanup ANS 54.1 changed the title to read:

" Containment Atmosphere Control" and reworded the first part of the criterion as follows: " Systems to control fission products and other radioactive substances which may be released into the reactor containment shall be provided as necessary to 4 reduce, consistent with the functioning of other associated systems, the concentration and quantity of these substances released to the environment following postulated assicents. Systems shall be provided as necessary to prevent and/or control the effects of potential chemical reactions following postulated accidents to assure that containment integrity is maintained. The necessity of such systems should consider the effects of sodium leakage and its potential reaction with oxygen and its potential for hydrogen generation when in contact with concrete."

50. Inspection of Containment Atmosphere Cleanup Systems ANS 54.1 changed the title to read: " Inspection of Containment Atmosphere Cleanup Systems."

51. Testing of Containing Atmosphere Cleanup Systems ANS 54.1 changed the title to read:

" Testing of Containment Atmosphere Con-trol Systems General Comment A separate criteria should be added which addresses the single failure requirement. This criteria should state that the single failure assumption may not be sufficient in providing a system with adequate reliability and that additional analysis is required to establish whether a particular safety function has adequate reliability. " Adequate" reliability is ambiguous and an attempt should be made to define " adequate." l i

FFTF APPENDIX F PRINCIPAL DESIGN CRITERIA TABLE OF CONTENTS CRITERION 1 - QUALITY STANDARDS (Category A) F-1 CRITERION 2 - PERFORMANCE STANDARDS (Category A) F-1 CRITERION 3 - FIRE PROTECTION (Category A) F-2 CRITERION 4 - SHARING OF SYSTEMS (Category A) F-2 CRITERION 5 - RECORDS REQUIREMENTS (Category A) F-2 , CRITERION 6 - REACTOR CORE DESIGN (Category A) F-2 CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS (Category B) F-3 CRITERION 8 - OVERALL POWER COEFFICIENT (Category B) F-3 CRITERION 9 - REACTOR COOLANT BOUNDARY (Category A) F-3 CRITERIA 10 AND 49 - CONTAINMENT (Category A) F-3 CRITERION 11 - CONTROL ROOM (Category B) F-3 CRITERION 12 - INSTRUMENTATION AND CONTROL SYSTEMS (Category B) F-4 CRITERION 13 - FISSION PROCESS MONITORS AND CONTROLS (Category B) F-4 CRITERION 14 - CORE PROTECTION SYSTEMS (Category B) F-4 CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEMS l (Category B) F-4 CRITERION 16 - MONITORING REACTOR Co0v.NT PRESSURE BOUNDARY (Category B) F-4 CRITERION 17 - MONITORING RADI0 ACTIVITY RELEASES (Category B) F-4 CRITERION 18 - MONITORING FUEL AND WASTE STORAGE (Category B) F-4 CRITERION 19 - PROTECTION SYSTEMS RELIABILITY (Category B) F-5 CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE (Category B) F-5 CRITERION 21 - SINGLE FAILURE DEFINITION (Category B) F-5 CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION I SYSTEMS (Category B) F-5 CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION SYSTEMS (Category B) F-5 CRITERION 24 - EMERGENCY POWER FOR PROTECTION S UTEMS (Category B) F-5 CRITERION 25 - DEMONSTRATION OF FUNCTIONAL OPERABILITY OF PROTECTION SYSTEMS (Category B) F-6 CRITERION.26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN (Category B) F-6 CRITERION 27 - REDUNDANCY OF REACTIVITY CONTROL (Category A) F-6 CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY (Category A) F-6 F-i

~ APPENDIX F PRINCIPAL DESIGN CRITERIA

• TABLE OF CONTENTS (Cont.)

J CRITERION 29 - REACTIVITY SHUTDOWN CAPABILITY (Category A) F-6 CRITERION 31 - REACTIVITY CONTROL SYSTEMS MALFUNCTION (Category B) F-6 CRITERIA 32 AND 33 - MAXIMUM REACTIVITY WORTH OF CONTROL RODS (Category A) F-7 CRITERION 34 - REACTOR COOLANT B0UNDARY MATERIALS AND SERVICE CONDITIONS (Category A) F-7 CRITERION 35 - Deleted CRITERION 36 - REACTOR COOLANT BOUNDARY SURVEILLANCE (Category A) F-7 CRITERION 37 - ENGINEERED SAFETY FEATURES BASIS FOR DESIGN (Category A) f -7 CRITERION 38 - RELIABILITY AND TESTABILITY OF ENGINEERED SAFETY FEATURES (Category A) F-8 CRITERION 39 EMERGENCY POWER FOR ENGINEERED SAFETY FEATURES (Category A) F-8 CRITERION 40 - MISSILE PROTECTION (Category A) F-8 ~ CRITERION 41 - ENGINEERED SAFETY FEATURES PERFORMANCE CAPABILITY (Category A) F-8 CRITERION 42 - ENGINEERED SAFETY FEATURES COMPONENTS CAPABILITY (Category A) F-8 CRITERION 43 - ACCIDENT AGGRAVATION PREVENTION (Category A) F-9 CRITERIA 44 AND 45 - EMERGENCY CORE COOLING (Category A) F-9 CRITERIA 46, 47 AND 48 - TESTING 0F EMERGENCY CORE COOLING PROVISIONS (Category A) F-9 CRITERION 50 - NDT REQUIREMENT FOR CONTAINMENT MATERIAL (Category A) F-9 CRITERION 51 - REACTOR COOLANT PRESSURE BOUNDARY OUTSIDE CONTAINMENT (Category A) F-9 CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEMS (Category A) F-10 CRITERION 53 - CONTAINMENT ISOLATION VALVES (Cagetory A) F-10 CRITERION 54 - CONTAINMENT LEAKAGE RATE TESTING (Category A) F-10 CRITERION 55 - CONTAINMENT PERIODIC LEAKAGE RATE TESTING (Category A) F-10 CRITERION 56 - PROVISIONS FOR TESTING OF PENETRATIONS (Category A) F-10 CRITERION 57 - PROVISIONS FOR TESTING 0F ISOLATION VALVES (Category A) F-10 F-ii

APPENDIX F PRINCIPAL DESIGN CRITERIA TABLE OF CONTENTS (Cont.) CRITERIA 58, 59, AND 61 - Deleted CRITERIA 62 THROUGH 65 - CONTAINMENT ATMOSPHERE CLEANUP SYSTEMS (Category A) F-10 CRITERION 66 - PREVENTION OF FUEL STORAGE CRITICALITY (Category B) F-11 CRITERION 67 - FUEL AND WASTE STORAGE DECAY HEAT (Category B) F-li CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING (Category B) F-11 CRITERION 69 - PROTECTION AGAINST RADI0 ACTIVITY RELEASE FROM SPENT FUEL AND WASTE STORAGE (Category B) F-ll CRITERION 70 - CONTROL OF RELEASES OF RADI0 ACTIVITY TO THE ENVIRONMENT (Category B) F-11 CRITERION 71 - COOLING SYSTEMS FOR CORE COMP 0NENT AND TEST ASSEMBLY HANDLING EQUIPMENT (Category B) F-12 F-fii

l. FFTF 1 APPENDIX F PRINCIPAL DESIGN CRITERIA The following criteria are established as " Principal Design Criteria" for guidance of the design and ufety evaluation of the FFTF. These criteria are modelled after the AEC " General Design Criteria for Nuclear Power Plant Construction Permits", and the identical wording of the respective AEC criteria is used where applicable. Modified or different criteria are defined where this was considered necessary or appropriate in con-sideration of the safety requirements and basic design characteristics of the sodium-cooled, fast test reactor facility. The numbering of these criteria follows that of the AEC Criteria, and, where AEC Criteria are omitted or combined, the numbering so indicates. CRITERION 1 - QUALITY STANDARDS (Cateaory A) Those systems and components of reactor facilities which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of tneir consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of the safety function to be performed. Where generally recognized codes or standards on design, materials, fabrication, and inspection are used, the; shall be identified. Where adherence to such codes or standards does not suffice to assure a quality product in keep-ing with the safety function, they shall be supplemented or modified as necessary. Quality assurance programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of suffi-ciency and applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is required. The Quality Assurance Program shall meet the requirements of RDT Standard F2-2T, " Quality Assurance Program Requirements", dated June 1%9. CRITERION 2 - PERFORMANCE STANDARDS (Category A) Those systems and components of reactor facilities which are essential -to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences shall be designed, fabri-cated, and erected to performance standards that will enable the facility F-1

9 o o CRITERION 2 - PERFORMANCE STANDARDS (Category A) (Cont.) g to withstand, without loss of the capability to protect the public, the additional forces that might be imposed by natural phenomena such as S earthquakes, tornadoes, flooding conditions, winds, ice, and other local site effects. The design bases so established shall reflect: (a) appro-priate consideration of the most severe of these natural phenomena that 6 have been recorded for the site and the surrounding area, and (b) cn e appropriate margin for withstanding forces greater than those recorded o to reflect uncertainties about the historical data and their suitability o as a basis for design. CRITERION 3 - FIRE PROTECTION (Category A) o The reactor facility shall be designed (1) to minimize the probability o of events such as fires and explosions and (2) to minimize the potential o effects of such events to safety. Noncombustible and fire resistant o materials shall be used whenever practical throughout the facility, par-q ticularly in areas containing critical portions of the facility such as containment, control room, and components of engineered safety features. Fire protection features and fire fighting systems shall be provided with capability and characteristics comensurate with potential fire sources, locations, and consequences; these features and provisions shall reflect specific consideration of potential sodium fires. CRITERION 4 - SHARING OF SYSTEMS (Category A) Reactor facilities shall not share systems or components unless it is shown, safety is not impaired by the sharing. CRITERION 5 - RECORDS REOUIREMENTS (Category A) Records of the design, fabrication, and construction of essential com-ponents of the plant shall be maintained by the reactor operator or under its control throughout the life of the reactor. CRITERION 6 - REACTOR CORE DESIGN (Category A) ~ The reactor core shall be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits which have been stipulated and justified. The core design, together with reliable process and decay heat removal systems, shall provide this capability under all F-2 ~ ~ ~, e

CRITERION 6 - REACTOR CORE DESIGN (Category A) (Co'nt.) expected conditions of normal operation with appropriate margins for uncertainties and for transient conditions which can he anticipated. Acceptable fuel damage limits for transient conditions shall be estab-lished to specify the acceptable consequences of faults at a level commensurate with the potential for their occurrence. CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS (Category B) The core design, together with reliable controls, shall ensure that - power oscillations which could cause damage in excess of acceptable fuel damage limits are not possible or can be readily suppressed. CRITERION 8 - OVERALL p0WER COEFFICIENT (Cateaory B) The reactor shall be designed so that the overall power coefficient in the power operating range shall not be positive. CRITERION 9 - REACTOR COOLANT B0UNDARY (Category A) The reactor coolant pressure boundary shall be designed and constructed so as to have an exceedingly low probability of gross rupture or sig-nificant leakage throughout its design lifetime. CRITERIA 10 AND 49 - CONTAlfMENT (Category A) Reactor containment shall be provided to prevent the accidental release of radioactivity to the environment in excess of guidelines of 10 CFR 100; specific consideration shall be given to the potential release of plutonium. The containment design shall be adequate to sustain (1) a hypothetical event which may cause disruptive disassembly of the reactor core with accompanying energy release and after-heat, and (2) the maximum postulated radioactive sodium fire. The containment and its associated systems shall be designed so as to maintain the capability of the con-tainment to perform its safety function as long as any postulated accident conditions require. CRITERION 11 - CONTROL ROOM (Category B) The facility shall be provided with a control room from which actions to anaintain safe operational status of the plant can be controlled. Adequate radiation protection shall be provided to permit access, even under accident conditions, to equipment in the control room or other areas as F-3

Q CRITERION 11 - CONTROL ROOM (Category B) (Cont.) o necessary to shut down and maintain safe control of the facility without radiation exposures of personnel in excess of AEC Manual Chapter 0524 limits, including emergency limits as applicable. It shall be possible to shut the reactor down and maintain it in a safe condition if access a to the control room is lost due to fire or other caUse. d ~ CRITERION 12 - INSTRUMENTATION AND CONTROL SYSTEMS (Category B) Jnstrumentation and controls shall be provided as required to monitor ~ and maintain variables within prescribed operating ranges. CRITERION 13 - FISSION PROCESS MONITORS AND CONTROLS (Category B) Means shall be provided for monitoring and maintaining control over the fission process throughout core life and for all conditions that can ~ reasonably be anticipated to cause variations in reactivity of the core, ~ such as position of control rods. ~ CRITERION 14 - CORE PROTECTION SYSTEMS (Category B) Core protection systems, together with associated equipment, shall be designed to act automatically to prevent or to suppress conditions that ~ could result in exceeding acceptable fuel damage limits. CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEMS (Category B) Protection systems shall be provided for sensing accident situations and i initiating the operation of necessary engineered safety features. t ( CRITERION 16 - MONITORING REACTOR COOLANT PRESSURE BOUNDARY (Category B) l Means shall be provided for monitoring the reactor coolant pressure boundary to detect leakage. CRITERION 17 - MONITORING RADI0 ACTIVITY RELEASES (Category B) Means shall be provided for monitoring the containment atmosphere, the facility effluent discharge paths, and the facility environs for radio-activity that ld be released from normal operations, from anticipated transients, trom accident conditions. CRITERION '.6 - MONI.' RING FUEL AND WASTE STORAGE (Category B) Nbnitoring and alarm. strumentation shall be provided for fuel and waste storage and handling areas for conditions that might contribute to loss of continuity in decay heat removal and to radiation exposures. F-4 l

CRITERION 19 - PROTECTION SYSTEMS RELIABILITY (Category B) Protection systems shall be designed for high functional reliability and in-se_rvice testability comensurate with the safety functions to be per-formed. CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE (Catecory B) Redundancy and independence designed into protection systems shall be suf-ficient to assure that no single failure or removal from service of any component or channel of a system will result in loss of the protection function. The redundancy provided shall include, as a minimum, two channels of protection for each protection function to be served. Differ-ent principles shall be used where necessary to achieve true independence of redundant instrumentation components. CRITERION 21 - SINGLE FAILURE DEFINITION (Category B) Multiple failures resulting from a single event shall be treated as a single failure. l l CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION l SYSTEMS (Cateaory B) Protection systems shall be separated from control instrumentation systems to the extent that failure or removal from service of any coni. col instru-mentation and protection circuitry, leaves intact a system satisfying all requirements for the protection channels. 1 CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION ' SYSTEMS (Category B)_ The effects of adverse conditions to which redundant channels or protec-1 tion systems might ba exposed in common, either under r.ormal conditions or those of an accident, shall not result in loss of the protection func-tion. CRITERION 24 - EMERGENCY POWER FOR PROTECTION SYSTEMS (Category B) In the event of loss of all off-site power, sufficient alternate sources of power shall be provided to permit the required functioning of the pro-tection systems. l F-5

CRITERION 25 - DEMONSTRATION OF FUNCTIONAL OPERABILITY OF PROTECTION SYSTEMS (Category B) Means shall be included for testing protection systems while the reactor o is in operation to demonstrate that no failure or loss of redundancy has occurred. CRITERION 26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN (Category B) The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are experienced. CRITERION 27 - REDUNDANCY OF REACTIVITY CONTROL (Category A) At least two independent reactivity control systems shall be provided. Independence of the systems shall prevent the simultaneous disability of the systems for any single failure within either system. CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY (Category A) ~ At least two reactivity control systems shall independently be capable of making and holding the core subcritical from any hot standby or hot operating condition, including those resulting from power changes, sufficiently fast to prevent exceeding acceptable fuel damage limits. CRITERION 29 - REACTIVITY SHUTDOWN CAPABILITY (Category A) At least one of the reactivity control systems provided shall be capable of making the core subcritical under any condition (including antici-pated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown margins greater than the worth of the most effective control rod when fully withdrawn shall be provided. CRITERION 31 - REACTIVITY CONTROL SYSTEMS MALFUNCTION (Category B) The reactivity control systems shall be capable of sustaining any single selfunction, such as unplanned continuous withdrawal (not ejection) of a control rod, without causing a reactivity transient which could result in exceeding acceptable fuel damage limits. F-6 h

CRITERIA 32 AND 33 - MAXIMUM REACTIVITY WORTH OF CONTROL RODS (Category A) Limits shall be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to assure that the potential effects of an accidental sudden change in reactivity from rod motion will not damage the coolant boundary, the core, the core support structures, or their components to the extent that loss of core cooling capability leading to core disruption will occur. Positive means shall be provided, as applicable, to prevent rod motion (such as rod ejection) which could cause a reactivity change in excess of the capability to main- ~ tain core cooling capability. \\ CRITERION 34 - REACTOR COOLANT BOUNDARY MATERIALS AND SERVICE CONDITIONS (Category A) Reactor coolant boundary materials and service conditions shall be' selected and maintained to provide materials properties which will assure non-brittle behavior and to avoid conditions which could produce rapidly propagating failures, such that coolant boundary damage will be maintained within acceptable limits under all conditions requiring core cooling. Consideration shall be given to (a) materials properties including duc-tility and noten-toughness, (b) the state of stress of material under static and transient loadings, (c) the quality control specified for materials and component fabrication, and (d) the effect of service temp-eratures and irradiation. CRITERION 35 - Deleted CRITERION 36 - REACTOR COOLANT B0UNDARY SURVEILLANCE (Category A) The design of the reactor vessel and primary coolant system shall accom-modate an integrated program for surveillance and in-service inspection to assess continued integrity of the primary coolant boundary. CRITERION 37 - ENGINEERED SAFETY FEATURES BASIS FOR DESIGN (Category A) Engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant boundary, and their protection systems. Such engineered safety features shall be de-signed to maintain the capability to prevent the accidental release of radioactivity to the environment in excess of the guidelines of 10 CFR 100, for circumstances which containment shall be designed to sustain. F-7

L ,j, CRITERION 38 - RELIABILITY AND TESTABILITY OF ENGINEERED SAFETY FEATURES (Category A) All engineered safety features shall be designed to provide high functional reliab~ility and ready testability. In determining the suitability of a facility for a proposed site, the degree of reliance upon and acceptance of the inherent and engineered safety afforded by the systems, including engineered safety features, will be influenced by the known and the demon-strated performance capability and reliability of the systems, and by the extent to which the operability of such systems can be tested and inspected where appropriate during the life of the plant. ~ CRITERION 39 - EMERGENCY POWER FOR ENGINEERED SAFETY FEATURES (Category A) Alternate power systems shall be provided and designed with adequate independency, redundancy, capacity, and testability to permit the functioning required of the engineered safety features. As a minimum, the onsite power system and the offsite power system shall each, inde-pendently, provide this capacity assuming a failure of a single active component in each power system. CRITERION 40 - MISSILE PROTECTION (Category A) Protection for engineered safety features shall be provided against dynamic effects and missiles that might result from plant equipment failures. CRITERION 41 - ENGINEERED SAFETY FEATURES PERFORMANCE CAPABILITY (Category A) Engineered safety features such as emergency core cooling and contain-ment heat removal systems shall provide sufficient performance capability to accommodate partial loss of installed capacity and still fulfill the required safety function. As a minimum, each engineered safety feature shall provide this required safety function assuming a failure of a single active component. CRITERION 42 - ENGINEERED SAFETY FEATURES COMPONENTS CAPABILITY (Category A) Engineered safety features shall be designed so that the capability of these features to perform their required function is not impaired by the effects of an accident for which the safety functions are required. ~ F-8 6.

CRITERION 43 - ACCIDENT AGGRAVATION PREVENTION (Category A) Engineered safety features shall be designed so that they do not cause hazardous conditions or accentuate the adverse consequences of accidents. CRITERIA 44 AND 45 - EMERGENCY CORE COOLING (Category A) The reactor coolant system shall provide emergency core cooling. The capacity and capability for emergency core cooling shall provide assurance ~ against exceeding acceptable fuel and coolant system damage limits com-mensurate with the possible consequences and potential for occurrence of faults. Provisions for reactor vessel and coolant system in-service in-spection shall incorporate inspection of critical components and features required for emergency core cooling. Redundancy, backup, and independence of features shall be provided to assure that emergency core cooling can be accomplished assuming failure of any single active component. CRITERIA 46, 47 AND 48 - TESTING 0F EMERGENCY CORE COOLING PROVISIONS (Category A) The design shall include the capability for periodic functional testing of emergency core cooling provisions. These capabilities shall include testing of component and system perfomance in the emergency operating mode, and testing of the operational sequence that initiates emergency mode of operation including the transfer to alternate power sources. CRITERION 50 - NDT REQUIREMENT FOR CONTAINMENT MATERIAL (Category A) Principal load-carrying components of ferritic materials exposed to the external environment shall be selected so that their temperatures under j nomal operating and testing conditions are not less than 30 *F above nil l ductility transition (NDT) temperature. CRITERION 51 - REACTOR COOLANT PRESSURE B0UNDARY OUTSIDE CONTAINMETE (Category A) If part of the reactor coolant pressure boundary is outside the contain-ment, appropriate features as necessary shall be provided to protect the health and safety of the public in case of an accidental rupture in that part. Determination of the appropriateness of features such as isolation valves an'd additional containment shall include consideration of the environmental and population conditions surrounding the site. F-9

CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEMS (Categcry A) Where active heat removal systems are needed under accident conditions to prevent exceeding containment design pressure, at least two systems, preferably of different principles, each with full capacity, shall be provided. CRITERION 53 - CONTAINMENT ISOLATION VALVES (Category A) l Penetrations that require closure for the containment function shall be ~ protected by redundant valving and associated apparatus. CRITERION 54 - CONTAINMENT LEAKAGE RATE TESTING (Category A) Containment shall be designed so that an integrated leakage rate testing can be conducted at design pressure after completion and installation of all penetrations and the leakage rate measured over a sufficient period of time to verify its conformance with required performance. ~ CRITERION 55 - CONTAINMENT PERIODIC LEAKAGE RATE TESTING (Category A) The containment shall be designed so that integrated leakage rate testing can be done periodically during plant lifetime. CRITERION 56 - PROVISIONS FOR TESTING OF PENETRATIONS (Category A) Provisions shall be made for testing penetrations which have resilient seals or expansion bellows to permit leaktightness to be demonstrated at design pressure. CRITERION 57 - PROVISIONS FOR TESTING OF ISOLATION VALVES (Category A) Capability shall be provided for testing functional operability o'f valves and associated apparatus essential to the containment function for estab-lishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits. CRITERIA 58, 59, 60, AND 61 - Deleted I CRITERIA 62 THROUGH 65 - CONTAINMENT ATMOSPHERE CLEANUP SYSTEMS (Category A) Containment atmosphere cleanup systems shall be provided as necessary for radioactivity source reduction to meet containment requirements. Provisions shall be incorporated for physical inspection, testing of active components q and key performance features (such as filter installations), and overall I F-10 I

~ CRITERIA 62 THROUGH 65 - CONTAINMENT ATMOSPHERE CLEANUP SYSTEMS (Category A) (Cont.) system performance testing under conditions as close to design as possible, for those systems and features (if any) necessary to maintain the contain-ment capability. Redundancy or backup shall be provided such that required capability is maintained upon failure of any single active component. CRITERION 66 - PREVENTION OF FUEL STORAGE CRITICALITY (Category B) Criticality in new and spent fuel storage shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls. CRITERION 67 - FUEL AND WASTE STORAGE DECAY HEAT (Category B) Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities that could result in radioactivity release to plant operating areas or the public environs. CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING (Category B) Shielding for radiation protection shall be provided in the design of spent fuel and waste storage facilities as required to meet the require-ments of AEC Manual Chapter 0524. CRITERION 69 - PROTECTION AGAINST RADI0 ACTIVITY RELEASE FROM SPENT FUEL AND WASTE STORAGE (Category B) Containment of fuel and waste storage shall be provided if a'ccidents could lead to release of undue amounts of radioactivity to the public environs. CRITERION 70 - CONTROL OF RELEASES OF RADI0 ACTIVITY TO THE ENVIRONMENT (Category B) The facility design shall include those means necessary to maintain con-trol over the plant radioactive effluents, whether gaseous, liquid or solid. Appropriate holdup capacity shall be provided for retention of ll gaseous, liquid, or solid effluents, particularly where unfavorable I environmental conditions can be expected to require operational limita-1 tions upon the release c ' radioactive effluents to the environment. In all cases, the design fcr radioactivity control shall be justified (a) on the basis of AEC Manual Chapter 0524 requirements for normal operations I and for any transient situation that might reasonably be anticipated to F-ll

~ ~ CRITERION 70 - CONTROL OF RELEASES OF RADI0 ACTIVITY TO THE ENVIRONMENT ~ (Category B) (Cont.) occur, and (b) on the basis of 10 CFR 100 dosage level guidelines for ~ s potential reactor accidents of exceedingly low probability of occurrence except that reduction of the recomended dosage levels may be required 3 where high population densities or very large cities can be affected by j the radioactive effluents. 1 CRITERION 71 - COOLING SYSTEMS FOR CORE COMPONENT AND TEST ASSEMBLY HANDLING EQUIPMENT (Category B) Systems shall be provided for fuel handling equipment to maintain adequate cooling of core components and test assemblies.during all handling opera-tions. The capability shall include provisions for fuel cooling in the s s ~ event of a mechanical failure of fuel handling equipment. Redundancy ~, cr backup shall be provided to prevent loss of cooling in event of failure _7 I v of any sing 13 active component of a cooling system. t ed a M sa t /. .e e ame, '\\ 4mp i e. emp e U s F-12 e O}}