ML17130A306

Revision 26 to Updated Final Safety Analysis Report, Appendix J, Identification-Resolution of AEC-ACR and Staff Concerns

ML17130A306
Person / Time
Site:	Peach Bottom
Issue date:	04/06/2017
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17130A259	List: ML17108A393 ML17130A208 ML17130A211 ML17130A216 ML17130A218 ML17130A220 ML17130A222 ML17130A224 ML17130A227 ML17130A231 ML17130A233 ML17130A235 ML17130A241 ML17130A245 ML17130A247 ML17130A249 ML17130A254 ML17130A256 ML17130A258 ML17130A263 ML17130A266 ML17130A268 ML17130A270 ML17130A273 ML17130A277 ML17130A279 ML17130A281 ML17130A284 ML17130A286 ML17130A288 ML17130A290 ML17130A292 ML17130A294 ML17130A301 ML17130A303 ML17130A306 ML17130A308 ML17130A310 ML17130A313 ML17130A317 ML17130A319 ML17130A321 ML17130A324 ML17130A326 ML17130A328 ML17130A330 ML17130A332 ML17130A486 ML17130A488 ML17130A493 ... further results
References
Download: ML17130A306 (78)

Text

PBAPS UFSAR APPENDIX J - INDENTIFICATION-RESOLUTION OF AEC-ACRS AND STAFF CONCERNS TABLE OF CONTENTS J.1

SUMMARY

DESCRIPTION J.2 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3--

AEC-ACRS CONSTRUCTION PERMIT LETTER J.2.1 Introduction J.2.2 Browns Ferry ACRS Comments (3/14/67) Applicable to Peach Bottom J.2.2.1 Effects of Fuel Failure on CSCS Performance J.2.2.2 Effects of Fuel Bundle Flow Blockage J.2.2.3 Verification of Fuel Damage Limit Criterion J.2.2.4 Effects of Cladding Temperatures and Materials on CSCS Performance J.2.2.5 Quality Assurance and Inspection of the Reactor Primary System J.2.2.6 Control Rod Block Monitor Design J.2.2.7 Plant Startup Program J.2.2.8 Main Steam Line Isolation Valve Testing Under Simulated Accident Conditions J.2.2.9 Performance Testing of the Station Standby Diesel Generator System J.2.2.10 Formulation of an In-Service Inspection Program J.2.2.11 Diversification of the CSCS Initiation Signals J.2.2.12 Control Systems for Emergency Power J.2.2.13 Misorientation of Fuel Assemblies J.2.3 Failure of Conowingo Dam - Alternate Heat Removal Capability J.2.4 Ring Header Leakage Protection Capability J.2.5 Station Thermal Effects - Commonwealth of Pennsylvania Limits J.2.6 HPCIS - Depressurization Capability J.2.7 Station Startup Program J.2.8 Conclusions J.3 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3--

AEC-STAFF CONSTRUCTION PERMIT SAFETY EVALUATION REPORT J.3.1 General J.3.2 AEC-Staff SER Section 2.0 Concerns J.3.2.1 Introduction J.3.2.2 RPS - IEEE-279 Design Statement J.3.3 AEC-Staff SER Section 3.0 Concerns J.3.3.1 Introduction J.3.3.2 Station Meteorological Program APPENDIX J J-i REV. 21, APRIL 2007

PBAPS UFSAR J.3.3.3 Station-Site Slope Cut Program Studies J.3.3.4 Station-Site Flood Protection Studies J.3.3.5 Station-Site Diffusion and Dispersion Studies -

Radiological Effects Determination J.3.3.6 Station Alternative Heat Sink in Event of Dam Failure

- Design Capability J.3.4 AEC-Staff SER Section 4.0 Concerns J.3.4.1 Introduction J.3.4.2 Suction Piping System Supply Water to ECCS (CSCS) -

Design Aspects J.3.4.3 Adequacy of HPCIS as a Depressurizer J.3.4.4 Engineered Safety Features - Electrical Equipment Inside Primary Containment - Design Capabilities J.3.5 AEC-Staff SER Section 5.0 Concerns J.3.5.1 Introduction J.3.5.2 Steam Line Break Fuel Rod Integrity - Thermal Hydraulic Analytical Justification J.3.6 AEC-Staff SER Section 6.0 Concerns J.3.6.1 Introduction J.3.6.2 Development Program of Significance for All Large Water-Cooled Power Reactors J.3.6.3 Development Program of Significance for BWR's in General J.3.6.4 Areas Requiring Further Technical Information J.3.7 Conclusion J.4 AREAS SPECIFIED IN OTHER RELATED AEC-ACRS CONSTRUCTION AND OPERATING PERMIT LETTERS J.4.1 General J.4.2 Instrumentation for Prompt Detection of Gross Fuel Failure J.4.3 AEC General Design Criterion No. 35 - Design Intent and Conformance J.4.4 Scram Reliability Study J.4.5 Design Basis of Engineered Safety Features J.4.6 Hydrogen Generation Study J.4.7 Seismic Design and Analysis Models J.4.8 Automatic Pressure Relief System - Single Component Failure Capability - Manual Operation J.4.9 Flow Reference Scram J.4.10 Main Steam Lines - Standards for Fabrication, Q/C, and Inspection J.4.11 Main Steam Line Isolation Valve Leakage J.4.12 Reactor Startup Vibration Testing Capability J.4.13 Control Rod Drop Accident APPENDIX J J-ii REV. 21, APRIL 2007

PBAPS UFSAR J.5 AREAS SPECIFIED IN OTHER RELATED AEC-STAFF CONSTRUCTION OR OPERATING PERMIT SAFETY EVALUATION REPORTS J.5.1 General J.5.2 Tornado and Missile Protection - GE BWR - Spent Fuel Storage Pool J.5.3 BWR System Stability Analysis J.5.4 Reactor Pressure Vessel - Stub Tube Design J.5.5 RPS and CSCS Instrumentation - Cable Marking and Identification J.5.6 RPS and CSCS Instrumentation - Design Criteria (IEEE-279)

APPENDIX J J-iii REV. 21, APRIL 2007

PBAPS UFSAR APPENDIX J - INDENTIFICATION-RESOLUTION OF AEC-ACRS AND STAFF CONCERNS LIST OF TABLES TABLE TITLE J.2.1 Summary of Design Basis LOCA Calculations With Fuel Loading Errors J.2.2 Peak Cladding Temperatures - Design Basis LOCA J.4.1 Rod Drop Accident Results - Three-Assembly Gd2O3 Core

- 50% Rod Density APPENDIX J J-iv REV. 21, APRIL 2007

PBAPS UFSAR APPENDIX J INDENTIFICATION-RESOLUTION OF AEC-ACRS AND STAFF CONCERNS LIST OF FIGURES FIGURE TITLE J.4.1 Rod Drop Accident Maximum Control Rod Worth with Single Operator Error at BOL with RSCS J.4.2 Rod Drop Accident Maximum Control Rod Worth with Single Operator Error at Most Reactive Point in Core Life (6,500 MWd/T) with RSCS J.4.3a Schematic Block Diagram of RSCS for Core Exposure

<6,500 MWd/t J.4.3b RSCS Block Diagram for Core Exposure <6,500 MWd/t J.4.4a Schematic Block Diagram of RSCS for Core Exposure

>6,500 MWd/t J.4.4b RSCS Block Diagram for Core Exposure>6,500 MWd/t J.4.5 Fault Tree Model of a Control Rod Stuck in Core Ready for a Drop J.4.6 Reactor States Used in the Analysis of the Control Rod Drop Accident J.4.7 Probability Analysis of Control Rod Drop Accident J.4.8 Off-Site Effect of Rod Drop Accident APPENDIX J J-v REV. 21, APRIL 2007

PBAPS UFSAR APPENDIX J - IDENTIFICATION-RESOLUTION OF AEC-ACRS AND STAFF CONCERNS J.1

SUMMARY

DESCRIPTION The design of the GE BWR's for this plant is based upon proven technological concepts developed during the development, design, and operation of numerous similar reactors. The AEC in reviewing the Peach Bottom Units 2 and 3 docket at the Construction Permit stage identified several areas where further Research and Development efforts were required to more definitely assure safe operation of this plant. These development efforts thus are of three general types: (1) those which pertain to the broad category of water-cooled reactors, (2) those which pertain specifically to BWR's, and (3) those which have been noted particularly for a facility during the construction permit licensing activities by the AEC Staff and Advisory Committee on Reactor Safeguard (ACRS) reviews.

The following discussion is a complete, comprehensive examination of each of these concern areas, indicating the planned or accomplished resolution. The discussion has been sub-divided as follows:

1. Areas Specified in the Peach Bottom-AEC-ACRS Construction Permit Letters.

2. Areas Specified in the Peach Bottom-AEC Staff Construction Permit Safety Evaluation Report.

3. Areas Specified in Other Related AEC-ACRS Construction and Operating Permit Letters on other dockets.

4. Areas Specified in Other Somewhat Related AEC-Staff Construction and Operating Permit Evaluation Reports on other dockets.

The scope of many of the areas of technology for items in 1, 2, and 3 above is discussed in detail as part of an official response by the General Electric Company to the various ACRS concern subjects (reference 1).

APPENDIX J J.1-1 REV. 21, APRIL 2007

PBAPS UFSAR J.1

SUMMARY

DESCRIPTION REFERENCE

1. Bray, A. P., et al, "The General Electric Company Analytical and Experimental Programs for Resolution of ACRS Safety Concerns," APED-5608, April, 1968.

APPENDIX J J.1-2 REV. 21, APRIL 2007

PBAPS UFSAR J.2 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3-- AEC-ACRS CONSTRUCTION PERMIT LETTER J.2.1 Introduction The PBAPS Units 2 and 3 had one AEC-ACRS letter associated with its docket. The letter was issued on October 12, 1967 as a regular event in the course of a construction permit application process.

"At its ninetieth meeting, on October 5-7, 1967, the Advisory Committee on Reactor Safeguards completed its review of the application by Philadelphia Electric Company for authorization to construct the Peach Bottom Atomic Power Station Units No. 2 and 3.

This project was previously considered at ACRS Subcommittee meetings held at the Peach Bottom Atomic Power Station site on August 25, 1967, and in Washington, D.C., on September 20, 1967.

During its review, the Committee had the benefit of discussions with representatives of Philadelphia Electric Company, General Electric Company, Bechtel Corporation, and the AEC Regulatory Staff, as well as the documents listed below." (Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

This letter contained several items of concern to the ACRS. These concerns and their solution are presented in this subsection.

J.2.2 Browns Ferry ACRS Comments (3/14/67) Applicable to Peach Bottom "The Committee, in its letter to you of March 14, 1967, called attention to a number of matters that warrant careful consideration with regard to reactors of the Browns Ferry design, and other matters of significance for all large water-cooled power reactors. These matters apply similarly to Peach Bottom Units No.

2 and 3." (Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

The letter of March 14, 1967 discussing Browns Ferry Units 1 and 2 contained several items of concern to the ACRS. These concerns and their solution are presented in the next paragraphs.

J.2.2.1 Effects of Fuel Failure on CSCS Performance Concern "Analysis indicated that a large fraction of the reactor fuel elements may be expected to fail in certain loss of coolant accidents. The applicant states that the principal mode of failure is expected to be by localized perforation of the clad, and that damage within the fuel assembly of such nature or extent APPENDIX J J.2-1 REV. 25, APRIL 2015

PBAPS UFSAR as to interfere with heat removal sufficiently to cause clad melting would not occur. The Committee believes that additional evidence, both analytical and experimental, is needed and should be obtained to demonstrate that this model is adequately conservative for this power density and fuel burnup proposed."

(Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No.

50-259 and 50-260) The Committee believes that these matters are of significance for all large water-cooled power reactors, and warrant careful attention.

Resolution The proposed experimental investigation program of fuel failure mode is presented in a GE topical report(1) submitted to the AEC in April, 1968.

The objective of this test program is to demonstrate the ability of the CSCS's to prevent fuel cladding melting as a result of perforation and swelling in the cladding under the combination of temperature and internal pressure which prevail from the pre-accident fuel performance. The general plan of action is to simulate as closely as possible all of the significant aspects of the problem in out-of-pile tests, starting with single-rod tests, expanding to multi-rod, Zircaloy clad, simulated fuel assembly tests in air and under emergency core cooling conditions, and culminating with full-size assembly tests. This general plan is supplemented by individual phenomenon tests as might be required to corroborate specific points of the experiment or related analysis work.

Fuel clad perforation will occur when the gas pressure within the fuel rod exceeds the pressure the clad can withstand for that particular clad temperature. The mode of this failure is known.

The perforation will be local in that a given fuel rod will perforate at a particular location, the extent of which will be random in that it will occur at a particular, even a very slight, weak point along the fuel rod length-- probably at a point of clad flaw, pellet oversize or pellet chip, or point of slightly increased clad oxidation. Such weak points will be randomly distributed. However, the location of failures will be clustered about the point where peak heat flux is located, probably in a 2-or 3-ft region. The position that the perforation will be random and local has been supported by experiments observed on failed irradiated fuel. It has also been demonstrated in test loops by placing single Zircaloy tubes containing UO2 pellets with internal pressurization in an electric induction heating facility and observing the failure mode. The observed failures in this single rod test were always localized, of the order of 1 in in the axial direction and random along the length of the heated rod.

Furthermore, the analysis of the perforation test results showed APPENDIX J J.2-2 REV. 25, APRIL 2015

PBAPS UFSAR good agreement of clad stress at failure with ultimate stress at failure temperature. Additional research and development testing has been performed with a nine-rod section consisting of nine Zircaloy tubes with internal pressurization. These rods were heated internally by electrical means. The observed failures were again localized and did not block the flow passage enough to preclude effective cooling.

Since the fuel perforation will have the characteristics identified above, the overall geometry of the 49 rod fuel bundles which are 12 ft long essentially remain the same and analytical investigation based upon the preceding experimental observations indicate that the emergency core cooling function by either reactor core spray cooling or core flooding would not be adversely affected. A full length, internally pressurized, nine-rod Zircaloy clad heater assembly was tested under the postulated design basis loss-of-coolant conditions with core spray cooling.

A full-scale Zircaloy clad heater bundle with collars welded to the cladding to simulate actual perforations was then tested in both spray and flooding cooling modes. Finally, a single full-scale test was conducted with internally pressurized Zircaloy clad heater rods to approximate as closely as possible a postulated design LOCA in terms of heatup perforations and spray cooling.

The test program results were submitted to the AEC as a GE topical report(2) in July, 1970.

J.2.2.2 Effects of Fuel Bundle Flow Blockage Concern "The applicant considers the possibility of melting and subsequent disintegration of a portion of a fuel assembly, by inlet coolant orifice blockage or by other means, to be remote. However, the resulting effects in terms of fission product release, local high pressure production, and possible initiation of failure in adjacent fuel elements are not well known. Information should be developed to show that such an incident will not lead to unacceptable conditions." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260) The Committee believes that these matters are of significance for all large water-cooled power reactors, and warrant careful attention.

Resolution The resolution of the above concern item is presented in a GE topical report(1) submitted to the AEC in April, 1968.

Experience with fuel performance in operating reactors similar in design to this plant, together with appropriate core mechanical APPENDIX J J.2-3 REV. 25, APRIL 2015

PBAPS UFSAR analysis, has indicated that flow blockage during normal operation could only be local in nature and could not propagate to the extent that the remainder of the reactor core would be affected.

Calculation of hydraulic forces under flow blockage conditions had indicated that the fuel channels would remain intact.

Analytical study of data derived from experimental work with induced melting of UO2 at Argonne National Laboratory and Oak Ridge National Laboratory has indicated that melting of a portion of fuel assembly would not lead to unacceptable results in terms of fission product release, local high-pressure production or initiation of failure in adjacent assemblies.

The nature of potential flow blockages has been examined. An experimental program was conducted. The test program results were submitted to the AEC as GE Topical Report NEDO-10174, dated May, 1970.

J.2.2.3 Verification of Fuel Damage Limit Criterion Concern "A linear heat generation rate of 28 kw/ft is used by the applicant as a fuel element damage limit. Experimental verification of this criterion is incomplete, and the applicant plans to conduct additional tests. The Committee recommends that such tests include heat generation rates in excess of those calculated for the worst anticipated transient and fuel burnups comparable to the maximum expected in the reactor." (Brown Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260) The Committee believes that these matters are of significance for all large water-cooled power reactors, and warrant careful attention.

Resolution The resolution of the above concern item is presented in a GE topical report(1) submitted to the AEC in April, 1968.

GE believes that the data presently available is adequate to support the validity of the 28 kW/ft damage limit for the fuel supplied for the PBAPS (GE 1967 product line). The fuel design and the associated linear heat generation rate have been selected as a result of development programs and experience over the past 6 to 7 yr. These programs, combined with extensive, large BWR operating experience, have demonstrated with a high degree of confidence that fuel integrity can be maintained in 1967 product line BWR cores even for worst anticipated transients.

APPENDIX J J.2-4 REV. 25, APRIL 2015

PBAPS UFSAR GE has conducted fuel rod tests over a range of conditions to obtain data applicable to the design of this station. Test fuel rods have been operated at various levels, up to and including 28 kW/ft. These tests have verified that the calculational methods adequately predict the clad strain associated with a particular LHGR. In addition to tests performed by GE, tests in the range of 12 to 24 kW/ft have been performed by others.

Additional fuel tests are in progress as a development effort primarily to provide a basis for possible extensions in fuel technology. These data, as well as the operational history of BWR's placed in service prior to the operation of 1967 product line plants, will provide additional confirmation of the present design bases and will demonstrate operation at heat generation rates comparable to the worst anticipated transients for the 1967 product line.

A summary of the fuel test programs and their results is given in Amendment 14/15 of Dresden Nuclear Power Station, Units 2 and 3 (AEC Docket No. 50-237 and 50-249)

A GE topical report(3) was submitted to the AEC on the final results of the test programs in June, 1970.

J.2.2.4 Effects of Cladding Temperatures and Materials on CSCS Performance Concern "In a loss-of-coolant accident, the core spray systems are required to function effectively under circumstances in which some areas of fuel clad may have attained temperatures considerably higher than the maximum at which such sprays have been tested experimentally to date. The Committee understands that the applicant is conducting additional experiments, and urges that these be extended to temperatures as high as practicable. Use of stainless steel in these tests for simulation of the Zircaloy clad appears suitable, but some corroboration tests employing Zircaloy should be included." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution The proposed resolution of the above concern item is presented in a GE topical report(1) submitted to the AEC in April, 1968.

The GE experimental program on reactor core spray cooling effectiveness is currently in progress and extensive data and analysis of its results have been reported in a GE topical report(4) submitted to the AEC March, 1968. Experimental full-APPENDIX J J.2-5 REV. 25, APRIL 2015

PBAPS UFSAR scale fuel assemblies exactly like the ones being used in this plant, as well as in all the current GE 1967 product line BWR's, are being employed in this test program. These simulated fuel assemblies contain Calrod units inside the fuel rod cladding instead of nuclear fuel, and complete simulation of the hardware (nose piece, spacers, handle, channel box, etc) is incorporated.

The power in the assembly is also simulated (axial cosine heated Calrods, corner fuel rod peaking, decay heat variation in time).

Tests already conducted as of this date have encompassed fuel assembly powers in excess of those which will occur at Peach Bottom or Browns Ferry, and flows which are lower than those being provided for this plant. The results of those experiments confirm that the design basis of the reactor CSCS is firmly established as adequate.

The general approach being followed is to develop high temperature, Zircaloy clad, electrically heated fuel rod simulators and to use these to conduct full-size Zircaloy clad assembly tests. Testing conditions will be selected (1) to duplicate cooling modes, initial temperatures, coolant flow rate, power transients, subcooling temperatures, and time of cooling initiation representative of the multitude of tests performed with stainless steel clad heaters, and (2) to investigate emergency core cooling effectiveness at peak temperatures in excess of 2,500F, to the highest temperatures the heaters will permit. The first area of testing will be to corroborate use of models based on the wealth of stainless steel data obtained in the past, while the latter area of testing will be to extend the knowledge to higher temperatures as closely approaching the cladding melting limit temperature as possible.

A series of "low temperature" spray tests are being conducted to provide information on the correlation between stainless steel and Zircaloy assemblies. "High temperature" effects will also be investigated in the spray mode. In a manner similar to the spray tests, flooding-only tests will be conducted to provide correlation information with "low temperature" tests and to investigate high temperature effects. A single test was conducted early in this program to obtain scoping results under realistic high temperature conditions with combined spray flooding modes of cooling.

Several core spray distribution tests have recently been performed using simulated reactor CSCS spargers and "top-of-reactors" fuel assembly geometry which would be exposed to the spray action.

These tests, which measure the water entering each fuel assembly, show that the design flow distribution can be attained. Tests also included experiment with air updraft to simulate potential steam upflow. The data obtained to date and the forthcoming data APPENDIX J J.2-6 REV. 25, APRIL 2015

PBAPS UFSAR will make it possible to further refine the understanding of the core spray and core flood phenomena as well as increase the wealth of information now available to confirm that core spray is an effective means of accomplishing core cooling.

A GE topical report(2) on the heated rod-core cooling aspects of this test program was submitted to the AEC in July, 1970.

J.2.2.5 Quality Assurance and Inspection of the Reactor Primary System Concern "The Committee continues to emphasize the importance of quality assurance in fabrication of the primary system and of inspection during service life. Because of the higher power level and advanced thermal conditions in the Browns Ferry Units, these matters assume even greater importance. The Committee recommends that the applicant implement those improvements in primary system quality which are practical with current technology." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260) The Committee believes that these matters are of significance for all large water-cooled power reactors, and warrant careful attention.

Resolution Design and fabrication of the reactor coolant system was of the highest quality practicable with current technology. The reactor vessels are designed, fabricated, and inspected in accordance with the ASME Boiler and Pressure Vessel Code,Section III, Class A for nuclear vessels as follows:

Vessel ASME Code Applicable Peach Bottom Units 2 and 3 1965 + Winter '65 Addenda The following is a list of a number of specific requirements which have been applied to these vessels which exceed the applicable ASME code requirements. Inclusion of these features means that these vessels meet many important technical requirements of the Summer 1968 Addenda to Sections II and III of the ASME code.

1. 100 percent volumetric ultrasonic inspection of plates after forming and heat treating, and acceptance standards equal to the ASME 1968 Edition of Section III, para. N321.1. These requirements first appeared in the Winter 1967 Addenda.

APPENDIX J J.2-7 REV. 25, APRIL 2015

PBAPS UFSAR

2. 100 percent ultrasonic testing of main closure stud bushing nut and washer material following heat treatment and rough machining, acceptance standards prescribed are at least equal to N325.1 as specified in Winter 1967 Addenda and subsequently.

3. 100 percent liquid penetrant inspection of all cladding to acceptance standards at least equal to Winter 1967 Addenda and subsequently. The B&W liquid penetrant test procedure approved by GE fulfills the technical requirements of Appendix IX, Section 360.

4. Plate material is SA-302B. This material specification first appeared in Table N421 of the Summer 1967 Addenda and subsequently.

5. Low alloy steel forgings to ASTM A-508 in accord with ASME Code Case 1332-2, paragraph 5. This material first appeared in Table N421 of the Winter 1967 Addenda and subsequently.

6. Studs, nuts, bushings, and washers to ASTM A540 Grade B23 or 24 and to ASME Code Case 1335-2, para. 4. This specification first appeared in the Summer 1968 Addenda, Table N422.

7. CRD stub tubes of nickel-chronium-iron SB166 per Code Case 1336. This material first appeared in Table N423 of the Summer 1967 Addenda and subsequently.

8. Complete records so that each component can be related to the original material certification and the fabrication history, including the heat numbers, chemical composition and mechanical properties. See Section III, Appendix IX, paragraph 226, which first appeared in the Winter 1967 Addenda and subsequently.

9. Submission of non-destructive testing procedures for purchaser approval. See Section III, Appendix IX, paragraph 321.

10. Submission of detailed fabrication procedures for purchaser approval. See Appendix IX, paragraph 222.

11. Maintenance of quality control records for five years in at least the same detail as Appendix IX, paragraph 225 and continued maintenance as specified in the Summer 1968 Addendum to paragraph 225.

APPENDIX J J.2-8 REV. 25, APRIL 2015

PBAPS UFSAR

12. Nozzle safe ends are considered to be a part of the reactor vessel; this exceeds the requirements of Section III, paragraph N150 in the 1968 Edition.

13. Paragraph N141 of the Winter 1967 Addenda. Provides the authorized inspectors at the manufacturing site with a copy of the design specification before fabrication begins. This requirement has been fulfilled in the subject vessels.

14. Paragraph N143 of the Winter 1967 Addenda has likewise been fulfilled on the subject vessels by application of the GE Quality Control Plan No. 209, Rev. 4, which is incorporated in the purchase requirements. It should also be noted that this quality control plan closely parallels the administrative requirements of Appendix IX, Section 220, which first appeared in the Winter 1967 Addenda.

The design basis for other primary systems components incorporates a quality level which produces equal serviceability to that of the reactor vessel. This is accomplished by specifying these components to meet applicable codes (ASME Section III, Class C or ANSI B31.1).

The quality assurance program for both Bechtel and GE scope items is detailed in Appendix D of the FSAR and additional information is presented in Section 4.0. The details of the in-service inspection program are presented in Appendix I, "In-Service Inspection."

J.2.2.6 Control Rod Block Monitor Design Concern "The Rod Block Monitor system should be designed so that if bypassing is employed for purposes other than brief testing no single failure will impair the safety function." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution The rod block monitor system (RBMS) was incorporated for operational reasons for the purpose of backing up the reactor operator in preventing a single operator error or a single equipment malfunction from causing fuel damage, and it is felt that the level of reliability provided by the system is consistent APPENDIX J J.2-9 REV. 25, APRIL 2015

PBAPS UFSAR with this application. The applicant and GE do not consider this a safety system.

The control rod block action of the RBMS is not to be confused with the nuclear instrumentation system-APRM rod block function.

The APRM rod block is a bulk power control system. The RBM is a local power control system.

Refer to Section 7.0 of the FSAR for further details and description on this system.

The analyses detailed in Appendix G support the nonsafety status of this system by indicating that no unacceptable safety results are encountered because of a single operator error or single equipment failures associated with the control rod system assuming that the RBMS was completely unavailable.

An operational analysis was performed on this system. It demonstrated that an improbable event (a worst case rod pattern) plus five to seven operator and equipment malfunctions concurrently would only lead to an improbable failure of 150 fuel rods. This would not constitute a 10CFR20 dose event. The details of this analysis are presented in Dresden Amendment 19/20 (AEC Docket No. 50-237 and 50-245). Details of operator error analysis are given in Brunswick, Units 1 and 2, Supplement 5 (AEC Docket No. 50-324 and 50-325).

J.2.2.7 Plant Startup Program Concern "Considerable information should be available from operation of previously reviewed large boiling water reactors prior to operation of the Browns Ferry reactors. However, because the Browns Ferry Units are to operate at substantially higher power level and power density than those on which such experience will be obtained, an especially extensive and careful start-up program will be required. If the start-up program or the additional information on fuel behavior referred to earlier should fail to confirm adequately the designer's expectations, system modifications or restrictions on operation may be appropriate."

(Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No.

50-259 and 50-260)

APPENDIX J J.2-10 REV. 25, APRIL 2015

PBAPS UFSAR Resolution Refer to FSAR paragraph J.2.7.

J.2.2.8 Main Steam Line Isolation Valve Testing Under Simulated Accident Conditions Concern "Steam line isolation valves are provided which constitute an important safeguard in the event of failure of a steam line external to the containment. One or more valves identical to these will be tested under simulated accident conditions prior to a request for an operating license." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution GE implemented a program to test a full size main steam line isolation valve under simulated accident conditions. This research and development program involved (1) testing of valves on a small scale to permit evaluation of hydrodynamics of the blowdown under prototypical conditions; (2) testing of a valve essentially identical in design to those to be used in this plant simulating as closely as feasible the accident conditions; and (3) testing the main steam line isolation valves of this plant during the pre-operational test phase to verify that the valves as installed will meet functional requirements.

The detailed description of the program was presented in a GE topical report(1) submitted to the AEC in April, 1968. The testing programs have been successfully completed and reported in a GE topical report(5) submitted to the AEC in March, 1969. Analysis of the accident event is discussed in a GE topical report(6) submitted to the AEC in October, 1969.

Refer also to FSAR subsection 4.6.

J.2.2.9 Performance Testing of the Station Standby Diesel-Generator System Concern "The diesel-generator sets for emergency power appear to be fully loaded with little or no margin (on the design basis of one of three failing to start). They are required to start, synchronize, and carry load within less than thirty seconds. The applicant stated that tests will be conducted by the diesel manufacturer to demonstrate capability of meeting these requirements. Any APPENDIX J J.2-11 REV. 25, APRIL 2015

PBAPS UFSAR previously untried features, such as the method of synchronization, will be included in the tests. The results should be evaluated carefully by the AEC Regulatory Staff. In addition, the installed emergency generating system should be tested thoroughly under simulated emergency conditions prior to a request for an operating license." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

"The emergency power system originally provided for Units 1 and 2 has been redesigned and expanded to serve all three units. Four diesel-generators are now incorporated instead of three. The design as proposed appears marginally acceptable. Questions arise regarding the capacity of the diesel-generators and regarding the necessity for paralleling of generators at some time after an accident. Consideration should be given to improvement of the system. The Committee believes that these improvements should be resolved between the applicant and the Regulatory Staff."

(Browns Ferry Unit 3, ACRS Letter, 5/15/68, AEC Docket No. 50-296)

Resolution This concern does not apply to Peach Bottom. The details of the Peach Bottom diesel generator system are described in subsection 8.5 of the FSAR. The use of four diesel generators, each connected to individual emergency buses, avoids the necessity of synchronization or paralleling.

J.2.2.10 Formulation of an In-Service Inspection Program Concern "The Committee will wish to review the detailed in-service inspection program at the time of request for an operating license." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution The in-service inspection program planned for the facility is described in Appendix I, "In-Service Inspection."

J.2.2.11 Diversification of the CSCS Initiation Signals Concern "Also, he will explore further possibilities for improvement, particularly by diversification, of the instrumentation that initiates emergency core cooling, to provide additional assurance APPENDIX J J.2-12 REV. 25, APRIL 2015

PBAPS UFSAR against delay of this vital function." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution The preliminary design of sensors of the CSCS equipment consisted of a reactor vessel low water signal from either of two independent instrumentation sources to activate the pumping equipment. Further studies were conducted to ascertain whether reliability could be improved by utilizing alternate or improved sensors. As a result of these studies, instrumentation which detects high pressure in the drywell has been incorporated in addition to the reactor low water level instruments to actuate reactor core spray cooling, HPCI and LPCI, and the standby diesel generator systems.

Diversity of sensors which perform interlocking action of the CSCS pumps has also been incorporated into the design; that is, two different types of pressure interlock sensors, bellows-type and bourdon-tube type, are used for this function in order to circumvent any unknown phenomenological uncertainties associated with pressure parameter measurements.

Diverse sensors (bourdon pressure switches and bellows pressure switches) which perform interlocking action of the CSCS pumps have been upgraded to analog transmitter/trip unit devices.

Replacement of the mechanical switches provides greater setpoint accuracy, simplified calibration and test procedures, and reduced probability of inadvertent interlocking action because of improved calibration techniques.

The transmitter/trip units continue to meet all applicable design requirements for CSCS systems.

J.2.2.12 Control Systems for Emergency Power Concern "The applicant stated that the control systems for emergency power will be designated and tested in accordance with standards for reactor protection systems." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution Class 1E electrical systems provide emergency power to Peach Bottom Units 2 and 3. The AC and DC subsystems are each divided into redundant systems with independent control systems. These control systems are designed and tested in a manner which meets APPENDIX J J.2-13 REV. 25, APRIL 2015

PBAPS UFSAR the requirements of the IEEE criteria for Class 1E electrical systems and the applicable sections of IEEE-279. These tests will show that the AC and DC subsystems meet the intent of the requirements of both these IEEE documents. Further information on the control system is found in subsection 8.5 of the FSAR.

J.2.2.13 Misorientation of Fuel Assemblies Concern "Operation with a fuel assembly having an improper angular orientation could result in local thermal conditions that exceed by a substantial margin the design thermal operating limits. The applicant stated that he is continuing to investigate more positive means for precluding possible misorientation of fuel assemblies." (Browns Ferry Units 1 and 2, ACRS Letter, 3/14/67, AEC Docket No. 50-259 and 50-260)

Resolution Operation with a misoriented fuel assembly would be an economic rather than a safety concern. Analyses have shown that less then 10 fuel rods in a misoriented assembly would experience a MCHFR less than 1.9. Under normal operating conditions, these 10 fuel rods would, even in the peak power position, remain at a MCHFR greater than 1.0 and peak LHGR less than 28 kW/ft.

Studies into means of precluding possible fuel misorientation have been completed. It is concluded that the present method of procedural controls is the most desirable of the alternatives.

Fuel handling operations at operating GE BWR's have shown this to be an efficient, effective method.

Various mechanical devices to prevent inserting a misoriented fuel assembly were also studied and eventually discarded. These devices tended to provide greater potentials for fuel damage during loading and storage operations than the misorientation they were designed to prevent. Visual identification has been successfully used in all BWR's operated to date to provide assurance of fuel location and orientation. Photos taken of the KRB core after the initial fuel loading clearly showed four different means of identifying a misoriented fuel assembly:

1. All assembly numbers point towards the center of the cell

2. Spring-clip assemblies all face the control rod

3. Lugs on the handles point towards the control rods APPENDIX J J.2-14 REV. 25, APRIL 2015

PBAPS UFSAR

4. Cell-to-cell replication.

Experience has demonstrated that these design features are visible so that any misoriented fuel assembly would be readily identifiable during core loading verification. As a result of this study and the accumulated fuel handling experience, no further work with respect to providing an alternate means of preventing fuel assembly misorientation is planned. Refer to Section 3.0 of the FSAR for further details.

An analysis of the peak cladding temperature following a design basis LOCA using worst case conditions in accordance with the Interim Acceptance Criteria, with various fuel manufacturing or fuel loading errors, has been performed for Peach Bottom Units 2 and 3. Table J.2.1 presents the results of these calculations in terms of maximum delta temperatures which should be added to the peak cladding temperature shown in Table J.2.2.

It can be seen that the maximum peak cladding temperatures with fuel loading or manufacturing errors are less than 2,300F.

J.2.3 Failure of Conowingo Dam - Alternate Heat Removal Capability Concern "In the unlikely event of failure of Conowingo Dam, the normal source of cooling water for the two units would no longer be available. The applicant described several possible schemes for removing shutdown heat from the plant in the event that the reservoir level should fall below the normal cooling water inlet.

Such a system should be designed and constructed to the same criteria as applied to other Class I structures in the plant. The design of this system should be reviewed by the Regulatory Staff."

(Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No.

50-277 and 50-278)

Resolution The details of the design and operation of the emergency heat sink are described in subsection 10.24. Loss of the normal heat sink would not prevent safely shutting down the reactors and maintaining the units safely shut down. Sensible and decay heat removal would be accomplished using the emergency cooling tower and the 3.7 million-gal cooling tower basin with the high pressure and emergency service water systems.

APPENDIX J J.2-15 REV. 25, APRIL 2015

PBAPS UFSAR J.2.4 Ring Header Leakage Protection Capability Concern "The present design of the units includes a ring header to supply water from the torus to the emergency core cooling systems. The applicant discussed a possible modification intended to simplify the piping and reduce susceptibility to single point failure. The Committee believes that this matter should be resolved between the applicant and the Regulatory Staff." (Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

Resolution In view of this expressed ACRS concern, the ring header has been deleted from the plant design. Details of the design changes implemented are described in paragraph J.3.4.2.

J.2.5 Station Thermal Effects - Commonwealth of Pennsylvania Limits Concern "To meet water temperature criteria of the Commonwealth of Pennsylvania, the use of cooling towers may be required for plant cooling water. A hydraulic model of the Conowingo Reservoir has been built and is being tested to determine how the criteria will be met. The Committee believes that one or more of the possible arrangements of cooling towers could be installed without adverse effects on the health and safety of the public, and that this matter can be resolved between the applicant and the Regulatory Staff." (Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

Resolution Units 2 and 3 use five mechanical-draft cooling towers consisting of multi-cell units to limit the temperature of the cooling water discharge to the pond. Details of the cooling tower design are presented in paragraph 12.2.11 of the FSAR, and information on the operation of the circulating water system and cooling towers is presented in subsection 11.6.

J.2.6 HPCIS - Depressurization Capability Concern "The film condensation coefficient used to predict the depressurization performance of the High Pressure Coolant APPENDIX J J.2-16 REV. 25, APRIL 2015

PBAPS UFSAR Injection (HPCI) system is based on extrapolation of available heat transfer data. Additional experiments or other supporting studies are needed to confirm the effectiveness of the HPCI system, and the results should be reviewed by the Regulatory Staff." (Peach Bottom, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

Resolution The resolution of the above concern item is presented in a GE topical report(1) submitted to the AEC in April, 1968.

The function of the HPCIS is to provide coolant makeup to the reactor vessel to keep the reactor core covered and cooled for small system breaks. The HPCIS also depressurizes the reactor so that the LPCIS or the reactor core spray system in the CSCS network can become effective for somewhat larger breaks than can be handled entirely by HPCIS inventory makeup. An analytical model based upon solution to the mass and energy balances for the system assuming thermodynamic equilibrium is used to predict the depressurization characteristics due to HPCIS operation. Because equilibrium does not actually exist, a calculated "mixing efficiency" is used to represent how nearly the injected subcooled water is raised to the temperature of the reactor vessel fluids.

Engineering tests were conducted in which subcooled water was injected into a constant volume, high-pressure steamwater system designed to simulate reactor conditions and geometry.

Depressurization rate, inlet, and fluid temperatures were measured. An overall mixing efficiency was evaluated. A sufficient range of variables were included in the tests such as to determine a mixing efficiency for each reactor primary system.

Refer to Section 6.0 of this FSAR for further details.

The results and successful completion of this test program were submitted to the AEC in a GE topical report(7) in June, 1969.

J.2.7 Station Startup Program Concern "As in the case of the Browns Ferry units, a careful startup program will be required. If the startup program or additional information on fuel behavior fail to confirm adequately the design basis, system modifications or restrictions on operation may be approporate." (Peach Bottom Units 2 and 3, ACRS Letter, 10/12/67, AEC Docket No. 50-277 and 50-278)

APPENDIX J J.2-17 REV. 25, APRIL 2015

PBAPS UFSAR Resolution The extent and scope of the startup program for this plant will reflect consideration appropriate for the size of the reactor and the thermal characteristics, service or transient conditions which might affect fuel integrity, reactor control and response characteristics, and functional performance of safeguard features contained in the plant design.

In particular, extensive surveys of reactor core power distribution will be performed during the initial approach to reactor power. It is expected that this program will demonstrate that power distributions, as good as or better than predicted, will be realized. Appropriate steps will be taken to ensure that safety margins are maintained under operational conditions.

A step-by-step power level approach to 3,293 MWt is planned.

A GE topical report(8) was submitted to the AEC on a summary of results obtained from a typical startup and power test program for a GE BWR in February, 1969.

Refer to FSAR Section 13.0 for further details of the startup program.

J.2.8 Conclusions The above concern items have been or will be resolved prior to the initial operation of the PBAPS Units 2 and 3, and the resolution will assure that these items have no adverse effect on the health and safety of the public.

APPENDIX J J.2-18 REV. 25, APRIL 2015

PBAPS UFSAR J.2 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3--

AEC-ACRS CONSTRUCTION PERMIT LETTER REFERENCES

1. Bray, A. P., et al, "The General Electric Company Analytical and Experimental Programs for Resolution of ACRS Safety Concerns," General Electric Company, APED-5608, April, 1968.

2. Liffengren, D. J., "Effects of Cladding Temperatures and Material on ECCS Performance," General Electric Company, NEDO-10179, June, 1970.

3. "Current State of Knowledge of High Performance BWR Zircaloy-Clad UO2 Fuel," General Electric Company, NEDO-10173, May, 1970.

4. Ianni, P. W., "Effectiveness of Core Standby Cooling Systems for General Electric BWR," General Electric Company, APED-5458, March, 1968.

5. Rockwell, D. A. and Van Zylstra, E. H., "Design and Performance of GE-BWR Main Steam Line Isolation Valves,"

General Electric Company, APED-5750, March, 1969.

6. Rockwell, D. A., "Consequences of a Main Steam Line Break for a GE-BWR," General Electric Company, NEDO-10045, October, 1969.

7. Rogers, A. E. and Torbeck, J. E., "Depressurization Performance of the GE-BWR-HPCIS," General Electric Company, APED-5447, June, 1969.

8. "Summary of Results Obtained from a Typical Start-Up and Power Test Program for a GE-BWR," General Electric Company, APED-5698, February, 1969.

APPENDIX J J.2-19 REV. 25, APRIL 2015

PBAPS UFSAR TABLE J.2.1

SUMMARY

OF DESIGN BASIS LOCA CALCULATIONS WITH FUEL LOADING ERRORS Maximum Error T (F)

Improper Location +40 (Fuel Assembly)

Improper Orientation +60 (Fuel Assembly)

Error in Gadolinia Concentration +135 Improper Gadolinia Rod Position +160 APPENDIX J J.2-20 REV. 21, APRIL 2007

PBAPS UFSAR TABLE J.2.2 PEAK CLADDING TEMPERATURES DESIGN BASIS LOCA Final Fuel Interim Acceptance Criteria Analysis Table 6.7.1 Design

1. LPCI Failure 2090 1990

2. Diesel Generator Failure 1930 1850 APPENDIX J J.2-21 REV. 21, APRIL 2007

PBAPS UFSAR J.3 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3--

AEC-STAFF CONSTRUCTION PERMIT SAFETY EVALUATION REPORT J.3.1 General The AEC-Staff - Construction Permit Safety Evaluation Report (SER) of November 7, 1967 identified several areas of specific concerns.

The concerns of each of the following are discussed in the following paragraphs.

J.3.2 AEC-Staff SER Section 2.0 Concerns J.3.2.1 Introduction The following AEC-Staff statements are recorded in Section 2.0 of the SER. The appropriateness and resolution of the statements to the Peach Bottom design are given below.

J.3.2.2 RPS - IEEE-279 Design Statement "The proposed reactor protection system, including the Rod Block Monitor, and the instrumentation which actuates engineered safety features will conform to the proposed IEEE standard. The design of these systems, however, is complex and will undergo a continuing review to ensure that it does, in fact, conform to the standard. At this point in the licensing process, we believe the proposed instrumentation system is acceptable." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The RPS is designed to conform to the IEEE-279 requirements. The CSCSs are also designed in accordance with the IEEE-279 standard (as discussed in paragraph J.5.6).

The RBM is not designed to conform to IEEE-279 requirements. Its design does include all but a limited number of restrictions.

Please refer to Brunswick 1/2, Supplements 5 and 6 (AEC Docket No.

50-324 and 50-325), Dresden 2/3, Amendments 17/18 and 19/20 (AEC Docket No. 50-321), where events of greater magnitude than a single operator error or a single equipment malfunction must occur to allow any fuel integrity risk.

The RBMS is discussed in paragraph J.2.2.6.

APPENDIX J J.3-1 REV. 21, APRIL 2007

PBAPS UFSAR J.3.3 AEC-Staff SER Section 3.0 Concerns J.3.3.1 Introduction The following AEC-Staff statements are recorded in Section 3.0 of the SER. The appropriateness and resolution of the statements to the Peach Bottom design are presented in the following paragraphs.

J.3.3.2 Station Meteorological Program Statement "To obtain data on wind regimes above the river valley, the applicant proposes to instrument an existing microwave tower located on a hill immediately adjacent to the proposed plant.

This tower rises to an elevation of approximately 815 feet mean sea level (MSL), or about 250 feet above the highest elevation on the site boundary. Continuous recordings of wind direction, wind speed, and temperature will be taken at several levels. The planned meteorological program will also include measurement of wind direction fluctuation, humidity, precipitation, and barometric pressure. To learn more about wind flow over the Conowingo Reservoir, additional wind measurements will be made by instruments mounted on the transmission tower located on Mount Johnson Island, which is situated in Conowingo Reservoir about 1-1/4 miles from the site.

We believe that data to be taken to the new meteorological monitoring program will show that the atmospheric diffusion assumptions used by us to estimate accident doses are conservative." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The station meteorological program is discussed in the FSAR, Section 2.0.

J.3.3.3 Station-Site Slope Cut Program Studies Statement "Extensive rock cuts will be required for site development.

Because of the geological characteristics of the rock, post excavation consideration of the detailed relationship between rock cut slopes and rock structure will be necessary to ensure stability of the final slopes dipping toward the plant. In Supplement I (question 2.2.2), the applicant indicated that tentative slopes of 1/2-horizontal to 1-vertical had been APPENDIX J J.3-2 REV. 21, APRIL 2007

PBAPS UFSAR established for rock cuts and benches. Further, the applicant has stated that to assure stability of the final slope, the slope design is subject to change based on experience as the work progresses. Following excavation, rock bolts, trim and removal of loose rock, and slope flattening will be undertaken as required.

We and our consultant, the U.S. Geological Survey (Appendix D),

are satisfied with this approach, and believe that necessary slope design modifications are within the limits of standard engineering practice. Our seismic design consultants, Drs. N.M. Newmark and W.J. Hall, also agree with this approach (Appendix F); however, they believe that a slope stability analysis should be performed.

This analysis should include earthquake effects for any surfaces from which slides might occur that could seriously damage the plant and affect the capability for safe shutdown. The applicant has agreed to perform the recommended slope stability analysis, and will correct the slope characteristics if any area of instability is noted. We will review this analysis." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution A description of the slope stability analysis is contained in subsection 2.9 of the FSAR.

J.3.3.4 Station-Site Flood Protection Studies Statement "A postulated failure of Holtwood Dam was analyzed, patterned after the type of failure experienced in 1900 at Austin, Texas, of a dam similar in shape and height to Holtwood. The Austin dam was a cemented masonry rubble structure, whereas Holtwood is cast-in-place concrete. The Austin dam failed in shear, wherein 50 percent of the dam length shifted 50 feet downstream. In its flood analysis, the applicant postulated a similar mode of failure of Holtwood Dam. Our review of the modes of dam failures indicates that this postulation provides a reasonable basis for estimating the water level at the site for such an event.

Considering possible reduction of peak flow by storage in flood control reservoirs, the applicant estimated a maximum probable flood discharge at Conowingo of 1,170,000 cfs. Under this flood condition, and a concurrent postulated failure of Holtwood Dam, the applicant estimated a total maximum river flow of 1,370,000 cfs. Based on this flow, the applicant's preliminary analysis predicts a potential peak flood elevation at the site of 126 feet MSL (plant grade is 115.5 feet MSL).

APPENDIX J J.3-3 REV. 21, APRIL 2007

PBAPS UFSAR The applicant has agreed to provide flood protection for all critical equipment required for a safe shutdown of the plant to an elevation of approximately 126 feet MSL, plus one-foot freeboard.

Flood protection measures being considered include the use of barricades, barriers, elevated pedestals, or the location of equipment in protected areas. The plant grade will slope upward from the reservoir at an elevation of 115.5 feet MSL to an elevation of about 135 feet MSL. Some critical equipment will be relocated to this higher plant elevation.

We are satisfied with the preliminary results of the flood analysis for a postulated failure of Holtwood Dam concurrent with the maximum probable flood, and the applicant's plans to conduct detailed studies to verify the potential flood level from this postulated flood. The flood height determined from these studies, plus one-foot freeboard will establish the flood protection levels for the site. These studies will be reviewed by the staff and its hydrological consultant." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The plant is protected from the effects of floods to a level of 127-0 ft (including 1 ft of freeboard for wave splash) so that the plant can be safely maintained in the shutdown condition. Details of flood protection afforded the various structures required for safe shutdown of the plant are found in Section 12.0.

J.3.3.5 Station-Site Diffusion and Dispersion Studies -

Radiological Effects Determination Statement "Characteristics of the diffusion and dispersion of liquid effluents into Conowingo Reservoir will be obtained from a program of analytical and hydraulic model studies. This program will involve the use of diffusion data obtained from dye tracer field studies conducted in Conowingo Reservoir in 1959 and 1960, prior to the operation of the Muddy Run pumped storage hydro-plant.

This previous study will be augmented by using a hydraulic model to determine the path of heated or contaminated effluent in Conowingo Reservoir under various conditions of operation of the Holtwood, Muddy Run, and Conowingo hydro-plants. The model of Conowingo Reservoir representing the entire area from Conowingo Dam upstream to Holtwood Dam has been constructed at the Alden Research Laboratories of the Worchester Polytechnic Institute.

These analytical and model studies to predict the concentration of effluents in Conowingo Reservoir have not been completed.

However, the results will be available prior to the operating license stage, and will be reviewed by the staff." (Peach Bottom APPENDIX J J.3-4 REV. 21, APRIL 2007

PBAPS UFSAR Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The results of these studies are reported in subsection 2.4 of the FSAR.

J.3.3.6 Station Alternative Heat Sink in Event of Dam Failure -

Design Capability Statement "In the unlikely event of a catastrophic failure of Conowingo Dam, the normal source of condenser cooling water for the Peach Bottom Units 2 and 3 would become unavailable. The applicant is investigating the most desirable means for supplying a heat sink to satisfy plant shutdown cooling requirements in the event that the reservoir level should fall below the normal plant cooling water intake. Although the system has not been selected or developed in detail, several methods are being considered."

(Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The resolution of this concern is described in paragraph J.2.3.

J.3.4 AEC-Staff SER Section 4.0 Concerns J.3.4.1 Introduction The following AEC-Staff statements applicable to safety matters common to GE BWR's are recorded in Section 4.0 of the SER. The appropriateness and resolution of the statements to the Peach Bottom design are presented in the following paragraphs.

J.3.4.2 Suction Piping System Supply Water to ECCS (CSCS) -

Design Aspects Statement "The piping system supplying water from the torus to the ECCS will be designed, constructed, tested, and inspected as part of the primary containment boundary. However, we believe that this ring header-piping complex, as presently designed, is susceptible to a single point failure, although we agree that failure of this system is of a low order of probability. Nevertheless, a moderate sized leak, or failure in the system supplying water to the ECCS pumps could result in potentially severe consequences. Since APPENDIX J J.3-5 REV. 21, APRIL 2007

PBAPS UFSAR isolation valves are located only at the pumps, a leak or failure in any portion of the interconnected suction piping, up to the isolation valves at the inlet of the pumps, would result in a loss of the torus water supply. This loss of water would lead to flooding of the ECCS pumps, resulting in a loss of emergency core cooling capability. Although the condensate water storage tank can serve as an alternate water supply, it does not have sufficient capacity over the long term.

To remove core decay heat following a loss-of-coolant accident, the ECCS would be required to function for a considerable period of time. We believe that the emergency core cooling systems should provide the capability for accommodating a failure in a portion of the system without losing the capability of the remainder of the system, or other systems to deliver water to the core.

We have reviewed the problem with respect to the loss of the ECCS water supply, and believe that suitable modifications can be made.

For example, in Oyster Creek, a modification has been proposed which will assure sufficient pump suction pressure to permit continued operation of the ECCS, even with a leak or failure in the suction piping system. This is accomplished by making the compartments in which the torus and ECCS pumps are located watertight. Thus, leakage into one compartment would not cause flooding of the others. The applicant has agreed (Amendment 4) to investigate modifications which would reduce the susceptibility of the system supplying water to the ECCS to a single point failure.

Included in the applicant's studies is a modification similar to that proposed in Oyster Creek. The applicant is also studying various valving arrangements which would permit isolation of the coolant pumps. These proposed modifications are acceptable alternates.

We believe that the resolution of this matter is within the capability of conventional engineering practices. When the modification proposed by the applicant is complete, it will be reviewed by the staff." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The Peach Bottom Units 2 and 3 ECCS piping has been modified to delete the ring header; each pump has a separate suction line.

The torus cavity and all ECCS pump rooms are leaktight as required up to at least 1 ft above the water level in the torus so that any postulated leakage from the ECCS piping during post-accident recovery conditions, with the primary containment at or near atmospheric pressure, would not affect other ECCS equipment rooms.

Instrumentation is provided to detect any significant leakage in APPENDIX J J.3-6 REV. 21, APRIL 2007

PBAPS UFSAR the torus cavity and all ECCS pump rooms. ECCS/Torus Room closures may be opened without jeopardizing watertight integrity provided a dedicated floodwatch is posted.

No more than one ECCS pump can be flooded due to a single failure in the ECCS piping. In the case of leakage into any one ECCS pump room, or into the torus cavity, the water level in the torus and the pump room or torus cavity will equalize at a level slightly lower than that required to maintain adequate suction head.

However, the high pressure service water pumps can raise the water level within a very short time. A cross tie to the RHRS is provided to accomplish this, thereby ensuring an inexhaustible supply of water from the high pressure service water pumps. The high pressure service water addition will be terminated at the normal water level in the torus so that spillage into the adjacent ECCS pump rooms will not occur.

J.3.4.3 Adequacy of HPCIS as a Depressurizer Statement "In our opinion, the principle of using the HPCI system to depressurize the reactor has been satisfactorily demonstrated for this stage of the review. However, we believe that during the detailed design phase, additional studies or experiments should be conducted to refine the HPCI mixing efficiency analysis model.

We expect that the adequacy of the HPCI system depressurization function will be demonstrated prior to the operation of Peach Bottom Units 2 and 3. We believe there are alternate ways of depressurizing the reactor in the event of an intermediate sized break in the primary coolant system. For example, the relief valves (see Section 2.2 of this report) which pass steam to the pressure suppression chamber, can be programmed to cut-in if the depressurization is not rapid enough." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Refer to paragraph J.2.6 for the detailed resolution of this concern.

J.3.4.4 Engineered Safety Features - Electrical Equipment Inside Primary Containment - Design Capabilities Statement "Electrical equipment which must operate inside the primary containment in an accident environment is limited to cables and operators for isolation valves. These circuits have to function APPENDIX J J.3-7 REV. 21, APRIL 2007

PBAPS UFSAR only long enough to operate the valves. Each valve is designed to fail "as is" or closed (safe failure). A circuit failure after the valve has closed will be a safe failure. In addition to designing the equipment to withstand the accident environment long enough to operate the valves, the applicant has agreed to perform environmental testing. In supplement 2 of the PSAR, the applicant stated that the manufacturers will be required to test a sample of cable and a motor operator of the type to be installed in the Peach Bottom primary containment. The tests will demonstrate that the material and equipment will survive the accident conditions of simultaneous pressure, temperature, and humidity for a period of time essential for their operation. This arrangement will satisfy our requirements." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Tests have been completed on cables and operators for isolation valves, recirculation line valves, and relief valves. The test results indicate the capability of the equipment to meet or exceed the design requirements and to function while under postulated accident conditions.

Refer to Millstone Unit 1, Amendment 18 for the complete report on the GE NSSS equipment capability. This information is directly applicable to the Peach Bottom facility.

Refer to paragraph 7.3.4.9 of the FSAR for additional information on design and test requirements of the cables and motor operators.

J.3.5 AEC-Staff SER Section 5.0 Concerns J.3.5.1 Introduction The following AEC-Staff statements regarding design basis accidents are recorded in Section 5.0 of the SER. The appropriateness and resolution of the statements to the Peach Bottom design are presented in the following paragraph.

J.3.5.2 Steam Line Break Fuel Rod Integrity - Thermal Hydraulic Analytical Justification Statement "The calculated doses resulting from the steam-line-break accident are a function of the closing time of the steam line isolation valves, and the assumptions used in the blowdown model. Based on the applicant's blowdown model, no fuel cladding perforations would occur for a valve closing time of three seconds. Thus, the activity would be that from residual fission products contained in APPENDIX J J.3-8 REV. 21, APRIL 2007

PBAPS UFSAR the reactor water prior to the accident. For a longer valve closing time, an excessive number of rods would perforate, increasing the fission product release activity. The steam-line isolation valves have been designed with the capability to close in a minimum of three seconds. The General Electric Company will conduct tests to verify isolation valve closure times as discussed in Section 6.2 of this Evaluation." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Refer to paragraph J.2.2.8 for the detailed resolution of this concern.

J.3.6 AEC-Staff SER Section 6.0 Concerns J.3.6.1 Introduction The following AEC-Staff statements regarding research and development programs relative to BWR concerns are recorded in Section 2.0 of the SER. The resolutions to the appropriate concerns are presented in the following paragraphs.

J.3.6.2 Development Program of Significance for All Large Water-Cooled Power Reactors

a. Linear Heat Generation Rate - Fuel Damage Limit Statement "A linear heat generation rate of 28 kilowatts per foot is used by the applicant as a fuel element damage limit. In Supplement 1 of the PSAR, the applicant outlined a fuel element test program which will cover the worst anticipated transient heat generation rates, and maximum expected fuel burnup. Test fuel rods have been operated at various linear heat generation levels, and have verified calculational models. Additional work is planned which includes experience with high burnup of fuel (20,000 to 30,000 MWD/T) and long-term operation at high linear heat generation rates, of capsules as well as complete fuel assemblies. These tests cover the spectrum of anticipated operating conditions of Units 2 and 3, and thus we believe that the work done to date and anticipated will solve outstanding questions in this area. The results of this test program are expected to become available prior to the date proposed for initial operation of Units 2 and 3." (Peach Bottom, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

APPENDIX J J.3-9 REV. 21, APRIL 2007

PBAPS UFSAR Resolution Refer to paragraph J.2.2.3.

b. Local Fuel Melting Resulting from Inlet Coolant Orifice Blockage Statement "The applicant has discussed this topic in Supplement 1 to the PSAR, indicating the flow blockage during normal operation is local in nature, and cannot propagate to affect the remainder of the core. Nevertheless the applicant has stated that additional analytical and experimental work will be conducted to confirm the results of previous studies." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Refer to paragraph J.2.2.2.

c. Effect of Fuel Clad Failure on Emergency Core Cooling Statement "The applicant has discussed this topic in Supplement 1 of the PSAR. Based upon analytical and experimental work done to date, clad perforation occurs at a localized area of a fuel rod.

Perforation is caused by high internal pressure and the point at which perforation occurs is random, depending upon a weak point in the rod. Further experimental and analytical work will be continued in order to confirm and further refine the understanding of this fuel damage model. This work will include further perforation tests of fuel cladding under various conditions of temperature, pressure, and metal ductility, further heat transfer analysis of fuel bundles under accident conditions, and other tests as appropriate. Based upon the work done to date and the scope and schedule for the test programs we believe there is reasonable assurance that this area will be satisfactorily resolved prior to the date proposed for initial operation of Peach Bottom Units 2 and 3." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

APPENDIX J J.3-10 REV. 21, APRIL 2007

PBAPS UFSAR Resolution Refer to paragraph J.2.2.1.

J.3.6.3 Development Program of Significance for BWR's in General

a. Core Spray Effectiveness Statement "The applicant has stated that analytical and test work is currently under way to optimize the core spray systems for the Tarapur, Oyster Creek, Nine Mile Point, Dresden Units 2 and 3, Millstone, and Browns Ferry reactors. Application of the core spray system to the Peach Bottom reactors will be based on the results of this development work. Appendix E of the PSAR provides a summary of the core spray test program.

To date, core spray tests have been conducted at fuel bundle powers greater than expected in Peach Bottom or Browns Ferry, and at water flow rates lower than what will be provided for these plants. The latest results on core spray tests have been reported in Supplement 1 of the PSAR. These latest 49-rod fuel bundle tests indicate that wetting of both sides of a fuel bundle channel by the core spray flow can reduce peak clad temperatures significantly. Future experimental work will include testing at higher fuel temperatures and using zircaloy rather than stainless steel clad so as to more closely simulate actual reactor condition. Tests have also been done and will continue on spray distribution over a simulated reactor core. In view of the effort expended on this matter to date and the plans for continued work, we believe that this matter will be resolved prior to the date proposed for initial operation of Peach Bottom." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Refer to paragraph J.2.2.4.

b. Steam Line Isolation Valve Testing Under Simulated Accident Conditions Statement "General Electric Company is currently developing a program to test the function and closure time of main steam line isolation APPENDIX J J.3-11 REV. 21, APRIL 2007

PBAPS UFSAR valves under simulated accident conditions. It is anticipated that this testing program will include testing of valves on a small scale to permit evaluation of hydrodynamics of the blowdown under prototypical conditions; testing of valves identical in design in other boiling water reactors simulating as closely as feasible the accident conditions; and testing the steam line isolation valves during the pre-operational test phase to verify that the valves as installed will meet all functional requirements.

The results of these tests are expected to satisfactorily demonstrate the performance characteristics of the steam isolation valves. We expect that this matter will be satisfactorily resolved prior to the date proposed for initial operation of Peach Bottom Units 2 and 3." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution Refer to paragraph J.2.2.8.

c. Control Rod Worth Minimizer Statement "The applicant has stated that the basic system will have been tested, installed and operated on the Tarapur, Oyster Creek, Nine Mile Point, Dresden Unit 2 and 3 and the Millstone reactors prior to the use at Peach Bottom. A prototype system was installed in early 1965 in Dresden Unit 1 for test purposes.

We expect that the operating data that will be forthcoming from these reactor plants will be sufficient to determine the adequacy of the rod worth minimizer for Peach Bottom." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The design of the rod worth minimizer (RWM) is complete as reported in a GE topical report(1) submitted to the AEC in March, 1967. The RWM is described in detail in FSAR subsection 7.16. A summary of experience follows.

The RWM was first used on Tarapur 1 & 2, and has been used on all GE BWR's since that time. Early versions consisted of a separate computer containing only the RWM function; currently, the RWM is imbedded in the plant process computer. Experience to date has indicated that the concept is sound and the programming of the system meets the design basis. Difficulties have been experienced APPENDIX J J.3-12 REV. 21, APRIL 2007

PBAPS UFSAR with earlier applications. These problems were, in general, due to hardware generating the necessary information for the RWM.

A current example of operability of this system is the Quad Cities I startup testing and operator training. The RWM was placed in operation at this plant October 7, 1971. From this time to the date of the report (January 26, 1972) the RWM was "adjudged excellent" by the manager of startup test operations. During this period a total of 5 1/2 hr of down time was experienced due to system failure, 4 hr with a voltage regulator board and 1 1/2 hr with a control rod identification circuit problem.

The rod worth minimizer has been replaced but is still part of the plant computer (PMS).

d. Control Rod Velocity Limiter Statement "The rod velocity limiter, which is designed to limit the free-fall velocity of a control rod, is being tested. This device will also have been tested during the pre-operational test phase in other boiling water reactors prior to its application in Peach Bottom." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The design and final test program of the control rod velocity limiter is complete as reported in a GE topical report(2) submitted to the AEC in March, 1967. Further details may be found in FSAR subsection 3.4.

e. In-Core Neutron Monitor System Statement "In-core startup and power neutron detectors have been developed to reduce neutron source requirements and to improve neutron flux monitoring capability in the startup and power ranges. Testing of these devices is presently being done in the Consumers Power Company's Big Rock Point reactor. The applicant has stated that the in-core detectors in this reactor have given excellent results and demonstrated satisfactory sensitivities in repeated counting cycles through subcritical and critical operation and have demonstrated counting ability during hot startup after a scram. A life test will also be conducted to demonstrate the feasibility of leaving the chambers in the high flux regions continuously.

Identical chambers will have been in operation in both Jersey Central's Oyster Creek reactor and Niagara Mohawk's Nine-Mile APPENDIX J J.3-13 REV. 21, APRIL 2007

PBAPS UFSAR Point reactor for several years before the first unit of this plant is operational.

Because of the experience described, satisfactory in-core testing will have been conducted to demonstrate the adequacy of these monitors prior to operation of Peach Bottom." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The design and adequate performance demonstration of the in-core nuclear instrumentation system is complete and is reported in a set of GE topical reports(3),(4) submitted to the AEC in August, 1968 and November, 1968, respectively. Refer to FSAR subsection 7.5 for supplementary information in addition to the experience summary which follows.

The incore sensors that are currently being employed in the GE BWR are of two types: one, (Model NA06) which has a gas flow path between the sensitive volume of the detector and the alumina insulated solid sheath cable, and the second, an improved higher linearity design (Model NA100) in which there is an insulator seal that separates the detector from the cable. NA06 detectors were initially installed in KRB, Tarapur 1 & 2, Dresden 2, Oyster Creek, and Nine Mile Point. Partial substitution of NA100 detectors was subsequently made at KRB, Tarapur 1 & 2, and Dresden

2. NA100 detectors are used in Millstone, Monticello, Dresden 3, Tsuruga, Fukushima 1, AKM, and Nuclenor, and this detector or a further improved version will be used in future plants. At no plant has there been an enforced shutdown or power reduction due to a malfunction in any LPRM detector.

There has been some difficulty experienced in the field with the lower 1/8-in cable seal during installation handling of both types of assembly and attachment of connectors. At some sites this resulted in breaking of the seal and a reduction in the cable insulation resistance. This was initially corrected by adherence to improved handling procedures and more recently by an improved connector design which is installed at the factory.

In addition, for the Model NA100 there is some evidence of leakage of the insulator seal between the detector and cable. This has been observed at Tsuruga, Fukushima 1, Millstone, and Dresden 2.

Following the postulated insulator seal leakage, there is a change in sensitivity which has the effect of modestly reducing lifetime and linearity. The LPRM's continue to function satisfactorily, and because of the manner in which they are employed (averaged in the APRM) and recalibration by the TIPS, no safety-related issues are involved. The insulator seal design and fabrication processes are being modified to produce units with greater lifetime.

APPENDIX J J.3-14 REV. 21, APRIL 2007

PBAPS UFSAR

f. Jet Pump Development Statement "Considerable analytical and test work has been completed on the jet pump system for reactor coolant recirculation to establish its basic design characteristics. Additional development programs in progress, and planned, are summarized in section I.7.0 of the PSAR.

This development program, and the fact that this device will have been operated on other reactors prior to its application in Peach Bottom will be adequate to determine its capability." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The design and test program of the jet pump assemblies is complete and is reported in a GE topical report(5) submitted to the AEC in September, 1968.

J.3.6.4 Areas Requiring Further Technical Information

a. CSCS Thermal Effects on the Reactor Vessel and Internals Statement "A preliminary analysis concerning thermal shock effects due to a recirculation line break to the reactor vessel, its internals and associated core cooling performance conducted by General Electric has indicated that several regions will undergo tolerable plastic strains for a single event. General Electric has indicated that this single event could be tolerated at the end of the 40-year design life because the effect of neutron irradiation or other normal service fatigue damage is not expected to appreciably affect the single event tolerable strains. This preliminary summary is based upon present simplified analysis of the recirculation break effects and extrapolation from completely analyzed but less severe conditions.

General Electric has indicated that a detailed report which will relate the complete comprehensive final results is in progress and will be completed within the next few months. The results of this analysis may vary in some degree from the preliminary summary, but it is expected that the conclusion will remain the same." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

APPENDIX J J.3-15 REV. 21, APRIL 2007

PBAPS UFSAR Resolution A detailed reactor vessel thermal shock analysis was performed on a representative GE BWR reactor vessel. The thermal shock analysis simulating CSCS-LOCA operation was performed on similar reactor vessel design to the Peach Bottom vessels and is reported in a GE topical report(6) submitted to the AEC in July, 1969.

The thermal shock analysis simulating CSCS-LOCA conditions was made on the reactor internals, including the core spray sparger and the reactor vessel shroud and is described in FSAR Sections 3.0 and 4.0 and Appendix C.

b. Interchannel Flow Stability Statement "The General Electric Company has indicated that they are continuing their studies on interchannel flow stability and will keep us informed of their findings as they become available. We intend to continue our consideration of this matter. Additional analytical results and reactor operating data are expected to become available prior to the date proposed for initial operation of Peach Bottom Units 2 and 3." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The development of a BWR stability model which would predict the onset of instabilities in the reactor core in this station has been essentially completed and the excellent agreement between model predictions and experimental data that has been reported in GE topical reports(7,8) submitted to the AEC and in a GE memorandum(9), submitted for PBAPS Units 2 and 3 (AEC Docket No.

50-277 and 50-278). Refer to subsection 7.17 of this FSAR for further details on this subject.

c. In-Service Inspection Statement "Provisions are being incorporated in the design of Peach Bottom Units 2 and 3 to facilitate inspection of selected areas of the interior of the reactor vessel and its components, as recommended in the report, APED-5450. This report, titled "Design Provisions for In-Service Inspection," was submitted by the General Electric Company to the regulatory staff on May 4, 1967. We will review the applicant's in-service inspection program at the operating APPENDIX J J.3-16 REV. 21, APRIL 2007

PBAPS UFSAR license stage." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The in-service inspection planned for the facility is described in Appendix I, "In-Service Inspection."

d. Primary System Leak Detection Statement "Detection of leaks in the primary system will be accomplished by monitoring the sump level in the containment vessel, by monitoring the T of the cooling water of the containment vessel heat exchangers, and by monitoring the containment vessel pressure.

Leaks of less than 1 gpm up to 40 gpm can be detected by these methods. Selected areas in the reactor building in the vicinity of the RCIC and RHR equipment will also be monitored." (Peach Bottom Units 2 and 3, AEC-Staff SER, 11/7/67, AEC Docket No. 50-277 and 50-278)

Resolution The primary containment leakage detection system as described in FSAR subsection 4.10 is sensitive and reliable for its intended safety considerations. This system is based on the sump-pump technique approach to leakage detection phenomena. Other supplemental techniques as described in the FSAR are useful alternates and are considered as supplemental off-line specialty approaches.

The proposed technical specifications justify the leakage rate sensitivity and operational readiness requirements of the system.

J.3.7 Conclusion The applicant believes that the above mentioned AEC-Staff statements have been or will be resolved as cited prior to facility operation, and that the cited resolutions are in conformance with the appropriate AEC criteria requirements.

APPENDIX J J.3-17 REV. 21, APRIL 2007

PBAPS UFSAR J.3 AREAS SPECIFIED IN THE PEACH BOTTOM UNITS 2 AND 3--

AEC-STAFF CONSTRUCTION PERMIT SAFETY EVALUATION REPORT REFERENCES

1. Stanley, L.; Starr, J. D.; and Thompson, O. A., "Control Rod Worth Minimizer," General Electric Company, APED-5449, March, 1967.

2. "Control Rod Velocity Limiter," General Electric Company, APED-5446, March, 1967.

3. Morgan, W., "In-Core Nuclear Instrumentation Systems for Oyster Creek Unit 1 and Nine Mile Point, Unit 1 Reactors,"

General Electric Company, APED-5456, August, 1968.

4. Morgan, W., "In-Core Neutron Monitoring Systems for GE-BWR,"

General Electric Company, APED-5706, November, 1968 (revised April, 1969).

5. Holland, K., "Design and Performance of GE-BWR Jet Pumps,"

General Electric Company, APED-5460, September, 1968.

6. Hsui, L. C., "An Analytical Study on Brittle Fracture of GE-BWR Vessel Subject to the Design Basis Accident (LOCA),"

General Electric Company, NEDO-10029, July, 1969.

7. Holland, K. and Ianni, P. W., "Stability and Dynamic Performance of the GE-BWR," General Electric Company, APED-5652, April, 1969.

8. Crowther, R., "Xenon Considerations in Design of Large BWR,"

General Electric Company, APED-5640, June, 1968.

9. "Technology of BWR Stability Analysis," General Electric Memorandum SCER-60, July, 1967.

APPENDIX J J.3-18 REV. 21, APRIL 2007

PBAPS UFSAR J.4 AREAS SPECIFIED IN OTHER RELATED AEC-ACRS CONSTRUCTION AND OPERATING PERMIT LETTERS J.4.1 General Development, testing, and analysis programs are continuing in several other areas of related interest(1). Other study programs which are related directly not only to the high power density reactor core design such as Browns Ferry and Peach Bottom, and indirectly to other low power density reactor core BWR's now near completion, but also to reactor designs which have been reviewed since the Peach Bottom Construction Permit issuance are being pursued and will be issued soon. The information developed in these programs will be addressed to several of the technical concerns which have not been voiced by the AEC-ACRS recently with respect to the GE BWR product lines.

The ACRS issues on the following facilities are identified and the Peach Bottom design capabilities relative to them are discussed in this subsection.

1. BECO - Pilgrim, Unit 1, ACRS Letter, 4/12/68, AEC Docket No. 50-293.

2. CPPD - Cooper, Unit 1, ACRS Letter, 3/12/68, AEC Docket No. 50-298.

3. CP&L - Brunswick, Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325.

4. CECO - Dresden, Unit 2, ACRS Letter, 9/10/69, AEC Docket No. 50-237.

5. NSP - Monticello, Unit 1, ACRS Letter, 1/10/70, AEC Docket No. 50-263.

6. IE and P - Duane Arnold, Unit 1, ACRS Letter, 12/18/69, AEC Docket No. 50-331.

Thus, although these items have not been addressed as requirements to this station, a detailed comprehensive review of each item and the Peach Bottom design conformance to it is analyzed in the following paragraphs.

APPENDIX J J.4-1 REV. 21, APRIL 2007

PBAPS UFSAR J.4.2 Instrumentation for Prompt Detection of Gross Fuel Failure Concern "Discuss the plant's capability for detection of fuel failures.

This discussion should include the detection time as a function of fuel failure severity." (Brunswick Units 1 and 2, AEC Letter, 3/5/69, AEC Docket Nos. 50-324 and 50-325)

Resolution Gross failure is detected by the main steam line radiation monitors. The details of the detection system have been described in Responses 7.5 and 9.4.2 of Supplement No. 3 and to Response 7.5 of Supplement No. 4 of the Brunswick Steam Electric Plant, Units 1 and 2 (AEC Docket No. 50-324 and 50-325). It is shown that the GE BWR failed fuel element detection capability for gross failure is conservatively responsive and well within the design requirements of the concern. Similar discussions were included in Duane Arnold, Unit 1 (AEC Docket No. 50-331 in Amendments 4 and 7).

The Brunswick and Duane Arnold submittals (referenced) discuss the design criteria for the instrumentation for prompt detection of gross failure of a fuel element which is also applicable to this facility.

This resolution has been altered by Peach Bottom APS Facility Operating Licensing Amendments Nos. 129 and 132 (March 1988).

These License Amendments address the impact of Hydrogen Water Chemistry implementation.

J.4.3 AEC General Design Criterion No. 35 - Design Intent and Conformance Concern "The applicant and the Staff should resolve the manner in which the intent of General Design Criterion Number 35 (10CFR50.34 proposed) will be met for the Pilgrim plant." (Pilgrim Unit 1, ACRS Letter, 4/12/68, AEC Docket No. 50-293)

"Discussion of General Design Criterion Number 35 (10CFR50.34 proposed) has occurred in connection with this review. The manner in which the intent of this criterion will be met for the Cooper Nuclear Station should be resolved between the applicant and the AEC Regulatory Staff." (Cooper Unit 1, ACRS Letter, 3/12/68, AEC Docket No. 50-298)

APPENDIX J J.4-2 REV. 21, APRIL 2007

PBAPS UFSAR Resolution Response to this concern is discussed in FSAR paragraph H.2.6.

J.4.4 Scram Reliability Study Concern "The Committee believes that, for transients having a high probability of occurrence, and for which action of a protective system or other engineered safety feature is vital to the public health and safety, an exceedingly high probability of successful action is needed. Common failure modes must be considered in ascertaining an acceptable level of protection. In the event of a turbine trip, reliance is placed on prompt control-rod scram to prevent large rises in primary system pressure. The applicant and his contractors have devoted considerable effort to providing a reliable protective system. However, systematic failures due to improper design, operation or maintenance could obviate the scram reliability. The Committee recommends that a study be made of further means of preventing common failure modes for negating scram action, and of design features to make tolerable the consequences of failure to scram during anticipated transients."

(Brunswick Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos.

50-324 and 50-325)

Resolution Studies are being performed by GE:

1. To evaluate common mode failures which could negate scram action

2. Of design features to make tolerable the consequences of failure to scram during anticipated transients.

A description of the intended study programs is described in Brunswick Steam Electric Plant, Units 1 and 2 - Supplement No. 6, C/R 8.0 (AEC Docket Nos. 50-324 and 50-325).

The above-mentioned studies were completed in late 1970.

J.4.5 Design Basis of Engineered Safety Features Concern "For purposes of design of the engineered safety features, the applicant has proposed using a fission-product source term smaller than that suggested in TID-14844, and a treatment of this source within the containment different from that recommended in the same APPENDIX J J.4-3 REV. 21, APRIL 2007

PBAPS UFSAR document. The Committee believes that the assumptions of TID-14844 should be used as a design basis for the engineered safety features of the Brunswick plant, unless and until the use of a different set of assumptions has been justified to the satisfaction of the Regulatory Staff and the ACRS." (Brunswick Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)

Resolution The engineered safety features were analyzed using the TID-14844 source terms. An assessment of the capability of the CSCS equipment to perform their intended functions is given in FSAR subsection 14.9, along with the offsite radiological effects of design basis accidents for such source assumptions.

J.4.6 Hydrogen Generation Study Concern "Studies are continuing on the possible effects of radiolysis of water in the unlikely event of a loss-of-coolant accident. The Committee believes that the applicant should evaluate all problems which may arise from hydrogen generation, including various levels of Zircaloy-water reactions which could occur if the effectiveness of the emergency core cooling system were significantly less than that predicted. The matter should be resolved between the applicant and the AEC Regulatory Staff." (Brunswick Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)

Resolution Studies are continuing on the possible effect of radiolysis of water in the unlikely event of a LOCA. The studies will evaluate all problems which may arise from credible hydrogen generation.

Studies are also intended to show possible methods of handling postulated quantities of hydrogen generated by radiolysis.

Details on the proposed studies have been submitted on Supplement No. 4, Brunswick Steam Electric Plant, Units 1 and 2 (AEC Docket Nos. 50-324 and 50-325)

Two GE topical reports(2,3) were submitted to the AEC in which it is clearly established that very little hydrogen is evolved as the result of the design basis accident-LOCA assuming the minimum CSCS equipment being available for operation under all required failure modes. Even with further CSCS degradations, the modeled design clad temperatures (of approximately 2,000F) would not increase to levels (2,800F) where clad shattering or 1 percent metal-water APPENDIX J J.4-4 REV. 21, APRIL 2007

PBAPS UFSAR reactions could take place. The containment metal-water reaction capability is 50 to 100 times the CSCS hydrogen levels.

J.4.7 Seismic Design and Analysis Models Concern "The applicant is reviewing the seismic design of Class I structural and mechanical components of the plant and will complete his analysis before the reactor goes into operation. In the event that changes to the plant should be found necessary, such changes will be made on a time scale to be agreed upon between the applicant and the Regulatory Staff." (Dresden Unit 2, ACRS Letter, 9/10/69, AEC Docket No. 50-237)

Resolution The piping systems were dynamically analyzed using the "response spectrum method" of analysis. For each of the piping systems, a mathematical model consisting of lumped masses at discrete joints connected together by weightless elastic elements was constructed.

Valves were also considered as lumped masses in the pipe, and valve operators as lumped masses acting through the operator center of gravity. Where practical, a support is located on the pipe at or near each valve. Stiffness matrix and mass matrix were generated and natural periods of vibration and corresponding mode shapes were determined. Input to the dynamic analyses were the 0.5 percent damped acceleration response spectra for the applicable floor elevation. The increased flexibility of the curved segments of the piping systems was also considered. The results for earthquakes acting in the X and Y (vertical) directions simultaneously, and Z and Y directions simultaneously were computed separately. The 1997 re-analysis of the Recirculation system piping, and the Residual Heat Removal and Reactor Water Clean-up piping inside primary containment for Peach Bottom NCR 97-02267 combined the peak collinear contributions due to the three spatial components of seismic excitation by the square root-sum of the squares (SRSS) method as required by application of ASME Code Case N-411-1. In this method, separate analyses are conducted corresponding to the three spatial components (two horizontal, one vertical) of seismic excitation resulting in an analysis of a three (3) dimensional earthquake.

The maximum responses of each mode are calculated and combined by the root-mean-square method to give the maximum response quantities resulting from all modes. The response thus obtained was combined with the responses produced by other loading conditions to compute the resultant stresses.

APPENDIX J J.4-5 REV. 21, APRIL 2007

PBAPS UFSAR J.4.8 Automatic Pressure Relief System - Single Component Failure Capability - Manual Operation Concern "The automatic pressure relief subsystem should be modified so that at least the manual actuation of the subsystem would not be prevented by any single failure in the subsystem." (Dresden Unit 2, ACRS Letter, 9/10/69, AEC Docket No. 50-237)

Resolution In order to provide an additional level of single component failure capability, the ADS of the CSCS is designed to provide the system with the ability to sustain a dc power failure in any of its dc battery feeds. The system is designed and installed such that either of the redundant, independent 125 VDC battery system networks is available, automatically, for the required system action. This modification, along with the air reservoirs on the ADS valves, provides the system (when manually operated) with the single component failure criteria application capability.

J.4.9 Flow Reference Scram Concern "In the area of reactor instrumentation, the Committee believes:

that the flux scram point should be automatically reduced to an appropriate level as the reactor recirculation flow is reduced below the normal full-power flow." (Brunswick Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)

Resolution An actual BWR facility test (Dresden, Unit 2) will be conducted in the near future to demonstrate that this feature restricts expected unit operational maneuvering and that its omission does not result in unacceptable consequences or dilute reactor protection within the facility when it is subjected to the design abnormal transients.

The flow reference scram system is being provided and will be connected and placed in service if the results of the Dresden 2 tests demonstrate its need.

The flow reference scram system will sum the flow sensed in each of the reactor coolant recirculation loops and provide a flow reference signal to vary the neutron flux scram set point. Flow APPENDIX J J.4-6 REV. 21, APRIL 2007

PBAPS UFSAR will be sensed from one flow measurement venturi in each of the two reactor coolant recirculation loops.

The plant safety analyses (Section 14.0) demonstrated that, for all transients considered, the core is adequately protected with a fixed APRM scram trip setting at 120 percent of rated neutron flux and the high-pressure scram setting of 1,101 psig. Therefore, it is intended to ultimately replace the automatic flow referenced scram with a fixed 120 percent scram setting, providing that initial power operation confirms the nuclear behavior characteristics used in these transient analyses.

J.4.10 Main Steam Lines - Standards for Fabrication, Q/C, and Inspection Concern "The Committee has reviewed the applicant's proposal concerning the standards of design, fabrication, and inspection of the steam lines downstream of the second isolation valve. The Committee concurs with the approach used in analyzing the stresses in the piping during an Operating Basis Earthquake. The Committee recommends that a program of spot radiography of the field butt welds be employed by the applicant as a quality control measure.

Consideration should be given to an appropriate program of in-service inspection." (Brunswick Units 1 and 2, ACRS Letter, 5/15/69, AEC Docket Nos. 50-324 and 50-325)

Resolution The portion of the main steam piping downstream of the second isolation valve is seismic Class II. For further information refer to Appendix A. One hundred percent radiographic examination and either dye penetrant or magnetic particle examination of the final layer of the welds on steam line piping are being employed as a quality control measure. In-service inspection is discussed in Appendix I.

J.4.11 Main Steam Line Isolation Valve Leakage Concern "The main steam lines are provided with redundant valves that are required to close automatically in the unlikely event of a serious accident. Because experience with these large and special valves is limited, the Committee recommends that their performance be followed closely, and that the applicant make additional provisions to assure the requisite leaktightness if experience should be unfavorable. The Committee wishes to be kept informed APPENDIX J J.4-7 REV. 21, APRIL 2007

PBAPS UFSAR of the resolution of this matter." (Monticello Unit 1, ACRS Letter, 1/10/70, AEC Docket No. 50-263)

Resolution General Recent licensing activity has raised a question of assurance that main steam line isolation valves normally provided on BWR's will be leaktight in service.

GE demands a high degree of leaktightness of vendors. This is demonstrated by the vendor at the factory by bench checking prior to shipment to the site. The valves are additionally demonstrated to be leaktight as installed at the site prior to plant startup.

Normal valve maintenance combined with leak testing in accordance with technical specifications is anticipated to assure continued leaktightness throughout plant life. In the event that maintenance of these valves to assure leaktightness becomes an inordinate burden to continued plant operation, additional features will be provided on GE BWR's to assure main steam line isolation valve leaktightness at least as good as plant technical specifications require.

Specifically GE initiated an extensive study program in addressing itself to the ACRS concern. GE has re-examined the main steam line isolation valve in regard to:

a. Dual purpose of the isolation valve (primary pressure boundary)

1. Prevention of coolant inventory loss and protection of plant personnel as a result of line breakage outside the isolation valves

2. Completion of containment boundary after LOCA

b. Basis of confidence in present valve design

1. State line test

2. Vendor bench tests

3. Current plant operation experience

i. Leak identification ii. Testing capability iii. Corrective implementation of leakage reduction APPENDIX J J.4-8 REV. 21, APRIL 2007

PBAPS UFSAR

4. Future structural support consideration

5. Future installation techniques

c. Dual nature of valve hardware versus leakage

1. Purchased valve - surveillance program

2. Installed valve - surveillance program

d. Internal valve design consideration (seat assembly)

1. Seat contact criteria

2. Inherent valve (residual) leakage consideration

e. Further possible measures for reduction of valve leakage J.4.12 Reactor Startup Vibration Testing Capability Concern "The General Electric Company has an extensive integrated program for measuring vibration in several reactors. A major program of vibration testing is planned for the Dresden 2 reactor and is expected to precede operation of the Monticello unit. The Committee believes that a limited program or vibration monitoring is appropriate for the Monticello reactor during preoperational tests and initial operation. In the event that the Dresden 2 data are not clearly favorable, or are not forthcoming before the Monticello unit is ready to operate, the Committee believes that the matter should be reviewed by the Regulatory Staff before routine full power operation of the Monticello units."

(Monticello Unit 1, ACRS Letter, 1/10/70, AEC Docket No. 50-263)

Resolution Internal startup vibration monitoring programs have been prepared for all first-of-a-kind core types or where some particular structural change has been made. If Peach Bottom is the first of its kind, internal startup vibration monitoring will be conducted.

J.4.13 Control Rod Drop Accident NOTE: The discussion in this paragraph no longer applies since the licensee has removed RSCS based on December 4, 1989 NRC approval of a Technical Specification Amendment to remove the RSCS at Peach Bottom. Removal of RSCS is based on NRC Safety Evaluation Report issued to J. S. Charnley, December 27, 1987, which approved APPENDIX J J.4-9 REV. 21, APRIL 2007

PBAPS UFSAR Amendment 17 of General Electric Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel". Amendment 17 requested Commission approval to eliminate the required use of RSCS.

Concern "The techniques for analysis of the control rod drop accident are being revised by the General Electric Company. The adequacy of the revised model and the acceptability of the results should be established in a manner satisfactory to the Regulatory Staff. The Committee wishes to be kept informed of the resolution of this matter." (Susquehanna Steam Electric Station, Units 1 and 2, ACRS Letter, 4/13/72, AEC Docket No. 50-388)

Resolution The discussion which follows is written in response to a concern raised in the Peach Bottom Units 2 and 3 ACRS letter dated September 21, 1972 and also an AEC letter to the licensee dated October 4, 1972.

The rod drop accident discussed herein is defined as the assumed drop of the highest worth rod that can be developed at any time in core life or plant operating conditions by one inadvertent error on the part of the operator. The RWM is assumed not to function.

The rod is assumed to drop at measured velocity as defined in Reference 4. Scram time was based on 5 sec to the 90 percent insertion point. Results have been calculated as described in References 4, 5, and 6.

A rod sequence control system (RSCS) was installed prior to operation above 1 percent of rated power to prevent the operator from moving an out-of-sequence control rod during startup or shutdown. By restricting selection of control rods in the startup and low power ranges, a postulated rod drop accident will not result in peak fuel enthalpies in excess of 280 cal/g for the entire range of plant operations and core exposure.

The requirements or criteria which the RSCS must satisfy to achieve the objective discussed above from the standpoint of core physics are listed below.

a. No undesignated rod may be selected for motion (these will be referred to as out-of-sequence rods).

b. The rods allowed for withdrawal will be designated as in-sequence rods.

APPENDIX J J.4-10 REV. 21, APRIL 2007

PBAPS UFSAR For core exposures of less than 6,500 MWd/T, there is one allowable rod withdrawal sequence defined as sequence A. Within withdrawal sequence A there will be five separate control rod groups. These will be designated A12, A34, B12, B34, and C. Rod sequence control groups A12 and B34 will combine the current sequence A RWM groups 1 and 2 and 3 and 4, respectively. The following control rods will be assigned to Group C:

(06,39) (06,31) (06,23) (22,55) (30,55) (38,55)

(54,39) (54,31) (54,23) (22,07) (30,07) (38,07)

(14,47) (14,15) (46,47) (46,15)

(10,43) (10,35) (10,27) (10,19) (18,51) (26,51)

(34,51) (42,51)

(50,43) (50,35) (50,27) (50,19) (18,11) (26,11)

(34,11) (42,11)

The remaining control rods are assigned to rod sequence control groups B12 and B34 in accordance with the sequence B RWM groups. Either rod groups A12 or A34 may be selected and withdrawn first; however, once a rod group is selected all rods in this group must be withdrawn before any rod in the other group can be withdrawn. After the A12 and the A34 rods are withdrawn, rod group B12 or B34 is the next to be selected for withdrawal in similar fashion. See items g and h below for exceptions.

c. For core exposures of greater than 6,500 MWd/T, there are two allowable rod withdrawal sequences defined as sequences A and B. Within a withdrawal sequence (i.e.,

either A or B) there will be two separate control rod groups. These rod groups are defined as a combination of the RWM groups. Rod control group 12 will combine RWM groups 1 and 2 and rod group 34 will be a combination of RWM groups 3 and 4. Under no circumstances may control rods designated for sequences A and B be combined or interchanged.

Either rod control group 12 or 34 within an allowable sequence may be selected and withdrawn first; however, once a rod sequence and rod control group is selected for withdrawal, all rods contained in that group must be withdrawn before any rods in the remaining group can be withdrawn. Exceptions to this criteria are only allowed under very special conditions as discussed in items g and h below.

APPENDIX J J.4-11 REV. 21, APRIL 2007

PBAPS UFSAR

d. After the rod groups of an allowable sequence are withdrawn within the provisions of the technical specifications, any control rod except those assigned to group C may be selected and withdrawn.

e. For core exposures less than 6,500 MWd/T, the control rods defined by group C must be fully inserted during both startup and shutdown when the reactor power is below 10 percent of rated. After achieving an exposure of 6,500 MWd/T, the high cross section gadolinum isotope has been depleted; thus, the radial variation in gadolinia which required control of the group C rods beyond 50 percent rod density(1) no longer exists.

f. For core exposures less than 6,500 MWd/T, control rod motion need not be restricted by the RSCS above 10 percent power. For core exposures greater than 6,500 MWd/T, control rod motion need not be restricted by the RSCS above 50 percent rod density.

g. Provision shall be made for inoperable control rods.

These rods may be valved out of service in accordance with technical specifications.

h. Special provisions must be allowed for startup testing.

These tests are the following:

i. Shutdown margin ii. Scram time measurement test

i. Provisions must be made for normal reactor shutdown.

This means that rod sequencing must be strictly adhered to once the appropriate power level or rod density is achieved. Basically this will involve the criteria for reactor startup in reverse order.

(1)

Rod density is defined as the percent of control rods fully inserted in the core.

APPENDIX J J.4-12 REV. 21, APRIL 2007

PBAPS UFSAR Figures J.4.1 and J.4.2 show the rod worths used for the rod drop accident with the RSCS for three assembly gadolinia cores at beginning-of-life (BOL) and 6,500 Mwd/T, respectively. These rod worths give the maximum peak fuel enthalpy with respect to moderator temperature since an increase in temperature by non-nuclear heating makes the reactor increasingly sub-critical.

In the 100 percent to 50 percent rod density range the RSCS will automatically prevent the movement of an out-of-sequence control rod. Thus, a single operator error cannot result in the movement of a rod with worth in excess of 1 percent. The calculated results of a postulated rod drop accident for a 1 percent rod are less than 170 cal/g (reference 5).

Below 50 percent rod density (50 percent to all rods fully out) the operator may select and move any rod that is not fully withdrawn, that is not assigned to control group C. Rod movement at this time is limited normally by procedures and the RWM to a specific number of notches. The operator error assumed, which results in maximum rod worth, is the full withdrawal of the selected rod at approximately the 50 percent rod density point.

When the power level permissive is satisfied (>10 percent power),

control rod movement is unrestricted by the RSCS.

The information provided in Table J.4.1, in addition to the information provided in references 4, 5, and 6, indicated that the calculated results of a postulated rod drop accident for this maximum worth rod will not exceed 280 cal/g. As shown in Figures J.4.1 and J.4.2 rod worths decrease from the 50 percent density point to full power. Therefore, the results of a postulated rod drop accident will also decrease such that at the worst time in core life, the 170 cal/g is reached at approximately 10 percent power.

For the three-assembly gadolinia core, 50 percent rod density corresponds to a moderator density of 0.906 g/cc (160C) at BOL and to 0 percent power (286C) at 6,500 MWd/T.

The values presented in Table J.4.1 for the exposed core condition are based on the assumptions and methods applied in reference 6.

The RSCS is a single channel system that provides circuitry which inhibits rod selection if the operator should inadvertently violate the planned rod movement sequence. The system also provides visual indications to guide the operator in the selection of rods to be moved during startup and shutdown to prevent rods from acquiring a high rod worth.

APPENDIX J J.4-13 REV. 21, APRIL 2007

PBAPS UFSAR This is accomplished by initially assigning each control rod to one of five control rod groups, A12, A34, B14, B34, and C and permitting only rods in the acceptable group(s) to be moved.

After the core exposure has exceeded 6,500 MWd/T, only four control rod groups are required, A12, A34, B12, and B34. The assignment of the rods is done by hard-wiring the rod select relays into assigned groups that control the rods of each control rod group. A relay either inhibits or permits all of the rods assigned to a particular group to be selected. This permit/inhibit condition is determined by logic circuits which are monitoring the sequence of rod movements.

The logic receives its inputs principally from the full-in and full-out switches in the rod position indicator probes and the rod sequence selector switch controlled by the operator. These full-in and full-out switches were only used for indication and are not used as input to the RWM.

In addition to hard-wired controls, hard-wire indication assures the operator that the correct rod sequence is being followed.

When the operator selects a particular control rod group, all of the push buttons on the rod select panel of that group will illuminate dimly. Any single rod selected from that group will illuminate brightly. Any out-of-sequence rod selected will remain dark as an indication that an illegal rod has been selected.

Thus, the operator knows that only rods controlled by illuminated switches can be moved at that time.

When all rods of the chosen group have been moved to their correct position (all full-in on insert, or all full-out on withdraw), all the dimly lit push buttons will extinguish, indicating that the operator is permitted to continue with the next correct group.

For rods that have to be valved out of service, or for rods with defective switches in the indicator probe, one bypass switch per rod under key control is provided. These switches are under supervisory control and will only be activated when it has been determined that an inoperable rod within the group pattern can be bypassed as allowed by the Technical Specifications and that no high worth rod pattern will result.

A typical startup with rod sequence control in effect would proceed as follows:

1. The operator would choose an allowable sequence on the rod sequence selector switch and place the sequence mode selector switch to withdraw. For this example, it will be assumed that the A sequence is selected; therefore, the operator places the rod sequence selector to A12. All sequence A12 push buttons would APPENDIX J J.4-14 REV. 21, APRIL 2007

PBAPS UFSAR light dim. All other rods are electrically inhibited from being selected.

2. The first rod to be moved in accordance with detailed written procedures is selected and the corresponding push button lights bright. The rod is moved to its full-out position.

3. The second rod to be moved is selected. Its push button lights bright and the previously selected rod's push button returns to dim. The second rod is moved to full-out and then the third rod is selected. This procedure is followed until all the rods in the A12 group are fully withdrawn or bypassed in accordance with the technical specifications.

4. When the last rod of the A12 group reaches the full-out position, all of the dim lights extinguish. The operator then chooses the A34 group and all push buttons corresponding to the A34 group rods light dimly. At this time all the remaining control rods are electrically inhibited from being selected.

5. The operator selects and moves rods in the A34 group in the same manner as was done in the A12 group.

6. With all A group rods fully withdrawn (50 percent rod density) the operator turns the rod sequence mode selector to NORMAL position. At this point, the operator is allowed to select and withdraw any B sequence rod. All A and C group rods are electrically inhibited from being selected.

7. The operator continues withdrawing B rods until the plant is above the power level permissive. At this time all rods become operable. Rod swap procedures are performed above this power level.

During the foregoing procedure, the operator is guided by light indication. However, if he should inadvertently try to move a rod from another sequence, or if he should try to select another sequence before completing the one originally selected, the circuitry will inhibit all rod movement.

A power indication is provided to ensure that proper rod patterns have been established prior to reducing power below power level permissive when shutting down.

APPENDIX J J.4-15 REV. 21, APRIL 2007

PBAPS UFSAR Figures J.4.3a and J.4.3b show the relationship of the RSCS with other components of the manual control system and rod position display. Figures J.4.3a and J.4.4a show a schematic block diagram of the RSCS. Figures J.4.3a and J.4.3b show the system to be used for core exposures less than 6,500 MWd/T, and Figures J.4.4a and J.4.4b show the system that may be used for exposure greater than 6,500 MWd/T.

The components of the RSCS are of the same type and quality as others that are being used throughout the industry, including use in safety systems. Their quality is consistent with minimum maintenance and low failure rate requirements, and they comply with the appropriate mil. specifications.

On completion of installation of the hard-wired rod sequence control system a pre-operational test will be conducted that will verify the proper sequence wiring. These sequences cannot be modified without wiring changes. In addition, this system can be functionally tested prior to each startup or shutdown by attempting to select and move a rod in or out of sequence group.

In the event of power failure to the system all rod movement with the exception of scram is inhibited. When power is returned, the system returns to its prepower failure state.

The development of the RSCS evolved through consideration of several possible concepts which were discussed with the AEC Staff and the ACRS. In order for the design modification to be acceptable to the staff, it had to render the probability of the control rod drop accident to a negligibly low value or make the consequences of the event consistent with 10CFR100 guidelines (peak fuel enthalpy below 280 cal/g). It should be noted as shown later that the probability of the control rod drop accident was already negligibly low in the opinion of the applicant.

Initially, it was proposed that the RWM be required to be operable during all plant startups in the range of concern. However, it was felt by the staff that there was not sufficient operating data to justify the reliability of the RWM to perform this function.

Changes in core design by removal of the axially distributed gadolinia or the use of temporary control curtains were suggested.

These changes did not reduce the peak fuel enthalpy to below 280 cal/g using the same accident assumptions discussed earlier.

Next, the use of a template interlocked with the rod selection push buttons which prevented rod withdrawal in the 100 percent to 50 percent control rod density range unless the template is in place was suggested. It was felt that this solution did not meet the AEC-Staff requirements because it was dependent on some form APPENDIX J J.4-16 REV. 21, APRIL 2007

PBAPS UFSAR of administrative control. Attempts to make this concept more permanent and less subject to operator manipulation was required by the AEC Staff.

Also considered during this period was the heating of the moderator prior to control rod withdrawal. This solution does not physically prevent an operator from establishing a control rod pattern which could lead to peak fuel enthalpy in excess of 280 cal/g should a control rod drop accident occur.

The RSCS was adopted since it is a permanent system with little reliance on operator control and reduces the probability of the control rod drop accident as shown later.

With regard to Peach Bottom Units 2 and 3 no other alternatives are being given further review.

A probabilistic approach to design basis accidents enables designers not only to see the consequences of an accident, but it also affords the opportunity of easily determining which components aid most in reducing the probabilities of such an accident. For this reason, the probabilistic approach has been used as an aid in investigating the design basis control rod drop accident and the resultant choice of a system to further reduce the probability of significant consequences due to the event. The analysis presented here concentrates primarily on the most probable modes of failures leading to a control rod drop accident.

Where probabilities cannot be calculated from historical data, deliberately conservative values have been used to avoid contentions over particular numbers. The overall probability for the control rod drop accident will be seen to be very small despite the compounding of conservative assumptions.

Figure J.4.5 is a fault tree model of a control rod stuck in the core ready for a drop. Three primary branches combine to produce the stuck rod "ready for a drop" state. These are: (1) a CONTROL ROD IS STUCK IN THE "NEAR-FULL" OR "FULL-IN" POSITION; (2) a CONTROL ROD SEPARATED FROM THE CRD; AND (3) a CRD MOVED ABNORMALLY. The heavy lines in Figure J.4.5 indicate the most probable path of failure which could lead to a control rod drop accident.

The first of the three conditions which must necessarily exist for there to be a potential for a control rod drop accident is that a control rod would be stuck in the near-full or full-in position.

This could happen in several ways; the most probable one would be where the fuel channel is warped, which could be conservatively estimated to have a probability of 10-4 failures/insertion.

Another way would be that a loose object could enter the channel and jam the rod in a fixed position. However, the control rod APPENDIX J J.4-17 REV. 21, APRIL 2007

PBAPS UFSAR weighs nearly 200 lb and the low probability of loose objects lodging in channels in an operating reactor seem to restrict this mode of failure; in fact, from the historical evidence that no such failures have occurred, a conservative probability of 10-6 failures/insertion for this mode of failure can be assumed.

Assuming the other modes of sticking have a much lower probability than the previously discussed ones, the total probability for a control rod to stick would be essentially 1.0 x 10-4 failures/insertion.

The second condition contributing to the rod drop accident requires that the CRD be disconnected from the control rod. The most likely mode of failure in the separation of the CRD from the rod itself would be through the breaking of the index tube. Since this failure has never occurred with the present design, it is justifiable to say that the probability of its happening would be no larger than 10-6 failures/withdrawal. Assuming that the probability of failure of the control rod would be much smaller than that of the index tube, it has not been incorporated into this analysis. Since there must be multiple failures present for the rod actually to be uncoupled without the operator's knowledge, the probability for this mode of failure would be small in comparison to that of the index tube breaking. Consequently, the probability of a control rod becoming separated from its drive is approximately 10-6 failure/withdrawal.

The third and final condition necessary in order for a control rod to drop is that the CRD must have been moved abnormally. A purely mechanical failure could not cause this condition without several other accompanying failures. This product of failures leads to a probability which is much smaller than that of the other mode of failure, namely, the operator error. In order for an operator to withdraw a CRD which is disconnected from the control rod, he would have to ignore or not receive the various signals indicating a malfunction in the drive. Even if the operator ignores an alarm and withdraws the uncoupled drive, the accident is of no consequence unless the rod is an out-of-sequence rod. There is an RWM which acts as an automatic check on the operator's drive selection. Since this report is to look into the improvement in reliability of the addition of a RSCS, both cases of operator error (with and without the RSCS) will be investigated. In order to be conservative in the calculation, a probability of 2 x 10-3 errors/withdrawal has been used for both the operator's selection of an out-of-sequence rod and for the checking performed by the RWM (or second reactor operator), the joint probability being 4 x 10-6 errors/withdrawal. To arrive at the probability of a drive withdrawal for the power level where only the RWM is in effect, the probability of 4 x 10-6 errors/withdrawal is multiplied by 2 x 10-3 errors/operation (which is a conservative estimate of the probability of an operator to ignore a signal or alarm which APPENDIX J J.4-18 REV. 21, APRIL 2007

PBAPS UFSAR indicates a system malfunction). This produces a probability of 8 x 10-9 errors/withdrawal that the operator withdraws an out-of-sequence rod and ignores any indications of system problems. At the power level when the RSCS is also in operation the probability of withdrawing an out-of-sequence rod is a factor of 10-3 smaller (assuming the hard-wired RSCS is twice as reliable as the RWM).

The probability that all three required conditions are present during a particular period of time is the product of the probabilities of each condition. Thus, the probability of an out-of-sequence control rod becoming stuck, disconnected, and its drive withdrawn would be 8 x 10-19 failures/withdrawal, with only the RWM being in effect. With both the RWM and the RSCS, the probability of a control rod being ready to drop is 8 x 10-22 failures/withdrawal.

Assuming 1,000 withdrawals per year per reactor, the probabilities become 8 x 10-15 failures/year and 8 x 10-18 failures/year, respectively.

For mechanical reasons, the probability of a rod becoming unstuck is not independent of the probability of its being stuck. In order to eliminate the complexities of this interdependency calculation of probability, the probability of a stuck rod unsticking will be conservatively assumed to be unity. This means that if a rod sticks it will drop.

From the above argument, the probability of a control rod sticking and then falling is 8 x 10-18 failures/year for low power levels (when both the RSCS and the RWM are operating) and 8 x 10-15 failures/year when the RWM only is in effect. However, in the design basis accident, it is necessary to assume that there is a rod drop. It is easily seen that this overwhelming assumption has exaggerated the importance of this accident.

Figure J.4.6 shows that there are three reactor states used in the analysis of the control rod drop accident. These are: (1) cold startup (reactor at 20°C, atmospheric pressure, and 10-8 of rated power); (2) hot startup (reactor at saturated temperature, operating pressure and 10-6 of rated power); and (3) 10 percent of rated power. No higher power levels are investigated since the effects are negligible in that no calculated fuel rod perforation occurs (peak fuel enthalpy is less than 170 cal/g). The probability of a reactor being at cold startup can be calculated using the nominal startup time (reference 7). The time span from the initiation of rod withdrawal to the hot standby (power) condition is 7.5 hr/startup. In order to be conservative and to take into account that there may be conditions requiring the operator to slow the startup procedure, a factor of 2 will be used. Thus, a reactor is in the cold startup condition 15 APPENDIX J J.4-19 REV. 21, APRIL 2007

PBAPS UFSAR hr/startup. Assuming four cold startups a year, the probability that a reactor is in the cold startup state is 6.9 x 10-3. The hot startup condition requires 2.8 hr to pass through for each startup. On the average, there are 11 hot startups/year which gives a total of 61.6 hr/yr in the hot startup condition, or a probability of 7 x 10-3. The third condition of any consequence is 10 percent power. The time that a reactor is in this state will be very conservatively assumed to be 1,000 hr/yr. Thus, the probability of a reactor being at 10 percent power will be 0.114.

Figure J.4.5 shows that the decision tree spreads into three groups. Only the effects of the control rod drop accident at hot startup will be discussed because it is the worst case. Figure J.4.7 shows the decision tree, culminating in the number of failed fuel pins. The analyses of failed fuel and rod worths are for a curtain core; however, the results will not be significantly different for a gadolina core. The rod worths are broken down into four groups. Assuming that there has been an operator error, and that an out-of-sequence rod has been withdrawn, the probability of an out-of-sequence rod having a rod worth of 0 to 1 percent K/K is 5.9 x 10-2. The probability that the out-of-sequence rod would have a worth of 1 percent to 2 percent K/K is 0.893. Only a specific configuration of withdrawn rods will produce a rod worth in the 2 percent to 3 percent range. The probability associated with this configuration is 4.7 x 10-2 .

Considering the possibility of the operator and the instrumentation making multiple errors, it is necessary to multiply the probability of attaining a multiple error configuration by the probability of the operator making a second error and by the probability of the instrumentation allowing a second error to be made. The probability of a configuration to produce rod worths in the range of 3 percent to 4.5 percent K/K is 1.7 x 10-3, whereas, the probability of an operator making a second error is 10-2 (the higher probability acccounts for the possibility of interrelations between errors). The probability associated with the RWM allowing the error is taken to be 10-2 (same reasoning as for the operator); the RSCS is also taken to have a second-failure probability of 10-2 (same reasoning as for the operator); the RSCS is also taken to have a second-failure probability of 10-2. Thus, the probability for rod worths in the 3 percent to 4.5 percent K/K range is 1.7 x 10 -7 without the RSCS and 1.7 x 10-9 with it.

The next parameter of concern is the velocity at which the control rod drops. Experiments have been performed (the average rod drop velocity was 2.73 ft/sec) and the probabilities are as shown in Figure J.4.7.

APPENDIX J J.4-20 REV. 21, APRIL 2007

PBAPS UFSAR The scram time (90 percent insertion) is the next parameter of interest. The data for actual control rod scrams in operating reactors was used to obtain the probabilities given in Figure J.4.7. The scram time technical specification is 4 sec for 90 percent insertion.

By using the different combinations of parameters shown in Figure J.4.7, the values of peak enthalpy (reference 5) can be obtained.

Also, these same parameters provide the need inputs to computer codes which project the number of fuel pins perforated. Both the enthalpy and fuel damage numbers appear in Figure J.4.7.

The effect of the modification on dose at the site boundary can now be assessed. The actual magnitude of the release is affected by many factors besides the mechanics of failure and nuclear excursion discussed here; decontamination factor, isolation valve closure time, main steam and recirculation flow at the time of the accident, condenser outleakage, and meteorology are a few of these parameters which add uncertainty to the final result. However, all of these factors which are not actually related to the magnitude of the excursion have been taken at the highly conservative values used in the FSAR analysis. This approach will demonstrate the specific effect of the modification quite clearly.

The off-site dose is calculated from the highest 24-hr whole-body gamma dose (essentially the same as the course-of-the-accident dose) tabulated in Table 14.4.3 of the Peach Bottom FSAR. This value of 2.3 x 10-5 Rem is equivalent to 6.9 x 10-8 Rem per perforated rod.

In Figure J.4.8 the ordinate of a point on the curve is the probability per reactor-year that the dose to a hypothetical individual at the site boundary, assuming the least favorable meteorological conditions, will exceed the value of the abscissa due to the postulated control rod drop accidents. The low probability that there will be any release at all is equal to the probability that there will be a rod drop times the probability that there will be any fuel damaged, given the rod drop occurs.

Figure J.4.8 does not include any of the cases resulting in peak fuel enthalpies in excess of 425 cal/g; under such conditions existing physics models cannot be used to predict the exact dynamics of fission product release. From Figure J.4.7 the probability of such circumstances is no greater than 4 x 10-25 per reactor-year with only the RWM in operation and no greater than 4 x 10-25 per reactor-year with only the RWM in operation and no greater than 4 x 10-29 with both the RWM and the RSCS.

The expected value of fencepost dose due to postulated control rod drop accidents can be calculated from the distributions shown in Figure J.4.8 by integrating the respective curves. The result is APPENDIX J J.4-21 REV. 21, APRIL 2007

PBAPS UFSAR 3 x 10-22 mRem/yr before the modification and 3 x 10-25 mRem/yr after the modification. The same hypothetical individual at the site boundary would expect to receive approximately 140 mRem/yr from natural "background" and other man-made radiation sources, as reflected in the "natural radiation" curve of Figure J.4.8.

It is concluded that the addition of the RSCS acts further to reduce the impact of the control rod drop accident, but from the effects of an accident whose impact on public health and safety was already trivially small. See subsection 7.7 for present description of system.

APPENDIX J J.4-22 REV. 21, APRIL 2007

PBAPS UFSAR J.4 AREAS SPECIFIED IN OTHER RELATED AEC-ACRS CONSTRUCTION AND OPERATING PERMIT LETTERS REFERENCES

1. Bray, A. P., "The General Electric Company Analytical and Experimental Programs for Resolution of ACRS Safety Concerns," General Electric Company, APED-5608, April, 1968.

2. "Metal-Water Reactions - Effects on Core Cooling and Containment," General Electric Company, APED-5454, March, 1968.

3. "Considerations Pertaining to Containment Inerting," General Electric Company, APED-5654, August, 1968.

4. Stirn, R. C., et al, "Rod Drop Accident Analysis for Large Boiling Water Reactors," NEDO-10527, March, 1972.

5. Stirn, R. C., et al, "Rod Drop Accident Analysis for Large BWR's-- Supplement 1," NEDO-10527, July, 1972.

6. Stirn, R. C., et al, "Rod Drop Accident Analysis for Large BWR's -- Supplement 2," NEDO-10527, February, 1973.

7. General Electric, "G.E. BWR Critical Path Startup Requirements," APED-5772.

APPENDIX J J.4-23 REV. 21, APRIL 2007

PBAPS UFSAR TABLE J.4.1 ROD DROP ACCIDENT RESULTS THREE-ASSEMBLY Gd203 CORE 50% ROD DENSITY Moderator Max. Control Temperature Rod Worth, K h (C) (%) (cal/g)

Beginning-of-Life 160 1.23 230 (BOL)

Exposed 6,500 MWd/T 286 1.52 213 End of Cycle 1 <160 1.44 215 APPENDIX J J.4-24 REV. 21, APRIL 2007

PBAPS UFSAR J.5 AREAS SPECIFIED IN OTHER RELATED AEC-STAFF CONSTRUCTION OR OPERATING PERMIT SAFETY EVALUATION REPORTS J.5.1 General The following areas of concern, attention, or further study have been noted in AEC-Staff SER on recent GE BWR construction and operating permit applications. Although these have not been addressed to this facility directly as required, a detailed, comprehensive review of each item and the Peach Bottom design conformance to it is analyzed.

J.5.2 Tornado and Missile Protection - GE BWR - Spent Fuel Storage Pool Statement "Describe an analysis of the effects of a tornado on the fuel storage pool considering both the refueling operation and storage of fuel in the pool. In particular, consider the effects of (a) loss of water, (b) missile damage, and (c) collapse of the crane structure into the refueling pond." (Pilgrim Unit 1, AEC-Staff Question, 11/67)

Resolution The objective of two topical reports(1,2) were to investigate the potential effects of a tornado striking the fuel storage pool of a BWR. These reports give a brief discussion of the tornado phenomena. Two key concerns were examined: (1) whether sufficient water could be removed from the pool to prevent cooling of the fuel, and (2) whether missiles could potentially enter the pool and damage the stored fuel.

The fuel pool of each Peach Bottom reactor building is designed with substantial capability for withstanding the effects of a tornado, as this document shows. The design of the fuel pool makes the removal of more than 5 ft of water due to tornado action highly improbable. With 25 ft of water covering the fuel racks, the removal of 5 ft of water is of no concern. Protection against a wide spectrum of tornado-generated missiles is provided by the water which covers the fuel racks. It is shown that protection is provided against all tornado-generated missiles having a probability of hitting the pool greater than one per 1.4 billion reactor lifetimes. Typical potential missiles in this category include a spectrum ranging up to a 3-in diameter steel cylinder 7 ft long or a 14-in diameter wooden pole 12 ft long.

Loading and unloading of a dry storage cask occurs in the cask pit area of the spent fuel storage pool. The same features of the APPENDIX J J.5-1 REV. 21, APRIL 2007

PBAPS UFSAR pool that protect fuel while in the spent fuel storage racks provide protection for fuel in the uncovered cask while being loaded or unloaded. Fuel in the cask has the dded protection of the cask walls which are adequate to protect the fuel while the cask is outdoors and a more direct target for tornado missiles.

The removal of 5 ft of water from the pool will result in slightly less water over the assemblies in the cask compared to those still in the racks; however, because all fuel in the cask will be at least 10 years old, the dose at the refueling floor elevation will still be acceptable.

It is concluded, therefore, that adequate protection for the fuel pool against the effects of a tornado has been provided for, and no additional protection is required for the Peach Bottom facility.

J.5.3 BWR System Stability Analysis Statement "5.2 ... (7) System Stability. The objective of this program is to develop an analytical model which would predict the onset of instabilities in the reactor core. Tests have been conducted at other GE-BWR's, notably the SENN and KRB reactors, and experimental data were found to agree well with model predictions which show no significant tendencies for system instabilities.

The General Electric Company has indicated that it is continuing its studies on this matter and will keep us informed of the findings as they become available. We will continue our review of this matter. Additional analytical results and reactor operating data will become available prior to anticipated initial operation of Pilgrim Station." (Pilgrim Unit 1, AEC-Staff SER, 5/20/68, AEC Docket No. 50-293)

Resolution The development of a BWR stability model which would predict the onset of instabilities in the reactor core in this plant has been completed and the excellent agreement between model predictions and experimental data that has been reported in GE topical reports(3,4) submitted to the AEC and in a GE memorandum(5) submitted on PBAPS Units 2 and 3, (AEC Docket No. 50-277 and 50-278). Refer to subsection 7.17 for further details.

J.5.4 Reactor Pressure Vessel - Stub Tube Design Statement "In order to facilitate our review of this potential problem at the earliest time, the applicant has informed us that it will APPENDIX J J.5-2 REV. 21, APRIL 2007

PBAPS UFSAR provide us with the additional information on the stub tubes and an evaluation of the potential stub tube problems for the Browns Ferry vessels. As indicated in the applicant's Summary of Application, he will incorporate any necessary corrective action, resulting from the stub tube problem evaluation in its vessels on a reasonable and practical basis prior to completion of fabrication. The applicant has indicated that the design and evaluation will be submitted to the staff as soon as information is available. This course of action with respect to the reactor pressure vessel design is acceptable to us." (Browns Ferry Unit 3, AEC-Staff SER, 6/6/68, AEC Docket No. 50-296)

Resolution A GE topical report(6) was submitted to the AEC on the stub tube design. The report describes the design, analysis, fabrication, and test of the CRD penetration typically used in current GE reactor vessels. The penetration described consists of an Inconel internal stub nozzle welded inside the reactor vessel bottom head and an austenitic stainless steel CRD housing penetrating the reactor vessel head and welded to the top of the Inconel stub nozzle. This penetration is also typical of the Dresden 2 and 3, Millstone, Monticello, Browns Ferry, Vermont Yankee, and Pilgrim nuclear power station plants now well along in construction and on other plants to follow in the immediate future. Although details of design and fabrication vary slightly in this series of plants, principally to accommodate the fabricators' manufacturing preferences and methods, these differences are not significant and the resulting penetrations are equivalent. Refer to FSAR Section 4.0 for further details.

J.5.5 RPS and CSCS Instrumentation - Cable Marking and Identification Statement

"... 3.4 Instrumentation ... (3) Conclusions ... The applicant has stated that a means will be developed to easily distinguish protection system components from similar components which are not related to protection. We conclude that the stated intention is sufficient at this stage of review." (Pilgrim Unit 1, AEC-Staff SER, 5/20/69, AEC Docket No. 50-293)

Resolution RPS cables are routed in separate conduits which have unique numbers for easy identification. CSCS cables are color coded by channel and each channel is installed in separate raceways. Color coding is provided for RPS and CSCS control panels and instrumentation nameplates.

APPENDIX J J.5-3 REV. 21, APRIL 2007

PBAPS UFSAR J.5.6 RPS and CSCS Instrumentation - Design Criteria (IEEE-279)

Statement

"... 3.4 Instrumentation ... (3) Conclusions ... The applicant has stated that the reactor protection system and the instrumentation which actuates the engineered safety features are being designed to the proposed IEEE Standard. Our analysis of the preliminary design indicates that these systems can be built to satisfy the requirements of the proposed IEEE Standard and we conclude that this is adequate at this stage of review." (Pilgrim Unit 1, AEC-Staff SER, 5/20/68, AEC Docket No. 50-293)

Resolution Instrumentation in the PBAPS Units 2 and 3 is classified as either control instrumentation or protection instrumentation. The former performs absolutely no safety or protective function, while the latter performs only protective functions. The former (control instrumentation) are not designed to meet the requirements of IEEE-279 (August, 1968) since no safety or protective function is provided by these instruments. The latter group of instrumentation includes not only that system called the RPS, but also the initiation circuitry for the CSCS's, the primary containment, and reactor vessel isolation system, and the isolation control function of the reactor building heating and ventilating system. This latter group of instruments is designed to meet the intent of the requirements of IEEE-279. Systems which are designed to meet the intent of the requirements of IEEE-279 are the following:

1. The RPS.

2. Initiation logic for the CSCS's-incident detection circuit (IDC).

3. Initiation logic for the primary containment and reactor vessel isolation control system.

4. Initiation logic for the isolation control function of the reactor building heating and ventilating system.

a. RPS The RPS provides protective reactor trip or shutdown to terminate any potentially unsafe trend. This system has no control function. The RPS is designed to meet the intent of the requirements of IEEE-279. This system includes the APRM and the IRM subsystems.

APPENDIX J J.5-4 REV. 21, APRIL 2007

PBAPS UFSAR Reactor coolant recirculation system flow measurement reference signals to the APRM scram circuits are designed and installed in a manner identical to Dresden 2 and Oyster Creek 1 facilities equipment arrangements.

The RBMS is not a safety system (see FSAR subsection 1.4) and is not designed to IEEE-279 requirements (see also Dresden 2/3-Amendments 17/18 and 19/20).

b. CSCS's The CSCS's are made up of several systems. These systems are intended to provide two protective functions. One protective function is for large coolant system breaks, where core spraying or core flooding is to be accomplished to adequately cool the core. The core spray system and the LPCI each independently provide this protective function. This is referred to as the low pressure core cooling protective function. The other protective function is for small coolant system breaks. In this case, the protective function occurs in two steps; the first is the depressurization of the coolant system followed by the second which is spraying or flooding as in the large break case. The depressurization can be performed rapidly by use of the ADS, or slowly by the HPCIS which also provides makeup to the coolant inventory. The ADS and HPCIS are each, independently, capable of providing the first step in the small break protective function.

This is known as and referred to as the high pressure core cooling protective function.

Each of the two protective functions (low and high pressure core cooling) described above are accomplished by the use of one of two systems. Either the LPCIS or one of the two core spray system loops perform a low pressure core cooling function. These systems are not individually redundant and independent, but are collectively designed so that each protective function (high and low pressure cooling) is achieved with a combined systems design which meets the requirements of IEEE-279 in both initiation and control. A discussion of each system is given in order to clarify the applicability of IEEE-279 to each protective function and the capability of each system making up the protective function to itself meet the IEEE-279 requirements.

b.1 Low Pressure Core Cooling Protective Function b.1.1 Core Spray System There are two completely independent, redundant, physically separated core spray system loops. The initiation logic (IDC) for these two system loops meets the intent of the requirements of APPENDIX J J.5-5 REV. 21, APRIL 2007

PBAPS UFSAR IEEE-279. There is no control function served by this system nor is there any automatic control circuitry on the system. Upon initiation by the IDC, the system operates continuously at design conditions. The two loops of the system together meet the IEEE-279 requirement.

b.1.2 LPCI Mode of RHRS The initiation logic (IDC) for the LPCI mode of the RHRS and the loop selection logic meet the single active component failure criterion. The LPCIS does not meet the requirements of IEEE-279 because the protective function performed by the LPCIS is redundant to and can be performed alternately by the core spray system. These systems collectively meet the intent of the requirements of IEEE-279.

The LPCIS mode of the RHRS has no automatic control circuitry associated with it. Like the core spray system, the LPCIS upon initiation operates continuously at design conditions. Subsequent to reflooding the core after an accident, the LPCI can be switched to manual control and system flow reduced to that required for other system functions such as containment cooling modes of operation. The manual control circuitry required for containment cooling meets the requirements of IEEE-279.

The flow path used by the LPCIS for injecting water into the reactor vessel utilizes a single injection valve and flow path.

The circuitry which operates this valve does not meet the requirements of IEEE-279 for the reasons discussed above. The shutdown cooling function of the RHRS is normally isolated during reactor operation by use of two closed valves. This portion of the RHRS does not provide any safety or protective function and therefore is not designed to meet the requirements of IEEE-279.

b.2 High Pressure Core Cooling Protective Function b.2.1 ADS The ADS initiation logic (IDC) meets the intent of the requirements of IEEE-279. The automatic control of the valves meets the single active component failure criterion of IEEE-279.

The protective function of the ADS is redundant to and can be performed alternately by the HPCIS described below. Thus, there are two independent and fully redundant systems to provide the high pressure core cooling protective function. The valves, when actuated, open and remain open with no further automatic control.

The valves are powered by redundant single active component failure-proof power sources and power control circuitry. The manual control of the valving meets the single active component failure-proof criterion.

APPENDIX J J.5-6 REV. 21, APRIL 2007

PBAPS UFSAR b.2.2 HPCIS The initiation logic (IDC) of the HPCIS meets the intent of the requirements of IEEE-279. This system has a steam turbine that is automatically controlled to operate under a wide range of driving steam conditions from as low as 100 psig to 1,100 psig.

The control instrumentation for the turbine does not meet the requirements of IEEE-279. The protective function served by the HPCIS is redundant to and can be performed alternately by the ADS.

The initiation and control circuitry of these two systems which perform the depressurization (high pressure) protective function, when considered together, are designed to meet the intent of the requirements of IEEE-279.

c. Primary Containment and Reactor Vessel Isolation Control System The initiation logic for the automatic closure of the primary containment and reactor vessel isolation valves meet the intent of the requirements of IEEE-279. Generally, two valves are located on each line, one inside and one outside the containment to meet the single active component failure criteria.

d. Reactor Building Heating and Ventilating System (Isolation Control Function)

The initiation logic for the isolation control function of the reactor building heating and ventilating system is designed to meet the intent of IEEE-279. The system meets the single active component failure criterion by including two isolation devices for each ventilation penetration.

Conclusions A thorough treatment of the protective function design philosophy is given in FSAR Sections 1.0, 5.0, 6.0, 7.0, and Appendix G. The systems described above meet the intent of the IEEE-279 requirements as stated.

APPENDIX J J.5-7 REV. 21, APRIL 2007

PBAPS UFSAR J.5 AREAS SPECIFIED IN OTHER RELATED AEC-STAFF CONSTRUCTION OR OPERATING PERMIT SAFETY EVALUATION REPORTS REFERENCES

1. "Tornado Protection for the Spent Fuel Storage Pool," General Electric Company, APED-5696, November, 1969.

2. "Tornado Criteria for Nuclear Power Plants," Bechtel Corporation, July, 1969.

3. Holland, K. and Ianni, P. W., "Stability and Dynamic Performance of the GE-BWR," General Electric Company, APED-5652, April, 1969.

4. Crowther, R., "Xenon Considerations in Design of Large BWR,"

General Electric Company, APED-5640, June, 1968.

5. "Technology of BWR Stability Analysis," General Electric Memorandum SCER-60, July, 1967.

6. "Design and Analysis of the Control Rod Drive Reactor Vessel Penetrations," General Electric Company, APED-5703, November, 1968.

APPENDIX J J.5-8 REV. 21, APRIL 2007