ML17130A301

Peach Bottom Atomic Power Station, Units 2 & 3, Revision 26 to Updated Final Safety Analysis Report, Appendix H, Conformance to AEC (NRC) Criteria

ML17130A301
Person / Time
Site:	Peach Bottom
Issue date:	04/06/2017
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17130A259	List: ML17108A393 ML17130A208 ML17130A211 ML17130A216 ML17130A218 ML17130A220 ML17130A222 ML17130A224 ML17130A227 ML17130A231 ML17130A233 ML17130A235 ML17130A241 ML17130A245 ML17130A247 ML17130A249 ML17130A254 ML17130A256 ML17130A258 ML17130A263 ML17130A266 ML17130A268 ML17130A270 ML17130A273 ML17130A277 ML17130A279 ML17130A281 ML17130A284 ML17130A286 ML17130A288 ML17130A290 ML17130A292 ML17130A294 ML17130A301 ML17130A303 ML17130A306 ML17130A308 ML17130A310 ML17130A313 ML17130A317 ML17130A319 ML17130A321 ML17130A324 ML17130A326 ML17130A328 ML17130A330 ML17130A332 ML17130A486 ML17130A488 ML17130A493 ... further results
References
Download: ML17130A301 (76)

Text

APPENDIX H H.1-1 REV. 26, APRIL 2017 APPENDIX H - CONFORMANCE TO AEC (NRC) CRITERIA H.1

SUMMARY

DESCRIPTION

This appendix contains an evaluation of the design bases of the

nuclear facility as measured against the General Design Criteria (GDC) for Nuclear Power Plant Construction Permits that were

proposed to be added to 10CFR50 as Appendix A in July 1967. In addition, this appendix includes an updated evaluation of the conformance of PBAPS to 10CFR 50 Appendix A and other criteria that was captured in the NRC Safety Evaluation Report (SER) for the Extended Power Uprate (EPU) for PBAPS.

During the construction licensing process for Peach Bottom Atomic

Power Station Units 2 and 3, the units were evaluated against the

then current Atomic Energy Commission (AEC) draft of the 27

General Design Criteria for Nuclear Power Plants (November, 1965)

rather than the 70 criteria proposed in July 1967. Section H.2 contains an evaluation of the design bases of the facility relative to each of the nine groups of the 70 criteria. In each

group, a statement of the licensee's understanding of the intent

of the criteria of that group is made and a discussion of the

plant design conformance is presented. A list of references to

appropriate sections of the Updated FSAR is presented at the end

of each group. Explanatory notes are included where required.

It was concluded that Units 2 and 3 conform with the intent of the AEC (NRC) proposed General Design Criteria for Nuclear Power

Plants, 10CFR50, Appendix A, July 1967.

During the licensing of Extended Power Uprate (EPU) for PBAPS (license amendment 292/295 dated 8/25/14), an evaluation of the current licensing basis with respect to conformance with 10 CFR 50 Appendix A and other criteria was performed. Section H.3 contains an evaluation of the NRC acceptance criteria, including the applicable General Design Criteria that were evaluated for the EPU license amendment.

H.1.1 RESTATEMENT OF PROPOSED GENERAL DESIGN CRITERIA (GDC) (July 1967)

The following is a quotation of the proposed GDC published in the

Federal Register (32 FR 10213) on July 11, 1967 by the AEC, predecessor to the NRC. This has been reproduced here for ease of

reference. The GDC have been amended since July 1967; however, PBAPS Units 2 and 3 were licensed to the July 1967 version of the

GDC. The quotation begins immediately hereafter.

APPENDIX H H.1-2 REV. 26, APRIL 2017 INTRODUCTION Every applicant for a construction permit is required by the

provisions of Section 50.34 {of 10 CFR} to include the principal

design criteria for the proposed facility in the application.

These General Design Criteria are intended to be used as guidance

in establishing the principal design criteria for a nuclear power

plant. The General Design Criteria reflect the predominating

experience with water power reactors as designed and located to

date, but their applicability is not limited to these reactors.

They are considered generally applicable to all power reactors.

Under the Commission's regulations, an applicant must provide

assurance that its principal design criteria encompass all those

facility design features required in the interest of public health

and safety. There may be some power reactor cases for which

fulfillment of some of the General Design Criteria may not be

necessary or appropriate. There will be other cases which these

criteria are insufficient, and additional criteria must be

identified and satisfied by the design in the interest of public

safety. It is expected that additional criteria will be needed

particularly for unusual sites and environmental conditions, and

for new and advanced types of reactors. Within this context, the

General Design Criteria should be used as a reference allowing

additions or deletions as an individual case may warrant.

Departures from the General Design Criteria should be justified.

The criteria are designated as "General Design Criteria for

Nuclear Power Plant Construction Permits" to emphasize the key

role they assume at this stage of the licensing process. The

criteria have been categorized as Category A and Category B.

Experience has shown that more definitive information is needed at

the construction permit stage for the items listed in Category A

than for those in Category B.

I. OVERALL PLANT REQUIREMENTS

CRITERION 1 - QUALITY STANDARDS (CATEGORY A)

Those system and components of reactor facilities which are

essential to the prevention of accidents which could affect the

public health and safety or to {the} mitigation of their

consequences shall be identified and then designed, fabricated, and erected to quality standards that reflect the importance of

the safety function to be performed. Where generally recognized

codes or standards on design, materials, fabrication, and

inspection are used, they shall be identified. Where adherence to

such codes or standards does not suffice to assure a quality

product in keeping with the safety function, they shall be

supplemented or modified as necessary. Quality assurance

APPENDIX H H.1-3 REV. 26, APRIL 2017 programs, test procedures, and inspection acceptance levels to be used shall be identified. A showing of sufficiency and

applicability of codes, standards, quality assurance programs, test procedures, and inspection acceptance levels used is

required.

CRITERION 2 - PERFORMANCE STANDARDS (CATEGORY A)

Those systems and components of reactor facilities which are

essential to the prevention of accidents which could affect the

public health and safety or to {the} mitigation of their

consequences shall be designed, fabricated, and erected to

performance standards that will enable the facility to withstand, without loss of the capability to protect the public, the

additional forces that might be imposed by natural phenomena such

as earthquakes, tornadoes, flooding conditions, winds, ice, and

other local site effects. The design bases so established shall

reflect: (a) appropriate consideration of the most severe of these

natural phenomena that have been recorded for the site and the

surrounding area and (b) an appropriate margin for withstanding

forces greater than those recorded to reflect uncertainties about

the historical data and their suitability as a basis for design.

CRITERION 3 - FIRE PROTECTION (CATEGORY A)

The reactor facility shall be designed (1) to minimize the

probability of events such as fires and explosions and (2) to

minimize the potential effects of such events to safety.

Noncombustible and fire resistant materials shall be used whenever

practical throughout the facility, particularly in areas

containing critical portions of the facility such as containment, control room, and components of engineered safety features.

CRITERION 4 - SHARING OF SYSTEMS (CATEGORY A)

Reactor facilities shall not share systems or components unless it

is shown safety is not impaired by the sharing.

CRITERION 5 - RECORDS REQUIREMENTS (CATEGORY A)

Records of the design, fabrication, and construction of essential

components of the plant shall be maintained by the reactor

operator or under its control throughout the life of the reactor.

II. PROTECTION BY MULTIPLE FISSION PRODUCT BARRIERS

CRITERION 6 - REACTOR CORE DESIGN (CATEGORY A)

The reactor core shall be designed to function throughout its

design lifetime, without exceeding acceptable fuel damage limits

APPENDIX H H.1-4 REV. 26, APRIL 2017 which have been stipulated and justified. The core design, together with reliable process and decay heat removal systems, shall provide for this capability under all expected conditions of

normal operation with appropriate margins for uncertainties and

for transient situations which can be anticipated, including the

effects of the loss of power to recirculation pumps, tripping out

of a turbine generator set, isolation of the reactor from its

primary heat sink, and loss of all offsite power.

CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS (CATEGORY B)

The core design, together with reliable controls, shall ensure

that power oscillations which could cause damage in excess of

acceptable fuel damage limits are not possible or can be readily

suppressed.

CRITERION 8 - OVERALL POWER COEFFICIENT (CATEGORY B)

The reactor shall be designed so that the overall power

coefficient in the power operating range shall not be positive.

CRITERION 9 - REACTOR COOLANT PRESSURE BOUNDARY (CATEGORY A)

The reactor coolant pressure boundary shall be designed and

constructed so as to have an exceedingly low probability of gross

rupture or significant leakage throughout its design lifetime.

CRITERION 10 - CONTAINMENT (CATEGORY A)

Containment shall be provided. The containment structure shall be

designed to sustain the initial effects of gross equipment

failures, such as a large coolant boundary break, without loss of

required integrity and, together with other engineered safety

features as may be necessary, to retain for as long as the

situation requires the functional capability to protect the

public.

III. NUCLEAR AND RADIATION CONTROLS

CRITERION 11 - CONTROL ROOM (CATEGORY B)

The facility shall be provided with a control room from which

actions to maintain safe operational status of the plant can be

controlled. Adequate radiation protection shall be provided to

permit access, even under accident conditions, to equipment in the

control room or other areas as necessary to shut down and maintain

safe control of the facility without radiation exposures of

personnel in excess of 10 CFR 20 limits. It shall be possible to

shut the reactor down and maintain it in a safe condition if

access to the control room is lost due to fire or other cause.

APPENDIX H H.1-5 REV. 26, APRIL 2017 CRITERION 12 - INSTRUMENTATION AND CONTROL SYSTEMS (CATEGORY B)

Instrumentation and controls shall be provided as required to

monitor and maintain variables within prescribed operating ranges.

CRITERION 13 - FISSION PROCESS MONITORS AND CONTROLS (CATEGORY B)

Means shall be provided for monitoring and maintaining control

over the fission process throughout core life and for all

conditions that can reasonably be anticipated to cause variations

in reactivity of the core, such as indication of position of

control rods and concentration of soluble reactivity control

poisons.

CRITERION 14 - CORE PROTECTION SYSTEMS (CATEGORY B)

Core protection systems, together with associated equipment, shall

be designed to act automatically to prevent or to suppress

conditions that could result in exceeding acceptable fuel damage

limits.

CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION SYSTEMS (CATEGORY B)

Protection systems shall be provided for sensing accident

situations and initiating the operation of necessary engineered

safety features.

CRITERION 16 - MONITORING REACTOR COOLANT PRESSURE BOUNDARY (CATEGORY B)

Means shall be provided for monitoring the reactor coolant

pressure boundary to detect leakage.

CRITERION 17 - MONITORING RADIOACTIVITY RELEASES (CATEGORY B)

Means shall be provided for monitoring the containment atmosphere, the facility effluent discharge paths, and the facility environs

for radioactivity that could be released from normal operations, from anticipated transients, and from accident conditions.

CRITERION 18 - MONITORING FUEL AND WASTE STORAGE (CATEGORY B)

Monitoring and alarm instrumentation shall be provided for fuel

and waste storage and handling areas for conditions that might

contribute to loss of continuity in decay heat removal and to

radiation exposures.

APPENDIX H H.1-6 REV. 26, APRIL 2017 IV. RELIABILITY AND TESTABILITY OF PROTECTION SYSTEMS CRITERION 19 - PROTECTION SYSTEMS RELIABILITY (CATEGORY B)

Protection systems shall be designed for high functional

reliability and in-service testability commensurate with the

safety functions to be performed.

CRITERION 20 - PROTECTION SYSTEMS REDUNDANCY AND INDEPENDENCE (CATEGORY B)

Redundancy and independence designed into protection systems shall

be sufficient to assure that no single failure or removal from

service of any component or channel of a system will result in

loss of the protection function. The redundancy provided shall

include, as a minimum, two channels of protection for each

protection function to be served. Different principles shall be

used where necessary to achieve true independence of redundant

instrumentation components.

CRITERION 21 - SINGLE FAILURE DEFINITION (CATEGORY B)

Multiple failures resulting from a single event shall be treated

as a single failure.

CRITERION 22 - SEPARATION OF PROTECTION AND CONTROL INSTRUMENTATION SYSTEMS (CATEGORY B)

Protection systems shall be separated from control instrumentation

systems to the extent that failure or removal from service of any

control instrumentation system component or channel, or of those

common to control instrumentation and protection circuitry, leaves

intact a system satisfying all requirements for the protection

channels.

CRITERION 23 - PROTECTION AGAINST MULTIPLE DISABILITY FOR PROTECTION SYSTEMS (CATEGORY B)

The effects of adverse conditions to which redundant channels or

protection systems might be exposed in common, either under normal

conditions or those of an accident, shall not result in loss of

the protection function.

CRITERION 24 - EMERGENCY POWER FOR PROTECTION SYSTEMS (CATEGORY B)

In the event of loss of all offsite power, sufficient alternate

sources of power shall be provided to permit the required

functioning of the protection systems.

APPENDIX H H.1-7 REV. 26, APRIL 2017 CRITERION 25 - DEMONSTRATION OF FUNCTIONAL OPERABILITY OF PROCTECTION SYSTEMS (CATEGORY B)

Means shall be included for testing protection systems while the

reactor is in operation to demonstrate that no failure or loss of

redundancy has occurred.

CRITERION 26 - PROTECTION SYSTEMS FAIL-SAFE DESIGN (CATEGORY B)

The protection systems shall be designed to fail into a safe state

or into a state established as tolerable on a defined basis if

conditions such as disconnection of the system, loss of energy (e.g., electric power, instrument air), or adverse environments (e.g., extreme heat or cold, fire, steam, or water) are

experienced.

V. REACTIVITY CONTROL

CRITERION 27 - REDUNDANCY OF REACTIVITY CONTROL (CATEGORY A)

At least two independent reactivity control systems, preferably of

different principles, shall be provided.

CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY (CATEGORY A)

At least two of the reactivity control systems provided shall

independently be capable of making and holding the core

subcritical from any hot standby or hot operating condition, including those resulting from power changes, sufficiently fast to

prevent exceeding acceptable fuel damage limits.

CRITERION 29 - REACTIVITY SHUTDOWN CAPABILITY (CATEGORY A)

At least one of the reactivity control systems provided shall be

capable of making the core subcritical under any condition (including anticipated operational transients) sufficiently fast

to prevent exceeding acceptable fuel damage limits. Shutdown

margins greater than the minimum worth of the most effective

control rod when fully withdrawn shall be provided.

CRITERION 30 - REACTIVITY HOLDDOWN CAPABILITY (CATEGORY B)

At least one of the reactivity control systems provided shall be

capable of making and holding the core subcritical under any

conditions with appropriate margins for contingencies.

APPENDIX H H.1-8 REV. 26, APRIL 2017 CRITERION 31 - REACTIVITY CONTROL SYSTEMS MALFUNCTION (CATEGORY B)

The reactivity control systems shall be capable of sustaining any

single malfunction, such as unplanned continuous withdrawal (not

ejection) of a control rod, without causing a reactivity transient

which could result in exceeding acceptable fuel damage limits.

CRITERION 32 - MAXIMUM REACTIVITY WORTH OF CONTROL RODS (CATEGORY A)

Limits, which include considerable margin, shall be placed on the

maximum reactivity worth of control rods or elements and on rates

at which reactivity can be increased to ensure that the potential

effects of a sudden or large change of reactivity cannot (a)

rupture the reactor coolant pressure boundary or (b) disrupt the

core, its support structures, or other vessel internals

sufficiently to impair the effectiveness of emergency core

cooling.

VI. REACTOR COOLANT PRESSURE BOUNDARY

CRITERION 33 - REACTOR COOLANT PRESSURE BOUNDARY CAPABILITY (CATEGORY A)

The reactor coolant pressure boundary shall be capable of

accommodating without rupture, and with only limited allowance for

energy absorption through plastic deformation, the static and

dynamic loads imposed on any boundary component as a result of any

inadvertent and sudden release of energy to the coolant. As a

design reference, this sudden release shall be taken as that which

would result from a sudden reactivity insertion such as rod

ejection (unless prevented by positive mechanical means), rod

dropout, or cold water addition.

CRITERION 34 - REACTOR COOLANT PRESSURE BOUNDARY RAPID PROPAGATION FAILURE PREVENTION (CATEGORY A)

The reactor coolant pressure boundary shall be designed to

minimize the probability of rapidly propagating type failures.

Consideration shall be given (a) to notch-toughness properties of

materials extending to the upper shelf of the Charpy transition

curve, (b) to the state of stress of materials under static and

transient loadings, (c) to the quality control specified for

materials and component fabrication to limit flaw sizes, and (d)

to the provisions for control over service temperature and

irradiation effects which may require operational restrictions.

APPENDIX H H.1-9 REV. 26, APRIL 2017 CRITERION 35 - REACTOR COOLANT PRESSURE BOUNDARY BRITTLE FRACTURE PREVENTION (CATEGORY A)

Under conditions where reactor coolant pressure boundary system

components constructed of ferritic materials may be subjected to

potential loadings, such as a reactivity-induced loading, service temperature shall be at least 120 F above the nil ductility transition (NDT) temperature of the component material if the resulting energy release is expected to be absorbed by plastic

deformation or 60°F above the NDT temperature of the component

material if the resulting energy release is expected to be

absorbed within the elastic strain energy range.

CRITERION 36 - REACTOR COOLANT PRESSURE BOUNDARY SURVEILLANCE (CATEGORY A)

Reactor coolant pressure boundary components shall have provisions

for inspection, testing, and surveillance by appropriate means to

assess the structural and leak-tight integrity of the boundary

components during their service lifetime. For the reactor vessel, a material surveillance program conforming with ASTM-E-185-66

shall be provided.

VII. ENGINEERED SAFETY FEATURES

CRITERION 37 - ENGINEERED SAFETY FEATURES BASIS FOR DESIGN (CATEGORY A)

Engineered safety features shall be provided in the facility to

back up the safety provided by the core design, the reactor

coolant pressure boundary, and their protection systems. As a

minimum, much engineered safety features shall be designed to cope

with any size reactor coolant pressure boundary break up to and

including the circumferential rupture of any pipe in that boundary

assuming unobstructed discharge from both ends.

CRITERION 38 - RELIABILITY AND TESTABILITY OF ENGINEERED SAFETY FEATURES (CATEGORY A)

All engineered safety features shall be designed to provide high

functional reliability and ready testability. In determining the

suitability of a facility for a proposed site, the degree of

reliance upon and acceptance of the inherent and engineered safety

afforded by the systems, including engineered safety features, will be influenced by the known and the demonstrated performance

capability and reliability of the systems, and by the extent to

which the operability of such systems can be tested and inspected

where appropriate during the life of the plant.

APPENDIX H H.1-10 REV. 26, APRIL 2017 CRITERION 39 - EMERGENCY POWER FOR ENGINEERED SAFETY FEATURES (CATEGORY A)

Alternate power systems shall be provided and designed with

adequate independency, redundancy, capacity, and testability to

permit the functioning required of the engineered safety features.

As a minimum, the onsite power system and the offsite power system

shall each, independently, provide this capacity assuming a

failure of a single active component in each power system.

CRITERION 40 - MISSILE PROTECTION (CATEGORY A)

Protection for engineered safety features shall be provided

against dynamic effects and missiles that might result from plant

equipment failures.

CRITERION 41 - ENGINEERED SAFETY FEATURES PERFORMANCE CAPABILITY (CATEGORY A)

Engineered safety features such as emergency core cooling and

containment heat removal systems shall provide sufficient

performance capability to accommodate partial loss of installed

capacity and still fulfill the required safety function. As a

minimum, each engineered safety feature shall provide this

required safety function assuming a failure of a single active

component.

CRITERION 42 - ENGINEERED SAFETY FEATURES COMPONENTS CAPABILITY (CATEGORY A)

Engineered safety features shall be designed so that the

capability each component and system to perform its required

function is not impaired by the effects of a loss-of-coolant

accident.

CRITERION 43 - ACCIDENT AGGRAVATION PREVENTION (CATEGORY A)

Engineered safety features shall be designed so that any action of

the engineered safety features which might accentuate the adverse

after-effects of the loss of normal cooling is avoided.

CRITERION 44 - EMERGENCY CORE COOLING SYSTEMS CAPABILITY (CATEGORY A)

At least two emergency core cooling systems, preferably of

different design principles, each with a capability for

accomplishing abundant emergency core cooling, shall be provided.

Each emergency core cooling system and the core shall be designed

to prevent fuel and clad damage that would interfere with the

emergency core cooling function and to limit the clad metal-water

APPENDIX H H.1-11 REV. 26, APRIL 2017 reaction to negligible amounts for all sizes of breaks in the reactor coolant pressure boundary, including the double-ended

rupture of the largest pipe. The performance of each emergency

core cooling system shall be evaluated conservatively in each area

of uncertainty. The systems shall not share active components and

shall not share other features or components unless it can be

demonstrated that (a) the capability of the shared feature or

component to perform its required function can be readily

ascertained during reactor operation, (b) failure of the shared

feature or component does not initiate a loss-of-coolant accident, and (c) capability of the shared feature or component to perform

its required function is not impaired by the effects of a loss-of-

coolant accident and is not lost during the entire period this

function is required following the accident.

CRITERION 45 - INSPECTION OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)

Design provisions shall be made to facilitate physical inspection

of all critical parts of the emergency core cooling systems, including reactor vessel internals and water injection nozzles.

CRITERION 46 - TESTING OF EMERGENCY CORE COOLING SYSTEMS COMPONENTS (CATEGORY A)

Design provisions shall be made so that active components of the

emergency core cooling systems, such as pumps and valves, can be

tested periodically for operability and required functional

performance.

CRITERION 47 - TESTING OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)

A capability shall be provided to test periodically the delivery

capability of the emergency core cooling systems at a location as

close to the core as is practical.

CRITERION 48 - TESTING OF OPERATIONAL SEQUENCE OF EMERGENCY CORE COOLING SYSTEMS (CATEGORY A)

A capability shall be provided to test under conditions as close

to design as practical the full operational sequence that would

bring the emergency core cooling systems into action, including

the transfer to alternate power sources.

APPENDIX H H.1-12 REV. 26, APRIL 2017 CRITERION 49 - CONTAINMENT DESIGN BASIS (CATEGORY A)

The containment structure, including access openings and

penetrations, and any necessary containment heat removal systems

shall be designed so that the containment structure can

accommodate without exceeding the design leakage rate the

pressures and temperatures resulting from the largest credible

energy release following a loss-of-coolant accident, including a

considerable margin for effects from metal water or other chemical

reactions that could occur as a consequence of failure of

emergency core cooling systems.

CRITERION 50 - NDT REQUIREMENT FOR CONTAINMENT MATERIAL (CATEGORY A)

Principal load carrying components of ferritic materials exposed

to the external environment shall be selected so that their

temperature under normal operating and testing conditions are not less than 30 F above nil ductility transition (NDT) temperature.

CRITERION 51 - REACTOR COOLANT PRESSURE BOUNDARY OUTSIDE CONTAINMENT (CATEGORY A)

If part of the reactor coolant pressure boundary is outside the

containment appropriate features as necessary shall be provided to

protect the health and safety of the public in case of an

accidental rupture in that part. Determination of the

appropriateness of features such as isolation valves and

additional containment shall include consideration of the

environmental and population conditions surrounding the site.

CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEMS (CATEGORY A)

Where active heat removal systems are needed under accident

conditions to prevent exceeding containment design pressure, at

least two systems, preferably of different principles, each with

full capacity, shall be provided.

CRITERION 53 - CONTAINMENT ISOLATION VALVES (CATEGORY A)

Penetrations that require closure for the containment function

shall be protected by redundant valving and associated apparatus.

CRITERION 54 - CONTAINMENT LEAKAGE RATE TESTING (CATEGORY A)

Containment shall be designed so that an integrated leakage rate

testing can be conducted at design pressure after completion and

installation of all penetrations and the leakage rate measured

APPENDIX H H.1-13 REV. 26, APRIL 2017 over a sufficient period of time to verify its conformance with required performance.

CRITERION 55 - CONTAINMENT PERIODIC LEAKAGE RATE TESTING (CATEGORY A)

The containment shall be designed so that integrated leakage rate

testing can be done periodically at design pressure during plant

lifetime.

CRITERION 56 - PROVISIONS FOR TESTING PENETRATIONS (CATEGORY A)

Provisions shall be made for testing penetrations which have

resilient seals or expansion bellows to permit leaktightness to be

demonstrated at design pressure at any time.

CRITERION 57 - PROVISIONS FOR TESTING OF ISOLATION VALVES (CATEGORY A)

Capability shall be provided for testing functional operability of

valves and associated apparatus essential to the containment

function for establishing that no failure has occurred and for

determining that valve leakage does not exceed acceptable limits.

CRITERION 58 - INSPECTION OF CONTAINMENT PRESSURE-REDUCING SYSTEMS (CATEGORY A)

Design provisions shall be made to facilitate the periodic

physical inspection of all important components of the containment

pressure-reducing systems, such as, pumps, valves, spray nozzles, torus, and sumps.

CRITERION 59 - TESTING OF CONTAINMENT PRESSURE-REDUCING SYSTEMS COMPONENTS (CATEGORY A)

The containment pressure-reducing systems shall be designed so

that active components, such as pumps and valves, can be tested

periodically for operability and required functional performance.

CRITERION 60 - TESTING OF CONTAINMENT SPRAY SYSTEMS (CATEGORY A)

A capability shall be provided to test periodically the delivery

capability of the containment spray system at a position as close

to the spray nozzles as is practical.

APPENDIX H H.1-14 REV. 26, APRIL 2017 CRITERION 61 - TESTING OF OPERATIONAL SEQUENCE OF CONTAINMENT PRESSURE-REDUCING SYSTEMS (CATEGORY A)

A capability shall be provided to test under conditions as close

to the design as practical the full operational sequence that

would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources.

CRITERION 62 - INSPECTION OF AIR CLEANUP SYSTEMS (CATEGORY A)

Design provisions shall be made to facilitate physical inspection

of all critical parts of containment air cleanup systems, such as, ducts, filters, fans, and dampers.

CRITERION 63 - TESTING OF AIR CLEANUP SYSTEMS COMPONENTS (CATEGORY A)

Design provisions shall be made so that active components of the

air cleanup systems, such as fans and dampers, can be tested

periodically for operability and required functional performance.

CRITERION 64 - TESTING OF AIR CLEANUP SYSTEMS (CATEGORY A)

A capability shall be provided for in situ periodic testing and

surveillance of the air cleanup systems to ensure (a) filter

bypass paths have not developed and (b) filter and trapping

materials have not deteriorated beyond acceptable limits.

CRITERION 65 - TESTING OF OPERATIONAL SEQUENCE OF AIR CLEANUP SYSTEMS (CATEGORY A)

A capability shall be provided to test under conditions as close

to design as practical the full operational sequence that would

bring the air cleanup systems into action, including the transfer

to alternate power sources and the design air flow delivery

capability.

VIII. FUEL AND WASTE STORAGE SYSTEMS

CRITERION 66 - PREVENTION OF FUEL STORAGE CRITICALITY (CATEGORY B)

Criticality in new and spent fuel storage shall be prevented by

physical systems or processes. Such means as geometrically safe

configurations shall be emphasized over procedural controls.

APPENDIX H H.1-15 REV. 26, APRIL 2017 CRITERION 67 - FUEL AND WASTE STORAGE DECAY HEAT (CATEGORY B)

Reliable decay heat removal systems shall be designed to prevent

damage to the fuel in storage facilities that could result in

radioactivity release to plant operating areas or the public

environs.

CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING (CATEGORY B)

Shielding for radiation protection shall be provided in the design

of spent fuel and waste storage facilities as required to meet the

requirements of 10CFR20.

CRITERION 69 - PROTECTION AGAINST RADIOACTIVITY RELEASE FROM SPENT FUEL AND WASTE STORAGE (CATEGORY B)

Containment of fuel and storage shall be provided if accidents

could lead to release of undue amounts of radioactivity to the

public environs.

IX. PLANT EFFLUENTS

CRITERION 70 - CONTROL OF RELEASES OF RADIOACTIVITY TO THE ENVIRONMENT (CATEGORY B)

The facility design shall include those means necessary to

maintain control over the plant radioactive effluents, whether

gaseous, liquid, or solid. Appropriate holdup capacity shall be

provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be

expected to require operational limitations upon the release of

radioactive effluents to the environment. In all cases, the

design for radioactivity control shall be justified (a) on the

basis of 10CFR20 requirements for normal operations and for any

transient situation that might reasonably be anticipated to occur

and (b) on the basis of 10CFR100 dosage level guidelines for

potential reactor accidents of exceedingly low probability of

occurrence except that reduction of the recommended dosage levels

may be required where high population densities or very large

cities can be affected by the radioactive effluents.

APPENDIX H H.2-1 REV. 26, APRIL 2017 H.2 CRITERIA CONFORMANCE H.2.1 Group I - Overall Plant Requirements (Criteria 1-5, Table H.2.1)

The criteria in Group I establish standards for the quality and

performance of systems and components essential to the prevention

of accidents or the mitigation of their consequences, fire

protection, safety of shared systems and components, and

recordkeeping.

The quality assurance program directed by the licensee covers the

design, procurement, fabrication, manufacture, erection, and

testing of essential systems and components for the plant. This

program also ensures the use of applicable design and construction

codes and standards (Criterion 1). Essential structures and

equipment are designed to performance standards which enable the

facility to withstand, without loss of capability to protect the

public, the additional forces that might be imposed by natural

phenomena such as earthquakes, tornados, floods, wind, ice, and

other local effects (Criterion 2). Non-combustible and fire

resistant materials are used whenever necessary throughout the

facility (Criterion 3).

The design of safety-related systems shared by Units 2 and 3

ensures that safety is not impaired as a result of the system

sharing (Criterion 4).

Records of design, fabrication, and construction for this facility

are stored or maintained by the licensee, or are available to the

licensee for inspection (Criterion 5).

TABLE H.2.1 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP I

(OVERALL PLANT REQUIREMENTS)

Conformance (Reference Criterion to Sections of FSAR)

1. Quality Standards 1.5, 1.10, 3.2-3.8, 4.2-4.8, 5.2, 5.3, 6.1-6.6, 7.2-7.5, 8.4, 8.5, 8.7, 12.2, App. D

2. Performance Standards 1.5, 2.2, 2.3, 3.3, 8.4, 8.5, 8.7, 10.2, 10.3, 12.2, App. C

3. Fire Protection 7.18, 9.4, 10.12, 12.2, 13.4

APPENDIX H H.2-2 REV. 26, APRIL 2017 Conformance (Reference Criterion to Sections of FSAR)

4. Sharing of Systems App. F

5. Records Requirements 1.0, App. D

H.2.2 Group II - Protection by Multiple Fission Product Barriers (Criteria 6-10, Table H.2.2)

The criteria in Group II require that nuclear power facilities be

provided with multiple barriers to protect the public against the

inadvertent release of fission products to the environs.

This reactor plant is provided with multiple fission product

barriers to contain or mitigate the release of fission products as

follows:

1. The fuel barrier, consisting of high density ceramic fuel sealed in high integrity cladding.

2. The nuclear system process barrier, consisting of vessels, piping, pumps, and other process components

which contain the steam, water, gases, and radioactive

materials coming from, going to, or in communication

with the reactor core.

3. The primary containment.

4. The secondary containment system, which includes the reactor building, the reactor building heating and

ventilating system, and the standby gas treatment

system.

5. The stack for controlled elevated release.

The primary containment is designed, fabricated, and erected to

accommodate without failure the pressures and temperatures

resulting from, or subsequent to, the instantaneous

circumferential break of any coolant pipe within the primary

containment. The reactor building encompasses the primary

containment, and in conjunction with the standby gas treatment

system and reactor building heating and ventilation system, provides secondary containment when the primary containment is in

service, and provides for containment when the primary containment

is open. The containment systems and the other engineered

safeguards ensure that offsite doses which result from postulated

design basis accidents are below the guideline values stated in

10CFR100 (Criterion 70).

APPENDIX H H.2-3 REV. 26, APRIL 2017 The reactor core, with its controls, is designed so that there is no inherent tendency for sudden divergent oscillation of operating

characteristics, or for divergent power transients in any mode of

plant operation, or for uncontrolled oscillations (Criteria 6, 7).

The basis of the reactor core design, in combination with the

plant equipment characteristics, nuclear instrumentation system, and the RPS, is to provide margins to ensure that fuel damage does

not occur during normal operation or operational transients (Criteria 6, 7). The reactor is designed so that the overall

power coefficient in the operating range is not positive (Criterion 8).

The primary system pressure boundary design considers system dead

weight and specified live loads acting separately or concurrently.

These live loads include pressure and temperature loads, vibrations, and seismic loads prescribed for the plant. The

reactor vessel and support structures are designed to withstand

the forces created by the plant design seismic loads. The reactor

vessel and support structures are designed to withstand the forces

resulting from the postulated design LOCA inside the drywell with

the reactor vessel at design temperature and pressure (Criterion

9).

TABLE H.2.2 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP II

(PROTECTION BY MULTIPLE FISSION PRODUCT BARRIERS)

Conformance (Reference Criterion to Sections of FSAR)

6. Reactor Core Design 1.5, 1.7, 3.2, 3.6, 3.7, 4.3, 4.7, 4.8, 7.2, 14.2, 14.4, 14.5, 14.6

7. Suppression of Power 1.5, 3.4, 3.6, 3.7, 4.4, 7.2, Oscillations 7.5, 7.7, 7.17, 14.5

8. Overall Power 1.5, 1.7, 3.6, 3.7, 7.17 Coefficient

9. Reactor Coolant 1.5, 4.2-4.4, 4.10, 4.11, Pressure Boundary 7.8, 14.5, App. A, App. C

APPENDIX H H.2-4 REV. 26, APRIL 2017 Conformance (Reference Criterion to Sections of FSAR)

10. Containment 5.2, 5.3, 14.4, 14.6

H.2.3 Group III - Nuclear and Radiation Controls (Criteria 11-18, Table H.2.3)

The criteria in Group III identify and define the plant

instrumentation and control systems which are necessary to

maintain the plant in a safe operational status and determine the

adequacy of radiation shielding, radiation monitoring, fission

process controls, and the effective sensing of abnormal conditions

for initiation of engineered safety features.

The plant is provided with a common control room having shielding

protection, air conditioning, and facilities to permit access and

continuous occupancy within 10CFR20 dose limits during design

basis accident situations. The plant design, therefore, does not

contemplate the necessity for evacuation of the main control room.

Nevertheless, equipment is provided to bring the plant to a safe

shutdown from outside the main control room in the event that it

is necessary to evacuate the control room (Criterion 11).

Safe shutdown can be achieved from the Remote Shutdown System (RSS) or by using Alternate Shutdown (ASD) panels at various plant locations. ASD panels are added in response 10 CFR 50, Appendix R requirements.

The necessary plant controls, instrumentation, and alarms for safe

and orderly operation are located in the control room (Criteria

11, 12, 13, 16).

The performance of the reactor core and the indications of reactor

power level are continuously monitored by the nuclear

instrumentation system (Criterion 13). The RPS, independent from

the plant process control systems, overrides all other controls to

initiate required safety actions. The core protection systems

automatically initiate appropriate action whenever the plant

conditions approach pre-established limits. The systems act

specifically to initiate the CSCS's (Criteria 12, 13, 14, 15).

The plant radiation and process monitoring systems are provided

for monitoring significant parameters from specific plant process

systems and specific areas, including the plant effluents, and to

provide alarms and signals for appropriate corrective actions.

Monitoring and alarm instrumentation are provided for fuel and

waste storage and handling areas (Criteria 17, 18).

APPENDIX H H.2-5 REV. 26, APRIL 2017 TABLE H.2.3 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP III

(NUCLEAR AND RADIATION CONTROLS)

Conformance (Reference Criterion to Sections of FSAR)

11. Control Room 1.5, 7.2-7.5, 7.7-7.10, 7.12, 7.18, 12.3, 14.9

12. Instrumentation and 1.5, 2.6, 3.4, 3.8, 4.10, 7.2-7.5, Control System 7.7-7.10, 7.12, 7.17, 9.2-9.4

13. Fission Process 1.5, 3.4, 3.8, 7.2, 7.5, Monitors and Controls 7.7-7.9, 7.16

14. Core Protection 1.5, 3.4, 3.5, 4.4-4.8, 6.1-6.7, Systems 7.2-7.5, 7.7, 7.12, 14.1-14.7

15. Engineered Safety 1.5, 7.2-7.5, 7.12

Features Protection

Systems

16. Monitoring Reactor 1.5, 4.10, 5.2, 7.3, 7.8, 9.2, Coolant Pressure 10.6, 10.7, 10.9

Boundary

17. Monitoring Radio- 1.5, 2.6, 4.10, 7.12, 9.2, 9.4, active Releases 10.13

18. Monitoring Fuel 1.5, 7.6, 7.12, 9.2, 9.4, 10.4, and Waste Storage 10.5

H.2.4 Group IV - Reliability and Testability of Protection Systems (Criteria 19-26, Table H.2.4)

The criteria in Group IV identify and establish requirements with

regard to the functional reliability in-service testability, redundancy, physical and electrical independence, separation, and

fail-safe design of the protection systems, which are essential to

the reactor protection functions: scram, isolation, and core

standby cooling.

The protection systems act to shut down the reactor, close primary

containment isolation valves, and initiate the operation of the

CSCS's. The protection systems automatically override the plant

APPENDIX H H.2-6 REV. 26, APRIL 2017 normal operational controls to initiate appropriate protective action whenever the plant conditions monitored by the system (e.g., neutron flux, containment pressure, reactor vessel

pressure) exceed established limits (Criterion 22). A dual-

channel protection system, with complete redundancy in each

channel, allows for component failure with no loss of protection.

The RPS is designed so that a plant accident is sensed by

different parametric measurements (e.g., LOCA is detected by high

drywell pressure and reactor low water level monitors). At least

two instrument channels are provided to initiate each protection

function (Criterion 20). Components of the redundant subsystems

can be removed from service for testing and maintenance without

negating the ability of the protection system to perform its

function upon receipt of the appropriate signals (Criteria 19, 20, 21). The design of the protection systems provides means for

testing during power operation without affecting planned operation

or impairing safety functions (Criterion 25). The systems'

electrical power requirements are supplied from independent, redundant sources. Alternate sources of power are provided so as

to permit the required functioning of equipment required for safe

shutdown of the plant in the event of loss of all off-site power (Criterion 24). The system circuits are separated to preclude a

circuit fault from inducing a fault in another circuit, and to

reduce the likelihood that adverse conditions will encompass more

than one circuit. Sensors and electrical circuits necessary to

the functioning of these systems are physically and electrically

separated so that no single event can compromise the protection

function. The system internal wiring and external cable routing

are arranged to reduce any external influence on the system

performance (Criteria 23, 24). Systems essential to the protection

function are designed to fail-safe in their likely failure modes.

A failure of any one RPS input or subsystem component produces a

trip in one of the two protection channels; this condition is

insufficient to produce a reactor scram, but the system is ready

to perform its protective function upon another trip (either by

failure of or by exceeding the preset trip in the other channel)

(Criterion 26).

APPENDIX H H.2-7 REV. 26, APRIL 2017 TABLE H.2.4 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP IV

(RELIABILITY AND TESTABILITY OF PROTECTION SYSTEMS)

Conformance (Reference Criterion to Sections of FSAR)

19. Protection Systems 1.5, 3.4, 7.2-7.5, 7.12, 14.0, Reliability App. G

20. Protection Systems 1.5, 3.4, 7.2-7.5, 7.12, 8.5, Redundancy and 14.0, App. G Independence

21. Single Failure 1.2, 14.4, App. G Definition

22. Separation of Protection 1.5, 3.4, 7.2-7.5, 7.12, 8.5

and Control Instrumen-

tation Systems

23. Protection Against 1.5, 3.4, 7.2-7.5, 7.12, 8.5, Multiple Disability 14.0, App. G for Protection

Systems

24. Emergency Power for 1.5, 3.4, 6.4, 7.2-7.5, 7.12, Protection Systems 8.5, 14.0, App. G

25. Demonstration of 1.5, 3.4, 4.6, 4.8, 5.2, 5.3, Functional Operability 6.7, 7.2-7.5, 7.12, 8.5, 13.0

of Protection Systems

26. Protection Systems 1.5, 6.1-6.5, 7.2-7.5, 8.5, 8.7 Fail-Safe Design

H.2.5 Group V - Reactivity Control (Criteria 27-32, Table H.2.5)

The criteria in Group V establish the reactor core reactivity

insertion and withdrawal rate limitations and the means to control

the plant operations within these limits.

The plant design contains two independent reactivity control

systems employing different principles. Control of reactivity is

operationally provided by a combination of movable control rods,

APPENDIX H H.2-8 REV. 26, APRIL 2017 burnable poisons, and reactor coolant recirculation system flow, which accommodate fuel burnup, load changes, and long-term

reactivity changes. Reactor shutdown by the CRDS is sufficiently

rapid to prevent violation of fuel damage limits for normal

operation and abnormal operating transients. The standby liquid

control system provides an independent shutdown capability, if

needed. This system is designed to shut down the reactor and

maintain it in the shutdown condition during cooldown (Criteria

27, 28, 29). The reactor core is designed to have (Criteria 27, 31):

1. A reactivity response which regulates or dampens changes in power level and spatial distributions of power

production to values consistent with safe and efficient

operation.

2. A negative reactivity feedback consistent with the requirements of overall plant nuclear-hydrodynamic

stability.

3. A strong negative reactivity feedback under severe power transient conditions.

The reactivity control system is designed such that, under

conditions of normal operation, sufficient reactivity compensation

is always available to make the reactor adequately subcritical

from its most reactive condition, and means are provided for

continuous regulation of the reactor core excess reactivity and

reactivity distribution. Shutdown margins provided are greater

than the maximum worth of the most effective control rod when

fully withdrawn (Criteria 29, 30). This system is also designed

to be capable of compensating for positive and negative reactivity

changes resulting from changing nuclear coefficients, fuel

depletion, and fission product transients and buildup (Criterion 29). The system design is such that control rod worths

and the rate at which reactivity can be added are limited to

assure that the design basis reactivity accident is not capable of

damaging the reactor coolant system or disrupting the reactor

core, its support structures, or other vessel internals

sufficiently to impair the CSCS effectiveness if needed.

Acceptable fuel damage limits are not exceeded for any reactivity

transient resulting from a single equipment malfunction or single

operator error (Criteria 29, 31, 32).

APPENDIX H H.2-9 REV. 26, APRIL 2017 TABLE H.2.5 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP V

(REACTIVITY CONTROL)

Conformance (Reference Criterion to Sections of FSAR)

27. Redundancy of 1.5, 3.4, 3.8, 7.7 Reactivity Control

28. Reactivity Hot 1.5, 3.4, 3.6, 3.8, 7.7, Shutdown Capability 14.0, App. G

29. Reactivity Shutdown 1.5, 3.4, 3.6, 7.2, 14.0, Capability App. G

30. Reactivity Holddown 1.5, 3.4, 3.6, 3.8

Capability

31. Reactivity Control 1.5, 3.4, 3.6, 3.7, 7.2, Systems Malfunction 7.7, 14.0, App. G

32. Maximum Reactivity 1.5, 3.4, 3.6, 3.7, 7.7, Worth of Control Rods 14.0, App. G

H.2.6 Group VI - Reactor Coolant Pressure Boundary (Criteria 33-36, Table H.2.6)

The criteria in Group VI establish the reactor coolant pressure

boundary design requirements and identify the means used to

satisfy these design requirements. The reactor coolant pressure

boundary is referred to in this FSAR as the nuclear system primary

barrier (see subsection 1.2, "Definitions").

The inherent safety features of the reactor core design, in

combination with certain engineered safety features (control rod

velocity limiter and control rod housing) and the plant reactivity

control system, are such that the consequences of the most severe

potential nuclear excursion accident, caused by a single

component failure within the reactivity control system (rod drop

accident), cannot result in damage (either by motion or rupture)

to the reactor coolant pressure boundary (Criterion 33). The

applicable ASME and ANSI codes are used as the established and

acceptable criteria for design, fabrication, and operation of

components of the reactor coolant pressure boundary (Criterion

34).

APPENDIX H H.2-10 REV. 26, APRIL 2017 Brittle fracture failure of reactor coolant pressure boundary

system components is prevented by the judicious selection of

ferritic steels for fabrication which have notch toughness

properties suitable for the system service temperatures.

Appropriate consideration is given in the design to the mechanical

properties of the materials to ensure that, at the service

temperatures, there is:

1. Complete energy absorption with fully ductible behavior (e.g., in the energy absorption region of 100 percent

shear fracture) whenever the boundary can be pressurized

beyond the systems safety valve setting by operational

transients in postulated accidents.

2. An NDT temperature at least 60 F below the service temperature whenever the boundary can be pressurized beyond 20 percent of its design pressure by operational

transients, hydro tests, and postulated accidents.

It is believed that Criterion 35 should be applicable only to

those components or systems whose failure would result in a loss

of coolant in excess of the normal makeup capability of the

reactor coolant system.

In this way it is ensured that brittle fracture is prevented in

the above defined components and systems under all potential

service loading conditions (Criterion 35).

The reactor coolant pressure boundary is given a hydrostatic test

in accordance with code requirements prior to initial reactor

startup. The system is checked for leaks, and abnormal conditions

are corrected before reactor startup. The minimum vessel

temperature during the hydrostatic test shall at least be 60°F

above the calculated NDT temperature prior to pressurizing the

vessel. The reactor coolant pressure boundary also has provisions

for hydrostatic testing during the service lifetime of the

boundary components. An extensive quality assurance program is

also followed during the entire fabrication of the reactor coolant

pressure boundary (Criterion 36). Surveillance samples of vessel

material are located within the reactor primary vessel to enable

periodic monitoring of the effects of radiation on material

properties. The program includes specimens of the base metal, heat-affected zone metal, weld metal specimens, and standard

specimens. Leakage from the reactor coolant pressure boundary is

monitored during reactor operation (Criterion 36).

APPENDIX H H.2-11 REV. 26, APRIL 2017 TABLE H.2.6 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VI

(REACTOR COOLANT PRESSURE BOUNDARY)

Conformance (Reference Criterion to Sections of FSAR)

33. Reactor Coolant Pressure 1.5, 3.3-3.6, 4.2, 4.4-4.6, Boundary Capability 14.4-14.6, App. A, C, G

34. Reactor Coolant Pressure 3.3, 4.2, 4.3, 7.8, Boundary Rapid Propagation App. A, C

Failure Prevention

35. Reactor Coolant Pressure 4.2, App. A

Boundary Brittle

Fracture Prevention

36. Reactor Coolant Pressure 4.2, 4.3, 4.10, 7.3, App. A

Boundary Surveillance

H.2.7 Group VII - Engineered Safety Features (Criteria 37-65, Table H.2.7)

The criteria in Group VII establish requirements with respect to:

1. Incorporation of engineered safety features.

2. Independence, redundancy, capability, testability, inspectability and reliability of engineered safety

features.

3. Suitability of each engineered safety feature for its intended duty.

4. Justification that each engineered safety feature's capability envelops all the anticipated and credible

phenomena associated with the plant operational

transients or design basis accidents considered.

The engineered safety features are referred to in this FSAR as

engineered safeguards and nuclear safety systems (see subsection

1.2, "Definitions").

The normal plant control systems maintain plant variables within

operating limits. These systems are thoroughly engineered and

APPENDIX H H.2-12 REV. 26, APRIL 2017 backed up by a significant amount of experience in system design and operation. Even if an improbable maloperation or equipment

failure were to occur, including the instantaneous circumferential

break of any pipe in the reactor coolant boundary, the nuclear

safety systems and engineered safeguards limit effects to levels

below those which are of public safety concern (Criterion 37).

These engineered safety features include those systems which are

essential to the isolation and core standby cooling functions (Criterion 37). Sufficient offsite and standby (redundant, independent, and testable) auxiliary sources of electrical power

are provided to attain prompt shutdown and continued maintenance

of the plant in a safe condition. The capacities of the offsite

and onsite power sources are independently adequate to accomplish

all required engineered safety functions, assuming a failure of a

single active component in a power system (Criterion 39).

The engineered safety features are designed to provide high

reliability and testability. Specific provisions are made in each

engineered safety feature to demonstrate operability and

performance capabilities (Criterion 38). Components of the

engineered safety features which are required for function after a

design basis accident are designed to withstand credible

environmental effects from a LOCA and are protected from credible

missiles which might impair their performance capability (Criteria

40, 42, 43). The CSCS's are designed to provide at least two

different systems of different principles to prevent excessive

fuel clad temperature over the entire spectrum of postulated

coolant boundary breaks. Such capability is available

notwithstanding the loss of all offsite AC power.

The CSCS's are designed to various levels of component redundancy

such that no single active component failure in addition to the

accident can prevent core cooling (Criteria 41, 44). To assure

that the CSCS's function properly, specific provisions have been

made to provide capability for testing the sequential operability

and functional performance of each individual system (Criteria 46, 47, 48). Design provisions have also been made to facilitate

physical and visual inspection of the CSCS's components (Criterion

45).

The primary containment structure, including access openings and

penetrations, is designed to withstand the peak pressures and

temperatures which could occur due to the postulated design basis

LOCA. The containment has the capability to accommodate energy

addition from metal-water reactions beyond conditions that could

exist following the accident (Criterion 49).

Pressure boundary materials associated with the primary containment and penetrations have a maximum NDT temperature of 0 F

APPENDIX H H.2-13 REV. 26, APRIL 2017 as determined by tests conducted in accordance with Section III of the ASME Boiler and Pressure Vessel Code. It is intended that the

drywell will not be pressurized or subjected to substantial stress at temperatures below 30 F above the NDT temperatures for the primary containment and penetration materials (Criterion 50). The effects of an accidental rupture of a line outside the primary

containment are limited by the engineered safety features such

that offsite doses will be below the guideline values of 10CFR100 (Criterion 51). Provisions are made for the removal of heat from

within the plant containment and to isolate the various process

system lines as may be necessary to maintain the integrity of the

plant containment systems as long as necessary following the

various postulated design basis accidents. Process lines that

penetrate the primary containment and which connect to the reactor

coolant system, or to the primary containment free space, are

provided with at least two isolation valves or equivalent in

series (Criterion 53). The plant design includes pre-operational

and post-operational pressure and leak rate testing capability (Criteria 54, 55). Provisions are made for demonstrating the

functional performance of the primary containment isolation valves

and leak testing of penetrations having seals or expansion

bellows, other than solidly welded connections (Criteria 56, 57).

The pressure-suppression system and the containment cooling system

provide two different means for containment heat removal under

accident conditions so that the peak containment pressure would be

less than the primary containment maximum allowable pressure. In

addition, periodic integrated leakage rate testing will be

conducted in accordance with Technical Specifications in Appendix

B (Criterion 52).

Ability to demonstrate operability, test the functional

performance, and inspect the active components of containment

pressure reducing systems and the containment cooling system is

provided (Criteria 58, 59, 60, 61). The standby gas treatment

system facilities permit the onsite testing of the filter

components with acceptable methods (Criterion 64). All major

components of the containment heating, cooling, and ventilating

systems can be physically inspected and tested. The standby gas

treatment system can be physically inspected and its operability

demonstrated using a tracer injection (Criteria 62, 63, 65).

APPENDIX H H.2-14 REV. 26, APRIL 2017 TABLE H.2.7 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VII (ENGINEERED SAFETY FEATURES)

Conformance (Reference Criterion to Sections of FSAR)

37. Engineered Safety 1.5, 3.3, 3.4, 4.2, 4.4, 4.6, Features Basis 5.2, 5.3, 6.1-6.7, 7.2-7.4, for Design 8.5, 8.7, 10.7, 10.9, 10.13, 10.14, 12.3, 14.1-14.7, App. G

38. Reliability and Testa- 1.5, 3.4, 3.5, 4.6-4.8, 5.2, bility of Engineered 5.3, 6.6, 7.2-7.5, 7.12, 8.5, Safety Features 8.7, 10.7, 10.9, 10.13, 10.14

39. Emergency Power for 7.2-7.4, 8.4, 8.5, 8.7

Engineered Safety

Features

40. Missile Protection 5.2, 12.2

41. Engineered Safety 4.7, 4.8, 6.1-6.5, 7.4, 8.5, Features Performance 14.1-14.6, App. G

Capability

42. Engineered Safety 3.4, 4.7, 4.8, 5.2, 5.3, Features Components 6.1-6.5, 7.2-7.4, 8.5, 8.7, Capability 14.1-14.6

43. Accident Aggravation 3.4, 5.2, 5.3, 6.1-6.5, 7.3, Protection 7.4, 8.5, 8.7, 14.9

44. Emergency Core Cooling 4.7, 4.8, 6.1-6.5, 7.4, 14.6, Systems Capability App. G

45. Inspection of Emergency 3.3, 4.2, 6.6

Core Cooling Systems

APPENDIX H H.2-15 REV. 26, APRIL 2017 Conformance (Reference Criterion to Sections of FSAR)

46. Testing of Emergency 1.5, 4.7, 4.8, 6.6, 7.4, 13.4

Core Cooling Systems

Components

47. Testing of Emergency 6.6, 7.4, 13.4

Core Cooling Systems

48. Testing of Operational 1.5, 6.4, 6.6, 7.4, 8.5, 8.7, Sequence of Emergency 10.9, 13.0

Core Cooling Systems

49. Containment Design 1.5, 4.8, 5.2, 6.1, 6.2, 6.5, Basis 7.3, 7.4, 13.4, 14.2-14.7, App. A, App. M

50. NDT Requirement for 5.2 Containment Material

51. Reactor Coolant Pressure 1.5, 2.2, 2.3, 4.6, 5.2, 7.2, Boundary Outside 7.3, 12.3, 14.6 Containment

52. Containment Heat 1.5, 4.8, 5.2, 6.1-6.5, 7.4, Removal Systems 10.7, 14.0

53. Containment Isolation 1.5, 4.6, 5.2, 7.3

Valves

54. Containment Leakage 5.2, 13.4 Rate Testing

55. Containment Periodic 5.2

Leakage Rate Testing

56. Provisions for Testing 5.2

of Penetrations

57. Provisions for Testing 4.6, 5.2, 7.3, 7.12

of Isolation Valves

58. Inspection of Contain- 4.8, 5.2, 6.4, 6.6, 10.7

ment Pressure Reducing

Systems

59. Testing of Containment 4.8, 5.2, 6.1-6.6, 7.3, Pressure Reducing 7.4, 10.7 Systems Components

APPENDIX H H.2-16 REV. 26, APRIL 2017 Conformance (Reference Criterion to Sections of FSAR)

60. Testing of Containment 4.8, 6.4, 6.6, 7.4

Spray Systems

61. Testing of Operational 5.2, 6.4, 6.6, 7.4, 8.4, 8.5

Sequence of Containment

Pressure-Reducing

Systems

62. Inspection of 5.2, 5.3, 10.13 Air Cleanup Systems

63. Testing of Air Cleanup 5.2, 5.3, 10.13

Systems Components

64. Testing of Air Cleanup 5.2, 5.3, 10.13

Systems

65. Testing of Operational 5.3, 7.12, 10.13, 13.4

Sequence of Air

Cleanup Systems

H.2.8 Group VIII - Fuel and Waste Storage Systems (Criteria 66-69, Table H.2.8)

The criteria in this group establish requirements applicable to

fuel and waste storage systems.

Plant fuel handling and storage facilities preclude accidental

criticality and provide sufficient cooling for spent fuel (Criteria 66, 67). The new fuel storage vault racks (located in

the reactor building) are top entry and are designed to prevent an

accidental critical array even in the event the vault becomes

flooded or subjected to seismic loadings (Criterion 66). Spent

fuel handling and storage of fuel that is less than 10 years old

is entirely within the reactor building which provides containment (Criterion 69). The spent fuel storage pool has provisions to

maintain water clarity, temperature control, and has

instrumentation to monitor water level. Water depth in the pool

provides sufficient shielding for normal reactor building

occupancy by operating personnel. The racks in which spent fuel

assemblies are placed are designed and arranged to ensure

subcriticality in the storage pool (Criteria 66, 67, 68, 69). The

spent fuel pool cooling and demineralizer system is designed to

maintain the pool water temperature (decay heat removal), to

control water clarity (safe fuel movement), and to reduce

radioactivity (shielding and effluent release control) (Criteria

APPENDIX H H.2-17 REV. 26, APRIL 2017 66, 67, 68). Accessible portions of the reactor and radwaste buildings have sufficient shielding to maintain dose rates within

10CFR20 limits (Criterion 68). The radwaste systems and buildings

prevent the release of undue amounts of radioactive materials to

the environs (Criterion 69).

Fuel that is ten years old or more may be stored in the plant's

spent fuel pools of in dry storage casks at the Independent Spent

Fuel Storage Installation (ISFSI) located on the Peach Bottom

site. Design of the ISFSI is not covered under the AEC general

design criteria that apply to the power plant; ISFSI design is

covered under 10 CFR 72 and was addressed in the 10 CFR 72.212

Report prepared by PECO in accordance with 10 CFR 72.

TABLE H.2.8 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP VIII (FUEL AND WASTE STORAGE SYSTEMS)

Conformance (Reference Criterion to Sections of FSAR)

66. Prevention of Fuel 7.6, 10.2, 10.3 Storage Criticality

67. Fuel and Waste 4.8, 10.5 Storage Decay Heat

68. Fuel and Waste Storage 9.3, 10.3, 10.5, 12.3

Radiation Shielding

69. Protection Against 5.3, 7.12, 9.2, 9.3, 10.2, Radioactive Release 10.3, 10.5, 12.3 from Spent Fuel and

Waste Storage

H.2.9 Group IX - Plant Effluents (Criterion 70, Table H.2.9)

The criterion in this group establishes requirements to limit

releases of radioactive materials.

The plant radioactive waste control systems (which include the

liquid, gaseous, and solid radwaste subsystems) are designed to

limit the potential offsite radiation exposure to levels below the

limits of 10CFR20. The plant engineered safeguards are designed

to limit the offsite exposure under the postulated design basis

accidents to levels below 10 CFR 100 (Criterion 70).

APPENDIX H H.2-18 REV. 26, APRIL 2017 The radioactive effluents of the Independent Spent Fuel Storage Installation (ISFSI) are not covered under the AEC general design

criteria. Any release of effluents from the ISFSI constitutes a

design basis accident whose limits are controlled by 10 CFR

72.106. The radiological consequences of dry storage cask leakage

were addressed in the 10 CFR 72.212 Report in accordance with 10 CFR 72.212 and were found to be acceptable.

TABLE H.2.9 AEC (NRC) GENERAL DESIGN CRITERIA - GROUP IX (PLANT EFFLUENTS)

Conformance (Reference Criterion to Sections of FSAR)

70. Control of Releases 1.5, 5.2, 5.3, 7.3, 7.12, 7.13, of Radioactivity to 9.2, 9.4, 14.2-14.7, App. G

the Environment

APPENDIX H H.3-1 REV. 26, APRIL 2017 H.3 EXTENDED POWER UPRATE (EPU) GENERAL DESIGN AND OTHER CRITERIA CONFORMANCE The NRC staff's review of the PBAPS EPU application was based on NRC Review Standard RS-001, "Review Standard for Extended Power Uprates". RS-001 contains guidance for evaluating each area of review in the application, including the specific GDC used as the NRC's acceptance criteria. Since the guidance in RS-001 is based on the final GDC and PBAPS, Units 2 and 3, were designed and constructed based on the draft GDC, Exelon submitted a supplement to the EPU application dated February 15, 2013, which replaced references to the final GDC with the corresponding design criteria that constitute the current licensing basis for PBAPS.

The NRC safety evaluation dated 8/25/14 for the EPU license amendment reflected the current licensing basis of PBAPS with respect to conformance with the GDC and other criteria current at the time of EPU licensing. The paragraphs below summarize that evaluation, including the NRC acceptance criteria for operation at the EPU power level.

H.3.1 MATERIALS AND CHEMICAL ENGINEERING H.3.1.1 Reactor Vessel Material Surveillance Program The reactor vessel material surveillance program provides a means for determining and monitoring the fracture toughness of the reactor vessel beltline materials to support analyses for ensuring the structural integrity of the ferritic components of the reactor vessel. The NRC staff's review primarily focused on the effects of the proposed EPU on the licensee's reactor vessel surveillance capsule withdrawal schedule. The NRC's acceptance criteria are based on: (1) final General Design Criterion (GDC)-

14, insofar as it requires that the reactor coolant pressure boundary (RCPB) be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (2) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; (3) 10 CFR Part 50, Appendix H, which provides for monitoring changes in the fracture toughness properties of materials in the reactor vessel beltline region; and (4) 10 CFR 50.60, which requires compliance with the requirements of 10 CFR Part 50, Appendix H.

H.3.1.2 Pressure-Temperature Limits and Upper-Shelf Energy Appendix G of 10 CFR Part 50 provides fracture toughness requirements for ferritic materials in the RCPB, including requirements on the upper-shelf energy (USE) values used for

APPENDIX H H.3-2 REV. 26, APRIL 2017 assessing the safety margins of the reactor vessel materials against ductile tearing and requirements for calculating pressure-temperature (P-T) limits for the plant. These P-T limits are established to ensure the structural integrity of the ferritic components of the RCPB during any condition of normal operation, including anticipated operational occurrences and hydrostatic tests. The NRC staff's review of P-T limits covered the P-T limits methodology and the calculations for the number of EFPY specified for the proposed EPU, considering neutron embrittlement effects and using linear elastic fracture mechanics. The NRC's acceptance criteria for P-T limits are based on: (1) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (2) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; (3) 10 CFR Part 50, Appendix G, which specifies fracture toughness requirements for ferritic components of the RCPB; and (4) 10 CFR 50.60, which requires compliance with the requirements of 10 CFR Part 50, Appendix G.

H.3.1.3 Reactor Internal and Core Support Materials The reactor internals and core supports include structures, systems, and components (SSCs) that perform safety functions or whose failure could affect safety functions performed by other SSCs. These safety functions include reactivity monitoring and control, core cooling, and fission product confinement (within both the fuel cladding and the reactor coolant system (RCS)).

The NRC staff's review covered the materials' specifications and mechanical properties, welds, weld controls, nondestructive examination procedures, corrosion resistance, and susceptibility to degradation. The NRC's acceptance criteria for reactor internal and core support materials are based on draft GDC-1 and 10 CFR 50.55a for material specifications, controls on welding, and inspection of reactor internals and core supports.

H.3.1.4 Reactor Coolant Pressure Boundary Materials The RCPB defines the boundary of systems and components containing the high-pressure fluids produced in the reactor. The NRC staff's review of RCPB materials covered its specifications, compatibility with the reactor coolant, fabrication and processing, susceptibility to degradation, and degradation management programs. The NRC's acceptance criteria for RCPB materials are based on: (1) 10 CFR 50.55a and draft GDC-1, insofar as they require that those systems and components which are essential to the prevention of accidents which could affect

APPENDIX H H.3-3 REV. 26, APRIL 2017 the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture; (3) final GDC-31, insofar as it requires that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of a rapidly propagating fracture is minimized; and (4) 10 CFR Part 50, Appendix G, which specifies fracture toughness requirements for ferritic components of the RCPB.

H.3.1.5 Protective Coating Systems (Paints) - Organic Materials Protective coating systems (paints) provide a means for protecting the surfaces of facilities and equipment from corrosion and radionuclide contamination. Coatings also provide wear protection during plant operation and maintenance activities. Considering temperature, radiation and pressure, the NRC staff's review covered Service Level 1 protective coating systems used inside the containment for their suitability and stability under design basis loss-of-coolant accident (DBLOCA) conditions. The NRC's acceptance criteria for protective coating systems are based on: (1) 10 CFR Part 50, Appendix B, "Quality Assurance Criteria for Nuclear Power Plants and Fuel Reprocessing Plants," which covers quality assurance requirements for the design, fabrication, and construction of safety-related SSCs; and (2) RG 1.54, Revision 2, "Service Level I, II, and III Protective Coatings Applied to Nuclear Power Plants," which covers application and performance monitoring of coatings in nuclear power plants.

H.3.1.6 Flow-Accelerated Corrosion Flow-accelerated corrosion (FAC) is a corrosion mechanism that occurs in carbon steel components exposed to single-phase or two-phase water flow. Components made from stainless steel are immune to FAC, and FAC is significantly reduced in components containing even small amounts of chromium or molybdenum. The rates of material loss due to FAC depend on the system flow velocity, component geometry, fluid temperature, steam quality, oxygen content, and pH. During plant operation, it is not normally possible to maintain all of these parameters in a regime that minimizes FAC; therefore, loss of material by FAC can occur.

The NRC staff reviewed the effects of the proposed EPU on FAC and the adequacy of the licensee's FAC program to predict the rate of material loss so that repair or replacement of damaged components could be made before reaching a critical thickness. The NRC's

APPENDIX H H.3-4 REV. 26, APRIL 2017 acceptance criteria are based on the structural evaluation of the minimum acceptable wall thickness for the components undergoing degradation by FAC.

H.3.1.7 Reactor Water Cleanup System The reactor water cleanup (RWCU) system provides a means for maintaining reactor water quality by filtration and ion exchange and a path for removal of reactor coolant when necessary.

Portions of the RWCU system comprise the RCPB. The NRC staff's review of the RWCU system included component design parameters for flow, temperature, pressure, heat removal capability, and impurity removal capability; and the instrumentation and process controls for proper system operation and isolation. The NRC's acceptance criteria for the RWCU system are based on: (1) draft GDC-9 and 34, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (3) draft GDC 51, insofar as it requires that systems that may contain radioactivity be designed with appropriate confinement.

H.3.2 MECHANICAL AND CIVIL ENGINEERING H.3.2.1 Pipe Rupture Locations and Associated Dynamic Effects SSCs important to safety could be impacted by the pipe-whip dynamic effects of a pipe rupture. The NRC staff conducted a review of pipe rupture analyses to ensure that SSCs important to safety are adequately protected from the effects of pipe ruptures. The NRC staff's review covered: (1) the implementation of criteria for defining pipe break and crack locations and configurations; (2) the implementation of criteria dealing with special features, such as augmented inservice inspection (ISI) programs or the use of special protective devices such as pipe-whip restraints; (3) pipe-whip dynamic analyses and results, including the jet thrust and impingement forcing functions and pipe-whip dynamic effects; and (4) the design adequacy of supports for SSCs provided to ensure that the intended design functions of the SSCs will not be impaired to an unacceptable level as a result of pipe-whip or jet impingement loadings. The NRC staff's review focused on the effects that the proposed EPU may have on items (1) thru (4) above. The NRC's acceptance criteria are based on draft GDC-40 and 42 insofar as they require that protection be provided for engineered safety features (ESFs) against the dynamic effects that might result from plant equipment failures.

APPENDIX H H.3-5 REV. 26, APRIL 2017 H.3.2.2 Pressure-Retaining Components and Component Supports The NRC staff has reviewed the structural integrity of pressure-retaining components (and their supports) designed in accordance with the ASME (B&PV Code),Section III, Division 1, final GDC 14 and draft GDCs 1, 2, 9, 33, 34, 40, and 42. The NRC staff's review focused on the effects of the proposed EPU on the design input parameters and the design-basis loads and load combinations for normal operating, upset, emergency, and faulted conditions. The NRC staff's review covered: (1) the analyses of flow-induced vibration; and (2) the analytical methodologies, assumptions, ASME Code editions, and computer programs used for these analyses. The NRC staff's review also included a comparison of the resulting stresses and cumulative fatigue usage factors (CUFs) against the code-allowable limits. The NRC's acceptance criteria are based on:

(1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a loss-of-coolant accident (LOCA); (4) draft GDC-9 and 33, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (5) draft GDC-34 insofar as it requires that the RCPB be designed to minimize the probability of rapidly propagating type failures; and (6) final GDC-14, insofar as it requires that the RCPB be designed, fabricated, erected, and tested so as to have an extremely low probability of rapidly propagating fracture.

H.3.2.3 Reactor Pressure Vessel Internals and Core Supports Reactor pressure vessel internals consist of all the structural and mechanical elements inside the reactor vessel, including core support structures. The NRC staff reviewed the effects of the proposed EPU on the design input parameters and the design-basis loads and load combinations for the reactor internals for normal operation, upset, emergency, and faulted conditions. These include pressure differences and thermal effects for normal operation, transient pressure loads associated with LOCAs, and

APPENDIX H H.3-6 REV. 26, APRIL 2017 the identification of design transient occurrences. The NRC staff's review covered: (1) the analyses of flow-induced vibration for safety-related and non-safety-related reactor internal components; and (2) the analytical methodologies, assumptions, ASME Code editions, and computer programs used for these analyses. The NRC staff's review also included a comparison of the resulting stresses and CUFs against the corresponding Code-allowable limits. The NRC's acceptance criteria are based on: (1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (4) draft GDC-6, insofar as it requires that the reactor core be designed with appropriate margin to assure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of anticipated operational occurrences.

H.3.2.4 Safety-Related Valves and Pumps The NRC's staff's review included certain safety-related pumps and valves typically designated as Class 1, 2, or 3 under Section III of the ASME Code and within the scope of Section XI of the ASME Code and the ASME Code for Operation and Maintenance of Nuclear Power Plants (OM Code), as applicable. The NRC staff's review focused on the effects of the proposed EPU on the required functional performance of the valves and pumps. The review also covered any impacts that the proposed EPU may have on the licensee's motor-operated valve (MOV) program related to GL 89-10, GL 96-05, and GL 95-07. The NRC staff also evaluated the licensee's consideration of lessons learned from the MOV program and the application of those lessons learned to other safety-related power-operated valves. The NRC's acceptance criteria are based on (1): draft GDC-1, insofar as they require that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be

APPENDIX H H.3-7 REV. 26, APRIL 2017 performed; (2) draft GDC-38, 46, 47, 48, 59, 60, 61, 63, 64, and 65, insofar as they require that the emergency core cooling system (ECCS), the containment heat removal system, the containment atmospheric cleanup systems, and the cooling water system, respectively, be designed to permit appropriate periodic testing to ensure the leak-tight integrity and performance of their active components; (3) draft GDC-57, insofar as it requires that piping systems penetrating containment be designed with the capability to periodically test the operability of the isolation valves to determine if valve leakage is within acceptable limits; and (4) 10 CFR 50.55a(f), insofar as it requires that pumps and valves subject to that section must meet the inservice testing program requirements identified in that section.

H.3.2.5 Seismic and Dynamic Qualification of Mechanical and Electrical Equipment Mechanical and electrical equipment covered by this section includes equipment associated with systems that are essential to emergency reactor shutdown, containment isolation, reactor core cooling, and containment and reactor heat removal. Equipment associated with systems essential to preventing significant releases of radioactive materials to the environment are also covered by this section. The NRC staff's review focused on the effects of the proposed EPU on the qualification of the equipment to withstand seismic events and the dynamic effects associated pipe-whip and jet impingement forces. The primary input motions due to the safe shutdown earthquake (SSE) are not affected by an EPU. The NRC's acceptance criteria are based on: (1) draft GDC-1, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or to mitigation of their consequences be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that those systems and components which are essential to the prevention of accidents which could affect the public health and safety or mitigation of their consequences be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) 10 CFR Part 100, Appendix A, which sets forth the principal seismic and geologic considerations for the evaluation of the suitability of plant design bases established in consideration of the seismic and geologic characteristics of the plant site; (4) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (5) draft GDCs 9 and 33, insofar as they require that the RCPB be designed and constructed so as to have an exceedingly low probability of RCPB gross rupture or significant leakage; (6)

APPENDIX H H.3-8 REV. 26, APRIL 2017 draft GDC-34, insofar as it requires that the RCPB be designed to minimize the probability of rapidly propagating type failures; and (7) 10 CFR Part 50, Appendix B, which sets quality assurance requirements for safety-related equipment.

H.3.2.6 Replacement Steam Dryer Structural Integrity The steam dryer is a reactor internal component and is located in the steam dome portion of the reactor pressure vessel (RPV). The function of the steam dryer is to dry the steam to very high quality, approximately 99.9% quality (or 0.1% moisture carryover), when it exits the dryer. Even though the steam dryer does not perform any safety function, it must retain its structural integrity to avoid the generation of loose parts that may adversely impact the ability of other SSCs from performing their safety functions. The NRC staff's review was focused on the effects of the proposed EPU on the qualification of the replacement steam dryers (RSDs) to withstand seismic events and the dynamic effects associated with flow induced vibration, MSL break, and turbine stop valve closure.Since the steam dryer is a safety significant component, the NRC's acceptance criteria is based on: (1) 10 CFR 50.55a and draft GDC-1, insofar as they require that SSCs important to safety be designed, fabricated, erected, constructed, tested, and inspected to quality standards commensurate with the importance of the safety functions to be performed; (2) draft GDC-2, insofar as it requires that SSCs important to safety be designed to withstand the effects of earthquakes combined with the effects of normal or accident conditions; (3) draft GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; and (4) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects and missiles that might result from plant equipment failures, as well as the effects of a LOCA.

H.3.3 ELECTRICAL ENGINEERING H.3.3.1 Environmental Qualification of Electrical Equipment Environmental qualification (EQ) of electrical equipment demonstrates that the equipment is capable of performing its safety function under significant environmental stresses which could result during and following design-basis accidents (DBAs).

The NRC staff's review focused on the effects of the proposed EPU on the environmental conditions that the electrical equipment will be exposed to during normal operation, anticipated operational occurrences, and accidents. The NRC staff's review was conducted to ensure that the electrical equipment will

APPENDIX H H.3-9 REV. 26, APRIL 2017 continue to be capable of performing its safety functions following implementation of the proposed EPU. The NRC's acceptance criteria for EQ of electrical equipment are based on 10 CFR 50.49, which sets forth requirements for the qualification of electrical equipment important to safety that is located in a harsh environment.

H.3.3.2 Offsite Power System The offsite power system includes two or more physically independent circuits capable of operating independently of the onsite standby power sources. The NRC staff's review covered the descriptive information, analyses, and referenced documents for the offsite power system; and the stability studies for the electrical transmission grid. The NRC staff's review focused on whether the loss of the nuclear unit, the largest operating unit on the grid, or the most critical transmission line will result in the loss of offsite power (LOOP) to the plant following implementation of the proposed EPU. The NRC's acceptance criteria for offsite power systems are based on final GDC-17.

H.3.3.3 Alternating Current Onsite Power System The alternating current (AC) onsite power system includes those standby power sources, distribution systems, and auxiliary supporting systems provided to supply power to safety-related equipment. The NRC staff's review covered the descriptive information, analyses, and referenced documents for the AC onsite power system. The NRC's acceptance criteria for the AC onsite power system are based on final GDC-17, insofar as it requires the system to have the capacity and capability to perform its intended functions during anticipated operational occurrences and accident conditions.

H.3.3.4 Direct Current Onsite Power System The direct current (DC) onsite power system includes the DC power sources and their distribution and auxiliary supporting systems that are provided to supply motive or control power to safety-related equipment. The NRC staff's review covered the information, analyses, and referenced documents for the DC onsite power system. The NRC's acceptance criteria for the DC onsite power system are based on final GDC-17, insofar as it requires the system to have the capacity and capability to perform its intended functions during anticipated operational occurrences and accident conditions.

APPENDIX H H.3-10 REV. 26, APRIL 2017 H.3.3.5 Station Blackout (SBO)

Station blackout (SBO) refers to a complete loss of AC electric power to the essential and nonessential switchgear buses in a nuclear power plant. SBO involves the LOOP concurrent with a turbine trip and failure of the onsite emergency AC power system.

SBO does not include the loss of available AC power to buses fed by station batteries through inverters or the loss of power from "alternate ac sources" (AACs). The NRC staff's review focused on the impact of the proposed EPU on the plant's ability to cope with and recover from an SBO event for the period of time established in the plant's licensing basis. The NRC's acceptance criteria for SBO are based on 10 CFR 50.63.

H.3.4 INSTRUMENTATION AND CONTROLS H.3.4.1 Reactor Protection, Safety Features Actuation, and Control Systems Instrumentation and control systems are provided: (1) to control plant processes having a significant impact on plant safety; (2) to initiate the reactivity control system (including control rods); (3) to initiate the engineered safety features (ESF) systems and essential auxiliary supporting systems; and (4) for use to achieve and maintain a safe shutdown condition of the plant. Diverse instrumentation and control systems and equipment are provided for the express purpose of protecting against potential common-mode failures of instrumentation and control protection systems. The NRC staff conducted a review of the reactor trip system, engineered safety feature actuation system (ESFAS), safe shutdown systems, control systems, and diverse instrumentation and control systems for the proposed EPU to ensure that the systems and any changes necessary for the proposed EPU are adequately designed such that the systems continue to meet their safety functions. The NRC staff's review was also conducted to ensure that failures of the systems do not affect safety functions. The NRC's acceptance criteria related to the quality of design of protection and control systems are based on 10 CFR 50.55a(a)(1), 10 CFR 50.55a(h), final GDC-19 and draft GDCs 1, 12, 13, 14, 15, 19, 20, 22, 23, 25, 26, 40, and 42.

H.3.5 PLANT SYSTEMS H.3.5.1 Internal Hazards H.3.5.1.1 Flooding The NRC staff conducted a review in the area of flood protection to ensure that SSCs important to safety are protected from flooding. The NRC staff's review covered flooding of SSCs

APPENDIX H H.3-11 REV. 26, APRIL 2017 important to safety from internal sources, such as those caused by failures of tanks and vessels. The NRC staff's review focused on increases of fluid volumes in tanks and vessels assumed in flooding analyses to assess the impact of any additional fluid on the flooding protection that is provided. The NRC's acceptance criteria for flood protection are based on draft GDC-2.

H.3.5.1.1.2 Equipment and Floor Drains The function of the equipment and floor drainage system (EFDS) is to assure that waste liquids, valve and pump leak-offs, and tank drains are directed to the proper area for processing or disposal. The EFDS is designed to handle the volume of leakage expected, prevent a backflow of water that might result from maximum flood levels to areas of the plant containing safety-related equipment, and protect against the potential for inadvertent transfer of contaminated fluids to an uncontaminated drainage system. The NRC staff's review of the EFDS included the collection and disposal of liquid effluents outside containment.

The NRC staff's review focused on any changes in fluid volumes or pump capacities that are necessary for the proposed EPU and are not consistent with previous assumptions with respect to floor drainage considerations. The NRC's acceptance criteria for the EFDS are based on draft GDC-2 insofar as it requires the EFDS to be designed to withstand the effects of earthquakes and to be compatible with the environmental conditions (flooding) associated with normal operation, maintenance, testing, and postulated accidents (pipe failures and tank ruptures).

H.3.5.1.1.3 Circulating Water Systems The circulating water system (CWS) provides a continuous supply of cooling water to the main condenser to remove the heat rejected by the turbine cycle and auxiliary systems. The NRC staff's review of the CWS focused on changes in flooding analyses that are necessary due to increases in fluid volumes or installation of larger capacity pumps or piping needed to accommodate the proposed EPU.

H.3.5.1.2 Missile Protection H.3.5.1.2.1 Internally Generated Missiles The NRC staff's review concerns missiles that could result from in-plant component overspeed failures and high-pressure system ruptures. The NRC staff's review of potential missile sources covered pressurized components and systems, and high-speed rotating machinery. The NRC staff's review was conducted to ensure that safety-related SSCs are adequately protected from

APPENDIX H H.3-12 REV. 26, APRIL 2017 internally generated missiles. In addition, for cases where safety-related SSCs are located in areas containing non-safety-related SSCs, the NRC staff reviewed the non-safety-related SSCs to ensure that their failure will not preclude the intended safety function of the safety-related SSCs. The NRC staff's review focused on any increases in system pressures or component overspeed conditions that could result during plant operation, anticipated operational occurrences, or changes in existing system configurations such that missile barrier considerations could be affected. The NRC's acceptance criteria for the protection of SSCs important to safety against the effects of internally generated missiles that may result from equipment failures are based on draft GDC-40. H.3.5.1.2.2 Turbine Generator The turbine control system, steam inlet stop and control valves, low pressure turbine steam intercept and inlet control valves, and extraction steam control valves control the speed of the turbine under normal and abnormal conditions, and are thus related to the overall safe operation of the plant. The NRC staff's review of the turbine generator focused on the effects of the proposed EPU on the turbine overspeed protection features to ensure that a turbine overspeed condition above the design overspeed is very unlikely. The NRC's acceptance criteria for the turbine generator are based on draft GDC-40 and relates to protection of SSCs important to safety from the effects of turbine missiles by providing a turbine overspeed protection system (with suitable redundancy) to minimize the probability of generating turbine missiles.

H.3.5.1.3 Pipe Failures The NRC staff conducted a review of the plant design for protection from piping failures outside containment to ensure that: (1) such failures would not cause the loss of needed functions of safety-related systems; and (2) the plant could be safely shut down in the event of such failures. The NRC staff's review of pipe failures included high and moderate energy fluid system piping located outside of containment. The NRC staff's review focused on the effects of pipe failures on plant environmental conditions, control room habitability, and access to areas important to safe control of post-accident operations where the consequences are not bounded by previous analyses. The NRC's acceptance criteria for pipe failures are based on draft GDC-40, insofar as it requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures.

APPENDIX H H.3-13 REV. 26, APRIL 2017 H.3.5.1.4 Fire Protection The purpose of the fire protection program (FPP) is to provide assurance, through a defense-in-depth design, that a fire will not prevent the performance of necessary safe plant shutdown functions and will not significantly increase the risk of radioactive releases to the environment. The NRC staff's review focused on the effects of the increased decay heat on the plant's safe shutdown analysis to ensure that SSCs required for the safe shutdown of the plant are protected from the effects of the fire and will continue to be able to achieve and maintain safe shutdown following a fire. The NRC's acceptance criteria for the FPP are based on: (1) 10 CFR 50.48 and associated Appendix R to 10 CFR Part 50, insofar as they require the development of an FPP to ensure, among other things, the capability to safely shut down the plant; (2) final GDC-3, insofar as it requires that (a) SSCs important to safety be designed and located to minimize the probability and effect of fires, (b) noncombustible and heat resistant materials be used, and (c) fire detection and fighting systems be provided and designed to minimize the adverse effects of fires on SSCs important to safety; and (3) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.5.2 Fission Product Control H.3.5.2.1 Fission Product Control Systems and Structures The NRC staff's review for fission product control systems and structures covered the basis for developing the mathematical model for DBLOCA dose computations, the values of key parameters, the applicability of important modeling assumptions, and the functional capability of ventilation systems used to control fission product releases. The NRC staff's review primarily focused on any adverse effects that the proposed EPU may have on the assumptions used in the analyses for control of fission products. The NRC's acceptance criteria are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.5.2.2 Main Condenser Evacuation System The main condenser evacuation system (MCES) generally consists of two subsystems: (1) the "hogging" or startup system which initially establishes main condenser vacuum; and (2) the system which maintains condenser vacuum once it has been established.

The NRC staff's review focused on modifications to the system that may affect gaseous radioactive material handling and release

APPENDIX H H.3-14 REV. 26, APRIL 2017 assumptions, and design features to preclude the possibility of an explosion (if the potential for explosive mixtures exists).

The NRC's acceptance criteria for the MCES are based on:

(1) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (2) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences and postulated accidents.

H.3.5.2.3 Turbine Gland Sealing System The turbine gland sealing system is provided to control the release of radioactive material from steam in the turbine to the environment. The NRC staff reviewed changes to the turbine gland sealing system with respect to factors that may affect gaseous radioactive material handling (e.g., source of sealing steam, system interfaces, and potential leakage paths). The NRC's acceptance criteria for the turbine gland sealing system are based on: (1) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; and (2) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences and postulated accidents.

H.3.5.3 Component Cooling and Decay Heat Removal H.3.5.3.1 Spent Fuel Pool Cooling and Cleanup System The spent fuel pool (SFP) provides wet storage of spent fuel assemblies. The safety function of the spent fuel pool cooling and cleanup system is to cool the spent fuel assemblies and keep the spent fuel assemblies covered with water during all storage conditions. The NRC staff's review for the proposed EPU focused on the effects of the proposed EPU on the capability of the system to provide adequate cooling to the spent fuel during all operating and accident conditions. The NRC's acceptance criteria for the spent fuel pool cooling and cleanup system are based on:

(1) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown that safety is not impaired by the sharing; (2) draft GDC-67, insofar that reliable decay heat removal systems are necessary to prevent damage to stored spent fuel; and (3) final GDC-61, insofar as it requires that fuel storage systems be designed with RHR capability reflecting the importance to safety of decay heat removal, and

APPENDIX H H.3-15 REV. 26, APRIL 2017 measures to prevent a significant loss of fuel storage coolant inventory under accident conditions.

APPENDIX H H.3-16 REV. 26, APRIL 2017 H.3.5.3.2 Station Service Water Systems The station service water system (SWS) provides essential cooling to safety-related equipment and may also provide cooling to non-safety-related auxiliary components that are used for normal plant operation. The SWS includes the emergency service water (ESW) and HPSW systems. The NRC staff's review covered the characteristics of the station SWS (i.e., ESW and HPSW systems) components with respect to their functional performance as affected by adverse operational (i.e., water hammer) conditions, abnormal operational conditions, and accident conditions (e.g., a LOCA with the LOOP). The NRC staff's review focused on the additional heat load that would result from the proposed EPU.

The NRC's acceptance criteria are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-41, insofar that the SWS is relied upon by engineered safety features for performing their safety functions; and (3) draft GDC-52, insofar that the SWS is relied upon by containment heat removal systems for performing their safety functions; and (4) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.5.3.3 Reactor Auxiliary Cooling Water Systems The NRC staff's review covered reactor auxiliary cooling water systems that are required for: (1) safe shutdown during normal operations, anticipated operational occurrences, and mitigating the consequences of accident conditions; or (2) preventing the occurrence of an accident. These systems include closed-loop auxiliary cooling water systems for reactor system components, reactor shutdown equipment, ventilation equipment, and components of the ECCS. The NRC staff's review covered the capability of the auxiliary cooling water systems to provide adequate cooling water to safety-related ECCS components and reactor auxiliary equipment for all planned operating conditions. Emphasis was placed on the cooling water systems for safety-related components (e.g., ECCS equipment, ventilation equipment, and reactor shutdown equipment). The NRC staff's review focused on the additional heat load that would result from the proposed EPU.

The NRC's acceptance criteria for the reactor auxiliary cooling water system are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; and (3) draft GDC-41, insofar that the Reactor Auxiliary Cooling Water Systems

APPENDIX H H.3-17 REV. 26, APRIL 2017 are relied upon by engineered safety features for performing their safety functions.

H.3.5.3.4 Ultimate Heat Sink The ultimate heat sink (UHS) is the source of cooling water provided to dissipate reactor decay heat and essential cooling system heat loads after a normal reactor shutdown or a shutdown following an accident. The NRC staff's review focused on the impact that the proposed EPU has on the decay heat removal capability of the UHS. Additionally, the NRC staff's review included evaluation of the design-basis UHS temperature limit determination to confirm that post-licensing data trends (e.g., air and water temperatures, humidity, wind speed, water volume) do not establish more severe conditions than previously assumed.

The NRC's acceptance criteria for the UHS are based on: (1) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; (2) draft GDC-41, insofar that the UHS is relied upon by engineered safety features for performing their safety functions; and (3) draft GDC-52, insofar that the UHS is relied upon by containment heat removal systems for performing their safety functions.

H.3.5.4 Balance-of-Plant Systems H.3.5.4.1 Main Steam The main steam supply system (MSSS) transports steam from the NSSS to the power conversion system and various safety-related and non-safety-related auxiliaries. The NRC staff's review focused on the effects of the proposed EPU on the system's capability to transport steam to the power conversion system, provide heat sink capacity, supply steam to drive safety system pumps, and withstand adverse dynamic loads (e.g., water steam hammer resulting from rapid valve closure and relief valve fluid discharge loads). The NRC's acceptance criteria for the MSSS are based on: (1) draft GDC-40 insofar as it requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.5.4.2 Main Condenser The main condenser (MC) system is designed to condense and de-aerate the exhaust steam from the main turbine and provide a heat sink for the turbine bypass system (TBS). For BWRs without a

APPENDIX H H.3-18 REV. 26, APRIL 2017 main steam isolation valve (MSIV) leakage control system, the MC system may also serve an accident mitigation function to act as a holdup volume for the plate out of fission products leaking through the MSIVs following core damage. The NRC staff's review focused on the effects of the proposed EPU on the steam bypass capability with respect to load rejection assumptions, and on the ability of the MC system to withstand the blowdown effects of steam from the TBS. The NRC's acceptance criteria for the MC system are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.5.4.3 Turbine Bypass The TBS is designed to discharge a stated percentage of rated main steam flow directly to the MC system, bypassing the turbine.

This steam bypass enables the plant to take step-load reductions up to the TBS capacity without the reactor or turbine tripping.

The system is also used during startup and shutdown to control reactor pressure. For a BWR without an MSIV leakage control system, the TBS could also provide an accident mitigation function. A TBS, along with the MSSS and MC system, may be credited for mitigating the effects of MSIV leakage during a LOCA by the holdup and plate out of fission products. The NRC staff's review for the TBS focused on the effects that the proposed EPU have on load rejection capability, analysis of postulated system piping failures, and the consequences of inadvertent TBS operation. The NRC's acceptance criteria for the TBS are based on draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA. H.3.5.4.4 Condensate and Feedwater The condensate and feedwater system (CFS) provides feedwater at a particular temperature, pressure, and flow rate to the reactor.

The only part of the CFS classified as safety-related is the feedwater piping from the NSSS up to and including the outermost containment isolation valve. The NRC staff's review focused on how the proposed EPU affects previous analyses and considerations with respect to the capability of the CFS to supply adequate feedwater during plant operation and shutdown, and isolate components, subsystems, and piping in order to preserve the system's safety function. The NRC's acceptance criteria for the CFS are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-4, insofar as reactor

APPENDIX H H.3-19 REV. 26, APRIL 2017 facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.5.5 Waste Management Systems H.3.5.5.1 Gaseous Waste Management System The gaseous waste management system (GWMS) involves the gaseous radwaste system, which deals with the management of radioactive gases collected in the offgas system or the waste gas storage and decay tanks. In addition, it involves the management of the condenser air removal system; the gland seal exhaust and the mechanical vacuum pump operation exhaust; and the building ventilation system exhausts. The NRC staff's review focused on the effects that the proposed EPU may have on: (1) the design criteria of the GWMS; (2) methods of treatment; (3) expected releases; (4) principal parameters used in calculating the releases of radioactive materials in gaseous effluents; and (5) design features for precluding the possibility of an explosion if the potential for explosive mixtures exists. The NRC's acceptance criteria for the GWMS are based on (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the boundary of the unrestricted area do not exceed specified values; (2) final GDC-3, insofar as it requires that (a) SSCs important to safety be designed and located to minimize the probability and effect of fires, (b) noncombustible and heat resistant materials be used, and (c) fire detection and fighting systems be provided and designed to minimize the adverse effects of fires on SSCs important to safety; (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; (4) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement; and (5) 10 CFR Part 50, Appendix I, Sections II.B, II.C, and II.D, which set numerical guides for design objectives and limiting conditions for operation to meet the "as low as is reasonably achievable" (ALARA) criterion.

H.3.5.5.2 Liquid Waste Management System The NRC staff's review for liquid waste management system (LWMS) focused on the effects that the proposed EPU may have on previous analyses and considerations related to the system design, design objectives, design criteria, methods of treatment, expected releases, and principal parameters used in calculating the releases of radioactive materials in liquid effluents. The NRC's acceptance criteria for the LWMS are based on: (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the

APPENDIX H H.3-20 REV. 26, APRIL 2017 boundary of the unrestricted area do not exceed specified values; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; (3) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement; and (4) 10 CFR Part 50, Appendix I, Sections II.A and II.D, which set numerical guides for dose design objectives and limiting conditions for operation to meet the ALARA criterion.

H.3.5.5.3 Solid Waste Management System The NRC staff's review for the solid waste management system (SWMS) focused on the effects that the proposed EPU may have on previous analyses and considerations related to the design objectives in terms of expected volumes of waste to be processed and handled, the wet and dry types of waste to be processed, the activity and expected radionuclide distribution contained in the waste, equipment design capacities, and the principal parameters employed in the design of the SWMS. The NRC's acceptance criteria for the SWMS are based on: (1) 10 CFR 20.1302, insofar as it provides for demonstrating that annual average concentrations of radioactive materials released at the boundary of the unrestricted area do not exceed specified values; (2) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents; (3) final GDC-63, insofar as it requires that systems be provided in waste handling areas to detect conditions that may result in excessive radiation levels, (4) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including anticipated operational occurrences (AOOs), and postulated accidents; and (5) 10 CFR Part 71, which states requirements for radioactive material packaging.

H.3.5.6 Additional Considerations H.3.5.6.1 Emergency Diesel Engine Fuel Oil Storage and Transfer System Nuclear power plants are required to have redundant onsite emergency power supplies of sufficient capacity to perform their safety functions (e.g., power diesel engine-driven generator sets), assuming a single failure. The NRC staff's review focused on increases in emergency diesel generator electrical demand and the resulting increase in the amount of fuel oil necessary for the system to perform its safety function. The NRC's acceptance criteria for the emergency diesel engine fuel oil storage and transfer system are based on: (1) draft GDC-40, insofar as it

APPENDIX H H.3-21 REV. 26, APRIL 2017 requires that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; and (3) final GDC-17, insofar as it requires onsite power supplies to have sufficient independence and redundancy to perform their safety functions, assuming a single failure.

H.3.5.6.2 Light Load Handling System (Related to Refueling)

The light-load handling system (LLHS) includes components and equipment used in handling new fuel at the receiving station and the loading of spent fuel into shipping casks. The NRC staff's review covered the avoidance of criticality accidents, radioactivity releases resulting from damage to irradiated fuel, and unacceptable personnel radiation exposures. The NRC staff's review focused on the effects of the new fuel on system performance and related analyses. The NRC's acceptance criteria for the LLHS are based on: (1) final GDC-61, insofar as it requires that systems that contain radioactivity be designed with appropriate confinement and with suitable shielding for radiation protection; and (2) final GDC-62, insofar as it requires that criticality be prevented.

H.3.6 CONTAINMENT REVIEW CONSIDERATIONS H.3.6.1 Primary Containment Functional Design The containment encloses the reactor system and is the final barrier against the release of significant amounts of radioactive fission products in the event of an accident. The NRC staff's review for the primary containment functional design covered:

(1) the temperature and pressure conditions in the drywell and wetwell due to a spectrum of postulated LOCAs; (2) the differential pressure across the operating deck for a spectrum of LOCAs (Mark II containments only); (3) suppression pool dynamic effects during a LOCA or following the actuation of one or more RCS safety/relief valves; (4) the consequences of a LOCA occurring within the containment (wetwell); (5) the capability of the containment to withstand the effects of steam bypassing the suppression pool; (6) the suppression pool temperature limit during RCS safety/relief valve operation; and (7) the analytical models used for containment analysis. The NRC's acceptance criteria for the primary containment functional design are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-10, insofar as it requires that

APPENDIX H H.3-22 REV. 26, APRIL 2017 reactor containment be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other engineered safety features as may be necessary, to retain functional capability for as long as the situation requires; (3) draft GDC-49, insofar as it requires that the containment and its associated heat removal systems be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA, including considerable margin for effects from metal-water or other chemical reactions that could occur as a consequence of failure of emergency core cooling systems; (4) draft GDC-12, insofar as it requires that instrumentation and controls be provided as required to monitor and maintain variables within prescribed operating ranges; and (5) final GDC-64, insofar as it requires that means be provided to monitor the reactor containment atmosphere for radioactivity that may be released from normal operations and from postulated accidents.

H.3.6.2 Sub-compartment Analysis A sub-compartment is defined as any fully or partially enclosed volume within the primary containment that houses high-energy piping and would limit the flow of fluid to the main containment volume in the event of a postulated pipe rupture within the volume. The NRC staff's review for sub-compartment analyses covered the determination of the design differential pressure values for containment sub-compartments. The NRC staff's review focused on the effects of the increase in mass and energy release into the containment due to operation at EPU conditions, and the resulting increase in pressurization. The NRC's acceptance criteria for sub-compartment analyses are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-49, insofar as it requires that the containment be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA.

H.3.6.3 Mass and Energy Release Analysis for LOCA The release of high-energy fluid into containment from pipe breaks could challenge the structural integrity of the containment, including sub-compartments and systems within the containment. The NRC staff's review covered the energy sources that are available for release to the containment and the mass and energy (M&E) release rate calculations for the initial

APPENDIX H H.3-23 REV. 26, APRIL 2017 blowdown phase of the accident. The NRC's acceptance criteria for mass and energy release analyses for postulated LOCAs are based on: (1) draft GDC-49, insofar as it requires that the containment and its associated heat removal systems be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA; and (2) 10 CFR Part 50, Appendix K, insofar as it identifies sources of energy during a LOCA.

H.3.6.4 Combustible Gas Control in Containment Following a LOCA, hydrogen and oxygen may accumulate inside the containment due to chemical reactions between the fuel rod cladding and steam, corrosion of aluminum and other materials, and radiolytic decomposition of water. If excessive hydrogen is generated, it may form a combustible mixture in the containment atmosphere. The NRC staff's review covered: (1) the production and accumulation of combustible gases; (2) the capability to prevent high concentrations of combustible gases in local areas; (3) the capability to monitor combustible gas concentrations; and (4) the capability to reduce combustible gas concentrations. The NRC staff's review primarily focused on any impact that the proposed EPU may have on hydrogen release assumptions, and how increases in hydrogen release are mitigated. The NRC's acceptance criteria for combustible gas control in containment are based on: (1) 10 CFR 50.44, insofar as it requires that plants be provided with the capability for controlling combustible gas concentrations in the containment atmosphere; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.6.5 Containment Heat Removal Fan cooler systems, spray systems, and residual heat removal (RHR) systems are provided to remove heat from the containment atmosphere and from the water in the containment wetwell. The NRC staff's review in this area focused on: (1) the effects of the proposed EPU on the analyses of the available net positive suction head (NPSH) to the containment heat removal system pumps; and (2) the analyses of the heat removal capabilities of the spray water system and the fan cooler heat exchangers. The NRC's acceptance criteria for containment heat removal are based on draft GDCs 41 and 52, insofar as they require that a containment heat removal system be provided, and that its function shall be to prevent exceeding containment design pressure under accident conditions.

H.3.6.6 Secondary Containment Functional Design

APPENDIX H H.3-24 REV. 26, APRIL 2017 The secondary containment structure and supporting systems of dual containment plants are provided to collect and process radioactive material that may leak from the primary containment following an accident. The supporting systems maintain a negative pressure within the secondary containment and process this leakage. The NRC staff's review covered: (1) analyses of the pressure and temperature response of the secondary containment following accidents within the primary and secondary containments; (2) analyses of the effects of openings in the secondary containment on the capability of the depressurization and filtration system to establish a negative pressure in a prescribed time; (3) analyses of any primary containment leakage paths that bypass the secondary containment; (4) analyses of the pressure response of the secondary containment resulting from inadvertent depressurization of the primary containment when there is vacuum relief from the secondary containment; and (5) the acceptability of the mass and energy release data used in the analysis. The NRC staff's review primarily focused on the effects that the proposed EPU may have on the pressure and temperature response and drawdown time of the secondary containment, and the impact this may have on offsite dose. The NRC's acceptance criteria for secondary containment functional design are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (2) draft GDC-10, insofar as it requires that reactor containment be designed to sustain the initial effects of gross equipment failures, such as a large coolant boundary break, without loss of required integrity and, together with other ESFs as may be necessary, to retain functional capability for as long as the situation requires.

H.3.6.7 Containment Review Considerations H.3.6.7.1 Containment Isolation The NRC staff acceptance criteria for the containment isolation are based on draft GDC-49, insofar as it requires that the containment be designed so that the containment structure can accommodate, without exceeding the design leakage rate, the pressures and temperatures resulting from the largest credible energy release following a LOCA.

H.3.6.7.2 Generic Letter 89-13 NRC GL 89-13, "Service Water System Problems Affecting Safety-Related Equipment" requested licensees to establish a routine inspection and maintenance program to ensure that corrosion, erosion, protective coating failure, silting, and biofouling/tube

APPENDIX H H.3-25 REV. 26, APRIL 2017 plugging cannot degrade the performance of the safety-related systems supplied by service water. These issues relate to the evaluation of safety-related HXs using service water and whether they have the potential for fouling, thereby causing degradation in performance, and the mandate that there exist a permanent plant test and inspection program to accomplish and maintain this evaluation. H.3.6.7.3 Generic Letter 89-16 Generic Letter 89-16, "Installation of a Hardened Wetwell Vent" discusses the advantages of installing a hardened containment (wetwell) vent and requested information from licensees on installation of such a vent. This was a result of the NRC's BWR Mark I Containment Performance Improvement Program.

H.3.6.7.4 Generic Letter 96-06 NRC GL 96-06, "Assurance of Equipment Operability and Containment Integrity During Design-Basis Accident Conditions" identifies the following potential problems with equipment operability and containment integrity during DBA conditions: (1) cooling water systems serving the containment air coolers may be exposed to water hammer during postulated accident conditions; (2) cooling water systems serving the containment air coolers may experience two-phase flow conditions during postulated accident conditions; and (3) thermally induced overpressurization of isolated water-filled piping sections in containment could jeopardize the ability of accident-mitigating systems to perform their safety functions and could also lead to a breach of containment integrity via bypass leakage. GL 96-06 questioned whether the higher heat loads at accident conditions could potentially cause steam bubbles, water hammer, and two-phase flow due to the higher outlet temperatures from cooled components, particularly the containment fan coolers.

H.3.7 HABITABILITY, FILTRATION AND VENTILATION H.3.7.1 Control Room Habitability System The NRC staff reviewed the control room habitability system and control building layout and structures to ensure that plant operators are adequately protected from the effects of accidental releases of toxic and radioactive gases. A further objective of the NRC staff's review was to ensure that the control room can be maintained as the backup center from which technical support center personnel can safely operate in the case of an accident.

The NRC staff's review focused on the effects of the proposed EPU on radiation doses, toxic gas concentrations, and estimates of dispersion of airborne contamination. The NRC's acceptance

APPENDIX H H.3-26 REV. 26, APRIL 2017 criteria for the control room habitability system are based on:

(1) final GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with postulated accidents, including the effects of the release of toxic gases; and (2) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident.

H.3.7.2 Engineered Safety Feature Atmospheric Cleanup Engineered safety feature (ESF) atmosphere cleanup systems are designed for fission product removal in post-accident environments. These systems generally include primary systems (e.g., in-containment recirculation) and secondary systems (e.g., standby gas treatment systems and emergency or post-accident air-cleaning systems) for the fuel-handling building, control room, shield building, and areas containing ESF components. For each ESF atmosphere cleanup system, the NRC staff's review focused on the effects of the proposed EPU on system functional design, environmental design, and provisions to preclude temperatures in the adsorber section from exceeding design limits. The NRC's acceptance criteria for ESF atmosphere cleanup systems are based on: (1) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent, to any part of the body, for the duration of the accident; (2) draft GDC-69, insofar as it requires that systems that may contain radioactivity be designed to assure adequate safety under normal and postulated accident conditions; and (3) final GDC-64, insofar as it requires that means be provided for monitoring effluent discharge paths and the plant environs for radioactivity that may be released from normal operations, including AOOs, and postulated accidents.

H.3.7.3 Control Room Area Heating, Ventilation and Air Conditioning System The function of the control room area heating, ventilation and air conditioning (HVAC) system is to provide a controlled environment for the comfort and safety of control room personnel and to support the operability of control room components during normal operation, AOOs, and DBA conditions. The NRC's review of the control room area HVAC system focused on the effects that the proposed EPU will have on the functional performance of safety-

APPENDIX H H.3-27 REV. 26, APRIL 2017 related portions of the system. The review included the effects of radiation, combustion, and other toxic products; and the expected environmental conditions in areas served by the system.

The NRC's acceptance criteria for the control room area HVAC system are based on: (1) final GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of and to be compatible with the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; (2) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem whole body, or its equivalent to any part of the body, for the duration of the accident; and (3) final GDC-60 , insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.7.4 Spent Fuel Pool Area Ventilation System The PBAPS design does not contain a separate spent fuel pool area ventilation system. Ventilation in this area is provided by the reactor building HVAC system under normal conditions. The SGTS provides ventilation in this area during accident conditions.

The reactor building HVAC system is evaluated in Section H.3.7.5.

The SGTS is evaluated in Sections H.3.5.2.1 and H.3.6.6.

H.3.7.5 Reactor, Turbine, Drywell and Radwaste Area Ventilation Systems The function of the reactor building, turbine building, drywell and radwaste building HVAC systems is to maintain ventilation in the reactor, turbine, drywell, and radwaste buildings to permit personnel access, and control the concentration of airborne radioactive material in these areas during normal operation, during AOOs, and after postulated accidents. The NRC staff's review focused on the effects of the proposed EPU on the functional performance of the safety-related portions of these systems. The NRC's acceptance criteria for the systems are based on final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.7.6 Engineered Safety Feature Heating, Ventilation and Air Conditioning Systems The function of the ESF HVAC system is to provide a suitable and controlled environment for ESF components following certain anticipated transients and DBAs. The NRC staff's review for the ESF HVAC systems focused on the effects of the proposed EPU on the functional performance of the safety-related portions of the

APPENDIX H H.3-28 REV. 26, APRIL 2017 system. The NRC staff's review also covered: (1) the ability of the ESF equipment in the areas being serviced by the ventilation system to function under degraded system performance; (2) the capability of the systems to circulate sufficient air to prevent accumulation of flammable or explosive gas or fuel-vapor mixtures from components (e.g., storage batteries and stored fuel); and (3) the capability of the systems to control airborne particulate material (dust) accumulation. The NRC's acceptance criteria for the ESF HVAC systems are based on: (1) draft GDC-40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) final GDC-17, insofar as it requires onsite and offsite electric power systems be provided to permit functioning of SSCs important to safety; and (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.8 REACTOR SYSTEMS H.3.8.1 Fuel System Design The fuel system consists of arrays of fuel rods, burnable poison rods, spacer grids and springs, end plates, channel boxes, and reactivity control rods. The NRC staff reviewed the fuel system to ensure that: (1) the fuel system is not damaged as a result of normal operation and AOOs; (2) fuel system damage is never so severe as to prevent control rod insertion when it is required; (3) the number of fuel rod failures is not underestimated for postulated accidents; and (4) coolability is always maintained.

The NRC staff's review covered fuel system damage mechanisms, limiting values for important parameters, and performance of the fuel system during normal operation, AOOs, and postulated accidents. The NRC's acceptance criteria are based on: (1) 10 CFR 50.46, insofar as it establishes standards for the calculation of ECCS performance and acceptance criteria for that calculated performance; (2) final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that specified acceptable fuel design limits (SAFDLs) are not exceeded during any condition of normal operation, including the effects of AOOs; and (3) draft GDCs 37, 41, and 44, insofar as they require that a system to provide abundant emergency core cooling be provided to prevent fuel damage following a LOCA.

H.3.8.2 Nuclear Design The NRC staff reviewed the nuclear design of the fuel assemblies, control systems, and reactor core to ensure that fuel design limits will not be exceeded during normal operation and

APPENDIX H H.3-29 REV. 26, APRIL 2017 anticipated operational transients, and that the effects of postulated reactivity accidents will not cause significant damage to the RCPB or impair the capability to cool the core. The NRC staff's review covered core power distribution, reactivity coefficients, reactivity control requirements and control provisions, control rod patterns and reactivity worths, criticality, burnup, and vessel irradiation. The NRC's acceptance criteria are based on: (1) final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs; (2) draft GDC-8, insofar as it requires that the reactor core be designed so that the overall power coefficient in the power operating range shall not be positive; (3) final GDC-12, insofar as it requires that the reactor core be designed to assure that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can be reliably and readily detected and suppressed; (4) draft GDCs 12 and 13, insofar as they require that instrumentation and controls be provided, as required, to monitor and maintain variables within prescribed operating ranges through the core life; (5) draft GDCs 14 and 15, insofar as they require that the protection system be designed to initiate the reactivity control systems automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and to initiate operation of ESFs under accident situations; (6) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits; (7) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (8) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; and (9) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the reactor coolant pressure boundary; or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.

H.3.8.3 Thermal and Hydraulic Design

APPENDIX H H.3-30 REV. 26, APRIL 2017 The NRC staff reviewed the thermal and hydraulic design of the core and the RCS to confirm that the design: (1) has been accomplished using acceptable analytical methods; (2) is equivalent to or a justified extrapolation from proven designs; (3) provides acceptable margins of safety from conditions which would lead to fuel damage during normal reactor operation and AOOs; and (4) is not susceptible to thermal-hydraulic instability. The NRC's acceptance criteria are based on: (1) final GDC-10, insofar as it requires that the reactor core be designed with appropriate margin to assure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs; and (2) final GDC-12, insofar as it requires that the reactor core and associated coolant, control, and protection systems be designed to assure that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can reliably and readily be detected and suppressed.

H.3.8.4 Emergency Systems H.3.8.4.1 Functional Design of Control Rod Drive System The NRC staff's review covered the functional performance of the control rod drive (CRD) system to confirm that the system can affect a safe shutdown, respond within acceptable limits during AOOs, and prevent or mitigate the consequences of postulated accidents. The review also covered the CRD cooling system to ensure that it will continue to meet its design requirements.

The NRC's acceptance criteria are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; (2) draft GDC-26, insofar as it requires that the protection system be designed to fail into a safe state; (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits; (4) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (5) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (6) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the reactor

APPENDIX H H.3-31 REV. 26, APRIL 2017 coolant pressure boundary; or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling; and (7) 10 CFR 50.62(c)(3), insofar as it requires that all BWRs have an alternate rod injection (ARI) system diverse from the reactor trip system, and that the ARI system have redundant scram air header exhaust valves.

H.3.8.4.2 Overpressure Protection During Power Operations Overpressure protection for the RCPB during power operation is provided by relief and safety valves and the reactor protection system. The NRC staff's review covered relief and safety valves on the main steamlines and piping from these valves to the suppression pool. The NRC's acceptance criteria are based on:

(1) draft GDC-9, insofar as it requires that the RCPB be designed and constructed so as to have an exceedingly low probability of gross rupture or significant leakage throughout its design lifetime; and (2) final GDC-31, insofar as it requires that the RCPB be designed with sufficient margin to assure that it behaves in a non-brittle manner and that the probability of rapidly propagating fracture is minimized.

H.3.8.4.3 Reactor Core Isolation Cooling System The reactor core isolation cooling (RCIC) system serves as a standby source of cooling water to provide a limited decay heat removal capability whenever the main feedwater system is isolated from the reactor vessel. In addition, the RCIC system may provide decay heat removal necessary for coping with a station blackout (SBO). The water supply for the RCIC system comes from the condensate storage tank, with a secondary supply from the suppression pool. The NRC staff's review covered the effect of the proposed EPU on the functional capability of the system. The NRC's acceptance criteria are based on: (1) draft GDC-40, insofar as it requires that protection be provided for ESFs against dynamic effects; (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing; (3) draft GDC-37, insofar as it requires that ESFs be provided to back up the safety provided by the core design, the RCPB, and their protective systems; (4) draft GDCs 51 and 57, insofar as they require that piping systems penetrating containment be designed with appropriate features as necessary to protect from an accidental rupture outside containment and the capability to periodically test the operability of the isolation valves to determine if valve leakage is within acceptable limits; and (5) 10 CFR 50.63, insofar as it requires that the plant withstand and recover from an SBO of a specified duration.

APPENDIX H H.3-32 REV. 26, APRIL 2017 H.3.8.4.4 Residual Heat Removal System The RHR system is used to cool down the RCS following shutdown.

The RHR system is typically a low pressure system which takes over the shutdown cooling function when the RCS temperature is reduced. The NRC staff's review covered the effect of the proposed EPU on the functional capability of the RHR system to cool the RCS following shutdown and provide decay heat removal.

The NRC's acceptance criteria are based on: (1) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against dynamic effects; and (2) draft GDC-4, insofar as reactor facilities shall not share systems or components unless it is shown safety is not impaired by the sharing.

H.3.8.4.5 Standby Liquid Control System The standby liquid control (SLC) system provides backup capability for reactivity control independent of the control rod system. The SLC system functions by injecting a boron solution into the reactor to effect shutdown. The NRC staff's review covered the effect of the proposed EPU on the functional capability of the system to deliver the required amount of boron solution into the reactor. The NRC's acceptance criteria are based on: (1) draft GDCs 27 and 28, insofar as they require that at least two independent reactivity control systems be provided, with both systems capable of making and holding the core subcritical from any hot standby or hot operating condition sufficiently fast to prevent exceeding acceptable fuel damage limits; (2) draft GDCs 29 and 30, insofar as they require that at least one of the reactivity control systems be capable of making and holding the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits; and (3) 10 CFR 50.62(c)(4), insofar as it requires that the SLC system be capable of reliably injecting a borated water solution into the reactor pressure vessel at a boron concentration, boron enrichment, and flow rate that provides a set level of reactivity control.

H.3.8.5 Accident and Transient Analyses H.3.8.5.1 Decrease on Feedwater Temperature, Incr4ease in Feedwater Flow, Increase in Steam Flow, and Inadvertent Opening of a Main Steam or Safety Valve Excessive heat removal causes a decrease in moderator temperature, which increases core reactivity and can lead to a power level increase and a decrease in shutdown margin. Any unplanned power level increase may result in fuel damage or

APPENDIX H H.3-33 REV. 26, APRIL 2017 excessive reactor system pressure. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) postulated initial core and reactor conditions; (2) methods of thermal and hydraulic analyses; (3) the sequence of events; (4) assumed reactions of reactor system components; (5) functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection system be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-29, insofar as they require that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.2 Decrease in Heat Removal by the Secondary System A number of initiating events may result in unplanned decreases in heat removal by the secondary system. These events result in a sudden reduction in steam flow and, consequently, result in pressurization events. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29 insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.2.1 Loss of External Load; Turbine Trip; Loss of Condenser Vacuum; Closure of Main Steam Isolation Valve; and Steam Pressure Regulator Failure (Closed)

A number of initiating events may result in unplanned decreases in heat removal by the secondary system. These events result in a sudden reduction in steam flow and, consequently, result in pressurization events. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered the sequence of events, the analytical models used for analyses, the values of parameters used in the analytical models, and the results of the transient analyses. The NRC's acceptance

APPENDIX H H.3-34 REV. 26, APRIL 2017 criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29 insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.2.2 Loss of Non-Emergency AC Power to the Station Auxiliaries The loss of non-emergency AC power is assumed to result in the loss of all power to the station auxiliaries and the simultaneous tripping of all reactor coolant circulation pumps. This causes a flow coastdown, as well as a decrease in heat removal by the secondary system, a turbine trip, an increase in pressure and temperature of the coolant, and a reactor trip. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.2.3 Loss of Normal Feedwater Flow A loss of normal feedwater flow could occur from pump failures, valve malfunctions, or a LOOP. Loss of feedwater flow results in an increase in reactor coolant temperature and pressure, which eventually requires a reactor trip to prevent fuel damage. Decay heat must be transferred from fuel following a loss of normal feedwater flow. Reactor protection and safety systems are actuated to provide this function and mitigate other aspects of the transient. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.3 Decrease in Reactor Coolant System Flow

APPENDIX H H.3-35 REV. 26, APRIL 2017 H.3.8.5.3.1 Loss of Forced Reactor Coolant Flow A decrease in reactor coolant flow occurring while the plant is at power could result in a degradation of core heat transfer. An increase in fuel temperature and accompanying fuel damage could then result if SAFDLs are exceeded during the transient. Reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the postulated initial core and reactor conditions; (2) the methods of thermal and hydraulic analyses; (3) the sequence of events; (4) assumed reactions of reactor systems components; (5) the functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses.

The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDC-29, insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.3.2 Reactor Recirculation Pump Rotor Seizure and Reactor Recirculation Pump Shaft Break The events postulated are an instantaneous seizure of the rotor or break of the shaft of a reactor recirculation pump. Flow through the affected loop is rapidly reduced, leading to a reactor and turbine trip. The sudden decrease in core coolant flow while the reactor is at power results in a degradation of core heat transfer, which could result in fuel damage. The initial rate of reduction of coolant flow is greater for the rotor seizure event. However, the shaft break event permits a greater reverse flow through the affected loop later during the transient and, therefore, results in a lower core flow rate at that time. In either case, reactor protection and safety systems are actuated to mitigate the transient. The NRC staff's review covered: (1) the postulated initial and long-term core and reactor conditions; (2) the methods of thermal and hydraulic analyses; (3) the sequence of events; (4) the assumed reactions of reactor system components; (5) the functional and operational characteristics of the reactor protection system; (6) operator actions; and (7) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness

APPENDIX H H.3-36 REV. 26, APRIL 2017 of emergency core cooling; and (2) draft GDCs 33, 34, and 35, insofar as they require that the RCPB be designed with margin sufficient to assure that, under specified conditions, it will behave in a non-brittle manner and the probability of rapidly propagating fractures is minimized.

H.3.8.5.4 Reactivity and Power Distribution Anomalies H.3.8.5.4.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical of Low Power Startup Condition An uncontrolled control rod assembly withdrawal from subcritical or low power startup conditions may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion. The NRC staff's review covered:

(1) the description of the causes of the transient and the transient itself; (2) the initial conditions; (3) the values of reactor parameters used in the analysis; (4) the analytical methods and computer codes used; and (5) the results of the transient analyses. The NRC's acceptance criteria are based on:

(1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient, which could result in exceeding acceptable fuel damage limits.

H.3.8.5.4.2 Uncontrolled Control Rod Assembly Withdrawal at Power An uncontrolled control rod assembly withdrawal at power may be caused by a malfunction of the reactor control or rod control systems. This withdrawal will uncontrollably add positive reactivity to the reactor core, resulting in a power excursion.

The NRC staff's review covered: (1) the description of the causes of the AOO and the description of the event itself; (2) the initial conditions; (3) the values of reactor parameters used in the analysis; (4) the analytical methods and computer codes used; and (5) the results of the associated analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage

APPENDIX H H.3-37 REV. 26, APRIL 2017 limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; and (3) draft GDC-31, insofar as it requires that the reactivity control systems be capable of sustaining any single malfunction without causing a reactivity transient which could result in exceeding acceptable fuel damage limits.

H.3.8.5.4.3 Startup of a Recirculation Loop at an Incorrect Temperature and Flow Controller Malfunction Causing an Increase in Core Flow Rate A startup of an inactive loop transient may result in either an increased core flow or the introduction of cooler water into the core. This event causes an increase in core reactivity due to decreased moderator temperature and core void fraction. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses.

The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; (2) draft GDCs 14 and 15, insofar as they require that the core protection systems be designed to act automatically to prevent or suppress conditions that could result in exceeding acceptable fuel damage limits and that protection systems be provided for sensing accident situations and initiating the operation of necessary ESFs; (3) draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling; and (4) draft GDC-29, insofar as it requires that at least one of the reactivity control systems be capable of making the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits.

H.3.8.5.4.4 Spectrum of Rod Drop Accidents The NRC staff evaluated the consequences of a control rod drop accident in the area of reactor physics. The NRC staff's review covered the occurrences that lead to the accident, safety features designed to limit the amount of reactivity available and

APPENDIX H H.3-38 REV. 26, APRIL 2017 the rate at which reactivity can be added to the core, the analytical model used for analyses, and the results of the analyses. The NRC's acceptance criteria are based on draft GDC-32, insofar as it requires that limits, which include considerable margin, be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to ensure that the potential effects of a sudden or large change of reactivity cannot (a) rupture the reactor coolant pressure boundary, or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.

H.3.8.5.5 Inadvertent Operation of ECCS or Malfunction that Increases Reactor Coolant Inventory Equipment malfunctions, operator errors, and abnormal occurrences could cause unplanned increases in reactor coolant inventory.

Depending on the temperature of the injected water and the response of the automatic control systems, a power level increase may result and, without adequate controls, could lead to fuel damage or overpressurization of the RCS. Alternatively, a power level decrease and depressurization may result. Reactor protection and safety systems are actuated to mitigate these events. The NRC staff's review covered: (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC 29, insofar as it requires that at least one of the reactivity control systems be capable of making the core subcritical under any condition sufficiently fast to prevent exceeding acceptable fuel damage limits.

H.3.8.5.6 Decrease in Reactor Coolant Inventory H.3.8.5.6.1 Inadvertent Opening of a Pressure Relief Valve The inadvertent opening of a pressure relief valve results in a reactor coolant inventory decrease and a decrease in RCS pressure. The pressure relief valve discharges into the suppression pool. Normally there is no reactor trip. The pressure regulator senses the RCS pressure decrease and partially closes the turbine control valves (TCVs) to stabilize the reactor at a lower pressure. The reactor power settles out at nearly the initial power level. The coolant inventory is maintained by the feedwater control system using water from the condensate storage tank via the condenser hotwell. The NRC staff's review covered:

APPENDIX H H.3-39 REV. 26, APRIL 2017 (1) the sequence of events; (2) the analytical model used for analyses; (3) the values of parameters used in the analytical model; and (4) the results of the transient analyses. The NRC's acceptance criteria are based on: (1) draft GDC-6, insofar as it requires that the reactor core be designed to function throughout its design lifetime without exceeding acceptable fuel damage limits; and (2) draft GDC-29, insofar as it requires that a reactivity control system be provided capable of preventing exceeding acceptable fuel damage limits.

H.3.8.5.6.2 Emergency Core Cooling System and Loss-of-Coolant Accidents LOCAs are postulated accidents that would result in the loss of reactor coolant from piping breaks in the RCPB at a rate in excess of the capability of the normal reactor coolant makeup system to replenish it. Loss of significant quantities of reactor coolant would prevent heat removal from the reactor core, unless the water is replenished. The reactor protection and ECCS systems are provided to mitigate these accidents. The NRC staff's review covered: (1) the licensee's determination of break locations and break sizes; (2) postulated initial conditions; (3) the sequence of events; (4) the analytical model used for analyses, and calculations of the reactor power, pressure, flow, and temperature transients; (5) calculations of peak cladding temperature, total oxidation of the cladding, total hydrogen generation, changes in core geometry, and long-term cooling; (6) functional and operational characteristics of the reactor protection and ECCS systems; and (7) operator actions.

The NRC's acceptance criteria are based on: (1) 10 CFR 50.46, insofar as it establishes standards for the calculation of ECCS performance and acceptance criteria for that calculated performance; (2) 10 CFR Part 50, Appendix K, insofar as it establishes required and acceptable features of evaluation models for heat removal by the ECCS after the blowdown phase of a LOCA; (3) draft GDCs 40 and 42, insofar as they require that protection be provided for ESFs against the dynamic effects that might result from plant equipment failures, as well as the effects of a LOCA; and (4) draft GDCs 37, 41, and 44, insofar as they require that a system to provide abundant emergency core cooling be provided so that fuel and clad damage that would interfere with the emergency core cooling function will be prevented.

H.3.8.5.7 Anticipated Transients Without Scrams ATWS is defined as an AOO followed by the failure of the reactor portion of the protection system specified in draft GDCs 14 and

15. The regulations in 10 CFR 50.62 require, in part, that:

APPENDIX H H.3-40 REV. 26, APRIL 2017 Each BWR have an alternate rod injection (ARI) system that is designed to perform its function in a reliable manner and be independent (from the existing reactor trip system) from sensor output to the final actuation device. Each BWR have a standby liquid control (SLC) system with the capability of injecting into the reactor vessel a borated water solution with reactivity control at least equivalent to the control obtained by injecting 86 gpm of a 13 weight-percent sodium pentaborate decahydrate solution at the natural boron-10 isotope abundance into a 251-inch inside diameter reactor vessel. Each BWR have equipment to trip the reactor coolant recirculation pumps automatically under conditions indicative of an ATWS.

The NRC staff's review was conducted to ensure that: (1) the above requirements are met; (2) sufficient margin is available in the setpoint for the SLC system pump discharge relief valve such that SLC system operability is not affected by the proposed EPU; and (3) operator actions specified in the plant's Emergency Operating Procedures are consistent with the generic emergency procedure guidelines/severe accident guidelines (EPGs/SAGs), insofar as they apply to the plant design. In addition, the NRC staff reviewed the licensee's ATWS analysis to ensure that: (1) the peak vessel bottom pressure is less than the ASME Service Level C limit of 1500 psig; (2) the peak clad temperature is within the 10 CFR 50.46 limit of 2200F; (3) the peak suppression pool temperature is less than the design limit; and (4) the peak containment pressure is less than the containment design pressure. The NRC staff also evaluated the potential for thermal-hydraulic instability in conjunction with ATWS events using the methods and criteria approved by the NRC staff. For this analysis, the NRC staff reviewed the limiting event determination, the sequence of events, the analytical model and its applicability, the values of parameters used in the analytical model, and the results of the analyses.

H.3.8.6 Fuel Storage H.3.8.6.1 New Fuel Storage Nuclear reactor plants include facilities for the storage of new fuel. The quantity of new fuel to be stored varies from plant to plant, depending upon the specific design of the plant and the individual refueling needs. The NRC staff's review covered the ability of the storage facilities to maintain the new fuel in a subcritical array during all credible storage conditions. The review focused on the effect of changes in fuel design on the analyses for the new fuel storage facilities. The NRC's

APPENDIX H H.3-41 REV. 26, APRIL 2017 acceptance criteria are based on final GDC-62, insofar as it requires the prevention of criticality in fuel storage systems by physical systems or processes, preferably utilizing geometrically safe configurations.

H.2.8.6.2 Spent Fuel Storage Nuclear reactor plants include storage facilities for the wet storage of spent fuel assemblies. The safety function of the SFP and storage racks is to maintain the spent fuel assemblies in a safe and subcritical array during all credible storage conditions and to provide a safe means of loading the assemblies into shipping casks. The NRC staff's review covered the effect of the proposed EPU on the criticality analysis (e.g., reactivity of the spent fuel storage array and boraflex degradation or neutron poison efficacy). The NRC's acceptance criteria are based on:

(1) final GDC-4, insofar as it requires that SSCs important to safety be designed to accommodate the effects of, and to be compatible with, the environmental conditions associated with normal operation, maintenance, testing, and postulated accidents; and (2) final GDC-62, insofar as it requires that criticality in the fuel storage systems be prevented by physical systems or processes, preferably by use of geometrically safe configurations.

H.3.9 SOURCE TERMS AND RADIOLOGICAL CONSEQUENCES ANALYSES H.3.9.1 Source Terms for Radwaste Systems Analyses The NRC staff reviewed the radioactive source term associated with EPUs to ensure the adequacy of the sources of radioactivity used by the licensee as input to calculations to verify that the radioactive waste management systems have adequate capacity for the treatment of radioactive liquid and gaseous wastes. The NRC staff's review included the parameters used to determine: (1) the concentration of each radionuclide in the reactor coolant; (2) the fraction of fission product activity released to the reactor coolant; (3) concentrations of all radionuclides other than fission products in the reactor coolant; (4) leakage rates and associated fluid activity of all potentially radioactive water and steam systems; and (5) potential sources of radioactive materials in effluents that are not considered in the plant's UFSAR related to liquid waste management systems and gaseous waste management systems. The NRC's acceptance criteria for source terms are based on: (1) 10 CFR Part 20, insofar as it establishes requirements for radioactivity in liquid and gaseous effluents released to unrestricted areas; (2) 10 CFR Part 50, Appendix I, insofar as it establishes numerical guides for design objectives and limiting conditions for operation to meet the

APPENDIX H H.3-42 REV. 26, APRIL 2017 "as low as is reasonably achievable" criterion; and (3) final GDC-60, insofar as it requires that the plant design include means to control the release of radioactive effluents.

H.3.9.2 Radiological Consequences Using Alternate Source Term The licensee reviewed the design-basis accident (DBA) radiological consequences analyses to determine the impact of the EPU. The radiological consequences analyses reviewed were the LOCA, fuel handling accident (FHA), control rod drop accident (CRDA), and main steam line break accident (MSLBA). The licensee's review for each accident analysis included: (1) the sequence of events; and (2) models, assumptions, and values of parameter inputs used by the licensee for the calculation of the total effective dose equivalent (TEDE). The NRC staff reviewed the results of the licensee's analyses. The NRC's acceptance criteria for radiological consequences analyses using an alternative source term (AST) are based on: (1) 10 CFR 50.67, insofar as it describes reference values for radiological consequences of a postulated maximum hypothetical accident; (2)

Regulatory Guide 1.183, insofar as it describes accident specific dose guidelines for events with a higher probability of occurrence; and (3) final GDC-19, insofar as it requires that adequate radiation protection be provided to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem TEDE, as defined in 10 CFR 50.2, for the duration of the accident.

H.3.10 HEALTH PHYSICS H.3.10.1 Occupational and Public Radiation Doses The NRC staff conducted its review in this area to ascertain what overall effects the proposed EPU will have on both occupational and public radiation doses and to determine that the licensee has taken the necessary steps to ensure that any dose increases will be maintained as low as is reasonably achievable (ALARA). The NRC staff's review included an evaluation of any increases in radiation sources and how this may affect plant area dose rates, plant radiation zones, and plant area accessibility. The NRC staff evaluated how doses to personnel needed to access plant vital areas following an accident are affected. The NRC staff considered the effects of the proposed EPU on nitrogen-16 levels in the plant and any effects this increase may have on radiation doses outside the plant and at the site boundary from skyshine.

The NRC staff also considered the effects of the proposed EPU on plant effluent levels and any effect this increase may have on radiation doses at the site boundary. The NRC's acceptance

APPENDIX H H.3-43 REV. 26, APRIL 2017 criteria for occupational and public radiation doses are based on 10 CFR Part 20; 10 CFR 50.67; 10 CFR Part 50, Appendix I; and final GDC-19.

H.3.11 HUMAN PERFORMANCE H.3.11.1 Human Factors The area of human factors deals with programs, procedures, training, and plant design features related to operator performance during normal and accident conditions. The NRC staff's human factors evaluation was conducted to ensure that operator performance is not adversely affected as a result of system changes made to implement the proposed EPU. The NRC staff's review covered changes to operator actions, human-system interfaces, and procedures and training needed for the proposed EPU. The NRC's acceptance criteria for human factors are based on final GDC-19, 10 CFR 50.120, 10 CFR Part 55, and the guidance in GL 82-33.