ML20008D760

App 1C to Midland 1 & 2 PSAR, Principal Design Criteria. Includes Revisions 1-36

ML20008D760
Person / Time
Site:	Midland
Issue date:	01/13/1969
From:	CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
To:
References
NUDOCS 8007300639
Download: ML20008D760 (34)

Text

-. - ._ _

O #

!~$'

i O oo2ss b39

"T 8007300

f7 APPENDIX 1C PRINCIPAL DESIGN CRITERIA The principal general design criteria given in this seetion are those resulting from the Atomic Industrial Foru='s redraft of the propesed 70 " General Design Criteria for Nuclear Power Plant Construction Permits" (GDC) issued by AEC Press Release No. K-172 on July 10, ic67 It is the intent of CP Co that the design of the Midland Plant Unita 1 and 2 meets these design criteria as in-terpreted herein. The principal safeguards corresponding to each criterion are su==arized herein, and reference is made to sections of this Teport where

= ore detailed information is presented. The numbering of criteria herein is consistent with that of the GDC.

_ _ CRITERION 1 - QUALITY STANDARDS (Category A)

Those systems and components of reactor facilities which are essential to the prevention, or the mitigation of the consequences, of nuclear accidents which could cause undue Tisk to the health and safety of the public shall be identi-fled and then designed, fabricated, and erected to quality standards that re-flect the dmportance of the safety function to be performed. Where generally recognized codes and standards y rtaining to design, =aterials, fabrication, 7 g .and dnapection are used, they shall be. identified. Where adherence to such l({g) codes or standards does not suffice to assure a quality product in keeping with the safety function, they shall be supplemented or modified as necessary.

Quality assurance programs, test procedures, and inspection acceptance criteria to be used shall be identified. An indication of the applicability of codes, standards, quality assurance progrs=s, test procedures, and inspection accep-

-tance criteria'used is required. Where such-items are not' covered by applica-ble codes and standards, a showing of adequacy is required.

Discussion A. Essential Systems and Co= cnents The integrity-of systems, structures, and components essential-to accident prevention and to =itigation of accident consequences has been included in the reactor design evaluations. These systems, structures, and co=ponents are:

1. Fuel assemblies.

2. Reactor vessel internals.

3 Reactor coolant system.

4. Reactor instrumentation, controls and protection syste=s.

5 Engineered safeguards.

6. Reactor building.

'7 Emergency power sources.

(.

iv  !

00269 1C-1

-. - . . -- . . - - . . - . - _ - ~ _ - -- - . - -

t i

4

[

\ B. Codes and Standards Tne folleving table references applicable codes and standards for the nuclear units as included in the pSAR:

i Quality Test Item Codes Centrol procedures 3 1.2.h.2 A-1 (+) 333 App 13 t

A-2 3 1.2 4 1 3 3.E 3 3.h 3 2.h.1 App 13 A-3 h.1 h.1.h.h h.h h.l.5 h.3 1.1.2 13

.j App 13 A-h 3 1.2.h.h 3 2.h.3 2 333 3 2.h.3 2 332.h.3.h 7 1.1.2 3 2.h.3 4 7 1.1.2 13 7 1.1.2 App 13 A-5 9 (p 9-1, 9-2) 9 (p 9-1, 9-2) 6.1.h p 9 1.2 5 App 13 6.2.4 ftj 9325 *

(p 9-1, 9-2)

A-6 5 1.1 513 5 1.2 5 1.2 App 13 5 1.4 5 1.4 app 53

. App 5A App 5H 13 A-7 8.1 App 13 83 13

(*) Fuel assembly production quality control and process procedures are being developed by 3&W and vender

=anufacturing crganications.

CRITERICN 2 - pERFCRMANCE STANDARDS (Category Al Those syste=s and co=penents of reactor facilities which are essential to the f'\ prevention or to the citigation of the ccusequences of nuclear accidents which

(_)

could cause. undue risk to the health and safety of the public shall be designed, fabricated, and erected to performance standards that will enable such syste=s 00?.70 1C-2.

i i l 1 (

1 and cceponents to withstand, without undue risk to the health and safety of the public the fotees that might reasonably be imposed by the occurrence of an ex-traordinary natural phenomenon such as earthquake, tornado, ficoding condition, high wind or heavy ice. The design bases so established shall reflect: (a) '

appropriate censideration of the most severe of these natural phenctena that have been officially recorded for the cite and the currcundinc area and (b) an appropriate nargin for withstanding fcrees greater than those recorded to reflect uncertainties about the historical data and their suitability as a l l

)

basis fer decign.

Discussion A. Essential Syste=s and Cc=ponents j The integrity of systems, structures, and cccponents essential to accident prevention and to mitigation of accident consequences has been included in the reactor' design evaluations. These systems, structures, and components are:

1

1. Fuel asse=blies.

2. Reactor vescel internals.

3 Reacter coolant system.

4. Reactor instrumentatien, controls and protection systems.

5 . Engineered safeguards.

( ) 6. Reactor building.

7 Energency power sources.

B. perfor=ance Standards L These essential systems and components Alve been designed to perfor=ance standards that vill enable the facility to withstand, without loss of the capability to protect the public, the additional forces that might be im-posed by natural phenomena. The designs are based upon the most severe of l

the natural phenomena, recorded for the vicinity of the site, with an ap-propriate cargin to account for uncertainties in the historical data.

These natural phenecena are listed belov vith PSAR references:

Sections Appendices

1. Earthquake 2.T, 5 1.1.2 5A 2d

2. Tornado 2 3, 5 1.1.2 2A, 5A

25 3 Flood and Ground-water 2.L, 2 5, 2.6, Silil.2 2B, 2C, 5A i k. '41nd 2 3, 5 1.1.2 2A, 5A

/\ 5 Snow and Ice 2 3, 5 1.1.2 2A, 5A

, O, h 25 6. Other Local .

l Site Effects 5 1.1.2 5A 0077.'.

Ic-3 Amendment No. 25

__ _ _ _,2/74 _ , _ . _ _ _ _

1 CRITERION 3 - FIRE PROTECTION (Category A)

A reactor facility shall be designed such that the probability of events such as fires and explosions and the potential consequences of such events will not result in undue risk to the health and safety of the public. Ncncombustible and fire resistant =aterials shall be used throughout the facility wherever j necessary to preclude such risk, particularly in areas containing critical portiens of the facility such as contain=ent, control roc =, and co=ponents of engineered safety features.

Discussion The reactor facility is designed such that the probability of events such as fires and explosions and the potential consequences of such events will not result in undue risk to the health and safety of the public.

.The potentia 1. magnitude of a fire in the control room vill be 11=ited by the following factors:

a. Materials used in control room conttruction are nonf1 m able,

b. Control cables and switchboard viring are constructed of materials that meet the flame resisting tests described in Insulated Power Cabic Engineers Association Publication S61-402, Part 6 5, and National. Electrical Manufacturers Association Publication WC 5-1968.

c. Furniture in the control room is of metal construction.

d. Combustible supplies cuch as logbooks, records, procedures,.. manuals, etc, are limited to the amounts required for plant operation.

e. All areas of the control room are readily accessible for fire extinguishing.

f. Adequate fire extinguishers are provided.

g. The control room is occupied at all times by a qualified person who has been trained in fire extinguishing techniques.

The only flannable materials inside -the control room are:

a. Paper in the fom of logs, records, procedures, manuals, diagrams, etc.

b. Snall amounts of ecmbustible =aterials used in the =anufacture of

.. var.io.us electronic equipcent.

The above list indicates that the f1mable =aterials are distributed to the extent that a fire would be unlikely to spread. Therefore, a fire, if started, would be of such a wnall =agnitude tbat it could be extinguished by the opera-

f. }- tor using a hand fire extinguisher. The resulting s=oke and vapors would be kgd removed by the control room ventilation system.

1C k

(

The safety of the nuclear unit is not affected by fires due to these =aterials.

-U) The operation of the engineered safeguards is not i=;nired due to the effects of fires.

CRITERICN h - SHARTIG CF SYSTIMS (Catercrv Al Reactor facilities =ay share syste=s or ec=ponents if it can be shown that such sharing vill not result in undue risk to the health and cafety of the public.

Discussion Systems and components vill be shared only to the extent that it can be de=en-strated that such sharing does not affect the functicnal capability of the sys-tem or ccmponent to perfom adequately in the separate reactor facilities.

Shared systems and components are described in 1.2.8.

' CRITERION 5 - RECORDS Rs um3E:TTS (Catecory A)

The reactor licensee shall be responsible for assuring the maintenance throughout the life of the reactor of records of the . design, fabrication,

(, pj.

and construction of major cc=ponents of the plant essential to avoid undne risk to the health and safety of the public.

Discussion The Applicant assures the maintenance through the life of the reactor of records of the design, fabrication, construction and tests of =ajor ccmponents of the plant essential to avoid undue risk to the health and safety of the public.

CRITERION 6 - REACTOR CORE DESIGN (Categories A & B)

The reactor core with its related controls and p otection syste=s shall be de-signed to function throughout its design lifetite without exceeding acceptable fuel da= age limits which have been stipulated and justified. The core and re-lated auxiliary system designs shall p ovide this integrity under all expected conditions of nor=al operation with appropriate =argins for uncertainties and for specified transient situations which.can,be. anticipated.

Discussion n

) The reactor is designed with the necessary =argins to acccc=cdate, without k [k / fuel da= age, expected transients from steady-state operation including the 1C-5 00M3

transients given in the criterien. Fuel clad integrity is insured under all s/ nor=al and abnomal =cdcs of anticipated operatien by avoiding clad over-stressing and overheating. The evaluatien of clad stresses includes the effects of internal and external pressures, te=perature gradients and changes, clad-fuel interactions, vibrations, and earthquake effects. The freestanding clad design prevents rollapse at the end volu=e region of the fuel rod and provides sufficient radial and end void volu=e to acec==cdate clad-fuel interactions and internal gas pressures (3 2.h.2).

Clad everheating is prevented by satisfying the following core ther=al and hydraulic criteria (3 1.2 3 and 3 2 3 1.1):

a. At the design everpower, no fuel =elting vill occur.

b. A 99 percent confidence exists that at least 99 5 percent of the fuel rods in the core vill be in no jeoprdy of experiencing a DNB during continuous operation at the design overpower of 114 percent.

The design =argins allow for deviatiens of te=perature, precsure, flow, reactor power, and reactor-turbine power =is=atch. Above 15 percent power, the reactor

.is operated at a constant average coolant te=perature and has a negative power coefficient to da=p the effects of pcVer transiente. The reactor control sys-tem vill =aintain the reactor operating parameters within preset limits, and the Teactor protection syste= will shut down the reactor if nor=al operating

.fy limits are exceeded by preset.a= cunts (Sections 7 1 and 1h).

<r CRITERION 7 - SUPPRESSION OF POWER OSCILLATIONS (Categor-/ 3)

The design of the reactor core with-its related controls and protection syste=s shall ensure that pover oscillaticus, the =agnitude of which could cause damage in excess of acceptable fuel da= age limits, are nct possible or can be readily suppressed.

Discussion Power oscimtions resulting from variation of coolant te=perature are =ini-

=1:ed by constant average coolant te=perature above 15 percent power. Power oscillations frc= spatial. xenon effects are =inimized by the large negative power coefficient. Features have been provided in the design that vill allev centrol of axial oscillations and vill =ake the core stable in regard to a:1-muthal oscillations. The reactor is shown by analysis to be stable to radial oscillations. Reactor trip prevents fuel clad ammage resulting frc= TNB.

~The ability of the reactor cortrol and protection system to coutrol the oscil-lations resulting fro = variation of coolant te=perature within the centrol system dead band and frc= spatial xenon oscillations has been analyzed. With regard to axial ese111ations, certain of the control rod assemblies vill con-tain poisen only in a portion of their lengths and vill be positioned to

,t. $' ))

1C-6 00":7M.

A maintain an acceptable power distribution in the core and to centrol any ten-y dency towards axial oscillaticn. A:1 uthal oscillation tendencies vill be minimized in the design by including fixed burnable poison in the core design (3 2.2.2 3).

CRITERICN 3 - CVERALL PO*iER CCETFICIE"T (Categcry B)

The reactor shall be designed so that the overall pcver coefficient in the power operating. range shall not be positive.

Discussion The overall power coefficient is negative in the operating range (3 2.2.1.h).

CRITERION 9 - REACTOR COOIANT PRESSURE BOUNDARY (Category A)

The reactor coolant pressure boundary shall be designed, fabricated, and con-structed so as to have an exceedingly low Trobability of gross rupture or sig-nificant uncontrolled leakage-throughout its design lifetime.

& Discussion v-The reactor coolant pressure boundary will be designed and constructed to meet ' these criteria:

a. Material selection, design, fabrication, inspection, testing, and certification will be in keeping with the ASME (Section III) and

-l .USASI (B31.7) Codes.

b. _. lity manufacture will include veld qualification test plates, per=anent identification of caterials, velder qualification tests, and extensive production nondestructive testing.

c. Service life of the reactor vessel and other coolant boundary mate-rials vill be chosen to retain =etallurgical stability of the cate-rial, to account for cyclic effects of mechanical shock and vibratory loadings, and to give due consideration to radiation effects and the

-a=ount of' increase in the nil ductility transition temperature as a result of. neutron irradiation-(Section h.1).

- CRITERION 10 - REACTOR COIEArDEC (Category A)

Reactor containment shall'be provided. The containment structure shall be designed-(a) to sustain without undue risk to the health and safety. of the

- v 00375 _

1C-7 Amendment No. 5

-~s

\ public the initial effects of gross equipment failures, such as a large reactor coolant pipe break, without loss of required integrity and (b) together with other engineered safety features as may be necessary, to retain for as lon as the situation requires the functional capability of the containment to the ex-tent necessary to avoid andue risk to the health and safety of the public.

Discussion The reactor building, a continuous, prestressed concrete structure, with a welded steel liner to provide leak tightness, cc=pletely encloses the entire reactor and reactor coolant system, to insure with certain engineered safe-guards (see Criterion 37) that an acceptable upper li=it for leakare of radio-active materials to the environ =ent will not be exceeded, even if cross failure of the reactor coolant system vere to occur (Section 5). It is the design goal to =aintain the integrity of the reactor building under both normal and

. accident. conditions.

CRITERION 11 - CONTROL E00M (Category B)

The facility shall be provided with a control root from which actions to =ain-tain safe operational status of the plant can be controlled. Adequate radia-tion protection shall be provided to permit continuous occupancy of the -control

(~'g room under any credible post-accident condition or as an alternative access to

(/ other areas of the facility as necessary to shut down and maintain safe con-trol of the facility without excessive radiation exposures of personnel.

Discussion The facility is provided with a control room (Section 7.6). It is a desien objective that occupancy in this control roo= can be maintained at all times.

The reactor can be tripped from the control room. As is discussed in 5.h.2.1, the whole body dose to plant personnel during the 30-day period felleving a design basis loss-of-coolant accident (MEA) vill not exceed 5 Pen, and the thyroid dose vill not exceed 30 Re=.

CRITERION 12 - INSTRUMENTATION AND CC5 TROL SYSTD!S (Category 3)

Instru=entation and controls shall be provided as required to =enitor and maintain within prescribed operating ranges essential reactor facility operating variables.

Discussion

,s Reactor regulation is based upon the use of movable control rods and a chenical neutron absorber (boron in the form of boric acid), dissolved in the reactor

,('2',) coolant. Input signals to the reactor controls include reactor coolant averase IC-8 .3, Amend =ent No. 9 k( **

3/20/70

s te=perature, =egawatt de=and, and reactor power. The reactor centrols are de-signed to =aintain a constant average reactor ecolant te=perature over the lead range frc= 15 to 1C0 percent of rated power. The steam syste= operates on cen-stant pressure at all leads. Adequate instru=entatien and centrols are provided to =aintain operating variables nthin their prescribed ranges (Section 7.2).

The nennuclear instrumentation =easures temperatures, pressures, f1cvs, and levels in the reacter ecolant syste=, steam syste=, and auxiliary reacter sys-te=s, and =aintains these variables within prescribed limits (7 3 2).

CRITERION 13 - FISSION FRCCESS MONITORS AND CONTROLS (Cater.iry B)

Means shall be provided for monitoring or otherwise =easuring and =aintaining control over the fission process throughout core life under all conditions that can reasonably be anticipated to cause variations In reactivity of the core.

Discussion This criterion is met by Teactivity centrol means and control rec = display.

Reactivity control is by movable control rods, =ovable xenen control rods to facilitate the control of. axis.1 power =aldistribution, fixed burnable poison distributed in the core, and by chemical neutron absorber (in the for= of boric

> i acid), dissolved in the reactor coolant. The position of each control red vill V be displayed in the control rec =. Changes in the reactivity status due -to sol-uble boren vill be indicated by changes in the position of the centrol reds.

Actual boron concentration in the reactor coolant is determined. periodically by the sampling syste= and is reported to the reactor operator (Section 7 2).

CRITERION lh - CORE PROTECTION SYSTEMS (Category B)

Core protecticn systems, together with associated equi; cent, shall be designed to prevent or to suppress conditions that could result in exceeding acceptable fuel h age 11=its.

1 Discussicn The reactor design =eets this criterica by reacter trip provisions and engi-neered safeguards. The reactor protection syste= is designed to limit reactor power which might result frc= unexpected reactivity changes, and provides an autc=atic reactor trip to prevent exceeding acceptable fuel da= age lir-its.

In a loss-of-coolant accident, the engineered safeguards protection syste:

1 autc=atically actuates the high-pressure and low-pressure coolant injection equi;=ent. The core ficoding tanks are self-actuating (Section 7 1).

0\

mj 00277 1C-9 L

CRITERION 15 - ENGINEERED SAFETY FEATURES PROTECTION V SYSTDis (Category B)

Protection systems shall be provided for sensing accident situations and initiating the creration of necessary engineered safety features.

7 Discussion The reactor protection system senses abnormal reactor power level, reactor out-let temperature, reactor coolant pressure and reactor start-up rate, and trips the reactor for each abnormal condition. The engineered safeguards actuation systen senses reactor coolant pressure anc reactor building pressure, either of which initiates core coolant injection. The reactor building pressure signal also initiates e=ergency building cooling, reactor building isolation and fission product removal system. A signal of high radiation in the reactor building initiates isolation of piping open to the reactor building atmosphere. Analyses of all accident situations examined, includ!ng the postulated LOCA, indicate that the system he'nitoring sensors provided in the design act to initiate the opera-tion of necessary engineered safeguards to protect the reactor core and reactor coolant system (Section 7 1).

g CRITERION 16 - MONITORING REACTOR COOLANT LEAKAGE k (Category B) t V

Means.shall be provided to detect significant uncontrolled leakage from the reactor coolant pressure boundary.

Discussion Instrumentation is.provided to meet this criterion by measuring fluid volume changes (pressuriser and reactor building sum ) and radioactivity levels in the reactor building. An increase in net makeup to the ecmbined reactor cool-ant system and connected high-pressure injection and purificatien system vill also indicate leakage (4.2 7).

CRITERION 17 - MONITORING RADICACrl/ITY RELEASES (Category B)

Means shall be provided for conitoring the containment atmosphere and the facility eff.luent discharge paths :for radioactivity released from normal operations, from anticipated transients, and from accident conditions. An environmental monitoring program shall be maintained to confirm that radio-activity releases to the environs of the plant have not'been excessive.

f%'

Discussion v Monitoring of all station solid, liquid,.and gaseous releases is accomplished

..vith the_ appropriate instrumentation (Section 7 5). Releases from the reactor en 00?,78 _c

building ventilation prior to release are monitored systematically. The plant ventilatien is similarly acnitored and diluted to achieve acceptable concen-trations. All liquid effluents are sa:': pled or =onitored both prior to and after treatment (Section 11.2). Th,e solid effluents are packaged and checked for racio-activity before shipment off-cite. Hence, monitoring of the releases within the facility environs is controlled co that the releaser are never =cre than allowed by 10 CFR 20. Detectors located in selected areac of the ctation along with op-erating procedures assure that personnel exposure det.3 not exceed 10 CFR 20 limits (Section 7 5). The environ = ental program is designed to establish environmental radiation levels and detect any changes which =ay occur. Sampling points are located on-site and off-site.

CRITERION 18 - MONITORING FUEL AND WASTE STC' RAGE (Category B)

Monitoring and alarm instru=entation shall be provided for fuel and vaste storage and associated handling areas for conditions that might result in less of capability to re=ove decay heat and to detect excessive radiation levels.

Discussion Monitoring and alam instrumentaticn is provided sensitive to the operation of

,O the spent iael pool cooling yysw= (3ection 9.!+). He st is w=cved -frc= stored radvaste by conduction _to the'~ ventilation. air. Ventilation air frc= the rad-vaste facilittis continuouq1y =enitorodjfer radicactivity.

- _. e w .

~

CRITERION 19 - PROTEl,U ON SYSTHtE EELTABILTIY (Catecory B)

~

Protection syste=s 5 hall be de'si6ned for high functional reliability and in-service testability ne,cessary to avoid undue risk to the health and safety of the public. *

.; - , ,,

s-Discussion ,

k Ts.

i Th6 protection systems'> design meets -this criterion by specific location, a=ple designcapacity,componen(redundancy,andLin-servicetestability. The major design criteria stated below have'been applied to the desi6n of the instrumen-tation, j~ ,

- m,

]

s ,

• ". '- \

a. No single component failure shall prevent the protection systems from full 1111ng their protective function when action is required.

b. No single co=ponent failure shall' initiate unnecessary protection system action, provtied i=plementation does not conflict with the criterion above. W '*

w ,

.e?"

,. . . g_u _

/ ) Manual testing facilities are built into the protection syste=s to provide for:

'V

a. Preoperational testing to give assurance that the protection syste=s can fulfill their required functions.

b. On-line testing to assure operability and to de=onstrate reliability (7 1.1).

CRITEEION 20 - PROTECTION SYSTD!S REIUNDANCY AND INDEPE'IDENCE (Category B)

Redunds.ncy and independence designed into protection systems shall be sufficient to assure that no single failure or removal from service of any component or channel of such a system vill result in loss of the protection function. The redundancy provided shall include, as a mini =um, two channels of protection for each protection function to be served.

Discussion Reactor protection and engineered safeguards are by four. channels with 2/h coinciden:e. All protection system functions are implemented by redundant

,p sensors, instrument strings, logic, and action devices that combine to form the protection channels. Redundant protection channels and their associated elements are electrically independent and packaged to provide physical sepa-ration. The reactor protection system initiates a trip of the channel in-volved when modules, equipment, or subassemblies are removed (7 1.1).

CRITERION 21 - SINGLE FAILURE DEFINITION (Categcry B)

Multiple failures resulting frcm a single event shall be treated as a single failure.

Discussion The protecticn systems meet this criterion by complying with Criterion 23 CRITERION 22 - SEPARATION OF PROTECEION AND COFIROL

_INSTRUMENTAT. ION SYSTENS (Category B)

Protection systems shall be separated from control instrumentation systems to the extent that fadlure.or removal frcm service of any control Instrumentation

~ j'

\. ,1 00260 1C-12

_ _ _ _ _ . . . ~ . , _ . - . _ _ _

l f' system component or channel, or of those coun::on to control instrumentation and protection circuitry, leaves intact a system satisfying all requirements for ft the protection ebannels. I Discussion The protection systems and control instrumentation systems meet this criterion by cc=plyina vith Criterion 20 (Section 71). l j

l CRITERION 23 - PROTECION AGAINST ICLTIPLE DISABILITY FOR PROTECTION SYSTH4S (Category B)

The effects of adverse conditions to which redundant channels or protection systems might be exposed in con: mon, either under normal conditions or those of an accident, aball not result in loss of the protection function or shall be  !

tolerable on some other bania. i Discussion The protection redimaan cy. systems are designed to extreme ambient conditions and with Protection systems' instrumentation vill operate from h0-140 F l and sustain (except for neutron detedors) the loss-of-coolant building en-vironmental mnditions of 67 psig and 297 F and still be operable. Protection bV systems ' instrumer_?ation vill.be . subject to* environmental (qualiricatien) test as required by the proposed IEEE Standard for Nuclear Power Plant Protection Systems.

Protective equi 1xnent outside of the reactor building, control room, and relay zoom is designed for continuous operation in.an ambient temperature of 120 F and for 90 percent relative humidity {T.1.1.4).

_ CRITERION 24 - ENERGENCY POWER FOR PROTECTION SYum4S (Category B)

This criterion is deleted since it appears preferable to focus all require-ments for emergency power in Criterion 39 la incorporated in Criterion 39 to acecamodate this deletion. Note that " protection systems" s

' PROTECTION CRITERIONSYSTD43 25 - DENONSTRATION (Category B)

OF FUNCTIONAL OPERABILITY OF Means prote shall be included for suitable testing of 1;he active components of or 1custion systems Qile of .redimdancy hasthe reactor is in operation to determine if failure occurred.

1C-13 Amendment ht 00N, 11. J

• 7 m .70 y _ _ - . ,, _ _ - . ,,7- . y .-- - - - ,- -

Discussion O

Test circuits are independence, and supplied coincidencewhich utilize the protection systems' redundancy features. ,

This makes it possible to manually initiate on-line trip signals in any single protection channel in order to test trip cambility in each channel without affecting the other channels (713) . . .

CRITERION 26 - PROTECTION SYSTD!S FAIL-SAFE DES 7'iN (Category B)

The protection systems shall be designed to fail into a safe state or into a state established as tolerable on a defined basis if conditions such as connection of the system, loss of energy (e.g., electric power, instrument water), are experienced. air), or. adverse environments (e.g., extreme heat Discussion The reactor protection system vill trip the reactor on loss of power. The engi-neeredfor power safeguards control and actuation system is supplied with multiple sources of electric valve action.

A total loss of electrical power to the engineered safeguards actuation system vill cause its instrumentation to as-relays require power to trip.sume a tripped position with the exception These of the fin

( *ment also position uponrequires a total loss power of power.to operate, this relay need not assume

.V] The multiple power supplies for the con-than the power supply for the engineered safeguards equipen The system is designed for continuous operation under adverse environments.

l The reactor protection system instrumentation within the reactor building is designed 100 percentforrelative continuous operation in an environment of 140 F, 67 psig hiamidity. , and i

Engineered safeguards equiment and vital in-1 297 F, and 100 percent IE) which meet the . requirements accident (71.1 and 71.2).

l i

Redundant neered instrument safeguards channels actuation syste=s.are prosided for the reactor protection and engi-protection channel vill trip that individual channel.Ioss of power to each individual reactor Loss of all instrument power vill trip the reactor protection system, thereby releasing the control l rods, and vill activate the engineered safeguards actuation system controls (with the exception of the reactor building spray valves). i j

1 Manual reactor trip is designed so that failure of the autcmatic reactor trip I circuitry will not prohibit or negate -the v.anual trip. The same is true with respect to canual operation of the engineered safeguards equigent.

I s C'

l 00'9'a 1C-lh j Amendment-No. 1h 7/31/70 l

p CRITERION 27 - RwuaLANCY OF REACTIVITY CONTROL (Category A)

Two independent reactivity centrol syste=s, preferably of different principles, shall be provided.

Discussion This criterion is met by control rods and soluble boron addition to, or re= oval frem, the reactor coolant (7 2.2.1).

CRITERION 28 - REACTIVITY HOT SHUTDOWN CAPABILITY (Category A)

The reactivity control systems provided shall be capable of making and holding the core subcritical from any hot operating condition.

s j Discussion One highly redundant reactivity control system consisting of 49 full-length control Tods is pvided-to rapidly make the core suberitical upon a trip signal and to protect the_ core.from anmage due to the effects of any operating transient. The soluble absorber reactivity control system can make the reactor

,,3 suberitical even from ulti= ate power. However, ats action is slow, and the

( ) ability to protect the core from da= age which might result from rapid load

'v' changes,such as an ult 1= ate load turbine trip, is not a design criterion for this system. The high degree of redundancy in the control rod system is con-sidered sufficient to meet the intent of this criterion (3 2.2.1).

CRITERION 29 - REACTIVITY SEUTDOWN CAPABILITY (Catecory A)

One of the reactivity control syste=s provided shall be capable of =aking the core suberitical under any anticipated operating condition (including antici-pated operational transients) sufficiently fast to prevent exceeding acceptable fuel damage limits. Shutdown =argin should assure suberiticality with the most reactive control' rod fully withdrawn.

Discussion The reactor design meets this criterion both under nor=al operating conditions, and under the accident conditions set forth in Section '14. 'The reactor is de-signed with the capability of providing an adequate shutdown.=argin with the single most reactive control rod fully withdrawn at any ' point in core life vith the reactor at a hot, zero power condition. The minimum hot shutdown margin

, occurs at the end of life (3 2.2.1).

.g 00?S4 1C-15

/'N CRITERION 30 - REACTIVITY HOLDDCVN CAPABILITY (Category B)

\d' The reactivity control syste=s provided shall be capable of naking the core suberitical under credible accident conditiens with appropriate =argins for contingencies and li=iting any subsequent return to power such that there will be no undue risk to the health and safety of the public.

Discussion The reactor =eets this criterien with centrol rods for hot shutdevn under nor-

=al operating conditions and for shutdown under the accident conditions set forth in Section 14. Reactor suberitical =argin is =aintained during cecidevn by changes in soluble boren concentratien. The rate of reactivity ec=pensation from boren addition is greater than the reactivity change associated with the

=aximum allowable reactor cooldown rate of 1CO F/ hour. Thus, suberiticality is assured during cooldown with the most reactive centrol rod totally unavail-( able (3 2.2.1).

CRITERION 31 - REACTIVITY CCNTROL'SYSTIMS MALFUNCTION (Category 3)

The reactor protection syste=s shall .be capable of protecting against any single malfunction of the reactivity , control system, such as unplanned con-

.- tinuous withdrawal (not ejection or liropout) of a ecutrol rod, by limiting (m)

v reactivity transients to avoid exceeding acceptable fuel da= age li=1ts.

Discussion The reactor design meets this criterien. A reactor trip vill protect against centinuous withdrawal of one rod (14.1.2 3).

CiumdON 32 - MAXIMUM REAunun WORTH CF ' CONTROL RODS (Cateeory A)

Limits, which include margin, shall be placed on the maximum reactivity worth of control rods or elements and on rates at which reactivity can be increased to' insure that the potential effects of a sudden or large change of reactivity cannot: (a) rupture the reactor coolant pressure boundary or (b) disrupt the core, its support structures, or other vessel internals sufficiently to impair the effectiveness of emergency core cooling.

Discussion The reacter design meets this criterien by engineered safeguards which limit the marimum reactivity incertion rate. These include rod-grcup withdraval

/7 interlocks, soluble boren cor,:entration reduction interlock, =ax1=um rate of j

0 0 M "21

~'

1C-16

.A dilution water adlition, and dilution-time entoff (14.1.2.h). In addition, the rod drives and their controls have an inherent feature that limits over-speed in the event of =alfunctions (3 2.h.3). Ejection of the =axi=un vorth control rod vill not lead to further ecolant boundary rupture or internals da= age which would interfere with e=ergency core eccling (lk.2.2.2) .

CRITERION 33 - REACTOR COOWE PRESSURE BCGEARY CAPABILITY (Category Al The reactor coolant pressure boundar'y shall be capable of acec==odating with-out rupture the static and dyna =1e loads imposed on any boundary component as a result of any inadvertent and sudden release of energy to the coolant. As a design reference, this sudden release shall be taken as that which would result from a sudden reactivity insertion such as rod ejection (unless pre-vented by positive =echanical means), red dropout, or cold water addition.

Discussion The reactor design meets this criterion. There are no credible mechanis=s whereby da= aging energy releases are liberated to the reactor coolant. Ejec-tion of the .::aximum verth centrol rod will not . lead to further ecolant boundary rupture (14.2.2.2).

q.m)

\!

m CRITERION 3h - REACTOR COOLANT PRESSURE BCGEARY RAPID

_ PROPAGATION FAILURE PREVENTION (Category A)

Tha ~nactor coolant-pressure boundary shall be designed and operated to reduce to an acceptable level the probability of rapidly propagating type failures.

Consideration shall be given (a) to the provisions for control over service te=perature and irradiation effects which =ay require operational restrictions, (b) to the design and construction of the reactor pressure vessel in accord-ance with applicable codes, -including-those which establish Tequirements for absorption of energy within the elastic strain energy range and for absorption of energy by plastic defor=ation and (c) to the design and ccustruction of reactor coolant pressure boundary . piping.and equi; cent in accordance with applicable codes.

Discussion

'The reactor coolant Tressure boundary design =eets this criterien by the following:

a. The reactor vessel is the only reactor coolant syste= cc=ponent exposed to a significant level of neutron irradiatien, and is therefore the only ecmponent subject to =aterial irradiation a n ge. The end-of-unit-life NDTI value of the vessel opposite 1C-17 002 %

'(m) b' the core vill be not more than 260 F based on an initial value of 10 F. Unit operating procedures vill be established to limit the operating pressure to 20 percent of the design pressure when the reactor coolant syste= temperature is below NUIT + 60 F throughout unit life.

b. Determinatien of the fatigue usage factor resulting from expected states and transient loading during detailed design and stress analysis,

c. Quality centrol procedures including pemanent identification of materials and nondestructive testing for flav identification.

d. Operating restrictions to prevent failure resulting from increase in brittle fracture transition temperature due to neutron irradia-tion, including a material irradiation surveill.ance program.

e. The reactor vessel vill -be ananufactured in accordance vith -the provisions of the ASME Boiler and Pressure Vessel Code, Part III (Nuclear Vessels) (b.1.4).

CRITERION 35 - REAC'IOR COOIANT PRESSURE BOUNDARY BRTITLE FRADIURE PHt;vtanON (Category A)

(Ui i Under conditions where reactor coolant pressure boundary system components con-structed of ferritic caterials may be subjected to potential loadings, such as a reactivity-induced loading, service temperatures shall be at least 120 F above the nil-ductility transition (NDT) temperature of the component material

.if.the resulting energy release is expected to be absorbed by plastic Lefor=a-

-tion or 60 F eve the IDT temperature of the component material if the result-ing energy release is expected to be absorbed within the elastic strain energy range.

Discussion The reactor coolant pressure boundary meets this criterion by complying with Criterion 34(4.1.4).

CRITERION 36 - REA0 TOR C00IANT PRESSURE BOUNDARY SURVETTJANCE (Category A)

' Reactor coolant pressure boundary components shall have provisions for inspec-tion, testing, and surveillance of critical areas by appropriate means to assess the structural and leaktight integrity of the boundary components during their service lifetime. For the reactor vessel, a me'erial surveillance. program con-fN i forming with current applicable codes sball be ..rovided.

t .e

(mv) Discussion The reactor coolant pressure boundary co=ponents meet this criterion. Space is provided for nondestructive testing during unit shutdown. A reactor pres-sure vessel =aterial surveillance program conforming to ASTM-E-lo5-66 will be established 'h.h.3).

E 83 CMTERION 37 - ENGINEERED SAFETY FEA'IURES BASIS FCR DESIGN (Category A)

Engineered safety features shall be provided in the facility to back up the safety provided by the core design, the reactor coolant pressure boundary, and their protection systems. Such engineered safety features shall be designed to cope with any size reactor coolant piping break up to and including the equivalent of a circumferential rupture of any pipe in that boundar assuming y

unobstructed . discharge from .both ends.

Discussion The reactor design meets this criterion. The emergency core cooling syste=

can protect the reactor for any size leak up to.and including the.circu=fer-ential rupture of the largest reactor coolant pipe (14.2.2 3).

s (o}

v CRITERION 38 - RELIABIMTY AND 'f*RNIUTY OF ENGINEERED SAFETY FEATURES (Category A)

.All engineered safety features shall be designed to provide such functional reliability and ready testability as is necessary to avoid undue risk to the health and safety of the public.

Discussion All engineered safeguards are designed so that a single failure of an active component in a syste= will not prevent operation of that syste= or reduce its capacity below that required to maintain a safe condition. Two in-dependent reactor building cooling syste=s, each having full heat re= oval capacity, are used to prevent overpressurization.

The high-pressure injection, core-flooding, and low-pressure injection com-ponents of the e=ergency core cooling syste= have separate equi; ment strings to insure availability of capacity.

Sc=e engineered safeguards have both a nor:a1 and an emergency function, thereby providing nearly continuous demonstration of operability. _During nor=al opera-

.gy tion, the standby and operating units vill be rotated into service on a

(

-; ) scheduled basis.

00297 1C-19

.m

'( ) Engineered safeguards equipment piping that is not fully protected against

\d missile damage utilizes dual lines to preclude loss of the protective function as a result of any secondary failure.

Testing and inspection of the engineered safeguards is described in the pSAR for each system in the criteria where such info mation is asked for specifically (6.1.4, 6.2.4, 6.3 k).

CRITERION 39 - DERGENCY POWER (Category A)

An emergency power source shall be provided and designed with adequate indepen-dency, redundancy, capacity, and testability to permit the functioning of the engineered safety features and protection systems required to avoid undue risk to the health and safety of the public. This power source shall provide this ca;acity assuming a failure of a single active component.

Discussion In the event of loss of all off-site power, a drop in plant load to auxiliary load is accomplished by the step load reduction detailed in 1h.1.2.8 In addition, emergency power sources provide a dependable supply of po w for the critical services in the unlikely event of simultaneous loss of L.:r=al and O standby power (8.2 3). Two diesel generators supply two 4160 volt buses and

) station batteries, and vill provide the power required for postulated loss-of-coolant accidents for one unit for vital auxiliaries, instrumentation, control equipment and emergency lighting to enable safe shutdown, and provide nomal shutdown for the other unit.

CRITERION h0 - MISSILE PROTECTION (Catestory A)

Adequate protection,for those engineered safety features, the failure of which could cause an undue risk to the health and safety of the public, shall be pro-vided against dynamic effects and misa is that might result from plant equip-ment failures.

Discussion Those engineered safeguards, the failure of which could cause an undue risk to the health and safety of the public, are adequately 7 otected against dynamic effects and missiles that might result from plant equip:ent failures.

,\

~ ..

l 00:58 1C-20

CRITERION hl - ENGINEERED SAFETY FEATURES PERFORMANCE V CAPABILITY (Category A)

Engineered safety features, such as the e=ergency core ecoling syste= and the containment heat re= oval system, shall provide sufficient perfor ance capability to accorycdate the failure of any single active ec=penent without resulting in undue risk to the health and safety of the public.

Discussicn All engineered safeguards are designed so that a single failure of an active component will not prevent operation of that system or reduce the system capacity below that required to =aintain a safe condition. Redundancy is provided in equipment and pipelines so that the failure of a single active component of any system will not impair the required safety funetion of that system.

CRITERION h2 - ENGE:rdED SAFETY FEATUREG COMPONEffS CAPAEILITY (Category A)

Engineered safety features shall be designed so that the capability of these features to perfor= their required function is not impaired by the effects of a loss-of-coolant accident to the extent of causing undue risk to the health and cafety of the public.

v Discussion The reactor design meets this criterion. The engineered safeguards are designed to function in the unlikely event of a loss-of-coolant accident with no impair-ment of capability due to the effects of the accident.

The core flooding tanks contain check valves which operate to per=it flow of emergency coolant from the tanks to the. reactor vessel. These valves are self-actuating and need no external signal or external supplied energy to =ake the=

operate.

- CRITERION h3 - ACCIDENT AGGRAVATION PREVENTION (Category A)

Protection against any action of the engineered safety features which would accentuate Eignificantly the adverse after-effects of a loss of nor=al cooling shall be provided.

Discussion n The engineered safeguards are designed to meet this criterien. The water in-("' ) jected to insure core cooling is sufficiently borated to insure core suberiti-cality. Nonessential sources of water inside the reactor building are 1C-21

O Q autocatiet iy isolated to prevent dilution of the borated coolant. Essential sources of post-accident cooling waters are conitored to detect leakage which may lead to dilution of boron content. An analysis has been =ade to de=on-strate that the injection of cold water on the hot reactor coolant system sur-faces will not lead to further failure. The design of the equi; tent and its actuating system insures that water injection vill occur in a sufficiently short time period to preclude significant retal-water reactions and consequent energy releases to the reactor building (14.2.2 3) .

CRITERION hk - EMERGENCY CCRE C00LIiG SYSTH4 CAPABILITY (Category A)

An e=ergency core cooling syste= with the capability for accomplishing adequate emergency core cooling shall be provided. This core cooling system and the core shall be designed to prevent fuel and clad damage that would interfere with the

-emergency core cooling function and to limit the clad metal-water reaction to acceptable a=ounts for all sizes of breaks in the reactor coolant piping up to the equivalent of a double-ended rupture of the largest pipe. The perfor=ance of such emergency core cooling system shall be evaluated conservatively in each area of uncertainty.

O Discussion

(!, \,

-' C' Emergency core cooling is provided by pumped injection and pressurized core flooding tanks. This equipment prevents clad melting for the entire spectrum of reactor coolant syste= failures ranging from the s=allest leak to the com-plete severance of the largest reactor coolant pipe. Pumped injection is sub-divided in such a way that there are two separate and independent strings, each including both high-pressure and lov-pressure coolant injection, and each ca-pable of providing 100 percent of the necessary core injection with the core flooding tanks. The core flooding tanks are passive components which are needed for only a short period of time after the accident, thereby assuring 100 percent availability when needed.

Chn tHION 45 ' INSPECTION OF H ERGETCY CORE COOLING SYST94 (Category A)

~ Design provisions shall, where practical, be cade to facilitate physical inspec-tion of all critical parts of the emergency core cooling system, including re-actor vessel internals and water injection non:lec.

Discussion All critical ps of the emergency core cooling system, including the reactor

\  !]/

f vessel internals and water injection nozzles, can be inspected during unit shutdown (Section 4.4).

0090 1C-22

O CRITERION h6 - TESTING OF E!ERGENCY CORE COOLING SYST94

,V _COMPCNENTS (Category A)

Design provisions shall be =ade so that active components of the emergency core cooling system, such as pumps and valves, can be tested periodically for operability and required functional perfor=ance.

Discussion The emergency core cooling syste= design meets this criterion by rotating the active components which are nor-ally in service as components of the engineered safeguards syste=s. In addition, periodic tests are performed on ecmponents not normally in service (6.1.4).

GTWRION 47 - N OF BIERGENCY CORE COOLING SYSTD4 (Category A)

A capability shall be provided to test periodically the operability of the emergency core cooling system up to a. location as close to the core as is practical.

7 p.

\

_ Discussion

J The high-pressure (makeup water) and low-pressure injection (decay-heat re= oval) strings are included as part of normal service systems. Consequently, the active components can be-tested periodically-for operability. The core flooding system operability can be tested during shutdown or refueling. In addition, all valves

. vill be periodically-cycled to_ insure operability. With-these provisions, the operability of the emergency core cooling system can be periodically demonstrated (6.1.4).

CRITERION 48 - IESTING OF OPERATIONAL S KUENCE OF EMERGENCY CORE COOLING SYSTE4 (Category A)

A capability shall be provided to test initially, under conditions as close as practical to design, the full operational sequence that would bring the emer-gency core cooling system into action, including the transfer to alternate power sources.

Discussion The operational sequence that would bring the emergency core cooling system into action, includLng transfer to alternate power sources, can be tested in parts (6.1.4 and 713).

\ )

v 002-31 <

1C-23

p CRITERION h9 - REACTOR CONTAIMMENT DESIGN BASIS (Cateeory A) d The reactor containment structure, including access openings and penetrations, and any necessary containment heat removal systems shall be designed so that the leakage of radioactive materials from the containment structure under con-ditions of pressure and temperature resulting from the largest credible energy release following a loss-of-coolant accident, including the calculated energy from =etal-water or other chemical reactions that could occur as a consequence of failure of any single active component in the emergency core cooling system, vill not result in undue risk to the health and safety of the public.

Discussion l The reactorofbuilding, pressure 67 psig at including 297 F. access openings .and penetrations, has a design The grestest transient peak pressure, associated with a postulated rupture of the piping in the reactor coolant system and the calculated effects of a metal-vater reaction, does not exceed these values.

The reactor .bnWing.and engineered safeguards systems have been evaluated for various combinations of credible energy releases. The analysis accounts for system energy and decay heat.

The cooling capacity of either reactor building cooling system is adequate to prevent overpressurization of the structure.

The than use of ECCS the design for core flooding limits the reactor building pressure to less pressure.

s Q'w/ The high-pressure injection and low-pressure injection systems have redundancy of equipment to insure availability of capacity.

u Electric motors and valves, whichJDust functica within the -reactor building during accident condition, are designed to operate in a steam-air atmosphere l at 297 Eand 67 psig.

CRITERION (Category A)50 - NI7f RBWIRDENT FOR CONTAINMENT MATERIAL The selection applicable and usecodes.

engineering of containment materials shall be in accordance with Discussion The ferritic materials used as load carrying components in the reactor build-ing design are selected in accordance with the appropriate codes, regulations, and testing requirements (Section 5).

O 1C-24 Q()'ygg Amendment No. lb 7/31/70

CRITERION 51 - REACIOR C00IANT PRESSURE BOUNDARY OUTSIDE q

4 CONTAIN! M (Category A) l v

If pe1 of the reactor coolant pressure boundary is outside the containment, features shall be provided to avoid undue risk to the health and safety of the public in case of an accidental rupture in that part.

Discussion The reactor design meets this criterion. The reactor coolant pressure boundary is defined as those piping systems or components which contain reactor coolant at design pressure and temperature. With the exception of the pressurizer sampling line, the reactor coolant pressure boundary, as defined above, is .

located entirely within the reactor building. The sampling line is provided with remotely operated valves for isolation in the event of a failure. This line is nor= ally isolated and is used only during actual sampling operations.

All other piping and components which =ay contain reactor coolant are at lov temperatures .such that any leakage would .be collected by the . contaminated drain system. No significant environmental dose would arise from these sources.

CRITERION 52 - CONTAINMENT HEAT REMOVAL SYSTEMS (Category A)

Where an active heat removal system is needed under accident conditions to CN

'() prevent exceeding containment design pressure this syst u shall perform its required function, assuming failure of any single active component.

Discussion The reactor building design. includes two redundant accident heat removal systems, the reactor building spray system and the reactor building air recirculation and cooling system, each with a full capacity of 200 x 10 6 Btu /h (Sections 6.2 and 6 3).

CRITERION 53 - CONTAINMENT ISOLATION VALVES (Category A)

Penetrations that require closure for the contaicment function shall be pro-tected by redundant valving and associated apparatus.

._.'11s cuss'.on The general design basis governing isolation is that leakage through all fluid penetrations not serving accident-consequence-limiting systems is tc be mini-mized by a double barrier so that no single, credible failure or malfunction of

.an active. component can result in loss-of-isolation or intolerable leakage.

< gy The installed double bar*iers take the fom of closed piping syste=s, both

( j inside and outside the reactor building, and various types of isolation valves.

v 1C-25 0033

' , r3 CRITERION Sh - INITIAL LEAKAGE RATE TESTING OF

) CONTAIIBENT (Catecory A)

Containment shall be designed so that integrated leakage rate testing can be conducted at the peak pressure calculated to result from the design basis accident after co=pletion and installation of all penetrations and the leak-age rate shall be measured over a sufficient period of time to verify its confomance with required perfor:ance.

Discussion The design leakage from the reactor building and penetret.f ons is consistent with the requirements of 10 CFR 200. An. integrated lee. sage a.te test at the peak pressure calculated to result from the postulated loss-of-coolant acci-dents, is possible on the completed reactor building including all penetra-tions (5 1.4).

CRITERION $5 - PERIODIC CONTAIIBENT LEAKAGE RATE TESTING (Category A)

The containment shall be designed so that an integrated leakage rate can be periodically determined by test during plant lifetime.

Discussion

-_The_ reactor _ building ls designed.so.that.the. leakage. rate.can be periodically checked during plant lifetime.

CRITERION 56 - PROVISIONS FOR TESTING OF PENETRATIONS (Category A)

Provisions shall be nade to the extent practical for periodically testing penetrations which have resilient seals or expansion bellows to per=1t leak tightness to be de=enstrated at the peak pressure calculated to result from occurrence of the design basis accident.

Discussion

' All electricalwetrations have ywvisions for pressurizing between the double seals periodically during operation or shutdown to allow for leak checking by observing the pressure decay. 'Ihere are no pipe penetrations to the reactor building which require a bellows seal between the pipe and the reactor building.

?/m 00294 1C-26

1 CRITERION 57 PROVISIONS FOR TESTEiG CF ISOLATION VALVES w (Category A)

Capability shall be provided to the extent practical for testing functional operability of valves and associated apparatus essential to the containment function for establishing that no failure has occurred and for determining that valve leakage does not exceed acceptable limits.

Discussicn Testing of the isolation valves and the associated instrumentation is provided for.

CRITERION 58 - EIS?ECTION OF CONTAEBEIT PRESSURE-PSDUCEIG #

SYSTH4S (Category A)

Design provisions shall be made to the extent practical to facilitate the periodic inspection of all important components of the containment pressure-reducing systems, such as pumps, valves, spray nozzles, torus, and sumps.

.

-t

-v 1: Discussion The reactor building. pressure-reducing syste=s are the spray system and the air. recirculation and cooling ~ system.

Performance--testing of all' active components of the reactor building spray system is accomplished as described in Criterion 59 During these tests, the

' equipment is visually. inspected for leaks. Valves and pumps are operated and inspected after any =aintenance to insure proper operation.

The equipment, piping, valves and instrumentation of the reactor building air recirculation and cooling units are_ arranged so that they can be visually in-spected. The air recirculation and cooling units and associated piping are located outside the secondary concrete shield around the reactor coolant system loops. Since the air. recirculation and cooling system 'is nor= ally in operation to remove the equipment heat load, its performance can be monitored continu-

ously. .The service water piping and valves outside the reactor building are inspectable at all times. Operational tests and inspections are performed prior to initial start-up.

~ CRITERION TESTEIG OF CONTAEGEIT PRESSURE-REDUCING SYSTEMS CCl4 PONE.NTS (Catecory A)-

i Thh containment. pressure-reducing systems shall be designed to the extent'prac-

-tical so that active components, such as pumps and valves, can be tested peri-J Lodically for operability and required functional perfor=ance.

S 00295 1C-27' ' Amendment,No.-5 1 !=fra

A Discussion Y]

The reactor building air recirculation and cooling system is nornally in service. Valving on the coils can be periodically cycled, thus placing the coils into emergency service periodically during operation. The active ecmponents of the reactor building spray system are tested periodically as set forth in 6.2.4.

CRITERION 60 - TESTING OF CONTAINMENT SPRAY SYSTES (Category A)

A capability shall be provided to the extent practical to test periodically the operability of the containment spray system at a position as close to the spray no :les as is practical.

Discussion The reactor building spray systa=s are tested on a periodic basis as follows:

Reactor Building These pumps are tested singly by opening the valves Spray Pumps in the test line, closing the block valves upstream of the spray header isolation valves, and closing the isolation valves. Each pump in turn is manually p!

started and checked for flow.

wJ Reactor Building When the unit is shut down, air or smoke is blevn Sprny Nozzles through the test connections with visual observation of the nozzles.

CRITERICN 61 - TESTING OF OPERATIONAL SEQUENCE CF CONTAINMENT PRESSURE-REDUCING SYSTEMS (Category A)

A capability shall be provided to test initially under conditions as close as practical to the design and the full operational sequence that would bring the containment pressure-reducing systems into action, including the transfer to alternate power sources.

Discussion Capability to test under conditions as close to design as practical the full

. operational sequence.that would bring .the reactor building pressure-reducing system into action is accomplished with a test line in the spray system (Section 6.2) just prior to the spray system isolation valves. Transfer to e=ergency power sources is acco=plished by tripping the nor=al source breaker 1;o simulate loss rf source. The resctor building air cooling units are con-

[ tinually tested by nor=al duty.

'\

v 1C-28 00?.96

, CRITERION 62 - INSPECTION OF AIR CIZANUP SYSTEMS t

(Category A)

Design provisions shall be made to the extent practical to facilitate physical inspection of all critical parts of containment air cleanup systems, such as ducts, filters, fans and dampers.

Discussion Since air cleanup ir=ediately following the LOCA or MIA is accceplished by a chemical additive spray system, there is no provision for a post-incident re-circulatory air cleanup system within the reactor building.

A filtration system is provided in the reactor building Mrirogen vent system which is required only during a post-IOCA or MHA period. All components of the hydrogen venting filtration system including dehumidifiers, ducts, filters, fans and dampers are located outside the enclosure building filtration region.

Access.for physical. inspection of these components.is thereby not impeded by reactor operation.

This syste= is described in Paragraph 9.12.2.1.

CRITERION 63 - TESTING OF AIR CIEANUP SYSTEMS CCNPONENTS

,, (Category A)

~

Design provisions shall be made so that, to the extent practical, active com-ponents of the air cleanup systems, such as fans and da=pers, can be tested periodically for operability and required functional perfor=ar e.

Discussion Active components of the hydrogen vent and auxiliary building filtration systems are tested periodically for operability and required functional performance.

CR11EHION 64 - TESTIIU OF AIR CLEANUP SYSTEMS (Category A)

A capability shall be provided to the extent practical for in-situ periodic testing and surveillance of the air cleanup systems to insure (a) filter bypass paths have not developed and (b) filter and trapping materials have not deterio-rated beyond acceptable limits.

Discussion Due to the hydrogen venting and refueling building filtration systems being located outside the reactor building, they may be periodically tested to insure that (a) filter bypass paths have not developed and (b) filter and trapping caterials have not deteriorated beyond acceptable limits.

1C-29 Amendment No. 2 5/28/69 OEN7

CRITERION 65 - TESTING OF OPERATIONAL SEQUENCE OF AIR CIZANUP SYSTDG j;q (Category A)

, A capability shall be provided to test initially under condit ons as close to design as practical the full operational sequence that would bring the air cleanup systems into action, including the transfer to alternate power sources and the design airflow delivery capability.

Discussien The full operational sequence that would bring the hydrogen venting and re-fueling building filtration system into action, including the transfer to an alternate power source and the design airflow delivery capability, can be tested.

CPT'T'mTON 66 - PREVE2 PION OF FUEL STORAGE CRITICALITY (Category B)

Criticality in new and spent fuel storage shall be prevented by physical systems or processes. Such means as geometrically safe configurations shall be emphasized over procedural controls.

.. g Discussion

k l V) This criterion is met by the design of the new and spent fuel assembly storage facilities to maintain a safe condition by storing fuel assemblies in racks shav.ing_spaca.ng and/or poison . sufficient to maintain a keff f less than 0 90 when wet.

CRITERION 67 - FUEL AND WASTE STORAGE DECAY EEAT (Category B)

Reliable decay heat removal systems shall be designed to prevent damage to the fuel in storage facilities and to vaste storage tanks that could result in radioactivity release which would result in undue risk to the health and safety of the public.

Discussion This decay heat removal is accomplished by the fuel cooling system. In case a maximum of l'-2/3 cores are stored due to complete unloading of one reactor ves-sel with 2/3 core already in residence, this system T1us the decay heat Temoval system maintains the fuel pool temperatura within acceptable limits as described in Section 9 3 The most serious failure would be complete loss of water in the storage pool. This is prevented by pd. acing the cooling connections near or above the water level so that the pool cannot be gravity-drained. Additionally, a h) 3v 1C-29a A=endment No. 2 s/ e m 00298

i I

I l

1 backup water supply is available from the fire system which could be utilized l in the unlikely event of a considerable loss of water from the pool. These l precautions to6 ether with the shielding specified in Section 5.4 vill prevent j radioactive release to the plant environs.  !

l I

Cooling is not r;;.uired for waste storage tanks due to the low level of i radioactive heating experienced. ,

j

• l l

l 4

tg 1C-29b Anendnent No. 2 5/28/69 00W19

CRITERION 68 - FUEL AND WASTE STORAGE RADIATION SHIELDING A (Category B)

)

Adequate shielding for radiation protection shall be provided in the design of spent fuel and vaste storage facilities.

Discussion The shielding provided in the spent fuel and vaste storage area is in accord-ance with the radiation oning described in Section 5.h, enabling the plant to meet the guidelines of 10 CFR 20.

CR1TERION 69 - PROTECTION AGAINST RADI0 ACTIVITY RELEASE FRCM SPENT FUELANDWASTESTORAGE1CategoryB)

Provisions shall be made in the design of fuel and vaste storage facilities such 1; hat -no undue rivk to the health and safety of the public could ' result from an accidental release of radioactivity.

Discussion The fuel and vaste storage facilities are designed so that accidental releases

,.s of radioactivity to the environment resulting from rupture of a vaste gas decay t( ) tank or from da-age to a spent Tuel ~ assembly as described lu 14.2.2.1 are be-V lov the 10 CFR 100 guideline values.

CRITERION TO - CONTROL CF RELEASES OF RADICACTIVITY TO THE ENVIRONMERP (Category B)

The facility design shall include those means necessary to caintain control over the plant radioactive effluents, whether gaseous, liquid, or solid.

Appropriate holdup capacity shall be provided for retention of gaseous, liquid, or solid effluents, particularly where unfavorable environmental conditions can be expected to require operational limitations upon the release of radio-active effluents to the environment. In all cases, the design for radioactivity control shall be justified (a) on the basis of 10 CFR 20 requirements for normal operations and for any transient situation that might reasonably be antici;nted to occur, and (b) on the basis of 10 CFR 1CO dosage level guidelines for poten-tial reactor accidents of exceedingly low probability of occurrence.

I Discussion The liquid radioactive vaste syste= collects, treats, ' stores, recycles, and/or disposes of all radioactive liquid vastes. These are collected in sumps and drain tanks and then transferred to the appropriate tanks for treatment, stor-(N age, and disposal. Vastes to be discharged from th _4rstem are processed on 1

.q ) l l

I 1C-30 l 00300 1

l l

'f(N a batch basis with each batch being processed by such methods which ara I

, s._,) appropriate for the materials present. All processed wastes discharEed are monitored prior to release. {

i Solid radioactive vastes are collected, processed, packaged, and stored temporarily on the site to permit decay or aceutu3ation prior to shiptent from the plant for permanent storage.

Equiptent is provided to compress and hold up radicactive gases for decay before release through the station stack at a controlled rate, although normally, these gases are monitored and discharged directly to the stack (Section 11) . All gaseous and liquid vastes discharged will be in accord-ance with the guidelines of 10 CFR 20.

(f;

\- /

gy

-%) )

00301 1c-31

-- - . -. .-