ML16281A229

Safety Evaluation Report for the Sodium Advanced Fast Reactor (Safr) Design

ML16281A229
Person / Time
Issue date:	01/19/1989
From:	Banks M, Remick F Advisory Committee on Reactor Safeguards
To:	Zech L NRC/Chairman
References
D890119
Download: ML16281A229 (5)

Text

D890119 The Honorable Lando W. Zech, Jr.

Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

SAFETY EVALUATION REPORT FOR THE SODIUM ADVANCED FAST REACTOR (SAFR) DESIGN During the 345th meeting of the Advisory Committee on Reactor Safe-guards, January 12-14, 1989, we completed our review of a draft of the subject safety evaluation report (SER). This subject was also con-sidered during our 344th meeting on December 15-17, 1988. Our Sub-committee on Advanced Reactor Designs met on December 13, 1988 to discuss this matter. During these meetings, we had the benefit of discussions with representatives of the NRC staff and its consultants, with representatives of the Department of Energy (DOE) and its con-tractors, including representatives of Rockwell International, the lead design contractor. We also had the benefit of the documents referenced.

The SAFR conceptual design is a product of a DOE program to develop designs for possible future power reactor systems that would have enhanced safety characteristics. Other design projects in the program are the Modular High Temperature Gas Cooled Reactor (MHTGR) and the Power Reactor Inherently Safe Module (PRISM). The NRC staff has re-viewed these designs in accordance with the Commission Policy on Ad-vanced Nuclear Power Plants. These preapplication reviews are intended to provide NRC guidance on licensing issues at a relatively early stage of design development. The ACRS has previously commented to you in June 1987 on NUREG-1226, "Development and Utilization of the NRC Policy Statement on the Regulation of Advanced Nuclear Power Plants," in July 1988 on key licensing issues associated with the entire program, in October 1988 on the SER for the MHTGR, and in November 1988 on the SER for PRISM.

We understand that issuance of the SER will not constitute approval of the SAFR design. Further engineering development and documentation would be required to support a future application for design certifi-cation.

The SAFR design incorporates small modular reactors cooled by liquid sodium. The standard SAFR plant would consist of one or more "power paks." Each "power pak" would comprise four reactor modules that would produce a total of 3600 MWt (1400 MWe). Each reactor, along with its intermediate heat exchangers and pumps is immersed in a pool of sodium.

A steel vessel containing this pool is surrounded by a secondary steel container and each module is installed within a concrete structure above grade. Secondary sodium coolant will flow from each reactor module to a pair of steam generators, located above grade along with the remainder of the balance of plant (BOP) equipment.

The SAFR modular design provides several desirable features for enhanc-ing safety of a nuclear power plant:

~ a passive system for emergency removal of decay power

~ inherent mechanisms for negative feedback of reactivity

~ two independent scram systems, one capable of self-actuation

~ large thermal inertia in the pool of sodium coolant

~ metal fuel, offering greater opportunity for on-site fuel repro-cessing

~ small component sizes, providing opportunities for factory fabrica-tion

~ opportunity for prototype testing of a single module

~ separation of safety-related functions from BOP systems SAFR, while similar to PRISM, has some important differences. Each SAFR reactor module is larger and would generate 900 MWt compared with 425 MWt for PRISM. SAFR primary sodium would run hotter than in PRISM with a nominal core exit temperature of 950~F compared with 875~F for PRISM.

SAFR steam conditions are 850~F and 2700 psig, compared with 545~F and 990 psig for PRISM. SAFR has two reactivity control and scram systems while PRISM has one. SAFR's main coolant pumps are conventional centri-fugal while PRISM's are electromagnetic.

The DOE has decided to discontinue its development of the SAFR design and concentrate liquid metal reactor (LMR) efforts in the PRISM design organization, but has requested that the NRC staff complete its review of both SAFR and PRISM. The NRC staff has expressed no opinion that there appears to be a net advantage in the PRISM design over that of SAFR, or vice versa.

On the basis of its review, the NRC staff has concluded that the SAFR design has the potential for a level of safety at least equivalent to current light water reactor (LWR) plants. We have no reason to disagree and believe that SAFR, like PRISM, could be licensed if continuing development work is pursued successfully.

A number of safety issues remain to be completely addressed. A continu-ing program of research and development will be necessary to support further design. Plans for extensive prototype testing should be includ-ed. In the following paragraphs, we comment on a number of specific safety issues which we believe should be considered by the staff in its final SER, and by DOE if it continues design and development of this concept.

Positive Sodium Void Coefficient SAFR, like PRISM, will experience a large increase in reactivity in the event of significant boiling or other voiding of the sodium coolant.

The designers' analyses cannot show that such voiding is impossible, but they have concluded that it is very improbable. Whether it is improb-

able enough and whether the consequences of such voiding can be toler-ated is the major safety issue that must be resolved before these reactor designs could be licensed. The simultaneous and sudden loss of both main circulation pumps, without scram, in a reactor module might cause significant sodium boiling and a reactivity increase. If the positive voiding coefficient is to be accepted, such events must be shown to be of extremely low probability. We believe that additional design and safety analysis work is needed in this area.

Other Reactivity Coefficients The satisfactory performance of the system in certain low probability transients is very dependent on the changes in core reactivity with variations in power, temperature, and flow that can make subtle changes in the core geometry. For these transients there are small margins between the calculated response and unacceptable responses. A con-siderable design and development effort will be necessary to assure that response of the core will be acceptable over a wide range of potential challenges.

Scram Systems The SAFR design includes two sets of control rods either of which can independently shut down the reactor in response to a scram signal and maintain it subcritical. One set would be released automatically by the loss of holding power in a special clutch containing a magnet. Abnor-mally high sodium temperature, greater than 1050~F, would cause the Curie point temperature of the magnet to be exceeded. We note, however, that this feature depends on there being maintained a sufficient flow of sodium coolant over the magnet. This flow must be assured if the automatic shutdown is to be assured.

Neither of the control rod systems is fully safety grade. Apparently, the systems do have some of the most important features of safety grade systems, e.g., tolerance of single failures. While we agree that experience with LWRs indicates the designation of a system as safety grade is not a guarantee of high reliability, we suggest that desig-nation of a system as fundamentally important as a scram system as non-safety grade is flouting not only convention but good sense.

Use of PRA The NRC staff seems to have been disappointed in the extent to which PRA has been useful in reviewing the design of SAFR, as well as the earlier review of the PRISM and MHTGR. Apparently the designs at this stage are developed in so little detail that risk analysts have little to work with and the benefits of the analysis are limited. Decision makers should regard with caution quantitative claims of high safety perform-ance for reactor systems still at the conceptual design stage.

Containment Although a secondary vessel is provided to contain leakage of sodium coolant, the SAFR design does not include a conventional containment capable of resisting high temperatures and pressures. It is contended that the potential for accidents, for which such a containment might provide mitigation, is so low that a conventional containment is not

needed. Both deterministic and probabilistic arguments are made in support of this contention. Although these arguments have technical merit, we are not yet convinced. Our position is as stated in our report to you of July 20, 1988 on the key licensing issues associated with DOE-sponsored reactor designs and our report to you of October 13, 1988 on the preapplication safety evaluation report for the Modular High Temperature Gas Cooled Reactor.

However, there is a problem in specifying containment design criteria.

One reason for providing a strong physical containment is to protect the public against unforeseen accidents. But, precisely because they are not foreseen, the design requirements for a containment are not obvious.

Therefore, engineering and policy judgments must be made about the need for, and nature of, containment that might be used with SAFR. We believe that further study is appropriate before final judgments are made.

Individual Rod Worth There are two shutdown systems utilized in SAFR. Neither is currently safety grade. The automatic plant trip system can drive in all six of the primary control rods, which have a net reactivity worth of about ten dollars. It can also interrupt power to the electromagnetic latch and drop three secondary control rods, with a net reactivity worth of about seven dollars. The minimum number of primary control rods needed for reactor shutdown is two out of the six to insert about three dollars.

The secondary system needs but one rod (about 2.2 dollars) to enter the core. With this very large reactivity worth for each rod, there is a potential for serious consequences from a rod ejection accident. We believe that this requires further study.

Need for Local Flow and Temperature Monitoring The SAFR safety analysis indicates that blockage of flow through one fuel assembly may damage that assembly, but will not damage adjacent assemblies. Early work with oxide fuel has demonstrated that propa-gation is unlikely, but experiments and analysis with metal fuel have not been as extensive. Especially because the design does not provide for monitoring flow and effluent temperature from individual assemblies, we believe that this requires further study.

Role of the Operator We believe that insufficient attention has been given to the role of the operator. Claims that a SAFR plant would have such inherently stable and safe characteristics that the operator will have essentially no safety function are unproven. Operation of four reactors, possibly in several different operational states at any given time, may be a signif-icant challenge for the small operations crew envisioned. Opportunities for cognitive error, which might defeat favorable safety characteristics of the reactor, might be more abundant than is now recognized. Further study is needed.

Other Operational Considerations In addition, certain features that have been found to be desirable in LWR plants are not provided in the SAFR design. Although remote shut-

down capability is provided, it appears to lack some of the attributes of such systems in current LWR plants. Also, the design does not include Class 1E AC electric power systems, but relies entirely on Class 1E DC power from batteries. We recommend that further consideration be given to the potentially large power needs of essential auxiliary functions such as space cooling.

Protection Against Sabotage With regard to the need for designing protection against sabotage, the following statement from our report of July 20, 1988 should be given early consideration as the design of this plant progresses:

"It is often stated that significant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the design process. Unfortunately, this has not been done consistently because the NRC has developed no guidance or require-ments specific for plant design features, and there seems to have been no systematic attempt by the industry to fill the resulting vacuum. We believe the NRC can and should develop some guidance for designers of advanced reactors. It is probably unwise and counterproductive to specify highly detailed requirements, as those for present physical security systems, but an attempt should be made to develop some general guidance."

Sodium Fires Further study of the potential for and suppression of sodium fires and consideration of their possible consequences is needed.

Such studies should include the possibility of fires resulting from earthquake effects.

Sincerely, Forrest J. Remick Chairman References

1. Office of Nuclear Regulatory Research, "Safety Evaluation Report for the Sodium Advanced Fast Reactor (SAFR)," Novem-ber 9, 1988 (Predecisional Draft).

2. Rockwell International (DOE contractor), AI-DOE-13527, "SAFR Preliminary Safety Information Document," Volumes I through III, October 1985.