ML18023A131
| ML18023A131 | |
| Person / Time | |
|---|---|
| Site: | NuScale |
| Issue date: | 01/22/2018 |
| From: | Rad Z NuScale |
| To: | Document Control Desk, Office of New Reactors |
| References | |
| RAIO-0118-58288 | |
| Download: ML18023A131 (9) | |
Text
RAIO-0118-58288 January , 2018 Docket No.52-048 U.S. Nuclear Regulatory Commission
ATTN: Document Control Desk
One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738
SUBJECT:
NuScale Power, LLC Response to NRC Request for Additional Information No.
285 (eRAI No. 9205) on the NuScale Design Certification Application
REFERENCE:
U.S. Nuclear Regulatory Commission, "Request for Additional Information No.
285 (eRAI No. 9205)," dated November 22, 2017 The purpose of this letter is to provide the NuScale Power, LLC (NuScale) response to the referenced NRC Request for Additional Information (RAI).
The Enclosure to this letter contains NuScale's response to the following RAI Question from NRC eRAI No. 9205:
15-3 This letter and the enclosed response make no new regulatory commitments and no revisions to any existing regulatory commitments.
If you have any questions on this response, please contact Darrell Gardner at 980-349-4829 or at dgardner@nuscalepower.com.
Sincerely, Zackary W. Rad Zackary Director, Regulatory Affairs NuScale Power, LLC Distribution: Gregory Cranston, NRC, OWFN-8G9A Samuel Lee, NRC, OWFN-8G9A Rani Franovich, NRC, OWFN-8G9A : NuScale Response to NRC Request for Additional Information eRAI No. 9205 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com
NuScale Response to NRC Request for Additional Information eRAI No. 9205 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com
Response to Request for Additional Information Docket No.52-048 eRAI No.: 9205 Date of RAI Issue: 11/22/2017 NRC Question No.: 15-3 In accordance with 10 CFR 50, Appendix A, General Design Criterion (GDC) 1, Quality standards and records, structures, systems, and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed.
To meet the requirements mentioned above, as they relate to the Chapter 15 accident analyses, the accident analyses should show that despite the worst single failure, the safety systems are still capable of accomplishing their safety functions and maintaining defense-in-depth for the NuScale design.
In response to RAI 8744, Question 15.02.08-4, dated June 21, 2017, the applicant stated that NUREG-0138, Issue 1, is the basis for justification that the nonsafety-related check valve in the feedwater line can be credited for DBA mitigation in the event its safety-related counterpart (i.e.
safety-related check valve in feedwater line) is assumed to fail under the single failure assumption because the nonsafety-related check valve is designed to requirements for augmented quality, is seismic Category I, and is included in the in-service testing program.
The staff considered NUREG-0138, Issue 1, in its review of the response to RAI 8744, Question 15.02.08-4. The staff quotes from NUREG-0138, Issue 1:
"for accidents involving spontaneous failures of secondary system piping not part of the primary system boundary, where the potential consequences are significantly lower
[emphasis added], less stringent requirements are imposed on the quality and design of the systems needed to cope with such secondary system ruptures. This approach results, in the staff's judgement, in a proper weighing of consequences and safety requirements [emphasis added] in order to assure a balanced level of safety over the entire spectrum of postulated design basis accidents."
The staff notes that the NUREG-0138, Issue 1, justification for crediting nonsafety-related components for DBA mitigation is predicated on the fact that the DBA under question has relatively less severe consequences than an event where all components required for mitigation must be safety-related. Therefore, in order to rely on NUREG- 0138, Issue 1, for justifying use of NuScale Nonproprietary
nonsafety-related components for DBA mitigation, the applicant must show that the acceptance criteria of a Condition II event are satisfied, assuming no credit of nonsafety-related components. If the acceptance criteria of a Condition II event cannot be met, assuming no credit of the nonsafety component, then it is the staff's understanding that GDC 1 is not met, the single failure criterion is not met for the safety-related component that was initially assumed to fail, and ultimately, the reactors defense-in-depth features are inadequate.
Furthermore, it is the staff's understanding that in the case of the feedwater line break inside containment, assuming no credit of the nonsafety check valve, as described in RAI 8744, Question 15.02.08-4, then there exists a potential to have both trains of DHRS inoperable which could result in core melt. The staff requests the applicant to show that for a feed line break inside containment assuming no credit of the nonsafety-related check valve, the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values in accordance with the ASME B&PV code, and the fuel cladding integrity is maintained by demonstrating that the MDNBR remains above the 95/95 DNBR limit. If these acceptance criteria cannot be met when assuming no credit of the nonsafety-related check valve, the staff requests the applicant to provide additional information in the FSAR justifying how GDC 1 and the single failure criterion are met for this event, and clarify how the NuScale design maintains adequate defense-in-depth for its safety systems.
Ultimately, the staff seeks to understand for all accident analyses presented in FSAR Tier 2, Chapter 15, where nonsafety-related components are currently credited for accident mitigation, how GDC 1 and the single failure criterion are met, and how defense-in-depth is maintained.
Therefore, for all accident analyses presented in FSAR Tier 2, Chapter 15, where nonsafety-related components are currently credited for accident mitigation, the staff requests the applicant to show that for each of these accidents, assuming no credit of nonsafety-related SSCs, the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values in accordance with the ASME B&PV code, and the fuel cladding integrity is maintained by demonstrating that the MDNBR remains above the 95/95 DNBR limit.
If these acceptance criteria cannot be met when assuming no credit of the nonsafety-related SSCs, the staff requests the applicant to provide additional information in the FSAR justifying how GDC 1 and the single failure criterion are met, and clarify how the NuScale design maintains adequate defense-in-depth for its safety systems.
NuScale Response:
There are three sets of nonsafety-related components that are credited in the NuScale Power Module (NPM) Chapter 15 safety analyses. These components are:
nonsafety-related feedwater (FW) check valves nonsafety-related FW regulating valves (FWRVs) nonsafety-related secondary main steam isolation valves (MSIVs) and bypass valves.
The NRC has issued eRAI 9237 for the MSIVs, which is also addressed in this response.
NuScale Nonproprietary
Feedwater Nonsafety-Related Check Valves The limiting event for a challenge to the decay heat removal system (DHRS) operability is a large feedwater line break (FWLB) inside containment. Following a FWLB, containment pressure will increase to the containment isolation setpoint at approximately one second into the event. The safety-related check valve (backflow prevention device) in the non-faulted FW line seats at approximately one second into the event. The increased containment pressure will initiate a reactor trip and containment isolation signal and actuate DHRS approximately three seconds into the event (including sensor and signal processing time). The DHRS valves are assumed to open in 30 seconds. The FWIVs and MSIVs are designed to close within seven seconds. DHRS heat exchanger on the faulted FW line empties into containment. See Figure 1 for an integrated diagram of the systems that interface with FW system and DHRS for this event.
If the safety-related check valve in the non-faulted FW line fails to seat, the nonsafety-related check valve is credited in the non-faulted FW line to maintain DHRS inventory for approximately 7 seconds. After 7 seconds, the safety-related FWIVs on both FW lines will close, isolating the flowpath from the intact DHRS heat exchanger to the faulted FW line. Closure of either FWIV will terminate the loss of inventory from the intact DHRS heat exchanger. The intact DHRS train is only affected if the FWLB is sufficiently large to permit backflow through both FWIVs and FWRVs, with a failure of both the safety-related and nonsafety-related FW check valves. Both nonsafety-related FWRVs will also be closing on the FW isolation signal, however, these valves have a slower closing time (approximately 30 seconds) so would not be expected to isolate before the FWIVs. Closure of either FWRV would also isolate the non-faulted DHRS heat exchanger. To summarize, closure of any one of the six valves in the flowpath from the non-faulted DHRS heat exchanger to the faulted FW line would prevent draining the intact DHRS inventory. See Figure 2 for a diagram of the accident flowpath.
The NuScale position is that application of NUREG-0138, "Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976, Memorandum from Director NRR to NRR Staff, Issue 1, is appropriate. The nonsafety-related FW check valve meets the requirements of GDC 1 because the valve has adequate quality commensurate with the safety function. As previously stated, the check valve is augmented quality, including being designed to Seismic Category I criteria, and is in the inservice testing (IST) program. The check valve is a passive component that requires no initiating signal or external motive force. The only event where the nonsafety-related FW check valve is credited is in a large FWLB where sufficient differential pressure is present to seat the valve.
RAI Question 15-3 states that in the case of the feedwater line break inside containment, assuming no credit of the nonsafety check valve, as described in RAI 8744, Question 15.02.08-4, then there exists a potential to have both trains of DHRS inoperable which could result in core melt. It is correct that in certain large FWLB events, both trains of DHRS could be inoperable without credit for the nonsafety-related FW check valve. However, the NuScale PRA does not indicate core damage with a loss of all DHRS. FSAR Figure 19.1-8, Sequence 6 NuScale Nonproprietary
shows a successful module response with no core damage following a secondary line break with no DHRS. In the case of a FWLB, core cooling is maintained by the FW from the break combined with condensed steam from the reactor safety valves (RSVs) inside containment transferring heat to the reactor pool. NuScale considers this event beyond design basis, but the event does not result in core damage.
Feedwater Regulating Valves The nonsafety-related FWRVs are credited for FWLB inside containment to limit the volume of FW that is released to containment through the break. The safety-related FWIVs are the primary mechanism to isolate FW flow through the FWLB. Both the FWIVs and the FWRVs have limiting conditions for operation and surveillance requirements in Technical Specification 3.7.2, in accordance with 10 CFR 50.36(c)(2)(ii). Leakage is monitored by the associated Surveillance Requirements. The nonsafety-related FWRVs are credited as backup FW isolation. The FWRVs close more slowly than the FWIVs (30 seconds versus 5 seconds) and, therefore, a greater amount of FW is released inside containment if the FWIVs fail to close. Even with the slower FWRV closure time, the level in containment from the addition of FW does not reach the setpoint to actuate the emergency core cooling system (ECCS) valves on containment level.
The FWRVs also provide a backup the FWIVs for containment isolation for other events. The FWRVs meet the requirements for GDC 1 because they are designed to Seismic Category 1 criteria, are required to be operable by Technical Specifications, have Surveillance Requirements and are in the IST program.
Main Steam Isolation Valves and Bypass Valves FSAR Section 15.6.3 provides the event progression for a steam generator tube failure (SGTF) in a NPM. The limiting mass release scenario of a SGTF initiates with a tube failure at the top of the steam generator. After the reactor trip, depressurization results in the actuation of the decay heat removal system (DHRS) and a closure signal of the MSIVs, secondary MSIVs, FWIVs, and the FWRVs. As explained in FSAR Section 15.6.3, the limiting single failure for this scenario is for the MSIV on the faulted SG failing open. In this scenario, the secondary MSIV is credited with isolating the faulted steam generator. Both sets of MSIVs and bypass valves are designed for RCS pressure for mitigation of SGTF events.
The secondary MSIVs and bypass valves are credited as a nonsafety-related backup isolation for the steam system for steamline breaks, steam generator tube failures (SGTFs) and for DHRS system integrity consistent with the guidance of Regulatory Guide 1.206. The secondary MSIVs meet GDC 1 due to the augmented design, surveillance and operability requirements.
The safety-related MSIVs, nonsafety-related MSIVs and the associated bypass valves all have limiting conditions for operation and surveillance requirements in Technical Specification 3.7.1, in accordance with 10 CFR 50.36(c)(2)(ii). The surveillance requirements in the technical specifications ensure operability, while the frequency is controlled in accordance with the IST program. The secondary MSIVs have augmented design requirements, including being designed to Seismic Category I requirements and having leak detection.
NuScale Nonproprietary
Requirements and Precedent RAI Question 15-3 states that the applicant must show that the acceptance criteria of a Condition II event are satisfied, assuming no credit of nonsafety-related components. The FWLB described in FSAR Section 15.2.8 is a Postulated Accident (Condition IV Event) as shown in Table 15.0-1, Design Basis Events. NuScale has chosen to demonstrate that this event can meet the more restrictive Condition II (Anticipated Operational Occurrence)
Acceptance Criteria, however, this is not a requirement. Similarly Table 15.0-1 states that 15.1.5, Steam Piping Failures Inside and Outside Containment and 15.6.3, Steam Generator Tube Failure are Postulated Accidents (Condition IV Events). NuScale has demonstrated that these events also meet Condition II (Anticipated Operational Occurrence) Acceptance Criteria.
The classification of events, acceptance criteria and licensing methodology is discussed in FSAR 15.0.0.2 and 15.0.0.3.
Regulatory Guide 1.206, states that Only safety-related systems or components should be used to mitigate transient or accident conditions. However, analyses may assume that nonsafety-related systems or components are operable for the following cases:
- 1. when a detectable and nonconsequential random and independent failure must occur in order to disable the system,
- 2. when nonsafety-related components are used as backup protection.
The second criterion is applicable to the NPM. The nonsafety-related FW check valves are only utilized for backup protection and only for a very small subset of possible FWLBs. Similarly the FWRVs and secondary MSIVs and bypass valves are only utilized for backup protection.
In addition to the guidance in Regulatory Guide 1.206 discussed above, the NRC has approved the use of nonsafety-related components as backup protection in the final safety evaluation reports (FSERs) for the Westinghouse AP600 (NUREG-1512 - ML081160453) and AP1000 (NUREG-1793 - ML043570339) based on the staff position in NUREG-0138.
The NRC also indicated that the use of a nonsafety-related turbine trip and closure of the turbine stop valves was acceptable in the Chapter 15.0 Safety Evaluation with Open Items for the U.S. EPR design certification (ML090900096). These functions served as backup function for isolating the steam system based on the staff position in NUREG-0138.
NuScale considers the use of Seismic Category I components with augmented quality and testing for backup to safety-related components appropriate, per the available regulatory guidance and as has been approved for other nuclear plant designs.
Impact on DCA:
There are no impacts to the DCA as a result of this response.
NuScale Nonproprietary
SEISMIC SEISMIC Figure 1: Primary and Secondary System Interface SEISMIC SEISMIC CLASS III CLASS I CLASS I CLASS III SECONDARY MSIV SECONDARY MSIV AND BYPASS AND BYPASS TO MS TO MS TRAIN TRAIN 21 TO MS TRAIN 2 SAFETY-RELATED SAFETY-RELATED RXB RXB CLASS BREAK CLASS BREAK POOL POOL WALL WALL MSIV MS TRAIN 1 MS TRAIN 1 MSIV MSIV MSIV BYPASS BYPASS DHRS DHRS VALVES VALVES SEISMIC SEISMIC SEISMIC SEISMIC CLASS III CLASS I CLASS I CLASS III FROM COMMON FROM COMMON FW HEADER FW HEADER BACKUP FW CHECK BACKUP FW CHECK VALVE AND RXB RXB VALVE AND REGULATION VALVE POOL SAFETY-RELATED SAFETY-RELATED POOL REGULATION VALVE WALL CLASS BREAK CLASS BREAK WALL BACKFLOW PREVENTION BACKFLOW PREVENTION FW TRAIN 1 DEVICE DEVICE FW TRAIN 2 FWIV FWIV FROM CNT TO CNT TO CNT FROM CNT SG CNT SG CNT SG CNT SG CNT 01-SG-SG-1001 01-SG-SG-2001 STEAM GENERATOR 1 STEAM GENERATOR 2 01-SG-PSV-1002 01-SG-PSV-2002 DHRS DHRS TRAIN 1 TRAIN 2 DHRS SG SG DHRS FROM DHRS FROM DHRS RPV CNV
SEISMIC CLASS III SEISMIC CLASS I Figure 2 - FWLB Train 1 Flowpaths SEISMIC CLASS I SEISMIC CLASS III SECONDARY MSIV SECONDARY MSIV AND BYPASS AND BYPASS TO MS TO MS TRAIN TRAIN 21 TO MS TRAIN 2 SAFETY-RELATED SAFETY-RELATED RXB RXB CLASS BREAK CLASS BREAK POOL POOL WALL WALL MSIV MS TRAIN 1 MS TRAIN 1 MSIV MSIV MSIV BYPASS BYPASS DHRS DHRS VALVES VALVES If Backflow Prevention Device does not stop this SEISMIC SEISMIC flowpath, the Backup FW SEISMIC SEISMIC CLASS III CLASS I check valve will. CLASS I CLASS III FROM COMMON FROM COMMON FW HEADER FW HEADER BACKUP FW CHECK BACKUP FW CHECK VALVE AND RXB RXB VALVE AND REGULATION VALVE POOL SAFETY-RELATED SAFETY-RELATED POOL REGULATION VALVE WALL CLASS BREAK CLASS BREAK WALL BACKFLOW PREVENTION BACKFLOW PREVENTION FW TRAIN 1 DEVICE DEVICE FW TRAIN 2 FWIV FWIV Flow from faulted FW line and backflow Backflow from FROM CNT TO CNT TO CNT FROM CNT SG CNT SG CNT SG CNT SG CNT from intact intact DHRS Heat DHRS and SG Exchanger and SG Break 01-SG-SG-1001 01-SG-SG-2001 STEAM GENERATOR 1 STEAM GENERATOR 2 01-SG-PSV-1002 01-SG-PSV-2002 DHRS DHRS TRAIN 1 TRAIN 2 Flow from faulted DHRS SG SG DHRS DHRS and SG FROM DHRS FROM DHRS RPV CNV