Text

LLC Response to NRC Request for Additional Information No. 436 (Erai No. 9435) on the NuScale Design Certification Application
	ML18176A256
Person / Time
Site:	NuScale
Issue date:	06/25/2018
From:	Rad Z; NuScale
To:	; Document Control Desk, Office of New Reactors
Shared Package
ML18176A255	List: ML18176A256;
References
	AF-0618-60601, RAIO-0618-60593
	Download: ML18176A256 (20)
	v • d • e

RAIO-0618-60593 June 25, 2018 Docket No.52-048 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738

SUBJECT:

NuScale Power, LLC Response to NRC Request for Additional Information No.

436 (eRAI No. 9435) on the NuScale Design Certification Application

REFERENCE:

U.S. Nuclear Regulatory Commission, "Request for Additional Information No.

436 (eRAI No. 9435)," dated April 25, 2018 The purpose of this letter is to provide the NuScale Power, LLC (NuScale) response to the referenced NRC Request for Additional Information (RAI).

The Enclosures to this letter contain NuScale's response to the following RAI Question from NRC eRAI No. 9435:

13.05.02.01-21 is the proprietary version of the NuScale Response to NRC RAI No. 436 (eRAI No.

9435). NuScale requests that the proprietary version be withheld from public disclosure in accordance with the requirements of 10 CFR § 2.390. The enclosed affidavit (Enclosure 3) supports this request. Enclosure 2 is the nonproprietary version of the NuScale response.

This letter and the enclosed responses make no new regulatory commitments and no revisions to any existing regulatory commitments.

If you have any questions on this response, please contact Steven Mirsky at 240-833-3001 or at smirsky@nuscalepower.com.

Sincerely, Zackary W. Rad Director, Regulatory Affairs NuScale Power, LLC Distribution: Gregory Cranston, NRC, OWFN-8G9A Samuel Lee, NRC, OWFN-8G9A Prosanta Chowdhury NRC, OWFN-8G9A NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

RAIO-0618-60593 : NuScale Response to NRC Request for Additional Information eRAI No. 9435, proprietary : NuScale Response to NRC Request for Additional Information eRAI No. 9435, nonproprietary : Affidavit of Zackary W. Rad, AF-0618-60601 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

RAIO-0618-60593 :

NuScale Response to NRC Request for Additional Information eRAI No. 9435, proprietary NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

RAIO-0618-60593 :

NuScale Response to NRC Request for Additional Information eRAI No. 9435, nonproprietary NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

Response to Request for Additional Information Docket No.52-048 eRAI No.: 9435 Date of RAI Issue: 04/25/2018 NRC Question No.: 13.05.02.01-21 REGULATORY BASIS REQUIREMENTS Title 10 of the Code of Federal Regulations (10 CFR) Section 52.47(a)(8) requires an applicant for a design certification to provide an FSAR (Final Safety Analysis Report) which includes the information necessary to demonstrate compliance with any technically relevant portions of the Three Mile Island requirements set forth in 10 CFR 50.34(f), with certain exceptions. Section 10 CFR 50.34(f)(2)(ii) requires an applicant to "Establish a program, to begin during construction and follow into operation, for integrating and expanding current efforts to improve plant procedures. The scope of the program shall include emergency procedures, ...

TMI Action Plan Item I.C.1, a Post-TMI requirement approved by the Commission for implementation, requires the preparation of emergency procedure technical guidelines for development of the Emergency Operating Procedures (EOPs). Preparation of the technical guidelines is conducted in accordance with NUREG-0737, Clarification of TMI Action Plan Requirements, and NUREG-0737, Supplement 1, Requirements for Emergency Response Capability, which also specify submittal of the technical guidelines to the NRC for review and approval.

Meeting the requirements of TMI Action Plan Item I.C.1 as prescribed in NUREG-0737,Section I.C.1, and Supplement 1 to NUREG-0737, Section 7, is acceptance criteria in SRP 13.5.2.1, Operating and Emergency Operating Procedures. Design-specific Generic Technical Guidelines (GTGs), otherwise referred to as the Emergency Operating Guidelines (EOGs), will be used by COL applicants to develop their Plant-Specific Technical Guidelines (P-STGs), from which their EOPs will be developed, and are the responsibility of the DC applicant.

By letter dated November 30, 2017 (ADAMS Accession No. ML17334B822) NuScale submitted technical report TR-1117-57216, NuScale Generic Technical Guidelines, for docketing.

ISSUE The NuScale GTGs are symptom-based procedural guidelines that allow the operator to respond directly to indications presented as part of an accident progression. Legacy plant NuScale Nonproprietary

generic guidelines include event-based descriptions; i.e., events based on the Transient and Accident Analysis events and associated operator actions described in Chapter 15 of the FSAR for a specific design. Because the NuScale design has no credited manual actions in FSAR Chapter 15, the symptom-based approach allows for mitigating strategies to be effective with multiple failure, regardless of the combination.

Section 4.2, Critical Safety Functions, of the NuScale GTGs states:

The evaluation of symptoms is grouped into critical safety functions. This guidance is developed to maintain critical safety functions for the NuScale design. Evaluation of the NuScale design, in addition to performing a comparison with traditional light water reactor safety functions, was used to determine the appropriate NuScale safety functions. These functions are accomplished by maintaining the following:

Containment Integrity Reactivity Core Heat Removal Additional safety functions are not needed due to the simplicity and reliance on passive systems in the NuScale design.

Section 4.2 also includes a brief discussion of the reasons for why the Secondary Heat Sink critical safety function (CSF) is defined for other PWR designs but not for the NuScale plant design. Section 4.2 does not however, provide any additional discussion, insights, or evaluation regarding the suitability of the RCS Integrity or Inventory CSFs defined for other PWR designs, to the NuScale design, in order to justify their exclusion from the GTGs, other than to state that [t]he Core Heat Removal (CHR) CSF also evaluates RCS Integrity.

Similarly, Chapter 7 does not provide any additional discussion, insights, or evaluation regarding the suitability of the RCS Integrity or Inventory CSFs defined for other PWR designs, to the NuScale design, in order to justify their exclusion from the GTGs, other than to state the following in Section 7.1.1.2.2, Post-Accident Monitoring:

The remove fuel assembly heat critical safety function includes the aspects of reactor coolant system (RCS) integrity. This is due to the integral nature of emergency core cooling system (ECCS) and RCS integrity - actuating ECCS opens valves to allow steam release to the containment and return of water back to the RCS - it is done to maintain core cooling and protect the fuel clad fission product barrier. This is automatically actuated when there is an existing loss of RCS as indicated by low reactor pressure vessel (RPV) riser water level or high containment water level.

Previously approved Emergency Response Guidelines (ERGs) for other PWR designs verified the integrity of the reactor coolant system (RCS) in order to ensure that the pressure -

NuScale Nonproprietary

temperature limits of the RCS are not violated. This verification is not included in the NuScale GTGs.

NRC staff is questioning whether the RCS Integrity needs to be included in the list of NuScale CSFs. Specifically, the staff is questioning whether pressure and temperature changes need to be verified to be within the pressure-temperature limits in the NuScale design. The staff is also questioning whether the Inventory CSF needs to be included in the NuScale GTGs.

INFORMATION NEEDED NRC staff requests that NuScale: (1) either include the RCS Integrity and/or Inventory CSFs in the NuScale GTGs or provide the justification for their exclusion, 2) enhance the discussion in Section 4.2 of the GTGs to include a justification for the exclusion of any CSFs not defined for the NuScale power plant design, beyond stating that Additional safety functions are not needed due to the simplicity and reliance on passive systems in the NuScale design, and (3) make any additional changes to technical report TR-1117-57216 necessary to ensure the completeness and accuracy of the NuScale GTGs (flowchart and bases).

NuScale Response:

As part of FSAR Chapter 18, document RP-0316-17615, "Human Factors Engineering Functional Requirements Analysis and Function Allocation Results Summary Report," lists the plant level functions. The plant functions are provided below for information.

Plant Function NuScale Design Features to Support Plant Function Remove Fuel Assembly Design features used to remove heat from the fuel assemblies via Heat passive convection and conduction.

Maintain Containment Design features used to maintain Containment Integrity to prevent Integrity fission product from escaping the containment boundary.

Maintain Reactor Coolant Pressure Design features used to maintain RCPB Integrity to prevent Boundary (RCPB) fission products from escaping the RCPB.

Integrity Reactivity Control Design features used to maintain reactivity within required limits.

Design features used to control the spread of radioactive Radioactivity Control contamination.

Design features used to identify and communicate plant Emergency Response conditions to internal and external organizations during emergencies.

Design features used to maintain comfortable and safe environmental conditions for personnel habitability by providing Human Habitability adequate air quality, air temperature, humidity, fire and radiation protection, illumination, and sanitary and potable water supplies.

NuScale Nonproprietary

Design features used to protect plant assets from degradation Protection of Plant due to plant environmental conditions or external environmental Assets conditions.

Design features used to protect the physical security of the Plant Security plant.

Design features used to perform startup, normal operations, Power Generation shutdown, and refueling.

These functions were identified by an interdisciplinary team including personnel from human factors engineering (HFE), system engineering, safety analysis and operations organizations.

These are the functions the NuScale design needs to 1) ensure the health and safety of the public by preventing or mitigating the consequences of postulated accidents, and 2) generate electricity.To simplify the event diagnosis during the unusual, complex conditions created by unusual events and accidents, NuScale identified "critical safety functions", a subset of plant functions. Critical safety functions (CSFs) are designed to be the minimum set of functions needed by the operator to verify plant conditions are within safety limits and to facilitate operator action when the safety limits are challenged. The methodology for determining CSFs started with the functions listed in IEEE 497-2002 (as endorsed by Reg Guide 1.97, Revision 4) and NUREG-0711, Revision 3. These safety functions were compared to those considered in the PRA as described in FSAR Section 19.1. The table below compares the source document functions to the NuScale functions.

IEEE 497-2002 and NUREG-0711, NuScale FSAR Chapter 19 NuScale plant safety Figure 4-1 critical safety function function Reactivity control Reactivity control Remove Fuel Assembly Reactor core cooling Heat Maintain Reactor Coolant RCS integrity Pressure Boundary Integrity Primary reactor containment Containment Integrity integrity Radioactive effluent control Radioactivity Control RCS inventory was not addressed because it is an integral part of the reactor core cooling safety function.

RCS integrity and radioactive effluent control are addressed as plant safety functions, but were not identified as safety functions in the PRA. In the NuScale design, the emergency core cooling system (ECCS) provides passive core cooling by retaining primary coolant inside the containment vessel (CNV), which facilitates the transfer of heat from the fuel to the ultimate heat sink.

The NuScale PRA defines success criteria to establish "success" or "failure" in the event tree sequence logic. The success criteria are defined in three progressive stages: overall success NuScale Nonproprietary

criterion, functional success criteria, and system success criteria.

The overall success criterion is prevention of core damage. Core damage is defined as occurring when the fuel peak cladding temperature, as determined by thermal-hydraulic simulation, exceeds 2200 degrees Fahrenheit. Accident sequences are considered successful or "OK" if no core damage occurs during the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> mission time and module conditions are stable or improving.

Functional success criteria are then developed based on the safety functions necessary to support the overall success criterion. The functional success criteria are the minimum set of safety functions whose success is needed to prevent core damage and a large release. The safety functions and method of achieving the functions are summarized in sections 4.2, "Critical Safety Functions," of the NuScale Generic Technical Guidelines, TR-1117-57216.

RCS integrity is addressed under the core heat removal CSF by ensuring that the low temperature overpressure (LTOP) system automatically actuates when required. The LTOP system fully actuates ECCS when pressure is above the temperature dependent pressure setpoint. When ECCS actuates, an intentional hydraulic connection between the RCS and CNV occurs which establishes a natural circulation heat removal path outside of the RCS, but within the containment. A pressurized thermal shock event is not credible at NuScale because of the following factors:

1. All sources of makeup are isolated by the containment isolation system.

2. Actuation of the ECCS system precludes pressurization of the RCS system.

3. The NuScale reactor pressure vessel is designed to withstand the maximum passive system cooldown rate.

The use of the NuScale PRA to identify containment isolation, reactivity, and core heat removal provides a systematic, rigorous methodology for identifying CSFs. It also associates beyond design basis event response to the safety functions providing for the minimum set of criteria operators need to attend to.

A minimum set of CSFs are desired because it simplifies diagnostic activities required of the control room operators during potentially complex, confusing conditions. The Human Factors Engineering Functional Requirements Analysis and Function Allocation Results Summary Report, RP-0316-17615, documents the incorporation of the PRA results into the HFE design.

The HFE evaluation verified the following goals:

1. CSFs as a group should be a straight forward diagnostic tool for the operator.

2. CSFs should account for passive safety systems, no reliance on AC and DC power, and automation.

3. The human actions credited by the NuScale plant PRA should align with the CSFs the human actions are designed to protect.

NuScale Nonproprietary

The Generic Technical Guidelines have been amended to include a summary of the methodology used to identify the CSFs and an explanation of why RCS integrity is not included as a CSF.

Impact on DCA:

Technical Report TR-1117-57216, NuScale Generic Technical Guidelines, has been revised as described in the response above and as shown in the markup provided in this response.

NuScale Nonproprietary

NuScale Generic Technical Guidelines TR-1117-57216-NP Draft Rev. 01 4.0 Procedure Development 4.1 Symptom-Based Procedures The structure of the guidelines is symptom-based. Symptom-based procedures are used to allow the operator to respond directly to the indications presented as part of the accident progression. Symptom-based procedures do not require the operator to attempt to diagnose the accident in progress. Symptom-based procedures allow the operator to respond to an event without knowledge of the initiating event or equipment status. These procedures also allow the operator to respond to unanticipated events, because they evaluate key parameters and direct actions to maintain them within the prescribed limits rather than responding in a predetermined sequence based on a diagnosed accident.

Legacy generic guidelines have included event-based descriptions. These events were based on the transient and accident analysis events and associated operator actions described in those designs Final Safety Analysis Report Chapter 15. Because the NuScale design has no FSAR Chapter 15 manual actions credited, the symptom-based approach allows for mitigating strategies to be effective with multiple failures regardless of the combination.

4.2 Critical Safety Functions The evaluation of symptoms is grouped into critical safety functions. This guidance is developed to maintain critical safety functions for the NuScale plant design. Evaluation of the NuScale design, in addition to performing a comparison with traditional light water reactor safety functions, was used to determine the appropriate NuScale safety functions. These functions are accomplished by maintaining the following, listed in order of priority:

containment integrity

reactivity

core heat removal Additional safety functions are not needed due to the simplicity and reliance on passive systems in the NuScale design. For example, current fleet pressurized-water reactors (PWRs) typically have a critical safety function of maintaining a secondary heat sink.

Heat sink maintenance exists in other PWR designs because its loss can lead to core damage. Timely assessment and recovery or mitigation is critical to preventing core damage and, therefore, a separate critical safety function is warranted. The key difference is that in the NuScale design, loss of secondary heat sink, by itself, does not result in core damage. Mitigation of a complete loss of secondary heat sink has been analyzed as part of PRA and, as such, is a best estimate analysis. This analysis demonstrates that loss of secondary heat sink is mitigated passively with the reactor safety valves and heat removal through containment. The ECCS is also fully capable of removing decay heat in all required operating conditions.

RCS integrity is not a stand-alone safety function and is monitored by the core heat removal safety function since the primary actuation that mitigates a loss of RCS integrity

NuScale Generic Technical Guidelines TR-1117-57216-NP Draft Rev. 01 is the ECCS. When the ECCS actuation valves open, a natural circulation path is created, allowing heat to be removed by the containment vessel to the ultimate heat sink.

((2(a),(c) 4.2.1 Containment Integrity ((

                                             }}2(a),(c)