ML18324A562

U.S. Nuclear Regulatory Commission NuScale Power, LLC; Summary Report of Regulatory Audit of Computer Program Codes as Part of the NuScale Design Control Document

ML18324A562
Person / Time
Site:	NuScale
Issue date:	11/29/2018
From:	Amadiz Marieliz Vera NRC/NRO/DLSE/LB1
To:	Samson Lee NRC/NRO/DLSE/LB1
Vera A M/NRO/5861
References
Download: ML18324A562 (9)

Text

November 29, 2018 MEMORANDUM TO: Samuel S. Lee, Chief Licensing Branch 1 Division of Licensing, Siting, and Environmental Assessment Office of New Reactors FROM: Marieliz Vera, Project Manager /RA/

Licensing Branch 1 Division of Licensing, Siting, and Environmental Assessment Office of New Reactors

SUBJECT:

U.S. NUCLEAR REGULATORY COMMISSION NUSCALE POWER, LLC;

SUMMARY

REPORT OF REGULATORY AUDIT OF COMPUTER PROGRAM CODES AS PART OF THE NUSCALE DESIGN CONTROL DOCUMENT On January 6, 2017, NuScale Power, LLC (NuScale) submitted a design certification (DC) application, for a small modular reactor, to the U.S. Nuclear Regulatory Commission (NRC)

(Agencywide Documents Access and Management System (ADAMS) Accession No. ML17013A229). The NRC staff started its detailed technical review of NuScales DC application on March 15, 2017.

The purpose of the audit was to confirm that the design calculations are consistent with the information provided in NuScale design certification application FSAR Tier 2, Section 3.9.1, Special Topics for Mechanical Components.

The NRC staff conducted this audit by reviewing documents available at the NuScale office in Rockville, Maryland, and online via the NuScale electronic reading room. The audit began on March 20, 2018, and was completed on April 27, 2018. The audit was conducted in accordance with the NRC Office of New Reactors (NRO) Office Instruction NRO-REG-108, Regulatory Audits.

CONTACT: Marieliz Vera, NRO/DLSE 301-415-5861

ML18324A562 *via email NRO-002 OFFICE NRO/ DLSE/LB1: PM NRO/ DLSE/LB1: LA NRO/DEI/MEB: BC NRO/DLSE/LB1: PM NAME MVera MMoore TLupold MVera DATE 11/20/2018 11/20/2018 11/29/2018 11/29/2018 U.S. NUCLEAR REGULATORY COMMISSION NUSCALE POWER, LLC

SUMMARY

REPORT OF REGULATORY AUDIT OF COMPUTER PROGRAM CODES AS PART OF THE NUSCALE DESIGN CONTROL DOCUMENT APPLICANT: NuScale Power, LLC (NuScale)

APPLICANT CONTACT: Marty Bryan, NuScale DURATION: March 20, 2018 - April 27, 2018 LOCATION: NuScale Rockville Office NRC AUDIT TEAM:

Cheng-Ih (John) Wu, Mechanical Engineer, Audit Lead Carl Thurston, Reactor Systems Engineer Omid Tabatabai, Senior Project Manager

1.0 BACKGROUND

On March 23, 2017, the U.S. Nuclear Regulatory Commission (NRC) accepted the design certification application for docketing for the NuScale Standard Plant Design Certification (DC)

Application for a small modular reactor (SMR) design submitted by NuScale Power, LLC (NuScale).

During March 20, 2018 through April 27, 2018, the NRC staff performed a regulatory audit of the computer codes in support of its review of Standard Review Plan (SRP) section 3.9.1, Special Topics for Mechanical Components. An audit plan was developed for the audit (Agencywide Documents and Access Management System Accession No. ML18074A079). The purpose of the audit was to confirm that the design calculations are consistent with the information provided in NuScale design certification application FSAR Tier 2, Section 3.9.1, Special Topics for Mechanical Components. To do this, the NRC staff audited the verification and validation (V&V) packages of the computer programs to confirm conformance with the guidance in SRP 3.9.1. The computer codes used in DCD Tier 2, Chapter 3 analysis for Seismic Category I structures and Association Society of Mechanical Engineers (ASME),Section III Class 1, 2 and 3 components require proper V&V in compliance with Appendix B to Title 10 of the Code of Federal Regulations (CFR), Part 50, Domestic Licensing of Production and Utilization Facilities, and ASME NQA-1-2008 and NQA-1a -2009 requirements. In addition, NRC staff identified a need to audit supporting documents to the response to RAI No. 182-9039, Question 03.09.01-5. Therefore, the NRC staff requested the applicant to provide the supporting documents for staff review during the audit.

2.0 AUDIT RESULTS As indicated in the audit plan, the primary scope of this audit is to review computer programs that are used for static, dynamic, and hydraulic transient analyses as they relate to NuScale 3

components and piping design. The review was to verify that the program performed the safety analysis in accordance with requirements of the ASME Section III Code. The review includes but is not limit to computer programs listed in Tier 2, Section 3.9.1 and all related preprocessors and postprocessors.

NuScale and suppliers are responsible for developing, approving, and issuing procedures, as necessary, to control the use of such computer application and digital equipment software. The NRC staff review finds that each application software and revision thereto is documented and approved by authorized personnel including the author, the program source, dated version, facility, and authors signatures. As such, the computer codes identified in FSAR Tier 2, Section 3.9.1 conform with SRP Acceptance Criteria 3.9.1 (II)(A).

In establishing its design control and verification as described in its Quality Assurance Program NP-TR-1010-859-NP, Revision 3, NuScale performed V&V of safety related computer codes in compliance with NQA-1-2008 and NQA-1a-2009 addenda. Specifically, this includes Requirement 3, Sections 100 through 900, and the standards for computer software in NQA 2008 and NQA-1a-2009 addenda, Part II, Subpart 2.7 and Subpart 2.14 for Quality Assurance requirements for commercial grade items and services.

The verification includes evaluating benchmarking problems in comparison to a result that has been formally reviewed and agreed upon, this serves as the basis for use and further development. NuScale also used the regression testing method to select retesting to detect errors introduce during the modification of the previous version of the computer program or by running the benchmarking problems to verify the modified computer program still meets its specified requirement.

The NRC staff reviewed NuScale documents SwTR-0304-14964, Revision 3, ANSYS Test Report. The software test report is to document the software testing of ANSYS Version 17.1 on the NuScale Corvallis Computing Cluster Linux System (CCCL 1). The test report summarizes the testing of ANSYS version 17.1 with the test cases from the Version 17.0 Testing Package.

The NuScale document CP-0303-16897, Revision 2, Software Acceptance Testing, provides acceptance criteria of software testing in accordance with ASME NQA-1-2008, and NQA-1a-2009 requirements.

ANSYS runs tens of thousands of test cases to test the code at each release. A subset of those tests is defined and run for final acceptance/production testing on each supported operating system. Many of those final acceptance tests are included in the ANSYS verification Testing Package. The verification testing packages are used to verify that the ANSYS programs are running properly on the production computer and operating system.

Tables 2-1 through 2.3 of the test report summarize results for each of the workbench test sets cases. Resulting errors and abnormalities are described in Section 3, Disposition of Test Errors. The failed ANSYS, version 17.1, mechanical workbench cases are summarized in Table 3-2. It shows that all failures are minor including differences in near zero numbers. There is no ANSYS Version 17.1 computational fluid dynamics (CFD) cases failed. The NRC staff reviewed the test report and finds that based on successfully passing and dispositioning the verification test cases, there are a few errors and failed cases, most of which were due to very minor differences in results, or errors in the test setup but not related to the computer program.

In accordance with NuScale procedure CP-0303-16897, Software Acceptance Testing, the V&V for currently used ANSYS Version 17.1 is adequate for use in SIL 2 and 3 software for analysis and design of safety related components.

4

The NRC staff reviewed NuScale documents SwTR-0304-49501, Revision 0, AutoPIPE Software Test Report. The test report was done to validate that AutoPIPE computer program, Revision 0 is ready for use of AutoPIPE V8i CONNECT Nuclear Edition, Version 10.01.00.09, referred to as AutoPIPE, which is commercial-off-the shelf software purchased from Bentley Systems, Inc. (Bentley AutoPIPE).

AutoPIPE is classified as a Software Integrity Level (SIL) 3 program by NuScale for use of safety related SSCs. The scope of this testing is to demonstrate that the computer program adequately and correctly performs its function and is ready for use in a configuration-controlled environment for SIL 3 components. Bentley is on the NuScale evaluated supplier list (ESL) and verification testing for AutoPIPE is performed under the Bentley quality assurance (QA) program. As such, the acceptance test set (ATS) provided by Bentley is used to performed this AutoPIPE V&V testing. The results produced by AutoPIPE are considered acceptable if matching baseline values are within 2.0 percent.

During the software testing, the base method and the automated method were performed. The base method involves manually executing the program for many different input files and then manually comparing the testing results to the approved results. Because this method is time consuming, the automated method is preferred. The automated (batch) method is performed using the "automated system processing" feature in AutoPIPE to automatically execute the test cases, create an output file for each test system, and compare the file to the corresponding previously-verified output file.

Based on Table 3-1 of the test report, all testing was performed successfully with no deviations.

All required tests passed and no software deficiencies were discovered during the testing. The results of this testing provide validation that AutoPIPE is ready for use as a pre-verified configuration-controlled software for safety-related calculations upon issuance of a software release note. Detailed results of the testing are discussed in Section 3.0 of the test report.

Appendix G of the report documents testing verification by an Independent checker where no errors were recorded. The appendix also documented and discussed some warning messages in Table G-2, such as "calculated stress(es) exceed allowable stress(es)." The warning message was verified to be a legitimate warning based on the inputs used in the sample problem, and therefore supported the V&V since the results matched the reference data as discussed for disposition in the table. NuScale found that all results of the tests matched the expected results provided previously in the reference data. Therefore, the NRC staff concludes that the software V&V of AutoPIPE computer program were successfully completed in accordance with NuScale document CP-0303-16897, and is acceptable.

The EMDAC is a finite element analysis code produced by Curtiss-Wright Electro-Mechanical Division, and is used for the seismic structural analysis of the control rod drive mechanisms (CRDM). The Simulink computer program is used to simulate the operating dynamics of the CRDM. For V&V review, NuScale provided its audit report, A2-0217-52885, which was conduct by NuScale in 2017. The purpose of this audit was to perform the triennial requalification audit of Curtiss-Wright EMD to assess the adequacy and effective implementation of the Curtiss-Wright EMD QA program in accordance with 10 CFR Part 50, Appendix B. and NQA-I-2008/a2009. The scope of the audit included the assessment of Curtiss Wright - EMD acceptability as a supplier of safety related design services to support CRDM design through implementation of Curtiss Wright - EMD Quality Assurance Program Manual Edition 1, Revision 2.

5

In addition, the review also included interviewing an EMDAC- Finite Element Analysis (FEA) software user and analysis managers, plus software engineer responsible for the EMDAC-FEA configuration control and development (including a recent revision due to the software user's reported errors). A list of six questions (Technical Specialist Worksheet) was sent to the contractor prior to this audit attendance as included in Appendix A of the audit report A2-0217-52885. Supporting procedures, technical presentations and documentation that had not been transmitted to NuScale were reviewed during the NuScale audit.

As a results of its review, the NuScale audit team concluded that the auditor questions documented in the Technical Specialist Worksheet Appendix A of audit report A2-0217-52885 were responded to satisfactorily, with the exception of the identification and documentation of the design verification for the CRDM. The NRC staff reviewed the audit report that identified the issue for the CRDM, which was regarding documentation of the design method, and determined it was not V&V related issue with the computer programs, and therefore concludes that the specific computer programs EMDAC-FEA and Simulink meet the V&V requirements in accordance with 10 CFR Part 50, Appendix B, and NQA-I-2008/a2009 and the computer codes are acceptable for use in the design of CRDM.

The staff reviewed document, ER-F010-6084, Revision 0, Computer Program Verification and Validation Summary Report, for the computer codes used by the NuScale contractor such as ANSYS, RspMatch2009, SAP2000, SASSI2010, and SHAKE2000. This document provides a summary of the V&V of the computer programs used in the analysis and design of the NuScale Category I and Category II structures. The report provides the program description, capabilities and limitations for each of these computer programs, used by the NuScale contractor, ARES Corporation. Section 3.0 of this report provides and describes the verification benchmarking problems for each of computer codes. The results of the V&V are stated in Section 4.0 of this report as they are documented in its Commercial Grade Software Evaluation Reports (CGSER).

NuScale was asked to provide the CGSER that contain the V&V results. Because the documents were proprietary to the supplier, ARES Corporation, NuScale was not able to make them available to NRC staff. As such, the NRC staff is unable to validate the results.

As a follow-up, the validation was completed via a vendor inspection, which was conducted from October 5, 2018 to October 10, 2018 in the ARES Corporation office at Walnut Creek, California. The results for verification benchmark problems for each of the computer codes, ANSYS, SAP2000, SASSI2010, and SHAKE2000 were validated as indicated in the Inspection Report No. 05200048/2018-201. Therefore, the issue is resolved and closed.

Relative to audit plan Item No. 6, which is a follow-up to RAI No. 9039, Question 03-09-01-5, requesting to identify the computer code that was used for the design of ASME Class 1 components at NuScale plants, NuScale provided, EAF Methodology.pdf, file in ERR for Environment Assisted Fatigue Calculation Methodology, which is a portion of document EC-A010-2771. For calculating Cumulative Fatigue Usage Factor (CUF) and Factor for Environment Assisted Effects (Fen), the applicant did not have a computer code or an example of a hand calculation available for NRC staff review. It was determined that this issue will be evaluated in the review of Section 3-12, ASME Code Class 1, 2, and 3 Piping Systems, Piping Components and Associated Supports, and Section 3.9.3, ASME Code Class 1, 2, and 3 Components, Component Supports, and Core Support Structures.

As indicated in the audit plan Item No. 7, the NRC staff reviewed RELAP5 documents that support technical report TR-1016-51669-P as it relates to the blowdown loads for Chapter 3 structural analysis. NuScale uses the base version (Beta Version 0.0) of NRELAP5 code, which 6

is taken directly from the Idaho National Laboratory (INL) RELAP5-3D Version 4.1.3 for analysis of dynamic mechanical loads from breaches in high energy line piping inside and outside of containment. The version used is NRELAP5 Version 0.0 and validation was performed as a part of the commercial grade dedication in compliance with 10 CFR 50, Appendix B. The validations for NRELAP5 Version 1.3, used for the Chapter 15 analysis, do not apply to this version. The methodology used here is detailed in NuScale Power Module Short-Term Transient Analysis, TR-1016-51669-P. This work supports FSAR section 3.9.1.2, Computer Programs Used in Analyses.

RELAP5-3D is developed from the one-dimensional RELAP5/MOD3 reactor systems code that is used widely in industry for thermal-hydraulic and safety analysis applications. RELAP5 is a transient, two-fluid model code for flow of two-phase vapor/gas-liquid mixtures that can allow users to accurately model the multi-dimensional flow behavior that can be expected in any component of pressurized water reactor systems. Typically, the code is used for chapter 15 accident simulations, however, the code models are generally applicable to all plant system behaviors, and are not restricted to use in safety analysis. The RELAP5 components can define specific volumes and the junctions connecting them to simulate local dynamic behavior. To provide validation of the code results, the applicant has performed benchmarks for several model tests, including the Marviken jet impingement tests in accordance with the NRC staffs recommendations in NUREG-0609, Asymmetric Blowdown Loads on PWR Primary Systems, Resolution of Generic Task Action Plan A-2. The methodology referenced relies on very conservative boundary and initial condition input assumptions, including not crediting the emergency core cooling system (ECCS) valves inadvertent actuation block (IAB) feature. The methodology uses simplified RELAP5 models of the reactor coolant system (RCS) for simulating the breaches where break flow is subcooled, saturated liquid or saturated steam.

The NRC staff found the applicant, in general, used very conservative assumptions for initial conditions, namely reactor pressure vessel (RPV) pressurizer pressure at 2100 psia, in comparison to nominal pressure plus instrument uncertainty at 1920 psia (1850 + 70). Likewise for secondary initial pressure, the applicant used very conservative assumptions, e.g., steam header pressure at 800 psia, in comparison to nominal pressure plus instrument uncertainty at 535 psia (500 + 35). These assumptions are expected to produce very conservative hydraulic blowdown loads for input to the ANSYS code. Also the NRC staff found that conservative sizes were used for pipe break and inadvertent ECCS valve seat areas.

It is noted that during the audit, staff discussed with NuScale that for the FW pipe load calculation in EC-A030-2840, a 4 inch pipe was analyzed, however the design of the FW pipe was later changed to 5 inch, as documented in engineering change request ECR-A010-53448.

An engineering change order was attached to calculation EC-A030-2840 to ensure that when this calculation is revised, the current design 5 inch FW pipe size will be analyzed. This design change does not affect the V&V for the RELAP5 computer code as verified.

3.0 DOCUMENTS REVIEWED

1. NuScale Power, LLC, NuScale Topical Report: Quality Assurance Program

2. Description for the NuScale Power Plant, NP-TR-1010-859-NP, Revision 3

3. SW-0614-7401 Rev1.pdf, software purchases

4. SwCI-0304-10009 Rev2.pdf, ANSYS software configuration Index 7

5. SwRN-0304-12868 Rev2.pdf, ANSYS software Release note

6. SwTP-0304-12476 Rev0.pdf, ANSYS test plan

7. SwTR-0304-14964 Rev3.pdf, ANSYS test report

8. SW-0116-20728 Rev0.pdf, Purcurement of Benetley AutoPIPE, Revion 0

9. SwCI-0304-21338 Rev0.pdf, Benetley AutoPIPE Software Configuration Index

10. SwRN-0304-49115 Rev0.pdf, Benetley AutoPIPE Software Release Note, Rev 0

11. SwTP-0304-49499 Rev0.pdf, AutoPIPE Software Test Plan, Rerv 0

12. SwTR-0304-49501 Rev0.pdf, Report, Rerv 0, 9/29/16 JJArthur (NS)

13. SwTS-0304-50275 Rev0.pdf, AutoPIPE Acceptance Test Set Documentation

14. A2-0217-52885.pdf, Supplier Audit Report

15. Item 6 EAF Methodogy.pdf,

16. EC-A013-3031 Rev1.pdf, Reactor Module Asymmetric Cavity Pressurization and Blowdown

17. EC-A030-2353 Rev0.pdf, High Energy Line break Benchmark Analysis

18. EC-A030-2360 Rev0.pdf, Subcooled High Energy Line Break Boundary Conditions

19. EC-A030-2407 Rev1.pdf, Saturated High Energy Line break Boundary Conditions for Dynamic Analysis

20. EC-A030-2840 Rev0.pdf, Main Steam and Feedwater line Break Boundarys for Dynamic Analysis

21. ECN-A013-4932 Rev0.pdf, RXM blowdown calculation results corrections

22. ECN-A030-5041 Rev0.pdf, DHRS Postulated Pipe Break Location, Table2-2 Updates

23. ECN-A030-5042 Rev0.pdf, HDR Input parameters and Bettis Hydraulic Pressure Pulse

24. ER-A010-3616 Rev1.pdf, RXM Blowdown Loading Specification

25. ER-A030-2223 Rev1.pdf, High Energy Line Break Blowdown Methodology

26. ES-0303-4836 Rev0.pdf, Piping Analysis Standard

27. SwRN-0304-51578.pdf, NRELAP5 Version 1.3 Software Release Notes

28. SwVVR-0304-15277.pdf, NRELAP5 V1.3 Software Validation Report

29. SwUM-0304-17023_Rev 4.pdf, NRELAP5 Version 1.3 Theory Manual (12/13/16) 8

30. NuScale Contractor/Suppliers Document: Computer Program Verification And Validation Summary Report, Report No. 057805 11 022-006, Revision 1 January 2018

31. ER-F010-6084 Rev0.pdf, Special Topics Audit for RspMatch2009, SAP2000, SASSI2010, SHAKE2000 as it relates NuScale Conferential, Proprietary Class 2 and safety class A1

32. Nuclear Power Plants Topical Report, NP-TR-1010-859-NP, QAPD, Revision 3, TAC No. RN6110, dated September 22, 2016 (ML16196A123).

33. EC-A013-3031 Rev1 with ECN.pdf, RXM blowdown calculation results corrections

34. EC-A030-2353 Rev0 with ECN.pdf, HDR input parameters and Bettis Hydraulic Pressure Pulse Modeling Discussion Updates

35. EC-A030-2360 Rev0.pdf, High Energy Line Break Boundary Conditions for Dynamics

36. EC-A030-2407 Rev1.pdf, Saturated High Energy Line Break Boundary Conditions For Dynamics

37. EC-A030-2840 Rev0.pdf, Main Steam and Feedwater Line Break Boundary Conditions for Dynamics

38. ER-A010-3616 Rev1.pdf, RXM blowdown Loading Specification

39. ER-A030-2223 Rev1 with ECN.pdf, DHRS Postulated Pipe Break Locations, Table 2-2 Updates

40. ES-0303-4836 Rev0.pdf, Piping Analysis Standard

41. CD-0714-7873_R1 Commercial Grade Dedication Report.pdf, RELAPS-3D Final commercial Grade Dedication Report Revision 1

42. CP-0303-16897_R2 Software Acceptance Testing.pdf, Software Acceptance Testing

43. CP-0803-7437 _R3 Software Configuration Management.pdf, Software Configuration Management

44. NCI-0914-8623, Name Change to NRELAP5.

45. CD-0714-7873 RELAP5-3D Final Commercial Grade Dedication Report, Rev 1.

46. Supplement information (sections 3.5.3 to 3.5.5 and Fig. 5-8 of EC-010-2771) as mentioned in Section 3.5.3 Fatigue methodology previously provided to the staff.

9

U.S. NUCLEAR REGULATORY COMMISSION NUSCALE POWER, LLC

SUMMARY

REPORT OF REGULATORY AUDIT OF COMPUTER PROGRAM CODES AS PART OF THE NUSCALE DESIGN CONTROL DOCUMENT LIST OF ATTENDEES March 20, 2018 to April 27, 2018 NRC Staff

Participants:

Cheng-Ih (John) Wu, Mechanical Engineer Carl Thurston, Reactor Systems Engineer Omid Tabatabai, Senior Project Manager NuScale (and other support organization)

Participants:

J.J. Arthur Brian Wolf Hannah Rooks Wayne Massie Marty Bryan 10