ML19057A618

LLC Supplemental Response to NRC Request for Additional Information No. 260 (Erai No. 9108) on the NuScale Design Certification Application

ML19057A618
Person / Time
Site:	NuScale
Issue date:	02/26/2019
From:	Rad Z NuScale
To:	Document Control Desk, Office of New Reactors
References
RAIO-0219-64684
Download: ML19057A618 (27)

Text

RAIO-0219-64684 February 26, 2019 Docket No.52-048 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738

SUBJECT:

NuScale Power, LLC Supplemental Response to NRC Request for Additional Information No. 260 (eRAI No. 9108) on the NuScale Design Certification Application

REFERENCES:

1. U.S. Nuclear Regulatory Commission, "Request for Additional Information No. 260 (eRAI No. 9108)," dated October 13, 2017

2. NuScale Power, LLC Response to NRC "Request for Additional Information No. 260 (eRAI No.9108)," dated November 27, 2017 The purpose of this letter is to provide the NuScale Power, LLC (NuScale) supplemental response to the referenced NRC Request for Additional Information (RAI).

The Enclosure to this letter contains NuScale's supplemental response to the following RAI Question from NRC eRAI No. 9108:

19-34 This letter and the enclosed response make no new regulatory commitments and no revisions to any existing regulatory commitments.

If you have any questions on this response, please contact Paul Infanger at 541-452-7351 or at pinfanger@nuscalepower.com.

Sincerely, Zackary W. Rad Director, Regulatory Affairs NuScale Power, LLC Distribution: Gregory Cranston, NRC, OWFN-8H12 Samuel Lee, NRC, OWFN-8H12 Rani Franovich, NRC, OWFN-8H12 : NuScale Supplemental Response to NRC Request for Additional Information eRAI No. 9108 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

RAIO-0219-64684 :

NuScale Supplemental Response to NRC Request for Additional Information eRAI No. 9108 NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvalis, Oregon 97330, Office: 541.360.0500, Fax: 541.207.3928 www.nuscalepower.com

Response to Request for Additional Information Docket No.52-048 eRAI No.: 9108 Date of RAI Issue: 10/13/2017 NRC Question No.: 19-34 Regulatory Basis 10 CFR 52.47(a)(27) states that a Design Certification (DC) application must contain a Final Safety Analysis Report (FSAR) that includes a description of the design-specific Probabilistic Risk Assessment (PRA) and its results. 10 CFR 52.47(a)(23) states that a DC application for light-water reactor (LWR) designs must contain an FSAR that includes a description and analysis of design features for the prevention and mitigation of severe accidents (e.g.,

challenges to containment integrity caused by core-concrete interaction, steam explosion, high-pressure melt ejection, hydrogen combustion, and containment bypass).

Regulatory 1.200, Revision 2, "An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities" provides the NRC standards for performing PRA. Table 3, "Summary of Technical Characteristics and Attributes of a Level 2 PRA for Internal Events," of the regulatory guide states that the PRA should include an assessment of the credible severe accident phenomena via a structured process.

The Commissions 1995 PRA Policy Statement states that treatment of uncertainty is an important issue and notes that uncertainties are due to knowledge limitations. The Policy Statement notes that a probabilistic approach has exposed some of these limitations and has provided a framework to assess their significance and assist in developing a strategy to accommodate them in the regulatory process. NUREG-1855 provides guidance on how to treat uncertainties associated with PRAs.

Standard Review Plan 19.0, Revision 3, guidance is to compare the PRA results against a probabilistic goals that (1) the conditional containment failure probability be less than 0.1 for the NuScale Nonproprietary

composite of all core damage sequences assessed in the PRA and (2) the large release frequency be less than 1x10-6 per year.

Request for Additional Information The staff reviewed the applicants Level 2 analysis in FSAR Chapter 19, ER-P020-7024-Revision 0, Level 2 PRA Notebook, and ER-P020-5092, Revision 0, Assessment of Low Risk Severe Accident Phenomena for the NuScale Level 2 PRA. As described in these documents, the applicant screened out the following severe accident challenges to containment (i.e.,

assigned them a probability of zero in the Containment Event Tree (CET)): high pressure melt ejection, failure of the reactor pressure vessel and containment vessel (CNV) bottom heads by contact with corium, steam explosion, and hydrogen combustion. Assigning these severe accident phenomena a probability of zero can reduce the conditional containment failure probability as well as the large release frequency. The applicant is requested to provide a summary in FSAR Chapter 19 that describes the approach used to quantitatively screen these severe accident phenomena from the CET. This information is needed for the staff to find that the design meets the probabilistic goals.

The applicant also is requested to reconcile apparent inconsistencies with the Level 2 PRA and update the Level 2 notebook, the CET, and the FSAR as appropriate:

The hydrogen combustion analysis assumes the containment has an initial air pressure of 0.1 psia. However, FSAR Table 7.1-4, "Engineering Safety Feature Actuation System Functions", states that the Containment System Isolation (CSI) High Narrow Range Containment Pressure is not actuated until containment pressure reaches 9.5 psia.

FSAR Table 7.1-4 suggests that the containment could have an initial air pressure as high as 9.5 psia. Also, FSAR Section 9.3.6 states that the containment evacuation system (CES) is used to establish and maintain a vacuum in the containment vessel during operation by removing non-condensable gases from the containment vessel.

However, the FSAR does not specify criteria for operating the CES or provide a technical specification that would limit containment vessel pressure. Please explain or clarify these apparent inconsistencies.

For chemical and volume control system (CVCS) over-pressurization, the applicant has provided text in ER-P020-7024-R0 stating why this over-pressure condition cannot result in containment failure. The applicant assumed the likelihood that the operator continuously operates CVCS (which would result in over-pressurization of the reactor pressure vessel and the CNV) is small enough to be excluded from the CET. The staff is requesting an analysis of the sequence of events for a postulated CVCS over-NuScale Nonproprietary

pressurization to justify that the likelihood of operator error is low. This analysis should include as applicable, instrumentation, alarms, and required time that the operator needs to terminate CVCS injection.

NuScale Response:

As a result of public discussions held with the NRC on November 13, 2018, January 8, 2019, and January 29, 2019, NuScale is supplementing its response to RAI 9108 (Question 19-34),

originally provided in letter RAIO-1117-57346, dated November 27, 2017. In those discussions, NuScale agreed to modify the FSAR by replacing the term physically unrealistic and similar terminology to more directly reflect insights from NuScale phenomenological analyses and to clarify the presence of analysis uncertainty. Accordingly, this response removes the FSAR Section 19.1.4.2.1.2 discussion of the CET quantitative screening criterion. This supplement also modifies the definition of conditional containment failure probability to directly incorporate the large release frequency, which reflects the insight that even if the CNV were to fail due to severe accident phenomena, a large release would not result; however, as stated in the FSAR, NuScale's thermal-hydraulic analyses indicate that CNV failure does not result from postulated severe accident phenomena. This supplement clarifies that if there were a postulated CNV failure due to a severe accident, a potential release would be scrubbed by pool water and/or there would be sufficient fission product deposition by the time of CNV failure to prevent a large release. Other information provided in the original RAI response remains valid. (Note that this supplemental response is accompanied by related FSAR revisions associated with supplemental NuScale responses to RAI 9043 (Question 19-26), RAI 9112 (Question 19-29),

and RAI 9138 (Question 19-33)).

Impact on DCA:

FSAR Sections 19.1 and 19.2 have been revised as described in the response above and as shown in the markup provided in this response.

NuScale Nonproprietary

NuScale Final Safety Analysis Report Probabilistic Risk Assessment 19.1.4.2.1.2 Containment Event Tree RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 In the NuScale PRA, the CET is directly linked to the end state of the Level-1 event trees. Therefore, there is no development of plant damage states (PDS) to group sequences by similar characteristics. Instead, each core damage accident sequence that is not a success is directly linked to the CET by the transfer event LEVEL2-ET. As such, each core damage accident sequence is directly linked and propagated through the CET. As summarized below, most containment failure modes typically considered in Level 2 PRA analyses are physically unrealisticdemonstrated by analyses discussed in Section 19.2 not to challenge containment integrity in the NuScale design. As such, all Level 1 sequences that are classified as core damage (i.e., whose end state is not "OK") transfer to a single CET initiating event, Level2-ET, as illustrated in Figure 19.1-15.

Severe Accident Processes and Phenomena Potential severe accident phenomena are evaluated to determine their applicability to the NuScale design. The evaluation considers phenomena listed in Section 19.0 of the Standard Review Plan, the ASME/ANS PRA Standard, NUREG/CR-2300 (Reference 19.1-38) and NUREG/CR-6595 (Reference 19.1-39).

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34, RAI 19-34S1 The characteristics of the NuScale design provide an inherent degree of safety.

As a result, severe accident phenomena that may challenge containment in currently operating plants are shown by analyses summarized in Section 19.2 to not challenge containment integrity in a postulated NuScale severe accident.be physically unrealistic in the NuScale design. These phenomena are not included in the CET consistent with the approach taken in NUREG-1524 (Reference 19.1-64) in which phenomena that are judged to be physically unreasonable", "vanishingly small", or very unlikely have a probability of less than 1 E-3. Because this probability is small with respect to the LRF and the conditional containment failure probability (CCFP) safety goal of less than 0.1, such events are not explicitly included in the CET.

Thus, containment failure due to bypass or containment isolation valve failure is the only mode of containment failure depicted in the CET. The following severe accident processes were considered and are discussed in detail in Section 19.2, as indicated:

• Retention of core debris in RPV, external RPV cooling (Section 19.2.3.2.1 and Section 19.2.3.3.1)

• Retention of core debris in CNV (Section 19.2.3.2.2)

• Hydrogen deflagration and detonation (Section 19.2.3.3.2)

• High pressure RPV failure and associated phenomena (Section 19.2.3.3.4)

• Fuel coolant interaction and steam explosion (Section 19.2.3.3.5)

• Molten core-concrete interaction (Section 19.2.3.3.3)

Tier 2 19.1-44 Draft Revision 3

NuScale Final Safety Analysis Report Probabilistic Risk Assessment location of the core. Severe accident containment challenges are evaluated in the NuScale PRA and dispositioned either deterministically or modeled probabilistically:

• Hydrogen combustion within the containment is not a hazard to CNV integrity because power operation occurs with the CNV effectively evacuated; hence there is very little oxygen available to mix with generated hydrogen and produce a combustible mixture. The possibility of combustible gas mixtures is further reduced under severe accident conditions when the containment would be inerted with steam. Even in idealized hypothetical combustion scenarios, the minimal oxygen inventory limits the energetics such that the CNV is not at risk.

• Containment overpressurization due to generation of non-condensable gases cannot occur because there is no concrete within the containment with which molten-core debris could interact to produce non-condensable gases. The CNV is not susceptible to overpressurization from steam generation because of the passive heat removal through the CNV wall. The CNV is partially immersed in the reactor pool (i.e., the UHS). The passive heat removal capability is not only greater than decay heat levels, but also greater than the expected power levels following a failure to scram, thus protecting CNV from being pressurized beyond its failure pressure.

• Molten core-concrete interaction is not a challenge to the CNV because there is not a concrete basemat within the CNV. The potential challenge of core debris in contact with the steel CNV shell has been evaluated.

• Primary coolant system overpressure failure would occur only if both safety-related RSVs failed to open during a transient with loss of heat removal through the steam generators (i.e., failure of both normal feedwater and of the DHRS). This extremely improbable scenario was addressed using a finite element structural analysis and shown to result in a slow-progressing asymmetrical flange separation on the pressurizer. Thermal-hydraulic simulations show that the resultant induced-LOCA does not pressurize the CNV beyond its ultimate failure pressure, and is therefore not considered a large release unless concurrent with failure of containment isolation. Furthermore, the induced-LOCA behaves like other severe accidents in that the RPV-CNV pressure differential decreases before core damage occurs, eliminating risk of a high-pressure severe accident and the associated containment challenges such as HPME and direct containment heating.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1

• TheAnalysis of the potential for in-vessel steam explosions has been investigated and found to be not physically realisticindicates that postulated steam explosions do not challenge the RPV. The design and materials of the core support structure are such that they are predicted to fail and relocate the core into the lower RPV head before temperatures in the core reach the fuel melting point. In addition, there would be only a small amount of water in the lower vessel head with which the core debris could interact. Finally, even if a slug of water were generated and struck the upper regions of the RPV, the potential for that to generate a missile sufficiently energetic to damage the CNV is not physically realistic.

Tier 2 19.1-53 Draft Revision 3

NuScale Final Safety Analysis Report Probabilistic Risk Assessment RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1

• Although not physically realisticanalysis indicates that, ex-vessel containment challenges associated with sequences in which the core penetrates the RPV and enters the CNV do not occur, these events areis considered from a defense-in-depth perspective. Such ex-vessel challenges would include HPME, ex-vessel steam explosion, and contact of core debris with the CNV lower head.

The combination of successful containment isolation (which ensures primary coolant remains within the containment even under severe accident conditions) plus passive heat removal (from the RPV to the CNV and CNV to the UHS) ensures that core debris remains within the RPV and effectively precludes the potential for each of the postulated ex-vessel severe accident challenges.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Assessments of severe accident phenomena predict no CNV failure. However, even if the CNV were postulated to fail, there would not be a large release to the environment.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 While derived considering internal initiating events, thesethe above insights are also generally applicable for internal floods, internal fires and external events. The passive heat removal phenomenon discussed above is dependent on only physical plant conditions and functions regardless of whether the scenario was caused by an internal initiating event or if an external event has occurred. The CNTS is protected from external events through the design of the system as well as protection provided by the structures in which it located. Therefore, the general insights summarized above are equally applicable to external events as well as internal events.

Table 19.1-32 summarizes these insights.

19.1.4.3 Level 3 Internal Events Probabilistic Risk Assessment for Operations at Power The PRA Level 3 analysis is used to evaluate offsite consequences at a potential site. A Level 3 analysis has not been performed for design certification.

19.1.5 Safety Insights from the External Events Probabilistic Risk Assessment for Operations at Power The external event hazards that may affect the NuScale risk profile are identified based on past studies and in a manner consistent with the requirements of ASME/ANS RA-Sa-2009.

Once the hazards are identified for consideration, the guidance in ASME/ANS RA-Sa-2009 is used to implement a progressive screening process to identify which external events could be screened from detailed evaluation and those that required a quantitative hazard evaluation. The screening criteria are presented in Table 19.1-33. The table provides preliminary and bounding screening criteria using the approach discussed in Part 6 of ASME/ANS RA-Sa-2009.

Tier 2 19.1-54 Draft Revision 3

Tier 2 NuScale Final Safety Analysis Report RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Table 19.1-2: Design Features/Operational Strategies to Reduce Risk Design Feature Description Effect on Risk Primary cooling by NuScale design incorporates natural circulation

• Absence of reactor coolant pumps means no threat of reactor coolant pump seal failures.

natural circulation cooling during almost all modes of operation (during

• No dependence of electric power or seal cooling water for primary coolant circulation and startup circulation of the primary cooling is enhanced hence less likelihood of a reactor trip due to forced flow transients.

by using CVCS pumps).

• Contributes to robust plant response during potential ATWS condition. Flow and hence heat transfer and reactivity control, is effectively self-regulated by the natural forces controlling flow through core.

Integrated primary All components of the primary cooling system are

• No external reactor cooling system pipe results in less likelihood of a LOCA.

cooling system contained inside the RPV. This includes the

• Steam generator tubes that are in compression (i.e., feedwater is on the inside and coolant design pressurizer, steam generators, and the entire primary circulates on the outside).

system cooling loop.

Internal (to RPV) Helical coil steam generator (SG) tubes wrap-around

• With primary, high-pressure coolant on outside of the SG tubes and the lower-pressure helical-coil steam central riser inside the RPV. Primary coolant flows on feedwater flow on the inside, the tubes are maintained in a constant state of compression. This generator (SG) outside of the tubes, with secondary, feedwater on is in contrast to the typical tensile stresses on the SG tubes in conventional plants. Maintaining inside. the tubes in compression is expected to prevent crack propagation and reduce the likelihood of SG tube failure.

19.1-132 Passive, fail-safe ECCS consists of 5 valves that fail-safe on a loss of

• No dependence on support systems (i.e., AC or DC power, or service water) or operator action ECCS power. Heat is transferred directly to the UHS by for heat transfer to the UHS.

passive natural processes (i.e., condensation, natural

• ECCS is effective in maintaining core cooling for possible LOCA sizes.

circulation, convection and conduction)

• No reliance on external sources of inventory addition to the RPV.

Passive fail-safe Passive, natural circulation, closed-loop isolation

• No electric power needed to remove heat from the secondary side of the SGs.

DHRS condenser removes heat from the secondary side of

• Closed-loop system does not need additional inventory.

the SGs.

• Passive, electric-power independent plant response to unplanned reactor trip.

Small reactor core Reactor core in each module is about five percent the

• Small reactor core is easier to keep cool under both normal and abnormal conditions. (Cycling size of a typical large PWR core. of just one of the two passive reactor safety valves is sufficient to maintain core cooling without DHRS or ECCS operation.)

• Each core, in a plant of up to 12-modules, is contained in a separate RPV, which in turn is Probabilistic Risk Assessment contained in a separate CNV. The distribution of the total plant core material, combined with the small size of each core, enhances the ability to cool the core passively.

• Small reactor core results in relatively low heat load on RPV lower head in the unlikely event a severe accident results in core relocation to the lower head; in this configuration, analysis Draft Revision 3 indicates that RPV failure does not occur.; as a result, RPV failure is physically unrealistic.

No RPV penetrations The RPV does not have penetrations below the

• No penetrations in the lower portion of the RPV means there is not a credible mechanism for below top of core refueling flange. draining the RPV and uncovering the core.

NuScale Final Safety Analysis Report Probabilistic Risk Assessment RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Table 19.1-32: Key Insights from Level 2 Evaluation Insight Comment Containment The primary purpose of CNTS is to retain primary If coolant remains primarily within the RPV, then the core Isolation coolant inventory within the CNV. With primary is covered. If the core is not covered in the RPV then coolant inventory maintained in the RPV or CNV, sufficient primary coolant is in the CNV to submerge the cooling of core debris is ensured. outside of the lower RPV and establish conductive heat removal from the core debris to the coolant in the CNV through the RPV wall.

CNTS terminates releases through penetrations Containment penetrations through which releases are leading outside containment. assumed to occur that dominate risk include those that bypass containment such as CVCS (injection and discharge) and paths through the steam generator tubes (main steam and feedwater piping). Isolation of normally open valves in these penetrations prevents releases from bypassing containment.

Passive Heat The RPV has no insulating material and passive heat Retaining primary coolant in the containment results in Removal removal capability from the RPV to the CNV is collection of sufficient RCS water in the CNV to allow heat sufficient to prevent core debris from penetrating transfer through RPV to CNV and ultimately UHS to the reactor vessel. remove heat generated in the fuel regardless of its The CNV is uninsulated and passive heat removal location.

capability from the CNV to the UHS is sufficient to prevent the containment from pressurizing and or core debris from penetrating the containment Tier 2 19.1-189 Draft Revision 3

NuScale Final Safety Analysis Report Probabilistic Risk Assessment Table 19.1-32: Key Insights from Level 2 Evaluation (Continued)

Insight Comment Severe Primary coolant system overpressure failure cannot Addition of water to the containment from external Accident lead to overpressurization of containment (i.e., loss sources (CFDS) results in submergence of the reactor Containment of decay heat removal through the steam vessel and establishes passive heat removal through the Challenges generators plus failure of the RSVs to open). containment wall to the reactor pool. Even if containment flooding is not successful, the RPV failure mode is such that containment ultimate capacity would not be exceeded.

Hydrogen combustion is not likely as the There is very little oxygen available (oxygen generated containment is normally evacuated. from radiolysis is only a long-term issue) and containment is steam inerted under severe accident conditions. In addition, conservative AICC analyses predict containment pressures that do not exceed the design pressure.

In-vessel steam explosions are not likely due to core Core support failure is expected before the fuel has a support design and volume of lower vessel head. chance to become molten. With the core uncovered there is little water in the bottom of the RPV with which core debris can interact. Even if a slug of water were to be generated, the potential for an alpha mode failure of containment is not physically credible.

HPME is not crediblecannot occur. Submergence of the lower With passive heat removal RPV establishes passive from the reactor to heat removal and prevents containment established, core debris from exiting the the reactor is depressurized RPV. No ex-vessel even if core debris is challenges occur if the core postulated to exit the remains within the vessel. vessel.

Ex-vessel steam explosion is not realisticdoes not Submergence of the lower With the lower vessel occur with a submerged RPV. RPV establishes passive flooded, there is no heat removal and prevents potential for a coherent core debris from exiting the pour of molten debris into RPV. No ex-vessel the pool of water in challenges occur if the core containment should it be remains within the vessel. postulated that debris exits the RPV.

Overpressure of containment due to There is no concrete in the containment with which the non-condensable gas generation is not applicable core debris could interact and generate to the NuScale design. non-condensable gases.

Basemat penetration is not applicable to the There is no basemat making up the containment NuScale design. boundary. This issue is addressed as a part of considering protection against contact of core debris with the containment wall.

Support Support systems are not needed for safety-related Safety-related mitigating systems are fail-safe on loss of Systems system functions (i.e., containment isolation) power and do not require supporting systems such as important to the Level 2 PRA. lube oil, instrument air, or HVAC to function.

Tier 2 19.1-190 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation RPV lower head shell and the heat flux distribution over the outer surface of the RPV lower head.

2) The second assessment assumes that the downward-facing heat transfer from the core debris to the lower head is minimized and that the remaining decay heat is focused onto the edge of the metallic layer formed above the oxidic debris. This assessment is performed primarily with conservative hand calculations.

The general heat balance for the assumed relocated core configuration is illustrated in Figure 19.2-2 and illustrates the basis for the assessments. It is postulated that under severe accident conditions, large quantities of core debris relocate to the lower plenum of the RPV. Heat transfer from the fallen debris evaporates any remaining water in the lower plenum and begins heating up the vessel structures. The heat source in the system is the radioactive decay of the oxidic materials. A portion of the decay heat is transferred across the vessel wall (the portion of the RPV wall in contact with the debris) to the water in the containment (Qdown). The remaining decay heat is transferred to the metallic layer, if present, on top of the debris (Qup), which in turn rejects the heat through the side vessel wall (the portion of the RPV wall in contact with the metal layer) to the water in the containment (Qside) and by radiation to the structures above it (Qrad). Excess heat generated increases the temperature of the oxidic materials. An increase in the core debris temperature enhances the heat transfer out of the core debris, and eventually the system reaches steady state.

Key modeling assumptions for the ANSYS simulation include:

• The decay heat load on the RPV lower head is selected based on a combination of complete core relocation, which is conservative based on MELCOR results, and a rapid time to core relocation.

• A conservative model of the core configuration after a severe accident was assumed. Specifically the debris field is assumed to consist solely of UO2 which conservatively maximizes the volumetric heat generation rate.

• Conservative modeling of heat load to the RPV lower head was assumed, e.g.,

heat loss by radiation from the top of the debris was not credited.

• Conservative values of CHF were assumed as the thermal success criterion

• Conservative value of required RPV wall thickness as the structural success criterion was assumed.

Key parameters of the simulation are provided in Table 19.2-1. The ANSYS simulation considers all relocated debris as a solid volume.

The results of the simulation are illustrated in Figure 19.2-3. The figure illustrates that the portion of the RPV lower head shell thickness kept below 900 degrees K (627 degrees C) is much greater than 1.1 cm. This implies that the RPV lower head does not fail structurally under the thermal attack from the relocated core debris.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Tier 2 19.2-15 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation The RPV bottom head, the transition region to the alignment feature, and the surfaces of the alignment feature were also evaluated in terms of CHF. The intent of the evaluation was to ensure that the maximum heat flux at any point on the outer surface of the RPV lower head is less than the local CHF. Figure 19.2-4 and Figure 19.2-5 illustrate the heat flux on the RPV lower head, vertical portion of the alignment pin and transition fillet. The figures illustrate that the maximum heat flux at the RPV to alignment pin transition is 333 kW/m2. As stated earlier, experimental studies for hemispherical surfaces suggest that the CHF for this geometry is at least 400 kW/m2. Figure 19.2-6 illustrates the heat flux on the retention pin bottom surface. This figure indicates that the maximum heat flux on the bottom of the alignment pin is 43 kW/m2. Experimental studies demonstrate the CHF for this geometry is at least 200 kW/m2. Thus, the ANSYS simulationThe results demonstrate that thermal attack from oxidic debris does not result in a challenge to lower head or alignment pin integrity.

The second evaluation considered a focusing effect associated with a potential metallic layer floating above oxidic materials. This evaluation assumes the oxidic core debris is not porous because porosity would prevent the formation of a distinct metallic layer. The height of the metallic layer was calculated based on limiting oxide and metallic mass ratios in the RPV lower plenum calculated by MELCOR. The heat flux is inversely proportional to thickness; theoretically the flux could be maximized with an infinitely thin layer. However, practically, the heat flux from a very thin layer becomes limited because of constraints on the convective and conductive heat transfer radially across the layer. Additionally, when the thickness of the metallic layer is significantly less than the thickness of the vessel wall, conduction in the shell is expected to dissipate the heat axially such that the peak heat flux on the outside surface of the RPV is drastically reduced. The CHF hand-calculated at the location on the RPV vessel of the potential metallic layer is 928 kW/m2. Conservative calculations, neglecting radiation from the top of the layer, determined the peak heat flux from the side of the layer to be 618.3 kW/m2, or about 30 percent lower than the CHF. The peak heat flux for a best-estimate calculation with radiation included is only 175.5 kW/m2. Thus, the focusing effect from a potential metallic layer above oxidic debris does not result in a challenge to RPV integrity.

RAI 19-26 Summary of Retention of Core Debris in the Reactor Pressure Vessel RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 An evaluation of the capability of the RPV to retain core debris after a severe accident has been performed using conservative ANSYS modeling and hand calculations. The evaluation considers potential core configurations in the lower RPV head after a severe accident and heat removal characteristics of the RPV, which is immersed in the water retained by the CNV. Boundary conditions for a severe accident are obtained from MELCOR simulations. TheWith bounding inputs and conservative methods, the analysis concludesdemonstrates that the thermal and Tier 2 19.2-16 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation structural integrity of the lower head is maintained in the event of in-vessel core relocation; thus, in-vessel retention in the RPV is ensured.

RAI 19-26 The conservatisms employed in the IVR analysis include:

RAI 19-26

• bounding decay heat load. Entire core relocates at the earliest onset of relocation.

RAI 19-26

• no credit for heat removal from the top surface of debris.

RAI 19-26

• maximized heat transfer to metallic layer for evaluation of the focusing effect.

RAI 19-26

• zero heat transfer to metallic layer for evaluation of thermal attack from oxidic debris.

RAI 19-26

• solid debris configuration assumed for maximum heat flux to bottom of lower head (region most susceptible to reach CHF).

RAI 19-26

• no credit for CHF enhancement from subcooling or pressurization of the containment pool.

RAI 19-26

• use of CHF exceedence as a criterion for vessel failure (i.e., not accounting for localized transition boiling).

RAI 19-26 The design characteristics of the NPM that improve the in-vessel retention-RPV capability compared to traditional large light water reactors are:

• retention of water in the CNV allowing passive heat transfer. Loss of RCS inventory and core uncovery is associated with core damage events. Only the potential accident sequences in which containment is isolated are relevant to consideration of in-vessel retention in the RPV. In this situation, the amount of water released to the CNV floods the outside RPV wall to a level that provides efficient cooling of any core debris in the RPV lower head.

• low core power density. The relocated core debris in the RPV lower head has lower volumetric heat generation rate than typical currently operating plants.

This is because the NPM has much lower power density and takes a relatively long time to reach core relocation in a severe accident, allowing a significant decrease of decay power.

RAI 19-26

• small amount of fuel materials. The amount of fuel materials is relatively small so that the core debris has a larger surface area to volume ratio than typical currently operating plants. Thus, the core debris has a large heat transfer surface relative to volume.

RAI 19-26, RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Tier 2 19.2-17 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation In summary, in a core damage event, the NuScale design ensures retention of the damaged core inside the RPV. If containment isolation is successful, there is sufficient water retained in the CNV to provide a continuous, passive heat conduction and convection path from the damaged core to the UHS. Because analysis indicates that failure to retain core debris in the RPV after a core damage accident involving an intact containment does not occuris not physically realistic, failure of the RPV is not included in the containment event tree.

19.2.3.2.2 Core Damage Progression with Retention in the Containment Vessel RAI 19-26 The NuScale design of a vessel (i.e., RPV) within a vessel (i.e., CNV), combined with the relatively small core size and low power density, indicate that a damaged core would be retained in the RPV for severe accident sequences in which the CNV is intact. As stated in Section 19.2.3.2.1, if the containment barrier is intact such that RCS water lost in a severe accident is retained in the CNV, there is a continuous, passive heat conduction and convection path to remove heat from the damaged core and transfer it to the reactor pool. Thus, retention of core debris within the RPV after a severe accident is ensured. However, for the benefit of demonstrating defense-in-depth with respect to the severe accident mitigating capabilities of the NuScale design, a discussion of the IVR capability of the CNV lower head is provided.

RAI 19-26 Drawing on similarities with the evaluation of core relocation in the RPV, evaluating the possibility of arresting core damage progression in the CNV is based on an analysis approach similar to that used for RPV retention. In both situations, as illustrated in Figure 19.2-7, core debris relocates to the lower head of a concave vessel with the potential to thermally challenge the lower head.

Evaluation of Core Debris Configuration in the Containment Vessel As was the situation with the core debris configuration in the RPV, core debris that is hypothetically relocated to the CNV is a self-heating body assumed to be shaped by the geometry of the CNV lower plenum. The average heat flux from the core debris is maximized when the core debris consists only of fuel materials; i.e., the greater the amount of non-heat generating materials that are in the core debris, the smaller the average heat flux over the debris surface.

RAI 19-26, RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 As illustrated in Figure 19.2-7, the core debris is submerged in water for severe accident sequences involving an intact containment. The water pool overlying the core debris precludes the possibility of the focusing effect on the CNV side wall as a highly conductive molten metallic layer on top of the oxidic debris is not possible given effective upward boiling heat removal. Even in the postulated scenario that a stable insulating vapor blanket forms over the debris and allows for a molten metallic layer, the heat removal from the top of the layer by radiation alone would Tier 2 19.2-18 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation mitigate a potential focusing effect. As such, the focusing effect is judged not to be a physically realistic challenge to IVR in the CNV.

Basis for Evaluating Core Debris Retention in the Containment Vessel RAI 19-26 Similar to the analysis of IVR in the RPV, the empirical CHF estimates derived from the SBLB tests are judged appropriate for the CNV lower head. While the region underneath the CNV lower head confined by the support skirt and the reactor pool floor differs from the open pool of the SBLB experiments, these geometric differences are judged not to have a significant effect on the CHF because the space underneath the CNV lower head is sufficient to accommodate the open pool boiling two-phase boundary layer. By extension, the open pool boiling CHF estimates derived from the SBLB tests are judged to remain appropriate for the CNV bottom head.

RAI 19-26 As previously discussed, the core debris in the CNV lower head is submerged in water, so heat removal from the top surface of relocated core debris in the CNV is greater than in the RPV situation. Additionally, the same debris mass has a greater surface area and thinner body in the CNV due to the lesser curvature of the CNV lower head (i.e., larger radius). These factors reduce the steady-state heat flux imposed on the CNV lower head and improve the core debris coolability in comparison to the RPV configuration. Because the CHF was not exceeded in the RPV analysis, it is also not exceeded for the CNV in a location that is in contact with the pool water.

Evaluate Potential Containment Vessel Failure RAI 19-26 The CNV lower head has two parts, the curved cap of the vessel and an exterior, structural cylindrical skirt as illustrated in Figure 19.2-8. The space directly under the cap enclosed by the skirt is referred to as the "skirted region." To allow for exchange of coolant flow between the skirted region and the UHS residing outside the skirt, there are numerous large slots evenly spaced just below the joint where the skirt and the cap meet, and numerous small slots also evenly spaced just above the bottom of the skirt. If core debris is in the CNV lower plenum, water in the skirted region is heated and steam is generated. The slots provide pathways for steam generated inside the skirt to escape and for the water outside to flow in. The joint where the skirt and cap meet is designed with a small fillet region directly above the larger skirt slots, which is expected to accumulate a small amount of vapor that cannot be vented by the slots. Because the steam layer blankets a small region of the CNV lower head compared to the thickness of the vessel wall, the local heat transfer degradation is not expected to cause significant local heatup as heat conducts to the well cooled proximities.

RAI 19-26 Tier 2 19.2-19 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation The CNV lower head integrity remains coolable as long as the slots provide a sufficient pathway for vapor escape, such that the small vapor region in the fillet does not grow and cause the lower head to exhibit significant dryout conditions and local overheating. Thus, the CNV lower head integrity is challenged only if the holes on the skirt fail to provide sufficient pathways for the steam generated in the skirted region to escape freely.

Summary of Analysis Results RAI 19-26 The analysis is based on hand calculations to estimate the volume of steam generated inside the skirted region under the CNV lower head, with the boundary conditions obtained from MELCOR simulations. In the simple analytical model, with a given steam generation rate and a conservative loss coefficient through the slots, the height of the steam layer in the skirted region relative to the top of the upper slots is calculated. Assumptions for the conservative sensitivity case were applied as follows:

• The decay heat load on the CNV lower head is selected based on a combination of 92 percent UO2 relocation with no relocation of metallic materials and conservatively rapid time to core relocation.

RAI 19-26

• Energy required to bring the subcooled reactor pool water to the saturated condition is ignored.

RAI 19-26

• Heat loss through the skirt is ignored.

RAI 19-26

• Heat flux from the top of the core debris is eliminated (representing no coolant in the CNV), resulting in the highest possible heat flux to the CNV lower head.

RAI 19-26 In this conservative sensitivity case, the height of the steam-trapped fillet region under the skirt is increased from 1 inch to 1.496 inches, and using more realistic relocated mass and heat transfer from the top of the debris, the height increases to 1.233 inches. This is a minimal increase, especially compared to the CNV vessel thickness of 3 inches. As a result of the configuration of the slots in the skirt, a natural circulation flow will develop with liquid flow entering the skirt from the bottom slots and a two-phase liquid and steam flow exiting through the top slots.

Because of the stable two-phase flow out of the top slots, the free flow of steam from the skirted region is unimpeded by recirculating or counter-current flows.

RAI 19-26, RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 The analysis concludes that the minimal steam accumulation in the skirted region does not lead to significant dryout of the CNV lower head, therefore melt-through or structural failure is not physically realisticpredicted by analysis. Thus, the CNV would retain core debris in the event of RPV failure.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Tier 2 19.2-20 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation Analyses and simulations of core damage scenarios predict no CNV failure.

Although the IVR analysis explicitly incorporated a number of uncertainties by conservative selection of analysis parameters, other phenomenological uncertainties may remain (e.g., critical heat flux, focusing effect, intermetallic reactions). However, even if the CNV were postulated to fail, resulting in fuel on the floor of the reactor pool, the reactor pool water would effectively scrub radionuclides and prevent a large release to the environment.Although not physically realistic and not explicitly modeled, if the CNV bottom head were to fail, potential consequences would be mitigated because the radiounclide release would be scrubbed by the reactor pool water.

19.2.3.3 Severe Accident Mitigation Features RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Features that mitigate a potential severe accident are summarized in this section. The potential for cooling the RPV from the outside is facilitated by the containment design as discussed in Section 19.2.3.3.1. Section 19.2.3.3.2 through Section 19.2.3.3.6 address the capability of the NuScale design with respect to potential containment challenges if core debris is not retained in the active core region of the RPV in a severe accident.

Section 19.2.3.3.7 deals with other potential mitigation features and Section 19.2.3.3.8 addresses equipment survivability in the CNV during a potential severe accident.

Because of unique characteristics of the NuScale design, analysis indicates that the only physically realistic mechanism for failure of the containment function is containment bypass or failure of containment isolation.

19.2.3.3.1 External Reactor Vessel Cooling RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 In the event of a severe accident with associated core damage, external reactor vessel cooling refers to the capability of cooling a core debris bed retained in the RPV by means of heat conducted through the RPV wall. The NuScale design with its small core, low power density and large surface-to-volume ratio facilitates external RPV cooling. Additionally for all intact containment accidents, coolant is retained in the CNV, surrounding the RPV vessel. The result of these features of the NuScale design is that retaining core material in the RPV is demonstratedthe only physically realistic end state for sequences with core damage and intact containment, as discussed in Section 19.2.3.2.1.

19.2.3.3.2 Hydrogen Generation and Control Hydrogen is a highly flammable gas which is highly diffusive and buoyant.

Deflagration and detonation are two different combustion processes that require separate consideration. In a deflagration, the combustion wave propagates at a velocity less than the speed of sound. In detonation, the combustion wave propagates at a velocity greater than the speed of sound, which creates a high-pressure shock wave that can cause significant damage on the structure it contacts. Key properties of hydrogen relevant to and as informed by Reference 19.2-24 through Reference 19.2-29, include:

Tier 2 19.2-21 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation

• Hydrogen is flammable over a wide range of concentrations. Changes in pressure or temperature cause the upper flammability limit to change. When steam concentrations exceed about 55 volume percent, the system is no longer flammable. Under the conditions of the CNV during a severe accident, volume percent and molar percent can be taken as equivalent.

• Hydrogen forms a flammable mixture with air at ambient conditions and its ignition energy is also low (about one-tenth of that required for gasoline vapors).

• Air concentrations must be greater than 20 volume percent in order to allow hydrogen deflagration (air is about 21 volume percent oxygen, so the minimum oxygen concentration that allows hydrogen deflagration is about 4 percent by volume).

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Hydrogen combustion, which would have the potential to challenge containment integrity, is physically unrealistic The potential for hydrogen combustion is minimized in the NuScale design based on the following considerations with respect to initial conditions and severe accident conditions:

Initial Conditions

• As stated in Section 6.2, during normal operation, a near vacuum is maintained in the CNV by the containment evacuation system (CES). Thus, the initial containment pressure with respect to the containment design pressure is very low.

• Due to the very low initial containment pressure and small free volume of the containment, the amount of oxygen initially present in the containment is very small.

• The initial hydrogen concentration in containment is negligible because the amount of air in the containment is very low and the fraction of hydrogen in air is very small. While there is some hydrogen in the RPV during steady-state operation (for water chemistry purposes), this would not transport to the containment until after a potential accident had initiated.

• The CNV is not compartmentalized, thus significant differences in localized gas concentrations are not a concern, consistent with the requirement of 10 CFR 50.44(c)(1).

Severe Accident Conditions The only source of oxygen generation during severe accidents with an intact containment is the radiolysis of water, which is relatively slow because of the relatively low decay power in the NPM. In terms of concentration (by mole or volume), the oxygen concentration is 21 percent initially as the gases in the containment are only air. However, because the total oxygen molar inventory is minimal, the initial 21 percent concentration of oxygen decreases to well below 4 percent as soon as any vapor or gases from the RPV are released into containment.

Initially, steam is the dominant gaseous species, causing a steam-inert Tier 2 19.2-22 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation several weeks of oxygen production demonstrates that hydrogen combustion does not pose a credible risk to the NuScale CNV.

Adiabatic Isochoric Complete Combustion Sensitivity Study RAI 06.02.05-4 An additional adiabatic isochoric complete combustion calculation was performed to analyze a combustion event based on the maximum hydrogen production from the severe accident simulations specified in Section 19.2.3.2. It is conservatively assumed that all produced hydrogen is in the CNV at the time of combustion.

Oxygen and hydrogen are produced by radiolysis until oxygen exceeds a 5 percent concentration, which is the MELCOR default lower limit and is more challenging for this sensitivity as it increases the total available moles of oxygen for combustion. It is estimated that radiolysis would have to proceed uninhibited for 45 days to produce such an oxygen concentration. The adiabatic isochoric complete combustion calculation results show that the post-deflagration pressure for the sensitivity case is approximately 920 psia, which remains below the containment design pressure.

RAI 06.02.05-4 In summary, over-pressurizing the NuScale CNV due to hydrogen combustion is physically unrealistic due to the very limited oxygen concentration before and after postulated severe accidents. The post-deflagration pressures from conservative adiabatic isochoric complete combustion calculations are below the CNV design pressure. Based on these results, containment structural integrity is maintained for a severe accident that releases more hydrogen than would be generated from 100 percent fuel clad-coolant reaction accompanied by hydrogen burning as required by10 CFR 50.44 (c)(5). In these calculations, oxygen, not hydrogen, is the limiting reactant for combustion.

19.2.3.3.3 Core Debris Coolability As discussed in Section 19.2.3.2.1 and Section 19.2.3.2.2, core debris coolability is ensured in both the RPV and CNV lower heads. The NuScale design does not include concrete inside the CNV. Thus, molten core-concrete interaction is not applicable to the NuScale design.

19.2.3.3.4 High-Pressure Melt Ejection RAI 19-26S1, RAI 19-29, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 High-pressure melt ejection (HPME) refers to the phenomenon of RPV failure at high pressure with the result that core debris is ejected and dispersed throughout the containment. A concern of HPME is the threat to the containment integrity due to direct containment heating causing a rapid heating of the containment atmosphere. Another potential threat to containment is associated with direct contact of the dispersed debris with the metal containment itself. Literature sources indicate that a significant pressure differential between the RPV and containment is required to cause HPME from the RPV. While there is not a Tier 2 19.2-26 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation commonly accepted value for the necessary pressure differential to support HPME, literature sources (Reference 19.2-21, Reference 19.2-22, and Reference 19.2-23) indicate that a pressure differential greater than 100 psid is required. As indicated below, HPME is not physically realistic for the NuScale designcannot occur in the NuScale design because a significant pressure differential between the RPV and CNV cannot exist at the time of core relocation.

RAI 19-26S1, RAI 19-29, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 In the NuScale Power Plant design, the passive DHRS and ECCS are designed to provide efficient primary system heat removal and to effectively depressurize the RPV in response to an initiating event. If the RPV is not depressurized by these safety systems, depressurization occurs due to a loss of RCS inventory resulting from the initiating event (e.g., a LOCA or inadvertent valve opening). The inventory lost from the RCS is retained in the CNV and provides a heat transfer medium between the RPV and CNV, and then to the UHS. As a result of this heat transfer, pressures in the RPV and CNV equalize; therefore, there is no driving pressure for HPME to occur., making a significant pressure differential between the RPV and CNV physically unrealistic.

The severe accident simulations presented in Section 19.2.3.2 were reviewed to evaluate the potential for high pressure melt ejection. Because every simulation results in the relocation of at least nine fuel assemblies to the RPV lower plenum, all have the potential for HPME.

RAI 19-26S1, RAI 19-29, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Figure 19.2-11 illustrates that after the time of core relocation to the RPV lower head (as presented for each sequence in Section 19.2.3.2) the pressure differential between the RPV and CNV in every simulation is less than 75 psid. Further, the RPV and CNV reach pressure equilibrium well before the RPV lower head temperature increases to the point at which RPV failure could be postulated. In this equilibrium configuration, the pressure in the lower volume of the CNV exceeds that in the RPV due to the hydrostatic head of water in the CNV, indicating that there is no driving force for HPME, if RPV failure were postulated. Therefore, an HPME and the associated potential threat to containment integrity is physically unrealisticdoes not occur, regardless of break location or size.

19.2.3.3.5 Fuel-Coolant Interaction The potential for an adverse interaction of molten fuel and coolant during a severe accident, either in the RPV ("in-vessel") or external to the RPV if molten fuel is not retained ("ex-vessel"), was evaluated. Fuel-coolant interaction can result in an energetic and rapid phase transition from liquid water to steam, referred to as a "steam explosion." During the transition, expanding fluids perform work, thereby challenging the integrity of the RPV or CNV. While traditional evaluations of steam explosions and empirical data suggest molten fuel is a requirement for a fuel-coolant interaction, molten fuel is not expected based on severe accident MELCOR modeling. Regardless, an evaluation was performed based on the consideration of certain fundamental characteristics of energetic steam explosions, such as:

Tier 2 19.2-27 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation

• a significant amount of molten corium above a water pool is required so that sufficient thermal energy exists to produce a steam explosion.

• a significant water pool is required so that sufficient inventory exists for an explosive transition from liquid water to steam.

• a larger fall height of debris into a deep water pool facilitates the breakup of debris. This initial breakup is a precursor to debris fragmentation, which is needed for rapid heat transfer associated with an energetic steam explosion.

• a large void (steam) fraction can prevent spontaneous occurrence of a steam explosion because a large steam fraction (large film thickness) makes debris-liquid contact difficult. Thus, explosions in saturated water are more difficult to trigger than in subcooled water.

• the presence of non-condensable gases in the mixture (e.g., hydrogen production due to corium oxidation by the steam as would occur in a severe accident) has a cushioning effect that hinders film collapse during the triggering stage of fuel-coolant interaction. The resistance to film collapse impedes fuel-coolant interaction.

• a steam explosion is more difficult to trigger spontaneously when the system pressure is high because the stability of the vapor film increases with pressure.

Additional energy relative to lower pressure situations is required to collapse this vapor film.

• a "melt pour" type of interaction (i.e., corium poured into a water pool) bounds the energetics associated with a "stratified" type of interaction (i.e., water flooding a corium debris bed).

The potential for in-vessel and ex-vessel steam explosions are discussed in more detail below.

In-Vessel Steam Explosion The "alpha mode" of containment failure is considered with regard to its potential in the NuScale design. In the alpha mode, the concern is that a steam explosion inside the RPV could induce a water slug which could impact the uppermost structures of the RPV or induce significant dynamic loading challenging the integrity of the RPV. If such an event were to occur, a sudden increase in energy within the RPV could challenge RPV section and bolted interfaces, potentially compromising vessel integrity. If this were to happen, it could cause failure of the upper head, potentially resulting in containment failure. The issue is described in NUREG-1524, NUREG/CR-5030, and Corradini et al (Reference 19.2-19, Reference 19.2-31, Reference 19.2-32, respectively).

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 For an in-vessel steam explosion, the body of molten corium is in the core region above the core support plate, while the water pool is below the plate. AnThe potential for an in-vessel steam explosion is evaluated to be physically unrealisticin the NuScale design is minimized based on the size of the NuScale core, physical dimensions of the RPV, and thermal-hydraulic conditions within the RPV, including:

Tier 2 19.2-28 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation From MELCOR results, observations of the NPM design were confirmed, including relocated core material configuration and the available coolant inventory. Because core relocation occurs as a result of support plate failure at temperatures less than the melting temperature of oxidic fuel materials, relocated corium within the RPV is largely a solidified mass, and not molten. Furthermore, limited coolant inventory within the RPV reduces the potential for energetic steam explosions to perform work on the RPV during fluid expansion.

RAI 19-33 The result of the Hicks-Menzies thermodynamic analysis shows a high conversion ratio of thermal energy in the fuel to mechanical energy as coolant expands to fill the full volume of the RPV. All expansion energy is assumed to transfer to an upward liquid water slug and no energy loss is assumed for dissipation in the upper internals of the RPV. As a result, the energy applied to the upper head of the RPV is conservative. Furthermore, because the NuScale core is small, relocated fuel materials contain a relatively small amount of initial thermal energy. This limits the potential for coolant to perform work on the RPV during the expansion process.

Consequently, work performed on the RPV by expanding coolant is insufficient to challenge vessel integrity.

RAI 19-33 Uncertainty in input parameters is considered by using the results of MELCOR accident simulations to inform the analysis of in-vessel FCI. A probability distribution for each input parameter is created using the minimum and maximum values from the MELCOR accident simulations presented in Table 19.2-10. A uniform distribution is applied between those bounds with a lognormal distribution describing extreme values of each distribution which are beyond the extreme values predicted by MELCOR simulations. Random samples for each input parameter are then acquired via Monte Carlo sampling and used to evaluate the Hicks-Menzies model. No combination of sampled input parameters results in failure of the RPV as a result of an in-vessel FCI.

RAI 19-26S1, RAI 19-29S1, RAI 19-33, RAI 19-33S1, RAI 19-34S1 With a significant amount of solid (versus molten) material in relocated core debris, the potential for an in-vessel steam explosion is highly unlikely. Further, a conservative thermodynamic analysis assuming fragmentation and heat transfer corresponding to molten debris (irrespective of debris temperature) found that the energy released from a hypothetical steam explosion is insufficient to challenge RPV integrity. As a result, the alpha-mode of containment failure is not credible relative to an in-vessel FCIcannot occur.

Ex-vessel Steam Explosion RAI 19-26S1, RAI 19-29S1, RAI 19-33, RAI 19-33S1, RAI 19-34S1 As discussed in Section 19.2.3.2.1, analysis demonstrates that failure of the RPV after a core damage accident involving an intact containment does not occur.is not physically realistic. For such situations, a significant volume of liquid water will be present in the annular region between the CNV and the RPV to provide a cooling Tier 2 19.2-30 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation pathway from the core region to the Reactor Building pool. This volume of water prevents failure of the RPV lower head. As a result, ana very rapid or instantaneous interaction of fuel materials inside of the RPV and liquid coolant in the CNV does not occur; therefore,is not credible and a quantitative analysis postulating such conditions was not performed.

RAI 19-26S1, RAI 19-29S1, RAI 19-33, RAI 19-33S1, RAI 19-34S1 However, from the perspective of demonstrating defense-in-depth, several aspects of the NuScale design precludeminimize the possibility of an ex-vessel FCI:

RAI 19-33

• Considering a situation with an intact containment, the RCS water relocated to the CNV, and a failed RPV lower head, the distance between the bottom of the lower head of the RPV and the CNV is small and MELCOR accident sequences with an intact containment predict this space to be occupied by a water pool.

An energetic FCI requires space between molten fuel materials, if present, and a water pool to promote material breakup. Breakup helps create a larger total surface area for contact with liquid coolant, thereby increasing rapid heat transfer. Because accident sequences with an intact containment contain a significant amount of liquid coolant in the annular region between the RPV and CNV, there is no available space between a failed RPV lower head and the water pool beneath to foster material breakup needed to promote an energetic transfer of heat to the water pool in the CNV.

RAI 19-33

• The CNV is not large enough to allow for a relocation of all core materials from the RPV to the CNV. Because of the limited space between the RPV and the CNV, a significant portion of the fuel material will remain backfilled within the RPV above a fuel mass in the CNV. This prevents fuel material from interacting with a water pool in containment. Coupled with the small size of the NuScale core, a relocation of fuel materials from the RPV to the CNV will involve less material than a similar FCI within the RPV, further limiting the potential energy transference necessary for an energetic ex-vessel steam explosion.

RAI 19-33

• Because of the large water pool predicted to reside in the containment annulus, the resultant conversion ratio for an ex-vessel FCI will be significantly less than the predicted ratio using the Hicks-Menzies thermodynamic model of an in-vessel FCI (which was shown to not challenge RPV integrity), thereby limiting the potential for work to be performed on the CNV by expanding coolant.

RAI 19-26S1, RAI 19-29S1, RAI 19-33, RAI 19-33S1, RAI 19-34S1 For these reasons, the potential for efficient transfer of thermal energy between fine fuel materials and coolant cannot take place and the conditions(which is required for an energetic ex-vessel FCI) is minimizedare not established.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Summary of Results RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 Tier 2 19.2-31 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation Analysis results and assessment of design features demonstrate that the potential for an energetic in-vessel or ex-vessel FCI is minimized. Additionally an analysis of in-vessel FCI demonstrated that there would not be sufficient energy to fail the RPV. Therefore, FCI is not predicted to threaten containment integrity. However, in consideration of phenomenological uncertainties (e.g., corium temperature, vessel failure energy), a postulated FCI that fails the CNV was evaluated. MELCOR simulations documented in Section 19.2.3.2 show that at the earliest possible time of FCI, the airborne fraction of volatile fission product aerosols is less than NuScale's calculated threshold for a large release, as determined in Section 19.1.4.2.1.4.

Therefore, the evaluation demonstrates that an instantaneous release of the entire airborne aerosol inventory at the time of a postulated FCI would not constitute a large release.

19.2.3.3.6 Containment Bypass A containment bypass is a flow path that allows an unintended release of radioactive material directly to the Reactor Building, bypassing containment. Core damage sequences that include containment bypass or failure of containment isolation are assumed to result in a large release as defined in Section 19.1.4.2.1.4.

No distinction is made between "early" or "late" releases. Containment bypass could occur through (i) failure of containment isolation or (ii) steam generator tube failure (SGTF) concurrent with failure of secondary-side isolation on the failed steam generator (SG). Containment bypass is represented by top event CNTS-T01 as discussed in Section 19.1.4.2.1.3.

Containment Isolation Failure As stated in Section 6.2.4, the containment system design provides for isolation of systems that penetrate the CNV. The design is reflected in a containment isolation and bypass model as summarized in Section 19.1.4.2.1.3.

Thermally-Induced Steam Generator Tube Failure In the NuScale design, the SG bundles are integrated within the RPV; they form part of the RPV reactor coolant pressure boundary. In contrast with conventional pressurized water reactors, the primary reactor coolant circulates over the outside of the SG tubes, with the steam-formation occurring in the secondary coolant on the inside of the SG tubes. As such, the NuScale SG tubes operate with the higher primary pressure on the outside of the tubes and lower secondary pressure on the inside of the tubes. The result is that there are predominately compressive stresses on the tubes versus the typical tensile stresses. Because the mechanism for fatigue crack propagation is tensile stress, the NuScale SG pressure conditions are expected to prevent crack propagation.

RAI 19-13S1 Due to the lack of data on thermal-induced SGTFs for the NuScale design, an evaluation of creep rupture was performed based on historical data for conventional SG tube flaws and time-history temperature and pressure conditions representative of NuScale severe accident sequences.

Tier 2 19.2-32 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation

• The criterion is applied to internal and external event scenarios when a module is operating at power. During low power and shut down operation, the containment may not be credited in some plant operating states; thus, the criterion is not a useful indicator of containment performance.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1

• The CCFP is defined as the ratio of the probability of CDF with containment failurelarge release frequency over the probability of CDF without containment failurecore damage frequency. As discussed in earlier sections, the only physically realistic mode of containment failure evaluated probabilistically is bypass or failure of containment isolation; analysis indicates that other severe accident containment challenges do not occur.

The composite CCFP for a module is calculated to be less than 0.1, which meets the safety goal, as discussed in Section 19.1.

RAI 06.02.05-2 Combustible Gas Control Containment performance is ensured also by achieving combustible gas control. During normal plant operation, combustible gas control is achieved by maintaining a near vacuum in the CNV by the CES. As discussed in Section 19.2.3.3.2, during severe accident conditions combustible gas control is provided initially by the steam-inert environment and later by the large production of hydrogen that reduces oxygen concentration below combustible limits. Additionally, an adiabatic isochoric complete combustion analysis was performed to evaluate the ability of the CNV to cope with combustible gases generated by radiolysis occurring for weeks after a severe accident. The analysis showed the resulting containment pressure was calculated to be below the CNV design pressure which demonstrates that hydrogen combustion does not pose a credible risk to the NuScale CNV. A listing of SSC that are required to remain functional following a hydrogen combustion event to support containment integrity and core cooling is provided in Section 3.3.5 of TR-0716-50424, Revision 0, "Combustible Gas Control" Technical Report (Reference 6.2-3).

Summary of Containment Performance Consistent with SECY-93-087, deterministic and probabilistic evaluations of containment capability have been performed. The deterministic evaluation of containment capability in comparison to potential severe accident challenges confirms that the CNV is a leak-tight barrier for a period of at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onset of core damage for the most-likely severe accident sequences. The probabilistic evaluation demonstrates that the reliability of containment isolation in response to severe accident meets the safety goal, as confirmed by the composite CCFP.

19.2.5 Accident Management Accident management refers to the actions taken during the course of a beyond design basis accident by the plant operating and technical staff to:

• prevent core damage

• terminate the progress of core damage if it begins and retain the core within the RPV Tier 2 19.2-36 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation

• maintain containment integrity as long as possible

• minimize offsite releases The inherent design characteristics (e.g., fail-safe equipment position and design simplicity) and thermal-hydraulic characteristics (e.g., passive cooling) of the NuScale design are such that there are no operator actions required to place an NPM in a safe configuration for postulated design basis accidents. That is, operator actions during postulated accidents are associated with monitoring the module or providing backup in the event of multiple component failures. Section 19.2.5.1 summarizes the capability of the NuScale design with respect to the different stages of a postulated accident.

Section 19.2.5.2 summarizes the programmatic structure for accident management.

19.2.5.1 Accident Management Design Capability The capability to manage the course of a severe accident at each stage is summarized below.

Prevention of Core Damage The Level 1 PRA discussed in Section 19.1 demonstrates the very low CDF is dominated by beyond design basis accidents involving incomplete actuation of the ECCS. In such sequences, inventory makeup to the RPV is required to prevent core damage. Potential actions to provide the necessary makeup, depending on the particular failures involved in the event, include

• manual action to open ECCS valves to allow ECCS flow between the RPV and the CNV, which allows decay heat removal to the UHS (reactor pool).

• manual initiation of makeup to the RPV through the CVCS injection line using the CVCS makeup pumps.

• manual initiation of makeup to the RPV through the pressurizer spray line using the CVCS makeup pumps.

• manual initiation of the CFDS to add water to the CNV to remove heat from the RPV through passive conduction and convection, preventing RPV over-pressurization, or when the CFDS is credited in conjunction with successful ECCS, the makeup coolant mitigates an unisolated outside-containment LOCA.

Terminate Core Damage Progression and Retain the Core within the RPV The actions identified for prevention of core damage are also taken to arrest the progression of core damage once begun and retain the core within the RPV.

Maintaining Containment Integrity RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1 The analyses supporting the Level 2 PRA discussed in Section 19.1 demonstrates that physically-realistic challenges to containment are due to failure of containment isolation or containment bypass. Potential actions to maintain containment integrity, depending on the particular failures involved in the event, include Tier 2 19.2-37 Draft Revision 3