ML19142A397

LLC Submittal of Changes to Final Safety Analysis Report, Section 19.2, Severe Accident Evaluation

ML19142A397
Person / Time
Site:	NuScale
Issue date:	05/22/2019
From:	Rad Z NuScale
To:	Document Control Desk, Office of New Reactors
References
LO-0519-65662
Download: ML19142A397 (7)

Text

LO-0519-65662 May 22, 2019 Docket No.52-048 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk One White Flint North 11555 Rockville Pike Rockville, MD 20852-2738

SUBJECT:

NuScale Power, LLC Submittal of Changes to Final Safety Analysis Report, Section 19.2, Severe Accident Evaluation

REFERENCES:

1. NuScale Topical Report, "Accident Source Term Methodology," TR-0915-17565, Revision 3, dated April 2019 (ML19112A172)

2. Letter from NuScale Power, LLC to U.S. Nuclear Regulatory Commission, NuScale Power, LLC Submittal of Presentation Materials Entitled NuScale Source Term Revision, Revision 0, PM-0118-58201, dated January 23, 2018 (ML18019A163)

3. U.S. Nuclear Regulatory Commission, Category 1 Public Meeting announcement, NuScale Power Design Certification Application Teleconference, dated April 9, 2019 (ML19098B624)

4. Letter from NuScale Power, LLC to U.S. Nuclear Regulatory Commission, NuScale Power, LLC Submittal of the NuScale Standard Plant Design Certification Application, Revision 2, dated October 30, 2018 (ML18311A006)

NuScale Power, LLC (NuScale) has modified the approach to the development of radiological accident source terms as presented in the Accident Source Term Methodology Topical Report (Reference 1).

NuScale has discussed its intention to modify the approach with the NRC staff in a series of public meetings ranging from January 23, 2018 (Reference 2) to April 9, 2019 (Reference 3). As a result of these discussions, NuScale has updated the subject section of the Final Safety Analysis Report (FSAR). The Enclosure to this letter provides a mark-up of the FSAR pages incorporating revisions in redline/strikeout format. NuScale will include this change as part of a future revision to the NuScale Design Certification Application.

This letter makes no regulatory commitments or revisions to any existing regulatory commitments.

If you have any questions, please feel free to contact Rebecca Norris at 541-602-1260 or at rnorris@nuscalepower.com.

Sincerely, Zackary W. Rad Director, Regulatory Affairs NuScale Power, LLC NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

LO-0519-65662 Page 2 of 2 05/22/19 Distribution: Samuel Lee, NRC, OWFN-8H12 Gregory Cranston, NRC, OWFN-8H12 Getachew Tesfaye, NRC, OWFN-8H12 Rani Franovich, NRC, OWFN-8H12

Enclosure:

Changes to Final Safety Analysis Report, Section 19.2, Severe Accident Evaluation NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

LO-0519-65662

Enclosure:

Changes to Final Safety Analysis Report, Section 19.2, Severe Accident Evaluation NuScale Power, LLC 1100 NE Circle Blvd., Suite 200 Corvallis, Oregon 97330 Office 541.360-0500 Fax 541.207.3928 www.nuscalepower.com

NuScale Final Safety Analysis Report Severe Accident Evaluation RAI 19-13S1 The SG tubes under severe accident conditions typically have a much higher probability of failure because of the higher temperatures during a severe accident.

The probability of an SGTF is calculated using the tube failure /creep rupture model presented in NUREG-1570 (Reference 19.2-33). Although the formulations employed for predicting creep rupture are based on internally pressurized tubes, the NuScale steam generator tubes are externally pressurized. As a result, the calculated probability of a thermally induced SGTF is judged to be overestimated because creep progresses more vigorously under tension than under compression.

The nominal temperature and stress conditions that the tubes are exposed to are derived from a representative MELCOR severe accident simulation. Uncertainty is accounted for by imposing a distribution about the nominal values for temperature, pressure, and the Larson-Miller parameter. The probability of such a failure is incorporated into the Level 2 PRA as described in Section 19.1.4.2. In the Level 2 PRA, if a core damage event causes a thermally-induced SGTF with concurrent failure of the secondary-side isolation valves on the damaged SG, a containment bypass accident has occurred and a large release is assumed. A thermally induced SGTF does not pose a unique severe accident phenomena risk that would threaten the CNV, and is not analyzed deterministically.

19.2.3.3.7 Other Severe Accident Mitigation Features The NuScale design includes additional features that are relevant to mitigation of severe accidents. In addition to the capabilities summarized in the prior sections, the design includes unique features that are not explicitly credited in the PRA.:

• Partial immersion of the CNV in the reactor pool provides radionuclide scrubbing in the event of CNV lower head failure.

• For severe accidents with CNV bypass or containment isolation failure, the release would potentially be further reduced by the Seismic Category I Reactor Building, which includes a spray system.

19.2.3.3.8 Equipment Survivability Consistent with SECY-90-016, SECY-93-087, and SECY-94-302 (Reference 19.2-15),

equipment required to mitigate severe accidents is evaluated to perform its intended severe accident functions. As stated in the references, the evaluation is intended to demonstrate that there is reasonable assurance that equipment needed for severe accident mitigation and post-accident monitoring and sampling(including the capability to monitor combustible gases as required by 10 CFR 50.44(c)(4)) will survive in the severe accident environment over the time span for which it is needed. Severe accident environmental conditions may produce extremes in pressure, temperature, radiation, and humidity.

Following a severe accident in which core damage has occurred, the two functions that must be maintained are containment integrity and post-accident monitoring (including the capability to monitor combustible gases). Post-accident monitoring is not relied upon for mitigating severe accidents, but is intended only to provide information on severe accident conditions as required by 10 CFR 50.34(f)(2)(xix).

Tier 2 19.2-33 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation The time span over which survivability is reasonably assured is specific to the equipment and its function. All equipment that is necessary to maintain containment integrity is reasonably assured to survive for at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after core damage. Equipment used for post-accident monitoring, except for combustible gas monitoring, is reasonably assured to survive for a duration based on the variable monitored and what operators would do with that information, with a maximum duration of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after core damage. Equipment that is necessary for continuous monitoring of combustible gases is reasonably assured to survive for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Equipment is qualified to 100-percent humidity. In terms of post-accident dose, the NuScale design has used a methodology for environmentally qualifying equipment in the containmentassuring equipment survivability based, in part, on environments predicted for severe accidents as modeled in the NuScale PRA. This approach provides confidence that the equipment needed for severe accident mitigation and monitoring survives over the time span in which it is neededmonitoring equipment remains functional following a severe accident.

Equipment survivability in a radiation environment is first evaluated by comparing the severe accident dose to the environmental qualification design-basis dose. The severe accident dose is based on the core damage source term described in Section 15.10. For cases in which the environmental qualification dose is larger, survivability is assured. For cases in which the severe accident dose is larger, qualitative assessments, testing, or additional analyses are performed to assure survivability.

Post-accident temperature and pressure conditions are discussed with regard to containment integrity and post-accident monitoring capabilities as follows.

Containment Integrity Containment integrity is the only safety function relied upon for severe accident mitigation. The function is ensured through successful closure of the containment isolation valves and ensuring that the CNVcontainment , including penetrations and seals, remains intact. Given how early a containment isolation signal is generated following most accidentspostulated PRA initiating events, containment isolation valves are expected to reach the desired position well before core damage occurs.

Simulation results confirm the NPM remains below CNV temperature and pressure limits for all accident sequences considered in the PRA. The two most challenging transients with respect to CNV temperature and pressure loads are: the CNV response to an ultimate failure of the RPV due to overpressurization, and the CNV response to an adiabatic complete combustion of the hydrogen conditions described in Section 19.2.3.3.2. Thermal-hydraulic results show that even if the RPV were to fail due to overpressurization, the CNV ultimate failure pressure would not be exceeded and any RPV-CNV pressure differential would subside well before core damage. A conservative thermodynamic analysis of a complete combustion of the hydrogen/oxygen inventory described in Section 19.2.3.3.2 imparting all energy adiabatically and directly into the exposed CNV steel (exposed on the inside-Tier 2 19.2-34 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation surface) confirms that the steel temperature would rise less than 75F, remaining well below the CNV design temperature.

NuScale's unique and robust design has reduced or eliminated many of the traditional failure mechanisms that challenge containment integrity once it is successfully isolated. Section 19.2.3.3 further discusses a module's response to such challenges.

Post-Accident Monitoring In the NuScale design, no post-accident monitoring variables are required to mitigate a severe accident. Type C variables, as identified in Table 7.1-7, provide adequate information for monitoring a severe accident. Each Type B, C, and D post-accident monitoring variable is included in the equipment survivability assessment. Additionally, the containment evacuation system containment isolation valves, containment flooding and drain system containment isolation valves, containment isolation valve hydraulic skids, containment gas sample pump, and combustible gas monitors are included for the monitoring of combustible gases. The pump and monitors provide the capability to continuously monitor, whereas the containment isolation valves and skids are only needed to start monitoring.

Following a severe accident, there is reasonable assurance that monitoring capability is maintained if the conditions experienced during the accident progression are not significantly harsher than the conditions for which the equipment is qualified.

The instrumentation in and directly around the core may be subject to more extreme conditions during core damage, but the utility of such monitoring variables diminishes greatly after core damage has occurred.

As shown in Figure 19.2-12, the simulation results from the severe accident cases in Section 19.2.3.2 exhibit RPV shell temperatures that do not increase above the RPV design temperature, even after core damage and relocation. Figure 19.2-12 does not include the temperature of the RPV lower head because the NuScale RPV lower head is not designed with instrumentation for post-accident monitoring. Severe accident module pressures are also not of significant risk, as discussed in Section 19.2.3.3.4. The relatively benign severe accident conditions are attributed to the effective passive heat removal through the CNV to the UHS, further enhanced by the retention of primary coolant in the CNV.

In a post-accident environment, the RPV shell temperature provides an upper bound of the temperatures experienced inside the CNV. Considering that severe accident simulations show that the RPV shell temperature does not exceed the equipment qualification temperature for instruments inside the CNV, there is reasonable assurance that post-accident monitoring will be maintained during a severe accident.The post-accident RPV shell temperature serves as a representative quantitative metric supporting that post-accident conditions are not significantly harsher than the equipment qualification conditions and provides reasonable assurance that post-accident monitoring capability is maintained.

Tier 2 19.2-35 Draft Revision 3

NuScale Final Safety Analysis Report Severe Accident Evaluation OtherThe remainder of instrumentation important for post-accident monitoring is exterior to the CNV, such asincludes containment isolation valve position indication, which experiences conditions much less severe than those on the RPV and areis reasonably assured to survive severe accident temperature and pressure conditions. The instrumentation in and directly around the core may be subject to more extreme conditions during core damage, but the utility in such monitoring variables diminishes greatly after core damage has occurred. Therefore, this instrumentation is not relied upon for post-accident monitoring. Post-accident samplingCombustible gas monitoring is part of the NuScale design and does not require equipment inside the CNV.

19.2.4 Containment Performance Capability As discussed in SECY 90-016, SECY 93-087 and associated staff requirements memoranda (Reference 19.2-4, Reference 19.2-5, Reference 19.2-13, and Reference 19.2-14),

containment performance with regard to severe accidents is evaluated using deterministic and probabilistic approaches.

Deterministic Evaluation of Ultimate Pressure Capacity An evaluation of the ultimate pressure capacity of the CNV is provided in Section 3.8. The evaluation demonstrates that the ultimate pressure capacity significantly exceeds the design pressure. The results of severe accident MELCOR simulations, as presented in Section 19.2.3.2 confirm that the CNV withstands the pressures associated with severe accidents, which are less than both the design pressure and the ultimate failure pressure, including the pressure associated with potential hydrogen generation, consistent with requirements in 10 CFR 50.34(f)(3)(v)(A)(1) and 10 CFR 50.44. The design of the UHS prevents the CNV pressure from increasing significantly after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, thereby ensuring the CNV continues to provide a barrier against the uncontrolled release of fission products.

Further, the CNV is shown to maintain structural integrity from potential hydrogen combustion, eliminating the need to manage combustible gases in order to maintain control of the containment boundary in the event of a severe accident. Finally, NuScale has no safety-related low-pressure injection that requires venting to atmosphere. Thus, a containment vent is unnecessary in the NuScale design.

Probabilistic Evaluation of Containment Performance Using a probabilistic approach, the conditional containment failure probability (CCFP) should not exceed 0.1. This criterion has been applied to the NuScale module in the following manner.

• The criterion is applied to internal and external event scenarios when a module is operating at power. During low power and shut down operation, the containment may not be credited in some plant operating states; thus, the criterion is not a useful indicator of containment performance.

RAI 19-26S1, RAI 19-29S1, RAI 19-33S1, RAI 19-34S1

• The CCFP is defined as the ratio of the probability of CDF with containment failurelarge release frequency over the probability of CDF without containment failurecore damage frequency. As discussed in earlier sections, the only physically realistic mode of containment failure evaluated probabilistically is bypass or failure of containment Tier 2 19.2-36 Draft Revision 3