ML19238A017

Preliminary P2 SER NuScale Ch 15 Redacted Version - Clean

ML19238A017
Person / Time
Site:	NuScale
Issue date:	08/23/2019
From:	Prosanta Chowdhury, Rani Franovich NRC/NRO/DLSE/LB1
To:
Chowdhury P / 415-1647
Shared Package
ML18201A159	List: ML18201A160 ML18201A161 ML19238A017
References
Download: ML19238A017 (164)

Text

15 TRANSIENT AND ACCIDENT ANALYSES SPECIAL NOTE: This PRELIMINARY PHASE 2, CHAPTER 15, TRANSIENT AND ACCIDENT ANALYSES, SAFETY EVALUATION REPORT (SER) is based on Chapter 15 of the NuScale design certification application, Revision 2. This preliminary SER chapter includes numerous items characterized for the purpose of this SER chapter as Open Items (OIs). However, many of these issues are unresolved without a clearly defined path toward resolution identified at this time and may involve potential legal issues. For this reason, the staff anticipates that NuScale will make revisions throughout this chapter of the application.

Accordingly, this preliminary SER chapter, while useful for illuminating the issues unique to the review of transient and accident analysis for the NuScale design, may not reflect the NuScale revised approach and associated NRC review of that revised approach. The staff provided a version of this preliminary SER chapter to support a meeting with the ACRS held on June 19-20, 2019, to discuss key issues related to this chapter and its associated topical reports. It should be noted that this preliminary SER reflects the staff evaluation as of June 18, 2019, and designates pending meeting and audit summaries with ADAMS Accession No. MLXXXXXXXXX. In addition, in Section 15.0.3 of this preliminary SER, the staff used red text to identify information pending completion of its review of topical report, TR-0915-17565, Accident Source Term Methodology, Revision 3.

This chapter of the safety evaluation report (SER) documents the U.S. Nuclear Regulatory Commission (NRC) staff (hereafter referred to as the staff) review of Chapter 15, Transient and Accident Analyses, of the NuScale Power, LLC (hereafter referred to as the applicant) Design Certification Application (DCA), Part 2, Final Safety Analysis Report (FSAR), Revision 2.

In this chapter, the NRC staff uses the term non-safety-related to refer to structures, systems and components (SSCs) that are not classified as safety-related SSCs as described in Title 10 of the Code of Federal Regulation (CFR), Section 50.2, Definition. However, among the non-safety-related SSCs, there are those that are important to safety as that term is used in the General Design Criteria (GDC) listed in Appendix A, General Design Criteria for Nuclear Power Plants, to 10 CFR Part 50, and others that are not considered important to safety.

15.0 IntroductionTransient and Accident Analysis Classification and Key Assumptions This section describes the internal events and their classification that are evaluated as part of the NuScale design bases. Under DCA Part 2, Tier 2, Chapter 15.0, the following subsections are presented by the applicant and evaluated by the staff:

15.0.0.1 Initiating Event Selection.

15.0.0.2 Design-Basis Event Classification 15.0.0.3 Licensing Methodology 15.0.0.4 Initial Conditions 15.0.0.5 Limiting Single Failures 15.0.0.6 Equipment Response and Physical Parameter Assumptions 1

15.0.0.7 Multiple Module Events Further, in Part 4 of the DCA, the applicant presented the technical specifications (TS). Several of these TS, listed below, apply to most of the Chapter 15 sections of this SER:

SL 2.1, Safety Limits Limiting Condition for Operation (LCO) 3.1.1, SHUTDOWN MARGIN (SDM)

LCO 3.1.4, Rod Group Alignment Limits LCO 3.1.5, Shutdown Group Insertion Limits LCO 3.1.6, Regulating Group Insertion Limits LCO 3.2.1, Enthalpy Rise Hot Channel Factor LCO 3.2.2, AXIAL OFFSET (AO)

LCO 3.3.1, Module Protection System (MPS) Instrumentation LCO 3.3.2, Reactor Trip System (RTS) Logic and Actuation LCO 3.3.3, Engineered Safety Features Actuation System (ESFAS) Logic and Actuation LCO 3.4.1, RCS Pressure, Temperature, and Flow Resistance Critical Heat Flux (CHF) Limits LCO 3.4.4, Reactor Safety Valves (RSVs)

LCO 3.4.6, Chemical and Volume Control (CVCS) Isolation Valves LCO 3.5.1, Emergency Core Cooling System (ECCS)

LCO 3.5.2, Decay Heat Removal System (DHRS)

LCO 3.5.3, Ultimate Heat Sink LCO 3.7.1, Main Steam Isolation Valves (MSIVs)

LCO 3.7.2, Feedwater Isolation The applicant described its selection of events in DCA Part 2, Tier 2, Section 15.0.0.1. Initiating events are the internal events associated with a single NuScale Power Module (NPM) at power.

A range of power operations is considered if it is thought to be more limiting for meeting the appropriate acceptance criteria. In general, most of the events described in DCA Part 2, Tier 2, Chapter 15, are similar to those at current pressurized-water reactors (PWRs) with some exceptions based on the NuScale design. Design-basis events (DBEs) that are not considered in a typical PWR but are relevant to the NuScale design include loss of containment vacuum, inadvertent operation of the decay heat removal system (DHRS), and inadvertent operation of an ECCS valve. DCA Part 2, Tier 2, Section 15.9, Stability, addresses the reactor coolant 2

system (RCS) thermal-hydraulic stability operating range, but this is considered the response of the reactor following an anticipated operational occurrence (AOO) rather than a separate event.

The applicant stated that, consistent with NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Section 15.0, IntroductionTransient and Accident Analyses, and current light-water reactors (LWRs), the events are categorized into one of seven categories:

(1) increase in heat removal by the secondary system (2) decrease in heat removal by the secondary system (3) decrease in RCS flow rate (4) reactivity and power distribution anomalies (5) increase in reactor coolant inventory (6) decrease in reactor coolant inventory (7) radioactive release from a subsystem or component The DCA Part 2, Tier 2, Table 15.0-1, lists the events selected, the event classification, and the computer codes used for evaluation in DCA Part 2, Tier 2, Sections 15.1 through 15.9. The staff reviewed the table and confirmed that the DBE identification and frequency classification are consistent with the guidance in SRP Section 15.0. The staffs evaluations of the listed DBE analyses are found in their respective sections of this SER. However, in Request for Additional Information (RAI) 9498, Question 15-9, (Agencywide Documents Access and Management System (ADAMS) Accession No. ML18166A306), dated June 16, 2018, the staff asked the applicant if the long-term return to power scenario described in DCA Part 2, Tier 2, Section 15.0.6, should be added to Table 15.0-1 to denote its DBE classification since the scenario can occur within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an abnormal operating occurrence or postulated accident (PA) using design basis. The resolution of this RAI is being tracked as Open Item 15.0.0.1-1.

In DCA Part 2, Tier 2, Section 15.0.0.2, the applicant described how it classified Chapter 15 events. DBE classification by frequency of occurrence is based on four distinct categories:

(1) AOOs (2) infrequent events (IEs)

(3) PAs (4) special events As stated in DCA Part 2, Tier 2, Section 15.0.0.2.1, events that are expected to occur one or more times during an NPM lifetime are classified as AOOs, consistent with the definition in Appendix A, General Design Criteria for Nuclear Power Plants, to Title 10 of the Code of Federal Regulations (10 CFR), Part 50, Domestic Licensing of Production and Utilization 3

Facilities. IEs and PAs are not expected to occur in the lifetime of the plant and allow for the possibility of fuel failure as given by DCA Part 2, Tier 2, Table 15.0-2, Acceptance Criteria Thermal Hydraulic and Fuel. The applicant may choose to evaluate IEs or PAs against AOO acceptance criteria as these criteria are more conservative. In general, the applicant states that events that are not considered to be within the design basis are evaluated in DCA Part 2, Tier 2, Chapter 19; however, those beyond-design-basis events (BDBEs) that are explicitly defined by regulation are addressed in DCA Part 2, Tier 2, Chapters 15 or 8. These events are termed special events.

The NuScale Power Plant design life is 60 years, and the applicant has conservatively interpreted the criterion one or more times in NPM life as including any transient with a frequency of 1X10-2 per year or more. The IE category identifies events that have a frequency of less than 1X10-2 per year but greater than the frequency of PAs. Neither IEs nor PAs are expected to occur in the lifetime of the plant. IEs have more restrictive radiological acceptance criteria than PAs to keep the overall risk approximately constant.

DCA Part 2, Tier 2, Table 15.0-2, gives the thermal-hydraulic acceptance criteria associated with events other than rod ejection and loss-of-coolant accidents (LOCAs). Table 15.0-3, Acceptance Criteria Specific to Rod Ejection Accidents, and Table 15.0-4, Acceptance Criteria Specific to Loss of Coolant Accidents, provide the acceptance criteria for rod ejection and LOCA, respectively. The staff agrees with the applicants acceptance criteria in Table 15.0-2 as they are consistent with Design-Specific Review Standard (DSRS)

Section 15.0. Similarly, the staff agrees with the rod ejection acceptance criteria as they are consistent with SRP Section 4.2, Fuel System Design, Appendix B, Interim Acceptance Criteria and Guidance for the Reactivity Initiated Accidents, and the LOCA criteria in 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors. The staff notes that the applicant has chosen to use the more restrictive AOO acceptance criteria given in Table 15.0-2 for IEs and PAs, except for the rod ejection specific acceptance criteria in SRP Section 4.2. The details of the applicants event-specific acceptance criteria are provided in the specific DCA Part 2, Tier 2, section for each event.

As part of its review, the staff noted that the Rod Ejection Methodology, topical report (TR-0716-50350), dated December 8, 2017, and the Loss-of-Coolant Accident Evaluation, topical report (TR-0516-49422), dated January 9, 2017, were not included in Generic Technical Specifications (GTS) Section 5.6.3, Core Operating Limits Report (COLR), paragraph b, which lists the analytical methods used to determine the parameters in Section 5.6.3, a. These two topical reports are used, in part, to determine the allowed axial offset range (LCO 3.2.2) and the power-dependent insertion limits (LCO 3.1.6) and should be included in the COLR list of references. The staff requested in RAI 9642, Question 16-66 (ADAMS Accession No. ML19105B294), justification as to why the applicant did not include the rod ejection and LOCA topical reports in GTS Section 5.6.3, b. RAI 9642 is being tracked as Open Item 15.0.0.2-1.

The relevant requirements of NRC regulations for this area of review and the associated acceptance criteria are in NUREG-0800, Section 15.0. The relevant requirements are summarized below.

4

• 10 CFR Part 20, Standards for Protection Against Radiation

• 10 CFR Part 50, especially 10 CFR 50.46 and Appendix A

• 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants

• 10 CFR 52.47, Contents of Applications; Technical Information The following General Design Criteria (GDC) from 10 CFR Part 50, Appendix A, are relevant to SRP Section 15.0, IntroductionTransient and Accident Analysis:

• GDC 2, Design Bases for Protection Against Natural Phenomena, as it relates to the seismic design of SSCs whose failure could cause an unacceptable reduction in the capability of the residual heat removal system.

• GDC 4, Environmental and Dynamic Effects Design Bases, as it relates to the requirement that SSCs important to safety be designed to accommodate the effects of and be compatible with the environmental conditions associated with normal operation, maintenance, testing, and PA conditions, including such effects as pipe whip and jet impingement.

• GDC 5, Sharing of Structures, Systems, and Components, as it relates to the requirement that any sharing among nuclear power units of SSCs important to safety will not significantly impair their safety function.

• GDC 10, Reactor Design, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

• GDC 12, Suppression of Reactor Power Oscillations, as it relates to the reactor core and associated coolant, control, and protection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified fuel design limits are not possible or can be reliably and readily detected and suppressed.

• GDC 13, Instrumentation and Control, as it relates to instrumentation and controls provided to monitor variables over anticipated ranges for normal operations, for AOOs, and for accident conditions.

• GDC 15, Reactor Coolant System Design, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.

• GDC 17, Electric Power Systems, as it relates to the requirement that an onsite and offsite electric power system be provided to permit the functioning of SSCs important to safety. The safety function for each system (assuming the other system is not working) shall be to provide sufficient capacity and capability to ensure that the acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary (RCPB) are not exceeded during an AOO and that core cooling, containment integrity, and other vital functions are maintained in the event of an accident.

5

• GDC 19, Control Room, as it relates to the requirement that a control room be provided from which personnel can operate the nuclear power unit during both normal operating and accident conditions, including a LOCA.

• GDC 20, Protection System Functions, as it relates to the reactor protection system being designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that the plant does not exceed SAFDLs during any condition of normal operation, including AOOs.

• GDC 25, Protection System Requirements for Reactivity Control Malfunctions, as it relates to the requirement that the reactor protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control system, such as accidental withdrawal of control rods.

• GDC 26, Reactivity Control System Redundancy and Capability, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded even during AOOs. This is accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

• GDC 27, Combined Reactivity Control Systems Capability, and GDC 28, Reactivity Limits, as they relate to the RCS being designed with an appropriate margin to ensure that acceptable fuel design limits are not exceeded and that the capability to cool the core is maintained.

• GDC 29, Protection Against Anticipated Operational Occurrences, as it relates to the design of the protection and reactivity control systems and their performance (i.e., to accomplish their intended safety functions) during AOOs.

• GDC 31, Fracture Prevention of Reactor Coolant Pressure Boundary, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

• GDC 34, Residual Heat Removal, as it relates to the capability to transfer decay heat and other residual heat from the reactor so that fuel and pressure boundary design limits are not exceeded.

• GDC 35, Emergency Core Cooling, as it relates to the RCS and associated auxiliaries being designed to provide abundant emergency core cooling.

• GDC 55, Reactor Coolant Pressure Boundary Penetrating Containment, as it relates to the isolation requirements of small-diameter lines connected to the primary system.

• GDC 60, Control of Releases of Radioactive Materials to the Environment, as it relates to the radioactive waste management systems being designed to control releases of radioactive materials to the environment.

• GDC 61, Fuel Storage and Handling and Radioactivity Control, as it relates to the requirement that the fuel storage and handling, radioactive waste, and other systems that may contain radioactivity be designed to ensure adequate safety under normal and PA conditions.

6

The applicant incorporated the above criteria in DCA Part 2, Tier 2, Section 3.1.1, Overall Requirements, which the staff finds acceptable.

DCA Part 2, Tier 2, Table 15.0-6, Module Initial Conditions Ranges for Design Basis Event Evaluation, establishes the range of initial conditions that are assumed in DCA Part 2, Tier 2, Chapter 15. The values presented in Table 15.0-6 are common to all Chapter 15 events, except where noted in the individual sections. The staff reviewed Table 15.0-6 and found that it identifies the important input parameters and establishes the range of conditions used in DCA Part 2, Tier 2, Chapter 15, which is consistent with the guidance in SRP Section 15.0. In a letter dated April 15, 2019 (ADAMS Accession No. ML19105B292), NuScale informed the staff of a design change to the DHRS and ECCS actuation logic. The staff has not fully reviewed the changes to the DHRS and ECCS actuation logic and the enclosed DCA markups but notes that DCA Part 2, Tier 2, Table 15.0-7, Analytical Limits and Time Delays, has an entry for Low RPV Riser Level Range, which may need to be modified as the staffs understanding that this trip setpoint is no longer credited in the LOCA analysis. The effect of the DHRS and ECCS actuation logic has not been evaluated for Chapter 15 topics and is being tracked as Open Item 15.0.0.4-1.

Appendix A to 10 CFR Part 50 describes a single failure as an occurrence that results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure consistent with 10 CFR Part 50, Appendix A. SRP Section 15.0.6.B, Sequence of Events and System Operation, states that the single failure criterion (SFC) applies to safety-related systems or components used to mitigate AOOs or PAs.

DCA Part 2, Tier 2, Section 15.0.0.5, states that a component that changes position or state to achieve its safety function is considered an active component, while a component that does not change position or state to achieve its safety function is considered a passive component.

The applicant also considers failure of a check valve an active failure and subject to the SFC consistent with SECY-94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non-Safety Systems (RTNSS) in Passive Plant Designs, dated March 28, 1994 (ADAMS Accession No. ML003708068).

During its review, the staff found that the applicant did not apply the SFC to the inadvertent actuation block (IAB) valve. The staff considers the IAB valve to be a safety-significant, first-of-a-kind design feature of the NuScale ECCS. Unlike a simple check valve, for which there is substantial operating experience, NuScales IAB valve is a spring-operated differential-pressure valve that is more complex than a simple check valve and subject to uncertainties. On May 22, 2017, the staff issued RAI 8815, Question 15-2 (ADAMS Accession No. ML17142A249), asking NuScale to provide justification for not applying single-failure considerations to the IAB valve. A key consideration is whether the IAB valve performs a passive function that is not subject to the SFC or an active function that is subject to the SFC.

The staff considers the functions that the IAB valves perform in the NuScale reactor design during transient and accident scenarios to be active functions subject to the SFC in accordance with current Commission policy.

7

In a letter to the Commission dated December 14, 2018 (ADAMS Accession No. ML18351A145), NuScale presented its position that the closing function of the IAB valve should either be treated as passive or that it performs an active function not subject to the SFC.

After considering that letter and other information presented as part of the DCA review, the staff maintains that the IAB valve is an active component subject to the SFC as described in SECY-77-439, Single Failure Criterion, dated August 17, 1977 (ADAMS Accession No. ML060260236). Therefore, the staff prepared SECY-19-0036 (ADAMS Accession No. ML19060A162), asking the Commission for direction on how to treat the IAB. If the Commission decides that the IAB is subject to the SFC, the applicant may need to revise DCA Part 2, Tier 2, Chapter 15, and reanalyze the sequence and consequence of most events. This issue is being tracked as Open Item 15.0.0.5-1.

Passive failures can be initiating events, such as the assumed mechanical failure of a reactor vent valve (RVV)/reactor recirculation valve (RRV) in DCA Part 2, Tier 2, Section 15.6.6, but passive failures of fluid systems are considered only on a long-term basis, which the applicant defines as greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation. The staff agrees that passive fluid system failures do not have to be considered in the short term based on SECY-77-439.

Components whose proper function has been demonstrated and documented consistent with SECY-94-084 are not considered credible single failures.

Active and passive failures are considered for electrical components. Protective actions must be accomplished in the presence of a single detectable failure. The effects of nondetachable failures are considered concurrently as part of the most-limiting single failure.

DCA Part 2, Tier 2, Chapter 15, evaluates a range of available power assumptions. The range of electrical power assumptions, as discussed in Section 15.0.0.6.2 of this SER and evaluated for each event, is not considered a single failure but a result of the non-Class 1E power system design. Therefore, the worst single failure of a component is assumed for each power system availability assumption.

Operator errors are considered as initiating events consistent with the guidance given in SRP Section 15.0. The applicant stated that an error of omission is not relevant as the design is such that no operator action is necessary to mitigate a DBE for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The applicant also stated that errors of commission, where no operator action is necessary, but an erroneous action is taken, are bounded by the worst case single-failure assumption. In response to RAI 8758, Question 18-1 (ADAMS Accession No. ML18134A352), the applicant gave the following reasons why a single failure of a safety-related SSC bounds an operator error of commission:

• Single actions taken on safety-related SSCs are bounded by the SFC since a safety-related SSC cannot be affected by a single action from the main control room (MCR), with the exception of initiating an engineered safety feature (ESF).

• Control room operators cannot manipulate safety-related SSCs except through the use of the module protection system (MPS) hard-wired manual actuation switches located at the standup panel for each unit. Operation of any of these switches is infrequent, is directed by procedure, and normally requires a prior peer-check.

• Operation of these switches is also expected to receive supervisory oversight, and because of the switches location, their operation is conspicuous to the operating crew.

8

• An operator cannot override the MPS either before or after initiation, with the exception of containment isolation override to support either adding inventory to the reactor vessel using the chemical and volume control system (CVCS) or to the containment using the containment flooding and drain system (CFDS).

• Once an MPS setpoint is reached, the associated safety-related SSCs will transition to their single safety position. The containment isolation override function is required only during highly improbable BDBEs, which are addressed in Chapter 19 and are beyond the scope of this RAI response, which is for Chapter 15 events only.

• The containment isolation override function requires multiple deliberate steps, which are directed by procedures. The Conduct of Operations and generally accepted industry standards on human performance and use of error reduction tools ensure that a peer check and proper supervisory oversight would be provided to complete this Important Human Action. To accidentally perform this action in error or to complete this action on the wrong unit is not deemed credible.

The Chapter 15 analysis models normal operation of systems that are not safety-related that increase the consequences of the event. Normal operation of systems that are not safety-related that improve (decrease) the consequences of the event are not modeled. Therefore, an operator act of commission performed in error on SSCs that are not safety-related, that increases the consequences of the event, is bounded in the Chapter 15 analysis.

Multiple operator errors or errors that result in common-mode failures are considered beyond design basis events. Chapter 19 analyzes these events.

The determination that operator errors of commission are bounded by a single failure of a safety-related SCC is dependent on the design of the manual operator capabilities and the likelihood of an erroneous operator action. Section 18.10.4.4.2.4.2 of this SER presents a detailed evaluation of the likelihood of performing operator actions erroneously.

For a particular transient, the limiting single failure for one acceptance criterion may be different than the limiting single failure for a different acceptance criterion for the same DBE. The limiting single failures for Chapter 15 events are described with the event analysis and are identified in Table 15.0-9. The staff evaluates these failures described in each of the subsections of DCA Part 2, Tier 2, Chapter 15.

DCA Part 2, Tier 2, Section 15.0.0.6, addresses control rod assembly insertion characteristics, decay heat, ESF characteristics, and required operator actions.

The time for inserting control rods directly affects the amount of heat that must be removed from the core in response to a DBE. Section 4.3 of the SRP describes the analytical basis for the control rod assembly insertion rates and reactivity effect as a function of time. The analyses for the Chapter 15 DBEs apply additional conservatism to the reactivity insertion rate provided in Section 4.3 to bound potential plant operating conditions. DCA Part 2, Tier 2, Figure 15.0-1, shows the normalized control rod position versus time, and Figure 15.0-2 shows the normalized SCRAM reactivity worth versus time. The use of bounding insertion times provides conservative results for DBE analyses. The TS specify drop-time testing requirements.

9

Bounding values for decay heat are designated to represent the maximum decay heat of the core following an event and conservative minimum decay heats for the cooldown events.

The 1973 American Nuclear Society (ANS) decay heat standard is used in NuScale Reactor Excursion and Leak Analysis Program, Version 5 (NRELAP5) to represent bounding decay heat. The LOCA methodology calculates fission product decay heat using a bounding form of the 1973 ANS decay heat standard with a 20-percent uncertainty added to the base value. A bounding form of the 1973 ANS standard in NRELAP5 is conservative relative to the 1971 ANS standard specified in 10 CFR Part 50, Appendix K, ECCS Evaluation Models. The applicant requested an exemption from 10 CFR Part 50, Appendix K. The staffs evaluation of this exemption is in Section 15.0.2 of this SER.

For non-LOCAs, the model also uses the conservative 1973 ANS decay heat standard, which is varied by utilizing different decay heat multipliers and specifying whether to include the actinide contribution.

The following decay heat multipliers are used:

Minimum = use multiplier of 0.8 while excluding the actinide contribution Maximum = use multiplier of 1.0 while including the actinide contribution The acceptability of the multipliers used for the non-LOCA analyses are evaluated in the staffs SER of the Non-Loss-of-Coolant Accident Analysis Methodology, topical report (TR-0516-49416, Rev. 1), dated December 8, 2017, which is being tracked as Open Item 15.0.2-4.

NuScale ESF systems include the containment systems (Section 6.2), ECCS (Section 6.3), and DHRS (Section 5.4.3) as described in the DCA Part 2, Tier 2. The DHRS provides cooling for non-LOCA DBEs when normal secondary-side cooling is unavailable or otherwise not used.

The DHRS is designed to remove post reactor trip residual and core decay heat from operating conditions and transition the NPM to safe-shutdown conditions without reliance on external power. DCA Part 2, Tier 2, Section 5.4.3, provides additional description of the DHRS. In conjunction with the containment heat removal function of containment, the ECCS provides a means of core decay heat removal for LOCAs that exceed makeup capability or during loss of both trains of the DHRS, which is a beyond-design-basis condition. The DHRS provides an additional capacity to remove decay heat during the initial blowdown period of a LOCA but is not credited in the LOCA model.

The ECCS valves and the DHRS do not rely on electrical power or on non-safety-related support systems for actuation. After actuation, the valves do not require a subsequent change of state or continuous availability of power to maintain their intended safety functions. One RRV and two RVVs are required for successful ECCS operation. If the redundant direct current (dc) power to the MPS or the ECCS and DHRS valve actuators is lost, the valves actuate. The ECCS valves open once RCS pressure goes below the IAB pressure-locking threshold.

The ability to successfully mitigate non-LOCA events using the DHRS, and LOCAs (including long-term cooling (LTC)), using the ECCS, is evaluated as part of the staffs overall DCA Part 2, Tier 2, Chapter 15, review.

10

Required Operator Actions The applicant stated that no operator actions are credited to mitigate DBE for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> assuming the worst single failure. The staff will evaluate the ability of the design to mitigate DBE without operator action as part of the overall DCA Part 2, Tier 2, Chapter 15, review.

Availability of Offsite Power Normal alternating current (ac) power systems are not safety-related and not credited to mitigate Chapter 15 events. The normal ac power systems consist of the following:

• EHVS (high-voltage (13.8-kilovolt (kV)) ac electrical system and switchyard),

• EMVS (medium-voltage (4.16-kV) ac electrical distribution system), and

• ELVS (low-voltage (480-volt (V) and 120-V) ac electrical distribution system).

The onsite dc power systems are not safety-related and not credited to mitigate Chapter 15 events. The dc power systems consist of the following:

• EDSS (highly reliable dc power system to supply essential loads) and

• EDNS (normal dc power system to supply nonessential loads).

The loss of normal ac power causes the MPS to initiate a reactor trip, actuate the DHRS, and close the containment isolation valves. The loss of normal power also causes the loss of the EDSS chargers causing the EDSS to rely on backup batteries. At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the MPS load sheds the ECCS valves causing them to open to the fail-safe position; RCS coolant is discharged into containment when the IAB pressure threshold is reached. As no power systems in the design are safety-related, several loss of power scenarios are evaluated to ensure that the DCA Part 2, Tier 2, Chapter 15, acceptance criteria are met. The applicant evaluated the following loss of power scenarios:

• Loss of normal ac either at the time of the initiating event or at the time of the turbine trip.

After 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the ECCS valves move to their fail-safe open position.

• Loss of normal dc power (EDNS) and normal ac. Power to the reactor trip breakers is provided via the EDNS, so this scenario is the same as a loss of normal ac with the addition of reactor trip at the time power is lost.

• Loss of the highly reliable dc power system (EDSS), EDNS, and normal ac. This scenario results in a reactor trip, actuation of DHRS, and closure of containment isolation valves. The ECCS valves move to their fail-safe open position when RCS pressure drops below the IAB pressure threshold.

Also evaluated are the scenarios in which power, ac or dc, remains, if the consequences of the event are more limiting.

11

Treatment of Systems that Are Not Safety-Related Systems that are not safety-related are assumed to function if their normal operation is assumed to increase the consequences associated with the event and are not assumed to change state to lessen or mitigate the consequences of the event.

The applicant stated that the treatment of non-safety-related systems for the DBE is as follows:

• The failure of a non-safety-related system in normal operation that increases the consequences of the event is modeled.

• The failure of a non-safety-related system in normal operation that improves the consequences of the event is not modeled.

• The failure of a non-safety-related system in normal operation that does not significantly alter the consequences of the event may be modeled.

• The failure in the worst-state condition of a non-safety-related system is not assumed except as an event initiator.

• Non-safety-related equipment is evaluated to consider the licensing basis assumptions for the events, including external events, environmental effects, and offsite and onsite power availability.

The above criteria are consistent with those discussed in SRP Section 15.0.6.B, which specifies that only safety-related systems or components are used in mitigating AOOs and PAs.

The SRP Section 15.0.6.B does state that the reviewer may consider the licensees technical justifications for the operation of systems or components that are not safety-related, for example, when used as backup protection and when not disabled, except by a detectable, random, and independent failure. The applicants design uses equipment that is not safety-related as a backup to safety-related equipment in the three following areas:

(1) The non-safety-related secondary MSIV serves as the backup isolation device to the safety-related MSIV for isolation of the main steam piping penetrating containment when the safety-related MSIV is assumed to fail.

(2) The non-safety-related feedwater regulating valve (FWRV) serves as the backup isolation device to the safety-related feedwater isolation valve (FWIV) for isolation of the feedwater system (FWS) piping penetrating the containment when the FWIV is assumed to fail.

(3) The non-safety-related feedwater check valve serves as the backup isolation device to the safety-related feedwater check valve for isolation of the DHRS when reverse flow is experienced during a break in the FWS piping.

The basis for relying on a component that is not safety-related to serve as a backup to a safety-related component is described in NUREG-0138, Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff, issued November 1976 (ADAMS Accession No. ML13267A423).

12

As discussed in NUREG-0138, Issue 1, the staff found it acceptable to credit the control and stop valves, which are not safetyrelated, during a main steamline break event based on the consequences being less than those of a LOCA and the combined reliability of the turbine stop and control valves being similar to that of a safety-related component. NUREG-0138, Issue 1, states that valves that are not safety-related can be used as a backup to safety-related valves in the FWS, assuming that the same evaluation criteria (i.e., reliability and consequence) apply.

The staff asked the applicant for additional information as to why it is acceptable to credit the backup valves that are not safety-related to meet the SFC for events listed in Table 15.0-9. This question was asked in RAI 8744, Question 15.02.08-4; RAI 9205, Question 15-3; RAI 9237, Question 15.06.03-3; and RAI 9420, Question 15-17. The staff notes, as discussed in RAI 9237, that crediting the secondary MSIV to mitigate a steam generator (SG) tube rupture is an extension of NUREG-0138, Issue 1, as tube rupture is the breach of the primary system pressure boundary not previously addressed by the staff. The applicant stated in its February 2, 2018, response to RAI 9420, Question 15-17 (ADAMS Accession No. ML18190A509), and its supplement, dated November 20, 2018 (ADAMS Accession No. ML18324A889), that these valves would have enhanced design, surveillance, and operability requirements, including appropriate quality and testing requirements, and that their use would be consistent with Regulatory Guide (RG) 1.206, Applications for Nuclear Power Plants, and previous staff positions based on other recent DCAs. The information provided by the applicant satisfactorily addressed the staffs question regarding NUREG-0138. The staffs evaluation of crediting the non-safety-related secondary MSIV for an SGTF event is in Section 15.6.3 of this report. (See Section 3.9.6 of this report for the staffs review of the augmented quality and testing requirements applied to these components). Based on the above response, RAI 9420, Question 15-17, is a confirmatory item pending incorporation of changes to DCA Part 2, Tier 2, Table 3.2-1.

As systems that are not safety-related are not used to mitigate an AOO or PA, except to serve as a backup function to safety-related components, the staff finds the applicants use of equipment that is not safety-related acceptable.

Chapter 15 DBEs are analyzed for a single NPM. DCA Part 2, Tier 2, Chapter 21, discusses the suitability of shared components and the design measures taken to ensure that these components do not introduce multimodule risks. The only safety-related shared system is the ultimate heat sink, which is evaluated in SER Section 9.2.5. Shared systems that are not safety-related are not credited in the NuScale transient and accident analyses; however, the failure of these systems is considered in the staffs evaluation presented in this SER chapter. In addition, Section 19.1 discusses the evaluation of multimodule events.

Radiological Consequence Using Alternative Source Terms The SRP Section 15.0.1 is focused on the application of alternative source terms to operating reactors and is not applicable to the NuScale SMR design certification review. Staffs evaluation of the NuScale design basis accident (DBA) radiological consequence analyses is discussed in Section 15.0.3 of this SER.

13

Review of Transient and Accident Analysis Methods DCA Part 2, Tier 2, Section 15.0.2, summarizes the analysis methods and computer codes used in non-LOCA safety analyses, LOCA evaluations, and post-LOCA LTC evaluations. In addition, DCA Part 2, Tier 2, Table 15.0-10, Referenced Topical and Technical Reports, lists the topical or technical reports used as the basis for analysis of each AOO and PA. The following SER section summarizes the methodology and computer codes used for relevant DBEs. Several different license methodologies are required to provide the neutronic, thermal-hydraulic, and radiological responses of the plant to AOOs, PAs, and IEs. DCA Part 2, Tier 2, Table 15.0-1, lists the computer codes used for each DBE.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.0.2, summarized as follows.

The DCA Part 2, Tier 2, Section 15.0.2.1, describes the licensing methodology relevant to transient and accident analyses for non-LOCA, LOCA, and LTC events. In DCA Part 2, Tier 2, Sections 15.1 through 15.6.4, and 15.6.6 through 15.9 describe safety analyses for non-LOCA events. DCA Part 2, Tier 2, Section 15.6.5 describes the safety analysis for LOCA events. The NuScale LOCA evaluation model (EM) was designed to meet the applicable requirements of 10 CFR Part 50, Appendix K, with some exceptions as described in the related Appendix K exemption request evaluated in Section 15.0.2.4.1 of this report, and the 10 CFR 50.46 acceptance criteria. The non-LOCA analysis methodology was then designed to build on the NRELAP5 LOCA EM.

In DCA Part 2, Tier 2, Section 15.0.2, the applicant described the analytical methods and computer programs used in non-LOCA safety analysis, LOCA evaluation, post-LOCA LTC evaluation, and other AOOs as detailed below.

Loss-of-Coolant Accident Methodology The DCA Part 2, Tier 2, Section 15.6.5, states that LOCA analyses are performed using NRELAP5, as described further below. DCA Part 2, Tier 2, Table 1.6-1, incorporates by reference TR-0516-49422, Loss-of-Coolant Accident Evaluation Model, Revision 0, issued December 2016 (ADAMS Accession No. ML17004A138). TR-0516-49422 uses the NuScale NRELAP5 systems computer code that is a modification and extension of the Idaho National Laboratory RELAP5-3D computer code. As described in TR-0516-49422, the applicant modified selected models and correlations to address unique features and phenomena of the NPM design and comply with the requirements of 10 CFR Part 50, Appendix K. The applicant requested exemptions from 10 CFR Part 50, Appendix K, requirements that the applicant believes are not applicable to the NuScale design in Part 7, Exemptions, of the DCA.

NRELAP5 employs a combination of proven RELAP5 features, models, and components as well as new and advanced features and components requiring new correlations and models to simulate the needed operating conditions and component system behavior. Of particular importance is the use of the containment vessel (CNV) as an integral part of the ECCS, the 14

modeling of condensation under high-pressure conditions, and the addition of a new hydrodynamic component for the helical coil SGs.

TR-0516-49422 is based on the deterministic ECCS performance calculation approach detailed in Appendix K to 10 CFR Part 50 and 10 CFR 50.46(a)(ii). Since the NPM is designed so that there is no core uncovery or heatup for design-basis LOCAs, the applicant indicated significant margins to the peak cladding temperature (PCT) and the other criteria (10 CFR 50.46(b)(2) through (b)(4)), such that the relevant figures of merit are not PCT but (1) collapsed liquid water level in the core, (2) the critical heat flux ratio (CHFR), and (3) containment pressure and temperature. Additionally, since the NPM is designed not to reach core uncovery, the applicants LOCA methodology does not address post-CHF heat transfer phenomena, including cladding oxidation, hydrogen production, or clad geometry changes such as swell and rupture.

This is reflected in the requested exemption from the requirements in 10 CFR Part 50, Appendix K, as follows: I.A.4 (decay heat model), I.A.5 (Baker-Just equation for metal-water reaction), I.B (cladding swelling and rupture), I.C.1.b (Moody model for two-phase discharge),

I.C.5.a (post-CHF heat transfer modeling), and I.C.7.a (channel cross-flow during blowdown).

The progression of the LOCA event for the NPM is slower than for conventional PWRs since break sizes are significantly smaller. In addition, the ECCS includes venting RVVs and recirculation RRVs that open to remove core decay heat by establishing stabilized recirculating flow from the containment back to the reactor pressure vessel (RPV) via boiling in the core and condensing in the CNV. TR-0516-49422 addresses the first four criteria of 10 CFR 50.46(b),

and technical report TR-0916-51299, Long Term Cooling Methodology, Revision 0, issued January 2017 (ADAMS Accession No. ML17009A490), which is incorporated by reference in DCA Part 2, Tier 2, Table 1.6-2, addresses the LTC requirement of 10 CFR 50.46(b)(4) and (b)(5) for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of a LOCA. TR-0916-51299 is a continuation of the LOCA methodology with modifications added to run simulations out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to show that cooling temperatures and pressures are adequately low with no credit for operator action.

Non-Loss-of-Coolant Accident Methodology DCA Part 2, Tier 2, Section 15.0.2.1, states that the non-LOCA analysis methodology builds on the NRELAP5 LOCA model. Additionally, DCA Part 2, Tier 2, Section 15.0.2.1, references TR-0516-49416, Non-Loss-of-Coolant Accident Analysis Methodology, Revision 1, issued August 2017 (ADAMS Accession No. ML17222A827). TR-0516-49416 describes event-specific methodologies for non-LOCA events including initial condition and parameter biases that present the greatest challenge to acceptance criteria. The report does not include evaluation of the minimum critical heat flux ratio (MCHFR) or radiological consequences, but it does describe the interface with the downstream subchannel and accident radiological analyses.

Flow Instability DCA Part 2, Tier 2, Section 15.0.2.2.3, states that the NuScale proprietary code, PIM, is used to demonstrate system stability at steady-state operation. Additionally, Section 15.0.2.2.3 references Topical Report (TR)-0516-49417, Evaluation Methodology for Stability Analysis of NuScale Power Module, Revision 0, issued July 2016 (ADAMS Accession No. ML16250A851).

Subchannel Analysis DCA Part 2, Tier 2, Section 15.0.2.3, states that subchannel analyses are performed using VIPRE-01 (Versatile Internals and Component Program for Reactors; EPRI) with the NuScale-15

specific critical heat flux (CHF) correlations. Additionally, Section 15.0.2.3 references TR-0915-17564, Subchannel Analysis Methodology, Revision 1, issued February 2017 (ADAMS Accession No. ML17046A333), and TR-0116-21012, NuScale Power Critical Heat Flux Correlations, Revision 1, issued December 2018 (ADAMS Accession No. ML18360A632).

Radiological Consequence Analysis Methodology for the Design-Basis Accident NuScale performed its DBA radiological consequence analyses using the RADionuclide Transport, Removal, and Dose (RADTRAD) computer code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.3. Section 15.0.3 of DCA Part 2, Tier 2, describes the use of RADTRAD and the radiological EM. Several codes provided information for input to the RADTRAD code calculations. The applicant calculated short-term accident atmospheric dispersion factors using the Atmospheric Relative CONcentrations in Building Wakes ARCON96 (ARCON96 in Building Wakes, 1996) computer code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.2. The applicant used the STARNAUA aerosol transport and removal code to calculate aerosol removal coefficients to model aerosol natural deposition in containment, as described in DCA Part 2, Tier 2, Section 15.0.2.4.5. The applicant developed the NuScale pHT code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.6, to calculate the post-accident time-dependent pH in containment to provide information to support the DBA dose analysis assumptions. The applicant used the MCNP (Monte Carlo N-Particle) code to evaluate the direct gamma radiation dose to operators in the control room, as described in DCA Part 2, Tier 2, Section 15.0.2.4.7.

DCA Part 2, Tier 2, Table 1.6-1, incorporates by reference NuScale topical report TR-0915-17565, Accident Source Term Methodology, which describes the applicants use of the ARCON96, STARNAUA, and pHT computer codes in the methodology for evaluation of the DBA radiological consequences.

ITAAC: There are no inspection, test, analysis, and acceptance criteria (ITAAC) items for this area of review.

Technical Specifications: The TS associated with DCA Part 2, Tier 2, Section 15.0.2, are related to analytical methods used to determine core operating limits and are described in Part 4 of the applicants Standard Plant DCA, Generic Technical Specifications, Reporting Requirement 5.6.3, Core Operating Limits Report.

Technical Reports: The applicable technical reports associated with this section are listed in DCA Part 2, Tier 2, Table 15.0-10.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR 52.47, Contents of Applications; Technical Information, and 10 CFR 52.79, Contents of Applications; Technical Information in Final Safety Analysis Report, require an FSAR to describe and analyze the design and performance of SSCs. The evaluation methodologies described in DCA Part 2, Tier 2, Section 15.0.2, form a partial basis for demonstrating compliance with the regulations identified in Section 15.0.0.3 of this SER.

• 10 CFR Part 50, Appendix K, provides the required and acceptable features of EMs.

16

Loss-of-Coolant Accident Methodology The staffs review of TR-0516-49422 will be documented in the SER for the topical report. In response to RAI 9325, Question 15.00.02-1, the applicant discussed a planned revision to the LOCA topical report to update NRELAP5 calculations and results because of a transition from NRELAP5 Version 1.3 to Version 1.4, as well as a new NPM base model.

The NRELAP5 code and input models used are key components of the applicants methodology. Since TR-0516-49422 was based on NRELAP5 Version 1.3 and the applicant indicated a transition to Version 1.4, the staff is reviewing this version change as it applies to the associated TR.

Additionally, in September 2018, NuScale submitted a newly developed Appendix B to expand the LOCA TR scope to cover the methodology for the EM for inadvertent opening of RPV valves. The staffs evaluation of the methodology relative to these requirements and the calculational framework established in RG 1.203 will be documented in the SER for TR-0516-49422. The staffs evaluation of TR-0516-49422 is ongoing and is being tracked as Open Item 15.0.2-2.

The staff also notes that NRELAP5 models used to support the Chapter 15 accident analysis were built from a base model that did not account for small geometry and design changes in the NPM. On April 5, 2018, the staff issued RAI 9325, Question 15.00.02-1 (ADAMS Accession No. ML18095A796), asking the applicant to reconcile the changes made in the NPM design to the NRELAP5 input models analyses in the DCA. The applicants response, provided by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), clarified that (1) changes affecting individual Chapter 15 events have been submitted as DCA markups associated with RAI responses, and (2) outstanding DCA analyses will be provided as part of the DCA Part 2, Tier 2, Chapter 15, Revision 3, submittal. The NRC staff is tracking this issue as Open Item 15.0.2-1.

Exemption from 10 CFR Part 50, Appendix K, Emergency Core Cooling System Evaluation Model The staff reviewed the applicants request for exemption from certain requirements of 10 CFR Part 50, Appendix K, as described in DCA Part 7, Section 10.1.2, related to certain phenomena not encountered in the NuScale NPM during a LOCA because of the NPM design. The applicant stated that the underlying purpose of the rule is met because the NPM has been designed to avoid those phenomena, and the model conservatively calculates the consequences of postulated LOCAs from a spectrum of pipe break sizes and locations. The specific requirements in 10 CFR Part 50, Appendix K, from which the applicant requested exemption are the following:

• I.A.4, as it relates to the heat generation rates from radioactive decay of fission products.

• I.A.5, as it relates to the rate of energy release, hydrogen generation, and cladding oxidation from the metal/water reaction.

• I.B, with respect to inclusion of a provision for predicting cladding swelling and rupture.

17

• I.C.1.b, with respect to calculation of the discharge rate for all times after the discharging fluid has been calculated to be two-phase.

• I.C.5.a, with respect to Post-CHF correlations of heat transfer from the fuel cladding to the surrounding fluid.

• I.C.7.a, with respect to calculation of cross-flow between the hot and average channel regions of the core during blowdown.

As stated in 10 CFR 52.7, Specific Exemptions, [t]he Commissions consideration of requests for exemptions from requirements of the regulations of other parts in this chapter, which are applicable by virtue of this part, shall be governed by the exemption requirements of those parts. The exemption requirements for 10 CFR Part 50 regulations are found in 10 CFR 50.12, Specific Exemptions. As 10 CFR 50.12 states, an exemption may be granted when (1) the exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security and (2) special circumstances are present. Specifically, 10 CFR 50.12(a)(2) lists six circumstances for which an exemption may be granted. One of these bases must be present for the NRC to consider granting an exemption request.

Authorized by Law The NRC has authority under 10 CFR 52.7 and 10 CFR 50.12 to grant exemptions from the requirements of this regulation. Therefore, the requested exemption is authorized by law.

No Undue Risk to Public Health and Safety The staff review of the exemption request to determine if the exemption would present an undue risk to the public health and safety (10 CFR 50.12(a)(1)) is ongoing. In its exemption request, the applicant stated that it has designed the NuScale Power Plant to avoid those phenomena covered by the requirements of 10 CFR Part 50, Appendix K. The applicant further stated that the model conservatively calculates the consequences of postulated LOCAs from a spectrum of pipe break sizes and locations.

TR-0516-49422 is still under NRC staff review, and therefore, the staff cannot yet confirm whether the model conservatively calculates the consequences of postulated LOCAs (Open Item 15.0.2-2).

Further, the results of the LOCA analyses, discussed in Section 15.6.5 of this SER, remain under review to confirm that no post-CHF phenomena will occur to invalidate the applicants stated justification for the exemption request (i.e., certain Appendix K requirements are not modeled because they are precluded by the design of the NPM). Further, in public meetings held on January 23, 2019, and February 19, 2019 (ADAMS Accession Nos. MLXXXXXXXXX and MLXXXXXXXXX, respectively) on RAI 9496, Question 15-19, which requested rewording of principal design criterion (PDC) 27, Combined Reactivity Control Systems Capability, the applicant clarified how it intends to use the CHF criteria during a potential return to power. As discussed in Section 15.0.6 of this SER, a potential return to power could occur following ECCS actuation. Although the current analysis of events described in DCA Part 2, Tier 2, Chapter 15, uses CHF as the acceptance criteria for all AOOs and PAs, including LOCAs, the applicant stated that it did not intend to limit the acceptance criteria to CHF for the initial PA in its design basis. The applicant intended only the subsequent return to power portion of a PA to be subject 18

to CHF criteria. Based on this information, the staff cannot yet complete its review of an exemption to Appendix K without the elements of the EM necessary to conservatively calculate the consequences of postulated LOCAs for phenomena that may reach post-CHF. The review of this exemption request to Appendix K therefore remains open. This is Open Item 15.0.2-3.

Consistent with Common Defense and Security The requested exemption is consistent with the common defense and security (10 CFR 50.12(a)(1)). The exemption does not affect the design, function, or operation of structures or plant equipment that are necessary to maintain the secure status of the plant. The proposed exemption has no impact on plant security or safeguards procedures. Therefore, the requested exemption is consistent with the common defense and security.

Special Circumstances At this time, the staff cannot determine if special circumstances exist because of the open items identified in Section 15.0.2 of this SER. The staff cannot determine if the NuScale design precludes the underlying phenomena during a postulated LOCA or if the alternative model features conservatively account for the processes and phenomena experienced by the NPM during a postulated LOCA.

Non-Loss-of-Coolant Accident Methodology TR-0516-49416 is currently under staff review. The staff is tracking this as Open Item 15.0.2-4.

In addition, Open Item 15.0.2-1 applies to the review of non-LOCA events.

Flow Instability TR-0516-49417 is currently under NRC staff review and is being tracked as Open Item 15.0.2-5.

Subchannel Analysis The staffs review and approval of the subchannel and CHF correlation methodologies are documented in the safety evaluations of TR-0915-17564 and TR-0116-21012. The staff notes that DCA Part 2, Tier 2, Section 15.0.2.3, needs to be updated to reference the approved version of TR-0915-17564 (ADAMS Accession No. ML19067A256). The staff is tracking this update to the DCA as Confirmatory Item 15.0.2-1.

Radiological Consequence Analysis Methodology for the Design-Basis Accident The NRC developed the RADTRAD code to evaluate the radiological consequences of DBAs, perform confirmatory analyses, and determine the acceptability of licensee and applicant DBA radiological consequence analyses. Therefore, the staff finds the code acceptable for use in performing DBA radiological consequence analyses. MCNP is a general-purpose code used widely to calculate neutron, photon, electron, or coupled neutron, photon, and electron transport. The staff finds it acceptable for use in calculating direct radiation doses.

The staffs review of the use of ARCON96, STARNAUA, and pHT as part of NuScales methodology (described in TR-0915-17565) for performing DBA radiological consequence analyses is ongoing and is being tracked as Open Item 15.0.2-6.

19

There are no combined license (COL) information items associated with DCA Part 2, Tier 2, Section 15.0.2.

Based on the open items discussed above, no conclusions can be reached regarding the NuScale analysis methods and computer codes used in non-LOCA safety analyses, LOCA evaluations, and post-LOCA LTC evaluations consistent with the requirements in 10 CFR 52.47, 10 CFR 52.79, and 10 CFR Part 50, Appendix K.

Radiological Consequences of Design-Basis Accidents This section of the report describes the staffs evaluation of the information provided in Chapter 15, Transient and Accident Analysis, that describes the evaluation of those DBAs that are projected to result in radiological consequences.

15.0.3.2 Summary of Application NuScales analyses of the radiological consequences of design basis accidents reference the accident source term methodology described in NuScale topical report TR-0915-17565, Accident Source Term Methodology. On May 16, 2018, NuScale submitted a white paper, NuScale Power, LLC Submittal of WP-0318-58980, Accident Source Terms Regulatory Framework, (ADAMS Accession No. ML18136A850) to describe proposed revisions to the accident source terms methodology topical report TR-0915-17565, Accident Source Term Methodology, Revision 2 (ADAMS Accession No. ML17254B068) and associated sections of the NuScale DCA Part 2, Revision 2. After several meetings on the proposed changes to the accident source term methodology and related analyses, NuScale submitted a revision to the white paper on January 31, 2019 (ADAMS Accession No. ML19032A146), with their revised plan forward to make the proposed revisions. Revision 3 of the topical report was submitted April 21, 2019, and proposed revisions to related DCA Part 2 Sections were submitted on April 19, 2019, and May 22, 2019. Because the staff has not fully reviewed TR-0915-17565, Revision 3, and the associated revisions in DCA Part 2, Revision 3, the description of the application information below is based on DCA Part 2, Revision 2. The part of the discussion below that is in red text will change once the staff has completed its review of TR-0915-17565, Revision 3, and the associated revisions in DCA Part 2, Revision 3.

DCA Part 2, Tier 1: The DCA Part 2, Tier 1, information associated with this section is found in DCA Part 2, Tier 1, Section 5.0, Site Parameters.

DCA Part 2, Tier 2: In DCA Part 2, Tier 2, Chapter 15, the applicant performed radiological consequence assessments for six reactor design basis accidents, using hypothetical site parameter atmospheric relative concentration (dispersion) values (/Q values) for accidents.

Because all other aspects of the design are fixed, these /Q values help determine the required minimum distances to the exclusion area boundary (EAB) and the low population zone (LPZ) for a given site in order to provide reasonable assurance that the radiological consequences of a DBA will be within the siting dose criteria given in regulation, as identified below.

20

The NuScale DCA Part 2, Tier 2, Sections 15.0.3, 15.1.5, 15.4.8, 15.6.2, 15.6.3, 15.6.5, 15.7.4, 15.7.5, and 15.7.6, with multi-module considerations discussed in Section 21.3.1.2, provide discussion of the DBA radiological consequences analyses. The DBAs analyzed for radiological consequences include:

• Failure of small lines carrying primary coolant outside containment (DCA Part 2, Tier 2, Sections 15.0.3.8.1 and 15.6.2).

• Steam generator tube failure (SGTF) (DCA Part 2, Tier 2, Sections 15.0.3.8.2 and 15.6.3).

• Main steam line break outside containment (MSLB) (DCA Part 2, Tier 2, Sections 15.0.3.8.3 and 15.1.5).

• Rod ejection accident (REA) (DCA Part 2, Tier 2, Sections 15.0.3.8.4 and 15.4.8).

• Fuel handling accident (FHA) (DCA Part 2, Tier 2, Sections 15.0.3.8.5 and 15.7.4).

• Maximum Hypothetical Accident (MHA) (DCA Part 2, Tier 2, Section 15.0.3.9).

The applicant provided information on the radiological consequences analysis methodology, assumptions, and results for the potential doses at the EAB, at the LPZ outer boundary, and in the control room. The applicant also provided information on the radiological habitability in the NuScale design technical support center (TSC) to show compliance with the onsite emergency response facility regulatory requirements.

In DCA Part 2, Tier 2, Chapter 15, the applicant concluded that the NuScale design will provide reasonable assurance that the radiological consequences resulting from any of the above DBAs will fall within the offsite dose criterion of 0.25 Sievert (Sv) (25 roentgen equivalent man [rem])

total effective dose equivalent (TEDE), as given in 10 CFR 52.47(a)(2), Contents of applications; technical information, and the control room operator dose criterion of 0.05 Sv (5 rem), as given in 10 CFR Part 50, Appendix A, GDC 19, Control Room, as incorporated by reference in 10 CFR 52.47(a)(3). The applicant reached this conclusion by performing the DBA radiological consequences analyses by:

• Using reactor accident source terms based on NuScale topical report TR-0915-17565, Accident Source Term Methodology.

• Modeling removal of aerosols within the containment by natural phenomena using the methodology in NuScale topical report TR-0915-17565.

• Crediting control of the pH of the water in the containment to prevent iodine evolution using the methodology in NuScale topical report TR-0915-17565.

• Using a set of hypothetical atmospheric dispersion factor (/Q) values.

The /Q values are the relative atmospheric concentrations of radiological releases at the receptor point in terms of the rate of radioactivity release. In lieu of site-specific meteorological data, the applicant provided a reference set of site parameter short-term (accident) /Q values for the NuScale design using meteorological data that is expected to envelope offsite dispersion conditions at most potential plant site locations in the United States. NuScale DCA Part 2, 21

Tier 1, Table 5.0-1, Site Design Parameters, under the heading of Meteorology, provides the reference set of /Q values for the NuScale design. Accident /Q values used in the DBA dose analyses for the EAB, LPZ, and main control room (MCR) and TSC receptors are also given in NuScale DCA Part 2, Tier 2, Table 2.0-1, Site Design Parameters.

The DCA Part 2, Tier 2, Table 15.0-12, Radiological Dose Consequences for Design Basis Analyses, summarizes the offsite and control room dose results from the DBA radiological consequence evaluations and compares these results to the applicable dose acceptance criteria.

ITAAC: There are no ITAAC specific to this area of review.

Technical Specifications: There are no TS specific to this area of review.

Technical and Topical Reports: The NuScale evaluation of the DBA radiological consequences relies upon the methodology proposed in NuScale proprietary licensing topical report TR-0915-17565, Accident Source Term Methodology, for which Revision 1 was provided for NRC review on April 8, 2016. The staff review of this topical report is ongoing.

(Reference 15.0-4 in DCA Rev. 0) 15.0.3.3 Regulatory Basis The following NRC regulations contain the relevant requirements for this review:

• 10 CFR 52.47 (a)(2), as it relates to the evaluation and analysis of the offsite radiological consequences of postulated accidents with fission product release.

• 10 CFR Part 52.47(a)(2)(iv), as it relates to ability of plant systems to mitigate the radiological consequences of plant accidents.

• 10 CFR Part 50, Appendix A, GDC 19, as it relates to maintaining the control room in a safe condition under accident conditions by providing adequate protection against radiation.

• 10 CFR Part 50, Appendix E, Emergency Planning and Preparedness for Production and Utilization Facilities, Paragraph IV.E.8, as it relates to adequate provisions for an onsite technical support center from which effective direction can be given and effective control can be exercised during an emergency.

The guidance in DSRS Section 15.0.3 lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other DSRS and SRP sections.

The following document also provides additional criteria, or guidance in support of the acceptance criteria to meet the above requirements.

• RG 1.183, as it provides guidance on acceptable methods to perform DBA radiological consequence analyses for light-water reactors.

22

15.0.3.4 Technical Evaluation As noted in Section 15.0.3.2 above, NuScale is planning to make changes to the accident source term methodology and the related discussion in the DCA Part 2 with respect to the analysis of the radiological consequences of DBAs. Because these changes have not yet been reviewed by the staff as of the date of the writing of this SER section, the staffs technical evaluation is not provided. The completion of the staffs review of the DCA Part 2, Tier 2, Chapter 15, radiological consequences of design basis accidents is captured as Open Item 15.0.3-1.

Selection of Design-Basis Accidents To be determined (see Open Item 15.0.3-1).

Site Characteristic Short-Term Atmospheric Dispersion Factors Because no specific site is associated with the NuScale design, the applicant defined the offsite boundaries only in terms of hypothetical atmospheric relative concentration (/Q) values at fixed EAB and LPZ distances as site parameters. The applicant assumed that the EAB and LPZ outer boundary were both located at the same analytical distance of 400 feet, which is the smallest distance to the security owner-controlled area fence from any potential release point.

The applicant also provided hypothetical site parameter /Q values for each pairing of accident release point and receptor for the MCR and TSC, both for the ventilation system intake and the assumed control room envelope inleakage location. DCA Part 2, Tier 2, Table 2.0-1 lists the site parameter accident release /Q values used in the radiological consequence analyses for the NuScale design. DCA Part 2, Tier 1, Table 5.0-1 also lists these accident /Q values as site parameters for the design. Section 2.3.4 of this SER provides discussion of the staffs review of the hypothetical atmospheric dispersion factors.

A COL applicant that references the NuScale design will provide short-term (less than or equal to 30 days) site specific atmospheric dispersion factors for potential accident consequence analyses based on the location of their EAB and LPZ outer boundary using onsite meteorological data. If the COL applicants site characteristic atmospheric dispersion factors exceed the NuScale site parameter values used in this evaluation (i.e., poorer dispersion characteristics), a COL applicant may have to consider compensatory measures, such as increasing the size of their site or providing additional ESF systems to reduce radiological releases to meet the relevant dose criteria.

Radiological Consequences The NuScale SMR is an integral PWR design, with 12 nuclear power modules included in the plant. Although the NuScale SMR is a light-water reactor, the plant design includes passive features to mitigate accidents unlike the operating power reactors. In SECY-16-0012, Accident Source Terms and Siting for Small Modular Reactors and Non-Light Water Reactors (ADAMS Accession No. ML15309A319), the staff described the history of the potential policy and licensing issues for SMRs and non-LWRs with respect to the determination of accident source terms and the resulting dose calculation and siting evaluations. The staff has found it acceptable to permit use of mechanistic source terms to account for design-specific accident scenarios and accident progression in developing DBA radiological source terms in meeting the regulatory requirement in 10 CFR 52.47(a)(2) that the accident analyses include a DBA with significant core damage and release to an intact containment. NuScale topical report TR-0915-23

17565 includes a methodology to determine a surrogate accident source term to meet the analysis requirements in 10 CFR 52.47(a)(2) in lieu of following prior NRC guidance regarding LOCA radiological consequence analyses for PWRs.

The NRC issued RG 1.183 in July 2000 to provide guidance to licensees of operating power reactors on acceptable applications of alternative source terms pursuant to 10 CFR 50.67, Accident source term. This RG provides guidance based on insights from NUREG-1465 and significant attributes of other alternative source terms that the staff may find acceptable for operating light-water reactors (LWRs). It also identifies acceptable radiological analysis assumptions for use in conjunction with the accepted alternative source term for operating power reactors. Although 10 CFR 50.67 is not applicable to new reactor design certification review, the guidance in RG 1.183 may be applicable to LWR designs. In SRP Section 15.0.3, the staffs review procedures direct the use of RG 1.183 regulatory positions, as far as applicable to the plant design under review. The applicant followed the relevant guidance in RG 1.183 for PWRs, as far as applicable.

Staffs evaluation of the applicants radiological consequence analyses in the following topic areas related to the analysis inputs, methods and results is to be determined, as tracked by Open Item 15.0.3-1. The topic areas are core inventory, coolant activity concentrations, reactor building pool boiling radiological consequences, control room and technical support center radiological habitability, radiological consequences of the specific events, and aerosol natural deposition in containment.

15.0.3.5 Conclusion Based on the open item discussed above, no conclusions can be reached regarding NuScales analyses of the radiological consequences of design basis accidents.

Safe, Stabilized Condition Safety analyses of DBEs are performed from event initiation until a safe, stabilized condition is reached. A safe, stabilized condition is reached when the initiating event is mitigated, the acceptance criteria are met, and system parameters (for example, inventory levels, temperatures, and pressures) are trending in the favorable direction.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this review.

DCA Pat 2, Tier 2: In DCA Part 2, Tier 2, Section 15.0.4, the applicant stated, for events that involve a reactor trip, system parameters continue changing slowly as decay and residual heat are removed and the RCS continues to cool down.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: There are no technical specifications associated with this section.

Technical Reports: There are no technical reports associated with this section.

24

While the event may be successfully mitigated in the short term following an AOO or PA, long-term recriticality can occur if specific conditions exist as described in DCA Part 2, Tier 2, Section 15.0.6, Return to Power. While DCA Part 2, Tier 2, Section 15.0.4, does not use the term shutdown or subcriticality in the definition of the safe, stable state, the staff found examples throughout DCA Part 2, Tier 2, where the applicant stated that a safe-shutdown condition is achieved. Therefore, in RAI 9525, Question 15-28, the staff asked the applicant to remove or clarify DCA Part 2, Tier 2, statements that a safe shutdown is achieved. The applicant responded on August 14, 2018 (ADAMS Accession No. ML18226A355), that the language indicating that the design can achieve and maintain safe shutdown is used to describe the transition between operating modes and is not referring to reactivity control. The NPM design basis for a return to power with the worst rod stuck out (WRSO) and the NPM design basis for safe shutdown with all control rods inserted are described in DCA Part 2, Tier 2, Section 4.3.1.5, and in the GDC 27 exemption request. The NRC staff has identified that long-term reactivity control following an AOO or PA depends on the distribution of soluble boron throughout the RCS. Accordingly, the NRC staff issued RAI 8930, Question 15-27, asking the applicant to describe and justify its methodology for evaluating the boron distribution during LTC following ECCS actuation. The adequacy of the response to RAI 9525, Question 15-28, depends, in part, on the resolution of RAI 8930, Question 15-27. The NRC staff is tracking this as Open Item 15.0.6-5.

The applicant stated that no operator action is required to reach or maintain a safe, stabilized condition. The staffs assessment of this statement is one of the items addressed in the Chapter 15 review.

The staffs conclusions as to whether the events have been appropriately evaluated until a safe, stabilized condition is reached are contained in the following sections:

• For conditions where shutdown is reached and maintained, the long-term decay and residual heat removal are discussed in Section 15.0.5 of this SER.

• Conditions that lead to a return to power in the long term are discussed in Section 15.0.6 of this SER.

Long-Term Decay Heat and Residual Heat Removal Two systems perform the safety-related function of decay and residual heat removal from the NPM following a DBE. The DHRS, described in DCA Part 2, Tier 2, Section 5.4.3, provides decay and residual heat removal, while RCS inventory is retained inside the RPV. The ECCS, described in DCA Part 2, Tier 2, Section 6.3, is the other system and provides for decay heat and residual heat removal when either RCS inventory is lost or when EDSS power to the ECCS valves is lost and the IAB pressure differential threshold has been achieved. Depending on the initiating event and the availability of electrical power, there are four long-term heat removal scenarios:

25

(1) DHRS.

(2) DHRS with the RVVs and RRVs opening 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a loss of normal ac power.

(3) DHRS with the RVVs and RRVs opening after a loss of normal ac and normal dc power when the IAB pressure threshold is reached.

(4) ECCS actuation following an inadvertent opening of an RCPB valve or a LOCA.

In the first scenario, decay heat removal on the DHRS, RPV inventory is maintained and ac power is available. DCA Part 2, Tier 2, Section 5.4.3 discusses the ability to remove residual and decay heat in the short term following an event. The staffs evaluation of the DHRS is in Section 5.4.4.3 of the SER.

The LTC scenarios 2 through 4 above begin with ECCS valves opening and the establishment of recirculation flow between the RPV and containment following either a non-LOCA or LOCA event. Long-Term Cooling Methodology, Revision 0 (TR-0916-51299), provides the methodology and results demonstrating that the ECCS LTC is adequate to remove decay and residual heat after the RPV and containment pressures have approximately equalized in pressure, and stable flow through the RRVs is established. In DCA Part 2, Tier 2, Sections 6.3 and 15.6.5 discuss the short-term ability of the ECCS to remove residual and decay heat.

Sections 6.3 and 15.6.5 of this SER provide the staffs evaluation.

The reviews in this SER section are for the non-LOCA events, which use either the DHRS for long-term heat removal or those that transition to ECCS after the IAB setpoint is reached or the 24-hour timer activates the ECCS. DCA Part 2, Tier 2, Chapter 15, LOCA and Inadvertent Operation of the ECCS transients that transition from DHRS and the ECCS are addressed in Section 15.6.5.2 of this SER, as the event progression and physical phenomena are very similar. A potential return to power following a DBE is outside the scope of the NuScale Long-Term Cooling Methodology, report. Section 15.0.6 of this SER presents the staffs evaluation of scenarios for the return of power.

DCA Part 2Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2 Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized as follows.

Depending on the availability of normal ac and EDSS dc power, LTC can be accomplished by either the DHRS, a combination of the DHRS and ECCS, or the ECCS alone can be used to remove residual and decay heat. The NuScale Long-Term Cooling Methodology (LTC) report provides the combination of the DHRS with a transition to ECCS and the ECCS LTC EM and analyses. The LTC report addresses all DBEs that evolve to a configuration where operation of the ECCS is needed for LTC. The applicant stated that the DHRS cooling transition into ECCS cooling is considered, and the analyses demonstrate that if DHRS cooling is provided until either the IAB setpoint or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is reached, the NPM remains in a safe, stable condition out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> without operator action. As stated in the LTC report, the figures of merit are that the collapsed liquid level (CLL) in the RPV remains above the top of the core, core temperatures remain high enough to prevent boron precipitation, and cladding temperatures remain acceptably low during LTC conditions. The applicant maintained that CHF is limiting during the 26

short-term LOCA and non-LOCA transient phase, and maintaining an adequate low fuel cladding temperature is sufficient to demonstrate that the MCHFR limit is met in the long term.

A condition assumed in the LTC report is that subcriticality is maintained and the only heat source is residual and decay heat.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS applicable to this area of review are the following:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: TR-0916-51299, Revision 0, Long-Term Cooling Methodology The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 34, states that a system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that SAFDLs and the design conditions of the RCPB are not exceeded.

• 10 CFR Part 50, Appendix A, GDC 35, states that a system to provide abundant emergency core cooling shall be provided. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts.

• For LTC, 10 CFR 50.46(b)(5) requires that, after any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period required by the long-lived radioactivity remaining in the core.

The staff notes that the applicant provided the principal design criteria for GDC 34 and 35.

PDC 34 and 35 proposed by NuScale are functionally identical to GDC 34 and 35, with the exception of the discussion related to electric power. A discussion of NuScales reliance on electric power and the related exemption to GDC 17 can be found in Chapter 8 of this SER, as well as the staffs evaluation of TR-0815-16497, Safety Classification of Passive Nuclear Power Plant Electrical Systems, issued January 2018 (ADAMS Accession No. ML17340A524)

The LTC report assumes that subcriticality is maintained to address 10 CFR 50.46(b)(5). Under some design-basis scenarios, it is possible for extended cooldown events to cause the reactor to become recritical, as discussed in DCA Part 2, Tier 2, Section 15.0.6. The staffs evaluation of this event is in Section 15.0.6 of this SER.

27

Evaluation Model The NRELAP5 code Version 1.4 and Revision 1 of the plant model are used in the latest markup of the LTC report (TR-0916-51299), provided in response to RAI 9516, Question 26 (ADAMS Accession No. ML18355A972), which included a revised description of the LTC model.

The updated LTC EM is developed from a coarser LOCA model described in the LOCA topical report, Section 9.6.1, Model Nodalization. Section 15.6.5.2.4.1 of this SER includes a more detailed discussion of the LTC NRELAP5 model. The evaluation of the revised model, currently under staff audit and review, is Open Item 15.6.5-2. The NRELAP5 code Version 1.4 and associated models and correlations are the subject of the staffs ongoing review of TR-0516-49422, Loss-of-Coolant Accident Evaluation Model, Revision 0, and that review is being tracked as Open Item 15.0.2-2. Other than revised modeling changes addressed in response to RAI 9516, Question 26, no NRELAP5 code modifications were made from the LOCA EM for the LTC EM.

The validation of the LTC EM is based on two NuScale Integral System Test (NIST-1) facility tests, HP-19a and HP-19b. HP-19a is based on vacuum containment conditions, while HP-19b is at atmospheric containment conditions. The purpose of the HP-19a test was to simulate the spurious opening of an RVV without DHRS actuation. The applicant stated in response to RAI 9516, Question 15-23, that a range of LOCA break sizes was evaluated with and without DHRS actuation and that small-break LOCAs not including DHRS cooling are conservative compared to non-LOCA transients that assume DHRS cooldown and ECCS actuation at either the IAB setpoint or at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. For small-break LOCA events without DHRS cooling, RPV pressure can return to near the initial value, lowering the CLL. For larger break sizes without DHRS, the CLL is dominated by the loss of RPV mass. In its response to RAI-9516, Question 15-23, the applicant stated that the 5-percent injection line LOCA case without the DHRS bounds potential non-LOCA transition cases to long-term ECCS heat removal. The staff is reviewing the adequacy of the LTC EM with regard to the 5-percent injection line case, as noted in Section 15.6.5.2 of this SER. Therefore, the staff is not able to find with reasonable assurance at this time that the HP-19a and HP-19b tests provide adequate EM validation data to cover the non-LOCA events that transition to long-term ECCS cooling. Additional detail on the LTC EM appears in Section 15.6.5.2.4 of this SER.

Comparing NRELAP5s computer codes ability to predict the NIST-1 HP-19a test data, the staff noted that (( )) . To address these discrepancies between the NRELAP5 predictions and the HP-19a test data, the staff issued RAI 9516, Question 15-24, asking the applicant to explain the differences, including any code or test uncertainties that could affect the comparison.

In response to RAI 9516, Question 15-24 (ADAMS Accession No. ML18355A972), the applicant explained that (( )) . After completing the original assessment, NuScale developed revised post-processing software, which uses more measurement data and therefore changes the compensated RPV and CNV levels. Revised figures of mid-term and long-term RPV and CNV levels compared to NRELAP5 predictions are provided in the response to RAI 9516, Question 15-24.

(( )) . The staff notes that NRELAP5 continues (( )) is in the conservative 28

direction with regard to maintaining the core covered. As noted above, the review of the revised NRELAP5 model is Open Item 15.6.5-2 in Section 15.6.5.2.4.1 of this SER.

The staff also noted in RAI 9516, Question 15-24, that the cooling pool level was not well predicted. The applicant stated that (( )) .

The staff had similar questions about the prediction of RPV and containment NRELAP5 level predictions for the HP-19b test. The staff noted that (( )) . The staff also noted that the test conditions between the HP-19a and HP-19b tests at 6,000 seconds were different, indicating the initial containment backpressure at atmospheric conditions had some effect on the transient progression from 0 to 6,000 seconds. RAI 9516, Question 15-25, requested additional information to understand why the (( )) when compared with the HP-19a test.

The applicant responded to RAI 9516, Question 15-25 (ADAMS Accession No. ML18355A972),

that initial test conditions, as well as the amount of noncondensable gases, affected the results at 6,000 seconds. The HP-19b CNV initial fluid level was lower than the H-19a test, and the primary fluid temperature was colder than that in the HP-19a test. The initial conditions combined with the small effect of noncondensable mass difference explain the CNV pressure difference.

The staff is not able to conclude the ECCS can adequately remove decay heat out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> based on the above open items.

Input Parameters, Initial Conditions, and Assumptions In response to RAI 9516, Question 26 (ADAMS Accession No. ML18355A972), the applicant provided markups of a large portion of the technical report Long-Term Cooling Methodology, Revision 0. The applicant stated in the response to RAI 9516, Question 26, that the SGTF cases use the following conditions when evaluating the figures of merit:

• The 1973 decay heat standard is used. A 1.0x multiplier is applied for the minimum level and maximum fuel clad temperature and a 0.8x for the minimum core inlet temperature evaluation.

• The SGTF was modeled at the top of the SG to minimize return flow back to the RPV.

• The initial pressurizer level is 52 to 68 percent of span.

• Pool temperatures are between 18.3 and 98.9 degrees Celsius (°C) (65 and 210 degrees Fahrenheit (°F).

• Pool levels are between 55 and 69 feet.

• RCS average temperatures are between 279 and 290 °C (535 and 555 °F).

• The noncondensable gas range is 0 to about 131 pounds mass (lbm).

• The ECCS capacity is between minimum and maximum.

29

As part of the response to RAI 9516, Question 26, the applicant provided markups to GTS LCO 3.5.3, Ultimate Heat Sink, which increased the minimum ultimate heat sink temperature to greater than or equal to 18.3 degrees Celsius (65 degrees F) and less than or equal to 43.3 degrees Celsius (110 degrees F).

As noted in Sections 15.0.5.4.1 and 15.0.5.4.3, because open items exist, the staff is not able to reach a conclusion about the conservative nature of the input parameters, initial conditions, and assumptions in this section. The ongoing Chapter 15 audit (ADAMS Accession No. ML19004A098) seeks to enhance the staffs understanding of the remaining open items associated with non-LOCA LTC EM and analyses.

Evaluation of Analysis Results As part of the staffs review of an extended DHRS cooldown and potential return to power, the staff identified a concern that an initial RCS water level inventory could exist such that the level would drop below the riser and interrupt single-phase natural circulation. It is unclear whether an extended cooldown on the DHRS from 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> could result in the water level dropping below the riser, leading to fuel heatup and a challenge to the MCHFR. Therefore, the staff noted in RAI 9508, Question 15-7, that if initial conditions exist such that RPV single-phase natural circulation could be lost, the applicant should demonstrate that fuel cladding temperatures remain acceptably low and the SAFDLs are preserved consistent with PDC 34.

The applicant responded (ADAMS Accession No. ML18256A401) but did not provide a basis for the SAFDLs being met. On March 14, 2019, the applicant provided a supplemental response (ADAMS Accession No. ML19073A286). The review of the calculations underlying the supplemental response is ongoing through the staffs audit (ADAMS Accession No. ML19004A098), and RAI 9508 is being tracked as Open Item 15.0.5-1.

The staff noted that in the response to RAI 9516, Question 26, the applicant evaluated a generic DHRS cooldown transient and a loss of feedwater event (heatup event). The applicant stated that these transients are not more limiting relative to the figures of merit than the case of SGTF with no power. The results of these additional non-LOCA transients were not documented in the markups provided for the LTC technical report and the staff will confirm the applicants statements as part of the ongoing Chapter 15 audit (ADAMS Accession No. ML19004A098).

The applicant concluded in the Long-Term Cooling Methodology, technical report that the LOCA spectrum of cases results in lower CLLs and higher cladding temperatures than the non-LOCA cases, with noncondensable gases in the CNV resulting in the highest clad temperatures.

The non-LOCA events in which inventory was lost were limiting with regard to the potential for boron precipitation after 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> because of the lower RPV mass at approximately the same core inlet temperature as the LOCA cases. The LOCA injection line break initiated from 13-percent rated thermal power was the minimum temperature case.

The staff notes that results have changed from those documented in Revision 0 of the LTC technical report. It is unclear to the staff if results differ because of the revised modeling, as noted in Sections 15.0.5.4.1 and 15.6.5.2.4.1 of this SER, or some combination of modeling and input assumptions. As part of the ongoing Chapter 15 audit, the staff will continue to review the model and input changes, as well as the analysis results and the revised LTC technical report and GTS markups provided in the response to RAI 9516, Question 26. This is Open Item 15.0.5-2.

30

During the review of the LTC technical report, Revision 0, the staff asked in RAI 9522, Question 15-13, why the SGTF inventory loss was analyzed for the minimum collapsed level instead of the CVCS line break outside containment as it appears the RPV mass loss is greater for the CVCS line break. Because both the LTC EM and input assumptions have changed as described above, the staff will seek additional understanding of the topics in RAI 9522, Question 15-13, as part of the ongoing Chapter 15 audit (ADAMS Accession No. ML19004A098). This is Open Item 15.0.5-3.

There are no COL information items associated with Section 15.0.5 of DCA Part 2, Tier 2.

Based on the open items documented above, no conclusions can be reached regarding PDCs 34 and 35 and 10 CFR 50.46(b)(5).

Evaluation of a Return to Power As demonstrated in DCA Part 2, Tier 2, Chapter 15, the NuScale control rod design provides sufficient negativity reactivity to shut down the reactor, when needed to mitigate, shortly after the initiating event, assuming the worst stuck rod does not insert into the core. However, because of the design of the safety-related, passive heat removal systems, an NPM could cool down sufficiently to return to power within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Specific conditions include the highest worth control rod stuck out of the core, a sufficiently negative moderator temperature coefficient typically associated with the later part of the operating cycle, and an unavailability of the non-safety-related means of adding boron.

The NuScale design has two safety-related passive heat removal systems, the decay heat removal system (DHRS) and the emergency core cooling system (ECCS). Depending on the event scenario, either system, or the combination of the two systems, assuming loss of the non-safety-related dc power (EDSS), is capable of removing residual heat sufficiently to cause a return to power, given conservative analysis assumptions. In a non-LOCA event, with dc power, the DHRS provides residual heat removal. A cooldown on the DHRS will lead to a return to power within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> when RCS water level remains above the riser. In a non-LOCA event with the loss of dc power, RCS coolant discharges to containment when the IAB setpoint has been reached. The exception to the DHRS providing residual heat removal during non-LOCA events is the inadvertent operation of the ECCS, which is classified as a non-LOCA event but behaves similar to a LOCA event. During a LOCA, once a valid ECCS setpoint has been met and the IAB setpoint has been reached, the ECCS provides heat removal throughout the event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

31

The applicant stated that for the NPM to return to power, specific circumstances, in combination with conservative analysis conditions, are needed. One of the most important circumstances is the assumption of a stuck rod because, if all rods insert, the NPM remains subcritical for both a DHRS cooldown and ECCS actuation. GDC 26, for AOOs, and GDC 27, for PAs, specify that a stuck control rod is to be assumed for both AOOs and PAs. With a stuck control rod, there is a set of conditions in which the reactor will return to power following many of the Chapter 15 events. For a cooldown driven by the DHRS, a return to power will occur if the positive reactivity insertion from the moderator and fuel is greater than the minimum shutdown margin given in DCA Part 2, Tier 2, Section 4.3 (assuming no xenon). The applicant stated that it used the following conservative assumptions in the DHRS cooldown scenario:

• The reactor is shut down with an assumed minimum required shutdown margin of 2 percent.

• A reactor pool temperature of 40 degrees F is used, which leads to a conservatively high cooldown rate, which adds the maximum positive reactivity.

• The most negative moderator temperature coefficient is used, as it will produce a bounding rate of increase in moderator reactivity worth during cooldown.

• The least negative Doppler coefficient is used because it results in the lowest negative reactivity feedback during the return to power.

Both DHRS trains are assumed to operate, and the DHRS heat transfer is increased by 30 percent to ensure the consequences of the cooldown are maximized after DHRS actuation.

The applicant used NRELAP5 to calculate the maximum return to power, which is given in DCA Part 2, Tier 2, Figure 15.0-8. The minimum critical heat flux ratio (MCHFR) was calculated assuming the ECCS valves did not open and assuming the ECCS valves opened at the maximum return to power during the DHRS cooldown event. In both cases, the MCHFR remained above the acceptance limit with the ECCS valves opening at the time of maximum return to power, the limiting (MCHFR) event.

The applicant stated that for events that rely on the ECCS for heat removal, the heat produced from a return to power with a nominal value of shutdown margin will be limited to less than 100 kilowatts (kW) by negative reactivity feedback from the moderator density. The low core heat level increases moderator temperature and generates voiding in the core, which, in combination with the elevated RCS temperature resulting from the heatup of the reactor pool from the residual heat of multiple reactors being shut down upon a loss of all ac power, provides negative feedback to keep the core power level very low.

For the limiting MCHFR case of a DHRS cooldown with the opening of the ECCS valves at the time of the peak return to power, the applicant stated the hot spot heat fluxes are approximately one-third of the spurious RVV opening evaluated in DCA Part 2, Tier 2, Section 15.6.6, Inadvertent Operation of ECCS.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

32

• LCO 3.1.3, Moderator Temperature Coefficient (MTC).

• the TS listed in Section 15.0.0 of this SER.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, states, in part, the following:

These General Design Criteria establish minimum requirements for the principal design criteria for water-cooled nuclear power plants similar in design and location to plants for which construction permits have been issued by the Commission. The General Design Criteria are also considered to be generally applicable to other types of nuclear power units and are intended to provide guidance in establishing the principal design criteria for such other units.

Because a return to power can occur following either an AOO or PA, the following GDC apply:

• 10 CFR Part 50, Appendix A, GDC 10, requires that the RCS design have appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 12, Suppression of Reactor Power Oscillations, relates to ensuring that core power oscillations that can result in conditions exceeding SAFDLs are not possible or can be reliably and readily detected and suppressed.

• 10 CFR Part 50, Appendix A, GDC 15, relates to designing the RCS and its auxiliaries with appropriate margin so that the pressure boundary is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 17, relates to onsite and offsite electric power systems and ensures that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

• 10 CFR Part 50, Appendix A, GDC 27, relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.

• 10 CFR Part 50, Appendix A, GDC 28, relates to limits on the potential amount and rate of reactivity increase to ensure that the effects of postulated reactivity accidents can neither (1) result in damage to the RCPB greater than limited local yielding nor (2) sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core.

• GDC 35 requires the provision of a system to provide abundant emergency core cooling.

The system safety function shall be to transfer heat from the reactor core following any 33

loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts.

The staff notes that the applicant provided principal design criteria for GDC 34 and 35. The PDCs 34 and 35 proposed by NuScale are functionally identical to GDC 34 and 35, with the exception of the discussion related to electric power.

SECY-18-099, NuScale Power Exemption Request from 10 CFR Part 50, Appendix A, General Design Criterion 27, Combined Reactivity Control Systems Capability (ADAMS Accession No. ML18065A431), dated October 24, 2018, also provides additional criteria or guidance in support of the SRP acceptance criteria related to this event.

Exemption from General Design Criteria 27 As part of the regulatory gap analysis performed during the preapplication interactions, the staff determined that reliably controlling reactivity in GDC 27 requires that the reactor be brought to a safe, stable, subcritical (shutdown) state following a PA. The staff notified NuScale of this determination in Response to NuScale Gap Analysis Summary Report for Reactor Systems Reactivity Control System, Addressing Gap 11, General Design Criterion 27, dated September 8, 2016 (ADAMS Accession No. ML16116A083).

The introduction to 10 CFR Part 50, Appendix A, states, in part, the following:

[T]here may be water-cooled nuclear power units for which fulfillment of some of the General Design Criteria may not be necessary or appropriate. For plants such as these, departures from the General Design Criteria must be identified and justified.

Consistent with 10 CFR Part 50, Appendix A, and pursuant to 10 CFR 52.7, the applicant requested an exemption to GDC 27 in Part 7 of the DCA, Section 15, 10 CFR 50, Appendix A, Criterion 27, Combined Reactivity Control Systems Capability. The applicant requested an exemption from GDC 27 to the extent it has been implemented to require demonstration of long-term shutdown under post-accident conditions with an assumed worst rod stuck out.

As stated in 10 CFR 52.7, [t]he Commissions consideration of requests for exemptions from requirements of the regulations of other parts in this chapter, which are applicable by virtue of this part, shall be governed by the exemption requirements of those parts. The exemption requirements for 10 CFR Part 50 regulations are found in 10 CFR 50.12. As 10 CFR 50.12 states, an exemption may be granted when (1) the exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security, and (2) special circumstances are present. Specifically, 10 CFR 50.12(a)(2) lists six circumstances for which an exemption may be granted. For the NRC to consider granting an exemption request, one of these bases must be present.

Authorized by Law The NRC has authority under 10 CFR 52.7 and 10 CFR 50.12 to grant an exemption from the requirements of this regulation. Therefore, the requested exemption is authorized by law.

34

No Undue Risk to Public Health and Safety In SECY-18-0099, the staff informed the Commission of the proposed review criteria to assess the acceptability of the requested exemption. The staff outlined the following three criteria to evaluate the exemption request:

(1) The design of the reactor must provide sufficient thermal margin such that a return to power does not result in the failure of the fuel cladding fission product barrier, as demonstrated by not exceeding SAFDLs for the analyzed events. The use of SAFDLs following a PA is an appropriate criterion to ensure that any return to power poses no undue risk to public health and safety.

(2) The combination of circumstances and conditions leading to an actual post-reactor-trip return to criticality is not expected to occur during the lifetime of a module. The criterion that a recriticality is not expected to occur during the lifetime of a module is consistent with NuScales classification of IEs and PAs (see Section 15.0.0.2.1, Classification by Event Frequency and Type, in the NuScale DCA, Revision 1, issued March 2018 (ADAMS Accession No. ML18086A187)).

(3) The incremental risk to public health and safety from the hypothesized return to criticality at a NuScale facility with multiple reactor modules does not adversely erode the margin between the Commissions goals for new reactor designs related to estimated frequencies of core damage or large releases and those calculated for the NuScale design.

In determining that the exemption to GDC 27 and the adequacy of PDC 27 do not present undue risk to public health and safety, the staff will use the three criteria listed in SECY-18-0099. The staff will also determine whether cold shutdown can be achieved with all control rods inserted and whether the NPM design satisfies the GDC listed in Section 15.0.6.3, except for GDC 27.

In the proposed PDC 27, the staff noted that meeting the SAFDLs was mentioned in the second paragraph, which does not include margin for a stuck rod. Therefore, in RAI 9496, Question 15-19 (ADAMS Accession No. ML18190A458), the staff asked why PDC 27 did not specify meeting the SAFDL criteria including margin for a stuck rod. The staff also noted that the MCHFR is only one of multiple SAFDL conditions, all which should be met during a return to power. Further, in public meetings (ADAMS Accession No. MLXXXXXXXXX and MLXXXXXXXXX) regarding RAI 9496, Question 15-19, the applicant clarified its intent relative to the use of the CHF criteria during a potential return to power. Although the current analysis of events described in DCA Part 2, Tier 2, Chapter 15, uses CHF as the acceptance criterion for all AOOs and PAs, including LOCAs, the applicant stated that it did not intend to limit the acceptance criteria to CHF for the initial PA in its design basis. The applicant stated that it intended only the subsequent return to power portion of a PA to be subject to CHF criteria.

Further, DCA Part 7, Section 15.1.4, states the following:

using the MCHFR SAFDL is appropriate for overcooling return to power scenarios because it ensures no additional [emphasis added] fuel failures following a postulated accident, and thereby prevents further radiological release.

Based on this information, the staff cannot yet complete its review of an exemption to GDC 27 as the design presented in the DCA is predicated on a design basis of no fuel failures in multiple 35

chapters and sections of the application. Further, the intent of the criteria in SECY-18-0099 was to preclude fuel failure following a PA. The staff had intended in SECY-18-0099, to include the time from the initiating event (time 0) as a measure to ensure that there would be no undue risk from continued fission product production following a return to power with a core having fuel failures produced by the preceding initiating event.

Further, in its exemption request, the applicant clarified the following:

NuScale PDC 27 is not intended to expand the applicability of GDC 27 beyond its current scope, but only to clarify the shutdown criterion for design basis events within the scope of GDC 27. Shutdown capability after reactivity accidents, specifically rod ejection, is not addressed by GDC 27 or GDC 28. Rather than addressing reactivity insertion for reactivity control or shutdown, GDC 28 is intended to restrict the amount of positive reactivity that can be inserted from reactivity accidents, including rod ejection, and thus limit the consequences of such events. Accordingly, GDC 28 remains the relevant criterion for evaluating reactivity control system design with respect to postulated reactivity accidents, as reflected in the review guidance of NUREG-0800.

In RAI 9647, Question 15-29 (ML19032A120), the staff asked NuScale to address the longer-term progression of a rod ejection accident for the NuScale design. The staff notes that the applicant is correct that the review guidance of NUREG-0800 does not specify that a rod ejection accident must meet GDC 27. However, GDC 28 defines a rod ejection event as a PA.

GDC 27 applies to PAs. Further, the staff considers that the guidance did not anticipate a design requiring an evaluation of a potential return to power during the longer-term portion of a rod ejection event. At the time the guidance was written, the PWR reactor designs all had a means to add negative reactivity to avoid recriticality.

Because of the issues identified above, the review of this request for exemption from GDC 27 remains open. This is Open Item 15.0.6-1.

The staff evaluated the NuScale design against the three criteria in SECY-18-0099 as described below:

(1) The design of the reactor must provide sufficient thermal margin such that a return to power does not result in the failure of the fuel cladding fission product barrier, as demonstrated by not exceeding SAFDLs for the analyzed events.

Evaluation: The staff review of this criterion appears in Section 15.0.6.1.3 of this SER and is associated with Open Items 15.0.6-2 through 15.0.6-6. The staff cannot conclude that this criterion is met, pending closure of these open items.

(2) The combination of circumstances and conditions leading to an actual post-reactor-trip return to criticality is not expected to occur during the lifetime of a module.

Evaluation: As described in DCA Part 7, Chapter 15, and Part 2, Tier 2, Section 4.3.1.5, Shutdown Margin and Long Term Shutdown Capability, the applicant calculated the probability of a return to power to be less than 1X10-6per reactor year. The combination of circumstances and conditions leading to a post-reactor-trip return to criticality, assuming a reactor trip frequency of one per reactor year, includes (1) failure of a control rod assembly to insert, (2) failure of the CVCS to insert soluble boron, and (3) the 36

reactor being in a state that could result in a return to power. The staff determined that the applicant considered the appropriate combination of circumstances and conditions that may lead to a return to criticality, and the estimated failure probabilities are technically justified and generally conservative. The resulting probability of a return to criticality is very low, substantially below the probability of an event occurring within the lifetime of a reactor module, which is conservatively 1E-2 per reactor year, as described in DCA Part 2, Tier 2, Section 15.0.0.2.1.

(3) The incremental risk to public health and safety from the hypothesized return to criticality at a NuScale facility with multiple reactor modules does not adversely erode the margin between the Commissions goals for new reactor designs related to estimated frequencies of core damage or large releases and those calculated for the NuScale design.

Evaluation: As described in DCA Part 2, Tier 2, Section 15.0.6, even in a return to power scenario, fuel damage does not occur because the resultant power level is limited, and the associated heat generated is within the capacity of the passive heat removal system. If the applicant can demonstrate that the SAFDLs are preserved as evaluated above, and that there are no challenges to any of the fission product barriers using conservative assumptions for the return to power scenario, the staff determined that incremental risk to public health and safety, related to estimated changes to core damage frequency (CDF) and large release frequency (LRF), is negligible with respect to the Commissions goals because, without additional postulated system or component failures, the scenario above does not lead to core damage in the probabilistic risk assessment. The issue of demonstrating the SAFDLs are met for the various return to power scenarios are being tracked under Open Items 15.0.6-4, 15.0.6-5 and 15.0.6-6.

Consistent with Common Defense and Security The requested exemption is consistent with the common defense and security (10 CFR 50.12(a)(1)). The exemption does not affect the design, function, or operation of structures or plant equipment that are necessary to maintain the secure status of the plant. The proposed exemption has no impact on plant security or safeguards procedures. Therefore, the requested exemption is consistent with the common defense and security.

Special Circumstances In DCA Part 7, Section 15.3.1, the applicant stated that special circumstances are present (10 CFR 50.12(a)(2)(ii)) in that application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule. The applicant stated in its exemption request that the inclusion of a stuck rod assumption for the NuScale design is not necessary, because the design would still meet the underlying purpose of the shutdown requirement, since a return to power is inherently limited with adequate core cooling being maintained by passive safety systems. Also, the probability of this scenario is unlikely.

As a result of the exemption request, as reflected in DCA Part 2, Tier 2, the applicant conformed to the following PDC related to PA reactivity control capability, intended to reflect the underlying purpose of the rule:

37

The reactivity control systems shall be designed to have a combined capability of reliably controlling reactivity changes to assure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained.

Following a postulated accident, the control rods shall be capable of holding the reactor core subcritical under cold conditions, without margin for stuck rods, provided the specified acceptable fuel design limits for critical heat flux would not be exceeded by the return to power.

The staffs evaluation of adequate core cooling being maintained is described in Section 15.0.6.1.3 and is associated with Open Items 15.0.6-2 through 15.0.6-6. Further, as described earlier in this section, Open Item 15.0.6-1 is associated with the wording of the PDC itself.

Regarding the probability of the scenario, the staffs review in conjunction with the criteria in SECY-18-0099 was described above under the preceding criterion (No Undue Risk to Public Health and Safety). Pending closure of the above open items, the staff cannot conclude that NuScale meets the underlying purpose of the rule.

The applicant states that special circumstances are present (10 CFR 50.12(a)(2)(iv)) in that the exemption would result in a benefit to the public health and safety that compensates for any decrease in safety that may result from granting the exemption. The applicant stated that the use of simple passive safety systems in its design is an overall benefit to public health and safety, which is reflected in the NRCs Policy Statement on Advanced Reactors (73 FR 60612,)

dated October 14, 2008. Further, the applicant argued that there is no decrease in safety, as a return to power would not involve fuel failure and therefore would not increase CDF. The staffs evaluation of a return to power scenario in terms of the CHF criteria is described in Section 15.0.6.1.3 and is associated with Open Items 15.0.6-2 through 15.0.6-6. The staff notes that there is nothing inherent in the design of a reactor that uses passive safety features that results in the need to account for potential recriticality. The staff agrees that simple passive safety systems are, in general, an overall benefit to public health and safety as reflected in the policy statement. However, the staff cannot conclude that it is in the public interest to grant an exemption from GDC 27 until the above open items are resolved.

Evaluation Model Three scenarios can potentially lead to a return to power: (1) a DHRS cooldown with dc power (EDSS) until an equilibrium power is achieved, (2) a DHRS cooldown without dc power (EDSS) with ECCS actuation when the IAB setpoint is reached, and (3) a cooldown on the ECCS. The applicant seeks to bound all three scenarios with an NRELAP5 analysis that maximizes the return to power for a conservative DHRS cooldown by actuating the ECCS at the peak return to power.

In RAI 9485, the staff asked the applicant to clearly delineate the methodology used in the return to power analyses. The applicant responded that the return to power analysis uses both the non-LOCA and LOCA methodologies. The applicant used NRELAP5 Version 1.4, as documented in TR-0516-49416, Revision 1, to perform a sensitivity analysis of assumed decay heat, reactor building pool temperature, and DHRS heat transfer bias to determine the parameters that maximize the return to power. The staff is tracking the applicants intended 38

update of transient and accident analyses using NRELAP5 Version 1.4 as Open Item 15.0.2-1 and the review of TR-0516-49416 as Open Item 15.0.2-4. A single lumped hydraulic channel and a single lumped heat structure are used to model the fuel and cladding, consistent with the non-LOCA transient methodology. The reactivity coefficients are determined to be consistent with the non-LOCA analysis methodology LTR. The staff finds acceptable the approach of using a simple single lumped hydraulic and heat structure NRELAP5 model for performing the sensitivity analysis to identify which initial conditions are used to determine the MCHFR, as this model evaluates only the core average power response.

The MCHFR determination uses the inadvertent operation ECCS methodology, described in DCA Part 2, Tier 2, Section 15.6.6, as documented in Appendix B to the LOCA topical report (TR-0516-49422). The staffs review of TR-0516-49422 is being tracked as Open Item 15.0.2-2. The core modeling and nodalization are consistent with those presented in the LOCA topical report. The hydraulic volumes and corresponding heat structures for the lower plenum, hot assembly core bypass, and upper plenum are the same as the LOCA NRELAP5 model, Version 1.4. The staff is tracking the applicants update to NRELAP5 Version 1.4 as Open Item 15.0.2-1. Since a return to power occurs only with a stuck rod, a conservative hot channel peaking factor based on the code given in the Nuclear Analysis Codes and Methods Qualification topical report (TR-0616-48793-A) is applied. The staff agrees that the SIMULATE code can adequately calculate the hot channel peaking factor associated with an N-1 control rod configuration under subcritical and low-power core conditions. The LOCA topical report methodology evaluated the bottom axial power shapes to determine the MCHFR. The core average power response from the inadvertent operation of ECCS NRELAP5 model and that from the non-LOCA NRELAP5 model are then compared using the same inputs to ensure consistent model responses.

Consistent with the NRELAP5 LOCA model, the return to power model uses the Extended Hench-Levy CHF correlation, which was assessed against the KATHY NuFuel HTP2 CHF for high-flow and Stern CHF for low-flow conditions to determine the 95/95 design limit after inclusion of the penalties for fuel rod bow and engineering factors. RAI 9536 asked the applicant to provide additional information on how the Extended Hench-Levy 95/95 correlation limit was validated and how it applies to DCA Part 2, Tier 2, Section 15.6.6, and the return to power MCHR conditions. The validation of the high-flow CHF correlation is presented in Appendix B to the LOCA EM topical report (TR-0516-49422) and is under staff review. The staff is tracking this as Open Item 15.0.6-2.

Input Parameters and Initial Conditions The applicant used a two-step process to determine the MCHFR. The first step used the non-LOCA NRELAP5 model to perform a sensitivity analysis. The analysis varied the decay heat, reactor building pool temperature, and the DHRS heat transfer while using a conservative, constant, hot zero power (HZP) negative MTC, and a minimum Doppler temperature coefficient to determine the peak return power. For the range of decay heat values analyzed, the applicant noted that the time to achieve the peak return to power changed, but there was little change in maximum return to power value. The staff agrees with this assessment as the maximum return to power is primarily driven by the assumed ultimate heat sink temperature and the reactivity added by the RCS coolant temperature change. The applicant assumed a 4.4 degree Celsius (40-degree F) minimum reactor pool building temperature, which bounds the lower reactor building pool temperature, and an increase of 30 percent on the DHRS heat transfer coefficient to maximize the return to power. The assumed 4.4 degrees Celsius (40 degrees F) is based on 39

DCA Part 2, Tier 2, Table 9.2.5-1, Relevant Ultimate Heat Sink Parameters, while the basis for the 30-percent increase in the DHRS heat transfer coefficient is added conservatism based on the Non-Loss-of-Coolant Accident Analysis Methodology, Revision 1 (TR-0516-49416). The staff is tracking the review of TR-0516-49416 as Open Item 15.0.2-4.

An HZP negative MTC was used, as the applicant stated that for reactor trips from hot full power (HFP), the RCS level will drop below the riser, significantly reducing the cooldown and either preventing or limiting the return to power. The potential of a return to power with the RCS water level dropping below the riser is being tracked as Open Item 15.0.5-1. The staff noted that the RCS level remained on scale in the pressurizer and, in RAI 9488 (ADAMS Accession No. ML18183B181), questioned whether a reactor trip from a higher power level would lead to a higher return to power as the initial MTC would be more negative and RCS temperature change would be greater, both leading to a larger moderator defect. The applicant noted in the response to RAI 9488 the return to power analysis starts at HZP, and the minimum shutdown margin at 215 degrees Celsius (420 degrees F) includes the moderator and fuel defect for part power cases. The staff agrees that using the minimum shutdown margin at 215 degrees Celsius (420 degrees F) includes the associated reactivity defects corresponding to part power cases. In the response to RAI 9485 (ADAMS Accession No. ML18264A340), the applicant claimed that a SIMULATE analysis demonstrates the reactor is highly subcritical at the time of maximum return to power and hence the return to power analysis is conservative. It is unclear what assumptions are used in the nuclear analysis, and the staff has asked the applicant for additional details. The staff is tracking RAI 9485 as Open Item 15.0.6-3.

The MCHFR was calculated with the hot channel, inadvertent operation of ECCS EM assuming actuation of the ECCS. The negative moderator density feedback associated with ECCS actuation temporarily terminates the return to power. The applicant used an end-of-cycle (EOC), 0 parts per million moderator density reactivity table, which the staff finds acceptable as it reflects the negative reactivity upon ECCS actuation. The staff also agrees that the use of radial averaged density reactivity feedback is conservative, as the localized density feedback in the location of the stuck rod is minimized.

The applicant examined the MCHFR using top, middle, and bottom axial power shapes for the maximum return to power during the scenario for DHRS cooldown with ECCS actuation (EDSS dc power unavailable). As reflected in the analysis results and consistent with the staffs engineering judgment, the top peaked axial shape had the MCHFR. The staff finds that the use of a maximum radial peaking factor of 6.5 to account for the stuck rod is conservative for core conditions consistent with the return to power analysis.

Results For the return to power event, the acceptance criteria of maximum RPV pressure, maximum SG pressure, and SAFDLs consistent with an AOO are evaluated. Maximum RPV pressure and maximum SG pressure are not challenged during a return to power event as the maximum return to power is approximately 10-percent rated thermal power (RTP). At 10 percent RTP, the RPV and SG pressures are well below the initial HFP values. Of the SAFDLs such as centerline temperature, clad strain, rod internal pressure, and MCHFR, the applicant maintained that only MCHFR is possibly challenged. Based on its independent confirmatory analysis, the staff agrees that SAFDLs other than the MCHFR are not challenged during the return to power event.

40

The NuScale NPM can potentially return to power by cooling down in three ways: (1) on the DHRS, (2) on a combination of the DHRS and ECCS, and (3) on the ECCS.

For a cooldown on the DHRS, without ECCS actuation, the maximum return to power is given by DCA Part 2, Tier 2, Revision 2, Figure 15.0-8, Power Response on a Return to Power, with the average RCS temperature given in Figure 15.0-11, Return to PowerAverage Reactor Coolant System Temperature (Peak Power Case), and the RPV pressure given in Figure 15.0-13, Return to PowerReactor Pressure Vessel Lower Plenum Pressure (Peak Power Case). Figure 15.0-17, Return to Power ECCS Transition CaseHot Channel Heat Flux (MCHFR Case), provides the maximum hot channel heat flux before and after ECCS actuation. DCA Part 2, Tier 2, Revision 2, Table 15.0-16, Sequence of Events for Overcooling Return to Power Event EDSS Available (Peak Power Case), shows the maximum return to power of 16 megawatts thermal occurs at 7,900 seconds. The applicant argued, and the staff agrees, that MCHFR is not challenged under these RCS conditions, even accounting for the stuck rod power distribution. A comparison between the return to power maximum hot channel heat flux and the HFP value shows the return to power value is less than half the HFP value. At the time of maximum return to power, core exit subcooling is in excess of 82 degrees Celsius (180 degrees F). The combination of subcooled margin and low maximum hot channel heat flux creates conditions in which a significant MCHFR margin exists, assuming that RCS flow stability is maintained under these conditions of low power, flow, and pressure.

The applicant evaluated power and flow stability during a DHRS cooldown by evaluating the minimum riser subcooling margin and the decay ratio (DR). The applicant used an exclusion-based stability solution, whereby a riser temperature based protective trip enforces an operating domain, which precludes challenging the SAFDLs. The protective trip at 321 degrees Celsius (610 degrees F) for pressures above 1,720 pounds per square inch atmospheric (psia),

and 315 degrees Celsius (600 degrees F) for pressures down to 1,600 psia, as shown in DCA Part 2, Tier 2, Revision 2, Figure 15.0-9, Analytical Operating Limits, precludes voiding or flashing in the riser leading to potential instabilities. As described above, core exit subcooled margin remains in excess of 82 degrees Celsius (180 degrees F) during the entire DHRS cooldown transient. The RCS reaches saturation conditions after the 24-hour timer actuates the ECCS, thereby precluding significant riser voiding. The applicant used the PIM code, as described in TR-0516-49417, Revision 0, to assess the potential for growing power and flow oscillations. The staff is tracking the review of TR-0516-49417 as Open Item 15.0.2-5. The PIM evaluation was performed using NRELAP5 reactor conditions where the reactor is critical and in the new low-power, steady-state condition. The applicant was able to adjust the moderator feedback coefficient in the PIM calculation and conservatively evaluated the DR with both a nominal, EOC, and zero moderator reactivity coefficient. The PIM evaluation demonstrated that the DR was significantly less than 1 for both MTC cases. The staff notes that the applicants analysis methodology also includes substantial conservatism by combining the worst combination reactivity parameters, the most negative MTC to maximize the return to power, and a zero MTC which minimizes stabilizing moderator feedback. These results confirm that the reactor remains stable with significant thermal margin during a postulated DHRS cooldown event.

The second potential return to power scenario is a combination of a DHRS cooldown assuming the non-Class 1 EDSS dc power is unavailable. Without EDSS dc power, the main ECCS valves open to the fail-safe position, and RCS discharge is prevented by closing the IAB valve.

When the RCS cools sufficiently, the IAB differential pressure setpoint is reached, allowing RCS coolant discharge to containment. Heat is then removed by the ECCS throughout the 41

remainder of the event. To bound the RCS conditions at which the IAB setpoint could be reached, the applicant opened the ECCS valves at the time of the maximum DHRS cooldown return to power. This scenario can potentially challenge the MCHFR because of the rapid RCS depressurization and void generation. Opening the ECCS valves at power is similar to the inadvertent operation of the ECCS transient described in DCA Part 2, Tier 2, Section 15.6.6.

Because of this similarity, the inadvertent operation of the ECCS EM is used to evaluate the MCHFR.

Before the ECCS valves are opened, the transient behavior is the same as in the DHRS-only cooldown event. DCA Part 2, Tier 2, Revision 2, Table 15.0-17, Sequence of Events for Overcooling Return to Power Event EDSS unavailable (MCHFR Case), shows that the MCHFR occurs at 7,900 seconds; the core power versus time is given in Figure 15.0-15, Return to Power ECCS Transition CaseReactor Power (MCHFR Case). The MCHFR versus time is given in Figure 15.0-14, Return to Power ECCS Transition CaseCritical Heat Flux Ratio (MCHFR Case). As given in DCA Part 2, Tier 2, Revision 2, Section 15.0.6.3.4, Conclusions, the MCFHR is 1.9, which is significantly above the 95/95 design limit of 1.13. The staff agrees that discharging RCS coolant at the maximum return to power is more limiting, based on the rapid void generation caused by the RCS depressurization, than the DHRS cooldown without ECCS actuation event. This behavior of the MCHFR is consistent with that seen in DCA Part 2, Tier 2, Revision 2, Section 15.6.6. The staff is unable to conclude that this scenario is the limiting MCHFR return to power event, as the applicant has not adequately addressed a potential return to power during an ECCS cooldown, as discussed below.

In DCA Part 2, Tier 2, Revision 2, Section 15.0.6, the applicant stated the following:

For those events that rely on heat removal using natural circulation flow through the RVVs and RRVs, the heat produced from a return to power with a nominal value for shutdown margin will be limited to less than 100 kW (0.06 percent of rated power) by negative reactivity feedback from moderator density. The low core heat level increases moderator temperature and generates voiding in the core, which in combination with the elevated RCS temperature due to the heatup of the reactor pool from the residual heat of multiple reactors being shut down upon a loss of all AC power, provides negative feedback to keep the core power very low. If decay heat exceeds 100 kW, the reactor will be maintained with keff<1 even with a worst rod stuck out because of negative density reactivity.

Therefore, the heat produced after a return to power with the RVVs and RRVs is bounded by maximum.

The staff notes that this language indicates a more realistic analysis, consistent with the GDC 27 exemption request but not necessarily a conservative Chapter 15 evaluation. This observation is further supported by the review of the response to RAI 9444. The response to RAI 9444 (ADAMS Accession No. ML18229A336) evaluates an extended NPM response to a conservative, EOC DHRS cooldown with ECCS actuation at the maximum DHRS return to power. The staff noted that following ECCS actuation, the reactor goes recritical again assuming a decay heat value above 100 kW. This extended ECCS cooldown behavior is supported by the increasing net reactivity of the return to power versus time following ECCS actuation, which is under review as part of the ongoing Chapter 15 audit (ADAMS Accession No. ML19004A098). Based on the staffs understanding of the response to RAI 9444, it appears that a return to power during an EOC, ECCS cooldown is possible using conservative Chapter 15 assumptions. The staff does note that Figure 7, Minimum critical heat flux ratio for 42

the hot channel as function of time of RAI 9444 shows the MCHFR remains above 2 but the staff is unsure how this is determined and the corresponding MCFHR 95/95 design limit under these conditions. In addition to requesting clarification in RAI 9506 (ML18180A352), which is being tracked as Open Item 15.0.6-4, regarding which decay heat values can lead to a return to power, the staff is requesting a conservative evaluation of the MCHFR for an EOC, ECCS cooldown and a corresponding revision to the DCA Part 2, Tier 2, Section 15.0.6, Return to Power Evaluation.

In RAI 8930, which is Open Item 15.0.6-5, the staff requested an LTC analysis that shows how a bounding boron dilution event affects core criticality and coolability. Physical phenomena have been identified that could redistribute boron between the RPV and CNV following ECCS actuation, as described in more detail in Section 15.6.5 of this SER. This redistribution could cause a decrease in the core boron concentration by an amount sufficient to overcome the shutdown margin, thereby causing a return to power. The staff asked the applicant to either demonstrate that the NPM remains subcritical, or that the EOC ECCS cooldown MCHFR bounds any potential return to power caused by boron redistribution. In its September 14, 2018 response (ADAMS Accession No. ML18257A308) to RAI 8930, Question 15-27, the applicant submitted an analysis, but the staff did not agree with the applicant that its model was sufficiently justified, nor that its assumptions were appropriately conservative in regard to boron volatility and the subsequent plate-out phenomena in the upper riser that could occur as the reactor undergoes extended cooldown. The applicant is preparing a supplement to the RAI response, as stated in a March 26, 2019, public meeting (ADAMS Accession No. MLXXXXXXXXX). Based on the above, the staff is tracking RAI 8930, Question 15-27, as Open Item 15.0.6-5.

The long-term evolution of the ejected rod analysis in DCA Part 2, Tier 2, Revision 2, Section 15.4.8, Spectrum of Rod Ejection Accidents, leads to a loss of RCS coolant and actuation of the ECCS. In the long term, this event is similar to the ECCS cooldown events with and without soluble boron. The major difference is the inability of the ejected rod to insert negative reactivity following a reactor trip, in addition to the lost stuck rod worth already evaluated in the ECCS cooldown. In RAI 9647 (ML19032A120), the staff requested that the applicant demonstrate that either the current DHRS cooldown with ECCS actuation at the maximum return to power MCHFR bounds the long-term ejected rod with ECCS cooldown, including the effect of boron redistribution, or provide an updated limiting return to power analysis and update DCA, Part 2, Tier 2, Section 15.0.6, accordingly. The staff is tracking RAI 9647 as Open Item 15.0.6-6.

The applicant stated in DCA Part 2, Tier 2, Section 4.3.1.5, that insertion of all control rods maintains subcriticality down to cold conditions. However, the shutdown margin given in Section 4.3.1.5 does not assume the potential boron redistribution discussed in RAI 8930, Question 15-27 (ADAMS Accession No. ML18149A640). Therefore, the staff is unable to conclude that the applicant has met the requirement in PDC 27 that the control rods shall be capable of holding the reactor core subcritical under cold conditions. As noted above, RAI 8930, Question 15-27, is Open Item 15.0.6-5.

The staff finds that no single failures that adversely affect the return to power scenarios have been identified. The return to power will happen well after the reactor trip, and only the DHRS and ECCS are used to mitigate the event. The consequences of a return to power on the DHRS are maximized when both trains are in service, and any degradation of the DHRS would minimize the return to power. The consequences of a DHRS cooldown coincident with 43

actuation of the ECCS are maximized if all ECCS valves discharge into containment.

Therefore, a single failure of an ECCS valve failing to open would be less limiting to the MCHFR. The consequences of a cooldown on the ECCS are also more limiting, assuming all ECCS valves are open, which would maximize the heat transfer from the CNV to the reactor building pool.

Barrier Performance The applicant concluded, and the NRC staff agrees, that the pressure in the RPV and main steam systems is maintained below 110 percent of the design values for this event. However, based on the open items described above, the staff is unable to conclude that the MCHFR remains above the 95/95 design limit.

Radiological Consequences Based on the open items described above, the staff is unable to conclude that there are no radiological consequences associated with this event.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.0.6.

Based on the open items documented above, the staff made no conclusions as to whether the applicant met GDC 10, 12, 17, 28, and 35. Likewise, the staff reached no conclusion regarding the exemption to GDC 27 and the adequacy of the applicants proposed PDC 27. The staff is also unable to conclude that incremental risk to public health and safety, related to estimated changes to CDF and LRF, is negligible with respect to the Commissions goals because the MCHFR SAFDLs (GDC 10) for the various return to power scenarios have yet to be demonstrated.

Based on the return to power scenarios, the staff is able to conclude that GDC 15 is met as the RPV pressure will be less than the 110 percent of nominal design value for all return to power scenarios. Likewise, the staff is able to conclude that probability of a return to criticality (power) is less than the lifetime of a reactor module, which is conservatively 1E-2 per reactor year.

15.1 Increase in Heat Removal by the Secondary System 15.1.1 Decrease in Feedwater Temperature The staff reviewed DCA Part 2, Tier 2, Section 15.1.1, Decrease in Feedwater Temperature, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.1.1.3 of this SER. A decrease in feedwater temperature is an AOO that causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the RCS cause an increase in core reactivity. Automatic control rod motion to maintain RCS temperature also adds positive reactivity. As a result, core power increases, and the MCHFR decreases. Continued overcooling leads to a reactor trip and subsequent actuation of the DHRS.

44

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

A decrease in feedwater temperature may result from a failure in the feedwater system (FWS).

The increase in heat transfer from the primary to the secondary system causes a reduction in RCS temperature, leading to positive reactivity insertion from the negative MTC and from the control rods attempting to maintain a programmed RCS temperature. As core power increases, the core outlet temperature also increases, leading to an almost simultaneous reactor trip and DHRS actuation on high core power and high RCS hot-leg temperature. DHRS actuation isolates feedwater, ending the cooldown, and transitions the NPM to a stable condition.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to obtain the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did not credit operator action and stated that no single failure produces a more limiting result for MCHFR.

The applicant concluded that the MCHFR remains above the 95/95 analysis limit for the NSP4 critical heat flux (CHF) correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the pressures described in DCA Part 2, Tier 2, Section 15.2, Decrease in Heat Removal by the Secondary Side.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS design with appropriate margin so that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

45

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so that the pressure boundary is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 20, as it relates to the reactor protection system being designed to automatically initiate appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so that SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Sections 15.1.1 through 15.1.4 list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• The most limiting moderate-frequency initiating events that result in increased heat removal are identified.

• For the most limiting initiating events, it is verified that the plant responds to the transients in such a way that the criteria for fuel damage and system pressure are met.

• Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

• Fuel cladding integrity shall be maintained by ensuring that the minimum departure from nucleate boiling ratio (DNBR) remains above the 95/95 DNBR based on acceptable correlations (see DSRS Section 4.4, Thermal and Hydraulic Design).

• An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

• The guidance provided in RG 1.105, Setpoints for Safety-Related Instrumentation, can be used to analyze the effect of instrument spans and setpoints on the plant response to the type of transient addressed in DSRS Sections 15.1.1 through 15.1.4, to meet the requirements of GDC 10, 13, 15, 20, and 26.

• The most limiting plant systems single failure, as defined in Definitions and Explanations, in 10 CFR Part 50, Appendix A, shall be identified and assumed in the analysis and shall satisfy the positions of RG 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems.

• The applicants analysis of transients caused by excessive heat removal should be performed using an acceptable analytical model and approved methodologies and computer codes. The values of the parameters used in the analytical model should be suitably conservative.

46

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to affect the limiting transient responses for DCA Part 2, Tier 2, Section 15.1, events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.1.1.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER presents the staffs evaluation of these codes.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant modeled the decrease in feedwater temperature as a linear decrease from the initial biased-high temperature of 154 degrees C (310 degrees F) to the minimum feedwater temperature of 37.8 degrees C (100 degrees F). The applicant conducted a sensitivity study to identify the limiting rate of temperature decrease by varying the length of time over which the temperature decreases and found that the limiting MCHFR occurs when the decrease occurs over 160 seconds, or a rate of about 0.72 degrees C (1.3 degrees F) per second. The staff finds this modeling approach acceptable because it considers an acceptable range of temperature decrease rates, and the applicant uses the limiting cooldown rate in conjunction with limiting initial conditions in the limiting event analysis.

The staff reviewed the initial parameter values and biases to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback. The end-of-cycle (EOC) MTC is acceptable because the highly negative MTC causes power to rise as RCS temperature falls, and the least negative Doppler temperature coefficient (DTC) provides the minimum negative reactivity feedback as fuel temperature increases.

The applicant credited several module protection system (MPS) signals for a decrease in feedwater temperature event, and the limiting event trips almost simultaneously because of the high core power and high hot-leg temperature signals. The applicant added a 5-percent uncertainty to the high core power setpoint to account for the temperature decalibration effect because of cooler, denser water in the downcomer affecting ex-core detector signals. The staff notes that the 5-percent uncertainty appears conservative based on an assumed 0.9 percent per degree C (0.5 percent per degree F) decalibration rate and an approximately 4.4-degree C 47

(8-degree F) decrease in downcomer temperature for the cooldown events and is therefore acceptable.

The staff notes that technical report TR-0616-49121, Revision 1, NuScale Instrument Setpoint Methodology Technical Report (ADAMS Accession No. ML18297A378) describes how the applicants setpoints conform to RG 1.105. The staffs review of TR-0616-49121 is in Chapter 7 of this SER.

In addition, the staff notes that the applicants assumptions about DHRS operation are limiting for a cooldown event since they tend to maximize cooling. For example, the reactor pool temperature is assumed to be the minimum operating temperature of 4.4 degrees C (40 degrees F), and DHRS heat transfer is increased by 30 percent. Furthermore, DHRS valves are assumed to open immediately when actuated.

The applicant did not credit operator action to mitigate the decrease in feedwater temperature event. The applicant assumed that the rod control system operates as designed, which the staff notes is conservative because it acts to withdraw control rods when the RCS temperature drops, inserting positive reactivity. The feedwater controls are conservatively disabled to provide a constant feedwater flow rate rather than the normal response of reducing feedwater flow.

The applicant did not assume a loss of power in the limiting event analysis. The staff notes that loss of ac power would trip the feedwater pumps, terminating the cooldown event, and therefore agrees that assuming a loss of power would not be limiting. The applicant also stated that no single failure causes a more limiting MCHFR. Although a single failure of a main steam isolation valve (MSIV) or a feedwater isolation valve (FWIV) may contribute to overcooling of the RCS, the staff notes that these valves close after DHRS actuation. MCHFR occurs before DHRS actuation, so failure of an MSIV or FWIV to close would not produce more limiting results for MCHFR.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). In addition, the staff confirmed through an audit that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology. The staff also verified that appropriate cases from the transient analysis were passed on for subchannel analysis as part of the ongoing Chapter 15 audit (see the audit plan at ADAMS Accession No. ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for MCHFR.

However, the staff notes that this event does not assume a single failure of an emergency core cooling system (ECCS) valve inadvertent actuation block (IAB), which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the single-failure criterion (SFC) is unresolved, and the staff provided SECY-19-0036, Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves (ADAMS Accession No. ML19060A162), dated April 11, 2019, to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not 48

crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 (ADAMS Accession No. ML17146B305), discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.1, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the decrease in feedwater temperature event and finds that it is consistent with the event description and assumptions about protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. However, the event sequences and consequences could change depending on the outcome of the open items discussed previously.

DCA Part 2, Tier 2, Table 15.1-3, presents the limiting analysis results for this event. The staff notes that the applicant did not bias parameters to maximize RCS or steam generator (SG) pressure. The applicant concluded that the primary and secondary pressure acceptance criteria are met because the pressure responses are less severe than those of AOOs in DCA Part 2, Tier 2, Section 15.2. The staff notes that the decrease in feedwater temperature event results in initial depressurization, with a relatively slow and small RCS pressurization just before the reactor trip that is bounded by the DCA Part 2, Tier 2, Section 15.2, events. The SG pressure increases rapidly following DHRS actuation, though the peak pressure remains below that of the limiting event in DCA Part 2, Tier 2, Section 15.2. The staff finds that the margin to the acceptance criteria, especially for SG pressure, and the bounding nature of the inherently pressurizing DCA Part 2, Tier 2, Section 15.2 events, provide reasonable assurance that the RCS and SG pressures will remain below 110 percent of the design values even if maximized for this event.

However, the staff is unable to confirm whether the MCHFR acceptance criterion is satisfied until open items are resolved.

There are no COL information items associated with Section 15.1.1 of DCA Part 2, Tier 2.

The staff reviewed the decrease in feedwater temperature event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the decrease in feedwater temperature AOO and GDCs 10, 13, 15, 20, and 26.

15.1.2 Increase in Feedwater Flow The staff reviewed DCA Part 2, Tier 2, Section 15.1.2, Increase in Feedwater Flow, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in 49

Section 15.1.1.3 of this SER. An increase in feedwater flow causes an increase in heat transfer from the primary to the secondary system. The negative MTC, the cooldown of the RCS, and the automatic control rod withdrawal to maintain RCS temperature cause an increase in core reactivity. Reactor power increases, while MCHFR decreases. Continued overcooling leads to a reactor trip and subsequent actuation of the DHRS.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

An increase in feedwater flow may result from a failure in the FWS. The increased heat transfer from the primary to the secondary system reduces RCS temperature, leading to positive reactivity insertion from the negative MTC and from the automatic control rod withdrawal attempting to maintain a programmed RCS temperature. Core power increases and MCHFR decreases, until the reactor trips on the high core power signal. The low steam superheat signal actuates DHRS, which transitions the NPM to a stable condition.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did not credit operator action and stated that no single failure produces a more limiting result for MCHFR. The applicant considered a single failure of an FWIV to investigate possible SG overfill scenarios.

The applicant concluded that the MCHFR remains above the 95/95 analysis limit for the NSP4 CHF correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the pressures described in DCA Part 2, Tier 2, Section 15.2.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS listed in Section 15.1.1.2 of this SER are also applicable to DCA Part 2, Tier 2, Section 15.1.2.

Technical Reports: There are no technical reports associated with this area of review.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.2.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and 50

is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to affect the limiting transient responses for DCA Part 2, Tier 2, Section 15.1 events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. The staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.1.2.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. To identify the limiting increase in feedwater flow scenario, the applicant analyzed a spectrum of feedwater flow increases up to a 100-percent increase relative to normal flow, assuming the flow linearly increases over 0.1 seconds. The staff notes that the maximum magnitude of increase is bounding based on possible causes of an increase in feedwater flow, and varying the magnitude of flow increase is sufficient to adequately identify the limiting rate of increase. The applicant concluded that the limiting event for MCHFR results from a 100-percent increase in feedwater flow.

The staff reviewed the initial parameter values and biases to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback caused by the EOC MTC and the least negative DTC. In addition, the staff notes that the applicants assumptions about DHRS operation are limiting for MCHFR since they tend to maximize cooling, as discussed in Section 15.1.1.4.2 of this SER.

The applicant credited several MPS signals for an increase in feedwater flow event, and the limiting event results in a reactor trip on the high core power signal and DHRS actuation on the low steam superheat signal. The applicant added a 5-percent uncertainty to the high core power setpoint to account for the temperature decalibration effect as a result of cooler, denser water in the downcomer affecting ex-core detector signals. As discussed in Section 15.1.1.4.2 of this SER, the staff finds that a 5-percent uncertainty is acceptable.

Technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105.

The staffs review of TR-0616-49121 is in Chapter 7 of this SER.

The applicant did not credit operator action to mitigate the increase in feedwater flow event.

The applicant assumed that the rod control system operates as designed, which is conservative because it withdraws control rods when the RCS temperature drops, inserting positive reactivity.

In addition, the applicant did not assume a loss of power or a single failure for the limiting MCHFR case. For the reasons stated in Section 15.1.1.4.2 of this SER, the staff finds these assumptions generally acceptable.

51

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results for MCHFR (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). In addition, the staff confirmed through an audit that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology that the NRC staff reviewed separately and found acceptable, TR-0915-17564-P-A and-NP-A, Revision 2, Subchannel Analysis Methodology (ADAMS Accession No. ML19067A256). The staff also verified that appropriate cases from the transient analysis were passed on for subchannel analysis as part of the ongoing Chapter 15 audit (see the audit plan at ADAMS Accession No. ML19004A098). The audited material supports the discussions about the limiting MCHFR case in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for MCHFR.

However, the staff notes that for the increase in feedwater flow event, the applicant did not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant considered a single failure of an FWIV to close to analyze the potential for an SG overfill, which could disable the related DHRS train. The staff audited related calculation notes and observed that the DHRS appears capable of performing its design function even when the SG inventory is maximized; however, other calculation assumptions may not be the most limiting in terms of the challenge to DHRS functionality (see the audit summary memorandum for the completed audit at ADAMS Accession No. MLXXXXXXXXX and the audit plan for the ongoing audit at ADAMS Accession No. ML19004A098). Therefore, the staff is tracking RAI 9483, Question 15.01.01-7, as Open Item 15.1.1-1.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.2, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the increase in feedwater flow event and finds that it is consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. However, the event sequences and consequences could change, depending on the outcome of the open items discussed previously.

DCA Part 2, Tier 2, Table 15.1-6, presents the limiting analysis results for this event. The staff notes that the applicant did not bias parameters to maximize RCS or SG pressure. For the same reasons discussed in SER Section 15.1.1.4.3, the staff has reasonable assurance that the RCS and SG pressure acceptance criteria would be met even if maximized for this event.

52

However, the staff is unable to confirm whether the MCHFR acceptance criterion is satisfied until open items are resolved.

There are no COL information items associated with Section 15.1.2 of DCA Part 2, Tier 2.

The staff reviewed the increase in feedwater flow event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the increase in feedwater flow event and GDCs 10, 13, 15, and 26, and 10 CFR 20.1406.

15.1.3 Increase in Steam Flow The staff reviewed DCA Part 2, Tier 2, Section 15.1.3, Increase in Steam Flow, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.1.1.3 of this SER. This event is postulated to result from a spurious opening of the turbine bypass valve. The increased steam flow increases heat transfer from primary to secondary, cooling the RCS and causing a positive reactivity insertion. Positive reactivity is also added as control rods withdraw to maintain moderator temperature, resulting in increasing power. A reactor trip and DHRS actuation mitigate the event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

An increase in steam flow event may result from a spurious opening of the turbine bypass valve or the main steam safety valves (MSSVs). The increased steam flow increases heat transfer from the primary to the secondary system, decreasing moderator temperature and inserting positive reactivity. The control rods withdraw to maintain a programmed RCS temperature, inserting more positive reactivity. The reactivity addition increases core power and decreases MCHFR. A reactor trip and DHRS mitigate the transient.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did not credit operator action and stated that no single failure produces a more limiting result for MCHFR.

The applicant concluded that the MCHFR remains above the 95/95 analysis limit for the NSP4 CHF correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the 53

peak pressures calculated in DCA Part 2, Tier 2, Section 15.2, Decrease in Heat Removal by the Secondary Side.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS listed in Section 15.1.1.2 of this SER are also applicable to DCA Part 2, Tier 2, Section 15.1.3.

Technical Reports: There are no technical reports associated with this area of review.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.3.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to affect the limiting transient responses for DCA Part 2, Tier 2, Section 15.1 events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the information in DCA Part 2, Tier 2, Revision 2, Section 15.1.3.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions To identify the limiting increase in steam flow scenario, the applicant analyzed a spectrum of steam flow increases up to a 125-percent increase, assuming the flow linearly increases over 0.1 seconds. The staff notes that the maximum magnitude of increase is bounding because an inadvertent opening of a turbine bypass valve results in a 100-percent steam flow increase, and varying the magnitude of flow increase is sufficient to reliably identify the limiting rate of increase. The applicant found that the limiting event for MCHFR results from a 14-percent increase in steam flow.

The staff reviewed the initial parameter values and biases for the increase in steam flow event to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback from the EOC MTC and the least negative DTC. In addition, the staff notes that the applicants assumptions 54

about DHRS operation are limiting for MCHFR since they tend to maximize cooling, as discussed in Section 15.1.1.4.2 of this SER.

The applicant credited several MPS signals for an increase in steam flow event, and the limiting event results in a reactor trip and DHRS actuation on the high hot-leg temperature signal.

Technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105.

The staffs review of TR-0616-49121 is presented in Chapter 7 of this SER.

The applicant did not assume a loss of power in the limiting event analysis and stated that no single failure causes a more limiting MCHFR. For the reasons stated in Section 15.1.1.4.2 of this SER, the staff finds these assumptions generally acceptable. However, the staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.3, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the increase in steam flow event and finds that it is consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. However, the event sequences and consequences could change, depending on the outcome of the open items discussed previously.

DCA Part 2, Tier 2, Table 15.1-9, presents the limiting analysis results for this event. The staff notes that the applicant did not bias parameters to maximize RCS or SG pressure. For the same reasons discussed in SER Section 15.1.1.4.3, the staff has reasonable assurance that the RCS and SG pressure acceptance criteria would be met even if maximized for this event.

However, the staff is unable to confirm whether the MCHFR acceptance criterion is satisfied until open items are resolved.

There are no COL information items associated with Section 15.1.3 of DCA Part 2, Tier 2.

The staff reviewed the increase in steam flow event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the increase in steam flow event and GDCs 10, 13, 15, and 26, and 10 CFR 20.1406.

15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve 55

DCA Part 2, Tier 2, Section 15.1.4, Inadvertent Opening of Steam Generator Relief or Safety Valve, states that the NPM design does not have SG relief or safety valves but does include two MSSVs downstream of the MSIVs. The DCA further states that an inadvertent opening of an MSSV is bounded by the increase in steam flow event analyzed in DCA Part 2, Tier 2, Section 15.1.3.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.1.4, as summarized in Section 15.1.4.1 of this SER.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: There are no technical specifications associated with this section.

Technical Reports: There are no technical reports associated with this section.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.3.

The staff evaluated the applicants claim that this event is bounded by an increase in steam flow event. DCA Part 2, Tier 2, Section 15.1.4, states that the two MSSVs together must accommodate 100 percent of the full power steam flow. Therefore, a spurious opening of one MSSV would result in a steam flow of at least 50 percent, but less than 100 percent, of steam flow at full power. A spurious opening of the turbine bypass flow valve, also located downstream of the MSIVs, could result in a 100-percent increase in steam flow. For this reason, the applicant concluded that an inadvertent opening of the turbine bypass valve bounds the steam flow increase caused by a spurious opening of an MSSV and did not analyze an inadvertent MSSV opening event. Based on its review of the design information, the staff agrees with and confirms the applicants conclusion that the inadvertent opening of an MSSV is bounded by the increase in steam flow event analyzed in DCA Part 2, Tier 2, Section 15.1.3.

There are no COL information items associated with Section 15.1.4 of DCA Part 2, Tier 2.

For the NPM design, the staff concludes that the inadvertent opening of a steam generator relief or safety valve event is bounded by the increase in steam flow event, which is discussed in Section 15.1.3 of this SER.

15.1.5 Steam System Piping Failures Inside and Outside of Containment 56

A break in steam piping inside or outside of containment can cause an increase in the heat removal rate from the reactor coolant system (RCS) resulting in a reduction of RCS temperature and pressure.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.1.5, Steam Piping Failures inside and outside of Containment.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 17, as it relates to onsite and offsite electric power systems and ensures that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

• 10 CFR Part 50, Appendix A, GDC 27, as it relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.

• 10 CFR Part 50, Appendix A, GDC 28, as it relates to limits on the potential amount and rate of reactivity increase to ensure that the effects of postulated reactivity accidents can neither (1) result in damage to the RCPB greater than limited local yielding nor (2) sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core.

57

• 10 CFR Part 50, Appendix A, GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

DSRS Section 15.1.5 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following sections discuss the staffs technical evaluation of the applicants steamline break (SLB) analysis.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.1.5, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.1.5.1, that because a steamline break in the NuScale plant can result from various mechanisms, the applicant considered a spectrum of SLB sizes and locations, with varying core and plant conditions, to determine the SLB scenarios with the most limiting results.

Thus, the applicant presented various limiting cases in this DCA Part 2 section, each with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.1.5, are the following: limiting RCS pressure case, limiting MCHFR case, and limiting radiological consequences case. The staff also notes that the applicant classified this event as an accident consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considers a spectrum of SLBs in different locations throughout the system.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the NRC staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.1.5. As part of the staffs review, the staff confirmed through audit (ADAMS Accession No. MLXXXXXXXXX) that the applicant followed the non-LOCA methodology for this DCA Part 2 section.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER presents the staffs evaluation of these codes.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that some 58

input assumptions varied slightly among the limiting SLB cases presented because some of these parameters would affect different aspects of the transient (e.g., the most negative moderator temperature coefficient is more limiting for the MCHFR case, whereas the most positive moderator temperature coefficient is more limiting for the RCS pressure case, because this maximizes the power response for each respective case). In any case, the staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

The staff reviewed the initial conditions and noted that NuScale used nominal initial conditions for the limiting radiological consequences case, as opposed to conservatively biased conditions as it used for the limiting MCHFR and limiting RCS pressure cases, to ensure that appropriate conservatisms were used in the analysis. In the responses (ADAMS Accession Nos. ML18180A323 and ML18333A322) to RAI 9478, Question 15.01.05-2, NuScale stated that the SLB radiological analysis was performed in accordance with the methodology described in the non-LOCA topical report, TR-0516-49416, including a sufficient number of sensitivity cases to determine the most limiting radiological release scenarios. NuScale further stated that the consequences for both scenarios are maximized by detection avoidance, which is exacerbated with a nominal initialization that starts the transient furthest from the trip condition.

Additionally, NuScale provided markups of the non-LOCA topical report for consistency between the DCA analysis and non-LOCA topical report methodology. The staff finds the RAI responses acceptable because the applicant adequately addressed the analysis initial conditions and limiting scenario. This is a confirmatory item contingent on confirmation of the incorporation of the markups in the next revision of the non-LOCA topical report.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.1.5, analysis, the staff confirmed that initial parameters, such as power level, RCS temperature, pressurizer (PZR) pressure, PZR level, RCS flow, scram characteristics (including the assumption of a stuck rod),

Doppler reactivity feedback, moderator temperature reactivity feedback, SG characteristics, and DHRS characteristics, were conservatively chosen for the analysis. The staff also confirmed that NuScale considered instrument inaccuracies and credited no operator action to mitigate the consequences of an SLB.

The staff reviewed the applicants single-failure assumptions for this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the SLB event. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The staff noted that, for the limiting RCS pressure case and the limiting MCHFR case, no single failure was found to have an adverse impact on either cases figure of merit. For the limiting radiological consequences case, the staff noted that the applicant modeled a single failure of the MSIV on the affected train. The staff confirmed that a failure of the MSIV on the affected train will maximize mass and energy release after an isolation signal occurs, which is conservative for the radiological consequences case. However, the staff noted that the applicant did not justify the credit of components that are not safety-related for accident mitigation, when a single failure of a safety-related component was assumed. In responses 59

dated July 9, 2018, and November 20, 2018 (ADAMS Accession Nos. ML18190A509 and ML18324A889, respectively), to RAI 9420, Question 15-17, on this topic, NuScale provided the basis for the crediting of components that are not safety-related for accident mitigation, when a single failure of a safety-related component is assumed. The staff finds the responses to the RAI acceptable, per SER Section 15.0.0.6, contingent on confirmation of the incorporation of the markups in the next revision of DCA Part 2, Tier 2. This is a confirmatory item.

The staff reviewed the applicants assumptions regarding break size and location. The staff noted that, as with other model assumptions, the limiting break size and location were dependent on which figure of merit (e.g., RCS pressure, MCHFR, or radiological consequences) was being analyzed. Nevertheless, the staff confirmed via audit (ADAMS Accession No. MLXXXXXXXXX) that the applicants assumed limiting break sizes and locations were supported by sensitivity analyses.

The staff reviewed the applicants assumptions regarding the availability or unavailability of electric power systems. The staff confirmed that, for each limiting case, the applicants power assumptions were conservatively determined.

Pending resolution of the open and confirmatory items identified, the staff finds the applicants SLB analysis-specific assumptions, input, and boundary conditions acceptable because they were selected conservatively and demonstrate acceptable mitigation of this event and protection of fission product barriers.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.1.5, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff specifically reviewed reactor power, reactor and SG pressures, core temperatures, break flow rates, MCHFR, and reactivity.

As part of the staffs review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants SLB case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff notes that for an SLB accident, the secondary side naturally depressurizes, and thus, in any given case, the main steam system pressure is of no concern. However, the staff notes that when the DHRS is actuated, a pressurization of that DHRS train will occur. This pressurization is understood and expected, and for an SLB accident, is not expected to challenge pressure limits for the secondary side. The applicant provided SG pressure plots, and the NRC staff confirmed that these representative SG pressures demonstrate that main steam system pressure is non-limiting for an SLB.

The staff reviewed the applicants SLB case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit.

60

However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

The staff notes that the radiological analysis of the SLB accident is presented in DCA Part 2, Tier 2, Section 15.0.3. The staffs review of the radiological consequences occurring from an SLB is documented in Section 15.0.3 of this report.

The staff confirmed that the DHRS is safety-related, and under the worst single-failure assumption for this event, which could render one train of the DHRS completely inoperable, the second train of the DHRS automatically actuates and provides an adequate amount of heat removal to cool the core during and after the accident.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.1.5.

Based on the open items discussed above, no conclusions can be reached regarding the applicants SLB analysis and GDCs 13, 17, 27, 28, and 31.

61

15.1.6 Loss of Containment Vacuum In the NuScale design, the containment vessel (CNV), which is partially submerged in the reactor pool, is normally kept at a very low absolute internal pressure. This serves to insulate the reactor pressure vessel (RPV) from the relatively cooler pool water during normal operations. An event resulting in a loss of containment vacuum conditions, whether through air or water ingress into the containment, would degrade the insulation function provided by the containment vacuum and thereby increase the heat transfer from the RPV to the pool, similar to an overcooling event. Overcooling events have the potential to decrease moderator temperature, which increases core reactivity, and can therefore lead to higher reactor power, higher RCS pressure, and reductions in MCHFR and shutdown margin. This event is expected to be of moderate frequency when compared to a pipe break, as it could result from operator action or equipment malfunction and is therefore classified as an AOO.

DCA Part 2, Tier 1: There is no Tier 1 content related to Section 15.1.6.

DCA Part 2, Tier 2: DCA Part 2, Tier 2, Section 15.1.6, Loss of Containment Vacuum/Containment Flooding, summarizes the analyses performed by the applicant related to the loss of containment vacuum or containment flooding event. During normal operation, the containment evacuation system (CES) maintains the containment vacuum conditions. DCA Part 2, Tier 2, Section 9.3.6, Containment Evacuation System and Containment Flooding and Drain System, discusses the CES. As stated by the applicant, a failure of this system could lead to an increase in containment pressure. Another means of losing containment vacuum is a pipe break or leakage of sufficient quantity to overwhelm the CES, such that containment begins to flood. In both scenarios, more severe transients exist that could cause similar effects but have other impacts and are analyzed in other sections of the DCA; for example, in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside Containment, or Section 15.1.5, Steam System Piping Failures Inside and Outside of Containment.

The applicant stated that the loss of vacuum event is bounded by a containment flooding event, and the most severe containment flooding event not bounded by another existing event analyzed in Chapter 15 is initiated as a break or leak in the reactor component cooling water system (RCCWS), which would not result in immediate boiling since the fluid temperature is low.

This scenario allows for the containment to partially fill with water, increasing the heat losses from the RPV, while not generating substantial vapor so that containment pressure remains below the trip setpoint.

The limiting containment flooding event is based on an RCCWS break inside containment, with a total volume of 14.2 cubic meters (500 cubic feet) and two RCCWS pumps operating following the break event. Additionally, a CES pump operates at capacity, which delays the onset of the containment pressure trip, with no trip occurring during the period of analysis. The applicant stated that the most severe sequence for this scenario results from retaining all power, with no single failures resulting in a more limiting response with respect to the acceptance criteria.

Other combinations of available power (ac, non-safety-related dc, and highly reliable dc) are analyzed, but not considered limiting.

62

For the analyses, the applicant used initial conditions intended to maximize RCS power over the longest duration such that containment fills, which increases heat losses to the reactor pool and therefore increases the magnitude of the overcooling. DCA Part 2, Tier 2, Section 15.1.6.3.2, Input Parameters and Initial Conditions, and Table 15.1-10, Loss of Containment Vacuum/Containment FloodingInputs, summarize these input parameters. Figures 15.1-47 through 15.1-52 show the results for the limiting case. The applicant stated that this event results in a small overcooling transient with a slightly degraded MCHFR that is bounded by the other overcooling transients.

ITAAC: There are no ITAAC associated with Section 15.1.6.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• LCO 3.4.7, RCS Leakage Detection Instrumentation

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports related to Section 15.1.6.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to the RCS being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs

• 10 CFR Part 50, Appendix A, GDC 20, as it relates to the reactor protection system being designed to automatically initiate appropriate systems, including the reactivity control systems, to ensure that SAFDLs are not exceeded during any condition of normal operation, including AOOs

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the ability of the design to reliably control reactivity changes to ensure that SAFDLs are not exceeded, including during AOOs DSRS Section 15.1.6 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

63

A loss of containment vacuum event is unique to the NuScale design. Because of the coupling and relative size of the RPV, the CNV, and the reactor pool, what would be a relatively benign liquid release in a traditional PWR could have an appreciable impact on the primary-side heat balance for the NuScale design. The containment is normally kept at vacuum conditions (less than 690 Pa (0.1 psia)), and therefore normally serves to insulate the RPV from the cooler reactor pool. An event in which the vacuum condition is not maintained, whether because of the ingress of water vapor or air, or the flooding of containment, degrades that insulation function.

This results in an event sequence that falls outside of the traditional Chapter 15 scope but requires analysis to confirm that safety acceptance criteria are met.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to model the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. The staffs evaluation is based on NRELAP5 Version 1.3, used to generate DCA Part 2, Tier 2, Revision 2, Section 15.1.6.

For the subsequent CHF analysis, the boundary conditions from the NRELAP5 analyses were passed to the subchannel CHF analyses, which the applicant performed using VIPRE-01. The applicant discussed the two code packages in DCA Tier 2, Section 15.0.2, Review of Transient and Accident Analysis Methods. The NRC staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions One means of losing containment vacuum involves a failure or degradation in CES capability such that a small amount of air or water vapor is allowed to exist within the containment. In the long term, this is similar to operating at a higher containment pressure while under the trip setpoint. The applicant performed a calculation demonstrating that an event of this nature would be bounded by a containment flooding event. The staff audited the calculation and compared it to the containment flooding analysis documented in the DCA and observed that the two calculations exhibit very similar behavior (see ADAMS Accession No. MLXXXXXXXXX).

For the events the applicant has characterized as a loss of containment vacuum (not a containment flooding event), there is a minimal effect on the parameters of interest and transient acceptance criteria. In calculations audited by the staff (ADAMS Accession No. MLXXXXXXXXX), results showed that the unit remained at power with a relatively small increase in heat loss from the RPV. RCS parameters and core power exhibited minor variations compared to nominal steady-state conditions. Because both this loss of vacuum and the flooding event ultimately end in quasi-steady states at higher power levels with no trip, the primary difference is the end-state power level and margin to the acceptance criteria. The flooding event is more limiting for the relevant figures of merit for this calculation. As such, the events in which containment flooding occurs are stated to bound the events involving only a loss 64

of containment vacuum. The staff agrees with this characterization, and the containment flooding events are evaluated in further detail in the following paragraphs.

As stated in the DCA, another cause of a loss of containment vacuum is a pipe break or leakage of sufficient volume to overwhelm the CES pump flow rate. Non-RCS fluid sources include the feedwater line, the main steamline, the chemical and volume control system (CVCS), and the RCCWS, which cools the control rod drive system. RCS breaks could also cause containment flooding events, but most would have additional consequences and are analyzed in other Chapter 15 sections. Some of these events are analyzed separately: feedwater pipe breaks are evaluated in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside of Containment; SLBs are evaluated in Section 15.1.5; and CVCS line breaks are evaluated in Section 15.6.2, Failure of Small Lines Carrying Primary Coolant Outside Containment. Considering these evaluations, viable loss of containment vacuum or containment flooding events that are not already analyzed elsewhere are limited to the RCCWS break and RCS high-point vent break.

The applicant also stated that the RCCWS break bounds the non-safety-related RCS high-point vent line with regards to the containment flooding event because of the subcooled nature of the break, which results in additional fluid being released into containment before the high-pressure trip setpoint is reached. The NRC staff agrees with this conclusion, especially given that other effects associated with the RCS high-point vent line break are assessed as part of the break spectrum analyzed in DCA Tier 2, Section 15.6.5, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.

Therefore, the only containment flooding event analyzed in Section 15.1.6 is the RCCWS line break.

With respect to the transient initial conditions, the applicant selected values intended to maximize RCS power and thereby maximize the amount of overcooling. The RCCWS is assumed to operate at maximum flow and minimum temperature so that liquid conditions in the containment are most conducive to transferring heat from the RPV to the reactor pool. Initial power is maximized, and the reactor is assumed to be at EOC conditions to produce a limiting power response. The NRC staff reviewed these conditions, as well as the related analyses of other input conditions in calculations audited by the staff (ADAMS Accession No. MLXXXXXXXXX) and determined that the values selected by NuScale represent a conservative set of values for this transient, as they produce the most limiting power response.

In the event of an RCCWS line break inside containment, the CNV slowly begins to fill with a mixture of liquid water and water vapor as the result of the low vapor pressure inside the CNV.

The CES then acts to remove vapor as the containment pressure increases. For the purposes of this transient, this assumption is conservative because maintaining containment pressure under the trip setpoint prolongs the transient as the CNV fills with water. During the transient, the RCCWS line break is assumed to flood containment with a volume equal to a full piping arrangement, with no makeup. As documented in DCA Tier 2, Revision 2, Section 9.2.2, Reactor Component Cooling Water System, the RCCWS inventory is limited by the RCCWS expansion tank, which requires operator action to be refilled. Leaks from the RCCWS can be detected through a variety of means, including those associated with RCS leakage.

DCA Tier 2, Section 15.1.6.2, Sequence of Events and Systems Operation, notes that there are no single failures that would result in more severe calculated values with respect to the acceptance criteria.

65

The staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The results from the sequence discussed previously are displayed in DCA Part 2, Tier 2, Figures 15.1-47 through 15.1-52. Figure 15.1-47, Reactor Power (15.1.6 Containment Flooding), shows reactor power during the transient; as stated previously, the reactor does not trip, and thus, reactor power stabilizes about 1 percent higher than the initial conditions.

Figure 15.1-48, Reactor Component Cooling Water System Break Flow Rate (15.1.6 Containment Flooding), displays the RCCW break flow, which is a constant based on the system flow rate until the assumed inventory is depleted. Figure 15.1-49, Reactor Pressure Vessel Heat Transfer (15.1.6 Containment Flooding), provides the integral heat losses from the RPV. The figure shows that the heat losses for this event increase fairly rapidly early in the transient before asymptotically approaching a lower, constant value. Figures 15.1-50 through 15.1-52 are related and show the collapsed liquid level (CLL) in the CNV, the CES mass flow rate, and the containment pressure, respectively. Because the applicant assumed a limited inventory in the RCCW system, the CNV level value rapidly increases to level off at a little over 14 feet in the CNV, with some irregular spikes early in the transient. As stated in DCA Section 15.1.6.3.3, Results, incongruities in the NRELAP model where local boiling occurs can cause local pressure conditions at the top of the CNV fluid region to drop and create further spikes in level and pressure. The staff does not view these spikes as relevant to the outcome in the context of the two-phase level tracking model in NRELAP and agrees that they do not significantly affect the end state of the transient.

From the information provided in the DCA, in conjunction with the material audited by the NRC staff (ADAMS Accession No. MLXXXXXXXXX), the staff finds this to be a transient sequence different from most of the Chapter 15 events, as this transient does not involve a reactor trip.

This results in minor differences in determining what constitutes the transient end state, with the applicant choosing to terminate the transient upon reaching stable conditions at a higher reactor power level. Because no trip setpoint is reached and the transient approaches an equilibrium state, the staff accepts this choice as reasonable for the loss of containment vacuum event, especially given that the figures of merit for the relevant acceptance criteria, discussed in the following paragraph, are bounded by the values calculated for other Chapter 15 events.

The acceptance criteria for AOOs include RCS pressure, steam pressure, containment pressure, MCHFR and fuel centerline temperature. In addition, an AOO should not progress into a more serious event. By demonstrating that these acceptance criteria are met, the applicant satisfied the requirements associated with GDC 10, 15, 20, and 26 for this transient.

For this event sequence, the applicants analysis demonstrates that pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event, and the minimum DNBR remains above the 95/95 limit. Fuel centerline temperature and containment pressure are considered nonlimiting for this event, with no challenge to limits 66

expected and other events substantially bounding the values calculated for this transient. For this transient, the reactor does not trip but stabilizes at a new, higher power level. Since the transient does not progress into a more severe event, the staff agrees with the applicants conclusion that this AOO meets the defined thermal-hydraulic acceptance criteria and the radiological barriers will not be challenged. Therefore, the staff finds that GDC 10, 15, 20, and 26 are met for this transient.

For the scope of the transient analyzed in this section, where the reactor does not trip, the indications available to the operators, particularly those indications relied on to monitor reactor leakage as stipulated by TS LCO 3.4.5, RCS Operational Leakage, provide operators a range of variables sufficient to monitor and diagnose the event and ensure that fission product barriers provide adequate safety within prescribed operating ranges, consistent with GDC 13. The plant response for this transient in the event of a reactor trip, as discussed previously, is enveloped by other transients evaluated in Chapter 15.

There are no COL information items related to Section 15.1.6.

Based on the open items discussed above, no conclusions can be reached regarding the AOO resulting in a loss of containment vacuum condition and GDCs 10, 13, 15, 20, and 26.

15.2 Decrease in Heat Removal by the Secondary Side 15.2.1 Loss of External Load, Turbine Trip, and Loss of Condenser Vacuum This SER section documents the staffs review of DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, Loss of External Load, Turbine Trip, and Loss of Condenser Vacuum, respectively. These events are discussed together since the transient responses are highly similar, and the applicant presented a single set of bounding results that envelops these three events.

The staff reviewed the events in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, to ensure that they are analyzed appropriately and meet the acceptance criteria outlined in Section 15.2.1.3 of this SER. The loss of external load (LOEL), turbine trip (TT), and loss of condenser vacuum (LOCV) events all result in a decrease in heat removal by the secondary system and a corresponding temperature and pressure increase in the RCS. Secondary pressure also increases.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Sections 15.2.1 through 15.2.3, summarized below.

67

An LOEL is an AOO caused by loss of most or all of the turbine generator load. The LOEL generates a TT that results in isolating the steam flow from the SGs to the turbine because of the closure of the turbine control valves (TCVs). The NPM design includes a turbine bypass valve that opens to allow the reactor to remain in operation in the event of a TT by transferring the main steam flow to the condenser. However, the events in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, do not credit the turbine bypass system. Therefore, primary and secondary-side temperatures and pressures increase until a reactor trip is issued, and the DHRS is actuated on either high PZR pressure or high steam pressure. The DHRS transfers decay heat to the reactor pool. The severity of the event is ultimately determined by how long it takes to initiate and establish a steady cooldown via the DHRS.

A TT is an AOO that may result from many different conditions that cause the turbine generator control system to initiate a TT signal or a failure in the control system itself. A TT initiates closure of the turbine stop valves (TSVs), which terminates steam flow from the SGs to the turbine. The TT event proceeds similarly to the LOEL event.

An LOCV is an AOO that may occur because of a reduction in condenser cooling, failure of the main condenser evacuation system to remove noncondensable gases, or in-leakage of air. An LOCV is similar to the LOEL and TT events, except that a loss of feedwater also occurs at event initiation because of the loss of net positive suction head in the condensate pumps. Therefore, a similar system response results.

The LOEL, TT, and LOCV events potentially challenge the RCS pressure, SG pressure, and MCHFR acceptance criteria. Therefore, the applicant evaluated the limiting cases with respect to each of the acceptance criteria in the DCA. The applicant stated that the LOEL, TT, and LOCV events resulted in almost identical responses and therefore included a single bounding set of figures for the three events. The applicant concluded that the limiting cases meet all acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

68

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the RCPB is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Sections 15.2.1 through 15.2.5 list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• The most limiting moderate-frequency event that results in an unplanned decrease in secondary system heat removal is identified, in particular as to primary pressure, secondary pressure, and long-term decay heat removal.

• The predicted plant response for the most limiting event satisfies the specific criteria for fuel damage and system pressure.

• Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

• Fuel cladding integrity must be maintained by the minimum DNBR (for NuScale, MCHFR) remaining above the 95/95 limit based on acceptable correlations (see DCA Part 2, Tier 2, Section 4.4) and by satisfaction of any other SAFDL applicable to the particular reactor design.

• An incident of moderate frequency should not generate an aggravated plant condition without other faults occurring independently.

• Plant protection systems setpoints assumed in the transient analyses are selected with adequate allowance for measurement inaccuracies as delineated in RG 1.105.

• Event evaluations consider single failures, operator errors, and performance of non-safety-related systems consistent with RG 1.206.

• The applicant should analyze these events using an acceptable analytical model. Any other analytical model proposed by the applicant will be evaluated by the staff for acceptability.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the LOEL, TT, and LOCV events. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to significantly affect DCA Part 2, Tier 2, Section 15.2, events. Pending 69

the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the information in DCA Part 2, Tier 2, Revision 2, Sections 15.2.1 through 15.2.3.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER presents the staffs evaluation of these codes.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. As stated previously, the LOEL, TT, and LOCV events are similar. The main differences are that an LOEL causes TCV closure, while a TT initiates TSV closure. The applicant models TCV and TSV closure similarly, except that TCV closure is slower than TSV closure. Therefore, plant responses are generally more severe for TT than LOEL. An LOCV is similar to a TT except that it also includes a loss of feedwater at event initiation, which is typically limiting for RCS pressure and MCHFR responses.

The conditions, biases, and assumptions used to determine limiting values for each acceptance criterion (RCS pressure, SG pressure, or MCHFR) may be different to maximize the consequences for the acceptance criterion being considered. Therefore, some differences occur in the event progressions for each acceptance criterion. However, one common assumption is that the applicant does not credit operator action. In addition, each of the analyses assumes that plant control systems perform as designed, with allowance for instrument inaccuracy, unless their action mitigates the events. Furthermore, the applicant did not assume loss of dc power in any case, which the staff finds acceptable because it would result in actuation of the engineered safety features (ESFs) earlier in the transient, thus leading to less severe consequences.

The limiting RCS pressure case is an LOCV with a concurrent loss of ac power. The immediate loss of feedwater leads to reduced heat removal by the secondary and RCS pressurization.

The high PZR pressure signal actuates reactor trip and the DHRS. The DHRS actuation opens the DHRS valves and closes the FWIVs, MSIVs, and the non-safety-related feedwater regulating valves and secondary MSIVs. DHRS actuation also deenergizes the PZR heaters, though for this case, they are already deenergized because of the loss of ac power. A reactor safety valve (RSV) opens to mitigate the RCS pressure increase. The limiting single failure for the RCS pressure case is a failure of an FWIV to close; however, the effect on RCS pressure is negligible (less than 1 pound per square inch (psi)).

The limiting SG pressure scenario is a TT with an assumed failure of an FWIV to close, which causes feedwater flow to continue to the affected SG until the non-safety-related feedwater regulating valve closes. This maximizes SG pressure and leads to a reactor trip and DHRS actuation on high steam pressure. A loss of ac power is not limiting for SG pressure because it would terminate feedwater flow at the start of the transient.

The applicant stated that the FWIV failure could lead to overfilling and disabling of one DHRS train. The staff notes that the loss of one DHRS train is not a concern because each of the two DHRS trains is designed to remove 100 percent of the RCS decay heat. Furthermore, DCA Part 2, Tier 2, Section 15.2.8, considers the loss of one DHRS train because of a double-ended 70

guillotine feedwater line break (FWLB) inside containment and shows that the event is not limiting. The staffs review of the FWLB event is described in Section 15.2.8 of this SER.

The limiting MCHFR case is an LOCV, which leads to a reactor trip and DHRS actuation on high PZR pressure, as well as the lifting of an RSV. The applicant indicated that no single failure results in a more limiting MCHFR. The staff finds that a failure of an MSIV or FWIV to close would have no impact because the failure would occur after the time of MCHFR.

However, the staff notes that these events do not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The staff reviewed the input parameters and initial conditions for each of the limiting cases to ensure that the applicant selected conservative values for the analyses. The staff notes that the applicant assumed suitably conservative parameters as described in DSRS Sections 15.2.1 through 15.2.5, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting beginning-of-cycle (BOC) reactivity feedback. The BOC reactivity feedback is conservative for RCS overheating events because the reactivity coefficients are least negative and therefore minimize the negative reactivity feedback resulting from temperature increases. In addition, the assumptions of maximum decay heat, feedwater temperature, and reactor pool temperature are limiting for overheating events since they present the greatest challenge to heat removal.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

The staff notes that technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, to ensure they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the LOEL, TT, and LOCV events and notes that they are consistent with the event descriptions and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event descriptions and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the events do not lead 71

to aggravated plant conditions. However, the event sequences and consequences could change, depending on the outcome of the open items discussed previously.

DCA Part 2, Tier 2, Table 15.2-7, presents the limiting analysis results for these events. The applicant concluded that the limiting RCS and SG pressures and MCHFR meet the specified acceptance criteria. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

There are no COL information items associated with Sections 15.2.1 through 15.2.3 of DCA Part 2, Tier 2.

The staff reviewed the LOEL, TT, and LOCV events, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transients. Based on the open items discussed above, no conclusions can be reached regarding the LOEL, TT, and LOCV events and GDCs 10, 13, 15, and 26.

15.2.2 Turbine Trip The staffs review of this event is documented in SER Section 15.2.1.

15.2.3 Loss of Condenser Vacuum The staffs review of this event is documented in SER Section 15.2.1.

15.2.4 Closure of Main Steam Isolation Valve(s)

The staff reviewed DCA Part 2, Tier 2, Section 15.2.4, Closure of Main Steam Isolation Valve(s), to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.2.1.3 of this SER. The inadvertent closure of one or both MSIVs is an AOO resulting from a steamline or reactor system malfunction or inadvertent operator actions. The event results in rapid primary and secondary pressurization, as well as an RCS temperature increase.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.2.4, summarized below.

The MSIV closure event is initiated by the closure of one or both MSIVs because of a spurious closure signal or operator error. One MSIV could also fail to close on a valid MSIV closure signal. The closure of one or more MSIVs results in an increase in secondary temperature and pressure in the affected SG(s) and consequent increases in primary temperature and pressure as the result of reduced heat removal. A reactor trip and DHRS actuation on either the high 72

steam pressure or high PZR pressure signal are credited to mitigate the event. The RSV lifts for a short time to limit the RCS pressure increase for the cases that reach the RSV setpoint.

The MSIV closure event potentially challenges the RCS pressure, SG pressure, and MCHFR acceptance criteria. Therefore, the applicant evaluated the limiting cases for each of the acceptance criteria in the DCA. The applicant concluded that the limiting cases meet all acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The regulatory basis described in SER Section 15.2.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.2.4.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the MSIV closure event.

The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to significantly affect DCA Part 2, Tier 2, Section 15.2, events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the information in DCA Part 2, Tier 2, Revision 2, Section 15.2.4.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model and notes that they vary for each of the three limiting cases to maximize the consequences for the acceptance criterion being considered. However, one common assumption is that the applicant did not credit operator action. In addition, each of the cases assumes that plant control systems perform as designed, with allowance for instrument inaccuracy, unless their action mitigates the events.

73

The applicant stated that the closure of two MSIVs is limiting for all acceptance criteria. This agrees with the staffs expectations, as closing two MSIVs leads to isolation of both SGs and the maximum loss of heat removal from the RCS. The applicant also stated that no single failures resulted in more severe results for any of the acceptance criteria and provided a sensitivity study in a letter dated May 21, 2018 (ADAMS Accession No. ML18141A880), which showed that a failure of an FWIV to close did not result in a more limiting SG pressure.

However, the staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The MSIV closure event progresses as described in Section 15.2.4.2 of this SER for each of the limiting cases. The MCHFR case assumes a loss of ac power concurrent with reactor trip. This causes a feedwater pump trip, exacerbating the RCS heatup. The limiting RCS and SG pressure cases do not assume a loss of ac power, and the differences in the two cases are based on initial condition biases. Furthermore, the applicant did not assume loss of dc power in any case, which the staff finds acceptable because it would result in ESF actuation sooner in the transient, thus leading to less severe consequences.

The staff reviewed the input parameters and initial conditions for each of the limiting cases to ensure that the applicant selected conservative values for the analyses. The staff notes that the applicant assumed suitably conservative parameters as described in DSRS Sections 15.2.1 through 15.2.5, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting BOC reactivity feedback.

In addition, the assumptions of biased-high feedwater and reactor pool temperatures are limiting for overheating events since they present the greatest challenge to heat removal.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

The staff notes that technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.4, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the MSIV closure event and notes that they are consistent with the event description and the assumptions for protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event descriptions 74

and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to aggravated plant conditions. However, the event sequences and consequences could change depending on the outcome of the open items.

DCA Part 2, Tier 2, Table 15.2-14, presents the limiting analysis results for this event. The applicant concluded that the limiting RCS and SG pressures and MCHFR meet the specified acceptance criteria. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

There are no COL information items associated with Section 15.2.4 of DCA Part 2, Tier 2.

The staff reviewed the MSIV closure event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the MSIV closure event and GDCs 10, 13, 15, and 26.

15.2.5 Steam Pressure Regulator Failure (Closed)

DCA Part 2, Tier 2, Section 15.2.5, Steam Pressure Regulator Failure (Closed), states that the NuScale design does not use a steam pressure regulator, and therefore, the applicant did not evaluate the steam pressure regulator failure event. The staff examined design information and drawings to confirm that there is no steam pressure regulator in the NuScale design and determined that this event is not applicable to the NuScale design.

15.2.6 Loss of Nonemergency ac Power to the Station Auxiliaries The staff reviewed DCA Part 2, Tier 2, Section 15.2.6, Loss of Non-Emergency AC Power to the Station Auxiliaries, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.2.6.3 of this SER. A loss of ac power event is an AOO that can result from failures in the electrical grid or the onsite ac distribution system and causes rapid primary and secondary pressurization.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.2.6, summarized below.

Failures in the electrical grid or plant or switchyard equipment, as well as external weather events, may lead to a loss of ac power to the station auxiliaries. A loss of ac power event causes a TT and a loss of pumps in the secondary system, leading to increasing primary temperature and pressure. The reactor trips and DHRS actuates on either the high PZR pressure or high steamline pressure signal. Secondary pressure increases until stable DHRS 75

operation is established to transfer decay heat from the RCS to the reactor pool. The limiting single failure is a failure of an FWIV to close, resulting in maximum SG pressure. The applicant concluded that the event meets the DSRS acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the RCPB is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Section 15.2.6 lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

• Fuel cladding integrity must be maintained by keeping the minimum DNBR (for NuScale, MCHFR) above the 95/95 limit based on acceptable correlations (see DSRS Section 4.4).

• An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

• The positions of RG 1.105 are considered with respect to plant protection system setpoints assumed in this event.

76

• The most limiting plant system single failure, as defined in 10 CFR Part 50, Appendix A, must be assumed in the analysis and must satisfy the positions of RG 1.53.

• The applicant should analyze this event using an acceptable analytical model. Any other analytical model proposed by the applicant will be evaluated by the staff.

• The parameter values in the analytical model should be suitably conservative.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the loss of ac power event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to significantly impact DCA Part 2, Tier 2, Section 15.2 events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the information in DCA Part 2, Tier 2, Revision 2, Section 15.2.6.

The applicant performed subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. For the loss of ac power analysis, the applicant assumed a loss of the low-voltage ac power distribution system (ELVS), which powers dc battery chargers, plant motors, heaters, and packaged equipment. The staff reviewed the ac power distribution system drawings and notes that a loss of power from the medium- or high-voltage ac power distribution systems would result in the same plant response. Therefore, the staff finds assuming loss of the ELVS acceptable.

The applicant stated that the event is most severe if dc power remains available. Because loss of dc power would cause a reactor trip or ESF actuation, or both, earlier in the transient than if there were no loss of dc power, the staff finds that assuming availability of dc power is acceptable.

Analyses of the loss of ac power do not credit operator action or backup diesel generators. The staff also confirmed that the analyses do not credit any action by mitigating plant control systems. The applicant assumed that the MPS performs as designed, with allowances for instrument inaccuracy. TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

For the limiting RCS pressure case, the loss of ac power causes a TT and loss of power to the PZR heaters, secondary pumps, and CVCS pumps. RCS pressure increases because of the reduction in heat removal, and the reactor trips and DHRS actuates on the high PZR 77

pressure signal. The RSV is credited to relieve RCS pressure. Secondary pressure increases initially and then declines as stable natural circulation is established in the DHRS.

The event is similar for the SG pressure and MCHFR cases, except that the SG pressure case assumes that an FWIV fails to close. In addition, the reactor trip and DHRS actuation for the MCHFR case occur because of high steamline pressure instead of high PZR pressure. The applicant stated that no single failure of an FWIV or MSIV caused more severe consequences for the RCS pressure or MCHFR cases because feedwater flow is lost at the start of the transient, and MCHFR occurs before potential valve failure.

However, the staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant identified different initial condition biases as limiting for RCS pressure, SG pressure, and MCHFR. The staff reviewed the selected input parameters and initial conditions and notes that the applicant has chosen suitably conservative input as described in DSRS Section 15.2.6, including a 102-percent initial core power level, the maximum time delay to scram with the most reactive rod held out of the core, and the most limiting BOC reactivity feedback. The staff also audited the applicants sensitivity studies that investigated the most limiting initial conditions and single failures to confirm that they led to the most limiting results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.6, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the loss of ac power event and finds that they are consistent with the event description and assumptions for the protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to aggravated plant conditions. However, the event sequences and consequences could change, depending on the outcome of the open items discussed previously.

DCA Part 2, Tier 2, Table 15.2-19, presents the limiting analysis results for this event. The applicant concluded that the limiting RCS and SG pressures and MCHFR meet the specified acceptance criteria. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

78

There are no COL information items associated with Section 15.2.6 of DCA Part 2, Tier 2.

The staff reviewed the loss of ac power event, including the sequence of events, values of parameters and assumptions used in the analytical model, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the loss of ac power event and GDCs 10, 13, 15, and 26.

15.2.7 Loss of Normal Feedwater Flow A pump failure, valve malfunction, or loss of offsite power can cause a loss of normal feedwater flow. A loss of normal feedwater flow causes a decrease in the heat removal rate from the reactor coolant system (RCS) resulting in an increase in RCS pressure and temperature.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.7, Loss of Normal Feedwater Flow.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

79

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 17, as it relates to onsite and offsite electric power systems and ensures that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded even during AOOs. This is accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

DSRS Section 15.2.7 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants analysis of loss of normal feedwater flow.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.7, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.7.1, that a loss of normal feedwater flow could occur as a result of pump failures, valve malfunctions, and loss of ac power. Because of the various causes, the applicant considered and analyzed a range of scenarios to determine the most limiting loss of feedwater (LOFW) events that result in the most severe consequences. For instance, to determine what type of LOFW event resulted in the maximum SG pressure event, the applicant ran a spectrum of cases to assess the sensitivity to how much feedwater flow is lost (perhaps because of a spurious partial valve closure or other LOFW mechanism). The staff notes that a feedwater line rupture can also result in a loss of feedwater flow; however, such an event is reviewed in Section 15.2.8 of this SER.

Considering this spectrum of cases, the staff notes that the applicant presented various limiting cases in the DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.7 are (1) the limiting MCHFR and limiting RCS pressure case and (2) the limiting SG pressure case. Furthermore, the staff notes that the applicant classified this event as an AOO, consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a range of scenarios that could be experienced in an actual plant because of component failures or malfunctions.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.2 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and 80

is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.2 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.2.7. As part of the staffs review, the staff confirmed through audit (ADAMS Accession No. MLXXXXXXXXX) that the applicant followed the non-LOCA methodology for this DCA Part 2 section.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that some input assumptions varied slightly among the presented limiting LOFW cases because some of these parameters would affect different aspects of the transient (e.g., a smaller loss in feedwater flow is more limiting for the peak SG pressure case, whereas a complete loss of feedwater flow is more limiting for the MCHFR case). In any case, the staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively selected.

For all limiting cases presented as part of the DCA Part 2, Tier 2, Section 15.2.7, analysis, the staff confirmed that initial parameters, such as power level, RCS pressure, RCS temperature, RCS flow, PZR level, Doppler reactivity feedback, moderator temperature reactivity feedback, reactor kinetics parameters, and scram characteristics (including assuming a stuck rod) were conservatively selected and applied in the analysis. The staff also confirmed that the applicant considered instrument inaccuracies and that no operator action is credited to mitigate the effects of a loss of normal feedwater flow event.

The staff reviewed the applicants single-failure assumptions for this event. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1. The staff confirmed through audit (ADAMS Accession No. MLXXXXXXXXX) that no single failures were found to have an adverse impact on the figures of merit for this event.

The staff reviewed the applicants assumptions regarding the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power availability assumptions were conservatively applied.

The staff confirmed that the applicants LOFW analysis-specific assumptions, input, and boundary conditions were selected conservatively. However, because of the open items documented in this section, the staff cannot make a finding at this time.

81

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.2.7, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and SG pressures, net reactivity, reactor coolant temperature and flow rate, MCHFR, and PZR level.

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants LOFW case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff reviewed the applicants LOFW case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff reviewed the applicants LOFW case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit.

However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

The staff reviewed the applicants analysis in DCA Part 2, Tier 2, Section 15.2.7, and confirmed that following a loss of normal feedwater event, stable DHRS cooling can be attained and the reactor can be safely shut down.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.7.

Based on the open items discussed above, no conclusions can be reached regarding the loss of normal feedwater flow event and GDCs 10, 13, 15, 17, and 26.

15.2.8 Feedwater System Pipe Breaks Inside and Outside Containment A break in feedwater piping inside or outside of containment can cause a decrease in the heat removal rate from the RCS resulting in an increase in RCS temperature and pressure.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside of Containment.

82

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 17, as it relates to onsite and offsite electric power systems and ensures that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

• 10 CFR Part 50, Appendix A, GDC 27, as it relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.

• 10 CFR Part 50, Appendix A, GDC 28, as it relates to limits on the potential amount and rate of reactivity increase to ensure that the effects of postulated reactivity accidents can neither (1) result in damage to the RCPB greater than limited local yielding nor (2) sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core.

• 10 CFR Part 50, Appendix A, GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

• 10 CFR Part 50, Appendix A, GDC 35, as it relates to the RCS and associated auxiliaries being designed to provide abundant emergency core cooling.

DSRS Section 15.2.8 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants FWLB analysis.

83

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.8, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.8.1, that a FWLB in the NuScale plant can occur because of seismic events, thermal stress, or cracking of the feedwater piping. Because of the various causes, the applicant analyzed a range of FWLBs in different locations throughout the system. For instance, a small split crack to a double-ended guillotine rupture of the largest feedwater line was analyzed in locations inside and outside of containment. Because of the variations in event initiation, through a spectrum of analyses, the applicant was able to determine the scenarios producing the most severe results with respect to the DSRS acceptance criteria.

For these reasons, the applicant presented various limiting cases in the DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.8 are the limiting MCHFR case, limiting RCS pressure case, limiting SG pressure case, and limiting DHRS function case. Furthermore, the staff notes that the applicant classified this event as an accident consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a spectrum of FWLBs in different locations throughout the system.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.2.8. As part of the staffs review, the staff confirmed through audit (ADAMS Accession No. MLXXXXXXXXX) that the applicant adequately followed the non-LOCA methodology for this DCA Part 2 section.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that some input assumptions varied slightly among the presented limiting FWLB cases because some of these parameters would affect different aspects of the transient (e.g., high PZR level is more limiting in the RCS pressure case, but low PZR level is more limiting in the MCHFR case). In any case, the staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.2.8, analysis, the staff confirmed that initial parameters, such as power level, fuel temperature, RCS temperature, PZR 84

pressure, PZR level, RCS flow, Doppler reactivity feedback, moderator temperature reactivity feedback, reactor kinetics, and scram characteristics (including the assumption of a stuck rod),

were conservatively applied in the analysis. The staff also confirmed that instrument inaccuracies were considered, and that no operator action is credited to mitigate the consequences of an FWLB event.

The staff reviewed the applicants single-failure assumptions regarding this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the FWLB event. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The staff noted that for the limiting RCS pressure case and the limiting MCHFR case the applicant found no single failure to have an adverse impact on either cases figure of merit. For the limiting SG pressure case, the staff noted that the applicant modeled a single failure of an FWIV backflow device to seat. However, the staff noted that the applicant did not justify the credit of components that are not safety-related for accident mitigation, when a single failure of a safety-related component was assumed. In the responses (ADAMS Accession Nos. ML18190A509 and ML18324A889) to RAI 9420, Question 15-17, issued on this topic, NuScale provided the basis for crediting components that are not safety-related for accident mitigation, when a single failure of a safety-related component was assumed. The staff finds the responses to the RAI acceptable based on the discussion in SER Section 15.0.0.6, contingent on confirmation of the incorporation of the markups into the next revision of DCA Part 2, Tier 2. This is a confirmatory item.

The staff reviewed the applicants assumptions regarding break size and location. The staff noted that, as with other model assumptions, the limiting break size and location depended on which figure of merit (e.g., RCS pressure, SG pressure, MCHFR, or DHRS function) was being analyzed. Nevertheless, the staff confirmed via audit (ADAMS Accession No. MLXXXXXXXXX) that the applicants assumed limiting break sizes and locations were supported by sensitivity analyses.

The staff reviewed the applicants assumptions about the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power assumptions were conservatively determined.

The staff confirmed that the applicants FWLB analysis-specific assumptions, input, and boundary conditions were selected conservatively. However, because of the open items documented in this section, the staff cannot make a finding at this time.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.2.8, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the 85

reactor power, reactor and SG pressures, core temperatures, RCS and break flow rates, MCHFR, and DHRS heat removal rates.

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the capability to maintain core cooling considering the amount of unborated water from the secondary system that would return to the core after ECCS actuation, which could ultimately challenge subcriticality. In responses (ADAMS Accession Nos. ML17172A716 and ML18257A308), to RAI 8744, Question 15.02.08-3, and RAI 8930, Question 15-27, NuScale provided a qualitative discussion and quantitative results of a long-term cooling (LTC) analysis. This analysis shows how a bounding boron dilution event affects reactor criticality and coolable core geometry. However, the staff did not agree with the applicant that its model was sufficiently justified, nor that its assumptions were appropriately conservative for boron volatility and the subsequent plate-out phenomena in the upper riser that could occur as the reactor undergoes extended cooldown. SER Section 15.0.6 also documents this issue. The applicant is preparing a supplement to the RAI response, as stated in a March 6, 2019, public meeting (ADAMS Accession No. MLXXXXXXXXX). The supplemental response to RAI 8930, Question 15-27, is identified as Open Item 15.0.6-5.

The staff reviewed the applicants FWLB case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants FWLB case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit.

However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

The applicant stated that the radiological analysis of the SLB bounds the radiological consequences for the FWLB. The staff finds this acceptable because the mass release through a feedline break outside containment would be significantly smaller than the mass release through an SLB outside containment. The staffs review of bounding radiological consequence analyses is documented in Section 15.0.3 of this SER.

The staff confirmed that the DHRS is safety-related, and under the worst single-failure assumption for this event, which renders one train of DHRS completely inoperable, the second train of DHRS automatically actuates and provides adequate heat removal, ensuring coolable core geometry during and after the accident.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.8.

Based on the open items discussed above, no conclusions can be reached regarding a FWLB and GDCs 13, 17, 27, 28, 31, and 35.

86

15.2.9 Inadvertent Operation of Decay Heat Removal System An inadvertent operation of the decay heat removal system (DHRS) can cause a decrease in the heat removal rate from the reactor coolant system (RCS) resulting in an increase in RCS temperature and pressure.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.9, Inadvertent Operation of the Decay Heat Removal System.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 17, as it relates to onsite and offsite electric power systems and ensures that safety-related SSCs function during normal operation, including AOOs. The safety function for each power system (assuming the other system is not functioning) is to provide sufficient capacity and capability so SAFDLs and RCPB design conditions are not exceeded during AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded even during AOOs. This is 87

accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

There is not an SRP section for this decrease in heat removal event; however, DSRS Section 15.2.7 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants analysis of an inadvertent operation of the DHRS.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.9, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.9.1, that the limiting cases for an inadvertent operation of the DHRS (IODHRS) occur at full power. The causes analyzed include opening of a single DHRS valve, actuation of one DHRS train, and actuation of both DHRS trains. The staff notes that at low power and reduced feedwater flow rates, the IODHRS is a cooldown event. If the DHRS actuation valve opens under these conditions, a portion of the DHRS liquid inventory drains into the feedwater line and momentarily increases SG flow. This unique variant of the IODHRS event leads to an increase in heat removal from the RCS. DCA Part 2, Tier 2, Section 15.2.9.1, states that this IODHRS event is bounded by more limiting overcooling events addressed in Section 15.1, such as an increase in feedwater flow.

The applicant presented various limiting cases in the DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.9, are the limiting MCHFR case, the limiting RCS pressure case, and the limiting SG pressure case.

Furthermore, the staff notes that the applicant classified this event as an AOO since it is expected to occur one or more times during the life of the module. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a range of scenarios that could be experienced in an actual plant as the result of component failures or malfunctions.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.2.9. As part of its review, the staff confirmed through audit that the applicant followed the non-LOCA methodology for this DCA Part 2 section.

88

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.2.9, analysis, the staff confirmed that initial parameters, such as power level, fuel temperature, RCS temperature, PZR pressure, PZR level, RCS flow, moderator temperature reactivity feedback, reactor kinetics, and scram characteristics (including the assumption of a stuck rod), were conservatively applied in the analysis. The staff also confirmed that the applicant considered instrument inaccuracies and that no operator action is credited to mitigate the consequences of an IODHRS event.

The staff reviewed the applicants single-failure assumptions for this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the IODHRS event. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The staff noted that, for the limiting RCS pressure case and the limiting MCHFR case, the applicant found no single failure to have an adverse impact on either cases figure of merit. For the limiting SG pressure case, the staff noted that the applicant modeled a single failure of an FWIV to close. However, the staff noted the applicant did not justify the credit of components that are not safety-related for accident mitigation, when a single failure of a safety-related component was assumed. In the responses (ADAMS Accession Nos. ML18190A509 and ML18324A889) to RAI 9420, Question 15-17, issued on this topic, NuScale explained the basis for crediting components that are not safety-related for accident mitigation when a single failure of a safety-related component was assumed. The staff finds the responses to the RAI acceptable based on the discussion in SER Section 15.0.0.6, contingent on confirmation of the incorporation of the markups in the next revision of DCA Part 2, Tier 2. This is a confirmatory item.

The staff reviewed the applicants assumptions as to the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power availability assumptions were conservatively applied.

The staff confirmed that the applicants IODHRS analysis-specific assumptions, input, and boundary conditions were selected conservatively. However, because of the open items documented in this section, the staff cannot make a finding at this time.

89

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.9, to determine if they meet the SAFDL acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and SG pressures, reactor coolant temperature and flow rate, MCHFR, and PZR level.

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants IODHRS case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants IODHRS case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants IODHRS case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit.

However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until the open items are resolved.

The staff reviewed the applicants analysis presented in DCA Part 2, Tier 2, Section 15.2.9, and confirmed that IODHRS events do not result in pressure or temperature transients that exceed the criteria for which the reactor pressure vessel, SG, CNV, or fuel are designed. Therefore, these barriers to the transport of radionuclides to the environment will function as designed.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.9.

Based on the open items documented above, no conclusions can be reached regarding inadvertent operation of the DHRS and GDCs 10, 13, 15, 17, and 26.

15.3 Decrease in Reactor Coolant System Flow Rate Decrease in RCS flow rate events do not apply to the NPM design because the NPM operates on the principle of natural circulation with no forced cooling.

90

15.4 Reactivity and Power Distribution Anomalies 15.4.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low-Power Startup Condition The staff reviewed DCA Part 2, Tier 2, Section 15.4.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power or Startup Condition, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.4.1.3 of this SER. An uncontrolled control rod assembly (CRA) withdrawal from a subcritical or low-power startup condition is an AOO that results in a rapid addition of reactivity to the core because of the CRA withdrawal. This causes an increase in core power and a decrease in MCHFR.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.1, as supplemented by letters dated November 28, 2018 (ADAMS Accession No. ML18332A446),

and February 21, 2019 (ADAMS Accession No. ML19052A607), summarized below.

An uncontrolled CRA withdrawal from a subcritical or low-power startup condition could be caused by an operator error or a malfunction in the control rod drive system. Withdrawal of the regulating CRA bank causes an unexpected reactivity addition, which increases core power and decreases MCHFR. The MPS initiates a reactor trip if MPS setpoints are exceeded. The applicant investigated a spectrum of reactivity insertion rates and initial power levels to identify the limiting cases for MCHFR, fuel centerline temperature, and RCS pressure using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the MCHFR and fuel centerline temperature response. The applicant stated that the limiting cases meet the MCHFR and fuel centerline temperature acceptance criteria and that RCS pressure remains below the design limit.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS apply to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, which requires that the reactor core and associated coolant, control, and protection systems are designed with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

91

• 10 CFR Part 50, Appendix A, GDC 13, which requires availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 17, which requires provision of an onsite electric power system and an offsite electric power system to permit functioning of SSCs important to safety.

• 10 CFR Part 50, Appendix A, GDC 20, which requires that the protective system automatically initiate the operation of the reactivity control system to ensure that SAFDLs are not exceeded as a result of AOOs.

• 10 CFR Part 50, Appendix A, GDC 25, which requires that the reactor protection system be designed to ensure that SAFDLs are not exceeded in the event of a single malfunction of the reactivity control system.

The guidance in SRP Section 15.4.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power Startup Condition, lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• The thermal margin limits (DNBR (for NuScale, MCHFR)), as specified in SRP Section 4.4, Thermal and Hydraulic Design, are met.

• Fuel centerline temperatures, as specified in SRP Section 4.2, do not exceed the melting point.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.2 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to influence DCA Part 2, Tier 2, Section 15.4, events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.2 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.4.1.

The applicant used the VIPRE-01 code with the NSP4 CHF correlation to perform the subchannel analysis, which identified the limiting MCHFR and maximum fuel centerline temperature. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

92

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant assumed that the entire regulating bank withdraws for this event, which provides the maximum reactivity insertion. The credited MPS signals for this analysis are high core power (at 25 percent of full power), source range and intermediate range power rate, high source range count rate, and high PZR pressure.

Different initial power levels and reactivity insertion rates could result in reactor trips on different MPS signals. Therefore, the applicant analyzed a spectrum of reactivity insertion rates at different initial power levels ranging from 1 watt to 15-percent rated thermal power (RTP), which is the upper limit for low-power operation. The applicant analyzed reactivity insertion rates up to 35 percent millirho per second (pcm/s), which bounds possible boron dilution scenarios, as well as CRA regulating bank withdrawal at the maximum speed.

The applicant determined that the limiting cases for MCHFR and RCS pressure have an initial power of 1 megawatt (MW). The limiting RCS pressure case has a lower reactivity insertion rate than the limiting MCHFR case, which allows a more prolonged RCS temperature and pressure increase and causes a slower reactor trip. The limiting RCS pressure case reaches the high PZR pressure analytical limit first, while the limiting MCHFR case reaches the high power analytical limit first. The DCA does not provide information about the initial conditions or reactivity insertion rate for the fuel centerline temperature case; however, the staff does not view this as necessary because the DCA provides such information for the uncontrolled CRA withdrawal at power event in DCA Part 2, Tier 2, Section 15.4.2, which is bounding in terms of fuel centerline temperature because of the higher initial power levels. The staffs evaluation of these parameters is in Section 15.4.2.4.2 of this SER.

The staff reviewed other initial parameter values and biases in the DCA, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. Although the applicant did not vary initial RCS pressure to find the limiting value, this event is clearly bounded by the uncontrolled CRA withdrawal at power event in DCA Part 2, Tier 2, Section 15.4.2, so the staff does not view additional sensitivity studies as necessary. In addition, the applicant assumed the most positive MTC and least negative DTC, which are conservative because they minimize negative reactivity feedback as moderator and fuel temperatures increase. The staff noted that the applicant did not list the initial RCS flow rate in the table of inputs for this event. The applicants supplemental response to RAI 9507, Question 15.04.01-5, dated February 21, 2019, clarified the initial RCS flow rate and provided corresponding DCA markups. The staff finds the response acceptable because it completes the table of inputs and is consistent with the underlying calculation notes the staff audited, as discussed in the following paragraph. The staff will confirm that the markups are incorporated in the next revision of the DCA. This is a confirmatory item.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results. In addition, the staff confirmed through the audit that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology, as stated in DCA Part 2, Tier 2, Section 15.4.1. The staff also verified that appropriate cases from the transient analysis were passed on for subchannel analysis (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX).

93

According to DCA Part 2, Tier 2, Table 15.0-7, the applicant treated the source range count rate trip as an overpower trip that occurs at an analytical limit of 500 kW, which functionally equates count rate to core power. A future COL applicant will need to verify this assumption since the source range trips are relied on to prevent unacceptable power excursions from source range power levels. In addition, the staff noted that the footnote discussing this assumption appeared to be in the incorrect location in Table 15.0-7. The applicants supplemental response to RAI 9507, Question 15.04.01-6, dated November 28, 2018 (ADAMS Accession No. ML18332A446), provided markups that acceptably correct the footnote location. The staff will confirm that the markups are incorporated in the next revision of the DCA. This is a confirmatory item.

The applicant did not credit operator action to mitigate the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event. In terms of limiting single failures, the staff notes that a failure of an ex-core detector would have no effect on a symmetric reactivity transient, and a failure of an MSIV or FWIV to close would have no effect on MCHFR since DHRS does not actuate for that event sequence. A single failure of an MSIV or FWIV to close could affect peak RCS pressure, but the RCS pressure for this event is clearly bounded by rod withdrawal at power events. The staff also notes that the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The DCA states that loss of power is not limiting for the event. The staff notes that a loss of normal ac power would trip the feedwater pumps and turbine, but the effect would be negligible because of the low initial power level. Furthermore, the effects of a loss of ac power for this event are bounded by the effects of a loss of ac power on the uncontrolled CRA withdrawal at power event in DCA Part 2, Tier 2, Section 15.4.2. Therefore, the staff finds that the applicants treatment of loss of power for this event is acceptable.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.1, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables that apply to the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event and finds that they are consistent with the event description and assumptions for protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. However, the event sequences and consequences could change depending on the outcome of the open items.

DCA Part 2, Tier 2, Table 15.4-3, presents the limiting analysis results for this event. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until open items are resolved.

94

There are no COL information items associated with Section 15.4.1 of DCA Part 2, Tier 2.

The staff reviewed the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event and GDCs 10, 13, 17, 20 and 25.

15.4.2 Uncontrolled Control Rod Assembly Withdrawal at Power The staff reviewed DCA Part 2, Tier 2, Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power, to ensure that the event was analyzed appropriately and meets the acceptance criteria discussed in Section 15.4.2.3 of this SER. An uncontrolled CRA withdrawal at power is an AOO that causes an unexpected positive reactivity insertion and a corresponding increase in core power. The power increase and resulting RCS temperature and pressure increases lead to a decrease in MCHFR.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.2, summarized below.

The uncontrolled CRA withdrawal at power analysis simulates withdrawal of the regulating CRA bank, which causes an unplanned reactivity addition to the core. Core power increases, and because the secondary system lags the primary system response, RCS temperature and pressure increase. Such conditions could challenge SAFDLs and the RCS design pressure.

The MPS initiates a reactor trip on high power, high power rate, high PZR pressure, or high hot-leg temperature, depending on the initial conditions and assumptions. The DHRS may be actuated on high hot-leg temperature or high PZR pressure to maintain post-trip core cooling.

The applicant analyzed a spectrum of reactivity insertion rates and initial power levels, including loss of power scenarios, to identify the limiting cases for MCHFR, fuel centerline temperature (as evaluated using linear heat generation rate (LHGR)), and RCS pressure. The applicant used NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to obtain the MCHFR and LHGR. The applicant stated that the limiting cases meet the MCHFR and fuel centerline temperature acceptance criteria and that RCS pressure remains below the design limit.

ITAAC: There are no ITAAC items for this area of review.

95

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The regulations listed in SER Section 15.4.1.3 are also applicable to DCA Part 2, Tier 2, Section 15.4.2. The guidance in SRP Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power, lists the same acceptance criteria as SRP Section 15.4.1 for demonstrating conformance to the applicable requirements, as well as review interfaces with other SRP/DSRS sections.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to influence DCA Part 2, Tier 2, Section 15.4 events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.4.2.

In addition, the applicant used the VIPRE-01 code with the NSP4 CHF correlation to perform the subchannel analysis, which identified the limiting MCHFR and LHGR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant assumed that the entire regulating bank withdraws for this event, which provides the maximum reactivity insertion. This analysis credits the high core power, high core power rate, high hot-leg temperature, and high PZR pressure MPS signals. Different initial conditions and reactivity insertion rates could result in reactor trips on different MPS signals. To account for the range of transient progressions and trip scenarios, the applicant analyzed a spectrum of reactivity insertion rates at initial power levels of 25, 50, 75, and 102 percent. The applicant included reactivity insertion rates up to 35 pcm/s, which bounds possible boron dilution scenarios as well as CRA regulating bank withdrawal at the maximum speed.

The applicant determined that the limiting case for MCHFR has an initial power of 75 percent and a reactivity insertion rate of 0.9 pcm/s. This case reaches the high hot-leg temperature and 96

high PZR pressure analytical limits almost simultaneously. The limiting RCS pressure and LHGR cases initiate from 102-percent power, with reactivity insertion rates of 15.2 pcm/s and 35.0 pcm/s, respectively. The limiting RCS pressure case reaches the high-power rate and high PZR pressure analytical limits almost simultaneously and results in the lifting of an RSV to mitigate the pressure increase. The rapid power increase during the maximum LHGR case causes a high-power rate trip.

The staff reviewed other initial parameter values and biases, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The applicant assumed the least negative MTC and DTC, which are conservative because they minimize negative reactivity feedback as moderator and fuel temperatures increase. In addition, the applicant assumed that the regulating bank is initially inserted to the power-dependent insertion limit (PDIL) plus six steps for rod position uncertainty. The staff finds this treatment conservative because it provides for the maximum reactivity to be added for a given power level.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results. The staff also confirmed that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology, as stated in DCA Part 2, Tier 2, Section 15.4.2 (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX).

The staff confirmed that the applicant treated control systems conservatively in the analysis. If control system operation leads to a less severe plant response, the applicant assumed that the control system is disabled. However, control system operation is allowed if it causes a more severe transient. For example, the applicant disabled automatic RCS pressure control for cases that examine maximum RCS pressure because it acts to reduce RCS pressure but enabled it for MCHFR cases to delay the high PZR pressure trip.

The applicant did not credit operator action to mitigate the uncontrolled CRA withdrawal at power event. In terms of limiting single failures, the staff notes that a failure of an ex-core detector would have no effect on a symmetric reactivity transient, and a failure of an MSIV or FWIV to close would occur after the time of limiting MCHFR and RCS pressure and is irrelevant to LHGR since DHRS does not actuate for that case. However, the staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant analyzed loss of power at both event initiation and the time of reactor trip and concluded that a loss of normal ac power at event initiation is limiting for RCS pressure, while a loss of normal ac power at the time of reactor trip is limiting for LHGR. A loss of power is not limiting for MCHFR. The staff confirmed through an audit that the applicants sensitivity studies 97

support the loss of power considerations in the DCA (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX).

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.2, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables that apply to the uncontrolled CRA withdrawal at power event and finds that they are consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met.

However, the event sequences and consequences could change depending on the outcome of the open items.

DCA Part 2, Tier 2, Table 15.4-6, presents the limiting analysis results for this event. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until the open items are resolved.

There are no COL information items associated with Section 15.4.2 of the NuScale DCA Part 2, Tier 2.

The staff reviewed the uncontrolled CRA withdrawal at power event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the uncontrolled CRA withdrawal at power event and GDCs 10, 13, 17, 20, and 25.

15.4.3 Control Rod Misoperation (System Malfunction or Operator Error)

The staff reviewed DCA Part 2, Tier 2, Section 15.4.3, Control Rod Misoperation (System Malfunction or Operator Error), to ensure that the events were analyzed appropriately and meet the acceptance criteria outlined in Section 15.4.3.3 of this SER. The applicant considered three different control rod misoperation events, which are all AOOs: (1) a CRA misalignment (DCA Part 2, Tier 2, Section 15.4.3.3), (2) a single CRA withdrawal (DCA Part 2, Tier 2, Section 15.4.3.4), and (3) a single or multiple CRA drop (DCA Part 2, Tier 2, Section 15.3.5).

Each of these events has the potential to challenge SAFDLs.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.3, summarized below.

98

The applicant considered three events for the control rod misoperation analysis: a CRA misalignment, a single CRA withdrawal, and a drop of single or multiple CRAs. Each of these events are AOOs and could unexpectedly affect core reactivity and power distributions such that SAFDLs could be challenged.

The CRA misalignment event assumes that all CRAs are withdrawn except for one that is misaligned to the 25-percent rated power PDIL plus six steps for rod position uncertainty. The applicant performed steady-state core analyses using SIMULATE5 to obtain the radial peaking augmentation factor to be input to the subchannel analysis using VIPRE-01. The applicant states that no transient analysis is needed for this event, as it is a static misalignment in which core power and thermal-hydraulic conditions do not change.

The applicant used NRELAP5 and VIPRE-01 to model both the single CRA withdrawal and a CRA drop. For both events, the applicant credited the high PZR pressure, high power rate, and high hot-leg temperature MPS signals.

A single CRA withdrawal may occur because of equipment failure or operator error. For this event, the applicant assumed that the regulating bank is inserted to the PDIL, and a single rod withdraws. This adds positive reactivity to the core, increasing power, and causes the power distribution to become asymmetric. The applicant analyzed a spectrum of initial power levels and reactivity insertion rates to identify the limiting cases for MCHFR, LHGR, and RCS pressure. Withdrawal of an entire regulating bank is analyzed in DCA Part 2, Tier 2, Section 15.4.2.

A CRA drop can occur because of mechanical or electrical failures and may include a single CRA or an entire control or shutdown bank. The applicant analyzed several CRA drop scenarios from different initial power levels to find the limiting case for MCHFR and LHGR.

For each of the events in DCA Part 2, Tier 2, Section 15.4.3, the applicant concluded that the limiting cases meet the MCHFR, LHGR, and RCS pressure acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so that SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, requires the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety 99

and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 20, requires that the protective system automatically initiate the operation of the reactivity control system to ensure that SAFDLs are not exceeded as a result of AOOs.

• 10 CFR Part 50, Appendix A, GDC 25, requires that the reactor protection system be designed to ensure that SAFDLs are not exceeded in the event of a single malfunction of the reactivity control system.

The guidance in SRP Section 15.4.3, Control Rod Misoperation (System Malfunction or Operator Error), lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• The thermal margin limits (DNBR (for NuScale, MCHFR)), as specified in SRP Section 4.4, are met.

• Fuel centerline temperatures, as specified in SRP Section 4.2, do not exceed the melting point.

• Uniform cladding strain as specified in SRP Section 4.2, does not exceed 1 percent.

The applicant presents the analyses of a CRA misalignment, single CRA withdrawal, and single or bank CRA drops in DCA Part 2, Tier 2, Section 15.4.3. The staff considers this to be a complete scope of CRA misoperation events (excluding the events in DCA Part 2, Tier 2, Sections 15.4.1 and 15.4.2) and therefore acceptable.

Although not an acceptance criterion for SRP Section 15.4.3, the applicant analyzed limiting RCS pressure cases, which are discussed in SER Section 15.4.3.4.2.2. The staff notes that a single CRA withdrawal results in a pressure increase and could therefore challenge RCS pressure limits.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to model the thermal-hydraulic response to the single CRA withdrawal and CRA drop events. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to influence DCA Part 2, Tier 2, Section 15.4, events. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 version used to generate DCA Part 2, Tier 2, Revision 2, Section 15.4.3.

The applicant also used SIMULATE5 to calculate the radial peaking augmentation factors for each of the events covered in this review section. The applicant used the NRELAP5 and SIMULATE5 results as input to the subchannel analyses using VIPRE-01 and the NSP4 CHF 100

correlation to identify the limiting MCHFR and LHGR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the analysis models. The control rod misoperation events share some common assumptions. First, the applicant did not credit operator action to mitigate these events. In addition, the analyses assume that plant control systems function as designed, except when they cause less severe consequences for the transient, which the staff notes is conservative. The credited MPS trips for these events include high core power rate, high hot-leg temperature, and high PZR pressure. The latter two signals are also credited for DHRS actuation. Event-specific inputs, initial conditions, and assumptions are discussed in the following paragraphs.

15.4.3.4.2.1 Control Rod Assembly Misalignment The DCA discusses three potential CRA misalignment scenarios. The first occurs at full-power conditions with the rods inserted to the PDIL with one rod left withdrawn, which the applicant stated is bounded by a single CRA withdrawal. The staff notes that the single CRA withdrawal analysis simulates essentially the same conditions except in a transient simulation, so the staff agrees this scenario is adequately covered. The second scenario is that all CRAs are inserted to the PDIL except one is fully inserted. The applicant stated that this scenario is not credible because reactor hold points would prevent rod motion in that case; furthermore, the staff notes that this scenario is bounded by a CRA drop. The final scenario, and the one the applicant analyzed, is a case at full power with all CRAs withdrawn except one regulating CRA misaligned in to the 25-percent PDIL, plus six steps of rod position uncertainty.

The applicant considered different power levels, axial offsets, withdrawn CRAs, and times in cycle in its SIMULATE5 calculations to find the limiting radial peaking augmentation factor for the VIPRE-01 calculation. The staff audited the underlying calculations and confirmed that the applicant identified the limiting case considering a comprehensive range of conditions (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX).

In addition, the staff confirmed that the initial RCS parameter values and biases used in the subchannel analysis are conservative with respect to MCHFR.

15.4.3.4.2.2 Single Control Rod Assembly Withdrawal The applicant analyzed a spectrum of reactivity insertion rates up to 12 pcm/s to capture the maximum reactivity insertion caused by a single rod withdrawal at initial power levels of 25, 50, 75, and 102 percent. The applicant determined that the limiting case for MCHFR has an initial power of 75 percent and a reactivity insertion rate of 2.5 pcm/s. This case results in a reactor trip and DHRS actuation on the high hot-leg temperature signal, and the high PZR pressure analytical limit is also reached during the actuation delay. The limiting cases for RCS pressure and LHGR both have an initial power of 102 percent and reactivity insertion rates of 12 pcm/s.

Both cases result in a trip and DHRS actuation on high PZR pressure. The main differences between these two cases are that (1) a loss of ac power concurrent with reactor trip is limiting for the maximum RCS pressure case, which causes a decrease in heat removal from the secondary side and an RSV to open; and (2) the LHGR case allows normal PZR spray operation to delay the reactor trip until after the maximum power has been reached.

101

The staff reviewed other initial parameter values and biases, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The applicant used the least negative DTC, which is conservative since it minimizes negative reactivity feedback as fuel temperature increases, and a power-dependent MTC, the conservatism of which the staff ascertained through a confirmatory calculation.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results and to confirm that those values are implemented in the DCA analysis. The staff also audited the subchannel analysis calculation for the single CRA withdrawal event and confirmed that the applicant used suitably conservative axial and radial power shapes and the associated peaking factors as input to the subchannel analysis, supporting the statement in the DCA that limiting radial and axial power shapes were used (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX).

The DCA states that the limiting single failure for the single CRA withdrawal is a failure of an ex-core detector. The analysis assumes the remaining detectors see the lowest possible flux resulting from the power asymmetry, which is conservative because it delays MPS actuation on power-related trips. However, the staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant analyzed loss of power at both event initiation and the time of reactor trip and found that a loss of normal ac power at event initiation is limiting for RCS pressure, but a loss of power is not limiting for MCHFR or LHGR. The staff audited the applicants sensitivity studies and confirmed that the loss of power considerations in the DCA are supported (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). Therefore, the staff finds that the applicant applied conservative loss of power assumptions.

15.4.3.4.2.3 Control Rod Assembly Drop The applicant investigated several CRA drop scenarios to find the one that results in the most severe power peaking change. The applicant examined different initial power levels, times in life, and dropped rods. The limiting case for MCHFR and LHGR is identical. This case assumes the drop of a single CRA, starts from 102-percent power, and results in a reactor trip on the high core power rate signal.

The staff reviewed the initial parameter values and biases, including initial RCS conditions and reactivity coefficients. The staff finds that the selected values are the most challenging to MCHFR. For example, the initial RCS temperature and PZR pressure are biased high, and the EOC reactivity coefficients (i.e., most negative MTC and DTC) maximize positive reactivity feedback to mitigate the power decrease due to the dropped rod.

102

The staff audited the applicants sensitivity studies that investigated the most limiting rod drop scenarios and initial conditions to confirm that they led to the most limiting results. The staff also audited the subchannel analysis calculation for the CRA drop event and confirmed that the applicant used suitably conservative axial and radial power shapes and the associated radial peaking augmentation factor as input to the subchannel analysis, supporting the statement in the DCA that limiting radial and axial power shapes were used (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). In addition, the power peaking caused by the CRA drop is conservatively applied to the entire transient in the subchannel analysis.

The DCA states that the limiting single failure for the CRA drop is a failure of an ex-core detector. The analysis assumes that the remaining detectors see the highest possible flux resulting from the power asymmetry, which is conservative because it delays MPS actuation on the power rate trip. However, the staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant did not analyze a loss of power for the CRA drop event, stating that the loss of power for the single CRA withdrawal event bounds the loss of normal ac power during the CRA drop event because of the lack of pressure increase for the CRA drop. The staff notes that a loss of ac power for the CRA drop event is inconsequential for MCHFR because a turbine and feedwater pump trip would mitigate the RCS temperature decrease resulting from the CRA drop. The staff agrees that the effects of a loss of ac power for the CRA drop event are bounded by those of the single CRA withdrawal event.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.3, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables for the CRA misoperation events and finds that they are consistent with the event descriptions and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they generally support the applicants event description and assertion that the acceptance criteria are met. However, the staff notes that the time scale of DCA Part 2, Tier 2, Figure 15.4-35, Critical Heat Flux Ratio, for the single CRA withdrawal event is not consistent with the corresponding sequence of events table. The staff is tracking revision of the figure as Open Item 15.4.3-1. In addition, the event sequences and consequences could change depending on the outcome of the open items.

DCA Part 2, Tier 2, Table 15.4-11, presents the limiting analysis results for the CRA misoperation events. However, the staff is unable to confirm whether acceptance criteria for this event are satisfied until the open items are resolved.

103

There are no COL information items associated with Section 15.4.3 of DCA Part 2, Tier 2.

The staff reviewed the various control rod misoperation events, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transients. Based on the open items discussed above, no conclusions can be reached regarding the various control rod misoperation events and GDCs 10, 13, 20, and 25.

15.4.4 Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature A startup of an inactive loop or recirculation loop at an incorrect temperature is not applicable to the NPM design because the NPM does not have coolant loops.

15.4.5 Flow Controller Malfunction Causing an Increase in Boiling-Water Reactor Core Flow Rate A flow controller malfunction causing an increase in core flow rate is not applicable to the NPM design because the NPM design does not have a flow controller that could increase recirculation flow. The NPM operates on the principle of natural circulation with no forced cooling.

15.4.6 Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (Pressurized-Water Reactor)

A malfunction in the CVCS or an operator error could result in an inadvertent dilution of boron in the RCS. The inadvertent dilution causes a positive reactivity addition to the core.

Section 15.0.6 of this SER documents the staffs review of the potential for boron redistribution following ECCS actuation.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.9, Boron Dilution Control

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER 104

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS design with appropriate margin so that SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so that the pressure boundary is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so that SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

The guidance in SRP Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR), lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The CVCS can adjust boron concentration and allows operators to match or modify boron concentration of the RCS during normal operation. Failures in the CVCS or operator error can result in unborated water being inadvertently introduced to the RCS. This event is considered to occur one or more times during the lifetime of the reactor, and is therefore, classified as an AOO. The limiting CVCS dilution source considered in the safety analysis is the demineralized water system (DWS) supply. Each CVCS makeup pump is assumed to provide 25 gallons per minute (gpm) of demineralized water.

The boron dilution analysis, described in DCA Part 2, Tier 2, Section 15.4.6, determines the range of possible reactivity insertion rates resulting from an inadvertent boron dilution and evaluates whether boron dilution could lead to a complete loss of TS shutdown margin before detection and isolation of the dilution source.

Evaluation Model DCA Part 2, Tier 2, Section 15.4.6.3.1, Evaluation Methodology Summary, states that two calculation techniques are used to analyze the boron dilution event for the NuScale module.

One method assumes unborated water injected into the RCS mixes instantaneously with the effective system volume. The applicant considers this assumption to be conservative for Mode 1 operating conditions because it provides a slower reactivity insertion rate, thus delaying its detection and allowing further loss of shutdown margin. The other method evaluates the boron dilution event by using a wave front model to maximize the amount of reactivity as the 105

diluted slug of water sweeps through the core and does not assume any axial mixing. This diluted slug is assumed to move through the riser, SGs, downcomer, and the reactor core. Both the perfect mixing and wave front models are used for the evaluation of Mode 1 operations. For all other modes where limited mixing exists, the wave front model is used.

The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4.

Input Parameters, Initial Conditions, and Assumptions For the purposes of the analysis, the CRAs are not assumed to mitigate reactivity changes.

Each of the two regulating bank groups is assumed to be at its respective PDIL so that the rods do not insert automatically as a result of the reactivity addition of an RCS boron dilution. The shutdown margin reactivity credited in the analysis for Modes 1, 2, and 3 is 2,041 pcm (shown in DCA Part 2, Tier 2, Table 4.3-3, Reactivity Requirements for Control Rods) and includes margin for a stuck rod.

DCA Part 2, Tier 2, Section 15.4.6.1, states that the loss of ac and dc power during this event is considered, but results in nonlimiting scenarios, and there are no single failures that could occur that result in a more severe outcome for the limiting case. However, the staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The analysis does not credit operator actions to terminate the event. Instead, the CVCS is designed with automated features that limit the amount and rate of reactivity increase caused by an inadvertent boron dilution event. To mitigate inadvertent dilution events, the CVCS incorporates two redundant safety-related demineralized supply isolation valves. The isolation valves automatically close upon any of the following MPS signals:

• reactor trip system actuation

• high subcritical multiplication

• low RCS flow DCA Part 2, Tier 2, Revision 0, Section 15.4.6.2, Sequence of Events and Systems Operation, stated that below 50-percent RTP, two-pump operation is not allowed. In its July 18, 2017, response (ADAMS Accession No. ML17200A105) to RAI 8844, Question 15.04.06-2, the applicant revised TS 3.1.9 and associated bases to limit demineralized flowrate and pump operation below 50 percent RTP. The applicant also clarified that the CVCS makeup pump flow rate is designed to provide 20 gpm; however, the analysis assumes 25 gpm to account for uncertainty. The staff finds this acceptable because the TS appropriately include the limits and controls for the CVCS and demineralization system consistent with the assumption in the analysis regarding inadvertent decrease in boron concentration. The staff verified that the 106

markup associated with RAI 8844, Question 15.04.06-2, has been incorporated into Revision 1 of the DCA.

The staff reviewed the safety analysis to verify that a boron dilution event has been analyzed for all plant conditions, such as refueling, startup, power operation, hot standby, hot shutdown, and cold shutdown. DCA Part 2, Tier 2, Section 15.4.6.3.4, Input Parameters and Initial Conditions, states that for Mode 1 operation the initial power levels considered for the event are hot zero power (HZP) and hot full power (HFP). The staff notes that TR-0516-49416, Section 7.2.16, Inadvertent Decrease in Boron Concentration, also evaluates Mode 1 operation at 25-percent RTP, which corresponds to the maximum HFP boron concentration, and vessel average temperature. This analysis confirms that a dilution event at 25-percent RTP is nonlimiting compared to the reactivity insertion rates for dilutions initiated from HFP and HZP conditions.

Mode 1Hot Full Power During a boron dilution transient at HFP, reactor power will increase, and RCS temperature and pressure will increase until the reactor trips on high power, high power rate, high PZR pressure, or high RCS riser temperature. The calculations performed by the applicant for this mode of operation use the perfect mixing model (DCA Part 2, Tier 2, Section 15.4.6, Equation 15.4-2) and the wave front model (DCA Part 2, Tier 2, Section 15.4.6, Equation 15.4-3). The applicant determined a shutdown margin of 1,912 pcm remained after isolation of the DWS.

Mathematical models used by the applicant are discussed further in the following sections related to other modes of operation.

Mode 1Hot Zero Power During a boron dilution transient at HZP, reactor power will increase; however, RCS temperature, pressure, and level remain relatively constant for rapid boron dilution scenarios, as reactor trip occurs quickly on either the high rate or high reactor power setpoint before RCS conditions can degrade. The reactor trip signals that protect the reactor against boron dilution in this mode of operation include high count rate, high power, and high startup rate. The calculations performed by the applicant for this mode of operation use the perfect mixing model and the wave front model. The applicant asserted that a shutdown margin of 697 pcm remained after the DWS isolation.

Mode 2 (Hot Shutdown) and Mode 3 (Safe Shutdown)

For Modes 2 and 3, if the RCS flow rate is less than 48.1 kilograms per second (kg/s)

(763 gpm), the MPS logic ensures that the DWS isolation valves are closed and precludes the possibility of a boron dilution event from a CVCS malfunction. If the RCS flow rate is greater than 48.1 kg/s (763 gpm), the analysis assumes a dilution flow rate of up to 25 gpm from one CVCS makeup pump. This causes a gradual increase in reactor power and ultimately a high subcritical multiplication engineered safety features actuation system signal to close the DWS isolation valves and terminate the boron dilution event. The calculations performed by the applicant for this mode of operation used the wave front model and determined that a shutdown margin of 517 pcm remained after the DWS isolation.

107

Mode 4 (Transition) and Mode 5 (Refueling)

During Mode 4, a boron dilution event is precluded because the CVCS is disconnected and isolated from the RCS. The applicant also analyzed the potential to dilute the RCS during Mode 5 refueling operations. DCA Part 2, Tier 2, Table 15.4-12, lists internal flooding sources and volumes that have the large potential for dilution. The applicant concluded that a total dilution volume of 234,430 gallons would be required to lose shutdown margin; therefore, reactor pool flooding as a result of pipe breaks and potential flooding sources is nonlimiting and can be accommodated by the initial reactivity condition of keff of 0.95 or less.

Evaluation of Analysis Results In DCA Part 2, Tier 2, Tables 15.4-11 through 15.4-16 present the results of the applicants analysis for the modes of operation. The results of the analysis demonstrate that for Modes 1 through 4, the MPS ensures that the CVCS dilution source is isolated before shutdown margin is lost without the need for operator action. However, the maximum reactivity insertion rate during HFP is bounded by the range of reactivity insertion rates evaluated for uncontrolled CRA withdrawal reviewed in Section 15.4.2 of this SER. Likewise, the reactivity insertion rates from a dilution at HZP is bounded by the analysis performed for uncontrolled CRA withdrawal from a subcritical or low-power startup condition (evaluated in Section 15.4.1 of this SER).

The limiting boron dilution event for the potential loss of shutdown margin occurs in Modes 2 and 3 when the DWS isolation valves are open because of the time it takes for the MPS to detect the dilution event. The results indicate that shutdown margin for this mode of operation occurs at 124 minutes; however, the DWS isolation occurs at 88 minutes. Therefore, the results show that automatic isolation of the DWS valves terminates the boron dilution before shutdown margin is lost. The staff determined that the analysis meets the guidance in SRP Section 15.4.6 with respect to subcriticality but is unable to confirm whether acceptance criteria for this event are satisfied until the related open items are resolved.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.4.6.

Based on the open items discussed above, no conclusions can be reached regarding a boron dilution event and GDCs 10, 13, 15, and 26.

15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position An inadvertent loading and operation of a fuel assembly in an improper position is an infrequent event (IE) that can result in reduced critical heat flux ratio (CHFR) that leads to exceeding the specified acceptable fuel design limits (SAFDLs). The staff reviewed DCA Part 2, Tier 2, Section 15.4.7, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position, to ensure that this event was analyzed appropriately and does not result in unacceptable consequences.

108

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.7, summarized below.

An inadvertent loading and operation of a fuel assembly in an improper position is an IE that could affect power distribution and power peaking of the reactor core. If undetected, such an event could lead to reduced CHFR and reduced margin to fuel centerline melt.

An inadvertent loading and operation of a fuel assembly in an improper position is not expected to occur during the lifetime of the reactor because of fuel loading controls and procedures. The in-core instrumentation detects all fuel misloads that result in power shape deviations greater than the detection thresholds, but not all misloads are detectable.

The applicant analyzed a spectrum of fuel misload configurations, including shuffle misloads and 180-degree rotational misloads, using SIMULATE5 to compute core power distributions, identify the limiting undetectable fuel misload, and compute the power peaking augmentation factor used as input to the subchannel analysis. The applicant performed the subchannel analysis using VIPRE-01 to obtain minimum CHFR (MCHFR) and fuel centerline temperatures.

The applicant concluded that all SRP Section 15.4.7, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position, acceptance criteria are met and that no fuel damage is expected.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS applicable to this area of review are listed in Section 15.0.0 of this SER.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to providing instrumentation to monitor variables over anticipated ranges for normal operations, AOOs, and accident conditions

• 10 CFR 52.47(a)(2)(iv)(A) and (B), as they relate to the evaluation and analysis of the radiological consequences of postulated accidents such as those resulting from reactor operations with an undetected fuel assembly in an improper position The guidance in SRP Section 15.4.7 lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• Plant operating procedures should include a provision requiring that reactor instrumentation be used to search for potential fuel-loading errors after fueling operations.

109

• If the error is not detectable by the instrumentation system and fuel rod failure limits could be exceeded during normal operation, offsite consequences should be a small fraction of the 10 CFR 52.47(a)(2)(iv)(A) and (B) criteria. A small fraction is interpreted to be less than 10 percent of the 10 CFR 52.47(a)(2)(iv)(A) and (B) reference values.

The applicant classified the inadvertent loading and operation of a fuel assembly in an improper position as an IE considering existing fuel-handling controls and procedures. The staff identified two initial startup tests in DCA Part 2, Tier 2, Chapter 14, related to this review section. The acceptance criterion for the Initial Fuel Load Test (Test # 76) states that each fuel assembly and control component is installed in the location specified by the design of the initial reactor core, which the staff notes provides assurance that a misload will be prevented. Furthermore, the Core Power Distribution Map Test (Test # 91) specifies taking core power maps at 25-, 50-, 75-,

and 100-percent power to verify that the power distribution is consistent with design predictions.

In addition, LCO 3.2.1 limits the enthalpy rise hot channel factor (FH) to the value specified in the core operating limits report. The value of FH is computed continuously based on measurements from the in-core instrumentation and is displayed in the control room, and it must be verified after each refueling and in accordance with the surveillance frequency control program.

The staff notes that the tests and LCO provide reasonable assurance that any fuel-loading error detectable by the in-core instrumentation will be detected. However, not all errors are detectable. In particular, the in-core instrumentation will detect all fuel assemblies that are 44 percent above or 35 percent below their predicted power, though it may detect some misloads before these thresholds are reached.

The consequences of a fuel-loading error vary based on the reactivity of the misloaded fuel.

Interchanging fuel assemblies with large reactivity differences would result in higher power peaking and lower MCHFR. Therefore, the applicant considered a spectrum of fuel assembly misloads to identify the limiting misload that is undetectable by the in-core instrumentation.

The staffs review of the applicants evaluation model, input parameters and initial conditions, and analysis results is provided in the following paragraphs.

Evaluation Model The applicant performed neutronics analysis with the three-dimensional, steady-state solver, SIMULATE5, to identify the limiting undetectable fuel misload and obtain the associated radial peaking augmentation factor for use in the subchannel analysis. As discussed in SER Section 4.3, Nuclear Design, the staff finds the applicants use of SIMULATE5 for neutronic analysis acceptable.

The applicant performed the subchannel analysis using VIPRE-01 with the NSP4 CHF correlation and the SIMULATE5-calculated limiting radial peaking augmentation factor as input.

Because thermal-hydraulic conditions remain constant for this event, a transient analysis using NRELAP5 is not necessary. Section 15.0.2 of this SER further discusses these computer codes.

110

Input Parameters, Initial Conditions, and Assumptions The applicant considered a spectrum of 231 potential shuffle misloads (i.e., swapping two fuel assemblies), including quarter-core, half-core, and cross-core configurations. The applicant also examined rotational misloads by rotating fuel assemblies by 180 degrees, even though fuel alignment features would preclude such rotation. The staff finds this analyzed spectrum of fuel misloads acceptable because it adequately covers the possible misloading scenarios.

The applicant did not consider misloads resulting from unprescribed enrichment or burnable poisons. The staff notes that the DCA references a fabricated fuel design, and fuel fabrication is subject to quality assurance requirements. Furthermore, a licensee will procure the fuel under a quality assurance process. Therefore, fuel with unprescribed enrichment or burnable poisons will not be available at the reactor site and need not be considered in the misload analysis.

The applicant referred to the subchannel analysis methodology topical report, TR-0915-17564, for other key inputs and assumptions used in the subchannel analysis. TR-0915-17564 has been approved by the staff (ADAMS Accession No. ML19067A256). The staff notes that the example parameter biases in TR-0915-17564 are consistent with the biases stated in DCA Part 2, Tier 2, Table 15.0-6, with the exception of smaller core exit pressure and core inlet temperature biases in TR-0915-17564. However, the applicants letter dated June 28, 2018 (ADAMS Accession No. ML18179A522), shows that the applicant used core exit pressure and core inlet temperature biases consistent with DCA Part 2, Tier 2, Table 15.0-6, which the staff confirmed through the ongoing Chapter 15 audit (see the audit plan at ADAMS Accession No. ML19004A098). Therefore, the staff finds that the applicant used conservative input parameters, initial conditions, and assumptions for the fuel misload analysis.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.7, to determine if they meet the SRP acceptance criteria. The applicant determined the limiting undetectable misload to be a swap of a fuel assembly on the core periphery with an adjacent assembly closer to the center of the core, which resulted in a radial peaking augmentation factor of 1.189. Rotational misloads are nonlimiting because the resulting change in power distribution is much less than that of a shuffle misload.

DCA Part 2, Tier 2, Table 15.4-20, presents the MCHFR and LHGR for the limiting undetectable fuel misload. The staff confirmed that the MCHFR remains above the 95/95 analysis limit of the NSP4 CHF correlation, and the LHGR remains well under the design limit. Because the SAFDLs are met, and because this event does not involve coolant leakage, no fission product release is postulated. Therefore, radiological evaluation and analysis to determine compliance with 10 CFR 52.47(a)(2)(iv)(A) and (B) are not necessary.

There are no COL information items associated with Section 15.4.7 of DCA Part 2, Tier 2.

The staff has evaluated the consequences of a spectrum of postulated fuel-loading errors. The staff concludes that some errors are detectable by the available instrumentation (and hence remediable). The in-core instrumentation will be used before the start of a fuel cycle to search 111

for fuel-loading errors and is continuously used to monitor thermal margins. Therefore, the applicant has met the requirements of GDC 13 with respect to adequate provisions to minimize the potential of a misloaded fuel assembly going undetected. The staff further concludes that the applicants analysis provides reasonable assurance that no fuel rod failures will result from undetectable fuel-loading errors. For this reason, the applicant does not need to provide radiological evaluation and analysis to demonstrate compliance with 10 CFR 52.47(a)(2)(iv)(A) and (B).

15.4.8 Spectrum of Rod Ejection Accidents (Pressurized-Water Reactor)

The applicant postulated the ejection of a control rod assembly (CRA) resulting from a mechanical failure that causes an instantaneous circumferential rupture of the control rod drive mechanism (CRDM). The CRA ejection adds positive reactivity to the core, which results in a rapid power increase for a short period of time. The power rise is limited by the Doppler feedback. Reactor shutdown is initiated by the MPS upon receipt of a reactor trip (i.e., high core power, high core power rate, high steam superheat, or high RCS pressure trip) shortly after the CRA ejection. This event is classified as a postulated accident in Table 15.0-1 of DCA Part 2, Tier 2. This classification is consistent with SRP Section 15.0.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2 information, summarized below.

The applicant analyzed the CRA ejection event using six different initial powers: 0, 25, 50, 70, 80, and 100 percent. Each power level was investigated at beginning of cycle (BOC), middle of cycle (MOC), and end of cycle (EOC). The applicant evaluated the event using several codes, including SIMULATE5 to determine the peaking factors and limiting CRA worth during the CRA ejection event and SIMULATE-3K to determine the transient core average power response.

The applicant obtained the nuclear steam supply system response using NRELAP5 and used VIPRE-01 to perform the minimum critical heat flux ratio (MCHFR) calculation. A conservative adiabatic heatup model was also used to calculate the fuel rod enthalpy during the Rod Ejection Accident (REA). MCHFR calculations used the NSP4 CHF correlation. The NuScale methodology does not permit any fuel failures resulting from MCHFR criteria. No fuel failures were calculated as the result of CRA ejection.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• LCO 3.4.3, RCS Pressure and Temperature (P/T) Limits

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

112

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges

• 10 CFR Part 50, Appendix A, GDC 27, as it relates to reactivity control system design so that there is the capability, in conjunction with the ECCS, of reliably controlling reactivity changes to ensure that core cooling is maintained under postulated accident conditions with appropriate margin for stuck rods

• 10 CFR Part 50, Appendix A, GDC 28, as it relates to the effects of postulated reactivity accidents that result in neither damage to the RCPB greater than limited local yielding nor sufficient damage to significantly impair core cooling capacity

• 10 CFR 52.47(a)(2)(iv)(A), 10 CFR 52.47(a)(2)(iv)(B), and 10 CFR Part 50, Appendix A, GDC 19, as they relate to the evaluation and analysis of the radiological consequences of postulated accidents The guidance in SRP Section 15.4.8, Spectrum of Rod Ejection Accidents (PWR), lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections, with the exception of GDC 27, which the guidance does not cover because the NRC staff did not anticipate a design requiring an evaluation of a potential return to power during the longer term portion of a rod ejection event. GDC 28 defines a rod ejection event as a postulated accident, and GDC 27 applies to postulated accidents.

Further, the PWR reactor designs at the time the guidance was written all had a means to add negative reactivity to avoid recriticality. Since NuScale does not have a safety-related means of adding negative reactivity, the Staff considers GDC 27 to apply to the design and analysis of NuScales response to an REA.

The following document also provides additional criteria or guidance in support of the SRP acceptance criteria to meet the requirements:

• RG 1.77, Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors The applicant proposes CRA ejection accident regulatory criteria in topical report TR-0716-50350, Rod Ejection Accident Methodology, December 30, 2016 (ADAMS Accession No. ML16365A242), which the NRC staff is currently reviewing. The criteria, summarized in DCA Part 2, Tier 2, Section 15.4.8.3.3, cover fuel cladding failure, core coolability, and RCS peak pressure. The staffs SER for the topical report will present its review of the criteria.

Pending completion of the staffs review, this is identified as Open Item 15.4.8-01. The potential for recriticality during the LTC portion of this event is evaluated in Section 15.0.6 of this report.

113

Evaluation Model The evaluation model is presented in topical report TR-0716-50350, referenced in DCA Part 2, Chapter 15. The applicant used several codes in the evaluation model for the REA event including SIMULATE5, SIMULATE-3K, NRELAP5, VIPRE-01, and an adiabatic heatup fuel response hand calculation:

SIMULATE5 SIMULATE5 is a three-dimensional, steady-state, nodal diffusion, reactor simulator code used to solve the multigroup nodal diffusion equation. SIMULATE5 provides the steady-state nuclear analysis parameters used to initiate SIMULATE-3K.

SIMULATE-3K SIMULATE-3K is a three-dimensional nodal reactor kinetics code that couples core neutronics with detailed thermal-hydraulic models to model transient neutronic analysis of the REA at various times in core life, power level, CRA positions, and initial core conditions.

NRELAP5 The NuScale NRELAP5 code is based on the Idaho National Laboratory RELAP5-3D code, Version 4.1.3. NRELAP5 addresses unique aspects of the NuScale design and licensing methodology. NuScales NRELAP5 includes models for characterization of hydrodynamics, heat transfer between structures and fluids, modeling of fuel, reactor kinetics models, and control systems. It is used to calculate the dynamic system response and peak RCS pressure and to provide input to the VIPRE-01 subchannel CHF evaluation.

By letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. This affects the MCHFR analyses in DCA Part 2, Section 15.4.8.

Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the NRC staffs evaluation is based on the NRELAP5 Version 1.3 analysis and Revision 0 of the plant model and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.2.8.

VIPRE-01 VIPRE-01 was developed based on the COBRA family of codes from Pacific Northwest Laboratories. It is used to evaluate nuclear reactor parameters MCHF.

The validation and applicability of these codes to the NuScale design is described in DCA Part 2, Tier 2, Section 15.0.2, and the staffs evaluation is in Section 15.0.2 of this SER.

Input Parameters and Initial Conditions The applicant analyzed peak RCS pressure, MCHF, and fuel rod temperature and enthalpy.

The analysis covers HZP; power at 25, 50, 70, and 80 percent; and full power. Each power level includes BOC, MOC, and EOC conditions. DCA Part 2, Tier 2, Section 15.4.8.3.2, presents the input parameters and initial conditions for the models. The staff compared the input values and initial conditions used against the methodology presented in TR-0716-50350 114

(ADAMS Accession No. ML16365A243). The staff finds that the inputs and initial conditions used to analyze the NuScale response to a rod ejection accident were consistent with the methodology. However, the staff also notes that topical report TR-0716-50350 is currently under review. If the underlying methodology is modified during this review process, the analyses presented in DCA Part 2, Section 15.4.8, could require revisions. This is identified as Open Item 15.4.8-01.

In terms of limiting single failures, the staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The applicants analysis shows that maximum core power is reached within a second from initiation of the REA event and is limited by Doppler feedback. Additionally, the applicants analysis results show some of the conservative inputs such as the conservative scram characteristics per the methodology such as a 2-second delay before dropping the rods into the core. As noted in the following discussion, the analysis results may be affected by the closeout of any open items. However, the results are summarized in the following paragraphs.

Peak Pressure The applicant calculated the peak pressure in the RCS to be 2,076 psia, which is below the RPV limit of 2,520 psia. However, the methodology used to calculate this pressure includes the use of NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model. By letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to influence DCA Part 2, Tier 2, Section 15.4, events; however, pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1.

Fuel Cladding Failure The applicant performed the MCHFR calculations at initial conditions corresponding to HZP and 25-, 50-, 70-, 80-, and 100-percent power. Each power level was investigated at BOC, MOC, and EOC conditions. The limiting MCHFR is 2.477, which is above the design limit.

Therefore, the applicants analysis shows that no fuel cladding violates the MCHFR criterion.

The applicant calculated the peak radial average fuel enthalpy at zero power conditions to be 34.6 calories per gram (cal/g). The hot zero power high temperature cladding failure limit is defined as 100 cal/g in TR-0716-50350 (ADAMS Accession No. ML16365A243). Therefore, the limit is met.

115

Per TR-0716-50350, the PCMI failure threshold limit is 75 cal/g. The applicant calculated the maximum change in peak radial average fuel enthalpy as 28.7 cal/g, which is below the limit.

Core Coolability The staff reviewed the fuel temperature and peak radial average fuel enthalpy evaluation models summarized in DCA Part 2, Section 15.4.8.3.1, and confirmed that the applicants analysis followed the fuel temperature methodology as presented in the referenced topical report TR-0716-50350 (ADAMS Accession No. ML16365A243). However, the NRC staff is currently reviewing this topical report. If the underlying methodology is modified during this review process, the analyses presented in DCA Part 2, Section 15.4.8, could require revisions.

This is identified as Open Item 15.4.8-1.

The applicant discussed the fuel and cladding integrity results in DCA Part 2, Section 15.4.8.3.4.

The analysis presented includes various initial power levels and times in cycle, which is consistent with the guidance in SRP Section 15.4.8, Revision 3.

The applicants analyses result in a limiting peak radial average fuel enthalpy of 84 cal/g, which corresponds to an initial power of 80 percent at BOC conditions. This value is below the limit of 100 cal/g provided in TR-0716-50350.

The applicant calculated the limiting peak fuel temperature to be 1,183 degrees C (2,162 degrees F), which is below the fuel melting temperature. However, the methodology used to calculate this temperature includes the use of NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model.

By letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. The applicant does not expect these changes to influence DCA Part 2, Tier 2, Section 15.4 events; however, pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.4.8.

The staff reviewed the control rod ejection accident, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the accident. Based on the open items discussed above, no conclusions can be reached regarding the control rod ejection accident and GDCs 13, 19, 27, and 28, and 10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B).

15.4.9 Spectrum of Rod Drop Accidents (Boiling-Water Reactor)

This event is specific to BWRs and therefore does not apply to the NPM design. The PWR equivalent of a rod drop is rod ejection, which is discussed in SER Section 15.4.8. SER Section 15.4.3 discusses control rod misoperations, including a dropped CRA.

2

15.5 Increase in Reactor Coolant Inventory 15.5.1 Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory A CVCS malfunction may cause an increase in the RCS inventory and pressure. The relatively cold makeup water combined with a negative moderator temperature coefficient can increase core reactivity. For limiting scenarios, the RCS pressure or level increase results in a reactor trip. The applicant classified this event as an AOO, which is consistent with the design-specific review standard (DSRS) for the NuScale small modular reactor design.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

The applicant identified the malfunction of the two 20-gpm CVCS makeup pumps that maximize makeup flow as the limiting scenario for a CVCS malfunction that increases RCS inventory.

The applicant stated that no single failure, including any loss of ac or dc power, would result in a more serious outcome for the increase in RCS inventory events. The thermal-hydraulic analysis of the NPM response to the event was performed using NRELAP5, and the subchannel critical heat flux (CHF) analysis was performed using VIPRE-01. The applicants analysis resulted in a peak RCS pressure of 2,130 psia (92.2 percent of safety limit), a peak SG pressure of 1,418 psia (61.4 percent of design limit), and an MCHFR of 2.379 (compared to the safety limit and minimum value of 1.284).

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• LCO 3.4.3, RCS Pressure and Temperature (P/T) Limits

• LCO 3.4.10, Low Temperature Overpressure Protection (LTOP) Valves

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain relevant requirements for this review:

• 10 CFR 52.47(a)(2), which requires evaluations to show that safety functions will be accomplished. Descriptions shall be sufficient to permit understanding of the system design relationships to the safety evaluations.

2

• 10 CFR Part 50, Appendix A, GDC 10, which requires that the reactor core and associated coolant control, and protection systems be designed with appropriate margin to ensure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, which requires, in part, that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for AOOs, as appropriate, to ensure adequate safety. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 15, which requires that the RCS and its associated auxiliary control and protection systems be designed with sufficient margin to assure that the design conditions of the RCPB are not exceeded during any condition of normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, which requires, in part, the reliable control of reactivity changes to ensure that SAFDLs are not exceeded under conditions of normal operation, including AOOs.

DSRS Sections 15.5.1 - 15.5.2, Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory, list the following AOO acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

• Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs based on acceptable correlations (see DSRS Section 4.4).

• An AOO should not generate a more serious plant condition without other faults occurring independently.

The applicant organized Section 15.5.1 of DCA Part 2, Tier 2, Chemical and Volume Control System Malfunction, to reflect the DSRS. This technical evaluation is organized accordingly.

Identification of Causes and Accident Description The applicant identified the malfunction of the CVCS makeup pumps resulting in 40-gpm makeup (and zero letdown) as the limiting scenario for the increase in RCS inventory. The applicant stated in the non-LOCA methodology topical report, TR-0516-49416, that the pump malfunction could be caused by a spurious PZR water-level signal. The applicant classified this event as an AOO, which is consistent with the DSRS. The case of a CVCS malfunction resulting in a boron dilution event is evaluated in SER Section 15.4.6.

3

Sequence of Events and Systems Operation The increase in reactor coolant inventory event terminates with automatic reactor trip on high PZR pressure or high PZR level, CVCS isolation on high PZR level, and DHRS actuation on high PZR or steamline pressure. The applicant credited these automated safety functions (e.g., CVCS, feedwater and main steam isolation), and did not credit operator action to mitigate this event. The sequence of automatic actions depends on the set of initial conditions. The applicant stated that its analysis assumed the availability of ac (ELVS) and dc (EDNS and EDSS) power because the CVCS cannot function without ELVS or EDNS power, and the CVCS flow pathways are isolated on a loss of EDSS. The staff agrees that this is a conservative assumption because loss of any of those power supplies would terminate the CVCS flow addition event and be non-limiting. The sequence of events is documented in Section 15.5.1 of DCA Part 2, Tier 2, Table 15.5-1, Sequence of Events CVCS MalfunctionLimiting SG Pressure and MCHFR (Pressurizer Spray Available), Table 15.5-2, Sequence of Events CVCS MalfunctionLimiting RCS Pressure (No Pressurizer Spray), and Figure 15.5-1, Pressurizer LevelIncrease in RCS Inventory (No PZR Spray) through Figure 15.5-10, Minimum Critical Heat Flux RatioIncrease in RCS Inventory (PZR Spray Available).

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.5.1.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The applicant conducted sensitivity studies to determine the initial conditions that maximize RCS and SG pressure and minimize MCHFR. The initial conditions included the core thermal power, RCS pressure, RCS temperature, PZR level, feedwater temperature, RSV setpoint, CVCS isolation valve closure time, CVCS makeup fluid temperature, coefficients of reactivity, maximum regulating control rod speed, minimum RCS flowrate, and the availability of PZR spray.

The staff agrees that the applicants limiting sets of initial conditions are conservative for the following reasons: (1) the applicant provided a conservative basis for each initial condition, (2) the applicant demonstrated with sensitivity studies, listed in the non-LOCA topical report, that reasonable variations of the initial conditions did not significantly alter the peak pressures, and (3) the applicant assumed the turbine stop valve (TSV) closed after 1 second, which is 4

more conservative than required because it ignored the actuation delays listed in DCA Part 2, Tier 2, Table 15.0-7.

The staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The applicant demonstrated that pressure in the reactor coolant and main steam system remained below 110 percent of the design values and the MCHFR remained above the design minimum. The staff confirmed that the automatic actions credited occurred while the MPS instrumentation was within its range. The applicants analysis also demonstrated that the NPM reached a stable, safe condition after the CVCS malfunction. SER Section 15.0 addresses considerations for a return to power.

However, the staff is unable to confirm whether the acceptance criteria are satisfied until the open items are resolved.

Radiological Consequences The staff is unable to confirm that there are no radiological consequences for this AOO until the open items are resolved and the acceptance criteria are satisfied.

There are no COL information items associated with Section 15.5 of DCA Part 2, Tier 2.

The staff reviewed the CVCS malfunction event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. Based on the open items discussed above, no conclusions can be reached regarding the CVCS malfunction event and GDCs 10, 13, 15, and 26, and 10 CFR 52.47(a)(2).

15.6 Decrease in Reactor Coolant Inventory Inadvertent Opening of a Pressurizer Safety Valve or an Automatic Depressurization Valve DCA Part 2, Tier 2, Section 15.6.1, Inadvertent Opening of a Reactor Safety Valve, states that an inadvertent opening of an RSV has the same thermal-hydraulic effects as, and is bounded by, an inadvertent opening of an RVV. The staff notes that the RSVs and RVVs are both located on top of the RPV, meaning the thermal-hydraulic conditions to which both sets of valves are exposed are highly similar. In addition, the RVV opening size, which is larger than 5

that of an RSV, presents a greater challenge in terms of mass and energy release. Therefore, the staff agrees with and confirms the applicants conclusion that the inadvertent opening of an RSV is bounded by the inadvertent opening of an ECCS valve, which is analyzed in DCA Part 2, Tier 2, Section 15.6.6.

Nonradiological Consequences of the Failure of Small Lines Carrying Primary Coolant outside Containment A break or leak from a line connected to the reactor coolant system (RCS) that penetrates containment can cause a direct release of reactor coolant outside containment. The staffs review in this section of the SER focuses on the nonradiological aspects of this event (e.g., RCS mass release, break location, fuel integrity) to ensure that conservative and bounding thermal-hydraulic inputs are used in the radiological aspect of this event. Section 15.0.3 of this SER documents the review of the radiological aspect of this event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.2, Failure of Small Lines Carrying Primary Coolant outside Containment.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR 52.47(a)(2)(iv)(A), as it relates to exclusion area dose criteria.

• 10 CFR 52.47(a)(2)(iv)(B), as it relates to low population zone dose criteria.

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to meeting the SAFDLs during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 55, as it relates to providing isolation valves to primary coolant lines that penetrate primary reactor containment.

The guidance in SRP Section 15.6.2, Radiological Consequences of the Failure of Small Lines Carrying Primary Coolant Outside Containment, lists the non-radiological acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

6

The following discusses the staffs technical evaluation of the applicants small primary coolant line failure outside containment analysis.

Causes In DCA Part 2, Tier 2, Section 15.6.2, the applicant stated that the small lines carrying primary coolant outside containment are the CVCS makeup and letdown lines, PZR spray line, and the RPV high-point degasification line. These lines extend from the RPV through the containment vessel (CNV) and include double isolation capability by means of containment isolation valves.

Failure of these lines is evaluated for both thermal-hydraulic and radiological consequences. A non-mechanistic break in these lines is considered. Since the two containment isolation valves on the RPV high-point degasification line are normally closed, and this line is the same size as the PZR spray line, a break in the spray line is considered representative for these two lines.

Methodology In the failure of small lines carrying primary coolant outside containment analyses, the staff notes that the applicant evaluated a spectrum of break sizes and locations. The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 version used to generate the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.6.2. As part of the staffs review, the staff confirmed through audit (ADAMS Accession No. MLXXXXXXXXX) that the applicant followed the non-LOCA methodology for this DCA section; however, this methodology is subject to change, as described previously.

The applicant did not perform a CHF calculation for this event. DCA Part 2, Tier 2, Section 15.6.2.5, states that the MCHFR response for this event is bounded by the rapid depressurization event in DCA Part 2, Tier 2, Section 15.6.6. The staff notes that the behavior of important parameters to MCHFR (e.g., reactor power, RCS flow, core inlet temperature, core exit pressure) for a break in a small line carrying primary coolant is less limiting than for other MCHFR-challenging events, such as cooldown and reactivity insertion events. In addition, fuel temperature decreases upon reactor trip, and core water level remains well above the top of the active fuel for the failure of small lines carrying primary coolant outside containment event. For these reasons, the staff finds that the potential for fuel failure is precluded for this event.

The staffs evaluation of the radiological effects of failure of small lines carrying primary coolant outside containment is documented in Section 15.0.3 of this SER.

Model Assumptions, Input, and Boundary Conditions The applicants analyses assume that ESFs perform as designed, with allowance for instrument uncertainty, unless otherwise noted. No operator action is credited to mitigate the effects of line breaks outside containment. In addition, no external power source is credited. However, the 7

staff notes that the event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The applicant evaluated various inputs and assumptions to determine the limiting break scenario with respect to radiological and thermal-hydraulic consequences. The results are presented in graphical form. The maximum mass and energy release scenario identified is a break in the CVCS letdown line outside containment with a coincident loss of normal ac power.

Evaluation of Analysis Results In these analyses, reactor trip and DHRS actuation occur, but the ECCS trip setpoints are not reached. Upon isolation of the break, a normal shutdown of the module proceeds using the DHRS. The mass and energy releases to the reactor building are maximized in order to maximize the radiological consequences. The applicants results presented in DCA Part 2, Tier 2, Section 15.6.2.3.3, show that the reactor water level remains well above the top of the active fuel and that the core remains subcritical for all break cases and with all power assumptions. The RCS and fuel temperatures stabilize following the breaks and continue to decline.

The staff reviewed the applicants calculations supporting this DCA section during the Chapter 15 audit (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX) and consider them to be reasonable.

The staff finds that the maximum mass and energy releases calculated by the applicant are appropriate for purposes of input into the downstream radiological analysis. The staff also finds that fuel integrity is maintained during this event because the water level in the reactor vessel remains above the top of the core.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.2.

This SER section remains incomplete pending satisfactory resolution of the open items identified herein. Therefore, the staff is unable to conclude whether 10 CFR 52.47(a)(2)(iv)(A),

10 CFR 52.47(a)(2)(iv)(B), GDC 10, and GDC 55 have been met.

Steam Generator Tube Rupture A steam generator tube rupture (SGTR) is a postulated accident caused by a rapid propagation of a circumferential crack that leads to a double-ended rupture of the tube. Reactor coolant 8

passes from the primary side of the SG into the secondary side and travels through the main steamlines to the turbine into the environment. A secondary criterion is to prevent overfill of the SG secondary to prevent water from entering the steamlines and potentially preventing closure of the main steam isolation valves (MSIVs).

Radionuclides contained in the primary coolant are discharged through the failed tube until the faulted SG is isolated by automatic closure of the MSIVs.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.3, Steam Generator Tube Failure (Thermal Hydraulic).

The applicant analyzed the SGTR event in terms of margin to fuel thermal design limits and maximized radiological consequences. Analyses were performed for many scenarios, including with and without power available, to ensure that the most limiting conditions are considered.

The applicant evaluated this event using NRELAP5 to obtain the NPM thermal-hydraulic responses in accordance with Topical Report TR-0516-49416, Non-Loss-of-Coolant Accident Analysis Methodology. The applicant determined the SGTR coincident with power available to be limiting in terms of MCHFR and radiological consequences. The applicant determined that the MCHFR is above the 95/95 DNBR limit; hence, no fuel failure is predicted to occur. The applicants DCA Part 2 analysis also concludes that, with conservative initial conditions, the SGTR event can be controlled by no operator actions with radiological releases remaining below 10 CFR Part 100, Reactor Site Criteria, regulatory limits (or within the limits of 10 CFR 50.67, Accident Source Term, for alternate source term) and that the affected SG liquid level increase does not lead to more severe consequences (i.e., the MSIV is unable to close).

It is also important to note that the design of the helical coil SGs, as described in DCA Part 2, Section 5.4, is different from conventional PWR design SGs in that the primary coolant is located on the outside (shell side) of the tubes. Thus, the volume of the secondary inventory is considerably smaller than in conventional designs, increasing the potential for SG overfill and other differences in transient responses.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.4.5, RCS Operational Leakage

• LCO 3.4.8, RCS Specific Activity

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of DCA Part 2.

9

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, GDC 14, as it relates to ensuring an extremely low probability of failure of the RCPB

• 10 CFR Part 50, GDC 19, as it relates to the requirement that a control room be provided from which personnel can operate the nuclear power unit during both normal operating and accident conditions, including a LOCA.

• 10 CFR Part 50, GDC 34, as it relates to the requirement that a system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that SAFDLs and the design conditions of the RCPB are not exceeded.

• 10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B), as they relate to the evaluation and analysis of the radiological consequences of postulated accidents such as those resulting from SGTR.

DSRS Section 15.0.3 and SRP Section 15.6.3, Radiological Consequences of Steam Generator Tube Failure, list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• Affected SG time to isolate and unaffected SG(s) until cold shutdown is established should be identified.

• The potential for fuel failures and the core thermal margins resulting from the postulated accident should be verified.

• It should be verified that the most severe case has been considered with respect to the release of fission products and calculated doses.

• Pressure in the reactor coolant and main steam systems should be maintained below 110 percent of the design values.

Evaluation Model The event is initiated by the failure of an SG tube that causes a decrease in PZR pressure and level. The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. The non-LOCA EM is currently under staff review and is identified as Open Item 15.0.2-4. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to update its transient and 10

accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Section 15.6.3.

The non-LOCA topical report reviews highly ranked phenomena related to SGTR (( )) .

The methodology relies on benchmarks to KAIST, SIET, and NIST-1 separate effects tests HP-03 and HP-04 for code validation.

The SGTR NRELAP5 model is developed from the NPM base plant base model with an averaged lumped core with point kinetics used to calculate reactivity feedback to the core power from the moderator, fuel, and decay heat. The model simulations are performed using event-specific conservatisms.

Input Parameters, Initial Conditions, and Assumptions The applicant conducted sensitivity studies to identify the limiting input conditions to identify the most challenging break location, main steam pressure, SG tube plugging, loss of power, single failure, feedwater temperature, and reactor coolant temperature and pressure with respect to total mass released and iodine spiking duration for the SGTR transient. The iodine spiking duration is the time calculated between reactor trip and isolation of the affected SG.

The staff reviewed the initial parameter values and biases and noted that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum RCS temperature and pressure, low steam pressure, and single failure of the primary MSIV. Additionally, different assumptions were used for cases that target maximum primary pressure and maximum secondary pressure. For each analysis performed, the applicants evaluations of the SGTR event considered a range of initial conditions, biases, and conservatisms including single failure (e.g., for peak RCS pressure, no failure of the affected SG primary MSIVs is conservative).

The staff notes that this event does not assume a single failure of an ECCS valve IAB, which keeps the ECCS valves closed until the RPV-to-containment differential pressure exceeds the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1.

The staff audited the applicants SGTR sensitivity studies, which investigated the most limiting initial conditions and loss of power assumptions, to confirm that they led to the most limiting results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for the MCHFR and radiological mass releases.

No operator action is assumed; however, the staff noted that the secondary MSIVs that are required to isolate the leakage are non-safety-related valves, as shown in DCA Part 2, Tier 2, Table 3.2-1. Therefore, on December 29, 2017, the staff issued RAI 9237, Question 15.06.03-3 11

(ADAMS Accession No. ML17363A439), asking the applicant to clarify how this configuration conforms to NUREG-0138, Issue 1, which allows flexibility in the acceptance of non-safety grade (i.e., non-safety-related) equipment where failures are of secondary system piping which have a significantly lower potential for release of fission products than a breach of the primary system boundary like the SGTR event. In its February 2, 2018, response (ADAMS Accession No. ML18033A119) to RAI 9237, Question 15.06.03-3, the applicant maintained that the backup valves would have enhanced design, surveillance, and operability requirements and that their use would be consistent with RG 1.206 and previous staff positions based on other recent DCAs. On May 10, 2018, the staff issued RAI 9420, Question 15-17 (ADAMS Accession No. ML18130A412), asking the applicant to perform a sensitivity analysis assuming the non-safety-related secondary MSIV fails to close and to provide several design and functional requirements to clarify valve ability to perform this safety function. In its response (ADAMS Accession No. ML18033A119) to RAI 9420, Question 15-17, the applicant provided the requested information along with a draft markup of DCA Part 2, Table 3.2-1. The staff performed a confirmatory radiological analysis, which agreed with the applicants offsite doses and showed that the dose criteria would not be affected. However, the staff needed clarification of other issues that were discussed with the applicant in public calls in February 2018 (ADAMS Accession No. ML18121A441). In its November 20, 2018, supplemental response (ADAMS Accession No. ML18324A889) to RAI 9420, Question 15-17, the applicant included additional information needed to conform to NUREG-0138 for the non-safety grade equipment. The applicant provided additional markups of DCA Part 2, Table 3.2-1, to include reference to DCA Part 2, Sections 3.9.6.5 and 15.0.0.6.6, and of DCA Part 2, Table 3.9-17, to clarify the quality and testing requirements for these secondary isolation valves. The supplemental response regarding NUREG-0138 satisfactorily addressed the information needed by the staff to determine that (1) SG overfill has no detrimental effects and (2) the MSIVs are able to close under low steam quality conditions. Based on the applicants response, RAI 9420, Question 15-17, is a confirmatory item.

Results The tube rupture causes a decrease in PZR pressure and level which results in reactor trip actuation on a low PZR pressure signal or a low PZR level signal. The DHRS is actuated, and closure of the FWIVs and MSIVs follows to isolate the SGs and terminate the loss of reactor coolant to the environment. Core decay heat then drives natural circulation, which transfers thermal energy from the RCS to the reactor pool via the DHRS associated with the intact SG.

The applicant performed two primary analyses for the SGTR event. The first analysis to investigate the radiological consequences uses conservative input parameters that maximize the potential for radiological release. The second analysis investigates the pressure responses in the RPV and helical coil SGs to ensure that peak pressures remain below the design pressures.

The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.6.3, to determine if they meet the SRP acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the core power, SG pressures and levels, core temperature and levels, RCS leak flow rate, MCHFR, and DHRS heat removal rates.

12

As part of the staffs review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

Maximize Radiological Consequences The magnitude of mass released from an SGTR event depends on the timing of SG isolation, since SG isolation ends the release of mass from the RPV to other plant areas. Maximizing the mass released to the environment and the duration of the iodine spike (elapsed time from reactor trip to SG isolation) maximizes the radiological consequences.

This SGTR event initiated from full power and biased high RCS pressure because the higher pressure difference between the primary and secondary leads to a higher break flow, and thus a higher integrated mass released. The results of sensitivity studies on break type and location indicate that a rupture of a tube at the top of the SG provides the greatest integrated mass released and the longest spiking time. This case also assumes (1) failure of the primary MSIV to close on affected SG which delays isolation since closure of the secondary MSIVs is slower, leading to additional mass released and a longer iodine spike duration, and (2) no loss of power.

The event starts with a double-ended tube failure at the top of the SG. As the leakage continues, the reactor pressure and PZR level decreases, and the MPS initiates a reactor trip and PZR heater trip based on a low PZR level signal at 254 seconds. The RCS temperature then begins to cool more rapidly because of the reactor trip and the energy lost to the faulted SG. The RCS pressure continues to decrease until reaching the low PZR pressure setpoint, which activates containment isolation including closure of the primary MSIVs, secondary MSIVs, FWIVs, FWRVs, and opening of the DHRS actuation valves at 277 seconds. Since the faulted SG primary MSIV fails to close, the SGTR leak flow continues until the secondary MSIV closes 30 seconds later, at approximately 307 seconds. In this analysis, the SG levels are predicted to remain below 20 percent at the time of the secondary MSIV closure; therefore, the valve closes in a steam environment, and SG overfill occurs well after secondary MSIV closure.

After the faulted SG is isolated, the NPM continues a gradual depressurization and cooldown as the DHRS associated with the intact SG removes decay heat.

The staff audited (ADAMS Accession No. MLXXXXXXXXX) the applicants calculations and confirmed that the most severe case for the release of fission products and calculated doses has been considered. The staff also reviewed bounding radiological consequence analyses as noted in Section 15.0.3 of this SER.

Maximize Reactor Coolant System and Steam Generator Pressure The staff reviewed the applicants SGTR case that resulted in a limiting RCS pressure. This case assumes a double-ended tube failure at the top of the SG but with a coincident loss of normal ac power, resulting in immediate closure of the turbine stop valves by 0.5 seconds. The RCS pressurizes because of loss of SG heat removal, compounded by the degraded SG with the tube rupture. The MPS actuates a reactor trip based on a high PZR pressure signal at 7.6 seconds, which also results in containment isolation and DHRS actuation. The peak RCS pressure of 2,073 psia occurs at about 12 seconds. The limiting SG pressure case assumes a low RCS average temperature, low SG pressure, and double-ended tube failure at the bottom of the SG, also with coincident loss of normal ac power. The MPS actuates a reactor trip based on a high PZR pressure signal at 8.5 seconds, which also causes containment isolation and DHRS actuation. The peak PZR of approximately 2,049 psia occurs at about 12.5 seconds. The SG 13

secondary pressurizes because of the SGTR and the turbine stop valve closure. The affected SG reaches a higher pressure because of the break, approaches the RCS pressure, and peaks at 1,806 psia at about 120 seconds. Afterwards, the RCS and secondary begin a gradual decline as the RCS is cooled by the intact SG and its associated DHRS. The staff confirmed that for the worst RCS pressure and SG pressure cases, the RCS and secondary pressure remained below 120 percent of their design pressures.

The staff confirmed that for the worst SGTR MCHFR case, the CHFR remained well above the 95/95 DNBR limit based on comparison to more limiting events, i.e., decrease in feedwater temperature and uncontrolled CRA withdrawal. The staff also found that the fuel temperature decreases upon the reactor trip and that core water level remains well above the top of the active fuel, such that the potential for fuel failure is precluded.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.3.

Based on the open items documented above, no conclusions can be reached regarding the SGTR event and GDCs 13, 14, and 34, and 10 CFR 52.47(a)(2)(iv)(A) and (B).

15.6.4 Main Steamline Failure outside Containment (Boiling-Water Reactor)

A main steamline failure outside containment is a BWR-specific event and therefore does not apply to the NPM design.

15.6.5 Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary This section describes the evaluation of the applicants DCA Part 2, Tier 2, analyses of the NuScale reactor responses to postulated LOCAs as the result of piping breaks within the RCPB, including LTC up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event. These analyses are used to determine the limiting conditions for operation, limiting safety system settings, and design specifications for safety-related components and systems.

Introduction A LOCA is a postulated accident resulting from instantaneous rupture of an RCS pipe within the RCS boundary. A spectrum of break sizes for both double-ended guillotine break and split break types are analyzed. For the NPM LOCA event, the most limiting scenario was found to occur in the CVCS injection line, which is a 2-inch line connected to the core riser. The methodology used is based on the NuScale topical report TR-0516-49422, Revision 0, Loss-of-Coolant Accident Evaluation Model, issued December 2016 (ADAMS Accession No. ML17004A138).

The LOCA event for the NuScale NPM design is unique compared to traditional PWRs because of the small size of RCS piping and because RCS inventory lost during a LOCA is preserved within containment and relied on for recirculation back to the core soon after event initiation.

14

The methodology uses the deterministic 10 CFR Part 50, Appendix K, approach, and the NPM is designed to eliminate or reduce many of the design-basis LOCA consequences compared to a typical large PWR, in which the most important LOCA consequences would be core uncovery, core refilling, core reflooding, fuel cladding swelling and rupture, and fuel metal-water reaction.

Consequently, NuScale has requested exemptions in Part 7 of the DCA from Appendix K, Parts 1.A.5, 1.B, 1.C.5, and 1.C.7 since phenomena related to these Appendix K criteria are essentially avoided by design of the NPM ECCS. Section 15.0.2 of this SER gives details of the exemption request. The NPM LOCA calculations show significant margins to peak cladding temperature (PCT) of 1,204 degrees C (2,200 degrees F) (10 CFR 50.46(b)(1)) and the other criteria (10 CFR 50.46(b)(2) through (b)(4)) so that the relevant figures of merit are not PCT but (1) collapsed liquid water level in the core, (2) the critical heat flux ratio (CHFR), and (3) containment pressure and temperature. In conjunction, therefore, applicability of the LOCA methodology is limited as described in SER Section 15.0.2.2 and does not address post-CHF heat transfer phenomena, including cladding oxidation, clad hydrogen production, or clad geometry changes such as swell and rupture.

The NPM LOCA event addresses the ECCS performance up to the time when a stable recirculation flow is established from the containment back to the reactor pressure vessel (RPV), pressures and levels in containment and the RPV approach a stable equilibrium condition (i.e., steady flow is recirculating through the RRVs), and core decay heat is removed by boiling in the core with steam exiting through the RVVs and then condensing in the containment. The DHRS is also available to supplement core cooling but is not credited in the LOCA analysis.

Summary of Application DCA Part 2, Tier 1: There are no Tier 1 entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 system description in Section 15.6.5, summarized below.

The LOCA event simulates a compromise in the RCPB resulting in RCS inventory loss at a rate that exceeds the capacity of normal makeup flow. The applicant assessed a spectrum of break sizes and locations of the RCS pressure boundary piping, and the event is analyzed for core thermal-hydraulic effects and is classified as a postulated accident.

The LOCA break spectrum is separated into two categories: (1) a liquid space break consisting of the RCS injection (i.e., charging) line and discharge line and (2) a steam space break consisting of the high-point vent line and PZR spray supply line. The progression of these events is similar, with the steam space breaks depressurizing the RCS faster, resulting in slight differences in timing of the key events because of the composition of the liquid or steam break flow. There are two distinct phases of the LOCA progression: (1) the blowdown phase that begins with the initiation of the postulated break in the RCS into the containment to the point that the MPS actuates the ECCS valves to open, and (2) a second, more rapid blowdown that begins with the opening of ECCS valves resulting in pressure equalization between the RCS and containment allowing the cooled, depressurized RCS inventory to fill the containment to the point that the discharged RCS fluid from the CNV is returned to the RPV downcomer. The MPS is actuated early in the event to initiate reactor trip, generally based on high CNV pressure or high PZR pressure, which then isolates containment, and initiates DHRS although DHRS is not credited. The ECCS is actuated by low riser level above the core, high containment level, loss 15

of ac power after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or loss of dc power. No operator action is credited in this event analysis.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response for minimum collapsed level above the core and MCHFR. The applicant stated that the input parameters and initial conditions used in the LOCA analysis are selected to provide conservative calculational results in compliance with the Appendix K requirements.

The applicant concluded that criteria 1 through 4 in 10 CFR 50.46(b) are met and that the MCHFR remains greater than the safety limit. The applicant further stated that CNV pressure and temperature remain within design limits, and the collapsed level remains above the top of the active fuel. The transition from the LOCA analysis to the post-LOCA long-term core cooling begins a third phase after natural circulation between the RPV and the containment through the RVVs and RRVs has reached a stable steady-state with adequate decay heat cooling. The latter phase (up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event) is addressed in a separate technical report; the staff evaluation is contained in Section 15.6.5.2 of this SER.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this area of review.

Regulatory Basis The following NRC regulations contain the relevant requirements for this review:

• 10 CFR 50.46, as it relates to ECCS equipment being provided that refills the vessel in a timely manner for a LOCA resulting from a spectrum of postulated piping breaks within the RCPB.

• 10 CFR Part 50, Appendix K, which provides the required and acceptable features of ECCS EMs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 35, as it relates to demonstrating that the ECCS would provide abundant emergency core cooling to satisfy the ECCS safety function of transferring heat from the reactor core following any loss of reactor coolant at a rate that (1) fuel and clad damage that could interfere with continued effective core cooling would be prevented, and (2) clad metal-water reaction would be limited to negligible amounts.

16

• 10 CFR Part 100, as it relates to mitigating the radiological consequences of an accident.

• 10 CFR Part 50, Appendix A, GDC 27, as it relates to the reactivity control systems being designed to have a combined capability of reliably controlling reactivity changes to assure that under postulated accident conditions, and with appropriate margin for stuck rods, the capability to cool the core is maintained (see SER section 15.0.6.4 - Exemption from General Design Criteria 27).

• 10 CFR 52.47(a) and 10 CFR 52.79(a), as they relate to demonstrating compliance with any technically relevant portions of requirements related to Three Mile Island in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).

The staff notes that the applicant provided principal design criteria (PDC) for GDC 34 and 35.

PDC 34 and 35 proposed by NuScale are functionally identical to GDC 34 and 35 with the exception of the discussion related to electric power, which PDC 34 and 35 eliminate. A detailed discussion of NuScales reliance on electric power and the related exemption to GDC 17 can be found in the SER for Chapter 8, as well as the staffs evaluation (ADAMS Accession No. ML17340A524) of the NuScale topical report on electrical systems (TR-0815-16497). Neither PDC 34 nor PDC 35 requires the DHRS or ECCS to have electrical power (offsite or onsite) to perform their safety functions. The staff will evaluate NuScales request for exemptions under 10 CFR 50.12 from GDCs 34 and 35 in SER Chapter 8.

SRP Section 15.6.5, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary, lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP sections:

• The applicant has performed an evaluation of ECCS performance in accordance with an evaluation model that satisfies the requirements of 10 CFR 50.46. RG 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, and Section I of Appendix K to 10 CFR Part 50 provide guidance on acceptable evaluation models.

• The analyses should be performed in accordance with 10 CFR 50.46, including methods referred to in 10 CFR 50.46(a)(1) or (2). Additionally, the LOCA methodology used in the LOCA analyses should be shown to apply to the individual plant by satisfying 10 CFR 50.46(c)(2), and the analysis results should meet the performance criteria in 10 CFR 50.46(b).

• The calculated maximum fuel element cladding temperature does not exceed 1,200 degrees C (2,200 degrees F).

• The calculated total local oxidation of the cladding does not exceed 17 percent of the total cladding thickness before oxidation. Total local oxidation includes pre-accident oxidation, as well as oxidation that occurs during the accident.

• The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1 percent of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

17

• Calculated changes in core geometry are such that the core remains amenable to cooling.

• After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptably low value, and decay heat is removed for the extended period required by the long-lived radioactivity.

• An analysis of a spectrum of LOCAs ensures that boric acid precipitation is precluded for all break sizes and locations.

• The radiological consequences of the most severe LOCA are within the guidelines of 10 CFR Part 100 or 10 CFR 50.67. For applications under 10 CFR Part 52, reviewers should use SRP Section 15.0.3, Design Basis Accident Radiological Consequence Analyses for Advanced Light Water Reactors.

• The Three Mile Island Action Plan requirements for II.E.2.3, II.K.2.8, II.K.3.5, II.K.3.25, II.K.3.30, II.K.3.31, and II.K.3.40 have been met.

DSRS Section 15.6.5 lists the following additional acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

• Adequate failure mode analysis has been performed to justify the selection of the most limiting single active failure consistent with DSRS Section 6.3.

• If core uncovery is not expected during the entire period of a LOCA, the staff should ensure that a significant number of fuel rods will not be damaged because of local dryout conditions. This may be demonstrated by showing that the limiting fuel rod heat flux remains below the CHF at a given pressure after depressurization has taken place.

• The parameters and assumptions used for the calculations were conservatively chosen.

These choices include taking the initial power level as the licensed core thermal power plus an allowance of 2 percent to account for power measurement uncertainties, using the maximum LHGR, addressing permitted axial power shapes, and conservatively calculating the initial stored energy.

• NuScale may base its ECCS and RCS designs on prevention of core uncovery. If that is the case, the reviewer should compare the applicants analysis with the staffs independent analysis to determine if the predicted level of core coverage is consistent.

Technical Evaluation 15.6.5.1.4.1 Evaluation Model The applicant used the LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.3 and Revision 0 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. Section 15.0.2 of this SER also provides a summary of the staffs evaluation of the code and methodology, as well as the applicants request for exemption from certain requirements in 10 CFR Part 50, Appendix K. The LOCA EM is currently under staff review and is identified as Open Item 15.0.2-2. In addition, by letter dated February 14, 2019 (ADAMS Accession No. ML19045A645), the applicant indicated its intent to 18

update its transient and accident analyses to use NRELAP5 Version 1.4 and a revised plant model. Pending the applicants submittal and staff review of updates to DCA Part 2, Tier 2, Chapter 15, this is identified as Open Item 15.0.2-1. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.3 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 2, Section 15.6.5.

The NRELAP5 input model for LOCA was developed from the applicants base plant model, which was developed generically for both LOCA and non-LOCA transient analyses. The base modeling contained a set nodalization to model thermal-hydraulic fluid volumes and connecting heat structures for (1) the reactor vessel primary loop, including the lower plenum, core, riser, PZR, SG primary side, RPV downcomer, with CVCS piping for RCS injection, discharge, and PZR spray lines, (2) reactor vessel secondary systems, including the helical coil SG secondary, steamlines and feedwater lines, (3) the containment, (4) the reactor pool with DHRS included, and (5) ECCS valves and connections. Additionally, the base model considers averaged reactor kinetics and MPS control systems logic including PZR pressure, PZR level, vessel riser temperature, steam pressure, turbine load, and ESF controls for the ECCS.

The LOCA modeling uses a simplified model that eliminates (( )) .

The NuScale-specific CHF correlations used in the LOCA EM are a function of the core mass flux. The staff audited the applicants break spectrum calculations that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting LOCA results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The applicant requested exemptions in Part 7 of the DCA from parts of Appendix K to10 CFR Part 50. This exemption request is evaluated in Section 15.0.2 of this SER and remains under evaluation. Pending staff approval, this exemption request is identified as Open Item 15.0.2-3.

Additionally, the staff performed a preliminary confirmatory analysis using the NRCs TRACE thermal-hydraulic code for the 100-percent CVCS injection line break case, which demonstrated that the applicants methodology produces reasonably conservative results. The staff found that the overall NRELAP prediction, with embedded conservatisms, is more conservative in predicting the peak containment pressure. The staff confirmatory cases to date have not considered the limiting 10-percent injection line break, but it appears the overall trends in the behavior track well for the important phenomena. Note that these results were generated with NRELAP5 Version 1.3 and may change when reanalyzed with Version 1.4 and the revised plant model. The staffs review of Version 1.4 updates to DCA Part 2, Tier 2, Chapter 15, is identified as Open Item 15.0.2-1.

15.6.5.1.4.2 Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the analysis model. This includes checking input parameters and initial conditions used in the LOCA analysis to ensure that selections provide conservative assumptions for initial stored energy in the RCS, MCHFR, and minimum collapsed liquid level (CLL) in the core. The key biases are maximum initial core power, 102-percent power, maximum RCS average temperature to maximize RCS energy, maximum PZR pressure of 1,920 psia to maximize RCS flow out of the break, minimum PZR level of 52 percent to minimize RCS inventory availability, and a reactor pool temperature of 60 degrees C (140 degrees F) maximum to minimize heat transfer rate to the pool.

19

The staff noted that the applicant selected the RCS average temperature of 287 degrees C (548 degrees F), which is not in accordance with DCA Part 2, Tier 2, Table 15.0-6. Therefore, the staff issued RAI 9481, Question 15.06.05-8, asking the applicant to update Section 15.6.5 of DCA Part 2, Tier 2, to address the deficiency in initial RCS average temperature conditions. In its September 28, 2018, response to RAI 9481, Question 15.06.05-8 (ADAMS Accession No. ML18271A152), the applicant explained that the discrepancy was the result of a limitation on the maximum operating riser temperature, which was being removed. Additionally, the applicant stated that it had updated TR-0516-49422 (under staff review, Open Item 15.0.2-2) to include an initial RCS average temperature of 291 degrees C (555 degrees F) consistent with DCA Part 2, Tier 2, Table 15.0-6, and that the RCS flow was minimized to the minimum value in DCA Part 2, Tier 2, Table 15.0-6, to ensure that initial stored energy of the RCS is maximized.

The NRC staff finds this response acceptable because it maximizes the amount of stored energy within the RCS, which is conservative for LOCA analyses. However, the applicants response did not provide DCA markups to remove the limitation on maximum operating riser temperature. The staff has requested that the applicant supplement its response to provide markups to DCA Part 2, Tier 2, Table 15.6-13. This is identified as Open Item 15.6.5-8.

Since the NPM relies on natural circulation for reactor coolant flow and does not include external RCS piping, there are no large-diameter pipe breaks to consider. Consequently, the applicant postulated a LOCA spectrum of breaks at various locations in comparatively small piping within the RCS pressure boundary. The breaks analyzed focused on the CVCS injection and discharge, high-point vent, and PZR spray lines inside containment.

The staff reviewed the break locations considered and noted that the reactor vent valves, reactor recirculation valves, and control rod drive mechanism housing were not identified as being considered in the spectrum of possible break locations. This led the staff to question whether the spectrum of pipe breaks considered was sufficient to identify the limiting break.

Therefore, on May 26, 2017, the staff issued RAI 8785, Question 15.06.05-1 (ADAMS Accession No. ML17146B301), asking the applicant to provide justification that a sufficient break spectrum was considered such that the limiting break size was identified and that it meets the acceptance criteria in 10 CFR Part 50, Appendix K, I.C.1. In its July 19, 2017, response to RAI 8785, Question 15.06.05-1 (ADAMS Accession No. ML17200D072), the applicant indicated that the ECCS valves and the control rod housings are considered part of the reactor coolant pressure vessel and that the valve nozzles did not meet the Appendix K definition of piping according to Branch Technical Position (BTP) 3-3, Protection Against Postulated Piping Failures in Fluid Systems Outside Containment. Additionally, the applicant indicated that, although not considered in the LOCA spectrum, the inner diameter of the CRDM nozzle is bounded by the flow area of an inadvertent opening of a reactor vent valve analyzed in DCA Part 2, Section 15.6.6. The staff disagreed with the interpretation of BTP 3-3 and, on January 26, 2018, issued follow-up RAI 9358, Question 03.06.02-17 (ADAMS Accession No. ML18026A519), to request the applicant to justify the valve connections as break exclusion locations according to BTP 3-4, Postulated Rupture Locations in Fluid System Piping Inside and Outside Containment. In its December 13, 2018, and January 22, 2019, responses (ADAMS Accession Nos. ML18348A917 and ML19022A364) to RAI 9358, Question 03.06.02-17, the applicant provided additional analysis and justifications for break exclusion, which are still under staff review. Pending NRC staff review of the applicants response, RAI 9358, Question 03.06.02-17, is identified as Open Item 03.06.02-1.

The applicant did not credit operator action to mitigate a LOCA event. The applicant also considered the single failures of an RVV or RRV to open. However, since the maximum rate of 20

depressurization during ECCS activation yields the minimum CLL, the assumption of no single failure of ECCS valves to open provides the limiting results.

The staff noted that the LOCA analyses do not assume single failure of an IAB valve to keep an ECCS valve closed until the RPV-to-containment differential pressure is above the inadvertent block setpoint. The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815, discussed in Section 15.6.6 of this SER, is identified as Open Item 15.0.0.5-1. The staff notes that since the effective break area of the RRV (2.5-inch diameter) is larger than the largest CVCS line break (1.69-inch diameter), the limiting MCHFR event will remain the inadvertent operation of ECCS (DCA Part 2, Tier 2, Section 15.6.6). The staff reviewed initial parameter values and biases in the DCA and in the applicants response to RAI 9475, Question 15.06.05-17 (ADAMS Accession No. ML18271A167), including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The staff agreed that the parameters are sufficiently conservative for LOCA initial conditions.

The staff also noted that the applicant implemented several minor geometry changes in the NPM design that were not reflected in NRELAP5 models used for the LOCA spectrum.

Therefore, on April 5, 2018, the staff issued RAI 9325, Question 15.00.02-1 (ADAMS Accession No. ML18095A796), asking the applicant to reconcile these changes and confirm that the modeling used remains conservative for the limiting LOCA cases (and non-LOCA, since it applies generically when NRELAP5 is used to determine results). In its June 4, 2018, response to RAI 9325, Question 15.00.02-1 (ADAMS Accession No. ML18155A623), the applicant stated that design and modeling changes have been implemented but did not provide details of those changes. In its February 14, 2019, supplemental response (ADAMS Accession No. ML19045A645) to RAI 9325, Question 15.00.02-1, the applicant indicated that it has incorporated the more significant changes, and they are being submitted to the NRC staff with various RAI responses and that the remaining analyses are not expected to change significantly, as described in Table 1 of the supplemental response. NuScale will continue to update the outstanding DCA analyses, which will be provided to the NRC as part of the DCA, Revision 3, submittal. The staff notes that not all the updated analyses had been provided in the revised response. Further, the staff learned during audits of DCA Part 2, Tier 2, Chapter 6.2 (ADAMS Accession No. ML18177A087), that design and methodology changes are being made that are not described in the current topical reports or DCA. Pending resolution of this issue, RAI 9325, Question 15.00.02-1, is identified as Open Item 15.0.2-1.

On February 19, 2019, NuScale informed the NRC staff (ADAMS Accession No. ML19056A289) that MPS design changes are in progress. These changes are related to increase in the containment level actuation setpoint and the removal of the ECCS actuation on reactor vessel (riser) level and logic input changes for DHRS actuation. This is Open Item 15.6.5-1.

The loss of normal ac power was determined to conservatively maximize the RCS thermal conditions after event initiation for a LOCA. When normal ac power is lost, the feedwater pumps coast down and a TT is initiated, thus limiting cooling to the RCS provided via the secondary system.

21

The staff audited the applicants break spectrum calculations that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting LOCA results (see the audit summary memorandum at ADAMS Accession No. MLXXXXXXXXX). The audited material generally supports the discussions in the DCA, and the staff confirmed that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

15.6.5.1.4.3 Results The submitted NPM break spectrum is separated into two categories: (1) liquid space breaks (RCS injection line or discharge line) and (2) steam space breaks (high-point vent line and PZR spray supply). A steam space break initiates a blowdown of the RCS inventory into the CNV from the top of the RPV. A liquid space break causes blowdown of the RCS inventory into the CNV from the RPV downcomer. The event progresses much faster if the break is from a liquid space.

The applicant determined the 10-percent CVCS injection line break case to be limiting for CLL above the core, and the 100-percent CVCS discharge line case to be limiting for MCHFR. The limiting case assumed a loss of ac power and no single failures. Single-failure evaluations of a single RVV to open, a single RRV to open, and failure of one ECCS division (one RVV and one RRV) to open determined that no single failure was the bounding scenario. The staff reviewed the accident progression and agrees that the 10-percent case delays ECCS actuation such that break flow is maximized from the RCS into the containment, which minimizes RCS inventory and core CLL. The staff also agrees that the 100-percent discharge line case is limiting for CHF since it results in maximum blowdown of break flow from the RPV early in the event. Within the first fraction of a second after the break, flow stagnation, core voiding, and high core stored energy cause the minimum departure from nucleate boiling (or CHF) to occur.

The limiting 10-percent CVCS break event begins coincident with a loss of normal ac, and upon initiation, RCS inventory flows out of the break into the containment. The loss of normal ac power trips feedwater pumps and ends RCS cooling via the secondary system. Because of the small break size and the loss of secondary cooling, the RCS undergoes a short-term pressurization where RCS pressure reaches the high PZR pressure setpoint of 2,000 psia, causing the reactor trip. The high PZR pressure signal also initiates secondary isolation and DHRS actuation, which provides additional cooling by a recirculation loop between SG steaming and the DHRS heat exchangers in the reactor pool. However, for conservatism, the DHRS cooling is not credited.

As the pressure and inventory inside the RCS continue to decrease, the pressure and inventory inside the containment continue to increase. The high containment pressure signal causes containment isolation. The NPM ECCS is actuated by either a high containment level limit or a low RPV riser level, and after the level setpoint is reached, the ECCS IAB feature prevents the ECCS valves from opening until the differential pressure between the RPV and containment reaches the 1,000-psi threshold. As the ECCS (RVVs and RRVs) opens, the pressure in the RPV drops quickly, causing a second round of flashing and voiding in the core and a sharp but brief reduction in the core CLL above the active fuel level. However, the core remains covered and the CHFR remains well above the safety limit. The minimum core level recovers rapidly, as RCS flow restabilizes and inventory in the containment begins to flow back into the RPV downcomer through the RRVs. Containment pressure and temperature reach a maximum 22

value at about 15 seconds after the ECCS valves open. After that, the core thermal energy is slowly discharged to the reactor pool through the containment wall via boiler condenser mode heat transfer. At this point, gradual cooldown and depressurization continue, and the LOCA event transitions to the post-LOCA LTC phase.

The minimum CLL above the top of the core was approximately 1.8 inches, and the MCHFR was approximately 1.8, well above the LOCA CHFR safety limit of 1.29. Since the MCHFR remained above the safety limit, the applicant concluded that the acceptance criteria for LOCA are met for the maximum peak clad temperature, total percentage of fuel cladding oxidation, amount of hydrogen generation, and maintenance of coolable geometry of the reactor core, and that the radiological consequences are within the limits of 10 CFR Part 100. The staff reviewed the plotted results and sequence of events tables and finds that they are consistent with the event description and progression of ECCS behavior. In addition, the staff concludes that they support the applicants assertion that the acceptance criteria are met. However, the sequence of events and limiting CHF consequences could change depending on the outcome of the open items.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.5.

Conclusion Based on the open items discussed above, no conclusions can be reached regarding the LOCA event and the requirements in 10 CFR 50.46, 52.47(a), and 52.79(a); GDCs 13, 35, and 27; 10 CFR Part 50, Appendix K; and 10 CFR Part 100.

Introduction The post-LOCA LTC assessment described in Section 15.6.5 of DCA Part 2, Tier 2, provides an evaluation of the ECCS LTC capability of the NPM after a successful initial short-term response to the DBEs discussed in Section 15.6.5.1 of this SER up to a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the events. The assessment does not credit for normal ac power, the non-safety-related dc power system, or any operator action. The methodology used is based on technical report TR-0916-51299, Revision 0 (ADAMS Accession No. ML17009A490), which is incorporated by reference in Table 1.6-2 of DCA Part 2, Tier 2.

The long-term core cooling phase starts after the ECCS is actuated and the NPM reaches a quasi-steady state condition such that steam from the PZR region of the RPV is released to the containment vessel (CNV) through the RVVs and the steam is condensed on the CNV walls, where it collects in the bottom of the CNV. Then, as the level in the CNV builds, the condensed liquid flows from the CNV through the RRVs back into the downcomer core inlet. This recirculation flow loop continues, and the NPM is gradually cooled. This LTC configuration is reached through both LOCA and non-LOCA initiating events; however, this review covers only LOCAs as the initiating event. The non-LOCA initiating events generally involve the DHRS cooldown to the point where the ECCS is initiated, much later than for LOCA cases (i.e., after the IAB threshold pressure is reached or after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if ac power is unavailable (see SER Section 15.0.6)). Consequently, the long-term core cooling requirements of 10 CFR 50.46(b)(4) and (b)(5) must be demonstrated for these LOCA or non-LOCA events. The LTC analyses are 23

intended to demonstrate that decay heat removal and reactor cooldown via the reactor pool are effective such that the reactor module(s) will remain in a safe, stable condition for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following the event.

The same NuScale-specific acceptance criteria applied for LOCA are used here based on 10 CFR 50.46, including (1) CLL in the reactor vessel remains above the top of the core, (2) cladding temperatures remain acceptably low, (3) margins to the CHF are maintained, (4) coolable geometry is maintained, and (5) the core remains in a subcritical condition. The applicant indicated that the fifth criterion does not apply to the LTC condition because no mechanism to push a large volume of diluted water into the core inlet exists to cause concern for recriticality resulting from boron dilution.

The staff disagrees with the applicants assertion that there is no potential for recriticality during the range of conditions that could be incurred in LTC. Section 15.6.5.2.4 of this SER discusses the staff review and assessment of this issue.

Summary of Application DCA Part 2, Tier 1: There are no Tier 1 entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 system description in Section 15.6.5, summarized below.

The transition from the LOCA analysis to the post-LOCA long-term core cooling phase results in a stable state where decay heat is being removed leading to gradual plant cooldown. The LTC evaluation performed by the applicant also states that the continued cooling occurs without boron precipitation or dilution for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the initiation of a LOCA.

The applicant concluded that Criteria 4 and 5 of 10 CFR 50.46(b) are met, the collapsed level remains above the top of the active fuel, and the MCHFR remains greater than the safety limit.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS are the same as those described in Section 15.6.5.1.2 of this SER.

Technical Reports: TR-0916-51299, Revision 0, Long-Term Cooling Methodology Regulatory Basis The relevant requirements of the regulations for this area of review and the associated acceptance criteria, given in SRP Section 15.6.5 (ADAMS Accession No. ML070550016), are the same as those previously summarized in the LOCA section of this SER (15.6.5.1), with the primary acceptance criteria set in GDC 35 and 10 CFR 50.46(b)(4) and (b)(5).

DSRS Section 15.6.5 lists the following additional guidance important for determining conformance to LTC requirements, as well as review interfaces with other SRP/DSRS sections:

• Verify that the analyses include a spectrum of LOCAs to ensure that boric acid precipitation is precluded for all break sizes and locations.

24

• Confirm CNV peak pressure and heat transfer capacity to remove the decay heat.

• Verify that the analysis of boric acid precipitation includes a justified mixing volume, which is computed as a function of time as emergency core cooling injection enters the core region. The precipitation limit must also be justified in the EM.

Technical Evaluation 15.6.5.2.4.1 Evaluation Model The applicant used the NRELAP5 code with the methodology specified in the LOCA topical report (TR-0516-49422, Revision 0) and the LTC methodology technical report (TR-0916-51299) to model the NPM responses for this long-term post-LOCA event. The methodology does not address the effects of debris on ECCS operation in regard to Generic Safety Issue 191, Assessment of Debris Accumulation on PWR Sump Pump Performance, (ADAMS Accession No. ML16054A259) or return to power due to overcooling or boron dilution. The staffs assessment of GSI 191 is described in Section 6.3 of this SER, and return to power is addressed in Section 15.0.6.

The LTC technical report identifies the highly ranked LTC phenomena for the NPM. The phenomena identification and ranking table (PIRT) is developed using figures of merit that include CHFR, core coolant collapsed level, and subcriticality. Broadly speaking, the LTC PIRT can be divided into three general categories:

(1) phenomena addressed by NRELAP5 code models (( ))

(2) phenomena related to NRELAP5 boundary conditions and NPM characteristics (( ))

(3) phenomena related to boron mixing, distribution, and behavior (( ))

The LTC technical report evaluates the applicability of the NRELAP5 code to the LTC methodology by (1) comparisons to the LOCA EM Topical Report and (2) benchmarks to two LTC tests without DHRS activation performed at the NIST-1 facility (NIST-1 tests HP-19a and HP-19b).

The applicant developed the NRELAP5 input model for LTC from the NPM base model for transient analyses, with some of the simplification taken from the LOCA model to run longer transient cases. Since validation of the NRELAP5 code for LTC depends heavily on the LOCA topical report assessments, the LTC NRELAP5 model is benchmarked to the LOCA EM input model to show consistency of results. The key LTC model differences are (( )) .

Additionally, decay heat modeling is used, with a multiplier of up to 1.2, depending on the LTC scenario considered.

The applicant described the LTC methodology as having a basis in the LOCA methodology; however, it appears to the staff that the two input models and methodologies were developed in parallel, with each originating from the singular NRELAP5 base model. Therefore, the staff does not identify a clear link to LOCA models since the LTC models are significantly different.

The applicant provided a benchmark comparison of the methodologies to show similarities in predictive capability and validation pedigree. However, since the applicant does not expect CHF or core uncovery for the long-term post-LOCA events, the applicant used a very streamlined approach to developing the LTC modeling. The applicants LOCA EM modeling 25

also contains considerably less detail than the NRELAP5 base model but (( )) .

Additionally, the LTC NRELAP5 model contains many changes to the base model for application to the LTC transient, including (1) reactor pool changes to directly incorporate the DHRS, (2) feedwater line changes, (3) initial CNV pressure is increased, with noncondensables added, and (4) reactor pool level changes.

The 100-percent letdown line break (LDBRK) case was used for the benchmark. According to Revision 0 of the LTC technical report, LTC-specific changes to the LOCA modeling included

(( )) .

For the LTC to LOCA EM benchmarking, the applicant plotted results only for the initial blowdown, ECCS actuation, and early ECCS recirculation, out to 4000 seconds (TR-0916-51299, Revision 0, Section 4.3, Figures 4-17 through 4-23). These results show that the LTC model (( )) .

With only about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> presented to show compatibility for a 72-hour analysis event, the staff could not conclude whether the compatibility was sufficient to determine the modeling pedigree and nodalization consistency of the LTC phase of a LOCA. Therefore, on May 25, 2018, the staff issued RAI 9516, Question 15-26 (ADAMS Accession No. ML18145A170), asking the applicant to discuss the analysis differences between the LTC EM nodalization and the LOCA EM nodalization, including the basis and justification for the changes to the LOCA EM, and to describe how the differences between the model nodalization resulted in the differences shown between the calculated results. In its December 21, 2018, response (ADAMS Accession No. ML18355A973) to RAI 9516, Question 15-26, the applicant provided a reanalysis of the LDBRK under minimum level conditions comparing the LOCA EM base model, a new LOCA EM coarser model, and an updated LTC model out to 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The revised results showed improved consistency between the LOCA EM and LTC models; however, the applicant indicated that it was changing the limiting LTC case from the LDBRK presented previously to an injection line break. The staff was unable to determine if these changes are related to LTC generic model changes or are related overarching model changes related to Revision 1 of the NRELAP5 base model (see RAI 9325).

The staff is addressing these updated modeling and design changes as part of an ongoing audit (ADAMS Accession No. ML19004A098), and therefore, RAI 9516, Question 15-26, remains as Open Item 15.6.5-2. The NRELAP5 validation benchmarks, NIST-1 tests HP-19a and HP-19b, simulating a LOCA with LTC, were each initiated by opening an RVV with slightly different conditions in the containment pressure vessel. Blowdown of reactor pressure vessel inventory into containment resulted with the event transitioning to ECCS recirculation and LTC. (( )) .

From these tests, the applicant compared the experimental data to the NRELAP5 predictions for eight parameters. The comparison showed reasonable agreement, with NRELAP5 tending to

(( )) showed good agreement. For each of the experiments, the applicant compared the NRELAP5 results to the following eight key parameters:

(1) CNV level (2) RPV level (3) CNV pressure (4) RPV pressure 26

(5) cooling pool level (6) lower cooling pool temperature (7) middle cooling pool temperature (8) upper cooling pool temperature The NRELAP5 prediction of (( )) ,

the applicant implied that the predicted heat transfer to the pool was consistent with the experiment.

Overall, the staff finds that the NRELAP5 predictions of the NIST-1 tests (HP-19a and HP-19b) are acceptable since the CNV and RPV pressure and level show good agreement. The staff also agrees that one-dimensional modeling in the cooling pool cannot capture all the realistic phenomena and that small differences in the predictions of cooling temperature and level are not crucial to the success of the benchmarks.

The LTC technical report identifies a methodology to assess boron precipitation during long-term ECCS operation. The analysis consists of a simplified mixing volume approach that compares the average boron concentration in the core and riser region to a solubility limit. The methodology uses conservative assumptions, including (1) the core inlet temperature is used to calculate boron solubility in the core and riser region, and (2) all boron initially in the RCS is retained in the core and riser region. In Revision 0 of the LTC technical report, (( )) .

The assessment relies on the NRELAP5 LTC calculations to provide NPM core inlet temperature and CLL in the core and riser region to determine the success of coolability. The staff reviewed this simplified approach and found that it was conservative and appropriate.

The LTC technical report does not address a methodology to assess the potential for boron dilution during long-term ECCS operation but assumes boron dilution cannot occur (i.e., the reactor remains subcritical). For traditional PWRs, ECCS actuation generally includes abundant injection of pumped borated water, but the NPM ECCS only recirculates RCS fluid, and there is no safety-related system to inject boron.

The staff was concerned that core reactivity could be adversely affected by diluted water from the RRVs entering the core during long-term ECCS recirculation, along with boron lost to plate-out in the upper riser from boron volatility caused by long-term steaming. On May 28, 2018, the staff issued RAI 8930, Question 15-27 (ADAMS Accession No. ML18148A002), asking the applicant to provide a methodology to determine the potential effects of boron dilution. The applicant could demonstrate either that the core remains in a subcritical condition or that SAFDLs are not exceeded during the return to power (see Section 15.0.6 of this SER). In its September 14, 2018, response (ADAMS Accession No. ML18257A308) to RAI 8930, Question 15-27, the applicant submitted an analysis, but the staff did not agree with the applicant that its model was sufficiently justified, nor that its assumptions were appropriately conservative in regard to boron volatility and the subsequent plate-out phenomena in the upper riser that could occur as the reactor undergoes extended cooldown. This issue is also addressed in SER Section 15.0.6, and the applicant is preparing a supplement to the RAI response, as stated in a March 26, 2019, public meeting (ADAMS Accession No. MLXXXXXXXXX). Pending staff receipt and review of the supplemental response, RAI 8930, Question 15-27, is identified as Open Item 15.0.6-5.

27

Assessments by the NRC staff determined that several mechanisms could contribute to boron dilution, assuming a 100-percent CVCS discharge break, including (1) boron lost to the CNV bottom during the initial blowdown that is no longer available to reenter the RCS, (2) boron that may concentrate in the upper riser from long-term steaming and recirculation after the RCS depressurizes and ECCS cooling is established, (3) diluted steam condensate that accumulates in the CNV and returns to the RPV downcomer, and (4) vapor produced by boiling will entrain small amounts of boric acid that will volatize in steam and plate-out onto cooler surfaces as it enters the CNV. The volatility of boron during long-term steaming has the potential to reduce boron concentration to the extent that recriticality is possible. Therefore, the staff disagreed with the applicants statement that no mechanism exists to push a large volume of diluted water into the core inlet and that there is no concern for recriticality caused by boron dilution for LTC out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The staff also noted that the applicant used an NRELAP5 control system to model steam flow through the RVVs by adjusting the flow coefficient via code control variables rather than the methodology used in the LOCA topical report but did not justify the change in method.

Therefore, on May 12, 2018, the staff issued RAI 9470, Question 15.06.05-9 (ADAMS Accession No. ML18132A005), asking the applicant to explain the basis for use of this control system and to evaluate the impact of this methodology compared to that of the LOCA modeling described in TR-0516-49422, Revision 0. In its December 21, 2018, response (ADAMS Accession No. ML18355A787), to RAI 9470, Question 15.06.05-9, the applicant submitted a revised modeling with a simpler single multiplier on the flow coefficient but did not provide an analysis to compare it to the LTC and LOCA methodologies used. The staff requested that the applicant supplement this RAI response. Pending staff receipt and review of the supplemental response, RAI 9470, Question 15.06.05-9, is identified as Open Item 15.6.5-9.

15.6.5.2.4.2 Input Parameters, Initial Conditions, and Assumptions Although the applicant provided a revised post-LOCA LTC analysis in its December 21, 2018, response (ADAMS Accession No. ML18355A973) to RAI 9516, Question 15-26, as discussed above, RAI 9516, Question 15-26, remains as Open Item 15.6.5-2. Therefore, the evaluation below is based on Revision 0 of the LTC technical report.

The input parameters and initial conditions used in the post-LOCA LTC analysis are selected to provide a conservative initial stored energy in the RCS, and the key parameters of interest are minimum CHFR, minimum collapsed liquid level (CLL) in the core, and boron precipitation.

Therefore, there are two LTC general limiting sets of conditions that address the thermal-hydraulic response: (1) maximum cooldown to minimize the level in the riser for addressing boron precipitation with lowest RCS temperatures, and (2) minimum cooldown to maximize the fuel cladding temperature and minimize the CHFR.

The applicant considered a broad range of assumptions and initial conditions to simulate the various cases to determine the limiting responses for post-LOCA LTC. Some of the variations include decay heat, ranging from no decay heat to 120 percent of nominal; heat transfer from the CNV to the pool, ranging from 20 percent to 1,000 percent of nominal; reactor pool temperature, ranging from 4.4 degrees C (40 degrees F) to 98.9 degrees C (210 degrees F);

reactor pool level, down to 45 feet (nominal at 69 feet); and PZR level, down to 20-percent level.

The CVCS letdown line break, in conjunction with loss of normal ac power, was determined to be the limiting scenario. The applicant identified and evaluated two limiting groups (five total cases).

28

(1) minimum cooldown with letdown line break (LDBRK)two cases, which differ in the minimum reactor pool level, decay heat with 1.2 multiplier, and maximum reactor pool temperature of 98.9 degrees C (210 degrees F)

(2) maximum cooldown with LDBRKthree cases, which vary decay heat multiplier 0.8 and 1.2, PZR level nominal to 20 percent, and minimum reactor pool temperature of 4.4 degrees C (40 degrees F)

The minimum cooldown presents the limiting conditions in terms of collapsed level and maximum fuel and RCS temperature, and the maximum cooldown presents the limiting conditions in terms of collapsed level and minimum RCS temperature. The staff reviewed the case selection and determined that the LDBRK is limiting since it results in greater inventory loss from the RCS.

15.6.5.2.4.3 Results Although the applicant provided a revised post-LOCA LTC analysis in its December 21, 2018, response (ADAMS Accession No. ML18355A973) to RAI 9516, Question 15-26, as discussed above, RAI 9516, Question 15-26, remains as Open Item 15.6.5 2. Therefore, the evaluation below is based on Revision 0 of the LTC technical report.

The LTC technical report evaluates the ability of the ECCS to provide decay heat removal and an orderly cooldown of the plant to a stable condition of LTC with natural circulation cooling.

For all cases, the applicant concluded that the decay heat removal via the ECCS is acceptable since the PCT drops steadily from the initial temperature, the CLL remains above the top of the fuel, and positive flow through the core is maintained.

The results of the post-LOCA LTC analysis are contained in TR-0916-51299 and incorporated by reference in Table 1.6-2 of DCA Part 2, Tier 2. Based on the applicants five sensitivity condition cases, the staff considered three limiting cases: (1) with maximum pool temperature, minimum pool level (45 feet),1.2 x decay heat, and single active failure of one RRV and one RVV for minimum cooldown, (2) with nominal PZR level, minimum pool temperature (4.4 degrees C (40 degrees F)), maximum pool level, 10 x pool volume, 1.2 x decay heat, and single active failure of one RRV and one RVV for maximum cooldown, and (3) the previous condition with 20-percent PZR level. Each of these cases is compared to a nominal LDBRK base case with nominal conditions and 1.0 decay heat multiplier.

Minimum Cooldown Rate The minimum cooldown rate case produces the highest RCS temperatures and pressures and highest CNV pressure of the cases considered. The fuel cladding temperatures are well within the fuel cladding limits, with the maximum RCS temperature in the LTC phase converging to about 193 degrees C (380 degrees F). The minimum CNV and riser CLLs for the minimum cooldown case are nearly the same as for the base LDBRK case at nominal conditions and converged to about 22 and 10 feet, respectively.

The results show a small periodic fluctuation of RCS and CNV temperature and pressure with an interval of about 25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />. The applicant does not explain this periodic behavior, but the phenomenon does not appear to affect the results to challenge the fuel cladding temperature or CLL criteria.

29

Maximum Cooldown Rate The maximum cooldown showed that fuel cladding temperature is not challenged and that core CLLs do not drop below the top of active fuel. The staff, however, was concerned about applicability since one of the two cases was run only to 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> out of the prescribed 72-hour LTC transient event. Additionally, the applicant stated that it was necessary to isolate heat transfer to the secondary side (SG tube and DHRS) to allow NRELAP5 to converge because of code robustness issues, stemming from accumulation of numerical mass errors.

The staff raised these concerns in audit conversations (ADAMS Accession No. ML17157B592),

and the applicant indicated that the longer-term behavior could be extrapolated since other LTC runs demonstrated a general asymptotic trend in the results. The staff maintained that the modifications to isolate the SGs and DHRS were inconsistent, with biasing needed for maximum cooldown. The staff considered that the applicant added extra conservativism in several of the assumptions used; however, it was not clear if the added conservatisms are adequate to compensate for isolation of the substantial cooling that would be provided by the DHRS with the reactor pool temperature at 4.4 degrees C (40 degrees F). Therefore, the staff issued RAI 9479, Question 15.06.05-5 (ADAMS Accession No. ML18120A368) to ask the applicant to revise the methodology to include DHRS cooling or provide an analysis justification for DHRS isolation that is appropriate for post-LOCA LTC. In its December 21, 2018, response (ADAMS Accession No. ML18355A824) to RAI 9479, Question 15.06.05-5, the applicant submitted an analysis showing that cooler core inlet temperatures are achieved with the DHRS activated and indicated that it would revise the LTC report (TR-0916-51299) accordingly. Pending receipt of the revised LTC technical report, RAI 9479, Question 15.06.05-5, is being tracked as a confirmatory item.

The applicant concluded that decay heat removal via the ECCS is acceptable, regardless of the short-term initiating conditions, and that stable long-term CLLs in the riser cover the core and preclude any occurrence of CHF. The minimum CLL was found to be 2.271 feet above the core for the maximum cooldown case, with 1.2 times decay heat and an initial PZR level of 20 percent.

In addition to the LOCA, the applicant considered inventory loss through possible containment leakage. With conservative assumptions of CNV pressure, the calculated leakage resulted in a very slight decrease in riser level of just over 1 inch of CLL in the riser region during the 72-hour LTC transient. The staff reviewed these results and finds that initial conditions were conservative and the plotted trends reasonably consistent and acceptable.

Boron Precipitation Analysis The applicants results indicate that boron precipitation will not occur during the limiting LTC scenario analyzed. The LDBRK case for maximum cooldown, with 1.2 decay heat multiplier and initial PZR level of 20 percent, indicated that at the time of minimum level, 2.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after break initialization, there is a margin of about 3.9 degrees C (7 degrees F) until boron precipitation. Based on the conservatisms of the boron precipitation modeling, the staff finds these results acceptable.

Boron Dilution The applicants methodology does not address the boron dilution phenomena because the applicant asserted that there is no credible mechanism of introducing a large slug of deborated 30

water unmixed into the core region. As previously stated, the staff issued RAI 8930, Question 15-27 (ADAMS Accession No. ML18148A002), asking the applicant to provide a methodology to determine the potential for boron dilution during long-term ECCS cooling, which is identified as Open Item 15.0.6-5.

Boron Precipitation/Plate-out The applicants methodology also does not address the boron plate-out phenomenon. The staff notes that localized boron plate-out above the two-phase water level in the riser or in the core region caused by aggressive boiling can potentially clog the RVVs during LTC. Therefore, on February 7, 2018, the staff issued RAI 9248, Question 15.06.05-4 (ADAMS Accession No. ML18038B365), asking the applicant to provide an analysis of the potential for boron plate-out and its effect on RVV ECCS performance during LTC. In its April 9, 2018, response (ADAMS Accession No. ML18099A379) to RAI 9248, Question 15.06.05-4, the applicant submitted an analysis concluding that the entrainment of droplets was not large enough to cause any significant plate-out that could impede operation of the RVVs. The staff reviewed the applicants response and agrees that plate-out from entrainment should not occur to the extent that it would affect operation of the three RVVs. However, staff determined that plate-out due to boron volatility (i.e., in steam resulting from long term ECCS steaming) also should to be addressed for RVV operability out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Therefore, RAI 9248 Question 15.06.05-4 was unresolved closed and referred to RAI 8930, which is identified as Open Item 15.0.6-5.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.5.

Conclusion Based on the open items discussed above, no conclusions can be reached regarding the post-LOCA LTC assessment and the requirements in 10 CFR 50.46, 52.47(a), and 52.79(a);

GDCs 13, 35, and 27; 10 CFR Part 50, Appendix K; and 10 CFR Part 100.

15.6.6 Inadvertent Operation of the Emergency Core Cooling System A spurious signal, hardware malfunction, or operator error can cause an ECCS valve to inadvertently open, resulting in a loss of reactor coolant from the reactor pressure vessel (RPV) and an RPV depressurization. This event is classified as an AOO.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.6, Inadvertent Operation of Emergency Core Cooling System.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS applicable to this area of review are in Part 4 of the DCA.

31

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the RCS being designed with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so the RCPB is not breached during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 20, which requires that the protective system automatically initiate the operation of the reactivity control system to ensure that SAFDLs are not exceeded as a result of AOOs.

• 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

• 10 CFR Part 50, Appendix A, GDC 29, which requires that protection and reactivity control systems be designed to assure an extremely high probability of accomplishing their safety functions in the event of AOOs.

• 10 CFR Part 50, Appendix A, GDC 35, as it relates to ensuring that fuel and clad damage, should it occur, must not interfere with continued effective core cooling, and that clad metal-water reactor must be limited to negligible amounts.

DSRS Section 15.6.6 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants inadvertent operation of ECCS analysis.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.6.6, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 6.3, that for the NuScale ECCS valve to open, two things must occur: the dc solenoid-operated trip pilot valve must open on either an ECCS actuation signal or loss of power, and, if the IAB valve seats, it must open when the passive, differential pressure block clears. As a result of the design of 32

these valves, for the analysis presented in DCA Part 2, Tier 2, Section 15.6.6, the applicant stated that an inadvertent actuation of ECCS can result in one of two ways: (1) a spurious ECCS signal coincident with a single failure of one of the IAB devices or (2) a mechanical failure of an ECCS valve. For the analysis presented in DCA Part 2, Tier 2, Section 15.6.6, the applicant assumed that the initiating event is a mechanical failure of one ECCS valve and did not assume a single failure of an IAB valve. On May 26, 2017, the staff issued RAI 8815, Question 15-2 (ADAMS Accession No. ML17146B305), to confirm whether the IAB valve is a passive component. Passive components are not subject to single failure in accordance with SECY-77-439; therefore, the staff could confirm that the applicants assumed cause of the initiating event (i.e., mechanical failure) is appropriate. This RAI also asked for confirmation that a partial opening of an ECCS valve is not a credible failure mode, since in the case of the RRVs, a partially open ECCS valve would result in less return flow to the core and, therefore, a more severe challenge to the core if the other RRV was assumed to fail to open upon ECCS actuation. If a partial opening of an ECCS valve is not a credible failure mode, then the staff would find that the applicants assumed cause of the initiating event (mechanical failure resulting in a fully open ECCS valve) is appropriate for this analysis. In response (ADAMS Accession No. ML18065B273) to RAI 8815, Question 15-2, the applicant revised DCA Part 2, Tier 2, Section 15.0, to state that the IAB valve is passive, and thus it is not necessary to assume a single failure of the IAB valve. Furthermore, the IAB valve meets the deterministic and probabilistic criteria in SECY-94-084. Also, the applicant stated that a partial opening is a noncredible failure mode for an initiating event. The staff performed an audit of the NuScale ECCS design (ADAMS Accession No. MLXXXXXXXXX), which is described in Section 3.9.6 of this report.

The question of whether the IAB is subject to the SFC is unresolved, and the staff provided SECY-19-0036 to the Commission requesting guidance on how the staff should treat the IAB. If the Commission decides that the IAB is subject to the SFC and DCA Part 2, Tier 2, Chapter 15, should be analyzed consistent with past practices (e.g., not crediting non-Class 1E power), the sequence and consequence of most events presented in DCA Part 2, Tier 2, Chapter 15, Revision 2, will be different. Pending resolution of this matter, RAI 8815 is identified as Open Item 15.0.0.5-1. In DCA Part 2, Tier 2, Section 15.6.6.1, the applicant stated that it does not expect the spurious opening of a single ECCS valve to occur during the lifetime of a module; however, the applicant categorized this event conservatively as an AOO.

Evaluation Model DCA Part 2, Tier 2, Section 15.6.6.3.1, states that the inadvertent operation of an ECCS valve is evaluated using a modified LOCA EM, which is documented in Appendix B to topical report TR-0516-49422, Revision 0 (ADAMS Accession No. ML17004A138). The staff is currently reviewing TR-0516-49422 and tracking the review of this EM as part of Open Item 15.0.2-2.

Model Assumptions, Input, and Boundary Conditions DCA Part 2, Tier 2, Section 15.6.6.3.2, states that input parameters and initial conditions were selected to minimize MCHFR. SER Table 15.6.6-1 provides these input parameters. The staffs evaluation of the input parameters is also provided in Table 15.6.6-1 and in the subsequent paragraphs. The applicant selected several input parameters based on the results of sensitivity analyses. The staff conducted an audit as part of the review, which included an examination of the sensitivity studies associated with the transient analyses (ADAMS Accession No. MLXXXXXXXXX). During this audit, the staff observed that the outcome of sensitivity 33

analyses associated with the inadvertent operation of the ECCS event was consistent with the statements made in DCA Part 2, Tier 2, Section 15.6.6.3.2. Additional parameter selection is based on the methodology presented in topical report TR-0516-49422, which is currently under staff review. The review of TR-0516-49422 is identified as Open Item 15.0.2-2.

34

Table 15.6.6-1: Initial Conditions and Input Parameters for the Inadvertent Operation of ECCS Event Model Parameter Applicants Assumption Basis Maximize core power to Initial power level Biased high minimize MCHFR Initial RCS average Biased high Sensitivity analysis temperature RCS flow Biased low Sensitivity analysis PZR pressure Biased high Sensitivity analysis PZR level Biased high Sensitivity analysis Reactivity feedback coefficients Minimal TR-0516-49422 Beginning of cycle + additional Kinetics parameters TR-0516-49422 biasing Maximum time delay, bounding Minimize reactivity Scram characteristics scram worth with most reactive rod insertion for limiting stuck, bounding control rod drop rate MCHFR Axial power distribution Bounding middle peaked shape Sensitivity analysis Changed as part of LOCA EM Radial power distribution TR-0516-49422 changes to analyze this event Limiting ECCS valve RRV Sensitivity analysis Additional considerations include loss of electric power and single failure. DCA Part 2, Tier 2, Section 15.6.6.3.2, states that several loss of power scenarios were considered, and the loss of all dc and ac was identified as the limiting scenario, but that the results are not sensitive to power availability because of the rapid nature of the transient. The staff agrees that the inadvertent operation of an ECCS valve is not sensitive to power availability because MCHFR 35

occurs before the systems affected by the loss of electrical power can impact the analysis. DCA Part 2, Tier 2, Section 15.6.6.3.2, states that the single-failure evaluation considered one reactor vent valve (RVV) failing to open, one reactor recirculating valve (RRV) failing to open, and failure of one ECCS division causing one RVV and one RRV failing to open. The staff recognizes that the consideration of single failure of the IABs has a significant impact on the inadvertent operation of ECCS event. As discussed in Section 15.6.6.4.1 of this SER, the application of single failure to the IABs is unresolved and is identified as Open Item 15.0.0.5-1.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.6.6, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and containment pressure, flow rates (including ECCS valve flow rates and RCS flow rates), CLL above top of active fuel, RCS temperature, and fuel and clad temperatures. DCA Part 2, Tier 2, Figure 15.6-67, shows that the MCHFR remains significantly above the safety limit for the inadvertent operation of an ECCS valve event. Additionally, in DCA Part 2, Tier 2, Tables 15.6-57 and 15.6-61 show that the RCS and main steam pressures are maintained far below 110 percent of design pressure. Further, the staff performed a confirmatory analysis of this event using TRACE and found that both TRACE and NRELAP predict similar phenomena and major plant parameter trends for the inadvertent ECCS valve opening event. Because of Open Item 15.0.2-2 associated with the evaluation methodology, as discussed in Section 15.6.6.4.2 of this SER, the staff cannot establish a finding associated with the MCHFR fuel safety limit. Based on the accident description in DCA Part 2, Tier 2, Section 15.6.6.1, the staff finds that RCS and main steam pressure is maintained below 110 percent of design pressure because the inadvertent operation of an ECCS valve event is a depressurization event for the NPM.

DCA Part 2, Tier 2, Section 15.6.6.5, states that the event escalation acceptance criteria are satisfied because the NPM continues to be cooled with natural circulation through the ECCS valves. The staff previously addressed the potential for event escalation in Section 3.2 of the safety evaluation for TR-0815-16497, Revision 1 (ADAMS Accession No. ML18054B607), in which the staff (1) addressed the concern that reliance on the containment to mitigate an AOO may not be consistent with the underlying defense-in-depth purpose of 10 CFR Part 50, Appendix A, GDC 15, and (2) established Condition 4.4 on TR-0815-16497 to address reliability requirements for the systems necessary to retain reactor coolant within the RCPB. The staff addressed Condition 4.4 for TR 0815-16497 in Chapter 1 of this SER and found that the condition is satisfied. Based on the information in Chapter 1 of this SER regarding the disposition of Condition 4.4 for TR-0815-16497 and the information in DCA Part 2, Tier 2, Section 15.6.6.1, the staff finds that the event escalation acceptance criteria are met because (1) a realistic analysis shows that ECCS actuation in response to an AOO or infrequent event is expected to occur much less than once in the lifetime of an NPM, and (2) the spurious opening of a single ECCS valve is not expected to occur during the lifetime of an NPM.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.6.

36

Based on the open items documented above, no conclusions can be reached regarding the inadvertent ECCS operation event and GDCs 10, 13, 15, 20, 26, 29, and 35.

15.7 Radioactive Release from a Subsystem or Component DCA Part 2, Tier 2, Section 15.7, Radioactive Release from a Subsystem or Component, describes events that could result in radioactive releases from a component or system other than the RCS. DCA Part 2, Tier 2, Section 15.7, points to other parts of the DCA that contain the evaluation of these events.

Gaseous Waste Management System Leak or Failure SER Section 11.3, Gaseous Waste Management System, contains the staffs evaluation of a gaseous waste management system leak or failure.

Liquid Waste Management System Leak or Failure SER Section 11.2, Liquid Waste Management System, contains the staffs evaluation of a liquid waste management system leak or failure.

Postulated Radioactive Releases Due to Liquid-Containing Tank Failures SER Section 11.2 contains the staffs evaluation of a postulated radioactive release resulting from liquid-containing tank failures.

Radiological Consequences of Fuel-Handling Accidents SER Section 15.0.3 contains the staffs evaluation of the radiological consequences of a fuel-handling accident.

Spent Fuel Cask Drop Accidents DCA Part 2, Tier 2, Section 15.7.5, Spent Fuel Cask Drop Accidents, states that the applicant has not performed a DBA analysis to assess the radiological consequences of a spent fuel cask drop accident because of the design of the single-failure-proof crane. SRP Section 15.7.5, Spent Fuel Cask Drop Accidents, states that accident analysis for a spent fuel cask drop is not required if the spent fuel cask handling design and procedures prevent the cask from falling or tipping onto spent fuel. In this case, the staff notes that the crane design precludes the dropping of a spent fuel cask. Section 9.1.5 of this SER, Overhead Heavy Load Handling Systems, presents the staffs evaluation of the reactor building crane system design and capabilities.

NuScale Power Module Drop Accident DCA Part 2, Tier 2, Section 15.7.6, NuScale Power Module Drop Accident, states that the applicant has not performed a design basis accident analysis to assess the radiological consequences of an NPM drop accident due to the design of the single-failure-proof crane.

SER Section 9.1.5 provides the staffs evaluation of the reactor building crane system design and capabilities. DCA Part 2, Tier 2, Section 19.1.6, Safety Insights from the Probabilistic Risk 37

Assessment for Other Modes of Operation, discusses the evaluation of an NPM drop event in the NuScale probabilistic risk assessment.

15.8 Anticipated Transients without Scram Introduction An anticipated transient without scram (ATWS) is characterized as a failure of the MPS to initiate a reactor trip in response to an anticipated operational occurrence (AOO). The probability of an AOO, in coincidence with a failure to scram, is much lower than the probability of any other event analyzed in this chapter. Therefore, an ATWS event is classified as a beyond design basis event (BDBE). The regulatory requirements associated with the mitigation of the consequences of ATWS are referred to in this section as the ATWS rule.

The underlying purpose of the specific design features required by the ATWS rule (10 CFR 50.62, Requirements for Reduction of Risk from Anticipated Transients without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.) is to reduce the risk associated with ATWS events by reducing the likelihood of failure of the reactor protection system to shutdown the reactor (scram) following anticipated transients and to mitigate the consequences of ATWS events. SRP Section 15.8, Anticipated Transients without Scram, provides two options for evolutionary plants to reduce the risks associated with ATWS. The first option is to provide a diverse scram system, which would reduce the probability of a failure to scram. The Statement of Considerations for the ATWS rule in Commission Paper SECY-83-293, Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (ATWS) Events, issued July 1983, suggests that the safety goal of the specific design features in 10 CFR 50.62 is to reduce the expected core damage frequency (CDF) associated with ATWS to about 1x10-5 per year. Therefore, a diverse scram system or other design feature should reduce the ATWS CDF to a level close to 1x10-5 per year to reduce the risks of ATWS to an acceptable level to satisfy this option. The second option is to demonstrate that SRP Section 15.8 ATWS safety criteria are met when evaluating the consequences of an ATWS occurrence.

Summary of Application DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.8, Anticipated Transients without Scram.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA.

38

Topical Reports: Topical Report TR-1015-18653, The Highly Integrated Protection System, issued September 13, 2017 (ADAMS Accession No. ML17256A892) is associated with this section of the applicants DCA.

In DCA Part 2, Tier 2, Section 15.8, the applicant stated that, in the NuScale design, the ATWS contribution to CDF is significantly below the safety goal of 1x10-5 per year, as demonstrated in the probabilistic risk assessment described in DCA Part 2, Tier 2, Section 19.1. This low contribution is based on the reliability of the reactor trip function of the MPS. The MPS, which is described in DCA Part 2, Tier 2, Sections 7.1 and 7.2, includes a robust reactor protection system with internal diversity, which avoids common-cause failures and reduces the probability of a failure to scram. The MPS uses the highly integrated protection system (HIPS) platform.

The HIPS topical report (ADAMS Accession No. ML17256A892) describes integration of fundamental instrumentation and controls design principles into the HIPS design. The HIPS platform encompasses the principles of independence, redundancy, predictability and repeatability, and diversity and defense in depth. The applicant further stated that the redundancy and diversity of the MPS design ensure that an ATWS occurrence is a very low probability event for the NuScale Power Plant, which meets the intent of the first criterion of SRP Section 15.8 for evolutionary plants, and that the NuScale design supports an exemption from the portion of 10 CFR 50.62(c)(1) requiring diverse TT capabilities because the NuScale design does not rely on TT to reduce the risk associated with ATWS events.

Additionally, the applicant stated that the NuScale design does not include an auxiliary feedwater system, and therefore, the portion of 10 CFR 50.62(c)(1) that requires diverse capability to initiate an auxiliary feedwater system is not applicable to the NuScale design. DCA Part 2, Tier 2, Section 19.2, describes the analysis of this beyond-design-basis ATWS event.

The applicants request for exemption from the TT requirement of 10 CFR 50.62(c)(1) is documented in Part 7 of the NuScale DCA. Paragraph (c)(1) of 10 CFR 50.62 states the following:

Each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse from the reactor trip system, to automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactor trip system.

The applicant provided additional description of ATWS and the MPS mitigation systems in DCA Part 2, Tier 2, Chapter 19, and DCA Part 2, Tier 2, Chapter 7, respectively.

Regulatory Basis Acceptance criteria for ATWS are based on meeting the relevant requirements of the following Commission regulations:

• 10 CFR 50.62 (the ATWS rule), as it relates to the acceptable reduction of risk from ATWS events via (1) inclusion of prescribed design features and (2) demonstration of their adequacy.

• 10 CFR 50.46, as it relates to maximum allowable PCTs, maximum cladding oxidation, and coolable geometry.

39

• 10 CFR Part 50, Appendix A, GDC 12, as it relates to whether the design of the reactor core and associated coolant, control, and protection systems ensures that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can be reliably and readily detected and suppressed.

• 10 CFR Part 50, Appendix A, GDC 14, as it relates to ensuring an extremely low probability of failure of the RCPB.

• 10 CFR Part 50, Appendix A, GDC 16, as it relates to ensuring that containment design conditions important to safety are not exceeded because of postulated accidents.

• 10 CFR Part 50, Appendix A, GDC 35, as it relates to ensuring that fuel and clad damage, should it occur, must not interfere with continued effective core cooling, and that clad metal-water reaction must be limited to negligible amounts.

• 10 CFR Part 50, Appendix A, GDC 38, as it relates to ensuring that the containment pressure and temperature are maintained at acceptably low levels following any accident that deposits reactor coolant in the containment.

• 10 CFR Part 50, Appendix A, GDC 50, as it relates to ensuring that the containment does not exceed the design leakage rate when subjected to the calculated pressure and temperature conditions resulting from any accident that deposits reactor coolant in the containment.

The guidance in SRP Section 15.8 details the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

Technical Evaluation The staff reviewed DCA Part 2, Tier 2, Section 15.8, to ensure that the regulatory and technical acceptance criteria described in the SRP for this section are satisfied. For evolutionary plants, the Statement of Considerations for the rule in SECY-83-293 allows the option either to provide a diverse scram system satisfying the design and quality assurance requirements specified in SRP Section 7.2, Reactor Trip System, or to demonstrate that the consequences of an ATWS event are within acceptable values. The MPS provides a diverse means to minimize the consequences of ATWS and the likelihood of its occurrence.

The staffs review of the applicants request for exemption from the TT requirements of 10 CFR 50.62(c)(1) is documented in the safety evaluation for DCA Tier 2, Chapter 7. The key component of the MPS is the HIPS, which provides the reactor trip, diversity, and defense-in-depth functions necessary to meet the intent of the ATWS rule. The staff approval of the HIPS design is documented in the safety evaluation for the HIPS topical report (ADAMS Accession No. ML17108A433).

During preapplication interactions with NuScale, the staff documented its view that the 10 CFR 50.34(f)(2)(xii) and 10 CFR 50.62(c)(1) requirements relating to conventional PWR auxiliary feedwater system automatic initiation may not apply to the NuScale small modular reactor design and that an exemption request may not be needed. NuScales view was documented as Gap 3, Auxiliary Feedwater System Actuation and Flow Indication, of 40

NP-RP-0612-023, Revision 1, the Gap Analysis Summary Report, issued July 2014 (ADAMS Accession No. ML14212A832). The staff documented the basis for its statements in a February 2016 letter to the applicant (ADAMS Accession No. ML15272A208). The staffs rationale for its statements was that the NuScale DHRS would perform the decay heat removal functions that would normally be expected of auxiliary feedwater systems found at typical light-water PWRs. The staff reviewed the information in DCA Part 2, Tier 2, Sections 10.4.9, Auxiliary Feedwater System, and 5.4.3, Decay Heat Removal System. Sections 10.4.9 and 5.4.3 of this SER document that review. Analyses of ATWS event sequences performed by the applicant and documented in DCA Part 2, Tier 2, Chapter 19, show that successful opening of a single RSV, even without consideration of the DHRS heat removal, provides sufficient natural circulation cooling to prevent core damage. The staff independently confirmed this conclusion. Because the decay heat removal function can be performed passively, the staff finds that a conventional PWR auxiliary feedwater system automatic initiation does not need to be applied to the NuScale small modular reactor design to prevent core damage.

The staff reviewed the information submitted in DCA Part 2, Tier 2, Section 15.8, to ensure the requirement in 10 CFR 50.62 (c)(6) that information sufficient to demonstrate the adequacy of items in 10 CFR 50.62 (c)(1)-(5) was submitted in accordance with 10 CFR 50.4, Written Communications. The staff finds that the information submitted in support of the request for exemption from the TT requirements of 10 CFR 50.62(c)(1) is sufficient to demonstrate the adequacy of items in 10 CFR 50.62(c)(1) based on the staffs safety evaluation for DCA Tier 2, Chapter 7. The staff confirmed that the items in 10 CFR 50.62(c)(2)-(5) do not apply to the NuScale design.

The staff evaluation of the ATWS BDBE and its associated CDF is discussed in the Chapter 19 safety evaluation.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.8.

Conclusion As described in Section 7.1.5.4.5.1 of this SER, the staff concludes that the NuScale design meets the exemption criteria in 10 CFR 50.12 for the applicable portion of the ATWS rule. The other portions of the ATWS rule are not applicable, for the reasons described above. As discussed in further detail in SER Section 7.1.5.4.5.1, the NuScale design provides acceptable reduction of risk from ATWS events via (1) inclusion of prescribed design features and (2) demonstration of their adequacy as specified in the staff requirements memoranda and the discussion contained in the Statement of Considerations for the final rule.

15.9 Stability Introduction Thermal-hydraulic and coupled thermal-hydraulic/neutronic instabilities can occur in reactors using natural circulation to drive primary flow. Certain conditions, such as low flow and high power, could result in two-phase flow (boiling, subcooled boiling, or flashing), which result in flow and pressure oscillations. Such oscillations are typically denoted as density wave oscillations. If these oscillations are growing, in primary pressure and flow, they are called density wave instabilities. For natural circulation systems, oscillations or instabilities could occur 41

because of buoyancy-induced density difference, including those from transition to two-phase flow, and are also coupled with neutron kinetics (core power) and secondary-side changes.

One approach is to determine the range of parameters and conditions in which the system remains stable and exclude operation of the reactor outside this range. Such an exclusion region limits operation to conditions under which long-term instabilities will not develop.

However, an unmitigated instability could result in a new steady-state condition or initiation of the applicants MPS.

Summary of Application DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.9, Stability.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following TS are applicable to this area of review:

• LCO 3.1.3, Moderator Temperature Coefficient (MTC)

• the TS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

Regulatory Basis The following NRC regulations contain the relevant requirements for this review:

• 10 CFR Part 50, Appendix A, GDC 10, as it relates to the reactor coolant system (RCS) being designed with appropriate margin to assure that specified acceptable fuel design limits are not exceeded during normal operations, including AOOs.

• 10 CFR Part 50, Appendix A, GDC 12, which requires that power oscillations which can result in conditions exceeding SAFDLs, be either not possible or reliably and readily detected and suppressed.

• 10 CFR Part 50, Appendix A, GDC 13, as it relates to instrumentation provided to monitor variables and systems over their anticipated ranges for normal operation, for AOOs, and for accident conditions, and to maintain these variables and systems within prescribed operating ranges.

• 10 CFR Part 50, Appendix A, GDC 20, which requires the reactor protection system to initiate automatic action to assure that SAFDLs are not exceeded as a result of AOOs.

Conditions that result in unstable power oscillations are AOOs.

• 10 CFR Part 50, Appendix A, GDC 29, which requires that protection and reactivity control systems be designed to assure an extremely high probability of accomplishing their safety functions in the event of AOOs.

42

DSRS Section 15.9.A lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

Technical Evaluation The staff reviewed DCA Part 2, Tier 2, Section 15.9, as modified by letters dated September 14, 2018 (ADAMS Accession No. ML18257A305) and February 28, 2019 (ADAMS Accession No. ML19059A478), to assess the applicants approach to preventing or mitigating instabilities and power oscillations that could pose unfavorable flow or thermal conditions and result in SAFDLs being exceeded. The staff is tracking the incorporation of the markups provided in letters of September 14, 2018, and February 28, 2019, as Confirmatory Item 15.9.4-1.

The staff reviewed the exclusion region based long-term stability solution. NuScale shows in DCA Part 2, Tier 2, Figure 15.9-1, that the region of possible instability is defined by loss of riser subcooling, and the region of forbidden operation is for a riser subcooling margin less than 2.8 degrees C (5 degrees F). NuScale states in DCA Part 2, Tier 2, Section 15.9.1, that the Module Protection System (MPS) trips the NPM five (5) degrees F before reaching the region where instability is possible. The staff noted the analytical boundaries that separate the acceptable NPM operating region from the exclusion region are plotted as RCS hot temperature versus PZR pressure in DCA Part 2, Tier 2, Figure 4.4-9. The staff further notes the lower right corner of this operating region was originally bounded by DCA Part 2, Tier 2, Equation 4.4-2, which generally defined the thermal-hydraulic stability exclusion region. The staff notes that the subcooling margin based on Equation 4.4-2 is slightly (2 percent to 4 percent) smaller, and therefore less conservative, than the 2.8-degree C (5-degree F) subcooling margin noted in DCA Part 2, Tier 2, Figure 4.4-9.

In its January 11, 2019, response (ADAMS Accession No. ML19011A310) to RAI 9501, Question 15-12, NuScale removed Equation 4.4-2 and provided markups that clarified in DCA Part 2, Tier 2, Section 4.4.3.2, that the low-pressure analytical limit is 1,600 psia for RCS hot-leg temperatures less than 316 degrees C (600 degrees F) and 1,720 psia for RCS hot-leg temperatures greater than 316 degrees C (600 degrees F). The staff notes that these analytical limits are more conservative than those defined by Equation 4.4-2. However, the subcooling margins remain slightly less than 2.8 degrees C (5 degrees F) (approximately 2.7 degrees C (4.8 degrees F and 4.9 degrees F, respectively)) for the analytical limits at and near two exclusion boundary points represented by (316 degrees C (600 degrees F), 1,600 psia) and (321 degrees C (610 degrees F), 1,720 psia) in the revised Figure 4.4-9 of the markups. While the exclusion region is not strictly defined by a subcooling margin of 2.8 degrees C (5 degrees F) (or greater), the staff finds the proposed markups acceptable because they provide an exclusion region consistent with the referenced stability methodology. The staff is tracking the incorporation of the proposed markups as a confirmatory item. The staff notes that the stability methodology is still under review and is identified as Open Item 15.0.2-5.

The applicant used the stability methodology discussed in Section 15.0.2 of this SER, including use of the PIM thermal-hydraulic computer code to simulate the dynamics of the flow in the NPM coolant loop with attention to optimal resolution of its stability. The stability EM described 43

in topical report TR-0516-49417, Revision 0, Evaluation Methodology for Stability Analysis of the NuScale Power Module (ADAMS Accession No. ML16250A851), is currently under staff review and is identified as Open Item 15.0.2-5.

DCA Part 2, Tier 2, Section 15.9.2.1.3, discusses the input parameters and initial conditions for the limiting stability case, and DCA Part 2, Tier 2, Sections 15.9.3.1.3, 15.9.3.2.3, and 15.9.3.5.3, discuss the input parameters and initial conditions for the transient scenarios analyzed. The applicant stated that both BOC and EOC conditions were analyzed; however, BOC results are presented for the perturbed steady-state analyses, while EOC results are typically presented for the transient analyses in DCA Part 2, Tier 2, Section 15.9, since these results were more limiting. NuScale further stated that input and initial conditions are nominal input parameter values for three core power levels of 160 megawatts thermal (MWt)

(100-percent RTP), 32 MWt (20-percent RTP), and 1.6 MWt (1-percent RTP). In its response (ADAMS Accession No. ML28257A305) to RAI 9491, Question 15.09-2, which requested key parameters and initial conditions, their values, and biases, NuScale stated that biasing would not necessarily produce a limiting analysis. NuScale further stated in the response that sensitivity studies described in several other RAI responses indicate no significant change in results. The staff notes that the studies described in the other RAI responses generally examine the sensitivity of parameters for constitutive models internal to PIM, or discretization characteristics, but not the sensitivity of key initial input parameters provided in DCA Part 2, Tier 2, Section 15.9. The staff audited (ADAMS Accession No. ML18164A255) selected stability calculations and confirmed that the applicant applied reasonable values to some key parameters and conditions. The staff also reviewed the key conditions described in Sections 15.9.4.3.1 through 15.9.4.3.4 of this report and the allowable ranges for these parameters based on similar considerations for other events analyzed in DCA Part 2, Tier 2, Chapter 15. The staff finds the response to RAI 9491 acceptable based on the staffs evaluation of key conditions, which is discussed in the following subsections. In addition, the staffs audit confirmed the assertions in the RAI response.

Core Inlet and Core Average Temperature The core inlet and core average temperature can be affected by changes in secondary-side operation or other operational considerations such as SG tube fouling. The stability characteristics (and analysis results) are not sensitive to the primary-side temperature so long as the primary-side temperature is maintained within the exclusion region boundary of 2.8 degrees C (5 degrees F) subcooling. This is because of a cancellation of errors in the steady-state operation whereby a higher temperature in the core corresponds to higher temperature throughout the RCS, leading to essentially the same stability characteristics. In the transient depressurization analysis, the initial temperature has negligible effect on the analysis because the RPV is depressurized until the temperature reaches the MPS trip setpoint.

Therefore, the analysis does not need to consider variation in the RCS temperature in the same manner as other events in Chapter 15.

Pressurizer Pressure PZR pressure may vary by 35 psia. However, it is not necessary to consider such variation in the stability analysis. For decay ratio (DR) calculations, the PZR pressure (much like the RCS temperature) affects both the hot and cold legs equally and can therefore be expected to have 44

minimal effect on the stability characteristics of the power module. The initial pressure, much like RCS temperature, affects the subcooling margin. However, the depressurization event is analyzed in such a manner that the RPV is depressurized until the MPS trip occurs as the result of a loss of subcooling margin. Therefore, the initial subcooling margin does not affect the analysis.

Feedwater Temperature and Feedwater Flow The feedwater temperature and feedwater flow can affect the initial RCS temperature; therefore, the impact of these parameters on the steady-state DR is the same as for the RCS temperature.

During the transient analysis, the FWS parameters are not assumed to change, and thus the effect of these parameters on the transient analysis is the same as the impact given by the associated change in the RCS temperature. In other words, for the same reason that variations in RCS temperature are insignificant, the variations in feedwater temperature and flow are insignificant to the stability analysis.

Reactor Coolant System Flow and Reactor Power Level The RCS flow and reactor power level are interrelated. The uncertainty in RCS flow rate at a given power level is considered as part of the stability analysis methodology and factors into the DR acceptance criterion. Therefore, the impacts of the initial conditions here are related because a change in the power level causes a change in the core flow rate. To this end, the stability analysis considers a variation of power and flow conditions ranging from 1-percent to 100-percent power conditions. Since the reactor tends to become more stable at higher power levels, the low power level of 1 percent analyzed is sufficient to address any staff concerns regarding the range of initial power levels. The staff notes that performing the analysis down to the 1-percent power level is conservative because the stability analysis methodology only requires consideration of the DR for power levels where thermal limits may be challenged, which occurs for core powers in excess of 1 percent.

Additionally, the staff notes that reactor physics parameters are selected based on the stability EM, which is under staff review. This is identified as Open Item 15.0.2-5.

The staff reviewed the analyses presented in DCA Part 2, Tier 2, Section 15.9, to determine if they meet the DSRS acceptance criteria. The staff notes that the applicant performed stability analyses over a spectrum of events that include perturbation of steady-state and transient operations where the initiating events are variations of selected AOOs. The staff further notes that the applicant considers transient events from six AOO classification types and considers two other events: startup and cooldown.

Perturbed Steady-State Operation The staff reviewed NPM stability under conditions of steady-state operation in DCA Part 2, Tier 2, Section 15.9.2. The applicant considered a variety of power levels to demonstrate that the DR remains below the acceptance criterion (0.8) for all conditions. The staff notes that the most limiting case the applicant analyzed is for low power (1 percent RTP) where the DR is 0.74. The results of the calculations show that for steady-state operation conditions, the NPM is stable. The staff notes that the stability evaluation methodology is still under review and is identified as Open Item 15.0.2-5.

45

Increase in Heat Removal by the Secondary System The staff reviewed NPM stability AOOs that increase heat removal by the secondary system in DCA Part 2, Tier 2, Section 15.9.3.1. The applicant analyzed an increase in feedwater flow that results in an increase in heat removal and that would likely result in an automatic trip of the reactor. The staff agrees that the analysis is conservative since it ignores (does not simulate) the trip to bound less severe feedwater flow increase events. The staff confirms the applicant determined the limiting conditions with respect to this class of AOOs for stability analysis. The staff notes that a feedwater flow increase yielding a power increase sufficient to produce a reactor trip bounds less severe flow increases that would not necessarily result in a reactor trip.

The applicant performed calculations at rated power initial conditions and at 20 percent of rated power (32 MWt), which show that the reactor remains stable. The staff notes that the stability evaluation methodology is still under review and is identified as Open Item 15.0.2-5.

Decrease in Heat Removal by the Secondary System The staff reviewed NPM stability AOOs that decrease heat removal by the secondary system in DCA Part 2, Tier 2, Section 15.9.3.2. For stability analysis, conditions that produce the largest reduction in secondary side heat removal are not limiting because they would likely lead to a prompt, automatic reactor trip due to an increase in PZR pressure. The most adverse event from a stability perspective would be an AOO that maximizes the potential for the riser to void while avoiding the high PZR pressure trip.

To establish a conservative, bounding analysis method, TR-0516-49417 assumes a 50-percent feedwater flow reduction. This reduction is large enough to cause a reactor trip due to high PZR pressure, which is not credited in the TR-0516-49417 analysis. Therefore, TR-0516-49417 defined a methodology that conservatively bounds feedwater flow reduction transients and demonstrates that GDC 12 is met.

However, the analysis in DCA Part 2, Tier 2, Section 15.9.3.2, departs from the methodology in TR-0516-49417 since the feedwater flow is reduced by only 10 percent in the DCA compared to the 50-percent reduction prescribed by TR-0516-49417. According to the applicants analyses, the 10-percent feedwater flow reduction will not actuate a high PZR pressure trip but will eventually actuate a high hot-leg temperature trip, which protects subcooling margin. Since the 10-percent feedwater flow reduction is less severe and progresses differently than the feedwater flow reduction event described in TR-0516-49417, it was not clear to the staff that the 10-percent feedwater flow reduction bounds similar events that do not have a high PZR pressure trip in their progression. DCA Part 2, Tier 2, Section 15.2.7, describes a 1.7-percent feedwater flow reduction event that progresses similarly to the 10-percent feedwater flow reduction event in DCA Part 2, Tier 2, Section 15.9.3.2. The 1.7-percent feedwater flow reduction event eventually initiates a high hot leg temperature trip 1,439 seconds into the event.

This is more than 10 times the period of the reactor. However, the rate of decrease in subcooling margin is also much slower than the more severe 50-percent feedwater flow reduction event analyzed in TR-0516-49417 such that riser voiding is mitigated. Consequently, the staff finds that the DCA Part 2, Tier 2, Section 15.2.7, analysis is sufficient to confirm that the long-term stability solution meets the requirement of GDC 12.

The applicants analyses for feedwater flow reduction (i.e., (1) the 1.7-percent reduction presented in DCA Part 2, Tier 2, Section 15.2.7; (2) the 10-percent reduction presented in DCA Part 2, Tier 2, Section 15.9.3.2; and (3) the 50-percent reduction presented in TR-0516-49417, 46

Sections 8.2.2 and 9.1) demonstrate that the RCS heats up and that a reactor trip protecting the riser subcooling margin is eventually initiated. Based on these analyses, the staff finds that this event progression is generally applicable and occurs regardless of the magnitude of the feedwater flow reduction. The staff also finds that the long-term stability solution is effective in preventing the reactor from reaching an unstable condition by initiating a reactor trip before such an instability would occur.

The analysis presented in DCA Part 2, Tier 2, Section 15.9.3.2, is a departure from, and non-conservative with respect to, the stability analysis methodology presented in TR-0516-49417.

Therefore, the staff finds that DCA Part 2, Tier 2, Section 15.9.3.2, safety conclusions shall not be construed as approval of the departure or as tacit acceptance of a change in the methodology. Nevertheless, for the reasons indicated above, the staff notes that the long-term stability solution is effective in preventing instability during AOOs that cause a decrease in secondary side heat removal. The staff notes that the stability evaluation methodology is still under review and is identified as Open Item 15.0.2-5.

Decrease in Reactor Coolant System Flow Rate The staff reviewed NPM stability AOOs that decrease RCS flow rate in DCA Part 2, Tier 2, Section 15.9.3.3. The applicant stated that it does not consider a decrease in the RCS flow rate a credible event for stability analysis. However, the staff notes that during a postulated AOO, it is easy to conceive of a sequence involving inadvertent operation of components related to the CVCS that could lead to reduced or increased primary system flow (such as CVCS pump overspeed or pump trip). The staff notes that since the CVCS is essentially external to the primary flow circuit, such AOOs could impact the RCS without other effects. The staff disagrees with the applicants assertion that a CVCS malfunction leading to a reduction in RCS flow rate is not a credible event. However, the staff finds it a credible but nonlimiting event and agrees with the applicant that this class of events is bounded by events resulting in a decrease in secondary-side heat removal. Therefore, a separate analysis is not required for this class of events.

Increase in Reactor Coolant Inventory The staff reviewed NPM stability AOOs that increase reactor coolant inventory in DCA Part 2, Tier 2, Section 15.9.3.4. In Section 15.9.3.4, the applicant states that the subcooling margin in the riser increases with increasing RCS pressure. However, a decrease and subsequent loss in riser subcooling margin, could result in unstable behavior. Therefore, the applicant dispositions pressurization events as unimportant to stability analysis, since these events would increase the subcooling margin. The staff finds that the applicants disposition acceptable as events that increase the RCS inventory and simultaneously increase pressure do not result in unstable RCS behavior because the subcooling margin in the riser increases with increasing pressure.

Reactivity and Power Distribution Anomalies The staff reviewed NPM stability AOOs with respect to reactivity and power distribution anomalies in DCA Part 2, Tier 2, Section 15.9.3.5. The staff notes that DCA Part 2, Tier 2, Section 15.9.3.5, states that boron concentration changes via the CVCS are slow and that these events would likely be bounded by other analyses. The staff agrees that a CVCS malfunction resulting in boration or dilution would likely be a slowly evolving transient and would be bounded, or at least similar to, the events that increase or decrease heat removal from the 47

primary system. In terms of control rod withdrawal, the staff agrees that protective trips are designed to protect thermal margins for control rod withdrawal events. The staff notes that the applicant analyzed a hypothetical reactivity increase of 65 cents starting from low power (20 percent of rated). The staff finds this approach to be reasonable given these considerations. BOC and EOC conditions were considered, with the EOC case being the more limiting event. The applicants results indicate substantial stability margin. The staff notes that the stability evaluation methodology is still under review and is identified as Open Item 15.0.2-5.

Decrease in Reactor Coolant Inventory The staff reviewed NPM stability AOOs that decrease reactor coolant inventory in DCA Part 2, Tier 2, Section 15.9.3.6. The staff notes that a decrease in inventory without a commensurate decrease in pressure would result simply in a reactor trip based on low PZR level, and therefore, those types of events need not be considered. The applicant discussed events that result in reduced pressure and concluded that events that do not reduce pressure sufficiently to result in riser flashing will not result in instability. The staff agrees that a low PZR pressure trip would occur before loss of subcooling margin, protecting the NPM against instabilities.

Additionally, the staff reviewed AOOs that could result in riser flashing. In the DCA markups included in February 28, 2019, supplemental response (ADAMS Accession No. ML19059A478) to RAI 9491, Question 15.09-2, the applicant simulated a depressurization event that decreases the reactor pressure to 1,378 psia (which corresponds to saturated conditions in the riser). The applicant indicated that the low-low PZR pressure trip at 1,600 psi is ignored. The staff notes that neglecting this trip is a conservative assumption for this stability event. The staff further notes that the purpose of the analysis is to demonstrate that the MPS protective trip on low riser subcooling margin is sufficient to trip the reactor before the reactor develops large amplitude flow oscillations. The staff notes that the included DCA markup for Figure 15.9-15 shows the results of the primary-side flow calculation, which indicates that the MPS trip occurs well before the onset of flow instability. This is a confirmatory item. The staff notes that the stability evaluation methodology is still under review and is identified as Open Item 15.0.2-5.

Demonstration of Module Protection Systems to Preclude Instability The staff reviewed the capability of the MPS to preclude instability in DCA Part 2, Tier 2, Section 15.9.4. In its September 14, 2018, and February 28, 2019, responses (ADAMS Accession Nos. ML18257A305 and ML19059A478) to RAI 9491, Question 15.09-2, the applicant assessed the exclusion protection provided by the MPS. The applicant stated that the NPM minimum loop transit time is greater than 60 seconds at rated power, while the time to scram is less than 11 seconds. The applicant concluded, and the staff agrees, that the MPS will enforce the exclusion region and shut down the reactor before violating thermal limits because the scram time is significantly less than the loop transit time. This is a confirmatory item.

The applicant concluded, and the staff agrees, that the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event, and the minimum DNBR remains above the 95/95 limit. Based on these conclusions, the staff finds that there is no challenge to any of the fission product barriers for this AOO.

48

Based on the results of the analysis and barrier performance, the applicant concluded, and the staff agrees, that there are no radiological consequences associated with events that could result in thermal-hydraulic instability.

15.9.5 Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.9.

15.9.6 Conclusion The staff reviewed the thermal-hydraulic stability analysis. Based on the open items documented above, no conclusions can be reached regarding DCA Part 2, Tier 2, Section 15.9.

49