ML19352E778

SER NuScale TR_0516_49417 Stability_Public_Encl 1

ML19352E778
Person / Time
Site:	NuScale
Issue date:	01/21/2020
From:	Anna Bradford NRC/NRR/DNRL
To:	Rad Z NuScale
Bavol B / 415-6715
Shared Package
ML19352E752	List: ML19352E775 ML19352E778
References
CAC 471, TR-0516-49417P, Rev. 1
Download: ML19352E778 (101)

Text

U.S. NUCLEAR REGULATORY COMMISSION NUSCALE POWER, LLC SAFETY EVALUATION FOR TOPICAL REPORT TR-0516-49417-P, REVISION 1, EVALUATION METHODOLOGY FOR STABILITY ANALYSIS OF THE NUSCALE POWER MODULE (CAC NO. 471)

1. Introduction and Background This safety evaluation report documents the U.S. Nuclear Regulatory Commission (NRC) staffs (hereafter referred to as the staff) safety evaluation of the NuScale Power, LLC (hereafter referred to as the applicant), topical report TR-0516-49417-P, Evaluation Methodology for Stability Analysis of the NuScale Power Module, issued July 2016 (hereafter referred to as the Stability TR) (Agencywide Documents Access and Management System (ADAMS) Accession No. ML16250A851).

The applicant submitted the Stability TR by letter dated July 31, 2016 (ADAMS Accession No. ML16250A851). The staff performed an acceptance review of the Stability TR and determined that the report did not contain sufficient information for the staff to begin technical review. By letter dated October 19, 2016, the NRC gave the applicant an opportunity to supplement the report with additional information (ADAMS Accession No. ML16271A307). The applicant provided the supplemental information by letter dated December 3, 2016 (ADAMS Accession No. ML16340A756). The TR Supplement provided under that letter (ADAMS Accession No. ML16340A756) provided the requested information and allowed the staff to proceed with detailed technical review of the Stability TR.

By letter dated September 17, 2019, NuScale submitted Revision 1, TR-0516-49417, Evaluation Methodology for Stability Analysis of the NuScale Power Module, (ADAMS Accession No. ML19262J750) which incorporate changes from request for additional information (RAI) responses. By letter dated November 22, 2019, the applicant submitted an errata to Revision 1 of the Stability TR correcting a minor error (ADAMS Accession No. ML19325D018).

2. Regulatory Evaluation and Review Conduct The staff conducted its review in accordance with the applicable standard review plan (SRP) guidance contained in Design-Specific Review Standard 15.9.A, Thermal-Hydraulic Stability Review Responsibilities (ADAMS Accession No. ML15355A311), and NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition, Section 15.0.2, Review of Transient and Accident Analysis Methods (ADAMS Accession No. ML070820123).

2.1 Regulatory Evaluation Title 10 of the Code of Federal Regulations (10 CFR) 52.47, Contents of Applications; Technical Information, and 10 CFR 52.79, Contents of Applications; Technical Information in

2 Final Safety Analysis Report, require a final safety analysis report (FSAR) to analyze the design and performance of the plants structures, systems, and components. Safety evaluations, performed to support the FSAR, require analysis of reactor stability to establish a partial basis for demonstrating compliance with certain general design criteria (GDC) in 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities, Appendix A, General Design Criteria for Nuclear Power Plants. In particular, Design-Specific Review Standard 15.9.A spells out the associated acceptance criteria in terms of the following GDC:

GDC 10, Reactor Design, requires that specified acceptable fuel design limits (SAFDLs) not be exceeded during any condition of normal operation, including conditions that result in unstable power oscillations with the reactor trip system available and other effects of anticipated operation occurrences.

GDC 12, Suppression of Reactor Power Oscillations, requires that power oscillations, which can result in conditions exceeding SAFDLs, be either impossible or reliably and readily detected and suppressed.

GDC 13, Instrumentation and Control, requires instrumentation provided to monitor variables and systems over their anticipated ranges for normal operation, for AOOs, and for accident conditions, and to maintain these variables and systems within prescribed operating ranges as may be required by a long-term stability (LTS) solution.

GDC 20, Protection System Functions, requires the reactor protection system to initiate automatic action to assure SAFDLs are not exceeded as a result of AOOs, such as for conditions that result in unstable power oscillations.

GDC 29, Protection against Anticipated Operational Occurrences, requires LTS solution design to assure an extremely high probability of accomplishing safety functions in the event of AOOs.

The scope of the Stability TR must address how the LTS solution meets the above GDC.

According to the Stability TR, the LTS solution involves an exclusion region where the unstable region is protected by a module protection system (MPS) trip based on indicated subcooling margin in the riser section. The solution relies on the supporting analysis method (the applicant refers to the code used to execute the stability analysis method as PIM) to demonstrate that the reactor remains stable under all postulated conditions (including the effects of anticipated operational occurrences (AOOs)) outside of the exclusion region.

PIM, the supporting analytical transient method, must be acceptable to perform the associated analyses. Therefore, the Stability TR must also address the criteria of SRP Section 15.0.2 pertaining to analysis methods. The associated review criteria from SRP Section 15.0.2 include the following:

Evaluation Model. Models must be present for all phenomena and components that have been determined to be important or necessary to simulate the accident under consideration. The chosen mathematical models and the numerical solution of those models must be able to predict the important physical phenomena reasonably well from both qualitative and quantitative points of view. The degree of imprecision allowed in the models will ultimately be determined by the amount of uncertainty that can be tolerated in the calculation. To the extent that the calculated results or trends in the results may be misinterpreted, models that caused nonphysical predictions are not acceptable.

3 Accident Scenario Identification Process. The purpose of the accident scenario identification process is to identify and rank the reactor component and physical phenomena modeling requirements based on (1) their importance to the modeling of the scenario and (2) their impact on the figures of merit for the calculation. The accident scenario identification process must be structured. It must include evaluation of physical phenomena to identify those that are important in determining the figure of merit for the scenario. The models that are present in the code and their degree of fidelity in predicting physical phenomena must be consistent with the results of this process. For example, if the accident scenario identification process determines that a certain physical phenomenon is important to the scenario under consideration, the code must have a relatively accurate model for that phenomenon, and a detailed assessment of that model must be provided. Phenomena that have lower ranking may be represented by models with larger inherent uncertainty. The formality and complexity of this process should be commensurate with the complexity and importance of the event under consideration.

Code Assessment. Assessments of all code models to be used in the evaluation model must be provided. All assessments must be performed with the frozen version of the evaluation model that has been submitted for review. Assessments performed with other versions of the evaluation model should be justified on a case-by-case basis because even small changes to the evaluation model can have unintended consequences on calculation results that were thought to be unaffected by the changes.

Separate effects testing must be performed to demonstrate the adequacy of the physical models to predict physical phenomena that were determined to be important by the accident scenario identification process. Separate effects testing must also be used to determine the uncertainty bounds of individual physical models.

Integral effects testing must be performed to demonstrate that the interactions between different physical phenomena and reactor coolant system (RCS) components and subsystems are identified and predicted correctly.

Assessments against both separate effects tests (SETs) and integral effects tests (IETs) must be performed with the code. All models need to be assessed over the entire range of conditions encountered in the transient or accident scenario. Assessments must also compare code predictions to analytical solutions, where possible, to show the accuracy of the numerical methods used to solve the mathematical models. Code options used in the assessment calculations must be the same as those used in plant accident calculations.

A scaling analysis must be performed to identify important non-dimensional parameters related to geometry and key phenomena. The assessment must identify and evaluate scaling distortions and their impact on the code assessment. Calculations of actual plant transients or accidents can be considered, but only as confirmatory supporting assessments for the evaluation model. This is because the data available from plant instrumentation are usually not detailed enough to support code assessment of specific models. Plant data can be used for code assessment if it can be demonstrated that the available instrumentation provides measurements of adequate resolution to assess the code. The assessment cases must compare code predictions to all important measured variables to show that good predictions of one test variable do not result from compensating errors. Assessments must include a description of all assessment cases,

4 specific models that are being assessed in each case, and acceptance criteria used.

Acceptance criteria must be supported by quantitative analysis whenever possible. Staff review of the specific acceptance criteria and the associated quantitative analysis for the subject review matter is described in Sections 3.2, 3.3 and 3.4 of this SER.

Uncertainty Analysis. The uncertainty analysis must address all important sources of code uncertainty, including the mathematical models in the code and user modeling such as nodalization. The major sources of uncertainty must be addressed consistent with the results of the accident sequence identification process. When the code is used in a licensing calculation, the combined code and application uncertainty must be less than the design margin for the safety parameter of interest. The analysis must include a sample uncertainty evaluation for a typical plant application.

Quality Assurance Plan. To meet the requirements of Appendix B to CFR Part 50, the quality assurance (QA) plan covers the procedures for design control, document control, software configuration control and testing, and error identification and corrective actions used in the development and maintenance of the evaluation model. The program also ensures adequate training of personnel involved with code development and maintenance, as well ensures adequate training for those who perform the analyses.

The Stability TR provides a phenomenon identification and ranking table (PIRT) that identifies and ranks phenomena associated with the scenarios of interest (stability during normal operating conditions and AOOs). The PIRT informs the development of the analysis code, PIM, which is also described by the Stability TR. The associated figure of merit in these analyses is the decay ratio (DR). The Stability TR includes assessment of PIM against experimental data collected in scaled, integral tests performed at the NuScale Integral Systems Test-1 (NIST-1) facility. Finally, the Stability TR provides an acceptance criterion of [ ] for the DR. The staff audited the applicants implementation of the QA plan for PIM, as described in the audit plan dated June 7, 2017 (ADAMS Accession No. ML17151B024).

The Stability TR covers four major topics related to the NRCs acceptance criteria:

(1)

Phenomena Identification and Ranking (Stability TR Section 4, Appendix A, and the TR Supplement)

(2)

Description and Validation of PIM (Stability TR Sections 5, 6, and 7)

(3)

Analysis Results and Stability Demonstration (Stability TR Sections 8 and 9)

(4)

Stability Protection Solution and Methodology (Stability TR Section 10) 2.2 Summary of Application 2.2.1 Phenomena Identification and Ranking The Stability TR attempts to identify all possible instability modes for the NuScale power module. In a broad sense, the possible mechanisms can be divided into static or dynamic instabilities. Static refers to cases where the effects of inertia are not important and reflect instability modes that involve the systems transition between viable steady-state conditions.

The static modes include the following:

flow excursion (Ledinegg)

5 boiling crisis flow pattern transition (relaxation) instability flashing instability geysering The dynamic modes include the following:

pressure drop oscillations acoustic oscillations density waves xenon oscillations natural circulation instability thermal stratification oscillations coupled (compound) instability modes:

o parallel channel instability o

primary circuit flow coupling to secondary-side steam generator (SG) o neutronic coupling to natural circulation instability o

NuScale natural circulation instability The Stability TR evaluates these modes of instability and concludes that the main instability mode relevant to the NuScale power module is the final compound mode, NuScale natural circulation instability. Throughout the Stability TR, this mode is also referred to as the riser instability mode.

Appendix A and the TR Supplement address the issue of secondary-side instability modes.

Based on the identified instability modes and the determination of the main instability mode, the applicant developed a PIRT and summarized the results in Table 4-1 of the Stability TR. The PIRT ranks phenomena by their importance in evaluating system response in terms of riser instability for the NuScale power module. The PIRT forms the basis for subsequent portions of the Stability TR, namely the development of the PIM code and validation of PIM against applicable experimental data to ensure that PIM adequately captures the important phenomena.

2.2.2 Description and Validation of PIM PIM is a thermal-hydraulics code that solves the nonhomogeneous, nonequilibrium, time-dependent mass, momentum, and energy conservation equations for two-phase flow in one dimension. PIM determines the two-phase flow void fraction according to a drift-flux formulation. PIM solves the momentum equation on the basis of conservation of momentum of the two-phase mixture. The thermal-hydraulic model includes closure relationships for pressure drop, form losses, drift-flux parameters, evaporation and condensation rates, and heat transfer coefficients. PIM does not model the dynamic response of the pressurizer; rather, the user supplies the pressure boundary conditions.

To complete the necessary modeling for the NuScale power module, PIM also includes (1) a point-kinetics neutronics model to simulate reactivity feedback, (2) a cylindrical fuel rod conduction model, and (3) a simplified heat transfer model to represent the heat removal by the secondary side of the helical coil SG.

6 The point-kinetics model accounts for moderator temperature and fuel temperature feedback mechanisms. The transient power calculation, however, does not vary the decay heatthe decay heat is specified as a constant thermal power that is maintained during the transient calculation. Nor does the model consider the reactivity effect of a reactor trip. In subsequent demonstration analyses, the timing of the MPS trip can be inferred from the system response; however, PIM does not explicitly evaluate the effect of the trip.

The fuel rod conduction model is relatively simple in that the entire core is modeled by a single average fuel segment representing the average fuel rod and pellet. The applicant uses the calculations to infer the average heat transfer from the fuel to the coolant and to compute the average change in fuel centerline and surface temperature.

The model also includes simplified heat removal to the secondary side. The SG model considers the modeling of the secondary-side fluid conditions, conduction through the SG tubes, and heat transfer on both sides of the tubes. The code solves the energy and mass conservation equations (the code does not include a momentum equation), based on specified user boundary conditions, to infer secondary-side fluid conditions. Primary-side heat transfer is modeled consistent with the formulation in the version of RELAP5 modified by the applicant for NuScale (NRELAP5). User input effectively determines the secondary-side heat transfer.

The applicant validated PIM through comparison of calculated DR results to measurements performed at the NIST-1 integral test facility. The applicant performed two types of stability measurements at NIST-1. In Type I tests, the applicant applied either a power or feedwater flow perturbation over a short duration, restored the initial condition, and then observed the transient response of the primary-side flow rate. The applicant then used successive peaks in the primary-side flow response to compute the DR. In Type II testing, the applicant operated the loop for a long duration (about 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />) in a steady-state condition and inferred the DR using noise analysis.

The applicant performed a total of 19 tests over various power levels ranging from 61 kilowatts (kW) to 319 kW. In general, PIM predicts a DR that is roughly 0.05 higher than the tests and predicts an oscillation frequency that is in generally good agreement with the tests.

2.2.3 Analysis Results and Stability Demonstration Section 8.1 of the Stability TR provides analyses to demonstrate NuScale stability under conditions of steady-state operation. The applicant considered a variety of power levels to demonstrate that the DR remains below the acceptance criterion ([ ]) for all conditions. The most limiting case the applicant analyzed was for low power (1 percent of rated thermal power) for which the DR is 0.74.

Section 8.2 of the Stability TR addresses stability during AOOs. The applicant considered a variety of AOOs, consistent with the classification of these events in Chapter 15, Transient and Accident Analysis, of the SRP. The categories of AOOs considered in the Stability TR are those that result in the following:

increase in heat removal by the secondary system decrease in heat removal by the secondary system decrease in RCS flow rate increase in reactor coolant inventory reactivity and power distribution anomalies

7 decrease in reactor coolant inventory The applicant analyzed these events in PIM by adjusting time-dependent boundary conditions (e.g., secondary-side flow rate) to simulate an operational transient falling into one of the above categories. In each case, the applicant performed the calculations to demonstrate either that (1) the reactor evolves to a new stable, steady-state condition or (2) the MPS would initiate a protective reactor trip based on the core exit thermocouple readings (which indicate low subcooling margin) before the onset of instability.

2.2.4 Stability Protection Solution and Methodology The LTS solution proposed in the Stability TR is based on an exclusion region. The exclusion region is defined by maintaining subcooling margin in the riser section of the power module. An MPS trip that will trip the reactor under a condition where the subcooling margin reaches a limit specified by the technical specifications (TS) enforces the exclusion region. The instrumentation determines subcooling margin by comparing core exit thermocouple temperature readings to saturation temperature based on pressurizer pressure.

On a cycle-specific basis, any licensee referencing the Stability TR must confirm that the maximum (positive) moderator temperature coefficient (MTC) assumed in the generic analysis bounds the cycle-specific value and that the riser subcooling margin remains within the TS value.

3. Technical Evaluation The staff reviewed the Stability TR for two applications: (1) the use of the PIM evaluation model to perform stability safety analyses and (2) the applicability of the LTS solution based on an exclusion region. The staff technical evaluation includes five major areas.

The first area is the staff evaluation of the instability modes and phenomena identification and ranking. The staff evaluated the content of the Stability TR, TR Supplement, and responses to requests for additional information (RAIs) to establish that the applicant had identified all the relevant instability modes for the NuScale power module and adequately ranked the important phenomena affecting the stability performance of the power module. The staff compared the PIRT documented in the Stability TR to a PIRT independently developed by the staff (ADAMS Accession No. ML17033A144). Since the applicant performed analyses to demonstrate compliance with GDC 12, this portion of the review determines whether the applicant has adequately considered all the phenomena that can meaningfully contribute to such analyses.

The second area is the staff review of the PIM code. The staff reviewed the description of the PIM models against the applicable criteria given in SRP Section 15.0.2. The staff reviewed the PIM code to determine that it includes models for all phenomena and components that have been determined to be important or necessary to simulate the transient under consideration and that the mathematical models are able to predict the important physical phenomena reasonably well from both a qualitative and quantitative standpoint. The staff reviewed the assessment of PIM against relevant separate effects and integral effects test (SET/IET) data, including consideration of the scaling of the experimental data to determine the adequacy of PIM to analyze NuScale power module stability.

The third area is the staff evaluation of the analysis methodology and acceptance criteria. The overall analysis method includes the code and evaluation model, but it also includes the way any particular code is exercised to generate relevant results. In turn, the results must be used

8 to generate figures of merit to be compared to acceptance criteria. In the Stability TR, the applicant seeks approval to use PIM in a manner consistent with the described inputs to generate DR results for comparison to a DR acceptance criterion and to predict the power module transient response to AOOs that could lead to instability. The staff review in this area considered the methods by which the code is exercised, code outputs processed into the figure of merit, and how uncertainty in the analysis is treated to ensure that adequate margin to the analysis acceptance criterion is included. The staff reviewed the methodology as it relates to demonstrating compliance with GDC 12.

The fourth area of the staff review is directed at the efficacy of the LTS solution as it relates to GDC 10, 12, 13, 20, and 29. The Stability TR describes an LTS solution based on an exclusion region whereby the LTS prevents the reactor from becoming unstable under normal operating conditions (including the effects of AOOs), thus ensuring compliance with GDC 10 and 12. The safety-related MPS and associated instrumentation provide a protective trip that prevents the reactor from reaching unstable conditions, ensuring that GDC 13, 20, and 29 are met.

Lastly, the fifth area of the staff review compares analyses performed by the applicant to confirmatory analyses performed by the staff. The purpose of the staffs independent calculations was to confirm the results provided by the applicant and the statements made in the Stability TR.

3.1 Instability Modes and Phenomena Identification and Ranking 3.1.1 Identification of Instability Modes In Section 4.3 of the Stability TR, the applicant identified the potential modes of instability of the NuScale power module. For most identified modes, the applicant provided a disposition of the mode. In many cases, the modes do not apply to the power module or are addressed elsewhere in the safety analysis. Broadly, the instability modes are divided into static and dynamic instabilities. The applicants identification of the modes informs the development of the PIRT, which further guides evaluation model development. The staff reviewed the descriptions of the modes and dispositions.

3.1.1.1 Static Instabilities The applicant described the static instability modes and associated dispositions in Section 4.3.1 of the Stability TR. The staff reviewed this information and generally agrees with the applicants conclusions, as explained below.

Section 4.3.1.5 of the Stability TR addresses geysering, and the staff agrees that this mode does not apply to the NuScale power module because the high pressure suppresses void formation. However, it is not clear if the Stability TR fully considers the implications of subcooled boiling. The disposition refers to the treatment of metastable liquid states being addressed by the analysis method because of the impact that this can have on the primary instability mechanism. In RAI 8946, the staff requested additional information about subcooled boiling. In its September 27, 2017, response to RAI 8946, the applicant stated that PIM calculations explicitly account for the energy carried by subcooled voids from the core into the riser section and that the calculation of condensation results in heat deposition in the riser fluid from these voids (ADAMS Accession No. ML17270A280). Therefore, the staff finds that the PIM calculations account for the heat transfer mechanism.

9 A limitation of the PIM methodology is the one-dimensional nature of the calculation. While the response to RAI 8946 correctly states that the planar average void fraction is the important parameter affecting the natural circulation flow rate, the planar averaging inherent in the PIM calculations can result in overestimation of void condensation close to the reactor core. As an example, in a code like TRAC-RELAP Advanced Computational Engine (TRACE), which uses three-dimensional modeling of the vessel, the fluid exiting the region of the core around the hot assembly will have slightly higher void fraction and slightly hotter liquid temperature. The rate of void condensation will be locally lower in this region in the TRACE calculation compared to the rate of condensation predicted in PIM for the same axial elevation because PIM essentially averages the liquid temperature across the plane. In a more detailed representation, and indeed, in the hypothetical reactor, hot streaking may occur, which allows subcooled voids to propagate upward through locally warmer regions of the riser transition region above the core.

However, the applicant also dispositioned the importance of this phenomenon in the RAI 8946 response by relating the magnitude of this effect to the dominant processes affecting stability and characterizing this subcooled boiling heat deposition effect as of low importance. In the September 28, 2017, response to RAI 9019, the applicant calculated the heat deposition in the riser from void collapse to contribute about 0.14 Kelvin (K)/% temperature increase in the riser per percent of planar average subcooled void (ADAMS Accession No. ML17271A332). The staff finds that this temperature contribution for modest void fractions remains small compared to the core temperature rise of 67 degrees Fahrenheit (F) (37 K). The staff also finds that PIM is able to capture the effect of subcooled boiling and the subsequent effect of heat transfer from the condensation of those voids. The staff notes that the PIM model is approximate and, because it lacks detailed three-dimensional modeling capability, would not be able to capture the effect of hot streaking on void axial propagation in the riser transition zone with high accuracy. However, the staff agrees with the applicant that this effect is not important to the overall stability analysis. Therefore, the staff finds that the applicant appropriately considered the phenomenon in its modeling.

The staff developed an independent PIRT for NuScale stability (ADAMS Accession No. ML17033A144) and did not identify any static instability modes outside of those identified by the applicant in Section 4.3.1 of the Stability TR. Therefore, the staff finds that the applicants identification is thorough and therefore acceptable.

On the basis of the dispositions in Section 4.3.1 of the Stability TR for: flow excursion (Ledinegg), boiling crisis, flow pattern transition (relaxation) instability, flashing instability, and geysering and the clarifications in the responses to RAIs, the staff agrees with the applicant that the identified static instability modes are either not possible, or are separately addressed by other safety analyses, or do not apply to the NuScale power module.

3.1.1.2 Dynamic Instability Modes The applicant identified other dynamic instability modes and provides dispositions for these modes in Section 4.3.2 of the Stability TR. The staff reviewed these other modes and compared the identified modes with those phenomena identified by the staff during the development of the staffs independent NuScale stability PIRT. For completeness, this safety evaluation report discusses each of these other modes:

pressure drop oscillationsThis mode is addressed by the Ledinegg instability mode (See Section 4.3.1.1 of the Stability TR, Sections 3.1.1.1 and 3.1.3 of this report). The staff agrees with the disposition because pressure drop oscillations form the underlying principle behind Ledinegg instability.

10 acoustic oscillationsThis mode is relevant for boiling-water reactor (BWR) steamlines but does not apply to NuScale because of the absence of long pipes with high velocity where resonance can occur in the NuScale power module. The staff agrees with the disposition.

density wavesThe staff evaluated this mode and considered it to be important for the secondary side. Section 3.1.1.4 of this report discusses the density-wave mode in more detail. The staff agrees with the disposition insofar as density waves on the primary side are part of the primary identified instability mode (the riser mode; see Section 3.1.1.5 of this report for further discussion of the staff review).

xenon oscillationsThis mode is not likely to become unstable for the NuScale power module because of the small size of the reactor core; however, the staff requested additional clarification of this topic. Section 3.1.1.3 of this report documents that this is outside the scope of the current Stability TR review.

natural circulation instabilityThis is the primary mode of instability. Section 3.1.1.5 of this report documents the staff review.

thermal stratification oscillationsThis mode is not possible because of the NuScale geometry. The staff agrees with the disposition.

compound modes: parallel channel instability and primary circuit flow coupling to secondary-side SGThese modes are related to the secondary side. The staff addresses them in Section 3.1.1.4 of this report.

compound modes: neutronic coupling to natural circulation instability and NuScale natural circulation instabilityThis mode is related to the riser instability mode except the description in the Stability TR accounts for neutronic feedback and to a certain extent feedback related to the secondary system. The staff agrees that this coupling is important, and that the natural circulation/riser instability mode is the primary instability mode for the NuScale power module. Section 3.1.1.5 of this report discusses this mode in greater detail.

3.1.1.3 Xenon Oscillations Xenon instability is outside the scope of the current Stability TR review. The review of Section 4.3 of the NuScale design certification application will address this topic.

3.1.1.4 Secondary-Side Instability and Interactions Section 4.3.3.2 of the Stability TR and Appendix A to the Stability TR discuss the disposition of secondary-side instability effects on the primary side. Further, bullet 4 of Section 5.2 and Section 5.5.3 of the Stability TR describe the modeling approach for the secondary side.

The staff considered the importance of the secondary side in an independent PIRT for NuScale stability and reached different conclusions than the applicant (ADAMS Accession No. ML17033A144). The staff identified several phenomena as having high importance (e.g., Ledinegg instability) and other phenomena as having medium importance based on the expected design of the system (e.g., density-wave oscillation and superheat control). Briefly summarized, the staffs rationale is that the primary side is expected to respond to any oscillations in the secondary side, which result in changes to the total heat removal from the

11 primary side. The applicant analyzed this response in Section 8.2.7 of the Stability TR; the results indicate that a sinusoidal oscillation in the secondary system creates an oscillation in the primary system. From this, the staff concluded that instability on the secondary side (affecting total heat transfer) would result in instability on the primary side. That is, if the primary side oscillates in response to secondary-side oscillations, the staff expects that growing secondary-side oscillations would result in growing primary-side oscillations (regardless of resonant interaction).

The staff considered the potential for different instability modes in the secondary system. One obvious mechanism is density-wave instability. The secondary side of the SGs represents a system analogous to a vertical boiling channel and therefore can be expected to have similar susceptibilities to instability driven by density waves. Appendix A to the Stability TR attempts to disposition this issue, but the rationale is incomplete.

The Stability TR appears to correctly identify an issue that the staff also identified. That is, even at the same tube pressure drop, density-wave oscillations or flow regime transitions within a tube can result in significant changes in heat transfer coefficient without producing similar changes in the pressure drop. Therefore, the staff agrees that significant heat transfer oscillations may take place even with a constant feedwater flow rate. However, imagining the heat transfer on the secondary side during a density-wave oscillation, the flow in the tube will likely oscillate in such a manner that, at low flow, a larger portion of the heat transfer is in single-phase vapor convection and, at high flow, a larger portion of the heat transfer is in single-phase liquid convection. The staff expects either of these cases to produce poorer heat transfer compared to heat transfer occurring in the nucleate boiling regime. A flow oscillation that leads to an oscillation in the heat transfer within minima at both the high-and low-flow conditions is conceivable. This tendency could result in an in-phase reduction in heat transfer occurring in two tubes with flow oscillations that are out of phase. Therefore, the argument that out-of-phase oscillations will tend to be self-cancelling, as described in Appendix A to the Stability TR, is not compelling without more detailed analysis. If heat transfer oscillations remain in phase even with flow being out of phase, then total heat transfer oscillations remain possible.

Further, while the staff agrees that control systems will attempt to maintain total feedwater flow rate, this is not the only boundary condition affected by the secondary-side controllers. Other boundary conditions will be controlled in tandem with the intention of achieving the desired flow rate and superheat. While the Stability TR does not provide details, the staff expects that the secondary side of the NuScale reactor module may be operated in a manner similar to that of the Babcock & Wilcox plants with once-through SGs. These plants rely on a complex control system that adjusts pressure, feed flow, and feed temperature simultaneously to achieve the desired degree of outlet steam superheat. If heat transfer oscillations are possible when out-of-phase flow oscillations occur, then instability driven by density waves on the secondary side can result in an oscillation in the SG outlet superheat. Once this is possible, the control system feedback can result in a reduction of stability margin for the in-phase mode, as the feedback will change parameters at the boundary conditions of the SG tubes (e.g., feed flow, feed temperature, steamline pressure).

The negative feedback that could be induced by the secondary integrated control systems could reduce the in-phase stability margin. Appendix A to the Stability TR states that inlet flow resistance is increased to ensure individual channel stability. However, the response to RAI 9093, Question 01-39, dated November 9, 2017, states that the applicant will revise this requirement in the original Stability TR to allow density-wave instability on the secondary side as

12 long as the limit-cycle oscillation magnitude is restricted to 10 percent in the SG inlet mass flow rate (ADAMS Accession No. ML17313B233). The applicant later submitted a supplement to its RAI 9093, Question 01-39, response to remove the 10-percent limit (ADAMS Accession No. ML18129A164) dated May 8, 2018. Furthermore, control system feedback could significantly reduce stability margin. The applicant did not provide any details to support the statement that the SG is properly designed to prevent in-phase instability driven by density waves. Such an analysis would have to consider local pressure losses, as well as feedback that could occur because of secondary-side control systems. Additionally, the staff can foresee the potential for a coupled instability mode with out-of-phase flow oscillations inducing an associated in-phase instability mode, as controllers intervene in a manner that affects total SG pressure drop.

For out-of-phase flow oscillations on the secondary side, the Stability TR discusses the potential for tube out-of-phase flow oscillations to develop a modal characteristic similar to BWR regional mode instability. In a BWR, the neutronic coupling between parallel, hydraulically isolated bundles can result in the regional mode, in which bundles in one area of the core oscillate together. The applicant believes that a similar mechanism is not present in the NuScale SG.

As discussed above, the staff postulated a means for out-of-phase oscillations in flow to produce in-phase oscillations in heat transfer. One key difference between the SG and a BWR could make this possibility more likely. In a BWR, the interassembly bypass flow area is generally at, or near, saturation temperature. As a result, heat transfer from the bundles to the bypass is negligible, leading to a more complete hydraulic isolation of the individual channels.

However, in the case of the NuScale generator, a heat transfer reduction in one tube would result in higher local primary coolant temperature near that tube, which in turn, would promote a higher rate of heat transfer to the surrounding tubes in the SG. In essence, the fluid between the tubes on the primary side does not serve to isolate the SG tubes in the same way that these are isolated in a BWR core. The analysis in the Stability TR does not consider this mechanism of communication between the SG tubes nearest neighbors. While the applicant did not analyze this mechanism, it casts doubt on the simple analysis presented in Appendix A to the Stability TR, insofar as it is not clear that the tube flow oscillations would necessarily occur with an even distribution of phase shifts. Mechanisms allowing coupling between a tube and its nearest neighbors would tend to promote something similar to regional mode oscillation as observed in BWR cores. Therefore, it is not clear if self-cancellation for heat transfer is a reasonable assertion based purely on the Appendix A analysis. For this reason, the staff based its review on the experimental demonstration in the TR Supplement, which is discussed in greater detail later in this section.

There is also the matter of primary/secondary system interaction feedback. The staff was concerned that once control functions are considered on the secondary side, and since the primary side in pressurized-water reactors (PWRs) tends to follow the secondary side, perturbations initiated on a marginally stable primary side may be enhanced through secondary-side feedback. For example, PIM might predict that the primary side is marginally stable in response to a core inlet flow perturbation; however, if that perturbation is propagated through the system, the secondary side might contribute to negative feedback, eroding the overall system stability margin. Without additional details of the control system operation and without a means of simulating the feedback associated with the secondary side and its interaction with the primary side, it was not clear if the stability margins predicted by PIM were reliable.

The applicant largely addressed the staff considerations in the TR Supplement, which stated that the Stability TR did not include the design of the control system. However, the TR

13 Supplement also states that the module control system must satisfy the requirement that it does not contribute any destabilizing effects. The staff agrees with this requirement for the design of the control system. Therefore, while the applicants approach addresses the interactions of the control systems, it was still necessary for the staff to consider the thermal-hydraulic phenomena leading to density-wave instability on the secondary side.

Many of the secondary-side thermal-hydraulic phenomena or considerations are complicated by the presence of many SG tubes of different lengths, which would imply families of tubes in the SGs with slightly different natural frequencies. The staff was concerned that the applicant does not consider this in the disposition; however, if the argument relies on demonstrating strong self-cancellation, then this difference in natural frequency between banks of tubes should be considered in a more detailed analysis or demonstration. As discussed later in this section, the staff considered experimental data provided by the applicant that support the conclusion that out-of-phase flow oscillations result in self-cancellation.

The staff initially considered the experimental data from the NIST-1 test facility as presented in the Stability TR, as these data may shed light on some of these issues. However, many of the issues are related to the parallel channel effect and the question of the differing tube lengths remains, so it is not clear how to derive conclusions from the current NIST-1 stability experiments. Further, the Stability TR points out scaling issues in applying such results directly.

Therefore, the staff could not rely on the NIST-1 experimental data to disposition the applicants claims concerning self-cancellation of secondary-side oscillations.

The applicant addressed secondary-side instability in the supplement to the Stability TR (ADAMS Accession Nos. ML16340A756 and ML16338A014). The TR Supplement clarifies the possible flow oscillation modes in the SG tubes. In terms of the in-phase oscillation, the TR Supplement clarifies that the feedwater flow is controlled based on steam flow demand, and that any pressure drop variation as a result of density-wave oscillation in the SG tubes will be minor relative to the driving head provided by the feedwater pumps. If the SG tubes are designed to be inherently stable with respect to density-wave-driven oscillation, then the staff finds this disposition to be reasonable and agrees that the primary concern is the possibility of out-of-phase oscillation of the tubes. However, because the applicant revised the requirement for the SG tubes to be inherently stable in the response dated November 9, 2017 and May 8, 2018, respectively for (ADAMS Accession Nos. ML17313B233 and ML18129A164) to RAI 9093, Question 01-39, the staff was required to reconsider this disposition in more detail with respect to in-phase flow oscillations.

The staff considered two cases in its evaluation of the secondary-side instability and the impact of such instability on the primary side. First, the staff considered a scenario in which the secondary-side controllers are idealized and can maintain the SG tube pressure drop at a fixed value. This idealized condition is consistent with assumptions in the applicants stability analyses. In this case, the SG tubes share a common pressure drop that is fixed. Under a fixed pressure drop, if any SG tubes become unstable, they can be expected to oscillate out of phase such that total SG flow rate remains unchanged. Second, the staff considered a scenario in which the SG tubes may become unstable, but the SG tube pressure drop is not fixed because controllers that affect the inlet and outlet pressures will respond to dynamic changes caused by a perturbation. In the second case, the pressure drop is not fixed across the SG. If the pressure drop can be dynamic, there is the possibility for the flow in the SG tubes to oscillate in phase. The staff considers each of these scenarios below.

Fixed Steam Generator Tube Pressure Drop

14 The TR Supplement states that the tubes are expected to be designed to preclude out-of-phase density-wave oscillations; however, the response to RAI 9093, Question 01-39, supersedes the original documents. Since SG tube flow oscillations are permitted, the argument of self-cancellation in Appendix A to the Stability TR is much more relevant to demonstrating that GDC 12 is met with respect to how secondary-side instability could affect primary-side power and flow. Experimental data collected during the SIET-TF2 tests also support the argument for self-cancellation. The TR Supplement states that the purpose of providing the results of the tests was to strengthen the basis for concluding that the dynamic feedback loop between the primary flow and the out-of-phase mode in the SG is broken for all practical purposes. The experimental data provided demonstrate the system response to significant out-of-phase flow oscillation in various instrumented tubes. The results of the test confirm the Appendix A rationale that the out-of-phase oscillations are self-cancelling and that these oscillations do not produce an in-phase oscillation in the heat transfer as originally conjectured by the staff.

In RAI 9171, the staff requested additional information about the specific test conditions for the SIET-TF2 test described by the TR Supplement. The staff asked for this information to confirm that the tested conditions are applicable to drawing conclusions about the operation of the SG at normal operating conditions or other conditions relevant to power module stability (such as those encountered during AOOs).

In the response dated February 16, 2018, to RAI 9171, (ADAMS Accession No. ML18047A737) the applicant stated that the SIET-TF2 flow oscillation tests were not intended to be representative of the operating conditions of the NuScale power module. However, the response still provides the test conditions and compares these test conditions for the normal operating conditions in the secondary side of the power module. The response also compares the geometry of the SIET-TF2 test to the NuScale SG design, and Table 3 of the response shows that the geometry is quite similar, apart from the coil length.

The staff compared the unstable SIET-TF2 test conditions to the NuScale power module SG conditions under conditions of normal operation. The bases for the staffs comparison are the dimensionless subcooling and phase change numbers (Nsub and Npch, respectively). For the unstable SIET-TF2 test conditions, the phase change number was computed based on the total power delivered to the secondary side (which was inferred by the primary-side flow and temperature drop), as well as the total secondary-side flow rate. Figure 1 compares the SIET-TF2 tests to the NuScale power module secondary-side operating conditions. The comparison shows that the SIET-TF2 tests consider a wider range of Npch, but a slightly higher range of Nsub. A higher Npch would indicate more unstable conditions, but this is not as clear with respect to the Nsub. In any case, the comparison indicates that the operating conditions of the power module during its startup fall in the same range of parameters as unstable test conditions based on SIET-TF2 tests. In Figure 1, the staff has approximated the stability boundary based on the method of Ishii (Ref. 4), which shows that the NuScale power module and SIET-TF2 points are in the unstable range. Therefore, the staff concludes that the test conditions are reasonably representative of the NuScale power module operating conditions and, furthermore, that the secondary side can be expected to become unstable during normal operating conditions, at least during the startup maneuvers.

[

15

]

Figure 1: [

1]

In many of the SIET-TF2 tests, significant flow oscillations developed. The applicant provided plots of these oscillations in its response to RAI 9171. Test TW0001 Run 806 is a good sample case because the test conditions are the most like those of the normal NuScale power module operation at power. The SIET-TF2 TW0001 Run 806 results show substantial tube inlet flow oscillations with flow reversal. The flow rates oscillate between -0.4 to 0.6 kilograms/second (kg/s) in the sample test. During this test, however, the primary-side to secondary-side heat transfer was not appreciably affected, as is evidenced by the relatively steady value of the primary-side temperature drop (see Figure 3 of the applicants response (ADAMS Accession No. ML18047A736).

The experimental demonstration of the self-cancellation effects in the SIET-TF2 tests is a sufficient basis to demonstrate that these types of oscillations do not propagate to the primary side. However, the staff based its conclusions on the SIET-TF2 experimental data, which were limited in terms of the achieved oscillation magnitude of the tube flow and were controlled in such a way as to fix the secondary-side boundary conditions.

If oscillation magnitude of the secondary-side tube flow instability becomes nonlinear and reaches its limit-cycle, it is not clear if the impact of such flow oscillations would still result in self-cancellation. Therefore, the staff requested additional information in RAI 9580. In its response, dated December 31, 2018 (ADAMS Accession No. ML18365A282), the applicant asserted that out-of-phase oscillations are self-cancelling, which the staff agrees with in the linear regime. While the response does not address nonlinearity of the out-of-phase oscillations, it does consider large amplitude in-phase flow oscillations, which would certainly 1 In this figure RTP stands for rated thermal power and NPM stands for NuScale power module

16 bound any consideration of the out-of-phase oscillations, whether linear or nonlinear.

Therefore, the staff review focused on the analysis of in-phase flow oscillations, which is discussed further in the following section of this report.

Dynamic Steam Generator Tube Pressure Drop The staff notes that the frequency of density-wave oscillations in the secondary side is very different from the natural frequency of the power module, and therefore, no resonant interaction can be expected between the instability modes of the two sides. However, the possibility remains that an oscillation on the secondary side generated by other phenomena, such as temperature variation or control system operation, which may occur at much lower frequency, could induce a resonant effect on the primary side if the frequency of the secondary-side oscillation is close to the natural frequency of the power module. The applicant separately addressed the issue of possible resonant interaction between the secondary and primary side in Section 8.2.7 of the Stability TR. Section 3.4.3.7 of this report presents the staff review.

As part of the review of the resonant interaction between the primary and secondary side, the staff requested in RAI 9089 that the applicant perform analyses at various frequencies. In the response, dated January 19, 2018, the applicant provided a figure that shows the primary-side gain as a function of frequency over a wide range (ADAMS Accession No. ML18019A944). The response shows that above a frequency of 0.05 hertz (Hz), the gain becomes very small. For example, a primary flow amplitude of 0.05 kg/s, which is the approximate primary flow amplitude at 0.05 Hz (based on visual inference), corresponds to a gain of approximately 2 percent. Using the information from the response (ADAMS Accession No. ML18047A737) to RAI 9171, dated February 16, 2018, the staff was able to estimate the SG tube transient time. Assuming pure liquid (i.e., zero void fraction) conditions, the maximum transit time is approximately 3 seconds.

Because the SG tubes under conditions of power greater than 20 percent will be in two-phase conditions, this represents an upper estimate of the transit time. This implies that the natural frequency of secondary-side density-wave oscillation would be greater than 0.3 Hz.

The dramatic reduction in the gain with increasing frequency makes sense, because any oscillations in the heat transfer on the secondary side can affect the primary side only if that change in heat transfer, dynamically, is comparable to the transit time of the primary side of the RCS flow as it traverses the axial expanse of the SG tubes in the annulus. If the frequency of secondary-side oscillations is very high, a slug of flow traversing the annulus on the primary side will experience several maxima and minima of the secondary-side oscillation, which will tend to cancel out in terms of the effect on the temperature of the slug as it leaves the annulus and enters the upper downcomer region. Since the flow in the RCS is relatively slow compared to the flow in the SG tubes, the gain can be expected to be very small at high frequency.

A frequency as high as 0.3 Hz (and more likely a frequency closer to 1 Hz) appears to be off scale for the results presented in the response to RAI 9089, but one can infer that the gain will be less than 2 percent for the range of interest. If the secondary-side oscillation magnitude is confined in some manner to, for example, 10 percent, the impact on primary-side flow resulting from secondary-side instability will be less than 2 percent of 10 percent or 0.2 percent, which is insignificant.

As stated above, the in-phase oscillation could occur if the secondary-side control system was designed to allow the SG tube pressure drop to change dynamically. The staffs analysis so far has assumed that the controllers would allow such an oscillation and that the oscillation would develop at the natural frequency of the SG tubes. However, without a detailed analysis of the

17 secondary side, including the controllers and equipment, the staff cannot conclude whether such an oscillation is possible. The staff can conclude that secondary-side, density-wave-driven, in-phase oscillations would not have a significant safety impact on the primary side if the oscillation magnitude is constrained. As shown in the staffs analysis above, a 10-percent oscillation would produce a negligible effect on the primary-side flow.

In the TR Supplement, the applicant stated that in-phase oscillations can be dismissed in part because the feedwater flow control is applied to a frequency-controlled feed motor that provides a large driving head and the relative magnitude of the SG pressure drop to the feedwater pump head is very small. Therefore, density-wave-driven instability in the tubes could not produce a significant enough change in the SG tube pressure drop to have an appreciable effect on the pump head. The staff is inclined to agree with this analysis, but it is not clear if the analysis also applies to a pressure regulator on the steamline that may be acting in tandem with the feedwater pump controller. It also may not be accurate that the secondary side is controlled in such a way that the feedwater flow is controlled to achieve a given turbine flow demand, especially for a plant design that operates with superheated steam coming from the SGs. For example, if the feedwater control system adjusts feed flow through a feedwater-regulating valve or with a combination of a flow control valve and pump motor speed, then the applicants argument with respect to pump head is moot. Therefore, in RAI 9580, the staff requested additional information about the secondary side.

In response (ADAMS Accession No. ML18365A282) to RAI 9580, the applicant confirmed that the secondary-side flow oscillation amplitude is not constrained to any prescribed limit (i.e., the 10-percent flow oscillation limit previously described in other RAI responses and Stability TR change pages). However, the applicant conceded the staffs point that control functions may result in large amplitude flow oscillations on the secondary side that are in phase. The applicant analyzed a series of flow oscillations at 20- and 100-percent power at different points in cycle using PIM and assuming that the feedwater flow controller was supplying an oscillation of a given magnitude. The applicant analyzed a feedwater flow oscillation that was equal to 100 percent of the nominal feedwater flow, arguing that this oscillation magnitude is bounding of any possible secondary-side flow oscillation produced by the feedwater flow control system.

The staff contends that the oscillation may become nonlinear, which would result in the possibility for positive flow peaks that are more than twice the average, but this point is not important. The applicants calculations using PIM do not simulate reactor trip functions and, therefore, do not show the power and temperature oscillations that would ensue if such large feedwater flow oscillations persisted. The applicant correctly argued that such oscillations would result in reactor trip because of either high power or loss of steamline superheat. At high reactor power (100 percent of rated power), the smallest power peak caused by a 100-percent feedwater flow oscillation was a 22-percent increase over the average, which is above the reactor high-power trip setpoint. In these high-power cases, the steamline superheat also reaches 0 degrees F, which would also prompt a reactor trip. Therefore, the oscillations on the secondary side analyzed by the applicant are certainly bounding.

While the applicant has not identified any limit-cycle nonlinear limiting conditions on the secondary side that constrain the oscillation magnitude, the staff accepts that MPS reactor trip functions that would shut down the reactor provide an acceptable constraint on the oscillation magnitude that must be considered. At high reactor power, the applicant has demonstrated that the reactor trip functions would actuate given secondary-side oscillations smaller than those analyzed in the RAI 9580 response.

18 The rationale suggested by the applicant is that the flow oscillations induced by this limiting secondary-side flow oscillation would not challenge thermal limits. This is evidenced by the applicants calculation results showing that the minimum critical heat flux ratio (MCHFR) remains well above unity in all calculation cases. PIM has not been qualified to calculate thermal margins, and the staff review explicitly limits the use of PIM for this purpose (see Section 3.2.1.9 of this report for further details). However, even though PIM is not qualified to determine the thermal margins, the staff still considered the applicants argument that the thermal margins predicted by PIM are so significant that they could be expected to remain significant even if a qualified critical heat flux (CHF) correlation was used. While this argument is more difficult to make for lower values of MCHFR, the staff finds the applicants rationale particularly convincing for the lower power case (at 20 percent of rated power) where the calculated MCHFR remains significantly larger than the CHF ratio calculated for normal full-power operation. While the staff finds this argument compelling, this does not constitute an endorsement of PIM to produce reliable predictions of thermal margin. Rather, the staff understands that these calculations indicate that there is likely to be substantial thermal margin at lower power levels during postulated large-amplitude, secondary-side flow oscillation.

The staff finds that unconstrained, in-phase, secondary-side flow oscillation may occur, but the MPS will constrain the magnitude of these oscillations by actuating a reactor trip in response to a loss of steam superheat or in response to excessive reactor power. On this basis, the staff finds that the applicant has analyzed an oscillation magnitude far exceeding the worst oscillation that could conceivably occur and persist in the plant. For low reactor power levels, the applicant shows such a substantial thermal margin using PIM that the staff agrees that even though these calculations are not qualified, they are still sufficient to demonstrate a reasonable expectation of thermal margin under these conditions.

At higher power levels, the applicants response shows that the effective oscillation magnitude that could persist on the secondary side is much more constrained than the oscillation analyzed.

While unable to accept the same argument regarding the thermal margin calculated by PIM in this case, the staff does find that the possible range of flow oscillation would be much smaller and lead to a much smaller change in the thermal margin than analyzed.

The staff further notes that the applicants analysis considers the worst possible period of the secondary-side oscillation from the standpoint of possible resonant interaction. By analyzing the flow oscillations at a resonant frequency, the applicants analysis produces the largest possible primary-side flow oscillation that can be induced by the secondary side. The resonant period tends to be comparable to the primary-side loop transit time. At high power, the limiting period varies from 55 to 500 seconds. This implies that the rate of feedwater flow change on the secondary side occurs over a period of approximately 1 to 10 minutes, which is long compared to the time it would take for a malfunction of the secondary side to produce an equivalent change in the feedwater flow rate during a postulated AOO. Therefore, the rate of feedwater flow change in the applicants current analysis is relatively small during the postulated oscillations when compared to AOOs that are analyzed for the power module associated with changes in the secondary-side heat removal. In addition, the PIM calculations provided by the applicant cover several periods, and these calculation results further illustrate that there is no resonant effect leading to growing oscillations on the primary side. As a result, the primary side follows the secondary side in the response, in that the secondary-side heat removal oscillation magnitude essentially matches the oscillation magnitude in the feedwater flow rate. In other words, because there is no resonant interaction, the secondary side does not cause the primary-side oscillations to grow from period to period, making each period an indistinguishable limit cycle in the linear range.

19 The flow conditions analyzed as part of the AOO analysis must consider an appropriate constraint on the maximum upset allowable by plant equipment and control system functions, such as the maximum credible increase or decrease in feedwater flow stemming from an equipment or controller failure. Therefore, the thermal margin changes in response to changing secondary-side flow can be expected to match those analyzed in the scope of AOOs analyzed as part of the design certification for changes in secondary-side heat removal. Because there is no resonant interaction, the primary-side response to a change in oscillatory flow would match the primary-side response to a monotonic change in secondary-side flow of the same magnitude. Therefore, the staff finds that no special consideration is needed in those analyses to address possible primary-side flow instability. Demonstration of adequate thermal margin in Chapter 15 of the FSAR is adequate to show that thermal margins are maintained during postulated changes in the secondary-side flow. In turn, this is sufficient to confirm that adequate thermal margins would be maintained during postulated secondary-side flow oscillations.

To summarize, the staff finds the applicants argument that flow oscillation is inherently constrained by MPS protective trips resulting from reactor power and steamline superheat compelling. The applicant analyzed secondary-side flow oscillations in excess of the limits that would be imposed by these trips and demonstrated that, at low power, substantial thermal margins can be reasonably expected to last throughout the oscillation. In the case of higher power, the staff finds that the interaction between the primary and secondary sides is such that the primary side will follow changes in the secondary side without any resonant interaction (see Section 3.4.3.7 of this report for further detail). Therefore, changes in thermal margin resulting from changes in secondary-side heat removal that demonstrate thermal margins as part of the Chapter 15 FSAR analysis would be sufficient to demonstrate that thermal margins are maintained during postulated secondary-side oscillations.

Therefore, the staff finds that no further analysis is needed to address secondary-side flow instability as part of the PIM stability analysis methodology beyond what is already required as part of the design certification review. Further, the staff finds the response to RAI 9580 acceptable insofar as it gives reasonable assurance that thermal margins will be maintained during the worst case allowable secondary-side flow oscillations, considering the MPS functions. This finding assumes, of course, that the applicants AOO analyses in Chapter 15 of the FSAR demonstrate adequate thermal margins (these are the subject of a different NRC review and are outside the scope of the current evaluation). If the Chapter 15 analyses do not demonstrate adequate thermal margins, then the NuScale design would not meet the applicable acceptance criteria and could not be certified by the NRC.

3.1.1.5 Natural Circulation or Riser Instability The natural circulation or riser instability mode is the primary mode of instability for the NuScale power module. Section 4.3.2.5 of the Stability TR addresses the basic mechanism, but Sections 4.3.3.3 and 4.3.3.4 of the Stability TR describe how this mechanism interacts with, or is compounded by, other phenomena. The staff reviewed these sections and concludes that the riser instability mode is similar to density-wave instability, except that instead of requiring prescribed pressure boundary conditions, density waves affect the flow by virtue of a closed loop with a two-part hot side (core and riser) and a two-part cold side (SG and downcomer).

The riser instability mode can be understood by considering a positive flow step perturbation; such a step perturbation traverses the core and reduces coolant temperature at the core exit relative to the initial steady-state temperature. Thus, the density at the bottom of the riser is higher. There is a delay while this temperature (and density) propagates upwards to populate

20 the entire riser with fluid at a lower temperature. This creates the delay between the effect of reducing temperature and increasing the static pressure head as that reduced temperature wave propagates up the riser. The feedback is negative because a positive flow perturbation creates a lower temperature, lower temperature means higher density, and higher density means higher gravitational head, which translates to a lower flow under natural circulation conditions. The delay, coupled with the negative nature of the feedback, makes it possible for the loop to become unstable in this mode.

The staff finds that this mode is coupled with two other primary physical processes. The first is the neutron kinetic response to changes in the core thermal-hydraulic condition, which changes the core power. In addition, changes in primary circuit flow rate will change the heat transferred to the secondary side around the SG annulus. Therefore, a detailed systems analysis of the power module stability must also consider how these phenomena interact with, or compound, the riser instability mode.

The staffs discussions of the phenomena affecting the NuScale power module stability in its own independent PIRT (ADAMS Accession No. ML17033A144) closely match the rationale given in the Stability TR. The staff reviewed the phenomenological description in the Stability TR and agrees with the applicant on the identification of this mode, the compounding physical processes, and the characterization of the mode as being the primary instability mode.

3.1.2 Stability Analogue and Reduced-Order Model Section 7 of the Stability TR discusses the NuScale power module stability based on a first-principles approach. This approach relies heavily on a published, simplified stability analogue of the power module natural circulation loop (Ref. 1). The analogue simplifies the modeling of many phenomena to derive analytical solutions of the dynamic response of the module. The intent of this analogue is to understand the key phenomena and underlying physical processes that affect the stability and stability trends for the NuScale power module.

The staff recognizes that this type of information is included in the Stability TR to assist in understanding the nature of the natural circulation loop dynamics. However, the staff also recognizes that important phenomena affecting stability characteristics are overly simplified in the analogue model. Therefore, while the analogue fulfills the intended purpose of elucidating the primary physical processes that dictate trends in the stability characteristics, it is not useful in establishing quantitative stability margins. Therefore, the staff clarifies that this safety evaluation report does not constitute approval of the stability analogue.

The TR Supplement describes a reduced-order model (ROM) similar to the analogue described in Section 7 of the Stability TR. The applicant used the ROM in the TR Supplement to explain the interaction between the power module and the SG. The ROM is also a simplified model, and the staff understands that results from the ROM are intended only to elucidate the key physical interactions between the primary and secondary sides. The ROM is not sufficiently detailed to be used to quantify stability margins. Therefore, the staff clarifies that this safety evaluation report does not constitute approval of the ROM. The limitation imposed by the staff on the analogue and ROM is summarized below:

Stability Analogue and Reduced-Order Model Limitation The stability analogue described by Section 7 of the Stability TR and the ROM described by the TR Supplement are not approved for licensing purposes.

21 3.1.3 Comparisons with the Phenomenon Identification and Ranking Table According to SRP Section 15.0.2, the review of any safety analysis method relies on the identification of important phenomena in a PIRT. Section 4.4 of the Stability TR presents the PIRT supporting PIM. The staff reviewed this PIRT by reconciling differences between the PIM PIRT and a NuScale stability PIRT that was independently developed by the staff. The staff documented its independent PIRT (ADAMS Accession No. ML17033A144), which contains a more detailed description of the rationale behind the staffs determination of the relative importance of certain phenomena. Table 1 lists all phenomena that the staff ranked as highly important. The phenomena are categorized according to the power module system and component.

Table 1: Summary of Highly Important Phenomena from the NRC Staffs Independent NuScale Stability PIRT (ADAMS Accession No. ML17033A144)

System Component Process/Phenomenon core fuel rods fission power core kinetics decay heat core kinetics delayed neutrons core kinetics fuel temperature feedback core kinetics moderator density feedback core kinetics moderator temperature feedback core subchannel core pressure drop core subchannel natural circulation core subchannel single-phase convection core subchannel single-phase pressure drop core subchannel subcooled boiling primary downcomer single-phase pressure drop primary downcomer vertical/radial natural circulation primary hot-leg riser flashing primary hot-leg riser Ledinegg instability primary hot-leg riser vertical/radial natural circulation primary lower plenum vertical/radial natural circulation primary SG annulus convection heat transfer to the SG tubes

22 System Component Process/Phenomenon primary SG annulus single-phase pressure drop primary SG annulus vertical/radial natural circulation primary upper plenum vertical/radial natural circulation secondary SG tubes conduction through the tube wall secondary SG tubes Ledinegg instability secondary SG tubes two-phase heat transfer There are several differences between the staffs listing of highly important phenomena and those identified in the Stability TR PIRT. For the core, the Stability TR PIRT and the staffs PIRT appear to be consistent in ranking the core power and reactivity feedback mechanisms as highly important. There are differences in the ranking of pressure drop and subcooled boiling.

The staff considers the pressure drop to be highly important because of the effect that pressure drop has on the natural circulation flow rate. This consideration applies to the pressure drops throughout the primary flow circuit, leading the staff to rank these pressure drops and natural circulation phenomena as highly important.

In RAI 9093, Question 01-36, the staff requested additional information to clarify the importance ranking of pressure drop. In response, the applicant provided additional justification of the medium importance ranking (ADAMS Accession No. ML17313B233). First, the applicant drew a distinction between the impact of the pressure drop in calculating the steady-state flow pattern and the impact of the pressure drop in calculating the response of the flow to a perturbation in the flow from that steady-state condition. This difference, according to the applicant, justifies a lower importance ranking for the pressure drop. This basis is not clear to the staff. When imagining any closed-loop system such as NuScale, the magnitude of the core flow rate predicted in the steady state can be expected to have an impact on the system transfer function.

Therefore, the staff expects that the steady-state predicted flow rate will influence the dynamic behavior of the system. As an example, a higher core flow rate predicted in the steady state would mean that any perturbation to that flow traverses the core region at a higher pace and could therefore be expected to diminish the influence of core reactivity feedback on the overall system response to a flow perturbation. Therefore, the staff does not accept the applicants rationale that it is important to consider the second impact (i.e., the impact on changes to the steady-state value during the transient calculation) only when determining the importance of a given phenomenon.

Second, the response to RAI 9093, Question 01-36, states that the medium importance ranking applied to the pressure drop highlights that the distribution of the pressure drop is less important in the stability evaluation of the NuScale power module when compared to stability evaluation for BWRs (ADAMS Accession No. ML17313B233). The staff agrees that the spatial distribution of the pressure drop, particularly in the reactor core of a BWR, is highly important for stability analysis in BWRs. However, this rationale does not appear to be relevant to the ranking. Even though the spatial distribution of pressure drop within the major system components of the

23 NuScale power module does not have a large impact on the stability characteristics, the relative pressure drop of each component within the primary flow loop does. That is, the staff agrees that the local pressure drop distribution along the axial elevation in the riser is certainly less important than the total pressure drop of the riser; however, the pressure drop of the riser compared to the pressure drop of the core and pressure drop of the downcomer is important to determining the core flow rate and core flow rate transient response. The staff reviewed the applicants discussion of the importance of pressure drop distribution in BWRs but does not consider it relevant to determining the importance of pressure drop phenomenology for the NuScale design.

Overall, the staff disagrees with the applicants ranking and disagrees with the rationale in the response to RAI 9093, Question 01-36. However, at the end of the response, the applicant stated that the stability analysis methodology treats medium-ranked and highly ranked phenomena in the same way. Therefore, the staff finds that the treatment of the phenomenon in the methodology is acceptable, even though the staff does not agree with the applicants importance ranking.

Further, the staff identified the phenomena of subcooled boiling (in the core) and flashing (in the riser) as highly important because the staff agrees with the applicant that void formation can have a significant impact on the riser instability mode. The Stability TR dispositions the flashing phenomenon by referring to the LTS solution, which protects subcooling margin in the riser.

The staff identified a similar disposition in its PIRT but did not rank the phenomenon as medium because of the perceived possibility that there may be delays in the MPS to enforce the subcooling margin, which, under transient conditions, could allow temporary riser flashing before the control rods suppress core power. A similar concession appears to be made in the Stability TR disposition.

However, the disposition in the Stability TR does not appear valid because the transient analyses documented in subsequent sections of the Stability TR essentially demonstrate that the LTS solution is effective in tripping the reactor before riser flashing occurs. Therefore, in terms of flashing, the staff finds that the methodology relies on accurately determining the timing of flashing onset relative to the timing of MPS trip. While an LTS solution is proposed to preclude flashing, PIM must be capable of reliably predicting flashing to demonstrate that there is margin between the timing of the MPS trip and the onset of instability. Therefore, the method relies on predicting this phenomenon, which is important to the stability of the power module.

Since void formation in the riser is a significant contributor to the riser instability mode, the staff requested in RAI 9018 that the applicant justify the medium importance ranking for riser flashing. The staff asked the applicant to address this discrepancy and provide additional information (such as model validation) consistent with a high importance ranking.

In the response to RAI 9018 dated October 2, 2017, (ADAMS Accession No. ML17271A157) the applicant reiterated the rationale for ranking riser flashing as being of medium importance.

The applicant further stated that while riser flashing occurs during unstable conditions predicted during the depressurization analysis, eventually the riser voiding becomes driven by a combination of flashing and boiling within the core. The staff agrees with the statement in the response that one aspect of the methodology is to analyze potentially unstable conditions to demonstrate that the MPS protective trip occurs with sufficient margin in time to prevent adverse consequences. Because the applicant analyzed conditions in which flashing contributes to riser instability as a way to demonstrate the effectiveness of the LTS solution, the staff cannot conclude that the phenomenon is of low importance because it occurs in a condition outside of

24 the range of normal operation. The applicants methodology specifically analyzes conditions outside the normal operating range according to the applicants prescribed analysis scope to demonstrate the LTS solutions effectiveness. Therefore, the staff disagrees with the rationale given by the applicant.

The response includes further rationale for the stabilizing effects of end-of-cycle (EOC) condition reactivity coefficients and discusses CHF consequences. The reactivity feedback is stabilizing, and EOC calculations of the same depressurization scenario could be expected to produce mild limit-cycle oscillations. This would be consistent with the staffs own confirmatory analysis.

The staff separately considered the applicants discussion of CHF. Section 3.2.1.9 of this report documents the staffs review of this topic.

In its own independent PIRT (see Table 1 and ADAMS Accession No. ML17033A144), the staff concluded that riser flashing was highly important. Therefore, the staff does not agree with the ranking or the rationale given in the RAI 9018 response. However, the response states that the medium-ranked phenomena are treated in PIM with the same fidelity as the highly ranked phenomena. The applicants discussion of the phenomenon of the medium-ranked riser flashing is consistent with the discussion of medium-ranked phenomena in its September 27, 2017, response (ADAMS Accession No. ML17270A268) to RAI 8922. Because the applicant made no effective distinction between medium and highly ranked phenomena, the staff can disagree with the ranking and the rationale, but ultimately, the applicants methodology treats the phenomenon as if it were highly ranked. Solely on this basis, the staff finds that the response to RAI 9018 acceptably resolves its concern about the applicants PIRT ranking of riser flashing.

As for subcooled boiling, the staff was not sure if the Stability TR intended to include this phenomenon under the broader category of vapor generation and condensation, as listed in Table 4-1 of the Stability TR. The staff requested additional information about the consideration of subcooled boiling in the PIRT in RAI 9093, Question 01-38. In its response, the applicant stated that subcooled boiling is captured in the PIM methodology and is considered under the broader category of vapor generation and condensation (ADAMS Accession No. ML17313B233). Because the broader category is ranked as highly important, and subcooled boiling falls under this category, the applicant treats subcooled boiling as a highly important phenomenon in its methodology. The staff agrees with this ranking and finds the treatment of subcooled boiling acceptable.

One of the differences between the staffs listing of highly important phenomena and those identified in the Stability TR PIRT is the ranking for Ledinegg instability. For the secondary side, the staff considered the possibility of Ledinegg instability in the SG tubes to be highly important.

However, given the information in the TR Supplement, the staff agrees with the disposition that secondary-side instability tends to be self-cancelling and would not have a significant influence on the primary side. For the primary side, the applicant addressed the Ledinegg instability phenomenon by stating that minimizing the flow resistance precludes flow excursion instability.

The staff finds that this argument is compelling but also finds that such static instabilities can be analyzed in the steady state to determine if SAFDLs are met, which would be within the scope of the steady-state thermal-hydraulic analysis. Especially as it relates to the secondary side, the staff does not agree that Ledinegg instability is not applicable (as it is currently ranked in the Stability TR); however, the staff finds that a ranking of low importance is warranted in light of the experimental data provided by the TR Supplement. Because a ranking of N (not-applicable)

25 versus L (low) does not have a meaningful impact on how the PIRT is used for evaluation model development, the staff finds the applicants approach acceptable, even though the staff does not agree with the ranking itself.

On a similar basis, the staff considered density-wave oscillations in the secondary side. In the independent PIRT, the staff ranked density waves in the SG tubes as being of medium importance under the assumption that the applicant would design the SG tubes with inlet flow orifices to ensure that oscillations driven by density waves are inherently damped. The original Stability TR and the TR Supplement both state that the SG tubes will be designed with inlet orifices to ensure inherent stability. The staffs preliminary findings on the Stability TR PIRT ranking, as well as the staffs independent PIRT, relied heavily on this design requirement specified in the applicants submittals. In RAI 9093, Question 01-39, dated November 9, 2017, the staff requested that the applicant describe the process by which the inlet orifices were confirmed to provide inherent stability. In its response, the applicant revised the Stability TR and stated that secondary-side instability would be allowed as long as the magnitude of the SG tube inlet mass flow oscillations is constrained to 10 percent (ADAMS Accession No. ML17313B233). The staff evaluated the consequences of secondary-side instability on the primary side in Section 3.1.1.4 of this report. The staff has determined that approval of the methodology is contingent on the disposition of secondary-side flow oscillation. The staff considered this requirement in its review of the response to RAI 9093, Question 01-39, and how that response affects the PIRT rankings. To complete its review, the staff required two supplemental pieces of information.

First, the staff noted that the response did not address its original concern in RAI 9093, Question 01-39, which focused on the process by which the applicant would demonstrate that the SG tube inlet orifices were designed to preclude instability. However, the applicants response, while changing the design requirement, does not describe the process for demonstrating how that requirement is met. Therefore, the staff asked for supplemental information in RAI 9580.

In the response (ADAMS Accession No. ML18365A282) to RAI 9580, the applicant stated that there is no imposed constraint on the secondary-side flow oscillation amplitude and revised the topical report to remove the limits previously discussed. The staff review of this revision, discussed in greater detail in Section 3.1.1.4 of this report, focuses on the consequences of unbounded, in-phase, secondary-side flow oscillations. Briefly, since unbounded oscillation would result in reactor trip before thermal limits are violated as the result of other trips (e.g., because of loss of steam superheat or high reactor power), it is not necessary to impose a specific limit on secondary-side flow oscillation.

The staff considered the possibility for secondary-side instability and determined that both out-of-phase and in-phase density-wave oscillation on the secondary side would not have a significant impact on the primary side. Section 3.1.1.4 of this report discusses these topics at greater length. During the review, the applicant provided several different dispositions of secondary-side instability concerns but ultimately replaced these dispositions with an analysis of a limiting secondary-side, in-phase flow oscillation to demonstrate that secondary-side instability does not pose a challenge to thermal margins in the core. The staff reviewed these analyses and determined that no special consideration of secondary-side instability is required to demonstrate compliance with GDC 10, apart from what is otherwise required according to Chapter 15 of the SRP. Therefore, while the staff cannot conclude that secondary-side instability is of low importance because it is limited by the design of the SG tubes and the staff disagrees with the disposition presented in the applicants PIRT, the staff has determined that

26 the low ranking in the PIRT does not affect its conclusions about the effect of this phenomenon on thermal margin and, subsequently, on the importance of its consideration in demonstrating compliance with GDC 10. Therefore, the staff merely notes that it disagrees with the applicants importance determination and disposition. Approval of the Stability TR should not be construed as NRC approval of the applicants PIRT in this regard.

Another difference between the staffs independent PIRT and the Stability TR is in the ranking of heat transfer mechanisms from the primary to secondary side. The staff considered these phenomena to be highly important, but the applicant ranked them as having medium importance. The applicants disposition appears to concede the higher importance by stating that the SG dynamics are important in the stability assessment, as they govern the cold-leg density. However, the Stability TR disposition continues by stating that a lower ranking is warranted because errors in the modeling associated with these phenomena would tend to be self-cancelling. On the sole basis that these phenomena dictate the removal of the reactor heat to the ultimate heat sink, the staff concludes that they are highly important. The staff agrees, however, that in terms of the power module stability, the key process is the integrated heat removal from the primary to the secondary side and that effects that would contribute to shifting the primary-side density within the axial span of the SG annulus would have a second-order effect on the natural circulation. To this end, the staff disagrees with the importance ranking but agrees with the concept that the overall heat transfer, as opposed to local effects, is the key consideration. However, it is unclear to the staff how certain errors would necessarily be self-cancelling.

In RAI 9093, Question 01-40, the staff requested additional information on the disposition of the heat transfer of the SG. The staff independently determined that the transfer of heat from the primary to the secondary side was of high importance (ADAMS Accession No. ML17033A144).

In response to RAI 9093, Question 01-40 (ADAMS Accession No. ML17313B233), the applicant conceded this point by agreeing that this is an important phenomenon. However, the applicant stated in the response that the ranking applied in the PIRT for this phenomenon is medium.

The staff disagrees with the applicant because the physical process of heat transfer from the primary side to the secondary side is the key phenomenon affecting the change in density in the SG annulus of the power module. While disagreeing with the importance ranking, the staff considers the response acceptable because the applicant stated that the methodology treats all medium-ranked phenomena in the same manner as highly ranked phenomena.

In RAI 8869, the staff requested additional information about the disposition of self-cancelling errors in the SG heat transfer. In its August 15, 2017, response, the applicant described how a change in the SG heat transfer that may occur as a result of tube fouling would produce a change in the temperature difference between the primary and secondary side (ADAMS Accession No. ML17228A261). However, this change would affect the primary-side average temperature but not the hot-and cold-leg temperature difference. Therefore, there would not be a significant impact on the natural circulation flow. The staff agrees with this point; however, increasing the primary-side average temperature may affect the transient calculations. Since the stability margin is afforded by the MPS protective trip to enforce riser subcooling, it is feasible that certain transient scenarios may become more adverse from a stability perspective if the initial temperature in the primary side is higher. Therefore, based on the response to RAI 8869 alone, the staff was unable to reach a conclusion on the importance of the SG heat transfer as it would relate to the transient analysis. In RAI 9441, the staff asked the applicant to provide supplemental information. The staffs request is divided into four items, which all focus on the AOO aspect of the NuScale power module stability analysis.

27 In the first item, the staff asked the applicant for an additional rationale for the importance ranking of the SG heat transfer, given that the SG heat transfer can affect the initial subcooling in the riser at the start of the transient. The staff stated that it would be acceptable for the applicant to formulate the rationale using an example of a phenomenon that could affect SG heat transfer such as fouling. In its response dated June 4, 2018, to RAI 9441, Item 1, the applicant explained that fouling would not occur during the transient (ADAMS Accession No. ML18155A625. This discussion was not relevant to the staffs question. It is clearly understood that phenomena such as fouling or plugging would occur before the transient initiation and would have the effect of reducing the SG heat transfer, thereby increasing the primary-side temperature at the initial point of the transient. The higher temperature of the primary side as an initial condition would mean that the initial subcooling in the riser would be lower. The applicant provided a calculation that demonstrates this effect. However, the applicants response does not address the staffs question, which relates to how a higher initial temperature might affect the transient progression and how that impact on transient progression would affect importance ranking.

In the second item, the staff asked the applicant to describe the limits on primary-side temperature. In its response to RAI 9441, Item 2, the applicant stated that the only upper constraint on the primary-side temperature is the exclusion region MPS protective trip, which enforces a subcooling margin of 5 degrees F in the riser (ADAMS Accession No. ML18155A625).

In the third item, the staff requested that the applicant consider all the different classes of AOOs and evaluate whether the consequences would become more adverse and potentially more limiting if the initial temperature of the primary side were much higher. In its response to RAI 9441, Item 3, the applicant stated that the depressurization scenario is the only class of transients that results in instability because of riser voiding (ADAMS Accession No. ML18155A625). The applicant further stated in the response that additional calculations at higher temperatures are not required because a higher initial temperature would merely result in earlier actuation of the MPS protective trip. The staff reviewed this statement and agrees with the applicants determination.

In the fourth item, the staff asked the applicant to evaluate any other AOOs that may be more limiting when considering high initial primary-side temperature. In its response to RAI 9441, Item 4, the applicant stated that no other limiting AOOs were identified based on such consideration (ADAMS Accession No. ML18155A625). Therefore, the staff agrees that no further analysis of other scenarios is required.

In reviewing the RAI 9441 response, the staff found that it did not fully address the question about the importance of the impact of SG heat transfer on stability during transients. However, the staff concluded that it is not necessary to reevaluate the stability during AOOs for the limiting event (depressurization) because the impact of reduced SG heat transfer would not affect the overall conclusions from the current analysis.

The staff maintains that the SG heat transfer is a highly important process in stability analysis and can affect the key figure of merit (i.e., instability onset timing) in a transient analysis.

However, a higher ranking of this phenomenon for PIM would have essentially no impact on the methodology or the subsequent analysis conclusions. The SG heat transfer in PIM, according to the methodology, is adjusted to match the results from NRELAP5 in the steady state.

Section 3.2.4 of this report describes this process in more detail. This adjustment means that the PIM calculations will be very close to the predictions of NRELAP5, which would be required

28 to accurately predict the SG heat transfer phenomenology and is the subject of a separate staff review.

Therefore, while the staff disagrees with the applicants importance ranking, the staff finds that these phenomena do not have to be treated as highly important in the PIM methodology because the PIM methodology anchors the model to NRELAP5. Since these phenomena are important to loss-of-coolant accident (LOCA) and non-LOCA transient analysis, they must be treated appropriately in the applicants NRELAP5-based evaluation model. The NRC staff is currently reviewing TR-0516-49422, Loss of Coolant Accident Evaluation Model, issued December 2016 (ADAMS Accession Nos. ML17004A202 and ML17010A427). As discussed in more detail in Section 3.2.4, the staffs review of PIM is contingent on the staffs review and approval of NRELAP5.

Based on the applicants clarifications and responses, the staff has determined that the applicant has ranked highly important phenomena as being of lesser importance in several instances in its PIRT. Therefore, the staffs current review should not be construed as an acceptance of the applicants PIRT. Rather, in all instances where the applicant ranked the phenomenons importance too low, the staff has confirmed that the applicant treated that under-ranked phenomenon as if it were ranked as highly important, except for secondary-side density-wave oscillation. In the case of secondary-side density-wave oscillation, the applicant provided a separate analysis to disposition this phenomenon; Section 3.1.1.4 of this report documents the staffs review of that analysis. Since the applicants methodology ultimately treated all the requisite highly important phenomena appropriately, the staff finds the methodology acceptable. However, the staff does not accept the applicants PIRT, and approval of the associated TR should not imply approval of the PIRT. Therefore, the staff imposes a restriction to make the scope of its approval clear:

PIRT Importance Ranking Restriction The staff approval of the NuScale stability analysis methodology does not constitute approval of the phenomena importance rankings described in the PIRT in the Stability TR. The current evaluation shall not be construed as approval of the applicants PIRT.

3.2 PIM Evaluation Model Section 5 of the Stability TR describes the PIM evaluation model. The staff evaluated PIM against the review criteria of SRP Section 15.0.2, as outlined below:

Evaluation Model The evaluation model includes the associated physical models of the PIM code, including the thermal-hydraulics, neutronics and kinetics, conduction, and SG models.

These are exercised according to a particular nodalization and numerical solution scheme. The staff reviewed each of these aspects of the evaluation model, as documented below.

Accident Scenario Identification Process The identified scenarios relate to stability. For steady-state operations, the scenario is well understood. However, GDC 10 and 12 require that the applicant demonstrate acceptable stability performance during AOOs. Therefore, the applicant identified AOOs

29 that potentially affect the stability of the NuScale power module and analyzed these events. Section 3.4.3 of this report addresses more fully the aspects of the review related to the identification of accident scenarios, and in that section, the staff documents its review of the transient identification and analysis.

Code Assessment The code assessment review covers three major areas: integral effects tests (IETs),

separate effects tests (SETs), and scaling. The following parts of this section cover the staff review of the associated IET and SET validation, including consideration of scaling distortions between the tests and the NuScale power module.

Uncertainty Analysis The uncertainty analysis is necessary to establish analysis acceptance criteria that provide reasonable assurance that the associated regulatory criteria are met. Therefore, the uncertainty analysis is tied closely to the DR acceptance criterion of less than or equal to [ ]. Section 3.3 of this report presents the staff review of the PIM uncertainty and the acceptance criterion.

Quality Assurance Plan The staff conducted a regulatory audit to review the QA plan to ensure that the plan meets the minimum requirements described in SRP Section 15.0.2. These include design control, document control, software configuration control and testing, error identification and corrective actions, and training of personnel involved with code development and maintenance. Section 3.2.8 of this report summarizes the audit findings.

3.2.1 Thermal-Hydraulics Models The PIM thermal-hydraulics model is defined by a combination of the conservation relationships for mass, momentum, and energy and a series of closure relationships. This section documents the staff review of the thermal-hydraulics model.

3.2.1.1 Conservation Equations Mass Section 5.5.1.1 of the Stability TR describes the mass conservation equations. Conservation of liquid and vapor mass is formulated on a nodal basis. [

30

] Therefore, the staff finds that the mass conservation equation is acceptable for the purpose of PIM analysis.

Energy Section 5.5.1.2 of the Stability TR describes the energy equation. The formulation of the energy conservation equation allows the liquid and vapor phases to be in nonequilibrium but forces the vapor to be at the saturation temperature. Since the LTS solution is intended to protect subcooling margin in the riser section, PIM will not be used to analyze conditions in which the vapor may become superheated on the primary side. Vapor will be superheated on the secondary side, but the SG model does not use the same formulation as described for the primary flow loop. Section 3.2.4 of this report describes the staffs review of the SG model. The nodal energy equations are referenced to the saturated liquid enthalpy, which, as stated in the Stability TR, requires the user to adjust certain inputs based on system pressure. Because, as stated above, PIM does not analyze conditions of primary side superheat, the staff finds the approach acceptable. The nodal energy equation formulation is straightforward and acceptable for the current purposes.

Momentum Section 5.5.1.3 of the Stability TR describes the momentum equation. The applicant derived the momentum equation from the one-dimensional, two-phase mixture differential equation shown in Equation 5-12 of the Stability TR. The applicant assessed properties at a constant system pressure and used them throughout all the nodes of the primary flow loop. The high pressure of the NuScale power module ensures that the fractional change in pressure through the primary loop will be small. Therefore, the staff finds that this is a reasonable approximation for the calculation.

The momentum equation is integrated over the loop and balances the loop pressure drop. [

] Therefore, the staff finds that the momentum equation formulation is acceptable.

The solution methodology, by solving the momentum equation, determines the velocity field in a series of one-dimensional nodes that form the closed primary circuit loop. This simplistic one-dimensional flow loop precludes PIM from calculating the bypass flow through the core. This limitation can result in PIM under-predicting the degree of subcooled boiling in the core because the bypass flow rate is, in effect, combined with the active core flow in PIM. Under bullet 2 of

31 Section 5.2, the Stability TR describes this limitation of PIM and briefly describes a method for accounting for subcooled boiling error using parametric studies. In RAI 8870, the staff requested additional information about this methodology.

The applicant referred to some sensitivity studies in its August 15, 2017, response (ADAMS Accession No. ML17228A277) to RAI 8870. Because this response was insufficiently detailed for the staff to reach a conclusion, the staff requested supplemental information in RAI 9438.

The applicant responded on May 30, 2018, to RAI 9438 and provided a much more detailed analysis (ADAMS Accession No. ML18150A707). [

] The staff agrees with this point.

The applicant then contended that the subcooled boiling phenomenon is most relevant to transient analysis where the reactor depressurizes and, furthermore, that suppressing subcooled boiling produces conservative results. To support this conclusion, the applicant provided the results of sensitivity calculations in the RAI 9438 response demonstrating the transient response for various values of the subcooled boiling coefficient (as described by Section 5.5.6.5 of the Stability TR). The coefficient was varied over a wide range, consistent with the range considered in the RAI 8944 response (ADAMS Accession No. (ML17271A237),

dated September 28, 2017. The results of the sensitivity calculations demonstrate that the default value of the boiling coefficient produces more adverse results when compared to calculations performed using lower values. [

] Therefore, the staff finds that the current approach of combining the [

] is appropriate for the purposes of the current analysis.

As for the boiling coefficient and treatment of the subcooled boiling in the transient calculations more generally, Section 3.2.1.8 documents the staff review of this model. To briefly summarize, the staff finds that the treatment of the phenomenon is appropriate so long as the assumed coefficient value is taken as the conservative, default value. The staff finds that the response to RAI 9438 is sufficient insofar as the response adequately justifies the assumption inherent in the PIM code to combine the active and bypass flows.

Another limitation of the formulation of the momentum equation is that PIM cannot treat flow reversal. Therefore, the staff imposes a limitation on PIM with respect to flow reversal:

32 Flow Reversal Limitation PIM is not approved to analyze transients where the oscillations become significant enough that flow reversal would occur anywhere within the primary flow circuit.

Based on the discussion above, the staff finds the momentum equation acceptable subject to the limitation imposed in this section.

3.2.1.2 Ambient Heat Loss Ambient heat losses are considered in the Stability TR using a simplified model. The ambient heat is calculated according to the bulk fluid temperature and the ambient temperature with an ambient heat transfer coefficient provided by Equation 5-48 in the Stability TR. The heat loss model neglects heat storage in the heat structures, but the staff agrees with the disposition in the Stability TR that the analyses are generally performed for small perturbations about a steady-state condition and that these effects can be ignored. The staff requested additional information regarding the basis for the ambient heat loss model in RAI 9024. In its response, dated October 10, 2017, the applicant described the calculations performed to determine the ambient heat losses (ADAMS Accession No. ML17283A422). The ambient heat losses were calculated using analytical models for heat transfer assuming emissivity values and heat transfer coefficients for the inside wall of the reactor pressure vessel (RPV) and the outside wall of the containment vessel. The applicant provided the values for these assumed quantities in Table 1 of the RAI 9024 response. The staff finds that these values are reasonable engineering approximations. Because ambient heat losses account for only a small fraction of the total heat removal from the system and because the staff determined ambient heat losses to be a phenomenon of low importance (ADAMS Accession No. ML17033A144), the staff finds that an analytical model with approximate values is reasonable for the stability analysis purpose. The applicant clarified in the response that the analytical models were exercised to produce a series of results at fixed primary coolant temperatures because the models must be solved iteratively.

The applicant then fit the results with a third-order polynomial expression. The fitted polynomial shown in the response is the same as the model described in the Stability TR; therefore, the response adequately describes the basis for the ambient heat loss model. Based on the discussion above, the staff finds that the overall approach is adequate given the low importance of the phenomenon to the stability analysis.

3.2.1.3 Chemical and Volume Control System Model The Stability TR describes the chemical and volume control system (CVCS) model in Section 5.5.5. The CVCS model is relatively simple: first, some flow is let down from a user-specified node in the downcomer; second, the extracted flow is passed through a heat exchanger and pump; and third, the flow is returned to the primary loop after some lag to a user-specified node in the riser. [

] In RAI 9172, the staff asked the applicant to provide a more detailed description of the CVCS model.

In its January 26, 2018, response to RAI 9172, the applicant described the CVCS model in PIM (ADAMS Accession No. ML18026A856). The staff reviewed the model assumptions, inputs, and equations that dictate the performance of the model. The staff found the approach to be straightforward and the assumptions and approximations to be reasonable for the purpose of stability analysis. In the RAI 9172 response, the applicant stated that neglecting the momentum

33 effect of the injected fluid is stabilizing, and while the staff is inclined to agree, the effect has not been quantified. However, the staff expects the momentum effect to be relatively small and therefore concludes that the CVCS model is reasonable.

In RAI 8814, the staff asked the applicant to evaluate changes in core flow as a consequence of malfunction of the CVCS. In its August 3, 2017, response to RAI 8814, the applicant considered CVCS malfunction and showed how these types of events are generically bounded by events leading to a decrease in secondary-side heat removal (ADAMS Accession No. ML17219A145).

Section 3.4.3.3 of this report describes the staff review more thoroughly. Since AOOs related to CVCS malfunction are generically bounded and do not require specific analysis, the CVCS model need only be sufficient to provide the right heat and mass balance to calculate natural circulation RCS flow rates during the startup. The staff finds that to achieve this goal, the simplified CVCS model, as described in the Stability TR, is sufficient and acceptable.

3.2.1.4 Fluid Properties The fluid properties in PIM are based on curve fits, which are verified against the 1995 version of the International Association of the Properties of Water and Steam (IAWPS). The staff finds the use of properties from the IAPWS 1995 version acceptable but requested clarification of a statement in the Stability TR concerning the range of analysis. Specifically, in RAI 9095, the staff asked the applicant to clarify the range of analysis over which the fluid property curve fits have been verified. The staff noted that the use of the IAPWS 1997 standard can cause issues when the liquid becomes highly superheated (TRACE V5.0 Users Manual, Volume 2, Modeling Guidelines, issued June 2008 (ADAMS Accession No. ML120060402)). The staff reviewed the applicants November 9, 2017, response (ADAMS Accession No. ML17313B231) to RAI 9095 and found that the applicant had adequately addressed the staffs concern regarding high superheat, justified the fluid property fits, and confirmed that the fits apply over the range of conditions necessary to analyze NuScale power module stability. On these bases, the staff finds the fluid property fits are acceptable.

3.2.1.5 Frictional Pressure Drop Section 5.5.6.2.1 of the Stability TR describes the PIM model for single-phase friction factor.

The single-phase friction factor model is based on the RELAP5-3D model. The friction factor depends on whether the flow is laminar, transition, or turbulent. [

] PIM user input defines the transition region, but values of Reynolds number (Re) of 2200 and 3000 are reported in the Stability TR and taken from RELAP5-3D. The staff finds this model to be fairly standard and has found similar applications acceptable in the past. Therefore, the staff finds the current usage to be acceptable. However, in RAI 8848, the staff requested some clarification of the transition region. The Stability TR states that these values are user input but does not specify that the listed Re values are used in the production methodology. The staff imposes the condition that the laminar-turbulent transition be consistently defined in the licensing analysis and that this transition region agree with the basis provided in the source reference (i.e., RELAP5-3D). In other words, the numerical values of the Re transition region must be the same as assured by the condition below. In its response to RAI 8848, the applicant stated that the stability performance of the NuScale power module is largely insensitive to the distribution of the friction pressure loss in the core, unlike the conditions in BWRs (ADAMS Accession No. ML17234A731). Further, the applicant clarified that the flow in the core remains in the turbulent regime for all the calculations and that the transition region is included for completeness. The staff agrees that many of the calculations indicate turbulent flow in the core, but because some calculations are performed at very low power (i.e., 1 percent) and

34 correspondingly low flow, there may be certain conditions requiring the analysis of laminar conditions in the primary flow circuit. Therefore, the staff concludes that the PIM methodology should include transition region treatment modeling. Since the primary parameter affected by the model is the core flow rate, and the applicant has confirmed that the use of the RELAP5-3D transition region produces acceptable predictions of the core flow rate, the staff finds that the continued use of the specific RELAP5-3D transition region is appropriate and should be used for future analyses.

Laminar-Turbulent Transition Condition When using PIM for licensing analysis, the user shall specify a laminar to turbulent transition region between Re of 2200 and 3000.

The staff finds that the predictive performance of the model is linked to the specific hydraulic parameters of a typical NuScale power module fuel assembly design. Acceptable performance of the model for substantially different types of fuel has not been generically established.

Therefore, the staff finds that the acceptability of the model is tied to its application to fuel assembly designs that are hydraulically compatible with a standard or typical NuScale power module fuel assembly design. To this end, the staff concludes that the methodology be applied only to compatible fuel designs as required by applicants Stability TR.

In a September 17, 2018, supplement to the RAI 9091 response (ADAMS Accession No. ML18260A380), the applicant clarified that licensees or COL applicants may reference the stability analysis documented in the Stability TR (or reference the methods described by the Stability TR in reload licensing stability-related confirmatory analyses) for alternative fuel designs without prior NRC approval only if the alternative fuel designs are hydraulically compatible with the reference fuel design (i.e., introduction of the alternative design would not significantly affect the total fuel assembly pressure drop characteristics and core flow rate). The applicant captured this aspect of the Stability TR applicability in a revision to Section 10.4 of the Stability TR. Therefore, the staff finds that the methods applicability to future fuel assembly designs is acceptably addressed.

Two-phase friction factor is derived by weighted average of the single-phase friction factors based on flow quality and density. While the staff considered two-phase pressure drop to be of only medium importance (ADAMS Accession No. ML17033A144), it is not clear how this formulation of the two-phase friction factor performs in a systems analysis. The staff requested additional information about the assessment of this model in RAI 8848. The applicant responded on August 22, 2017, by clarifying that the two-phase friction model is based on the correlation of Müller-Steinhagen and Heck and that the correlation has been assessed by comparison with data (ADAMS Accession No. ML17234A731). The response further clarifies that the applicant confirmed the correct physical trends in the implementation, but independent assessment [

]. The staffs independent PIRT ranked this phenomenon as being of medium importance (ADAMS Accession No. ML17033A144), and therefore, the staff agrees that the confirmation of the correlation performed by the applicant is sufficient. The correlation for two-phase friction has been separately assessed in the peer reviewed literature (Ref. 5). On the basis of that separate assessment the staff has found it acceptable.

35 Based on the Stability TR, RAI responses, and the staffs independent PIRT, the staff concludes that the friction factor models in PIM are acceptable and can be used to calculate friction pressure losses for stability analyses.

3.2.1.6 Local Form Losses Section 5.5.6.3 of the Stability TR describes the model for local form losses in PIM. The approach involves specifying a flow-dependent local loss factor. The approach described by the Stability TR is very similar to methods used in other systems analysis tools, such as TRACE.

The coefficient and flow-dependent factors are specified by user input, which is a common approach. Because this common approach is widely used and has been previously found acceptable by the staff, the staff finds the form loss model in PIM acceptable.

3.2.1.7 Drift Flux Model According to Section 5.5.6.4 of the Stability TR, PIM determines the void fraction according to a drift-flux correlation. Equations 5-60 and 5-61 in the Stability TR provide the correlation parameters. Drift-flux correlations are commonly used in similar systems analysis tools, including time-domain stability methods. The Stability TR states that the methodology determines the Zuber drift velocity parameter according to a correlation coefficient derived at normal operating pressure, but that the coefficient is only a weak function of pressure. In RAI 9096, the staff asked the applicant to clarify the range of pressure over which the correlation parameter is applicable. The staff requested that the applicant compare the drift-flux correlation to other common correlations such as Chexal-Lellouche and Modified-Bestion.

In the response to RAI 9096, dated October 26, 2017, the applicant compared the PIM void-quality correlation to other correlations used in systems codes and concluded that [

]. The staff reviewed the applicants rationale, finds the reasoning of the rationale to be sound as it related to the application of different void-quality correlations, and agrees with the applicants determination. While justifying the application of the cited correlation to the geometry of the large-diameter riser over the pressure range of interest, the applicant also referred to sensitivity calculations performed in response to RAI 9017. In that RAI, the staff asked the applicant to provide validation of the void-quality correlation.

In its response to RAI 9017, dated September 25, 2017, the applicant provided the results of sensitivity calculations making changes to the subcooled boiling and drift-flux models in PIM (ADAMS Accession No. ML17268A378). The staff reviewed the magnitude of the perturbations made in the sensitivity calculations and concurs with the applicant that these sensitivity perturbations are sufficiently large to bound uncertainty in the associated models. The results of the analyses presented by the applicant indicate that the PIM method is either unaffected by the perturbation or that the selection of the nominal models is conservative. Therefore, the staff finds that the response is acceptable and addresses what would otherwise be a need to more fully assess these models, as described by the SRP 15.0.2 acceptance criteria.

On the bases that (1) the void-quality correlation is applicable to the NuScale power module riser geometry over the pressure range of interest and (2) the sensitivity analyses have demonstrated that the effect of variations in the model over its uncertainty range have minimal impact on key figures of merit, the staff concludes that the drift-flux correlation is acceptable.

36 3.2.1.8 Evaporation and Condensation Section 5.5.6.5 of the Stability TR describes the evaporation and condensation models. The applicant based these models on the [

] The staff considers the simplifying modifications to the models to be acceptable for the purposes of the current analysis because the void formation is limited in the primary circuit by the nature of the LTS solution. Therefore, the staff agrees with the applicants discussion in the Stability TR concluding that the analysis results will not be very sensitive to the parameters of these models. In other words, the modifications to the model, relative to the previously approved models, are small enough that they do not have an impact on the stability analysis results. In RAI 8944, the staff requested clarification of an empirical factor in the model. In response to that RAI, the applicant described the basis for the boiling coefficient and justified the default value by demonstrating that the default value used in the analysis was conservative (ADAMS Accession No. ML17271A237). The staff agrees that using the conservative default value of the boiling coefficient is appropriate. However, when the boiling coefficient is adjusted by the user [

] (the applicant showed this in the response (ADAMS Accession No. ML18150A707) to RAI 9438). Therefore, the staff finds that safety analyses performed using PIM must be based on a boiling coefficient that has been demonstrated to be conservative for the application. To this end, the staff imposes the following condition:

Boiling Coefficient Condition Stability-related confirmatory analyses, referred to as being within the scope of the NuScale reload analysis methodology, shall be performed using the default value of the boiling coefficient [ ] described in Section 5.5.6.5 of the Stability TR.

Based on the previous staff approval of similar models and the clarification provided by the RAI response, the staff finds the models acceptable as long as PIM is exercised in accordance with the staffs condition regarding the default boiling coefficient.

3.2.1.9 Critical Heat Flux Section 5.6.5 of the Stability TR describes the CHF model. However, because the LTS solution precludes the reactor from developing unstable conditions, it is not necessary for the applicant to evaluate the transient CHF in the stability analysis. The applicant states that compliance with GDC 12 is afforded by the LTS solution insofar as instability is not possible. Therefore, the staff finds that compliance with GDC 10 can be confirmed by demonstrating that the steady-state and AOO conditions do not exceed SAFDLs (such as minimum CHF ratio). The staff agrees with the applicants statement in the Stability TR that CHF calculations are not required to demonstrate compliance with GDC 12 given the nature of the LTS solution, which is based on an exclusion region.

Therefore, while PIM includes the capability to calculate and output information regarding CHF predictions according to its internal models, these results are not required for the current regulatory purpose. Therefore, the staff did not review the CHF model in PIM. The staff approval of PIM does not constitute approval of the PIM CHF model and does not constitute approval of PIM to perform analyses of thermal margin. The staffs safety evaluation imposes the following limitation on the use of PIM:

37 CHF Limitation The PIM CHF model described by Section 5.6.5 of the Stability TR is not approved for licensing purposes.

3.2.2 Neutronics and Kinetics Models Section 5.6.1 of the Stability TR describes the neutron kinetics model in PIM. [

] The staff agrees that a point kinetics model is appropriate for the current application for two reasons: (1) the small reactor core size led the staff to rank three-dimensional neutronic phenomena as having low importance (ADAMS Accession No. ML17033A144), and (2) it is not important to characterize local power distribution to determine thermal margin, because the LTS solution is an exclusion region type and it is not necessary to evaluate margin to SAFDLs.

The staff evaluated the [ ] to the kinetics model and determined them to be appropriate for the current application. While the staff agrees with the applicants statement in the Stability TR that the neutronic feedback mechanisms are important, the staff finds that when the feedback is strong, the core will act to stabilize, rather than destabilize, the primary instability mode. This is because, with negative feedback coefficients, the reactor core will respond to a flow perturbation to reverse the perturbation before that perturbation propagates to the riser component (i.e., the core feedback is essentially in phase with the flow), thereby acting to damp natural circulation flow oscillations.

Therefore, simplifying the kinetics equations is acceptable so long as the feedback coefficients are appropriately determined and applied in the analysis. The staff further agrees that the [

] without an appreciable loss in analysis accuracy.

The Stability TR is not clear as to the source of parameters for the kinetics model, such as the delayed neutron fraction, the [ ], or the neutron lifetime. These parameters could be derived from the results of an NRC-approved nuclear design methodology, but the Stability TR is not clear on whether these factors can be supplied by the user or if generic values are applied in the calculations. Therefore, in RAI 8802, the staff requested additional information on these kinetics parameters. The staff finds that the formulation of the point kinetics equations is acceptable if the parameters are derived from an NRC-approved nuclear design methodology.

In its August 15, 2017, response to RAI 8802, the applicant stated that the nuclear data are SIMULATE5 (i.e., the applicants nuclear design analysis method) results derived for a representative NuScale power module core (ADAMS Accession No. ML17228A249). The response further states that PIM can calculate the reactivity according to either a moderator temperature coefficient (MTC) or moderator density coefficient (MDC). As part of RAI 8802, the staff asked the applicant to address the reactivity effect of a change in temperature, and while the applicant stated that [

], the effect is inherently captured by fitting the kinetic data to SIMULATE5 results. The staff had originally requested these additional details to ensure that the methodology was sufficient for characterizing the reactivity feedback over the whole range of

38 application, which includes AOOs and startup analyses. Therefore, to address staffs concerns, the PIM stability analysis methodology must evaluate a wide range of power levels. In RAI 9439, the staff asked for additional details of the fitting procedure and the specific SIMULATE5 calculations that were performed.

In its response (ADAMS Accession No. ML18152B881) to RAI 9439, dated June 1, 2018, the applicant contradicted the information provided in response to RAI 8802. In its RAI 8802 response, the applicant stated that the nuclear parameters were fit based on SIMULATE5 calculations. However, in its RAI 9439 response, the applicant stated that the nuclear parameters were calculated from CASMO5 (i.e., the applicants lattice physics analysis method). The RAI 9439 response is more consistent with the Stability TR, which refers to lattice physics calculations as being the source of the nuclear parameters. The response to RAI 9439 is also consistent with the response to RAI 9097, Question 01-43, dated November 17, 2017, (ADAMS Accession No. ML17321B078) which identifies the source of the nuclear data as CASMO5 calculations.

In the response to RAI 9439, the applicant conceded that the information appears contradictory but asserts that use of CASMO5 or SIMULATE5 is equivalent. The applicant further asserted that the only difference between using CASMO5 and SIMULATE5 results is bookkeeping. The staff disagrees with the applicants assertions that CASMO5 and SIMULATE5 are equivalent.

The applicant described one key difference in the original RAI 8802 response, which is that SIMULATE5 would be capable of accounting for the moderator temperature effect implicitly, whereas CASMO5 would not. Therefore, despite the explanation provided in response to RAI 9439, the applicant has previously stated, and the staff agrees, that a SIMULATE5-based approach would be different from a CASMO5-based approach. Further, there are at least two physical processes that the CASMO5/SIMULATE5 code system can treat that CASMO5 alone cannot.

First, CASMO5/SIMULATE5, when coupled, will be able to calculate the water temperature and density for a given power level in the reactor and, given sufficient branching of the cross sections, would be able to calculate the change in the core multiplication factor in response to changes in both the moderator density and temperature. The CASMO5 calculations described in the responses to Question 01-43 of RAI 9097 and RAI 9439 cannot account for the temperature effect.

Second, CASMO5/SIMULATE5, when coupled, is able to calculate the axial buckling that occurs as a result of axial variation in fuel loading, such as enrichment cutbacks, enrichment zoning, burnable absorber loading variations, and other aspects of the fuel design that may have some axial variation, as well as axial buckling as the result of neutron leakage at the axial extrema of the reactor core. CASMO5 is an inherently two-dimensional methodology and cannot account for these effects.

In its responses to RAI 9439 and RAI 9097, Question 01-43, the applicant stated that the reactivity coefficients are calculated by performing [

] However, the NRC staff has not previously reviewed this feature for application to safety analysis. Although the RAI 9439 response does mention SIMULATE5, the staff concludes that SIMULATE5 was not used in the generation of the nuclear data. The staff believes that the RAI 8802 response is incorrect in its description of the methodology.

39 Therefore, the staff has determined that the responses to RAI 9439 and RAI 9097, Question 01-43, supersede the response to RAI 8802.

Because the staff has not [ ] feature to perform the requisite calculations to determine reactivity feedback nuclear parameters and because this methodology cannot model all of the relevant physical processes (e.g., temperature effect and axial buckling),

the staff imposes the condition that the kinetics data must be confirmed against calculation results from an NRC-approved nuclear design methodology.

While the staff has not found that CASMO5 can produce an acceptable representation of the nuclear data without being coupled to a code such as SIMULATE5, the staff must differentiate between the use of CASMO5 in the stability analysis for licensing purposes and for demonstration analysis purposes. The Stability TR provides analyses to demonstrate the stability solution for a representative NuScale module design and core design using the CASMO5-based approach for computing the nuclear data. Per the Stability TR, the applicant states that the analyses must be re-performed to support licensing of the design and, in certain cases, for reload licensing purposes. For the purpose of reviewing the LTS solution and the analysis methodology scope and procedures the staff relies on the demonstration analyses provided in the Stability TR. These demonstration analyses were performed using the CASMO5-alone approach to generate the nuclear data and the staff separately considered whether this approach would be acceptable for the purpose of reviewing the demonstration analyses.

The staff notes that CASMO5 is used as part of the nuclear design methodology which was reviewed by the NRC (see ADAMS Accession No. ML18348B036) and can be expected to produce results that are at least representative for NuScale. Further, while not capturing all of the physical processes, the feedback calculated by PIM using the applicants current method could be expected to represent, at least to the first order, the behavior of a hypothetical NuScale power module. To that end, and for the current purpose of reviewing the demonstration analyses, the staff finds that the calculations described in the Stability TR using the current coefficients remain valuable in demonstrating the LTS solution principle (i.e., the acceptable function of the MPS protective trip to enforce the exclusion region) on a generic basis.

However, the staff cannot conclude that these parameters will remain applicable to an actual NuScale power module core loading. The analyses must be shown to apply or to conservatively bound any cycle-specific core design. Therefore, the staff imposes the following condition.

Kinetics Parameters Condition An applicant or licensee referencing the Stability TR shall, on a cycle-specific basis, either: (1) confirm that the delayed neutron fraction, decay constant, and prompt neutron lifetime assumed in the reference PIM safety analysis are conservative relative values calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) reperform the PIM safety analysis with user-defined values for the delayed neutron fraction, decay constant, and prompt neutron lifetime that results in values equivalent to those predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) reperform the PIM safety analysis with user-defined values for the delayed neutron fraction, decay constant, and prompt neutron lifetime that result in a conservatively bounding set of parameters compared to those as predicted by an NRC-approved nuclear design methodology.

40 Sections 5.6.1.1 and 5.6.1.2 of the Stability TR describe the models for the Doppler reactivity feedback and moderator reactivity feedback, respectively. The Doppler coefficient is defined in terms of an exposure-dependent coefficient (CDopp) that is adjusted by a user-specified multiplier (MDopp). The Stability TR states that values can be explored in the analysis through this user-input multiplier. To this end, the exact values of the coefficient output by the formula for CDopp in Equation 5-77 of the Stability TR are not particularly important because the user can control the value of the coefficient through the multiplier. Earlier in Section 5.6.1, the Stability TR states that the reactivity feedback components can be obtained from fitting CASMO5 lattice code calculation results. The approach of fitting the lattice calculation results seems reasonable to the staff on the basis of engineering judgment. Similarly, it would also appear reasonable to the staff to likewise fit results generated from a nuclear design analysis (such as the results from the design control document, Chapter 4).

However, the staff considers the Doppler coefficient values currently used to be generic, stand-in values for the purpose of performing the demonstration analyses reported in Sections 8 and 9 of the Stability TR at the design stage. The applicant or licensee referencing the Stability TR must perform a cycle-specific analysis on the basis of the actual core loading to determine appropriate values for the MDopp. Further, the Stability TR is not clear on how the operating conditions are considered. One aspect of the demonstration analysis in Section 8 of the Stability TR is the evaluation of the stability characteristics at various power levels. These changes in power levels will be accompanied by changes in the flow rate and fluid conditions that are likely to affect the neutron spectrum in the reactor core. As such, the values of the feedback coefficients such as the Doppler coefficient are expected to be a function of the steady-state power level condition of interest. Therefore, in RAI 8802, the staff requested additional information on the determination of an appropriate Doppler coefficient, given the initial power level in the analysis.

As stated above, the responses to RAI 9097, Question 01-43 (ADAMS Accession No. ML17321B078), and RAI 9439 (ADAMS Accession No. ML18152B881) supersede the response to RAI 8802 (ADAMS Accession No. ML17228A249). The applicant provided the conditions analyzed to determine the Doppler reactivity in the response to RAI 9439. [

] Therefore, the staff finds the functional form of the Doppler coefficient fit is appropriate and applicable to the range of application.

The default values for the Doppler reactivity feedback in the Stability TR (and the associated analyses) can be referenced only if the Doppler coefficient assumed in the Stability TR analysis

41 is conservative (i.e., smaller in magnitude) compared to the cycle-specific and power-level-specific value determined according to an NRC-approved nuclear design methodology. When the reference analyses are not bounding, a cycle-specific analysis can be performed in which the user-input MDopp is adjusted to match the cycle-specific analysis values for the Doppler feedback coefficient or is adjusted to achieve a new conservatively bounding value. In Section 10.2A, the Stability TR concedes a similar point; however, the description in Section 10.2 refers only to the MTC. In addition, the staff notes that the coefficient applied in the Stability TR is generated using the CASMO5 MxN feature instead of an NRC-approved method. Therefore, the staff requires, on a cycle-specific basis, that the Doppler coefficient be verified against NRC-approved methods by an applicant or licensee referencing the Stability TR.

The Doppler coefficient condition imposed by the staff is as follows:

Doppler Reactivity Coefficient Multiplier Condition An applicant or licensee referencing the Stability TR shall, on a cycle-and power-level-specific basis, either: (1) confirm that the Doppler coefficient assumed in the reference PIM safety analysis is conservative relative to the Doppler coefficient calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) re-perform the PIM safety analysis with a user-defined Doppler coefficient multiplier that results in a Doppler coefficient equivalent to that predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) re-perform the PIM safety analysis with a user-defined Doppler coefficient multiplier that results in a conservatively bounding (i.e., smaller in magnitude) Doppler coefficient compared to the Doppler coefficient predicted by an NRC-approved nuclear design methodology.

Section 5.6.1.2 of the Stability TR describes the moderator feedback calculation in PIM. In a manner similar to the Doppler coefficient, the methodology weighs the MDC according to cycle exposure between the beginning-and end-of-cycle (BOC and EOC) values. The overall worth is adjusted by a user-defined multiplier (MMD) in a manner similar to the Doppler coefficient. The primary difference is the functional form of the worth. Whereas the Doppler worth is computed according to the difference in the square root of the temperature, the methodology applies the density in a polynomial expression to determine the reactivity effect. The applicant provided the polynomial curves by a series of coefficients in Section 5.6.1.2.

In RAI 9097, Question 01-43, the staff asked the applicant for additional details on the polynomial fits, particularly whether the fits are fuel-design specific. In the response to RAI 9097, Question 01-43, the applicant stated that the reactivity coefficient polynomial fits were generated for a representative fuel design and are not intended to be fuel-design specific (ADAMS Accession No. ML17321B078). For DR calculations, which maintain conditions near the steady-state condition, the staff finds that the specifics of the fits are not as important as applying the user-defined multiplier in the methodology to ensure that PIM safety analyses are performed with a conservatively bounding MDC. Since negative feedback is stabilizing for the power module, the analyses must consider the most limiting (i.e., most negative) MDC for any given core loading (or a conservatively bounding value). The applicant and the staff agree on this point, as described in Section 10.2 of the Stability TR.

The Stability TR appears to conflate the reactivity effects of changes in moderator density with the reactivity effects of changes in moderator temperature. Approaches that combine these two reactivity effects into a single coefficient are commonly used. Such an approach is acceptable,

42 but it is not clear from the Stability TR whether these two effects are considered in the polynomial fitting process. Therefore, in RAI 8802, the staff requested additional information on the moderator temperature effect. In the response to RAI 8802, the applicant stated that SIMULATE5 results are used to determine the MDC and that the temperature effect would be effectively combined with the density coefficient (ADAMS Accession No. ML17228A249). The staff agrees with the applicants assertion (i.e., that the temperature effect would be effectively combined with the density coefficient); however, the RAI 8802 response is inaccurate in that SIMULATE5 is not used to determine the reactivity feedback coefficients according to the response to RAI 9439 (ADAMS Accession No. ML18152B881). In the response to RAI 9439, the applicant described CASMO5 MxN calculations that were performed to derive the MDC polynomial fit. The staff reviewed these calculations and determined that the calculations ignored the moderator temperature effect.

Therefore, in RAI 9578, the staff requested clarification of the methodology for providing upstream nuclear data to PIM. In its December 18, 2018, response to RAI 9578, the applicant clarified how other nuclear kinetic parameters were computed for use in PIM (ADAMS Accession No. ML18352B366). On the basis of the information provided by the applicants response and its own engineering judgment, the staff found the applicants methods reasonable.

In addition, the response confirms that nuclear data supplied to PIM will be generated with NRC-approved nuclear design methods and states that Studsviks Core Management System 5 (CMS5) will be used in practice to provide nuclear data. The staff noted some deficiencies in the use of CASMO5 to provide the kinetics data (namely, that the CASMO5 method ignored axial buckling and the moderator temperature effect). These effects, however, are inherently treated in a core simulator code, such as SIMULATE5 or CMS5. Further, the staff notes that the nuclear data are confirmed on a cycle-specific basis according to the Stability TR and the RAI 9578 response. The staff finds this approach acceptable if the nuclear parameters are calculated on a cycle-specific basis using an NRC-approved core simulator code and not based solely on the lattice physics calculations. The staff agrees with the applicants response that generic values for certain kinetics parameters can be embedded in the PIM method, but only if the nuclear parameters are confirmed on a cycle-specific basis. Therefore, the staff imposes the following condition on the cycle-specific confirmation of the nuclear kinetic parameters:

Core Simulator Nuclear Data for Cycle-Specific Confirmation or Reanalysis Condition On a cycle-specific basis, when the licensee or applicant referring to the PIM stability analysis methodology is either confirming the nuclear kinetics parameters or generating new nuclear kinetics parameters for analysis, the licensee or applicant shall generate those nuclear kinetics parameters using an NRC-approved core simulator code.

The staff notes that the results presented in the Stability TR to demonstrate the effectiveness of the LTS solution are based on calculations using nuclear kinetics parameters generated from the lattice physics code CASMO5. As stated above, this method, as described in the applicants RAI 8802, RAI 9439, and RAI 9578 responses (ADAMS Accession Nos. ML17228A249, ML18152B881, and ML18352B366, respectively), ignores axial buckling and the moderator temperature effect. These are second-order effects compared to the radial buckling and moderator density effect. Therefore, even though the impact of these effects has not been quantified, the staff is confident that these effects will not be sufficient to substantially change the general conclusions of the analysis presented in the Stability TR. Therefore, the staff finds that the current analysis is acceptable for generally demonstrating the principle of the operation

43 of the LTS solution. However, on a cycle-specific basis, the nuclear parameters will be evaluated, and the applicability of the generic analysis will be confirmed, or the analysis will be reperformed using appropriate nuclear parameters. On this basis, the staff finds that any deficiencies in the method based on lattice physics used for the Stability TR demonstration analyses will not apply to any applicant or licensee referencing the LTS solution and associated analysis methodology.

The Stability TR does not address the potential for the moderator feedback to be sensitive to the power level. As for the Doppler reactivity coefficient, operation at various power levels will affect the core flow rate and fluid condition, resulting in spectral changes at various power levels, which would likewise affect the magnitude of the MTC or MDC. Because it was unclear how the methodology addresses power-level dependence, in RAI 8802, the staff requested additional information about the power-level dependence. The applicants response (ADAMS Accession No. ML17228A249) to RAI 8802 did not accurately reflect the analysis methodology and was superseded by the response to RAI 9439 (ADAMS Accession No. ML18152B881).

In RAI 9439, the applicant described how the moderator density reactivity coefficient is derived from CASMO5 MxN calculations performed at a variety of moderator densities. The moderator density was adjusted independent of temperature and covers a [

] The highest density certainly covers the expected operating conditions down to low power. The maximum density required for analysis would be consistent with cold conditions at pressure, which is consistent with the conditions experienced during reactor startup. The lower density [ ] should bound any expected thermal-hydraulic conditions encountered during PIM transient calculations at least through the range of analysis up to the point of instability, which would generally occur with relatively low void fraction in the riser (and hence low core exit void fraction). Assuming a 20-percent void fraction (which is within the void fraction analyzed in the limiting AOO according to the RAI 8921 response (ADAMS Accession No. ML17268A387)) and a density at high pressure (e.g., 1,850 pounds per square inch atmospheric (psia)), the minimum density would be about 0.5 g/cc, which is within the range analyzed by the applicant. A high-order polynomial fit is used to fit the reactivity between these conditions, which is an acceptable method to account for the nonlinear dependence.

Unlike the Doppler reactivity, the moderator density takes the axial adjoint distribution into account. Equation 5-81 in the Stability TR combines the nodal values with a normalized flux profile according to a neutron-flux squared weighting. The staff requested clarification in RAI 9097, Question 01-44, of why the user supplies the axial power distribution but not the flux distribution. The applicant clarified in the response to RAI 9097, Question 01-44, that the weighting is based on the axial power distribution (ADAMS Accession No. ML17321B078). The staff finds that the approximation made by using power instead of flux is reasonable for the current application purposes using a relatively simple analysis method, such as PIM. In fact, the staffs TRACE code includes a similar weighting scheme for use in calculating point kinetics transients (TRACE V5.0, Theory Manual, issued June 2008 (ADAMS Accession No. ML120060218)).

The staff agrees with the Stability TR that the moderator density feedback tends to be stabilizing. In instances where the MTC might be positive, the staff agrees that this could be destabilizing. Early in the cycle, the high boron concentration could contribute to a slightly positive MTC under certain conditions. Section 10.2 of the Stability TR states that the current demonstration analyses described in Sections 8 and 9 of the Stability TR assume a positive

44 MTC, which the staff agrees is the limiting condition from the standpoint of stability. Further, the staff agrees that analyses would have to be re-performed if the MTC or the MDC is outside of the envelope analyzed in the Stability TR. The staff also notes that the coefficient applied in the Stability TR is generated using the CASMO5 MxN feature instead of an NRC-approved method.

Therefore, the staff requires on a cycle-specific basis that the MDC be verified against NRC-approved methods and imposes a condition for the MDC that is analogous to the Doppler coefficient, as shown below:

Moderator Density Coefficient Multiplier Condition An applicant or licensee referencing the Stability TR shall, on a cycle-and power-level-specific basis, either (1) confirm that the MDC assumed in the reference PIM safety analysis is conservative relative to the MDC calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) reperform the PIM safety analysis with a user-defined MDC multiplier that results in an MDC equivalent to that predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) reperform the PIM safety analysis with a user-defined MDC multiplier that results in a conservatively bounding (i.e., more negative) MDC compared to the MDC predicted by an NRC-approved nuclear design methodology.

Section 5.6.2 of the Stability TR describes the decay heat model. The decay heat model is greatly simplified in that PIM assumes a constant power contributed by decay heat throughout the calculation. The simplified approach is acceptable because the reactor tends to be stabilized by stronger feedback in the core. Holding the decay heat power level constant effectively damps feedback from decay heat (even though this mechanism is relatively slow compared to the dynamic timeframe of interest). Overall, the approximation would produce reasonable, although probably slightly conservative, results so long as the decay heat power fraction is properly determined at the start of the calculation.

Section 8.2.2.2 of the Stability TR refers to decay heat sensitivity calculations but does not clearly define how the decay heat power level is properly specified by the PIM user to perform safety analyses. During startup operations, the decay heat power levels will be lower than those calculated according to steady-state nuclear design methods. Conversely, the decay heat power levels during shutdown or down-power operations (as may occur during load-follow) will be higher than those predicted by steady-state nuclear design methods. In RAI 8873, the staff requested clarification of how an appropriate fraction of power is determined for the decay heat power level.

In its August 18, 2017, response to RAI 8873, the applicant described how a conservative decay heat fraction can be determined with respect to Doppler reactivity coefficient (ADAMS Accession No. ML17234A748). Because the Doppler reactivity feedback is always stabilizing, the effect of the Doppler feedback can be minimized in a sensitivity calculation by assuming a large decay heat fraction. The applicant clarified in its response to RAI 8873 that in the specific case in the Stability TR, the decay heat fraction was calculated by assuming constant operation at nominal power levelcalculating the decay heat at this power levelthen maintaining that amount of decay heat but at a lower total power level. This has the effect of increasing the decay heat fraction. In this particular instance, the staff finds that this methodology is appropriate because the reactor could operate at its highest power level before any down-power maneuver. Further, since Doppler feedback is stabilizing and assuming a higher decay heat fraction reduces Doppler feedback, this approach would conservatively account for operational

45 flexibility in the stability analysis. However, the applicant did not describe how this decay heat fraction is calculated generally as a part of its analysis methodology. Also, the above discussion applies to Doppler feedback, as well as to negative moderator temperature feedback, but there may be conditions early in the cycle at lower power levels where the moderator temperature feedback is positive. Under the condition of a positive MTC, it would be conservative to minimize the decay heat fraction because the reactivity feedback would be destabilizing.

Therefore, although the methodology applied in the specific instance described above is acceptable, it becomes inadequate when considering the general case.

For a general case, the decay heat fraction specified must conservatively bound operational flexibility, while at the same time considering that the moderator reactivity feedback coefficients may be either positive or negative.

In its September 17, 2018, supplement to the RAI 8873 response (ADAMS Accession No. ML18260A378), the applicant provided a revision to Section 10.4 of the Stability TR. This revision describes the calculation process for determining the conservative decay heat fraction for stability-related confirmatory analyses. [

]

[

] Therefore, the staff finds the approach acceptable.

Section 5.6.4.1 of the Stability TR refers to the direct energy deposition factor in the description of the pellet heat transfer model, and Section 5.6.3 describes the cylindrical condition model.

However, these sections do not clearly state how the PIM models treat direct energy. In RAI 8872, the staff requested additional information on direct energy deposition. The staff asked the applicant to clarify the methodology in terms of how neutron and gamma heating is computed, whether these factors are fuel-design specific, and how these factors are incorporated in the overall methodology. On August 23, 2017, the applicant responded to RAI 8872 by (1) confirming that the direct energy deposition is weighted by the liquid volume fraction and (2) stating that the direct energy deposition fraction is much less important in the analysis of NuScale power module stability than in the analysis of BWR stability (ADAMS Accession No. ML17235B179). As to the first point, the staff agrees that this approach is appropriate because it captures the inherent effect that energy deposition is related to density.

As to the second point, the staff agrees with the applicant. In an independent PIRT (ADAMS Accession No. ML17033A144), the staff concluded that these phenomena are of low importance, so the approach for determining these fractions and applying them in the analysis can be simplified, and the use of approximate values is acceptable. The Stability TR reports a direct energy deposition fraction of 0.026 as being typical for PWRs. The staff finds use of this value acceptable for the current analysis purpose, which is to demonstrate the effectiveness of the LTS solution.

46 However, the applicant did not describe the process for selecting a value for licensing calculations as requested by the staff in RAI 8872. Licensing calculations may be performed by licensees for cycle-specific reloads using PIM according to the Stability TR methodology.

The response appears to indicate that using a value of 0.026 is acceptable to the applicant but the Stability TR does not commit to utilizing this value in future licensing calculations. While the precise value of the direct energy deposition fraction should not have a significant impact on the stability analysis, it is prudent to use a reasonable value for the direct energy deposition fraction.

For example, the staff does not expect that using an extreme value of 1.0 would significantly change the conclusions of the current analysis but utilizing a pathological value in the calculations could be expected to produce results that are contrary to expectations based on the actual physical processes. As an example, incorrectly inputting an artificially high direct energy deposition fraction would significantly distort the calculation of thermal margin in the nonconservative direction (the staff notes that the thermal margin is an ancillary result of the PIM calculations). Therefore, the staff imposes the following condition on the selected value of the direct energy deposition fraction:

Direct Energy Deposition Fraction Limitation Any COL applicants or licensees referencing the Stability TR that use PIM for licensing calculations shall either specify a value for the direct energy deposition fraction that is 0.026 or specify an alternative, reasonable value based on the results of calculations performed using NRC-approved nuclear design methods.

3.2.3 Conduction Models The cylindrical heat conduction model is necessary to model the transfer of heat from the fuel through the fuel heat structure to the coolant and likewise to model the transfer of heat through the SG tubes from the primary to secondary side. Section 5.6.3 of the Stability TR describes the cylindrical conduction model. Section 5.6.4 of the Stability TR describes the fuel rod heat conduction model. In addition to calculating the transient cladding surface heat flux, the fuel rod conduction model computes the fuel temperature that is used to drive the Doppler temperature feedback calculation.

The cylindrical conduction model is very straightforward and can be used to predict the heat conduction for the SG tubes, if appropriate material properties are assumed. In RAI 9098 the staff requested clarification of the radial nodalization of the SG tubes and justification of the nodalization scheme adopted. In its response to RAI 9098, dated November 6, 2017, the applicant stated that four nodes are used (ADAMS Accession No. ML17310B545). The number of nodes used in the SG tube model matches the number of nodes used in the fuel rod model, and the applicants rationale for the nodalization is the same for each. As discussed at greater length later in this section, the nodalization is appropriate because of the short time scale of heat transfer across these elements compared to the time scale of the flow oscillation period.

This difference in the time scale means that a coarser model could likely have been adopted and would have yielded nearly identical DR results.

The fuel rod heat conduction model expands on the cylindrical conduction model and includes models for the pellet, gap, and cladding heat transfer. The calculations are based on [

] that is used to determine the core average parameters in terms of heat flux and fuel temperature. Since the staff agrees that three-dimensional effects inside the core are of low

47 importance (ADAMS Accession No. ML17033A144), the approach of using average quantities is acceptable for performing the stability analyses.

In RAI 9098, the staff asked the applicant to provide the radial nodalization for the fuel cladding conduction model. In its response to RAI 9098, the applicant stated that a lumped parameter model would have likely been sufficient, but this was not known during the code development process, and the applicant adopted a four-node model out of expediency (ADAMS Accession No. ML17310B545). A four-node approach is used for both the SG tubes and the fuel rod. The RAI 9098 response provides a series of sensitivity calculations that vary the gap conductance.

The purpose of the sensitivity calculation is to demonstrate that large changes in the calculated fuel thermal time constant do not significantly affect the calculation of the DR.

Results presented at 20- and 100-percent power show only a small impact on the flow response to a perturbation, which indicates that each calculation would produce essentially the same DR result. This result makes sense because the time scale of conduction (measured in seconds) is small compared to the period of the oscillations (measured in minutes). The sensitivity can, therefore, be expected to be smaller at lower power levels where the period is longer. Because the magnitude of the effect of varying the gap conductance over the range provided in the RAI response would bound any impact from increasing or decreasing the number of nodes on the fuel time constant, the staff finds that the applicants rationale is acceptable to justify the current nodalization scheme. While no sensitivity results are provided for the SG tubes, the staff agrees with the applicant that the same rationale applies. Therefore, the nodalization scheme is acceptable.

PIM determines the transient heat flux by calculating the pellet heat flux using the heat generation rate (which is derived from the kinetic response) and a fuel pellet time constant that is based on the pellet material properties. In various analyses, the applicant has demonstrated that the thermal inertia of the fuel has a very small effect on the stability performance. The long flow transient time and oscillation period, compared to the fuel thermal time constant, explain why the results are largely insensitive. The staff reviewed the parameter values assumed for the fuel parameters listed in the response and concluded that these values are reasonable for the NuScale reference fuel design and are therefore appropriate for the stability analysis.

Further, even though these parameters are exposure dependent, the staff finds that using constant values is an acceptable approximation because of the mild sensitivity of the DR to these parameters.

Section 5.6.4.3 of the Stability TR describes the method for calculating the pellet temperature based on the heat flux and the gap conductance. The method is predicated on the pellet heat flux being equivalent to the heat flux on the cladding inside surface; however, the fuel thermal time constant does not account for the thermal resistance of the gap. The staff requested clarification in RAI 9104, Question 01-46. The applicant stated in its RAI 9104 response, dated September 17, 2018, that the time constant refers only to the pellet and that the effect of gap conductance is separately captured (ADAMS Accession No. ML18260A383). The gap conductance is provided as a user input to the PIM calculation. The applicant stated that the response to RAI 9098 provides the results of sensitivity calculations that demonstrate that the effect of gap conductance over a wide range on the DR is relatively small. The sensitivity calculations that the applicant provided in the RAI 9098 response demonstrate a small sensitivity of the DR to gap conductance over [

] (ADAMS Accession No. ML17310B545). The applicant also explained in the RAI 9098 response that the insensitivity stems from the large difference in time scale between the heat

48 conduction (seconds) and the oscillation period (minutes); the staff agrees with the applicants assessment. Therefore, the staff finds that the PIM approach can be used if the user specifies a reasonable gap conductance.

The RAI 9104 and RAI 9098 responses are ambiguous on the assumed value, but the PIM input deck provided as a supplement to the Stability TR indicates that the analysis used a value of [

]. The staff finds this acceptable. However, for any future licensing calculations performed using the methodology, which may be required on a cycle-specific basis as part of the reload licensing process, the staff requires that a reasonable value of the gap conductance be used.

An unreasonably low value could result in a nonphysical but large fuel thermal time constant, which could distort the analysis results. While DR is insensitive over a normal range of gap conductance, the user must not input unreasonable values far outside of the range evaluated by the applicant.

In its September 17, 2018, supplement to the response to RAI 9104, the applicant further clarified the gap conductance (ADAMS Accession No. ML18260A383). The gap conductance varies over a range from [ ]. The staff reviewed these values and concludes that they cover a reasonable range for fuel gap conductance. The response also provides revisions to the Stability TR to clarify that the gap conductance values shall be within this reasonable range or, alternatively, produced from an NRC-approved fuel thermal-mechanical analysis method. While review of the applicants thermal-mechanical analysis method (COPERNIC) is outside the scope of the current review, the staff finds it acceptable to use values generated by such a method if the NRC has separately reviewed and approved that method. Given the range of values listed in the revised Stability TR and to the statement in the revised Stability TR that alternate values must be generated using an NRC-approved method, the staff finds that the gap conductance model is acceptable.

Section 5.6.4.4 of the Stability TR describes how PIM calculates the temperature for use in evaluating the Doppler reactivity. The Doppler temperature is based on a weighted average of the calculated pellet surface and centerline temperature. This approach is relatively common in computing the Doppler reactivity feedback, and a similar method is employed in the staffs own TRACE/Purdue Advanced Reactor Core Simulator (PARCS) codes. In RAI 8808, the staff requested additional information about the weighting factor. In its July 26, 2017, response to RAI 8808, Question 29741, the applicant provided the exposure dependent parameter a but did not describe the temperature weighting factor (ADAMS Accession No. ML17207A905).

Therefore, the staff requested additional information in a supplemental RAI (RAI 9440, Question 15.09-2).

In its May 17, 2018, response to RAI 9440, Question 15.09-2, the applicant provided additional clarification (ADAMS Accession No. ML18137A618). The applicant gave references in the literature to different temperature weighting factors confirming that a value of 0.85 is within the range used for similar analyses. On this basis, the staff agrees that the value is reasonable.

Furthermore, the applicant performed sensitivity calculations to demonstrate that varying the value between [ ] has essentially no impact on the stability results. The insensitivity is expected because the oscillation period is much longer than the fuel thermal time constant.

Therefore, the staff finds that the value used in the current analysis is acceptable.

PIM computes the average pellet temperature by averaging the values of the surface and centerline temperature. PIM uses this average temperature to compute the temperature-dependent fuel pellet properties, such as thermal conductivity. Because the method relies on core average quantities to determine the average heat flux and temperature, in

49 RAI 8808, Question 29742, the staff requested clarification of how distributed core quantities (such as the burnup distribution) are used to determine the appropriate fuel thermal conductivity, which is dependent on fuel exposure.

The applicant responded to RAI 8808, Question 29742, by stating that the core average exposure is used to calculate the conductivity using Equation 5-109 of the Stability TR (ADAMS Accession No. ML17207A905). The applicant stated that the use of the conductivity is limited in the methodology as it is used only to compute the Doppler reactivity feedback. The applicant then discussed how multiple exposures were evaluated and the effect of different exposures was minor. The staff is not certain of this assertion because the change in the cycle exposure affects other nuclear parameters, most notably, the MDC (or MTC). The change from BOC to EOC in the MDC can be expected to have a much larger effect on the stability performance than the change in Doppler coefficient over the same exposure range. Therefore, it is difficult to determine the impact on the stability performance attributable only to the change in the Doppler feedback arising from a difference in the core average exposure. However, because the MDC effect is more significant, the staff finds that using an average temperature for calculating the Doppler feedback in the point kinetics methods is acceptable. The applicants approach is reasonable for such an analysis, and therefore, the staff finds this acceptable.

The PIM method calculates the cladding surface heat flux by calculating a heat transfer coefficient according to the Dittus-Boelter correlation. This approach is widely used and is appropriate for pre-CHF heat transfer calculations.

The staff finds the heat conduction models to be acceptable. However, the staff notes that the application must be limited to pre-CHF heat transfer because the models are not capable of treating degraded heat transfer on the outer cladding surface and implicitly ignore heat transfer phenomena that may become important in post-CHF regimes, such as radiative heat transfer and axial conduction. While the method is not required to analyze these conditions for the purpose described by the Stability TR, for clarity, the staff explicitly imposes the following limitation:

Pre-CHF-Only Limitation The staffs approval of the PIM stability analysis method covers only pre-CHF heat transfer. PIM is not approved to analyze conditions of post-CHF heat transfer.

As needed, an applicant or licensee referencing the Stability TR may demonstrate that the analysis conditions predicted by PIM remain in the pre-CHF regime by analyzing the same thermal-hydraulic conditions using an NRC-approved transient analysis method capable of predicting thermal margin and approved by the NRC for that purpose.

The PIM methodology calculates heat conduction only for the fuel rods and the SG tubes.

However, in RAI 9019, the staff requested that the applicant evaluate the impact of heat conduction and other heat deposition and heat transfer mechanisms in the riser component. In the response to RAI 9019, dated September 28, 2017, the applicant described the effect of conduction through the riser wall on riser temperature (ADAMS Accession No. ML17271A332).

The applicant stated that the conduction through the riser wall is [

]. This temperature difference was considered along with other mechanisms that can affect riser temperature, namely, the decay of control rod activation products and heat deposition from the condensation of subcooled boiling voids in the riser. These mechanisms

50 affect the riser temperature, but the impact of all of them is small compared to the effect of core power and core temperature rise. Nevertheless, the applicant performed a simplified analysis using the ROM to show that the trend of riser cooling by conduction is expected to have a stabilizing effect. The staff agrees that riser cooling by conduction would produce a feedback that limits the amplitude of a flow perturbation to the out-of-phase component (which is the integrated riser density) and would act as a stabilizing feature. The applicant stated in the response that, while PIM does not treat these mechanisms, (1) they are small and (2) neglecting them is conservative. The staff agrees with the applicants analysis and therefore finds that the RAI response is adequate in demonstrating that heat conduction modeling for the riser wall is not necessary in PIM.

On the basis of the above discussion, the staff finds that the PIM conduction models are acceptable.

3.2.4 Steam Generator Model Modeling the SG in PIM can be divided into four major areas: tube conduction, primary-side heat transfer, secondary-side flow, and secondary-side heat transfer. Section 3.2.3 of this report discusses tube conduction modeling in the SG. This section describes the staff review of the remaining areas.

The PIM modeling is a one-dimensional method based on calculation of the average SG tube performance. The staff considered phenomena that could occur as a result of asymmetric loading in the SG tubes. The staff considered this for NuScale power module stability and determined such effects to be of medium importance in its independent PIRT (ADAMS Accession No. ML17033A144). In determining this importance ranking, the staff considered that the imbalanced operation of the two SGs could affect the heat transfer patterns and flow regimes on the secondary side. The SGs are intertwined, and therefore, an asymmetric loading on the SG does not inherently produce any discernible effect on the primary sidein essence, two SGs operating at 100 percent each would be indistinguishable from one SG operating at 200-percent heat removal, in terms of the primary flow. The staff considered that possible asymmetries would be limited to a smooth azimuthal gradient that could appear over a length limited by the pitch between tube centers, which would be small compared to the axial height of the downcomer. However, plugging could result in asymmetric loading that would result in one SG bearing more of the heat removal burden than the other, resulting in a difference in the average boiling length for the more heavily burdened SG. In that case, one of the SGs may become more susceptible to Ledinegg or density-wave instability owing to the difference in average heat load. The asymmetric loading of SGs is typical in PWR operation. However, as discussed in Section 3.1.1.4 of this report, secondary-side instability is not expected to affect power module stability. Therefore, PIM is not required to analyze multiple SG tubes to represent the two SGs.

Appendix A to the Stability TR and the TR Supplement discuss parallel channel effects associated with the SG tubes within a single SG. Section 3.1.1.4 of this report addresses the issue of parallel channel effects, but in summary, the staff did not find them to have a significant impact on the stability performance of the NuScale power module. Therefore, PIM is not required to analyze multiple SG tubes for stability calculations.

Primary-Side Heat Transfer

51 PIM calculates the primary-side heat transfer coefficient according to the correlation in Equation 5-44 of the Stability TR and correlation coefficients taken from NRELAP5 documentation. The applicant stated that the correlation coefficients are controlled by user input, and other values may be applied based on the results of testing. Since the heat transfer correlation is based on the NRELAP5 model (ADAMS Accession No. ML17004A202) dated December 30, 2016, the staff defers the review of this correlation to the review of NRELAP5.

The staff is currently reviewing NRELAP5 for application to LOCA analysis (ADAMS Accession No. ML17004A202). The staff noted that the PIM model description in Section 5.5.3 of the Stability TR does not appear to agree with the NRELAP5 theory manual in terms of the shell-side correlation. Furthermore, in the response to RAI 8846, Question 01-21, the applicant provided the same correlation shown in Section 5.5.3 and stated that the same correlation is used in the NRELAP5 model (ADAMS Accession No. ML17271A256). Therefore, in RAI 9136, Question 01-51, the staff requested clarification of the shell-side heat transfer correlation.

In its response to RAI 9136, Question 01-51, dated January 2, 2018, the applicant clarified the differences between the PIM shell-side heat transfer coefficient correlation and the NRELAP5 shell-side heat transfer coefficient correlation (ADAMS Accession No. ML18002A610). Both appear to fundamentally use the same heat transfer correlation for the tube bundle based on the Engineering Science Unit (EDSU) 1973 correlation. This correlation is provided in Section 5.5.3 of the Stability TR. However, the correlation is not implemented in the same way in NRELAP5.

In NRELAP5, the reference flow area is different, and the EDSU heat transfer coefficient is combined with the heat transfer coefficient from Dittus-Boelter. Therefore, fairly substantial differences are evident between the NRELAP5 heat transfer model for the shell side and the PIM shell-side heat transfer model.

The applicant noted in its response to RAI 9136, Question 01-51, however, that the initial heat transfer is adjusted according to a factor so that the initial conditions between PIM and NRELAP5 are in agreement. This initialization and adjustment procedure is the subject of the staffs RAI 9443, which is discussed in greater detail later in this section. Briefly, the heat transfer from the primary to secondary side in PIM is tuned by an adjustment factor during the steady-state initialization so that PIM and NRELAP5 predict the same primary-side fluid conditions and primary-to-secondary-side heat transfer.

In the response to RAI 9136, Question 01-51, the applicant stated that the NRELAP5 model has been validated against experimental data, in particular the SIET-TF2 test data. The staff did not review the NRELAP5 validation as part of this Stability TR review. However, the approval of PIM for stability analysis is inherently contingent on the staffs approval of NRELAP5 as the NRELAP5 steady-state calculations form an element of the PIM calculation methodology.

Given that clarification, the staff finds that tuning the heat transfer at steady-state conditions ensures that the base heat transfer under steady-state conditions is acceptable because the process ensures that the results are consistent with the validated model.

The more complicated matter arises when PIM is used to evaluate the transient heat transfer.

PIM uses the EDSU correlation and does not perform the same adjustment as NRELAP5 (NRELAP5 combines the EDSU correlation with the Dittus-Boelter correlation heat transfer coefficients [ ]). Therefore, during the transient calculation, PIM will evaluate a change in the heat transfer coefficient arising from changing primary-side flow conditions based on the functional dependence of the EDSU correlation, whereas NRELAP5 (which is the validated model) combines the effect of the EDSU dependencies with those from Dittus-Boelter. The applicant provided sensitivity calculations with PIM. In one calculation, the primary-side heat transfer is based on EDSU, and in the other calculation, the

52 primary-side heat transfer is based on Dittus-Boelter. The staff agrees with this approach because NRELAP5 combines these two correlations; a result that is consistent with the NRELAP5 model would, therefore, be bounded between these two sensitivity calculations. The results of the sensitivity calculation show that transient results are essentially the same regardless of which model is used. This is largely because of the initial tuning process and because only the change in the heat transfer coefficient is being evaluated by the correlation.

In stability analysis, two types of calculations are performed. Section 3.3 of this report covers those kinds of calculations in more detail, but it is important to distinguish between these two types of calculations in evaluating the primary-side heat transfer model.

First, for DR calculations, the system is perturbed near its steady state. Therefore, the magnitude of the change in the heat transfer is quite small, so the impact of the model difference between PIM and NRELAP5 can be expected to be quite small for these kinds of calculations.

Second, for the transient (AOO) calculations, the system can undergo more dramatic changes during the event. For example, the system may depressurize, which leads to more significant changes in the primary-side flow conditions. These changes may lead to greater changes in, for example, the Re in the SG annulus of the primary side and contribute to larger differences between the PIM and NRELAP5 model results for shell-side heat transfer. However, two factors still limit the overall magnitude of the change in the shell-side heat transfer: (1) the AOO calculations are performed only to demonstrate the timing of the MPS trip, which means that only mild transients that do not result in very rapid MPS actuation are considered, and (2) control system function feedback is ignored (see Section 3.1.1.4 for more discussion of control system feedback). These two factors mean that the AOOs modeled with PIM for stability analysis tend to result in a smaller departure from normal steady-state conditions when compared to AOOs typically analyzed to demonstrate thermal margin (see Section 3.4.3 for more discussion of limiting transients). Therefore, similar to the argument for the DR calculations, because there is not a very significant change in the primary-side conditions (as would result in a rapid trip) and the boundary conditions are maintained fixed (control systems do not provide any feedback), the heat transfer on the shell side will be generally near the heat transfer predicted in the steady state.

Therefore, the staff agrees with the applicants argument that even though the shell-side heat transfer model is different from the NRELAP5 model, because the results are adjusted to match NRELAP5 in the steady state, the PIM calculation results are as acceptable as the NRELAP5 calculation results. For stability analysis, PIM will not capture the same dependence of the primary-side heat transfer on changing thermal-hydraulic conditions on the primary side as in the validated NRELAP5 model. Therefore, PIM calculations of the transient change in primary-side heat transfer can be expected to be less accurate. However, because the range of conditions analyzed by PIM is generally near the steady-state initial condition, both for DR and AOO calculations, the staff concludes that the resulting inaccuracies of the PIM model do not significantly contribute to any error in the PIM-calculated figures of merit.

Secondary-Side Flow The secondary-side model of the SG is [

53

] This approximation is reasonable for the specific case of stability analysis. In the stability analysis, the calculation of the DR depends on calculating the effect of different feedback mechanisms which occur with different dynamic time scales.

Measurements performed during the SIET-TF2 tests, as provided by the applicant in the TR Supplement, indicate that the [

] This timeframe is much shorter than the primary-side transit time ([

]). While the power module period remains higher than the SG period for all power levels, the staff considered the analysis conditions most relevant to stability analysis.

Since the DR margin increases with power and natural period decreases with power, the region of greatest interest from the standpoint of secondary-side instability is the lowest power where there is significant voiding in the secondary system. In cases where the secondary side is cold, the staff considers the approximation reasonable because liquid water is nearly incompressible.

The point of greatest interest is therefore the 20-percent power condition because this is the lowest power level where the feedwater heaters are active. At 20-percent power, the primary-side period is about 60 seconds. Therefore, the dynamic behavior of the secondary side in response to changes in flow or pressure boundary conditions on the SG [

]. Therefore, the approximation of essentially instantaneous flow changes is reasonable in the specific case of analyzing stability relative to steady-state operation.

The staff does not consider that such an approximation for the secondary-side flow response would be reasonable for performing other analyses, such as fast transient calculations to determine thermal margin. The approximation would be valid, however, for slow transients.

Slow transients in this context refer to changes in secondary-side conditions where the time scale of the analysis is such that the quasi-steady approximation is reasonable. The transient calculations described in Section 9 of the Stability TR and discussed in Section 3.4.3 of this report are slow compared to the characteristic time scale of the secondary-side SG tubes, and therefore, the quasi-steady approximation is reasonable for the scope of transient calculations described by the Stability TR.

Secondary-Side Heat Transfer The applicant stated that user input effectively determines the total SG heat removal in PIM, but this approach is not clear to the staff based on the Stability TR. Therefore, in RAI 9443, the staff requested additional information on the process for specifying these inputs.

In its May 17, 2018, response to RAI 9443, the applicant explained that the user has several options in the PIM code for modeling the SG (ADAMS Accession No. ML18137A607). In the PIM stability analysis methodology, only the input steam generator type [( )] option is used for licensing. In this method, the detailed heat transfer models described by the topical report are used to compute the heat transfer coefficients, but the SG heat transfer coefficient is tuned by an adjustment factor so that the primary-side initial conditions match input conditions that are derived from upstream NRELAP5 calculations. PIM calculates the adjustment factor internally using an iterative method. The response to RAI 9443 clarifies the PIM methodology and explains how the user input of the initial conditions affects the SG heat transfer. The Stability TR explains how this adjustment factor, once determined during the initialization, is

54 held constant during the transient calculations. The staff reviewed the RAI 9443 response and found it sufficient to explain how the PIM methodology determines the adjustment factor from upstream calculations and how this factor is applied in the transient calculations. Based on this clarification, the staff was able to proceed with the review of the individual models that make up the SG heat transfer package in PIM.

Secondary-side heat transfer is divided into different regimes that range from single-phase liquid convection, to subcooled boiling, to nucleate boiling, to saturated steam cooling, to superheated steam single-phase convection. The applicant also included natural convection heat transfer and radiation heat transfer models but stated that this is only to constitute a physically consistent SG secondary-side heat transfer model over a wide range of conditions (including very low flow) and that these models do not contribute to the stability analysis. The staff agrees that these modes of heat transfer are very small compared to the other modes such as convective heat transfer or nucleate boiling. However, the staff notes that these conclusions are predicated on the SG operating in a forced convection (instead of a natural convection) mode; therefore, the staff explicitly imposes the following condition stating that its approval of PIM for stability analysis is limited to those conditions of forced convection in the SG tubes.

Secondary-Side Forced Convection Limitation PIM is approved only to analyze conditions of forced convection in the secondary side.

For the primary-heat transfer regimes, the flow quality, with transitions between fixed quality points, dictates the transition between the regimes. According to the Stability TR, the transition from single-phase liquid convection to nucleate boiling occurs [

]. Lastly, the transition from steam cooling to superheated steam cooling occurs at a quality of 100 percent. In RAI 8846, Question 01-22, the staff asked the applicant to clarify the basis for the transition points.

In response to RAI 8846, Question 01-22, dated September 28, 2017, the applicant described the advantages of a simple model that treats the transition points based on quality and describes how these parameters were selected based on engineering judgment (ADAMS Accession No. ML17271A256). The staff reviewed the rationale in the applicants response and agrees that the approach is acceptable, particularly in light of the mild sensitivity of the key figures of merit to the transition points.

PIM treats the transition regions by averaging the heat transfer coefficients determined by correlations over the regimes above and below the transition. In RAI 9136, Question 01-52, the staff requested additional information on the weighting scheme used in the averaging. In response to this RAI, dated December 19, 2017, the applicant clarified the methodology (ADAMS Accession No. ML17353A494). The applicant stated that the PIM method [

]. On the basis of its engineering judgment, the staff finds this approach to be straightforward and reasonable and therefore finds the approach is acceptable.

The methodology determines the single-phase heat convection heat transfer coefficient for both liquid and vapor according to the Dittus-Boelter correlation, which is commonly used for this purpose. However, the applicant stated that the steady-state initialization process, which

55 adjusts the SG heat transfer, means that added detail (such as Dean number dependence) on the secondary-side heat transfer would essentially be lost during the initialization. The staff concurs with this assessment. In the stability calculations, the initialization ensures consistent predictions of the SG heat transfer between PIM and NRELAP5. This initialization process is the subject of staff RAI 9443, which was described earlier in this section.

This dependency of the PIM method on NRELAP5 was discussed earlier in this section for the primary-side heat transfer. The same rationale applies here to the secondary side. However, [

], secondary-side heat transfer changes only when the secondary-side boundary conditions are explicitly changed in the analysis, such as during a feedwater flow oscillation. In that case, the Dittus-Boelter correlation for the convective heat transfer still captures the transient change even if the correlation does not include a refinement to account for the helical tube geometry.

The methodology determines the nucleate boiling heat transfer according to the Chen correlation, which is also widely used for this purpose and is acceptable even for helical coil SG tubes. The Stability TR states that subcooled boiling is treated by extending the Chen correlation according to the approach of Collier. In RAI 9136, Question 01-54, the staff asked the applicant to justify the application of the subcooled boiling model to helical coil SG tubes. In response, the applicant stated that the rationale for using the Chen correlation is the same as the rationale for using the Dittus-Boelter correlation without any adjustment to account for the helical geometry (ADAMS Accession No. ML17353A494). The staff reviewed this rationale above in the case for the Dittus-Boelter correlation application. On the same basis as stated above, the staff concurs with the applicant. Therefore, the staff finds that the response to RAI 9136, Question 01-54, is acceptable.

The Stability TR states that in any given SG tube node, any or all of the heat transfer regimes may occur. This allows PIM to analyze conditions where there is a heat transfer regime transition within a single node without numerical issues. However, it is not clear from the Stability TR how this methodology is implemented in PIM. Therefore, in RAI 9136, Question 01-55, the staff requested that the applicant provide additional details on this method.

In response, the applicant clarified how the [

] The applicants clarification is sufficient for the staff to understand the method. The staff found that the method is reasonable on the basis of its engineering judgment and is therefore acceptable.

The staff reviewed the applicants RAI responses and considered the possibility for heat transfer regime oscillation to occur in the secondary side. This could take the form of a Ledinegg-like instability occurring (even within a single node) in the PIM calculations of the tube side of the SG. The SIET-TF2 experiments addressed density-wave oscillations on the secondary side affecting the primary side and showed that significant flow oscillations do not propagate to the primary side (see the TR Supplement and Section 3.1.1.4 of this report). However, Ledinegg-like instability may occur because of heat transfer regime oscillations. Oscillations occurring on the secondary-side heat transfer could affect primary-side stability performance.

However, the applicant separately addressed this through PIM analysis by performing calculations in which secondary-side heat removal is purposefully forced to oscillate at the resonant frequency. Section 8.2.7 of the Stability TR and Section 3.4.3.7 of this report address this particular topic. Specific PIM calculation capabilities to simulate the impact of heat transfer regime oscillation on power module stability are therefore not explicitly required, because PIM

56 can perform calculations in which the secondary-side heat transfer is forced to oscillate via feedwater flow boundary conditions.

In RAI 9136, Question 01-56, the staff requested that the applicant validate the SG secondary-side heat transfer models. In response, the applicant did not provide direct validation of the PIM secondary-side model (ADAMS Accession No. ML17353A494). Instead, the applicant compared PIM to NRELAP5. The staff again notes that NRELAP5 forms an element of the PIM analysis methodology because it is used to tune the PIM SG heat transfer during the steady-state initialization. The current results presented in the applicants response to RAI 9136, Question 01-56, show some differences between the PIM and NRELAP5 results.

The applicant argued that the impact of these differences on the calculation results is limited for two key reasons: (1) the boundary conditions are the same at the inlet and outlet of the SG secondary side, which limits how different the temperatures can be between the codes, and (2) in the PIM calculation process, the SG heat transfer is tuned by an adjustment factor to match NRELAP5. Therefore, the only observed difference in practice will be in the heat transfer axial distribution in the SG. The staff reviewed the applicants response and agrees with the rationale. The primary-side stability characteristics will depend on the [

] in the hot and cold legs. Therefore, small differences in the temperature profile in the span of the SG annulus will have a very small effect on the stability calculations performed using PIM.

Consequently, the staff finds the heat transfer approach acceptable, but only if the staff approves NRELAP5 for performing the requisite steady-state calculations that provide the basis for the PIM initialization.

Reliance on NRELAP5 in Calculating Steam Generator Heat Transfer Throughout this section, the staff has noted cases where the PIM calculation results may not be accurate but have been adjusted to match the associated NRELAP5 calculations during the steady-state initialization. This is a key element in the stability analysis methodology because NRELAP5 has been validated against experimental data, whereas PIM has not. While the calculation performance of PIM in the transient can be expected to yield less accurate results than more detailed models, the models are typically exercised only within a relatively narrow range of the initial condition for both DR and AOO calculations. Sensitivity calculations performed by the applicant have shown minimal impact on key figures of merit in these analyses to variations in the associated heat transfer parameters. However, the overall acceptability of the method is inherently tied to the reliability and accuracy of the NRELAP5 calculations that form the basis for the steady-state initialization. Because of significant differences between the PIM and NRELAP5 heat transfer models for both the shell and tube side of the SG and given the lack of validation of the PIM models, the staff cannot conclude that the PIM methodology is acceptable for modeling the highly important phenomena associated with SG heat transfer without the adjustment of the PIM results to match the NRELAP5 calculation results.

Because the evaluation of NRELAP5 is outside the scope of the current review, the staff imposes a condition to reflect the ongoing review of NRELAP5 separate from the current review:

NRELAP5 Steady-State Condition The approval of the PIM stability methodology, which relies on steady-state calculation results from NRELAP5, is contingent on the staff review and approval of NRELAP5 for the purpose of performing best estimate steady-state calculations for the NuScale power module.

57 If the staff approves NRELAP5 to predict best estimate, steady-state, thermal-hydraulic conditions for the NuScale power module, then the staff finds that the downstream use of this information as part of the PIM stability analysis methodology is both necessary and acceptable.

Given the above considerations and the staffs evaluation of the PIM SG models, the staff has concluded that the models are acceptable when exercised within the conditions specified by this section.

3.2.5 Numerical Methods Section 5.8 of the Stability TR describes the PIM numerical scheme. In reviewing such numerical schemes for stability applications, the staffs primary review concern is whether the numerical methods contribute to artificial damping of oscillations through numerical diffusion.

The kinetics and conduction solutions are [

]. This type of approach for stability analysis is similar to the approach adopted by the staff in using the TRACE/PARCS codes for BWR stability evaluation (Ref. 3) and is acceptable. However, the solution may be subject to numerical diffusion if the time step results in a Courant number substantially different from unity. This topic is addressed briefly in the TR Supplement in terms of the ROM, but the staff finds it difficult to extrapolate conclusions made with the ROM to PIM. To evaluate the Courant limit in the PIM calculations, in RAI 8801, the staff asked the applicant to provide information about the nodalization, time-step size, and velocity field.

In response to RAI 8801, dated August 7, 2017, the applicant described the nodalization scheme, as well as the types of sensitivity calculations that were performed to test the nodalization scheme and time-step size to ensure that the effects of numerical diffusion were minimal (ADAMS Accession No. ML17219A738). The scope of the calculations described in the RAI response are sufficient to address the concerns of numerical diffusion. Further, the staff agrees with the applicant that numerical diffusion is likely to be less significant in the calculation of the NuScale power module stability compared to the calculation of stability in BWRs. In a BWR, the propagation of the density wave through the reactor core affects the local power density though the void reactivity feedback mechanism on a small spatial scale; however, in the NuScale design, the [

]. Therefore, the NuScale system is less sensitive to the diffusion effects because [ ]. The staff agrees with the applicants technical approach and qualitative arguments. However, because the applicant did not provide the numerical results of the referenced studies, the staff cannot confirm that the sensitivity to nodalization or time-step size is small compared to the uncertainty or DR margin.

To reach this confirmation, the staff requested the numerical results in a supplemental RAI (RAI 9417).

In its May 29, 2018, response to RAI 9417, the applicant provided the numerical values of the calculation results (ADAMS Accession No. ML18149A652). The results confirm the sensitivity of the DR calculations to nodalization and time-step size. A larger number of sensitivity calculations were performed for the 32-megawatt (MW) (20-percent power) case. The results show that the DR tends to be higher in the standard case, which uses the reference nodalization scheme and time-step size. In this standard case, the core Courant number is [

]. When compared to the other cases, the results confirm that the DR is [

58

], the results confirm that the nodalization and time-step size are adequate. The staff finds that, through these refinement studies, the applicant adequately demonstrated that the nodalization scheme and time-step size do not contribute significant error in the DR calculation.

RAI 9105 also asked the applicant to address the issue of numerical damping through verification of PIM against relevant problems with analytical solutions. In the response to RAI 9105, dated January 26, 2018, the applicant provided the results of calculations to address kinematic and dynamic effects of numerical diffusion (ADAMS Accession No. ML18026A939).

The applicant stated that it was not possible to use PIM directly to evaluate certain analytical problems, and the staff agrees with the limitations described in the response. In lieu of the direct analysis, therefore, the applicant relied on alternative methods (e.g., using the ROM) to quantify the effect of the numerical diffusion. The results of the analysis are consistent with the staff expectations for similar types of analyses. Therefore, the staff finds that the applicants analysis approach is acceptable. The staff reviewed the results from the calculations and found them to be reasonable and to confirm that numerical diffusion can be expected to [

].

The Stability TR describes the explicit scheme in PIM, which is consistent with other systems analysis methods approved by the staff for similar purposes. However, the response also references an [ ] scheme. While this scheme may be part of PIM, the staff did not review it. Approval of the Stability TR does not constitute approval of the implicit scheme in PIM. The staff therefore restricts the use of this alternative implicit scheme as follows:

Implicit Scheme Restriction PIM is not approved to perform stability analysis using the implicit scheme for the thermal-hydraulic solution.

The applicant evaluated nodalization schemes in the response and demonstrated that the numerical diffusion effect decreases with increasing spatial resolution. Because the NuScale nodalization is finer than the schemes analyzed, the staff agrees with the applicant that the estimated numerical diffusion effects can be applied to the NuScale calculations. Based on the calculations provided in the response, the applicant has determined that numerical diffusion has

[ ]. The staff has reviewed the analysis and concurs with the applicants assessment of the effect.

In the RAI 9105 response, the applicant described some of the physical processes that can contribute to actual physical diffusion. The applicant argued in the response that some numerical diffusion is therefore appropriate to account for physical diffusion (ADAMS Accession No. ML18026A939). However, the applicant has not quantified these effects. The staff agrees that, for example, molecular diffusion caused by turbulence can contribute to the diffusion of temperature, but the effect has not been sufficiently quantified for the staff to independently confirm that the degree of numerical diffusion in the PIM calculations is appropriate to mimic the physical process. Furthermore, the applicant contended in the response that the effect of physical diffusion would be difficult to quantify, because [

] The staff agrees with the applicant insofar as the staff finds that the [

59

], and therefore, numerical diffusion effects are not as significant in the calculations for NuScale as they would be in stability calculations for a BWR. However, the staff cannot conclude that purposefully including diffusion is appropriate. Numerical diffusion, which generally contributes to stabilizing a system in a calculation model, should be eschewed and not exploited to simulate the unquantified effects of physical diffusion that are not treated explicitly.

NuScales response references calculations that were performed to assess the impact of the [

], and the applicant concludes that the PIM predictions of DR are conservative (ADAMS Accession No. ML18026A938). The staff does not reach the same conclusion. It is not clear which biases or uncertainties the applicant is referring to in the response. The staff is not aware of a comprehensive uncertainty quantification performed by the applicant that would shed light on the biases and uncertainties. Because of scaling concerns, the validation provided against the NIST-1 tests does not provide any direct, quantifiable assessment of the PIM biases or uncertainties with respect to the NuScale power module (see RAI 9037 response (ADAMS Accession No. ML17297A693) dated October 24, 2017). Given the lack of applicable validation data or a detailed uncertainty analysis, the staff cannot reach the same conclusion as the applicant. Therefore, the staff does not agree that the analyses demonstrate any conservatism in the PIM calculations. However, the staff does agree that the effect of numerical diffusion [

]. Section 3.3.1 of this report discusses the impact of the applicants numerical diffusion assessment on the acceptability of the DR acceptance criteria.

3.2.6 Integral Effects Testing Validation Section 6 of the Stability TR provides the validation of PIM against data collected at the NIST-1 test facility. Table 6-1 of the Stability TR summarizes the test results, which were performed over a power range of 61 to 320 kW. The tests appear to indicate that the NuScale power module is quite stable with DRs from the test in the range of about [ ]. At these low DRs, it is generally difficult to reliably measure the DR with either the Type I or Type II approaches described in the Stability TR, so the experimental uncertainty for these data can be quite high.

This can be observed in the differences between runs conducted at similar power levels and with different perturbation methods. The applicant performed a series of tests at power levels between [

]

The applicant compared PIM results to these data and found reasonable agreement, with PIM predicting very large stability margins under the conditions shown to be highly stable at NIST-1.

If anything, the PIM results appear to include a small conservative bias; however, it is difficult to quantify the bias given that experimental uncertainty at low DR is relatively large.

The Stability TR also compares the measured and calculated oscillation periods. The standard deviation in period is not reported in the Stability TR, but measurements performed at similar power levels can indicate the experimental uncertainty in the measured period. For the data collected at [

]. Using this as an indication of the measurement uncertainty, the comparison in Table 6-2 of the Stability TR indicates that the predicted and calculated periods agree reasonably well.

60 Given the relatively large uncertainty in the experimental data in this highly stable regime and given the limited number of measurements made, the staff considers the integral effect test validation with NIST-1 insufficient to reach conclusions about the uncertainty in the PIM calculations. The PIM predictions agree reasonably well with the available IET data, and these data correspond with the highly stable conditions expected for normal NuScale power module operation. However, this does not fully address PIM uncertainty in predicting DR.

Figure 7-1 in the Stability TR illustrates two concerns with drawing conclusions from the PIM validation against NIST-1. First, there is the issue of scaling. The NIST-1 facility has been scaled based on phenomena relevant to LOCAs, and therefore, there will be scaling distortion when relating the NIST-1 stability characteristics to the NuScale power module. This concern is illustrated by differences in the DR trend with power between the prototype (marked NPM) and the test (marked NIST) in Figure 7-1 of the Stability TR. Second, there is the issue of stability margin. Stability margins in the NuScale power module are degraded by low-power operation and by voiding in the riser. The NIST-1 tests covered the stable range of operation but did not go to low power levels where the DR is expected to increase sharply for the NuScale power module. Section 7.2 of the Stability TR includes a discussion from first principles explaining how accounting for cold-leg feedback explains the trend in DR with decreasing flow (and hence decreasing power).

As for the first issue of scaling, the Stability TR derives various scaling parameters in Section 7 (i.e., a, 0, and S0). In RAI 9037, the staff requested information about the scaling and the completeness of the test matrix. In response to RAI 9037, the applicant described these same scaling parameters and confirmed that there are scaling distortions between NPM and NIST-1 with respect to stability (ADAMS Accession No. ML17297A693). However, these scaling distortions are not numerically evaluated because NIST-1 does not form the basis of the LTS solution. Further, the response clarifies that the NIST-1 benchmarking was performed to demonstrate the modeling efficacy in PIM to capture the salient phenomena in an IET assessment, but it was not used to quantify the bias or uncertainty in the PIM calculations.

In light of these scaling factors, in RAI 9106, Question-01-57, the staff requested additional information as to how the uncertainty in DR derived from the NIST-1 assessment correlates with uncertainty in the PIM calculations for the NuScale power module. In its response to RAI 9106, Question 01-57, dated March 21, 2018, the applicant clarified that the NIST-1 validation is not used to quantify the uncertainty in the PIM DR calculations (ADAMS Accession No. ML18080A231). Section 3.3.1 of this report discusses at further length the acceptability of the DR acceptance criterion (given the absence of a direct link between the DR calculation uncertainty and the validation provided in the Stability TR). The applicant also discussed the effect of riser heat transfer in the response to RAI 9106, Question 01-57, but this does not appear to be relevant so was not reviewed by the staff.

As for the second issue, in RAI 9106, Question 01-58, the staff requested additional information about the change in stability margin with decreasing flow rate and asked if there are experimental data supporting the trend. In response to RAI 9106, Question 01-58, the applicant provided further support for the lower power trend in DR for the NuScale power module (ADAMS Accession No. ML18080A231). The applicant stated that the trend in DR at low power is the result of the inverted density wave in the downcomer. The applicants response explains how the density wave traverses the downcomer in the same direction as gravity (hence inverted) with the SG acting as a heat sink. [

61

] The staff reviewed the applicants analysis and concurs that the inverted density wave is sufficient to explain the trend in DR. The staff also agrees with the applicant that this explains the agreement in the PIM calculations and the trends predicted by the ROM. The applicant referenced calculations provided in the response to RAI 9105 (ADAMS Accession No. ML18026A939). The staff finds that these calculations are sufficient to demonstrate the key physical process that explains the low-power trend in DR.

While the NIST-1 validation indicates that PIM provides reasonably accurate predictions of DR and period for conditions similar to the normal operating conditions for the NuScale power module, the staff does not find that the NIST-1 validation is sufficient to quantify uncertainty in the PIM calculations for the NuScale power module. Furthermore, because the NIST-1 tests consider only the very stable regime near normal operation conditions for the power module, it is insufficient to validate the PIM models used in certain transient analyses where the power module is predicted to become unstable. In particular, the NIST-1 experiments do not validate the PIM models for void formation phenomena important to the riser instability mode.

Section 3.2.7 of this report discusses these models, for which the staff has requested additional validation against SET data.

The TR Supplement provides some data from the SIET-TF2 IET. The applicant reported these tests in the TR Supplement to address issues of secondary-side instability and did not use them for IET validation of PIM. Section 3.1.1.4 of this report discusses the SIET-TF2 IET.

The staff reviewed the IET validation provided by the applicant in the form of the SIET-TF2 and NIST-1 tests and concluded, for the reasons provided above, that these tests are insufficient to quantify the uncertainty in the PIM predictions of the stability-related figures of merit.

3.2.7 Separate Effects Testing Validation The Stability TR does not provide any validation of the PIM code against separate effects test (SET) data. The SRP Section 15.0.2 acceptance criteria for code assessment state that SET validation must be performed to demonstrate the adequacy of the physical models to predict physical phenomena that were determined to be important in the PIRT. The PIRT in Section 4.4 of the Stability TR lists several phenomena that the applicant did not assess against SET data.

The assessment should cover the full range of applicability of the subject model. The staff identified the subcooled boiling model and the drift-flux model as being related to vapor generation, which is ranked as highly important. In RAI 9017, the staff asked the applicant to validate the PIM models for these phenomena against relevant SETs.

In its September 25, 2017, response to RAI 9017, the applicant did not provide validation of these models against SET data (ADAMS Accession No. ML17268A378). Rather, the response evaluates the sensitivity of the analysis results to a broad range of parameter variation that bounds any uncertainty in the models themselves. In the case of the boiling coefficient, a wide parameter range was assumed to demonstrate conservatism in the default value. In the case of the void-quality correlation, the correlation was compared to the homogeneous equilibrium model, which would certainly provide a lower bound to the slip. The staff reviewed the response and found that the sensitivity ranges explored are sufficient to bound any uncertainty in the models. Since the results of the sensitivity analyses demonstrate no significant impact on the key figures of merit, the staff agrees with the applicant that, in this case, the correlations from the literature can be applied without NuScale-specific SET validation to justify the applicability of these models.

62 Flashing in the riser can be highly important in predicting the onset of instability in the power module. The staff considered flashing in the riser to be a highly important phenomenon during its independent PIRT development (ADAMS Accession No. ML17033A144). Therefore, in RAI 9093, Question 01-37, the staff requested that the applicant provide SET validation of the flashing models in PIM. In its response to the RAI, the applicant provided a simple analysis intended to show that heat transfer between the riser and SG annulus and downcomer would be sufficient to preclude the occurrence of flashing in the riser (ADAMS Accession No. ML17313B233). The staff cannot reach the same conclusion. The focus of the staffs RAI 9093, Question 01-37, is the incidence of flashing that may occur in the riser during a depressurization transient. Prediction of this phenomenon is important because it can affect the timing of the onset of the instability. Therefore, the staff does not find the response to RAI 9093, Question 01-37, sufficient to address its concern about flashing during transient calculations.

However, the applicant then referenced the RAI 8921 response (ADAMS Accession No. ML17268A387) in the RAI 9093 response, which deals with the topic of flashing, but in a different context. The RAI 8921 response is related to upper plenum flashing, not riser flashing.

In RAI 8921, the staff asked the applicant to describe how the PIM methodology captures the effect of flashing in the upper plenum. The applicants response explains that it is not important to capture the flashing effect in the DR calculations. First, the response refers to a calculation of the riser quality that could occur as a result of flashing. [

] The staff is not certain if this quantity applies to the limiting AOO (i.e., depressurization); in addition, because of the relationship between quality and void fraction, a small change in quality at low quality can produce a much larger change in void fraction. For stability analysis, the results are sensitive to the void fraction, rather than the quality, so it is not clear from the applicants calculation of the quality whether there is an appreciable effect from flashing.

The applicant also provided analyses with PIM based on two different methods. In one method, local pressure variation in the primary system is used in calculating the void, which allows for flashing to occur (blue case); in the other method, the local pressure variation is not treated, which precludes flashing (red case). The staff reviewed these two calculations and agrees that they are sufficient to evaluate the sensitivity of the key figure of merit (i.e., instability onset timing) to any uncertainty in the prediction of flashing.

The applicants sensitivity calculation shows that accounting for local pressure variation actually slightly delays the instability onset timing by a small amount. In both the red and blue cases, the calculations demonstrate that the MPS affords a similar protective margin. The blue case calculation allows PIM to treat the local pressure in the riser section, which results in slightly later voiding in the riser section because it accounts for slightly higher pressure at the bottom of the riser compared to the pressurizer. While lowering the pressurizer pressure would more rapidly affect the propensity for flashing in the top of the riser compared to the bottom, the change in pressure in the pressurizer is essentially felt simultaneously throughout the whole system because of the high speed of sound. As a result, the most significant contribution to integrated riser void during the depressurization is the increase in core voiding and the transport of these voids from the core to the riser. The red calculation shows an earlier void formation and confirms the applicants claim that void production from the core is much more significant than the production of void from flashing.

Because the sensitivity calculations provided by the applicant cover a sufficient range to bound any potential uncertainty in the flashing model, the staff finds that this sensitivity analysis is adequate to address the potential effect of uncertainty in the flashing model. Since the applicants calculations confirm that the MPS trip provides essentially the same margin in the

63 sensitivity calculations, the staff agrees with the applicant, in this specific case, that SET validation of the flashing model specific to NuScale is not required.

However, in its review of the response to RAI 8921, the staff disagrees that the flow oscillation magnitude predictions between the two cases are essentially the same. The applicant made a statement to this effect in the RAI 8921 response (ADAMS Accession No. ML17268A387).

However, the results shown in Figure 1 of the RAI 8921 response clearly indicate that the flow response in the blue case is more adverse than the red case from the standpoint of thermal margin. As further discussed in Section 3.3.2 of this report, the accurate calculation of oscillation magnitude is not required as part of the transient analysis methodology. Rather, the stability analysis methodology with respect to transients requires demonstration that the MPS trip would actuate with sufficient margin to ensure that the reactor is controlled before the onset of instability. Therefore, for the current analysis purpose, it is not necessary for PIM to predict the oscillation magnitude.

If PIM were used to evaluate the change in thermal margin as a result of oscillations, then the staff would need to more thoroughly review the results of the RAI 8921 response sensitivity analyses to determine the impact of flashing on oscillation magnitude. Since this is not part of the stability analysis methodology, and the staff has not approved PIM to evaluate thermal margin (see Section 3.2.1.9), the staff did not further review the implications of the applicants sensitivity analysis with respect to the prediction of oscillation magnitude. The staff merely notes its disagreement with the applicant on the sensitivity of the oscillation magnitude to flashing.

On the basis of the above considerations and the staffs evaluation, the staff concluded that SET validation of the flashing model was not required for the current application of PIM to predict the stability-related figures of merit. However, the staff found that such validation would be needed if future applications of PIM sought to quantify other figures (e.g., oscillation magnitude).

3.2.8 Quality Assurance Plan and Change Process According to SRP Section 15.0.2, the QA plan must meet requirements in the following areas:

design control document control software configuration control and testing error identification and corrective actions used in the development and maintenance of the evaluation model adequate training of personnel involved with code development and maintenance, as well as those who perform the analyses The staff review in this section builds on the staff evaluation (ADAMS Accession No. ML120680132) of the NuScale QA program description (ADAMS Accession No. ML16347A405), as well as an inspection conducted by the staff from August 24-27, 2015 (ADAMS Accession No. ML15268A186). The staff reviewed the design certification QA program description, including the corrective action program, and found it to be acceptable (ADAMS Accession No. ML120680132). During the August 2015 inspection, the staff inspected

64 several aspects of the QA plan related to safety analysis codes (and NRELAP5 in particular).

The staff found that the QA plan met the applicable requirements. Therefore, the scope of the Stability TR audit as it applies to the subject review was limited only to verification of the acceptable use of the relevant procedures for the PIM code in particular. The staff conducted this audit of the QA plan to confirm that the plan meets the requirements listed in SRP Section 15.0.2 for PIM and that independent peer reviews were performed by programmers, developers, and end-users at key steps in the evaluation model development process.

The staff completed the QA audit and documented its detailed findings in an audit results summary report (ADAMS Accession No. ML181614A253) dated June 20, 2018. The staff summarizes its findings in each of the major areas below.

Design Control In terms of design control, the staff found that the governing procedures are acceptable insofar as they (1) provide documentation requirements that spell out the design requirements and formalize the requirements for software in the form of a requirements traceability matrix, (2) require independent verification of the implementation relative to the design requirements, and (3) provide for a procedural feedback loop between the outcome of the verification and allowed uses of the software.

Document Control The applicant meets the requirements of document control by ensuring that the software documentation is maintained as quality records. Furthermore, changes to these documents are controlled by a procedure requiring independent review of proposed changes and tracking of change impacts on other areas, including those areas important to nuclear safety. However, currently, the NuScale procedures do not address the requirements of 10 CFR 50.59, Changes, Tests and Experiments, in terms of evaluating changes. Therefore, the staff identified an audit item with respect to clarifying how COL applicants or licensees will address the requirements of 10 CFR 50.59. The staff notes that its review and findings are based on Version 1.1 of the PIM software.

Software Configuration Control and Testing The staff reviewed procedures associated with software testing and identified two audit items, which are addressed by RAI 9333. The first audit item relates to the documentation of code limitations that are identified as part of software testing. These limitations, according to NuScale procedures, should be translated to the code users manual to ensure that the codes are executed in an acceptable manner. The staff identified two instances in which the applicant appears to have identified code limitations through software testing, but the users manual does not reflect these limitations. In RAI 9333, Question 01-66, the staff asked the applicant to address these two instances. The applicant responded to the RAI, dated April 3, 2018, by describing how it has addressed these instances in the overall QA program and how they do not require specific limitations in the code manual (ADAMS Accession No. ML18093B575). The staff reviewed the specific actions taken by the applicant in response to these instances and found, on the basis of its own judgment, the actions to be prudent and in accordance with the applicable requirements. Therefore, the staff concurs with the applicants approach.

The second audit item relates to regression testing. The staff found that the regression testing relies on comparison of code results to the previously approved code version. In this approach, the code results are not compared to a static benchmark, and therefore, the code results may

65 change a small increment during subsequent revisions that, when integrated, may result in a large change that goes undetected. This process of small changes accumulating is referred to as code drift. The staff identified regression testing and code drift as an audit item and requested additional information in RAI 9333, Question 01-67. The applicant responded to the RAI and provided specific examples of regression testing performed for Version 1.2 of PIM (ADAMS Accession No. ML18093B575). The staff reviewed the implementation of the regression testing described in the response but could not determine what specific aspects of the software testing would preclude code drift. The applicant stated in the response that its software testing and verification procedures would capture any future code drift; however, the staff was not able to identify from the description in the response those aspects of the process that would identify code drift. Therefore, the staff requested more information in supplemental RAI 9576.

In response to RAI 9576, dated October 11, 2018, the applicant described how code drift is assessed during regression testing by comparing several figures of merit between the current code version and the 1.0 code version and confirming that the figures of merit for several calculation cases remain within a tight tolerance window (ADAMS Accession No. ML18284A487). Because the results are compared to a static code version (Version 1.0),

the staff finds that the approach is acceptable to assess code drift. The magnitude of the acceptance criterion specified in the RAI 9576 response is acceptably small to ensure that code drift will not adversely impact biases in the safety analyses. Therefore, the staff concludes that the regression testing process adequately addresses code drift and is therefore acceptable.

Error Reporting and Corrective Action The procedures meet the requirements for corrective actions by providing a process for determining if error reports under the NuScale Error Tracking System are, in fact, items appropriate for inclusion as condition reports in the corrective action program (CAP). In addition, CAP condition reports are screened for potential 10 CFR Part 21, Reporting of Defects and Noncompliance, requirements according to the appropriate criteria and reporting timelines. The staff determined that NuScale faithfully adheres to the CAP-related quality procedures previously approved by the NRC staff through its review of PIM-related specific examples.

Independent Peer Reviews and Training An external contractor performed the initial peer review of PIM. The staff reviewed the details and confirmed that the external contractor was, indeed, independent, had the requisite technical competency to perform the review, and was adequately trained in the applicable QA procedures at NuScale. On the basis of the training records audited by the staff, the staff concludes that, moving forward, NuScale staff are qualified in the QA procedures, stability phenomenology, and the PIM code, and, therefore, are able to properly conduct the independent peer reviews required by the procedures.

3.3 Analysis Methodology, Uncertainty, and Acceptance Criteria Apart from the PIM code, the overall analysis methodology is defined by the means of execution of the PIM code to derive the figures of merit (e.g., DR) and how the figure of merit is compared to acceptance criteria that appropriately account for uncertainty in the method. This section of the staffs evaluation report addresses these aspects of the analysis methodology.

66 The stability analysis methodology can be divided into two distinct areas. The first (described in Section 8 of the Stability TR) is the steady-state DR method, and the second (described in Section 9 of the Stability TR) is the transient method. In the first method, generally, a perturbation is applied to a steady-state condition, and the transient response of the flow rate in response to the perturbation is computed. This method uses the flow response to determine the DR. In the second method, PIM simulates a transient condition and determines the point where the MPS subcooling margin protective trip is activated based on predicted system parameters (namely, core exit temperature). To demonstrate the effectiveness of the MPS subcooling margin protective trip in preventing instability of the power module, the method then compares the MPS subcooling margin protective trip timing to the timing for the onset of instability.

The methodology also considers the effects of cycle depletion, but the Stability TR was unclear as to how stability behavior is necessarily verified at all points in cycle. In RAI 8868, the staff requested additional information about how cycle exposure is considered in the methodology.

The applicants response, dated August 23, 2017, states that no sensitivity was identified for parameters that would be affected on a cycle-specific basis (ADAMS Accession No. ML17235B151). The response states that certain nuclear parameters, and most importantly, the MTC, vary as a function of cycle exposure because of the effect of boron letdown. The staff agrees with this characterization of the MTC. However, the staff does not agree that the nuclear parameters are not affected on a cycle-specific basis. The applicant appears to concede the same point in the Stability TR in Section 10.4, which states that representative nuclear kinetics parameters and reactivity coefficients bound expected cycle exposure conditions and that the least-negative MTC in the cycle may not occur at the BOC or EOC condition. The staff cannot reconcile the RAI 8867 response with the Stability TR. The Stability TR indicates that it would be a necessary step in the methodology to confirm that cycle-specific nuclear parameters (at the worst point in cycle) are bounded by the analysis in the Stability TR. However, the RAI 8867 response, states that no cycle-specific effects are expected.

Furthermore, the RAI 8867 response and the Stability TR use conflicting language when describing the assumptions for the nuclear parameters. In some instances, the Stability TR refers to the assumed parameters as conservative, and in other instances, the applicant refers to the parameters as representative. For the purposes of the current analysis (to demonstrate the principle of the LTS solution), such differences are not important, as long as conservatism is applied in the reload licensing process so that cycle-specific analyses are adequately conservative to account for the impacts of core loading and cycle depletion on the nuclear parameters.

Section 3.2.2 addresses concerns about the generic nuclear data. In that section, the staff discusses conditions and limitations related to cycle-specific analyses (namely, that the COL applicant or licensee referencing the Stability TR must confirm that the assumed nuclear parameters are conservative or redo the analysis). However, the applicants response to RAI 8867 implies that only the BOC and EOC conditions need to be evaluated. This contradicts the Stability TR, and the staff agrees with the discussion in the Stability TR that the most limiting point in cycle may not be the BOC or EOC.

In a supplement, dated September 17, 2018, to the RAI 8867 response (ADAMS Accession No. ML18260A376), the applicant further clarified the methodology and provided a revision to Section 10.4 of the Stability TR. Because the most limiting point in cycle may occur between the BOC and EOC, on a cycle-specific basis, the staff determined that any COL applicant or licensee referencing the Stability TR must verify that the nuclear parameters assumed in the

67 PIM stability calculations are conservative for all points in the cycle. Based on the revised Stability TR discussion, the staff concludes that NuScale acceptably addresses the variation of nuclear parameters over the cycle by ensuring that limiting values are used in the stability analysis. Therefore, the staff finds that the cycle exposure is adequately and acceptably addressed by the applicants methodology.

In terms of the transient calculations that account for operational occurrences, the staff requires that the scope of the analysis covers the range of allowable plant operation. Plant operational flexibilities may include factors such as flow and temperature windows in terms of the secondary side, power levels, and allowable equipment out of service. Any of these factors may affect the stability of the power module. Therefore, in RAI 8831, the staff asked for confirmation that the transient methodology considers initial conditions and plant response consistent with the most adverse, limiting conditions allowed by the plant TS including any operational flexibility options (e.g., reduced feedwater temperature operation, SG tube plugging).

The applicant considered the allowable operating range according to the TS in its August 22, 2017, response to RAI 8831 (ADAMS Accession No. ML17234A750). In this response, the applicant stated that the Stability TR included extensive parameter variations covering a wide range of operation and design variability. However, the staff does not agree with this description. The Stability TR provides an analysis to demonstrate the effectiveness of the LTS solution for a representative design and representative operating maneuvers.

Parameters that could vary as the result of operational factors within the TS allowable range are not considered explicitly. An example is primary-side temperature, which could increase because of SG tube fouling or plugging. The Stability TR does not include analyses over a wide range or extensive range of initial temperature variations to cover the anticipated operating range allowable by the TS.

However, while the staff disagrees with the applicants description of the Stability TR analyses, the staff does agree that it is appropriate for the COL applicant to perform confirmatory analysis as part of the NuScale Reload Analysis Methodology. The response to RAI 8831 refers to Section 10.4 of the Stability TR, which states that to utilize the stability methodology, the COL applicant or licensee referencing the stability methodology must confirm that the MTC is within the envelope of the generic analysis and that the riser subcooling is within the TS value.

Therefore, while extensive parameter variations are not present for all allowable operating flexibilities within the current Stability TR, the response and Stability TR refer to cycle-specific confirmatory analyses. The staff finds this acceptable because it would ensure that any variations as a result of core reload are inherently captured in the reload licensing process. The staff finds this acceptable.

In terms of thermal-hydraulic state conditions that are allowed by operating flexibilities, the applicant refers to the TS value for riser subcooling. Riser subcooling is a key parameter. The response to RAI 8831 explains that the system remains stable within a stated operating range, with the exclusion of riser boiling. The LTS solution precludes the riser instability mode by enforcing margin in the riser subcooling. In reviewing, for example, Section 9.2 of the Stability TR, the staff observed that a higher initial primary system temperature other than that assumed in the generic analysis could accelerate the timing of the instability onset and MPS trip.

Because a higher temperature would produce more adverse conditions from the standpoint of stability during AOOs, the staff requested additional information in RAIs 9093, 8869, and 9441 about the relatively low ranking of SG heat transfer in the Stability TR PIRT and the impact of higher temperature on the different classes of AOO events. Section 3.1.3 of this report

68 discusses the responses to these RAIs in greater detail. The staff finds that the general conclusions of the analysisthat the MPS trip protects against the onset of instabilityremain applicable even for a higher primary-side temperature as long as riser subcooling margin exists at the start of the transient.

Therefore, while operational flexibilities may affect the initial conditions within the primary system, any of these flexibilities are ultimately constrained by the TS to ensure margin in the riser subcooling. The staff agrees with the applicant that this is the key parameter that could be affected by operational flexibility. Further, the staff agrees that a TS value directly controls this key parameter. Since the COL applicant or licensee must confirm that the riser subcooling remains within the TS value on a cycle-specific basis, the reload licensing process described in Section 10.4 of the Stability TR will ensure that future operation remains within the appropriate thermal-hydraulic constraints to protect against the riser instability mode.

Section 10.4 of the Stability TR states that a final analysis will be provided separately in the FSAR for the final design and that an application of the methodology with a full analysis scope is expected to support or disposition the stability impact of future NuScale power module design changes. The staff agrees that design changes will affect the stability performance and that PIM has flexibility in analyzing those plant design changes that can be reasonably expected during the final detailed design process for the NuScale power module. The full scope of analysis will have to account for any plant design changes; however, core design changes will take place every cycle.

In the initial submittal, Sections 10.2 and 10.4 appeared to be in conflict where Section 10.2 appeared to indicate that cycle-specific consideration of the moderator feedback was required, but Section 10.4 appeared to imply that such cycle-specific considerations need not be considered in the licensing analyses. To clarify the scope of the analysis and to reconcile the language of Sections 10.2 and 10.4 of the Stability TR, in RAI 9091, the staff asked the applicant to provide a list of PIM models and PIM inputs that are fuel-design specific and would be subject to revision with the introduction of a new fuel assembly design. The staff requested that NuScale describe the process by which analyses are reperformed when parameters specific to the fuel design change.

In the response to RAI 9091 (ADAMS Accession No. ML17313B219), the applicant discussed which PIM models are fuel-design dependent. The response includes a table of the fuel-design specific parameters and clarifies that these parameters are specified by user input. The applicant also clarified that the introduction of a new fuel design would require evaluation of the neutronic and thermal-hydraulic performance. In cases where the neutronic performance is not bounded, the applicant stated that the case would require reanalysis using appropriate neutronic parameters. If the fuel design introduces significant changes to the thermal-hydraulic performance, the applicant stated that this would induce a change in the rated core flow.

According to the response, changes in the rated core flow rate that deviate from the licensed flow range would trigger a reanalysis of all safety aspects (of which stability is only one part).

The staff finds that the response is reasonable insofar as expected changes in fuel design characteristics can be addressed through user input. The staff concludes that changes in fuel design that would cause substantial changes in the neutronic or thermal-hydraulic characteristics of the core (i.e., pressure drop as a function of flow) have appropriate triggers for reanalysis. Therefore, the staff finds that the characteristics specific to fuel design are considered adequately in the Stability TR.

69 3.3.1 Decay Ratio Calculation Method There are several methods for calculating the DR from the PIM transient results. These methods generally rely on calculating the flow oscillation peaks and examining the ratio of the heights of peaks in the oscillation response. The two-peak method is a fairly standard way to infer DR from time-domain transient analysis codes.

According to Section 8.1 of the Stability TR, PIM performs the steady-state DR calculations by applying a perturbation and observing the power module transient response for a period of approximately 10 circuit times. The circuit time is a function of the primary-side mass flow rate and the system inventory. A problem time of 10 circuit times is used to ensure that short-term effects are allowed to decay so that the long-term response gives a clean indication of the stability behavior without any short-term effects. The staff agrees with this approach and finds that this is an important element of the method used for the safety analysis.

Section 8.1 of the Stability TR lists the perturbation methods applied in the PIM safety analyses.

The specific perturbation applied in time-domain stability methods is not generally an important detail of the analysis. The perturbation must be designed by the user in a way that avoids inducing significant nonlinear effects that may result in underpredicting the DR. The perturbation methods described by the Stability TR are relatively small and can be expected to produce a response in the linear range. Therefore, the staff finds these types of perturbation acceptable for the current purposes. The staff concludes that the possibility for the perturbations to induce nonlinear effects is mitigated by the requirement that the analysis be performed for 10 circuit times, which would result in the damping of any short-term, nonlinear effects, to ensure that the DR is inferred only from the long-term response. Therefore, the staff finds these types of perturbation acceptable for the current purposes.

In RAI 8937, the staff requested clarification because Sections 5.8, 6.2, and 7.1.1 of the Stability TR are not clear about the method for calculating the DR. For the validation against NIST-1, it appears that the applicant calculates the DR based on a three-peak method. However, it is not clear how this method is applied in accordance with the requirement in the TR that the response consider 10 circuit times. In the response to RAI 8937, dated September 28, 2017, the applicant described several methods for calculating DR (ADAMS Accession No. ML17271A285); however, only one of these methods was adopted for the PIM methodology. The applicant stated that the methodology does not rely on automated techniques, but instead depends on the analyst visually inspecting the results and determining the DR according to the ratio of two successive peaks in the transient flow response. The staff takes a similar approach to calculating DR using TRACE and finds this method acceptable. The applicants response clarifies that the signals are examined to determine a usable segment of the flow response that does not have any interference from the initial perturbation. This aspect of the method is consistent with the requirement to analyze the flow signals using PIM for at least 10 circuit times. Therefore, the RAI 8937 response is sufficient to clarify the method for calculating DR and is consistent with the calculation duration requirements described in the Stability TR. The staff finds that the applicants approach is acceptable for calculating DR.

The response to RAI 9579, dated December 19, 2018, (ADAMS Accession No. ML18353B515) however, contradicts the RAI 8937 response. The applicant explained in the RAI 9579 response that PIM includes algorithms for calculating the DR, but that this method often fails to converge, and that manual analysis of the results in postprocessing is often used to calculate the DR when the automated calculation fails to converge. This is acceptable to the staff as the automated and manual methods rely on the same principles, but the manual method, as

70 discussed above, allows for the analyst to carefully consider the appropriate time interval for calculating the DR. Therefore, while this approach is acceptable, the staff notes here that the response to RAI 9579 supersedes the response to RAI 8937 and introduces alternatives to the two-peak method for computing DR.

In the RAI 9579 response, the applicant further discussed the three-peak method and an additional, new four-peak method that is programmed in PIM. The applicants response describes how the four-peak method can be thought of as the geometric average of results from the three-peak method using successive time intervals. The staff agrees with this interpretation and further agrees that using either the three-peak method in the long term or the four-peak method in the shorter term (while multiple modes are decaying) is sufficient to diagnose whether the system is stable or unstable with a reasonable degree of accuracy in the calculated DR.

In summary the staff found that there are several DR calculation methods presented as part of the applicants submittal which include automatic and manual methods. On top of those presented in the Stability TR itself, the response to RAI 9579 includes an additional, new method for DR calculation, which is programmed as an automatic method in the PIM code. The staff reviewed this approach and finds that the methods are acceptable. Further, the manual analysis method remains as a backup in case the PIM calculation results do not converge during the automatic calculation process. The staff finds this acceptable as well. As stated above, this new description of the calculation process and method supersedes the response to RAI 8937; therefore, the staffs final review did not consider the applicants statements regarding the sole use of the manual method made in the response to RAI 8937.

The staff finds that the final PIM methodology relies on two possible automatic DR calculations performed by PIM using either the three-peak or four-peak method. These methods are acceptable to the staff, as described above. If these methods fail to converge the DR, the methodology relies on manual postprocessing of the results, in which the analyst can judiciously select the time interval for the analysis in order to infer the DR. According to the RAI 9579 and 8937 responses, this manual method relies on identifying a time interval in the transient response in which successive peaks can be used to infer the DR of the dominant mode. The process and criteria used for selecting such a time interval are generally well understood, and the staff finds the current description of this process sufficient to ensure that the applicants method will reliably infer the DR. Therefore, the staff finds this manual method and the methodology described in the response to RAI 9579 to be acceptable.

According to the applicant, where the DR cannot be converged using the two-peak, three-peak, or four-peak methods (either automatically or manually), the methodology can rely on another backup calculation method. In the RAI 9579 response, the applicant refers to this final method as the envelope method. The applicants RAI 9579 response describes the envelope method and the following summarizes the staffs understanding of the method based on the applicants description. The envelope method can be applied when the flow oscillations are highly stable.

Therefore, during the decay of the dominant mode oscillation, there are multiple modes still excited. This means that the oscillation cannot be interpreted purely as the decay of the dominant mode. [

]

[

71

] Because the envelope method is conservative as described above, the staff finds this method acceptable for performing the DR calculations under the specific situations laid out in the RAI 9579 response.

Section 8.1 briefly touches on the topic of time-step size and numerical diffusion effects by stating that the [ ]. The method may underestimate the DR if there is significant numerical diffusion. The TR Supplement includes a section devoted to discussing results from the ROM and refers to numerical diffusion in the PIM calculations as a result of having a Courant number less than unity. Section 5.8 of the TR describes the numerical solution; however, it does not include sufficient detail about the required nodalization or time-step size for the staff to determine the degree of numerical diffusion in the calculations. In RAI 8801, the staff requested additional information on the nodalization and the velocity field in the power module primary side. The velocity field will be dependent on the initial conditions assumed in the analysis (namely, the core power). Furthermore, as the applicant described in its response to RAI 8801, the time-step size also depends on the reactor power (ADAMS Accession No. ML17219A738). In the response to RAI 8801, the applicant described the results of sensitivity calculations that demonstrate that the effect of numerical diffusion for the given nodalization and time-step size is small. Section 3.2.5 of this report discusses the staff review of RAI 8801 and its supplement (RAI 9417).

The DR acceptance criterion must be defined with sufficient margin to account for biases (such as those introduced by numerical diffusion) and uncertainty. The staff requested additional information about the validation of PIM against NIST-1 in RAI 9037 and RAI 9106 assuming that this validation formed, in part if not entirely, the basis for the acceptance criterion of [ ]. In the responses to RAI 9037 and RAI 9106, the applicant clarified that the NIST-1 assessment was not appropriately scaled for this purpose and that the validation was not used to determine the acceptance criterion (ADAMS Accession Nos. ML17297A693 and ML18080A231, respectively). Therefore, in RAI 9107, the staff asked the applicant to demonstrate sufficient margin afforded by the [ ] acceptance criterion for DR to account for both uncertainty and numerical diffusion effects.

In its response to RAI 9107 (ADAMS Accession No. ML18089A092), dated March 30, 2018, the applicant stated that the acceptance criterion for the DR [

] is rather arbitrarily selected based on historical experience with BWR stability analysis methodology acceptance criteria. The staff has previously reviewed several methods for BWR stability analysis and has approved several such methods with a DR acceptance criterion of about [ ]. Examples include boiling water reactor stability methods such as ODYSY and STAIF (ADAMS Accession Nos. ML091100194 and ML090750216, respectively). These BWR analysis methods are generally based on frequency domain and include full-scale IET validation to support the uncertainty determination for the methods. Apart from analyzing a different reactor plant type, the staff believes there are several reasons to conclude that the uncertainty in PIM may be different from the uncertainty in the BWR analysis methods, which may require a different margin afforded in the DR acceptance criterion.

First, PIM includes many simple models for thermal-hydraulic and neutron kinetic phenomena.

The simple nature of the PIM modeling in some instances would lead the staff to suspect that uncertainty would be higher for PIM DR predictions when compared to other, higher fidelity analysis methods.

Second, PIM is a time-domain stability analysis method, and is subject to numerical diffusion effects. The applicant analyzed numerical diffusion separately but included the estimated effect

72 in the response to RAI 9107. In response to RAI 9105, the applicant evaluated the numerical diffusion effects and determined that numerical diffusion has an impact on the [

] (ADAMS Accession No. ML18026A939). The staff reviewed the RAI 9105 response and agreed with the applicants analysis. Section 3.2.5 of this report documents the details of the staffs review of the RAI 9105 response. Therefore, the staff accepts this quantity for the numerical diffusion effect but was not able to independently confirm the additional claim that the numerical diffusion effect is offset by conservatism afforded by the adiabatic assumption in the riser.

The staff performed confirmatory calculations of the DR using TRACE, which are discussed in Section 3.5 of this report. In performing those calculations, the TRACE model accounts for heat transfer across the riser heat structure, and the staff also used higher order numerics to minimize the effect of numerical diffusion. The staffs calculations indicate excellent agreement between the PIM and TRACE results, which lends credibility to the claim, but it is not clear if the agreement is a result of these two effects canceling each other out or the result of multiple different and smaller interacting effects.

Without specific validation of the PIM method to quantify the uncertainty, the staff was unable to determine the uncertainty in the PIM-predicted DR. In RAI 9107, the staff proposed that the uncertainty could be estimated based on sensitivity analysis combined with the results from SET validation. However, the applicant did not provide such an analysis in the response to RAI 9107, dated April 3, 2018, (ADAMS Accession No. ML18089A092). The applicant did present some quantitative analysis with respect to possible uncertainty arising from hydraulic characterization, but the results and discussion provided were not sufficient for the staff to fully review the impact of these uncertainties on the PIM-predicted DR.

For the 20-percent power case, the staff used the figures provided in the response to infer the DR but was limited in this effort by having to pull the values of peaks visually from the figures.

Using this visual approach, the staff estimated the difference in the DR for the high-flow and low-flow cases at 20-percent power to be [ ]. However, the difference calculated by the staff is smaller than the uncertainty introduced by the staffs visual approach, so the quantitative impact of the flow sensitivity on the DR was unclear. The staff estimated the uncertainty introduced by the visual approach by computing the DR standard deviation based on several peaks and finds the deviation to be [ ]. The staff could not complete the review without more detailed information on the sensitivity analysis results.

Therefore, in RAI 9579, the staff requested additional information on these sensitivity calculations. In response to RAI 9579, the applicant provided the numerical results of the sensitivity calculations (ADAMS Accession No. ML18353B515). The applicants calculations show that the DR sensitivity to the hydraulic perturbation depends on the power and time in cycle. [ ] In many cases, the calculated DR sensitivity is much smaller and consistent with the calculated values from the staffs results described above. Therefore, the staff finds that the calculated DR is largely insensitive to the hydraulic range analyzed by the applicant. The applicant analyzed this result in the RAI 9579 response and showed that the insensitivity is the result of competing effects with respect to flow.

Lowering the flow from the nominal value can be destabilizing because the core exit temperature change in response to a flow perturbation from the lower flow rate is higher but is simultaneously stabilizing because a lower flow at a given power level implies higher friction losses. These friction losses work in phase with the flow perturbation to damp the oscillation, which is stabilizing.

73 Because of these competing effects, the applicant finds that the DR is largely insensitive to flow uncertainty. The staff reviewed the RAI 9579 response and the rationale regarding the insensitivity to the core flow uncertainty and agrees with the applicants analysis of the results.

The sensitivity of the DR to flow uncertainty, however, must be considered in the determination of the DR acceptance criterion.

The staff finds that the DR acceptance criterion is essentially based on the applicants engineering judgment that the PIM method as applied to the NuScale power module would not have a greater bias or uncertainty than historically approved BWR frequency-domain stability analysis methods. The applicants responses to RAI 9107 and RAI 9579 both discuss this rationale (see ADAMS Accession Nos. ML18089A092 and ML18353B515, respectively). In considering this judgment, it is essential to recognize that, compared to PIM, the BWR analysis methods tend to be high-fidelity methods with detailed models of the thermal-hydraulic and neutronic phenomena. The applicant contended in the RAI 9579 response that this must be considered along with the argument that the NuScale power module is likewise a simpler system, and therefore, accuracy would not be expected to be compromised by relying on simpler models in the stability analysis.

The staff went through each highly important phenomenon identified during its independent PIRT evaluation (see ADAMS Accession No. ML17033A144) and examined how PIM treated each of these important phenomena. In particular, the staff wanted to identify any phenomena that were either treated with inherent conservatism or with detailed, high-fidelity modeling. In the former case, it would not be necessary to account for the uncertainty in the modeling of such phenomena in the assessment of the DR acceptance criterion. In the latter case, addressing the phenomena with highly detailed models lends credence to the applicants claim that the PIM uncertainty would be comparable to the uncertainty in other NRC-approved methods.

Table 2 of this SER describes the staffs review of the highly important phenomena and how they are treated in the PIM stability methodology and discusses the disposition of the uncertainty. With few exceptions, the staff found that the highly important phenomena are effectively treated in the stability analysis methodology using upstream calculations (e.g., NRELAP5 and SIMULATE5) or are treated with conservative approaches (e.g., adiabatic riser approximation). In the few instances in which PIM uses best-estimate internal models (e.g., SG tube conduction), the staff found that the DR would be negligibly affected by the uncertainty in the associated models.

When an upstream method is used to supply input to PIM, these methods (NRELAP5 and SIMULATE5) include higher fidelity models that have been validated to justify the applicability of these methods as best estimate tools to predict the thermal-hydraulic and neutronic performance of the NuScale power module. The staff notes that the review of these methods is outside the scope of the current effort, but they are the subject of separate NRC review and approval initiatives (see ADAMS Accession Nos. ML17004A202, ML17010A429, and ML16243A517).

The staff finds that the uncertainty in the DR as a result of modeling uncertainties is probably within [ ] and further agrees with the applicant that the bias introduced in the DR as a result of [ ]. However, without a detailed uncertainty analysis, the staff cannot conclude that the margin afforded by the [ ] acceptance criterion is sufficient to account for all sources of bias and uncertainty. Therefore, the staff requested additional information in RAI 9579.

74 The applicants response to RAI 9579 characterized different sources of uncertainty (ADAMS Accession No. ML18353B515). Several component uncertainties were shown to negligibly affect the DR results. Therefore, the applicant and staff agree that these uncertainties need not be explicitly included in the DR uncertainty calculation. Of the remaining categories, the staff agrees that there are two primary considerations: (1) the hydraulic uncertainty consideration and the impact on DR, and (2) the impact of numerical effects.

For the first, the RAI 9579 response provides the results of DR sensitivity calculations for a significant perturbation to the friction losses, which in turn, cause substantial differences in the core flow. These differences are in the range of approximately [ ] for the range of friction losses that the applicant considered in its analysis. On the basis of engineering judgment, the staff agrees that this range is a sufficient analysis range to cover the expected uncertainty in the hydraulic characterization and core flow rate. [

]

For the second consideration, the staff reviewed the numerical diffusion effects evaluated and the impact of the numerical diffusion effects on the DR. Section 3.2.5 of this report documents this review. [

]

Given that these are the most significant sources of uncertainty and bias, and that the applicant has quantified them to have a net impact of [ ] on the DR, the staff finds that the DR acceptance criterion of [ ] is sufficient to provide adequate margin to account for uncertainty and bias in the PIM stability analysis methodology.

The applicants response to RAI 9579 also briefly describes biases that can be assessed from validation efforts. In particular, the applicant identifies this consideration as a specific category in the DR uncertainty calculation method and then further describes the results of the comparison between PIM and NIST-1 measurements. The staff reviewed the applicability of the NIST-1 integral validation (see Section 3.2.6 of this report for a more thorough discussion of the staffs review with respect to the NIST-1 validation) and found that NIST-1 cannot be relied on for DR uncertainty quantification. This is partly because of scaling issues. In RAI 9106, the staff requested clarification of the use of NIST-1 in determining the DR uncertainty. In response to that RAI, the applicant stated that the NIST-1 validation was not used to quantify the DR bias or uncertainty (ADAMS Accession No. 18080A231).

Therefore, the staff finds that the response to RAI 9579 is partially misleading. The applicant referred to the bias in the PIM results relative to the NIST-1 validation as a potential indication of conservatism in the PIM method because the PIM calculated DR is larger than the NIST-1 measurements. The staff does not accept this as a valid consideration in the DR bias or uncertainty determination. This is because of the issues raised and dispositioned by RAI 9106.

In the applicants own determination, NIST-1 cannot be relied on for quantification of the DR bias or uncertainty for the NuScale power module. Therefore, the staff clarifies that it did not consider the argument regarding the PIM bias from the NIST-1 validation in its review of the DR acceptance criterion of [ ] and approval of the Stability TR should not be construed as the staffs endorsement of the applicants argument.

This acceptance criterion is applied at [ ]. This range of power is acceptable because the [ ] is sufficiently low that thermal margins are substantial and would not be challenged by possible flow oscillation below this threshold. Therefore, the

75 staff finds that the [ ] DR acceptance criterion applied above 5 percent of power affords adequate margin to account for DR uncertainty in the range of power level where thermal limits may be challenged and is therefore acceptable.

76 Table 2: PIM Treatment of Highly Important Phenomena and Uncertainty Implications System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Core Fuel rods Fission power User input The user inputs the initial fission power to establish the power level at the start of the analysis. Changes in fission power are calculated according to the neutron kinetics. The input could account for plant instrumentation uncertainty in the measurement and monitoring of the core power level. [

]

Core Kinetics Decay heat Conservative The initial fraction of decay heat is set as a conservative minimum or maximum value depending on the analysis according to the staffs condition on decay heat fraction (see Section 3.2.2 of this report). In addition, decay heat fraction is held constant, which means that decay heat is treated conservatively in the PIM methodology. Therefore, it is not necessary to address uncertainty for decay heat.

Core Kinetics Delayed neutrons Supplied by upstream code

[(

)]

The staff has imposed a condition on the kinetic parameters that ensure that the delayed neutron parameters (i.e., delayed neutron fraction and precursor decay constant) are consistent with NRC-approved nuclear design method results or are conservatively bounding (see Section 3.2.2 of this report).

Uncertainty in the delayed neutron parameters should not significantly affect the DR uncertainty since these parameters are calculated either according to a high-fidelity, approved method or are conservatively input.

77 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Core Kinetics Fuel temperature feedback Supplied by upstream code

[(

)]

The staff has imposed a condition on the feedback coefficients that ensure that the feedback coefficient multipliers are set to produce feedback results that are consistent with NRC-approved nuclear design method results or are conservatively bounding (see Section 3.2.2 of this report). Therefore, uncertainty in the feedback coefficient is consistent with the uncertainty in high-fidelity, NRC-approved methods (e.g., [ ]) and can be expected to contribute to overall DR uncertainty in a manner consistent with such methods. Alternatively, the user-supplied input must be conservative relative to the value calculated by the NRC-approved method.

Core Kinetics Moderator density feedback Supplied by upstream code

[( )]

The staff has imposed a condition on the feedback coefficients that ensure that the feedback coefficient multipliers are set to produce feedback results that are consistent with NRC-approved nuclear design method results or are conservatively bounding (see Section 3.2.2 of this report). Therefore, uncertainty in the feedback coefficient is consistent with the uncertainty in high-fidelity, NRC-approved methods (e.g., [ ]) and can be expected to contribute to overall DR uncertainty in a manner consistent with such methods. Alternatively, the user-supplied input must be conservative relative to the value calculated by the NRC-approved method.

Core Kinetics Moderator temperature feedback Supplied by upstream code

[(

)]

The moderator temperature effect is ignored in the PIM models for reactivity feedback; however, the effect is captured in nuclear design methods that evaluate the moderator feedback coefficient (e.g., MTC). Because the staff has imposed a condition in Section 3.2.2 of this report that ensures feedback parameters are input in a manner that is either consistent with a high-fidelity, NRC-approved method or conservative, moderator temperature feedback uncertainty should not significantly affect the DR uncertainty

78 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Core Subchannel Core pressure drop Supplied by upstream code

[( )]

The core pressure drop as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ]

must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results. Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Core Subchannel Natural circulation Supplied by upstream code

[( )]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods (i.e.,

[ ]) and PIM results are anchored to these [ ]

calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results.

Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

79 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Core Subchannel Single-phase convection Best estimate The primary effect of single-phase convection on the NuScale power module stability is the phase lag generated by the net thermal resistance of the fuel element. Since the time scale of the natural period of the reactor is much longer than the fuel thermal time constant (accounting for the heat transfer resistance at the clad-coolant interface), the DR results are largely insensitive to uncertainty in the heat transfer coefficient. Therefore, the staff finds that the uncertainty in the PIM prediction can be expected to have a negligible impact on the calculated DR.

Core Subchannel Single-phase pressure drop Supplied by upstream code

[( )]

The core pressure drop as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods (i.e., [ )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [

] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results. Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Core Subchannel Subcooled boiling Conservative PIM treats the phenomenon of subcooled boiling via the user input boiling coefficient. In Section 3.2.1.8 of this report, the staff has imposed the condition that the boiling coefficient must be input as the default value, which the applicant has demonstrated to be conservative for PIM analysis.

Therefore, the staff finds that the PIM methodology conservatively treats subcooled boiling, so it is not necessary to consider the uncertainty in subcooled boiling in the DR uncertainty.

80 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Primary Downcomer Single-phase pressure drop Supplied by upstream code

[( )]

The primary mechanism by which pressure drop affects primary-side instability is through the effect that such pressure drop has on the evolution of the RCS flow rate during the transient perturbation analysis. However, the pressure drop in the PIM primary side is adjusted so as to match the core flow rate predicted by [ ] in the steady state. Since DR calculations are based on small perturbations from the initial condition, the contribution of the pressure drop uncertainty to DR uncertainty will be consistent with the uncertainty contribution of a high-fidelity thermal-hydraulic method such as [

].

Primary Downcomer Vertical/radial natural circulation Supplied by upstream code

[( )]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results.

Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Primary Hot-leg riser Flashing Conservative PIM includes a conservative assumption of adiabatic conditions in the riser, which promotes riser flashing. This conservative treatment of the riser ensures that PIM provides conservative predictions with respect to riser flashing. Therefore, it is not necessary to consider the uncertainty in flashing in the DR uncertainty.

Primary Hot-leg riser Ledinegg instability Outside of scope

[

]

81 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Primary Hot-leg riser Vertical/radial natural circulation Supplied by upstream code

[( )]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [

] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results. Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Primary Lower plenum Vertical/radial natural circulation Supplied by upstream code

[( )]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results. Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

82 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Primary SG annulus Convection heat transfer to the SG tubes Supplied by upstream code

[( )]

The SG heat transfer in PIM is adjusted during the initialization process to achieve a heat balance consistent with [ ] predictions of the primary-side thermal-hydraulic conditions. This ensures that the total heat transfer from the primary to secondary side calculated by PIM is the same as the heat transfer predicted by the more sophisticated [ ] method, which, as stated in Section 3.2.4of this report, must be approved by the NRC.

The staff has considered the transient variation in these parameters affecting heat transfer between the primary and secondary sides and finds that these will be a minor contributor to the PIM uncertainty. Therefore, the DR uncertainty caused by uncertainty in parameters affecting the phenomenon of heat transfer from the primary side to the secondary side will be consistent with the uncertainty contribution from a high-fidelity, NRC-approved thermal-hydraulic method [( )].

Primary SG annulus Single-phase pressure drop Supplied by upstream code

[( )]

The primary mechanism by which pressure drop affects primary-side instability is through the effect that such pressure drop has on the evolution of the RCS flow rate during the transient perturbation analysis. However, the pressure drop in the PIM primary side is adjusted so as to match the core flow rate predicted by [ ] in the steady state. Since DR calculations are based on small perturbations from the initial condition, the contribution of the pressure drop uncertainty to DR uncertainty will be consistent with the uncertainty contribution of a high-fidelity thermal-hydraulic method such as [

].

83 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Primary SG annulus Vertical/radial natural circulation Supplied by upstream code

[(

)]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )], and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results. Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Primary Upper plenum Vertical/radial natural circulation Supplied by upstream code

[( )]

Primary-side natural circulation flow as calculated by PIM is initialized based on more sophisticated thermal-hydraulic analysis methods [( )],

and PIM results are anchored to these [ ] calculated initial conditions describing the primary-side hydraulics. Because the DR calculations evaluate small perturbations to the initial condition, the PIM thermal-hydraulic models will have a minor contribution to the uncertainty above the contribution from uncertainty in the conditions supplied upstream by [ ]. As discussed in Section 3.2.4 of this report, the staff has imposed the condition that [ ] must be approved by the NRC staff to analyze the steady-state conditions and provide best estimate results.

Therefore, the contribution to the DR uncertainty from this parameter can be expected to be similar to the contribution from a high-fidelity, NRC-approved model.

Secondary SG tubes Conduction through the tube wall Best estimate The PIM model for tube conduction is based on first principles and uses a detailed nodalization. The staff considered the potential uncertainty in DR from uncertainty in the conduction prediction (which is expected to be small),

but because the time scale for tube conduction is much smaller than the natural period of the reactor primary system, a significant variation in the tube conduction would produce a small variation in the predicted DR. Since the uncertainty in the conduction itself is small, the impact of this uncertainty on DR uncertainty is expected to be negligible.

84 System Component Process/

Phenomenon Approach in PIM Methodology Uncertainty Disposition Secondary SG tubes Ledinegg instability Outside of scope Ledinegg instability is not analyzed with PIM and is therefore not a factor in the PIM DR uncertainty Secondary SG tubes Two-phase heat transfer Supplied by upstream code

[(

)]

The SG heat transfer in PIM is adjusted during the initialization process to achieve a heat balance consistent with [ ] predictions of the primary-side thermal-hydraulic conditions. This ensures that the total heat transfer from the primary to the secondary side calculated by PIM is the same as the heat transfer predicted by the more sophisticated [ ] method.

The staff has considered the transient variation in these parameters affecting primary-to-secondary-side heat transfer and finds that these will be a minor contributor to the PIM uncertainty. Therefore, the DR uncertainty resulting from uncertainty in parameters affecting the primary-to-secondary-side heat transfer phenomena will be consistent with the uncertainty contribution from a high-fidelity, NRC-approved thermal-hydraulic method [( )].

85 3.3.2 Transient Method The second method, as described by the applicants Stability TR, includes a transient calculation, performed by applying a time-dependent function to various boundary conditions (e.g., system pressure). PIM then calculates the transient power module response. The transient flow response can be analyzed to determine the point in time when the power module becomes unstable (if the power module becomes unstable). This time can be compared to the time when the MPS protective trip would actuate (based on calculation of the core exit temperature). The method then uses the results of the calculation to demonstrate margin between the MPS protective trip function and the onset of instability. The method uses margin in the timing between reactor trip and instability onset to demonstrate the effectiveness of the MPS protective trip to adequately enforce the exclusion region and prevent instability. The staff finds this approach reasonable as long as the applicant demonstrates that the PIM code can accurately predict the onset of instability. Time-domain methods may be subject to nonconservatism in the prediction of instability onset if the reactor can attain an unstable configuration, but the analysis code does not indicate the onset of instability because there is no perturbation mechanism to initiate oscillation. The staff considers that in an actual operating reactor, as opposed to a code simulation, noise would result in any unstable configuration evolving oscillations. (For a more thorough description of this type of concern as it applies to the NRCs TRACE code, see Reference 2.) In the staffs TRACE code, noise can be applied to the analysis through a feature in PARCS to ensure that the code predicts oscillation growth at the point of instability onset. In RAI 9173, the staff requested additional information regarding the efficacy of PIM to predict the instability onset and whether it was necessary to apply some kind of perturbation or noise in the transient calculations.

In response to RAI 9173, the applicant provided the results of transient analyses using different artificial perturbation methods (periodic disturbances and random noise) (ADAMS Accession No. ML18099A374). The results of the calculations demonstrate that the instability onset timing is the same regardless of whether noise is applied in the calculation. The staff reviewed these results and concurs with the applicants determination that the inclusion of noise does not appreciably affect instability onset timing. Therefore, the staff agrees that consideration of artificial perturbations or noise is not required for the transient calculations performed using PIM to reliably show the timing of instability onset.

The transient analysis method ignores any transient effects from control system operation that may occur. The staff finds that this approach is acceptable as long as it has been demonstrated that the control system functions are stabilizing.

Overall, the staff finds that the transient analysis method is acceptable to calculate the specific figure of merit, which in this case is the difference in timing between the successful insertion of the control rods and the onset of the instability so long as the control system functions have been demonstrated to be stabilizing.

3.4 Stability Solution 3.4.1 Exclusion Region-Based Long-Term Stability Solution Section 10.3 of the Stability TR describes the LTS solution. The LTS solution is an approach based on an exclusion region, whereby GDC 12 is met by demonstrating that instability is not possible within the allowable operating region. An MPS trip protects the exclusion region

86 boundary by tripping the reactor. The applicant defined the operating region by a minimum subcooling margin in the riser. Figure 10-1 of the Stability TR illustrates the LTS solution.

Because the primary instability mode is the riser instability mode for the power module, the staff agrees that the LTS approach is adequate to demonstrate compliance with GDC 12 as long as the exclusion region boundary is protected by the MPS trip on low riser subcooling.

The MPS trip setpoint affords a margin of 5 degrees F. This margin, however, is based on comparing the core exit temperature to the saturation temperature as determined according to pressurizer pressure. Because pressure at the core exit is slightly higher than the pressurizer pressure, there is slightly more margin, but this conservativism is small.

PIM analyses have been performed to demonstrate that the DR is less than or equal to [ ] at 5 percent of rated power or greater and when there is riser subcooling margin to demonstrate that the reactor is inherently stable under these conditions, thus ensuring GDC 12 is met. The applicant also performed transient PIM analyses to demonstrate that the MPS trip on riser subcooling precludes the onset of instability during AOOs. These analyses demonstrate that the LTS solution is effective in meeting the requirements of GDC 10 and GDC 12, assuming that the reactor trip is sufficient to suppress any oscillations in the power module. Section 3.4.4 of this report further addresses the topic of suppression.

The MPS trip that protects the exclusion region is based on safety-related instrumentation and associated protection systems which trip the reactor. Therefore, the staff finds that the proposed LTS solution meets GDC 13, 20, and 29 which require that the LTS solution be based on appropriate safety-related instrumentation capable of sensing reactor conditions and a reactor protection capability that inserts control rods that are effective in shutting down the reactor when applicable setpoints are exceeded 3.4.2 Steady-State Demonstration Section 8.1 of the Stability TR provides demonstration analyses performed with PIM to show that the power module remains stable under steady-state operating conditions at various power levels. The power levels considered the range from 1 percent to 100 percent of rated power level. The applicant performed a special set of calculations at 20 percent of rated power (32 MW) to account for startup procedures; in effect, the feedwater temperature increases once the turbine is brought online and steam is fed to the feedwater heaters, so the applicant performed calculations at both low and high feedwater temperatures at 32 MW.

The results of the calculations show that under conditions of steady-state operation, the NuScale power module is stable. At high power, the stability margin is substantial. As power is decreased, the DR increases, but this trend is expected based on the response (ADAMS Accession No. ML18080A231) to RAI 9106, Question 01-58.

The Stability TR provides the results at 20-percent power, for the low-feedwater temperature case and reports that the case for high-feedwater temperature is slightly more stable. In RAI 9176, the staff requested additional information about the DR results. The staff asked that the applicant provide the results of both calculations and analyze the differences on the basis of the SG gain. The applicant provided more detailed analysis results in its response (ADAMS Accession No. ML18058A786) to RAI 9176. The applicant provided the PIM-calculated DR for the case [ ]. The applicant performed an analysis using the analytical model described in Section 7 of the Stability TR (accounting for changes in the heat sink temperature at lower feedwater temperature). The results from the

87 analytical calculations show a milder sensitivity but indicate the same direction of the change in DR with increasing feedwater temperature. The staff reviewed the applicants PIM calculation results and the analytical results reported in the response and finds that the explanation is reasonable and acceptable.

At low power, the DR increases, and the results show that the DR reaches [

]. This is below the proposed DR acceptance criterion of 0.8 in the Stability TR, but this criterion applies only for [ ]. The results show that, even at very low power levels, the calculations show the power module appears stable. The Stability TR compares the long-term response for the 1-percent case to the 25-percent case (40 MW) and concludes that the results are consistent, but the Stability TR does not make clear the way in which the 25-percent and 1-percent power cases are consistent in their long-term response.

The 1-percent case shows that the oscillations are damped but persist for a long time because of the relatively high DR, whereas oscillations decay faster in the 25-percent power case.

The calculations performed by the applicant using PIM demonstrate that the NuScale power module is stable under all conditions of steady-state operation from low to nominal power levels, thereby demonstrating that GDC 12 is met for steady-state operation. The DR trends observed in the calculation results correspond well with the trends predicted by the stability analogue, which confirms the applicants understanding of the physical processes driving the trend. On the basis of the analysis results and RAI responses, the staff finds that the applicant has adequately demonstrated that instability is not possible under conditions of normal, steady-state operation. However, the staff agrees with the applicants discussion in Section 10.2 that the applicability of these analyses must be confirmed on a cycle-specific basis based on the reactor core design because of changes in the reactivity feedback coefficients. Further, from Section 10.4 of the Stability TR, the staff understands that final analyses will be performed for the final design and submitted to the NRC as part of the design certification application. The staff finds that the steady-state demonstration analysis provided, which is based on the current design information, serves as an adequate template for approach and scope in the final analysis as it relates to compliance with GDC 12 on a steady-state basis. Section 3.4.3 of this report discusses the staff review of the impact of AOOs as it relates to GDC 12.

3.4.3 Transient Demonstration Sections 8.2 and 9 of the Stability TR address stability during AOOs. The Stability TR divides these events into two categoriesevents where the reactor remains stable and events where the LTS solution MPS protective trip is credited with precluding the onset of instability.

Section 8.2 of the Stability TR discusses the former, and Section 9 discusses the latter. The applicant systematically considered AOOs according to the standard categories and addressed potentially limiting events within each category. The staff similarly considered these types of events in its independent PIRT (ADAMS Accession No. ML17033A144). The events identified are not the same as those identified in Chapter 15 of the SRP because the Chapter 15 events are considered based on challenging the thermal margin and tend to result in automatic trip. In the current analysis, and particularly for the events described in Section 8.2 of the Stability TR, the limiting events from the stability perspective are not necessarily the events that are limiting from the standpoint of thermal margin, because the stability considerations are more significant when the reactor does not automatically trip.

In addition to the AOOs, the applicant also considered certain plant transients: oscillating secondary-side flow, gradual shutdown, and startup (nonnuclear heatup). The staff likewise

88 separated startup and shutdown from AOOs in its independent PIRT (ADAMS Accession No. ML17033A144), and the staff agrees with the applicant that these transients are appropriate for consideration in the analysis to demonstrate transient stability.

3.4.3.1 Increase in Heat Removal by the Secondary System Section 8.2.1 of the Stability TR addresses AOOs that increase heat removal by the secondary system. The applicant analyzed an escalation in feedwater flow that results in an increase in heat removal but is a sufficiently mild perturbation to the power module that it does not result in an automatic trip of the reactor. The staff agrees with the applicants approach to determine the limiting conditions with respect to this class of AOO for the stability analysis. The approach determined a maximum feedwater flow increase to result in the maximum increase in power that will not result in an automatic trip of the reactor. The applicant performed calculations using PIM at rated power initial conditions and confirmed that the reactor remains stable. The applicant performed a second calculation at 20 percent of rated power (the minimum power for which the feedwater heater system and turbine are online). The applicant also confirmed that the reactor remains stable at these lower power calculations.

3.4.3.2 Decrease in Heat Removal by the Secondary System Section 8.2.2 of the Stability TR addresses AOOs that decrease heat removal by the secondary system. The applicant analyzed a reduction in feedwater flow that results in a decrease in heat removal but is a sufficiently mild perturbation that the reactor does not trip. In determining this feedwater flow reduction, the applicant considered a 50-percent flow reduction, which would, operationally, correspond to a partial loss of feedwater and a successful runback to avoid a reactor trip. In the calculations, operation of the MPS to trip the reactor based on high rate of flux change was not credited. Ignoring the rate of flux change trip is acceptable in determining a bounding feedwater flow reduction. The staff agrees with the applicants approach to determine the limiting conditions with respect to this class of AOO for stability analysis. The applicant performed calculations using PIM at rated power initial conditions and confirmed that the reactor remains stable. The applicant performed a second calculation at 20 percent of rated power (the minimum power for which the feedwater heater system and turbine are online). The applicant performed the lower power calculation with a decay heat power set to 35 percent. Since decay heat is static in the PIM calculations, increasing the decay heat fraction has the effect of damping reactivity feedback (reactivity feedback is generally stabilizing), and the staff agrees that selecting a high value of decay heat fraction can produce conservative results. In RAI 8873, the staff requested additional information regarding the methodology for selecting the decay heat fraction. Section 3.2.2 of this report discusses this aspect of the method in greater detail. The results of the calculations confirm that the power module remains stable at low power.

Section 9.1 of the Stability TR expands on the analysis performed by the applicant in Section 8.2.2. In Section 9.1, the applicant provided the results of an analysis assuming no reactivity feedback from the moderator. Under these assumptions, the reactor power remains relatively high even as the primary-side temperature increases. The reactivity still decreases as the fuel temperature increases, as reflected in Figure 9-3 of the Stability TR. The applicant performed the transient calculation under these conditions to demonstrate that the MPS protective trip would occur before the power module becomes unstable.

Figure 9-1 illustrates the temperature transient and shows that the MPS protective trip occurs as the core exit temperature reaches the saturation point. Figure 9-4 shows that, accounting for

89 the MPS trip delays, the control rods would shut down the reactor very shortly after the first void formation at the top of the riser. The staff finds that the analysis sufficiently demonstrates the effectiveness of the MPS protective trip to protect against riser instability in the event of a limiting decrease in secondary-side heat removal.

3.4.3.3 Decrease in Reactor Coolant System Flow Rate Section 8.2.3 of the Stability TR states that the applicant does not consider a decrease in the reactor coolant system (RCS) flow rate a credible event for stability analysis. However, the staff disagrees with this assessment. During a postulated AOO, it is easy to conceive of a sequence involving inadvertent operation of components related to the CVCS that could lead to reduced or increased primary system flow (such as CVCS pump overspeed, or pump trip). Since the CVCS is essentially external to the primary flow circuit, such AOOs could impact the RCS without other effects. In RAI 8814, the staff requested additional information on changes in RCS flow rate as a result of CVCS malfunction.

In the response to RAI 8814, the applicant provided several paragraphs of commentary about the importance of the CVCS flow (ADAMS Accession No. ML17219A145). The response compared the CVCS flow rate and CVCS heat removal to normal operating conditions. The staff does not find these discussions to be germane because the analysis methodology must consider even low-power and low-flow conditions, such as reactor startup, where the CVCS can play a more significant role. Regardless, the staff reviewed the balance of the applicants response and found two aspects of the response sufficient to address its concern.

First, the response correctly states that a decrease in CVCS flow (for example, because of a pump trip) would produce a more adverse condition in terms of stability because the CVCS injects colder water into the riser. A loss of CVCS flow would therefore remove a source of cold water from the riser flow and lead to a decrease in the riser subcooling margin; however, a loss of heat sink would bound any AOO initiated by a reduction of CVCS flow. Section 3.4.3.2 of this report discusses events that result in a decrease in secondary-side heat removal. The staff agrees with the applicants assessment and finds that events that reduce secondary-side heat removal would generically bound AOOs initiated by a reduction in CVCS flow.

Second, the applicant described how an increase in CVCS flow would provide additional cold water to the riser and thereby increase the riser subcooling. This event would increase the stability margin. Therefore, from a stability perspective, an AOO initiated by a CVCS flow increase is bounded by other AOO categories generically.

Since the applicant has demonstrated that AOOs initiated by malfunction of the CVCS are generically bounded by other events, the staff agrees with the response insofar as it finds performance of a stability analysis for CVCS malfunction unnecessary. As the CVCS malfunction is the only precursor to independently initiate a change in RCS flow, the staff further agrees that this general class of transients does not need to be specifically analyzed.

However, the staff disagrees with the applicants assertion in the RAI response that a CVCS malfunction leading to a reduction in RCS flow rate is not a credible event. The staff finds that it is a nonlimiting event, but the event is certainly credible because this event is classified by the applicant as an AOO, see Section 15.5.1.1 of Chapter 15 of the NuScale DCD.

Further, the response discusses a trip based on low-low RCS flow. The staff did not consider this trip in its current review because this trip is not part of the exclusion-based LTS solution methodology. The staff finds that without consideration of this report, the response remains

90 sufficient to demonstrate that events under the category of RCS flow decrease are nonlimiting and do not require separate analysis.

3.4.3.4 Increase in Reactor Coolant Inventory Section 8.2.4 of the Stability TR addresses AOOs that increase the RCS inventory. The applicant first dispositioned pressurization events. The staff agrees with this disposition because events that increase the RCS inventory and simultaneously increase pressure are nonlimiting because the subcooling margin of the riser increases with increasing pressure.

Therefore, the primary type of event considered must be an increase in inventory without a commensurate increase in pressure; this could only be achieved in the power module assuming operation of pressurizer control systems such as heater and spray. A hypothetical malfunction and inadvertent operation of the pressurizer spray would increase RCS inventory but could be compensated by the pressurizer heater to maintain pressure. Under such a scenario, the stability characteristics of the power module are not affected at all. The only other means for increasing RCS inventory is through the CVCS; the primary effect of increasing the inventory (assuming that pressure can be automatically controlled and maintained during the event and that the inventory change is sufficiently small that trips related to the pressurizer level are avoided) would be on the primary-side flow rate. A CVCS malfunction that injects cold water into the riser would result in a small perturbation to the primary-side flow rate in addition to adding inventory to the RCS; therefore, this event would track closely with the event postulated by the staff in RAI 8814 and is the subject of the staff review documented in Section 3.4.3.3 of this report. Although the Stability TR did not completely describe the possible injection sources in the pressurizer, overall, the staff agrees with the applicants disposition that events that increase inventory, but also maintain pressure, are very likely to be bounded by the events that increase or decrease heat removal by the secondary side.

3.4.3.5 Reactivity and Power Distribution Anomalies Section 8.2.5 of the Stability TR addresses reactivity and power distribution anomalies. Under this category, the Stability TR states that boron concentration changes via the CVCS are generally slow and that these events would likely be bounded by other analyses. The staff agrees that a CVCS malfunction resulting in boration or dilution would likely be a slowly evolving transient and would be bounded by, or at least similar to, the events that increase or decrease heat removal from the primary system. In terms of control rod withdrawal, the staff agrees that protective trips are designed to protect thermal margins for control rod withdrawal events.

Therefore, to be considered for further analysis, a reactivity insertion from a control rod withdrawal would have to be sufficiently mild so as not to initiate a reactor trip on high flux or high rate of flux change. To this end, the applicant analyzed a hypothetical reactivity increase of 25 cents over 10 seconds starting from low power (20 percent of rated). The staff finds this approach to be reasonable given the above considerations. The analysis considers BOC and EOC conditions, and the staff finds that both cases demonstrate a high degree of stability.

3.4.3.6 Decrease in Reactor Coolant Inventory Section 8.2.6 of the Stability TR discusses a decrease in RCS inventory, and the staff agrees that a decrease in inventory without a commensurate decrease in pressure would result simply in a reactor trip based on low pressurizer level; therefore, those types of events need not be considered. The applicant then discussed events that result in reduced pressure and concluded that events that do not reduce pressure sufficiently to result in riser flashing will not result in instability. The staff generally agrees with this assessment by the applicant but, in RAI 8921,

91 sought clarification with respect to upper plenum flashing. The staff asked the applicant to discuss the implications of upper plenum flashing on stability during depressurization AOOs.

In the response to RAI 8921, the applicant provided analyses that study the sensitivity of the results to flashing (ADAMS Accession No. ML17268A387). The results confirm that the key parameter affecting the stability performance is the riser void fraction. When the applicant performed PIM calculations that suppress flashing, the results (in terms of instability onset timing) are insensitive. The results are insensitive because the onset timing is driven by void generation in the core more than by riser flashing. Section 3.2.7 of this report discusses the staff review of associated phenomena at greater length. The staff finds that this demonstrated insensitivity is sufficient to address any concerns associated with the modeling of flashing in the upper plenum.

Section 9.2 of the Stability TR addresses AOOs that could result in riser voiding. The applicant simulated a depressurization event that decreases the reactor pressure to [

]. The analysis conservatively ignores the low pressurizer pressure trip setpoint of 1,600 psia. The purpose of the analysis is to demonstrate that the MPS protective trip on low riser subcooling margin is sufficient to trip the reactor before the reactor develops large amplitude flow oscillations. Figure 9-8 in the Stability TR shows the results of the primary-side flow calculation, which confirm that the MPS trip occurs well before the onset of flow instability. Therefore, the results confirm that the LTS solution is effective in preventing the onset of instability as the result of riser voiding for depressurization AOOs.

3.4.3.7 Effect of Oscillating Secondary-System Flow Section 8.2.7 of the Stability TR provides the results of an analysis performed with an oscillatory feedwater flow perturbation. The purpose of the analysis is to demonstrate that secondary-side perturbations do not produce a resonant effect on the primary side that leads to growing flow oscillations. The applicant provided correction pages to this section of the Stability TR in to the TR Supplement (ADAMS Accession No. ML16340A756). The correction addresses an inconsistency between the Stability TR text and figures in this section with respect to the magnitude of the applied perturbation. The case analyzed is the 20-percent power case because the DR is higher at lower power, and 20 percent is the minimum power level at which the turbine and feedwater heater system are active. The staff notes that the applied feedwater flow [ ] is roughly double the natural frequency of the power module under the analyzed conditions ([ ] per Section 8.1.5 of the Stability TR). The natural period appears to be roughly half of the transit time based on the PIM calculations provided in the Stability TR. The staff considered a positive temperature perturbation in a localized pulse to the RCS flow, which would have a positive effect on the flow while the temperature perturbation traverses the reactor core and riser but would have a negative effect on the flow while the temperature perturbation traverses the SG tube annulus and downcomer.

Accordingly, it would make sense for the natural period to correspond with half of the transit time. To assess the susceptibility of the primary system to resonant effects, the calculations should be performed with a feedwater flow perturbation applied at the resonant frequency or integer multiples of that frequency. Therefore, as part of RAI 9089, the staff asked the applicant to perform additional analyses applying secondary-side feedwater oscillations with [

]. These periods account for twice the natural frequency, as well as a small band around the natural frequency of the primary side.

92 In its response to RAI 9089, the applicant provided an analysis of the primary-side flow oscillation magnitude as a function of external excitation from a feedwater flow oscillation for a wide range of frequencies, including the specific frequencies requested by the staff (ADAMS Accession No. ML18019A944). The response showed that the primary-side flow oscillation resonance is shallow and wide. The staff reviewed the results and agrees with the applicant that excitation, even at the resonant frequency, does not result in growing primary-side flow oscillations and is therefore acceptable. (For further discussion of the nature of interactions between the secondary and primary sides, see Section 3.1.1.4 of this report.)

3.4.3.8 Stability during Gradual Shutdown Section 8.2.8 of the Stability TR provides calculations for a gradual shutdown of the power module. The analysis is performed in PIM starting from full power and then slowly reducing the secondary-side feedwater flow rate. The primary side follows the secondary-side change in flow, and power is gradually reduced. The analysis covers the window from 100-percent power to a power level below 20 percent (below the level of feedwater heater system operation). The change in flow rate is relatively slow, and for this reason, artificial perturbations are applied during the calculation to determine the DR during the transient evolution. The staff agrees with this approach of using artificial perturbations to induce oscillations to infer the stability margin.

The results are consistent with the trends observed in the steady-state calculation results in Section 8.1 of the Stability TR. The calculations are presented for BOC, but the Stability TR reports that EOC results are consistent though with smaller oscillations, as would be expected given the stronger MTC. The staff reviewed the results and finds that they appear to demonstrate that, for sufficiently slow shutdown operations via control by the feedwater system, the power module stability matches that predicted by the steady-state calculations at various power levels. The results and conclusion are reasonable. The staff finds that the steady-state analyses shown in Section 8.1 of the Stability TR, in concert with the analysis provided in Section 8.2.8, provide an acceptable basis for concluding that the reactor remains stable at various power levels and during slow power reduction maneuvers that may occur during operation.

3.4.3.9 Stability during Nonnuclear Heatup Section 8.2.9 of the Stability TR addresses nonnuclear startup maneuvers. Several key assumptions are made in the analysis. First, the exact startup trajectory can vary within an operating window, so the analysis performed is intended to be representative. The applicant assumed that any deviations from the demonstrated startup would have only a small impact on stability. Second, the heat capacity of the power module structures is neglected. This means that the analysis artificially increases the heatup rate of the primary system because the CVCS also does not have to bring components such as the vessel up to temperature. Third, from a stability perspective, CVCS heating and decay heat are indistinguishable during startup. While the effects of these assumptions may be small, they must be considered in terms of the calculated stability margins. In much the same method used for the shutdown calculations in Section 8.2.8 of the Stability TR, perturbations are applied during the transient to observe oscillations and infer the stability margins. Figure 8-57 of the Stability TR presents the key result from this analysis. The flow oscillations are shown to damp in all cases where they are applied. The staff concludes that the stability analysis demonstrates stability during nonnuclear startup.

93 3.4.4 Worst Rod Stuck Out, Return to Power, and Low-Power/Low-Pressure Considerations Design Certification Application (DCA) Part 2, Tier 2, Chapter 15, Transient and Accident Analyses, dated December 31, 2016, Section 15.0.6 of the Design Control Document discusses the consequences of a return to power when the strongest control rod is stuck out of the core during design-basis events (ADAMS Accession No. ML17013A286). The staff considered that this presents a challenge to meeting GDC 10 and GDC 12. In a scenario such as inadvertent opening of a reactor safety valve (RSV), this event would result in a reactor trip and actuation of the decay heat removal system (DHRS). If, coincidentally, the worst rod is stuck out (WRSO) as may occur due to a malfunction resulting in stuck rods, the event may progress as follows:

(1)

Reactor trip reduces the core average power level, but radial peaking is high near the WRSO location.

(2)

RCS pressure decreases in response to a combination of inventory loss through the open RSV and cooling from the DHRS.

(3)

Pressurizer heater is tripped off because of low level, and RSV ventline is isolated.

(4)

RCS pressure and temperature continue to decrease in response to DHRS operation.

The staff was concerned that the combination of low core average power, flow, and RCS pressure may create conditions where the reactor becomes susceptible to flow instability. If a [

], the staff finds that the RCS pressure will likely be [

] with coolant temperature of [ ]. Low pressure could result in a smaller subcooling margin combined with higher liquid water densities, increasing the likelihood of instability and recriticality.

The staff considers that modest power levels of [ ] would likely be sufficient to result in flows of [ ] of nominal flow rate and lead to a core temperature rise of [

]. This could result in temperature approaching saturation if the core experiences a return to power.

It should be noted that an instability that develops about 1 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> following a trip cannot be suppressed because the reactor trip has already occurred.

The staff was also concerned that the exclusion-region-based approach to demonstrating compliance with GDC 12 may not succeed because the protective trip does not preclude the reactor from reaching conditions where reactor instability is possible.

The staff was not certain that GDC 10 would be met under these conditions. The applicant analyzed an unmitigated instability for a depressurization scenario in which the reactor trip was presumed to fail, and this case shows oscillation magnitude of [ ] in core average flow rate. However, this failure was accompanied by power oscillation. The presence of control rods would damp any inherent reactivity feedback mechanisms (but reactivity feedback would be stabilizing).

The flow oscillation would be driven by the average core power level; however, very high radial peaking is likely in the vicinity of the WRSO. If the peaking factor is about 5 to 10, the hot assembly power may be about 25 to 100 percent of nominal power. Average core flow rate

94 would be reduced to about [ ] of nominal. This would imply an already degraded thermal margin even without consideration of flow oscillation.

If oscillations of about 30 percent occur in flow, the minimum flow may reach as low as about 20 percent nominal. Considering that the flow oscillation period is much greater than the fuel thermal time constant [( )] and that the neutronic feedback is damped by the control rods, the thermal margin may be significantly degraded because a situation would develop that would be largely similar to (in the worst case) a steady-state condition at 100-percent power and 20-percent flow for the hot assembly.

Because the staff considered that a depressurization AOO in combination with the WRSO could result in flow oscillations that may challenge SAFDLs, in RAI 8803, the staff asked the applicant to analyze possible instability during such transients and to evaluate whether stability margin would be maintained.

In its August 30, 2017, response (ADAMS Accession No. ML17242A333) to RAI 8803, the applicant referred to its July 24, 2017, response (ADAMS Accession No. ML17205A649) to RAI 8771, Question 15-01. However, the staff found that the response to RAI 8771, Question 15-01, was focused on the return to power that may occur during a design-basis LOCA event. The staffs RAI 8803 addressed flow instability that may occur during an AOO after reactor trip but assuming WRSO. The pressure may be an intermediate value between normal operating pressure and the low pressure experienced during LOCAs. Therefore, to address depressurization AOOs that may result in a wider range of intermediate RPV pressures, the staff requested supplemental information in RAI 9444.

In response to RAI 9444, the applicant provided an analysis of a depressurization event with a return to power (ADAMS Accession No. ML18229A336). First, the applicant considered an event without actuation of the emergency core cooling system (ECCS). The applicant assumed that the RPV is cooled by the DHRS starting from an EOC condition and that the reactor trips with the WRSO. The transient analyzed by the applicant is consistent with the type of AOO considered by the staff. The event was analyzed at the EOC because this point in cycle has the largest magnitude of the moderator feedback coefficient. At EOC, the cooldown can be expected to produce the most severe return to power. Therefore, the applicant provided an analysis at EOC to maximize the power level achieved during the cooldown. However, because strong reactivity feedback is stabilizing, the applicant used a conservative methodology to analyze the stability margin during the return to power.

NRELAP5 was used to analyze the cooldown assuming EOC reactivity parameters. The NRELAP5-predicted conditions were then fed into a PIM calculation to determine the DR during the return to power. The PIM calculations were performed using the reactor conditions where NRELAP5 predicts that the reactor is critical and in a new steady condition. The applicant was able to adjust the moderator feedback coefficient in the PIM calculation and conservatively evaluated the DR with a zero moderator reactivity coefficient. The PIM calculations showed a [

]. These results confirm that the reactor remains stable with significant margin during postulated depressurization scenarios. The applicants analysis methodology also includes substantial conservatism by combining the worst combination of reactivity parameters for the two parts of the calculation.

The applicant also considered the possibility of ECCS actuation. The ECCS may actuate under certain circumstances following initiation of a depressurization AOO. The response to RAI 9444 states that the event with ECCS actuation would produce the most limiting conditions with

95 respect to thermal margin. Actuation of ECCS will result in a significant release of RPV mass and energy into the containment vessel, and as a result, the liquid level in the RPV will drop below the riser. Because the natural circulation flow circuit is broken, the applicant could not analyze the event with PIM. The staff has reviewed the PIM method and concurs that it would not be able to analyze conditions when the level drops below the top of the riser.

Therefore, in the response to RAI 9444, the applicant used NRELAP5 to analyze the ECCS actuation phase of the AOO. The analysis shows that the flow oscillates in the long term, but this occurs because the flow stagnates once the level drops below the riser. The flow becomes oscillatory once the natural circulation flow pattern breaks because of the feedback between flow driving head and core void fraction. Ultimately, the core power oscillation is limited by the magnitude of the core void that can be sustained in the core and still remain critical. The staff has reviewed the applicants analysis and concurs with the conclusions.

Ultimately, if the ECCS actuates in response to a depressurization AOO, then the level will drop below the top of the riser, and the riser instability mode is not possible. Rather, flow oscillations can be expected but will be limited by the dynamic interaction of core void formation, flow, and density driving head. The staff agrees that PIM cannot analyze these conditions and that NRELAP5 is better suited to simulate these conditions. The results of the calculations presented in the RAI 9444 response show substantial thermal margin.

Therefore, the staff finds that the applicant has adequately addressed the possibility of flow instability as a result of depressurization with the WRSO. The applicants analysis of the AOO scenario without ECCS actuation and WRSO is conservative and demonstrates significant DR margin. The applicants analysis of the AOO scenario with ECCS actuation demonstrates that the riser instability mode is not possible and that any flow oscillations that would develop are limited and would not challenge the thermal margin.

Therefore, even considering the possibility of a reactor trip with the WRSO, the staff finds that, subsequent to the MPS trip, the LTS solution is effective in precluding flow instability that would challenge SAFDLs. Thus, the relevant requirements of GDC 10 and 12 are satisfied.

3.5 Confirmatory Analysis The staff performed confirmatory calculations using TRACE. The staff used these calculations to confirm (1) the trend of DR with power, which is described in Figure 7-1 and Section 8 of the Stability TR, and (2) the transient depressurization results described in Section 9.2 of the Stability TR.

3.5.1 Stability Trend with Power The staff compares the TRACE calculation results to the applicants PIM results for different power level cases in Table 3. At 1.6, 32, and 160 MW, the staff calculations are in excellent agreement with the PIM reference results.

96 Table 3: TRACE Confirmatory Calculations of DR and Period TRACE PIM Power (MW)

DR Period (s)

DR Period (s)

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

[ ]

The staffs confirmatory calculations demonstrate the same trend of both DR and period as the applicants PIM results.

3.5.2 Results of Analysis of Depressurization Anticipated Operational Occurrence The staff analyzed a transient depressurization AOO consistent with the event description in Section 9.2 of the Stability TR.

]

Figure 2

]

[

97

]

Figure 2: [ ]

Apart from the small increase in core flow (about 5 percent) leading to the instability, which is the result of subcooled boiling and riser voiding in the TRACE calculation, the staffs confirmatory calculation results are in excellent agreement with the reference PIM calculations.

The core flow rate is in good agreement [( )], the pressure at the onset of instability is in good agreement [( )], and the timing of the MPS trip is in good agreement [( )]. The TRACE calculations confirm the riser instability mode and demonstrate margin to instability afforded by the MPS trip.

4. Conditions and Limitations The conditions and limitations on PIM for the NuScale Power Module Stability Analysis are aggregated in this section and listed below.

Stability Analogue and Reduced-Order Model Limitation (Section 3.1.2)

The stability analogue described in Section 7 of the Stability TR and the ROM described by the TR Supplement are not approved for licensing purposes.

PIRT Importance Ranking Restriction (Section 3.1.3)

The staff approval of the NuScale stability analysis methodology does not constitute approval of the phenomena importance rankings described in the PIRT in the Stability TR. The current evaluation shall not be construed as approval of the applicants PIRT.

Flow Reversal Limitation (Section 3.2.1.1)

PIM is not approved to analyze transients where the oscillations become significant enough that flow reversal would occur anywhere within the primary flow circuit.

Laminar-Turbulent Transition Condition (Section 3.2.1.5)

When using PIM for licensing analysis, the user shall specify a laminar-to-turbulent transition region between Re of 2200 and 3000.

Boiling Coefficient Condition (Section 3.2.1.8)

98 Stability-related confirmatory analyses, referred to as being within the scope of the NuScale reload analysis methodology, shall be performed using the default value of the boiling coefficient

[( )] described in Section 5.5.6.5 of the Stability TR.

Critical Heat Flux Limitation (Section 3.2.1.9)

The PIM CHF model described in Section 5.6.5 of the Stability TR is not approved for licensing purposes.

Kinetics Parameters Condition (Section 3.2.2)

An applicant or licensee referencing the Stability TR shall, on a cycle-specific basis, either:

(1) confirm that the delayed neutron fraction, decay constant, and prompt neutron lifetime assumed in the reference PIM safety analysis are conservative relative values calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) reperform the PIM safety analysis with user-defined values for the delayed neutron fraction, decay constant, and prompt neutron lifetime that result in values equivalent to those predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) reperform the PIM safety analysis with user-defined values for the delayed neutron fraction, decay constant, and prompt neutron lifetime that result in a conservatively bounding set of parameters compared to those predicted by an NRC-approved nuclear design methodology.

Doppler Reactivity Coefficient Multiplier Condition (Section 3.2.2)

An applicant or licensee referencing the Stability TR shall, on a cycle-and power level-specific basis, either: (1) confirm that the Doppler coefficient assumed in the reference PIM safety analysis is conservative relative to the Doppler coefficient calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) reperform the PIM safety analysis with a user-defined Doppler coefficient multiplier that results in a Doppler coefficient equivalent to that predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) reperform the PIM safety analysis with a user-defined Doppler coefficient multiplier that results in a conservatively bounding (i.e., smaller in magnitude)

Doppler coefficient compared to the Doppler coefficient predicted by an NRC-approved nuclear design methodology.

Core Simulator Nuclear Data for Cycle-Specific Confirmation or Reanalysis Condition (Section 3.2.2)

On a cycle-specific basis, when the licensee or applicant referring to the PIM stability analysis methodology is either confirming the nuclear kinetics parameters or generating new nuclear kinetics parameters for analysis, the licensee or applicant shall generate those nuclear kinetics parameters using an NRC-approved core simulator code.

Moderator Density Coefficient Multiplier Condition (Section 3.2.2)

An applicant or licensee referencing the Stability TR shall, on a cycle-and power level-specific basis, either (1) confirm that the MDC assumed in the reference PIM safety analysis is conservative relative to the MDC calculated according to an NRC-approved nuclear design methodology for the current core loading, (2) reperform the PIM safety analysis with a user-defined MDC multiplier that results in an MDC equivalent to that predicted by an NRC-approved nuclear design methodology for the current core loading, or (3) reperform the PIM safety analysis with a user-defined MDC multiplier that results in a conservatively bounding

99 (i.e., more negative) MDC compared to the MDC predicted by an NRC-approved nuclear design methodology.

Direct Energy Deposition Fraction Limitation (Section 3.2.2)

Any COL applicants or licensees referencing the Stability TR that use PIM for licensing calculations shall either specify a value for the direct energy deposition fraction that is 0.026 or specify an alternative, reasonable value based on the results of calculations performed using NRC-approved nuclear design methods.

Pre-CHF-Only Limitation (Section 3.2.3)

The staffs approval of the PIM stability analysis method covers only pre-CHF heat transfer.

PIM is not approved to analyze conditions of post-CHF heat transfer.

Secondary-Side Forced Convection Limitation (Section 3.2.4)

PIM is approved only to analyze conditions of forced convection in the secondary side.

NRELAP5 Steady-State Condition (Section 3.2.4)

The approval of the PIM stability methodology, which relies on steady-state calculation results from NRELAP5, is contingent on the staff review and approval of NRELAP5 for the purpose of performing best estimate steady-state calculations for the NuScale power module.

Implicit Scheme Restriction (Section 3.2.5)

PIM is not approved to perform stability analysis using the implicit scheme for the thermal-hydraulic solution.

5. Conclusions If the NRCs criteria or regulations change so that its conclusions about the acceptability of the methods are invalidated, the licensee or applicant referencing the Stability TR will be expected to revise and resubmit its respective documentation or justify the continued effective applicability of these methodologies without revision of the respective documentation.

The staff reviewed the Stability TR to determine the acceptability of the PIM Version 1.1 code, in accordance with the described analysis methodology, to perform stability analyses for the NuScale power module. In this review, the staff used the guidance and acceptance criteria described in SRP Section 15.0.2 to evaluate PIM Version 1.1 and the associated analysis methodology and acceptance criteria. The staff finds that when executed in a manner consistent with the Stability TR description and within the conditions and limitations described in the staffs safety evaluation, PIM Version 1.1 and the associated analysis methodology satisfies applicable regulatory requirements and is acceptable for performing the requisite stability analyses. The conditions and limitations are marked throughout this report and are also compiled in Section 4.

The staff examined the PIM QA plan through a regulatory audit. The audit findings are documented more thoroughly in the staffs audit results summary report (ADAMS Accession No. ML18164A253). To summarize, the staff found that the QA plan meets the minimum criteria specified in SRP Section 15.0.2 and is therefore acceptable.

100 The staff reviewed the PIM code and does not intend to review the associated topical report when referenced in licensing evaluations but finds the methods applicable only when exercised in accordance with the conditions and limitations described in this report. When exercised appropriately, the methods documented in the Stability TR are acceptable for performing the prescribed stability analyses for the NuScale power module.

Furthermore, the staff has reviewed the NuScale power module LTS solution against the review criteria described by the Design-Specific Review Standard 15.9.A. The LTS solution is based on the exclusion region principle. Applicant analyses demonstrate that the power module remains stable under normal operating conditions, including startup and shutdown maneuvers.

The staff also finds that the applicant demonstrated the efficacy of the MPS protective trip based on core exit temperature measurements to shut down the reactor before any riser flashing.

Therefore, the staff concludes that the LTS solution is acceptable for preventing the riser instability mode. Since oscillations have been shown to be either not possible or prevented by the LTS solution, the staff agrees that the LTS solution meets GDC 12. The proposed LTS solution meets GDC 13, 20, and 29 because the exclusion-region protective MPS trip is based on safety-related instrumentation and associated protection systems that are capable of sensing the reactor condition and actuating a reactor trip to shut down the reactor when the appropriate setpoints are exceeded. While other safety analyses (e.g., the Chapter 15 DCD analyses) demonstrate compliance with GDC 10, this review supports the conclusion that demonstrating compliance with GDC 10 under conditions of normal operation and AOOs is sufficient, and these other safety analyses do not need to consider possible instability because flow instability that could possibly challenge the SAFDLs is avoided by virtue of the LTS solution.

The staff understands that the power module design may change during the final design process and may change during the design certification review process. Changes that can be reasonably expected during these processes should not affect the findings of the staff review of the stability methodology or general conclusion regarding the acceptability of the LTS solution.

Regardless, the Stability TR includes the commitment by the applicant to reperform the analyses for the final design and submit these analyses to the NRC for review as part of the design certification application.

6. References

1.

Farawila, Y., Todd, D., Ades, M., Reyes Jr., J., Analytical Stability Analogue for Single-Phase Natural-Circulation Loop, Nucl. Sci. and Engr. (184), pp. 321-333, November 2016.

2.

Zaki, T. and Yarsky, P., Use of White Noise in TRACE/PARCS Analysis of ATWS with Instability, Nucl. Sci. and Engr. (184), pp. 346-352, November 2016.

3.

Cheng, L-Y., Baek, J.S., Cuadra, A., Aronson, A., Diamond, D., and Yarsky, P.,

TRACE/PARCS Analysis of Anticipated Transient without SCRAM with Instability for a MELLLA+ BWR/5, Nucl. Tech. (196), pp. 238-247, November 2016.

4.

Ishii, M., Study on Flow Instability in Two-Phase Mixtures, Argonne National Laboratory Report ANL-76-23, March 1976.

5.

Muller-Steinhagen, H., and Heck, K., A Simple Friction Pressure Drop Correlation for Two-phase Flow in Pipes, Chemical Engineering and Processing, 20(6) pp. 297-308, November 1986.

101