ML20028D595

From kanterella
Jump to navigation Jump to search
Chapter 15 P4 SER (Public)
ML20028D595
Person / Time
Issue date: 01/28/2020
From: Rani Franovich
NRC/NRR/DNRL/NRLB
To:
Franovich R , 415-7443
Shared Package
ML19171A301 List:
References
Download: ML20028D595 (166)
v • d • e


Text

15 TRANSIENT AND ACCIDENT ANALYSES This chapter of the safety evaluation report (SER) documents the U.S. Nuclear Regulatory Commission (NRC) staff (hereafter referred to as the staff) review of Chapter 15, Transient and Accident Analyses, of the NuScale Power, LLC (NuScale) (hereafter referred to as the applicant) Design Certification Application (DCA), Part 2, Final Safety Analysis Report (FSAR), Revision 3. The Preliminary Phase 2 SER for this chapter (Agencywide Documents and Access Management System (ADAMS) Accession No. ML19238A017), identified confirmatory items with proposed changes submitted on the docket, which the staff found acceptable. Unless otherwise stated below, the staff has confirmed that the proposed changes for the confirmatory items described in the Preliminary Phase 2 SER have been incorporated into DCA, Revision 3, and are closed. In addition, all Open Items (OIs) identified during Phase 2 of the review have been satisfactorily closed. With the exception of certain confirmatory items that have not been incorporated into DCA, Revision 3, the staffs regulatory findings documented in this SER are based on the latest version of the application on the docket, as Commented [A1]: Confirmatory Items - DCA Revision supplemented by the applicants responses to requests for additional information. DCA, 4 Updates will pertain to the following Chapter 15 Revision 4, will update these confirmatory items. Sections:

  • ML19277H590 - 15.6.5 and 15.6.6, for IAB
  • ML19304C673 - 15.1.2, 15.2.8, and 15.6.6, In this chapter, the NRC staff uses the term non-safety-related to refer to structures, systems revisions following the Corvallis audit and components (SSCs) that are not classified as safety-related SSCs as described in Title 10 *ML19337B447 - Long Term Cooling Technical of the Code of Federal Regulation (CFR), Section 50.2, Definition. However, among the non- Report, conforming revisions from LOCA close out.

safety-related SSCs, there are those that are important to safety as that term is used in the *ML19332A120 - RAI 8930 Supplement, with a General Design Criteria (GDC) listed in Appendix A, General Design Criteria for Nuclear Power change to 15.0.6.

Plants, to 10 CFR Part 50, and others that are not considered important to safety.

15.0 IntroductionTransient and Accident Analysis Commented [A2]: Throughout this chapter, the following ML#s are noted in reference to completed Classification and Key Assumptions staff audits. These specific audit ML#s refer to the audit plans for these audits, as the audit summaries are being finalized. These ML#s will be replaced with the This section describes the internal events and their classification that are evaluated as part of ML#s for the audit summaries in Phase 6:

the NuScale design bases. Under DCA Part 2, Tier 2, Chapter 15.0, the following subsections are presented by the applicant and evaluated by the staff: ML19004A098 ML19255F022 15.0.0.1 Initiating Event Selection 15.0.0.2 Design-Basis Event Classification 15.0.0.3 Licensing Methodology 15.0.0.4 Initial Conditions 15.0.0.5 Limiting Single Failures 15.0.0.6 Equipment Response and Physical Parameter Assumptions 15.0.0.7 Multiple Module Events Further, in Part 4 of the DCA, the applicant presented Generic Technical Specifications (GTS).

Several of these GTS, listed below, apply to most of the Chapter 15 sections of this SER:

SL 2.1, Safety Limits 15-1

Limiting Condition for Operation (LCO) 3.1.1, SHUTDOWN MARGIN (SDM)

  • LCO 3.1.3, Moderator Temperature Coefficient (MTC)
  • LCO 3.3.1, Module Protection System (MPS) Instrumentation
  • LCO 3.3.3, Engineered Safety Features Actuation System (ESFAS) Logic and Actuation
  • LCO 3.7.2, Feedwater Isolation The applicant described its selection of events in DCA Part 2, Tier 2, Section 15.0.0.1. Initiating events are the internal events associated with a single NuScale Power Module (NPM) at power.

A range of power operations is considered if it is thought to be more limiting for meeting the appropriate acceptance criteria. In general, most of the events described in DCA Part 2, Tier 2, Chapter 15, are similar to those at current pressurized-water reactors (PWRs) with some exceptions based on the NuScale design. Design-basis events (DBEs) that are not considered in a typical PWR but are relevant to the NuScale design include loss of containment vacuum, inadvertent operation of the decay heat removal system (DHRS), and inadvertent operation of an ECCS valve. DCA Part 2, Tier 2, Section 15.9, Stability, addresses the RCS thermal-hydraulic stability.

15-2

The applicant stated that, consistent with NUREG-0800, Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants: LWR Edition (SRP), Section 15.0, IntroductionTransient and Accident Analyses, and current light-water reactors (LWRs), the events are categorized into one of seven categories:

(1) increase in heat removal by the secondary system; (2) decrease in heat removal by the secondary system; (3) decrease in RCS flow rate; (4) reactivity and power distribution anomalies; (5) increase in reactor coolant inventory; (6) decrease in reactor coolant inventory; and (7) radioactive release from a subsystem or component.

The DCA Part 2, Tier 2, Table 15.0-1, lists the events selected, the event classification, and the computer codes used for evaluation in DCA Part 2, Tier 2, Sections 15.1 through 15.9. The staff reviewed the table and confirmed that the DBE identification and frequency classification are consistent with the guidance in NuScale Design Specific Review Standard (DSRS)

Section 15.0 (ADAMS Accession No. ML15355A302). The staffs evaluations of the listed DBE analyses are found in their respective sections of this SER.

15-3

The NuScale design assures that fuel cladding integrity is maintained for all design basis events, including postulated accidents, such that the effect of a postulated return to power with failed fuel has not been evaluated in the analysis of accident consequences. Therefore, to preclude unanalyzed accident consequences, NuScale's design basis implements PDC 27 in Chapter 15 to prohibit fuel failures under postulated accident conditions.

The staff finds the criteria specified by the applicant for analysis of DBAs acceptable and appropriate, since other aspects of the NuScale design (for example, accident consequences, equipment qualification, and source term) rely on the designs ability to preclude fuel failures during design basis events. This criteria is also consistent with SECY-18-0099, Nuscale Power Exemption Request from 10 CFR Part 50, Appendix A, General Design Criterion 27, Combined Reactivity Control Systems Capability (ADAMS Accession No. ML18065A431).

DCA Part 2, Tier 2, Table 15.0-2, gives the thermal-hydraulic acceptance criteria associated with events other than rod ejection and loss-of-coolant accidents (LOCAs). Table 15.0-3, Acceptance Criteria Specific to Rod Ejection Accidents, and Table 15.0-4, Acceptance Criteria Specific to Loss of Coolant Accidents, provide the acceptance criteria for rod ejection and LOCA, respectively. The staff agrees with the applicants acceptance criteria in Table 15.0-2 as they are consistent with DSRS Section 15.0, and they are specified to preclude fuel failure, consistent with SECY-18-0099. Similarly, the staff agrees with the rod ejection acceptance criteria as they are consistent with or more restrictive than those in SRP Section 4.2, Fuel System Design, Appendix B, Interim Acceptance Criteria and Guidance for the Reactivity Initiated Accidents, and the LOCA criteria in 10 CFR 50.46, Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Reactors. The staff notes that the applicant has chosen to use the more restrictive AOO acceptance criteria given in Table 15.0-2 for IEs and PAs, except for the rod ejection specific acceptance which is either consistent with or more restrictive than the criteria in SRP Section 4.2. The staff finds this acceptable, as the rod ejection event is only evaluated in the short term, as discussed in Section 15.0.6 of this report, and thus need not consider the potential for a long term return to power in the event sequences. The details of the applicants event-specific acceptance criteria are provided in the specific DCA Part 2, Tier 2, section for each event.

The relevant requirements of NRC regulations for this area of review and the associated acceptance criteria are in NUREG-0800, Section 15.0. The relevant requirements are summarized below.

  • 10 CFR Part 52, Licenses, Certifications, and Approvals for Nuclear Power Plants 15-4

The following GDC from 10 CFR Part 50, Appendix A, are relevant to SRP Section 15.0, IntroductionTransient and Accident Analysis:

  • GDC 2, Design Bases for Protection Against Natural Phenomena, as it relates to the seismic design of SSCs whose failure could cause an unacceptable reduction in the capability of the residual heat removal system.
  • GDC 4, Environmental and Dynamic Effects Design Bases, as it relates to the requirement that SSCs important to safety be designed to accommodate the effects of and be compatible with the environmental conditions associated with normal operation, maintenance, testing, and PA conditions, including such effects as pipe whip and jet impingement.
  • GDC 5, Sharing of Structures, Systems, and Components, as it relates to the requirement that any sharing among nuclear power units of SSCs important to safety will not significantly impair their safety function.
  • GDC 10, Reactor Design, as it relates to the RCS being designed with appropriate margin to ensure that specified acceptable fuel design limits (SAFDLs) are not exceeded during normal operations, including AOOs.
  • GDC 12, Suppression of Reactor Power Oscillations, as it relates to the reactor core and associated coolant, control, and protection systems shall be designed to assure that power oscillations which can result in conditions exceeding specified fuel design limits are not possible or can be reliably and readily detected and suppressed.
  • GDC 13, Instrumentation and Control, as it relates to instrumentation and controls provided to monitor variables over anticipated ranges for normal operations, for AOOs, and for accident conditions.
  • GDC 15, Reactor Coolant System Design, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.
  • GDC 17, Electric Power Systems, as it relates to the requirement that an onsite and offsite electric power system be provided to permit the functioning of SSCs important to safety. The safety function for each system (assuming the other system is not working) shall be to provide sufficient capacity and capability to ensure that the acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary (RCPB) are not exceeded during an AOO and that core cooling, containment integrity, and other vital functions are maintained in the event of an accident.
  • GDC 19, Control Room, as it relates to the requirement that a control room be provided from which personnel can operate the nuclear power unit during both normal operating and accident conditions, including a LOCA.
  • GDC 20, Protection System Functions, as it relates to the reactor protection system being designed to initiate automatically the operation of appropriate systems, including the reactivity control systems, to ensure that the plant does not exceed SAFDLs during any condition of normal operation, including AOOs.

15-5

  • GDC 25, Protection System Requirements for Reactivity Control Malfunctions, as it relates to the requirement that the reactor protection system be designed to ensure that SAFDLs are not exceeded for any single malfunction of the reactivity control system, such as accidental withdrawal of control rods.
  • GDC 26, Reactivity Control System Redundancy and Capability, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded even during AOOs. This is accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.
  • GDC 27, Combined Reactivity Control Systems Capability, and GDC 28, Reactivity Limits, as they relate to the RCS being designed with an appropriate margin to ensure that acceptable fuel design limits are not exceeded and that the capability to cool the core is maintained.
  • GDC 29, Protection Against Anticipated Operational Occurrences, as it relates to the design of the protection and reactivity control systems and their performance (i.e., to accomplish their intended safety functions) during AOOs.
  • GDC 31, Fracture Prevention of Reactor Coolant Pressure Boundary, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.
  • GDC 34, Residual Heat Removal, as it relates to the capability to transfer decay heat and other residual heat from the reactor so that fuel and pressure boundary design limits are not exceeded.
  • GDC 35, Emergency Core Cooling, as it relates to the RCS and associated auxiliaries being designed to provide abundant emergency core cooling.
  • GDC 55, Reactor Coolant Pressure Boundary Penetrating Containment, as it relates to the isolation requirements of small-diameter lines connected to the primary system.
  • GDC 60, Control of Releases of Radioactive Materials to the Environment, as it relates to the radioactive waste management systems being designed to control releases of radioactive materials to the environment.
  • GDC 61, Fuel Storage and Handling and Radioactivity Control, as it relates to the requirement that the fuel storage and handling, radioactive waste, and other systems that may contain radioactivity be designed to ensure adequate safety under normal and PA conditions.

The applicant incorporated the above criteria in DCA Part 2, Tier 2, Section 3.1, Conformance with U.S. Nuclear Regulatory Commission General Design Criteria, which the staff finds acceptable. The staff notes that the applicant requested an exemption to the GDC 17 electrical power requirements. In addition, the applicant requested an exemption to the electrical power provisions in GDC 34 and GDC 35 and developed principle design criteria (PDC) 34 and PDC

35. A detailed discussion of NuScales reliance on electric power and the related exemptions to GDC 17, GDC 34, and GDC 35 can be found in the SER for Chapter 8, as well as the staffs evaluation (ADAMS Accession No. ML17340A524) of the NuScale topical report on electrical systems (TR-0815-16497). The applicant also requested an exemption to certain reactivity 15-6

provisions of GDC 27 and developed PDC 27. The staffs evaluation of the GDC 27 exemption and adequacy of PDC 27 in Section 15.0.6.4.1 of this report.

DCA Part 2, Tier 2, Table 15.0-6, Module Initial Conditions Ranges for Design Basis Event Evaluation, establishes the range of initial conditions that are assumed in DCA Part 2, Tier 2, Chapter 15. The values presented in Table 15.0-6 are common to all Chapter 15 events, except where noted in the individual sections. The staff reviewed Table 15.0-6 and found that it identifies the important input parameters and establishes the range of conditions used in DCA Part 2, Tier 2, Chapter 15, which is consistent with the guidance in DSRS Section 15.0.

Further, the staff considered that Generic Technical Specifications (GTS) Section 5.6.3, Core Operating Limits Report (COLR), paragraph b, lists the analytical methods used to determine the core operating limits in Section 5.6.3, a. The methodologies that are used to determine these core operating limits are included in the COLR list of references. Therefore, the staff concludes that the applicant included acceptable controls to ensure approved methods are used in determining the numerical values for the TS limits that ensure the initial conditions assumed in the Chapter 15 analyses are met during operation.

Appendix A to 10 CFR Part 50 describes a single failure as an occurrence that results in the loss of capability of a component to perform its intended safety functions. Multiple failures resulting from a single occurrence are considered to be a single failure consistent with 10 CFR Part 50, Appendix A. DSRS Section 15.0.I.8.B, Sequence of Events and System Operation, states that the single failure criterion (SFC) applies to safety-related systems or components used to mitigate AOOs or PAs.

DCA Part 2, Tier 2, Section 15.0.0.5, states that a component that changes position or state to achieve its safety function is considered an active component, while a component that does not change position or state to achieve its safety function is considered a passive component.

The applicant also considers failure of a check valve an active failure and subject to the SFC consistent with SECY-94-084, Policy and Technical Issues Associated with the Regulatory Treatment of Non-Safety Systems (RTNSS) in Passive Plant Designs, dated March 28, 1994 (ADAMS Accession No. ML003708068).

The inadvertent actuation block (IAB) valve is a first-of-a-kind, safety-significant, active component integral to the NuScale ECCS. In order to meet the requirements for the ECCS in 10 CFR Part 50, an applicant must show that it has addressed the single failure criterion (SFC).

The SFC is defined in 10 CFR Part 50 Appendix K and derived from the definition of single failure in 10 CFR Part 50 Appendix A. During its review, the staff noted that although the applicant assumed a single failure of a main ECCS valve to open, the applicant did not apply the SFC to the IAB valve in regard to the valves function to close. NuScale disagreed with the staffs application of the SFC to the IAB valve, which led the staff to request Commission direction to resolve this issue, SECY-19-0036 Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves.1 In SECY-19-0036, the staff 1

See SECY-19-0036, Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent 15-7

summarized the NRCs historical practice for applying the SFC. Specifically, the staff summarized SECY-77-439,2 in which it informed the Commission how the staff then generally applied the SFC, and, SECY-94-084,3 in which the staff requested Commission direction on application of the SFC in specified fact- or application-specific circumstances. In view of this historical practice, the staff in SECY-19-0036 requested Commission direction on application of the SFC to the IAB valves function to close.

In response to the paper, the Commission directed the staff in SRM-SECY-19-0036, Staff RequirementsSECY-19-0036Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves,4 to review Chapter 15 of the NuScale Design Certification Application without assuming a single active failure of the inadvertent actuation block valve to close. The Commission further stated that [t]his approach is consistent with the Commission's safety goal policy and associated core damage and large release frequency goals and existing Commission direction on the use of risk-informed decision-making, as articulated in the 1995 Policy Statement on the Use of Probabilistic Risk Assessment Methods in Nuclear Regulatory Activities and the White Paper on Risk-Informed and Performance-Based Regulation (in SRM SECY- 98-0144 and Yellow Announcement 99-019).

Based on the staffs historic application of the SFC and Commission direction on the subject, as described in SECY-77-439, SRM-SECY-94-084, and SRM-SECY-19-0036, the NRC has retained some discretion, fact- or application-specific circumstances, to decide when to apply the single failure criterion. The Commissions decision in SRM-SECY-19-0036 provides direction regarding the appropriate application and interpretation of the regulatory requirements in 10 CFR Part 50 to the NuScale IAB valves function to close. This decision is similar to those documented in previous Commission documents that addressed the use of the SFC and provided clarification on when to apply the SFC in other specific instances.

NuScale requested an exemption from the GDC 35 requirements for electric power. This exemption request is evaluated in Chapter 8 of this FSER. NuScales PDC 35 is functionally identical to GDC 35, except with respect to the discussion regarding electric power. Based on the above discussion, including redundancy of the ECCS to perform its design function assuming a single failure of a main ECCS valve to open, and the Commission determination that the SFC does not need to be assumed for the NuScale IAB valves function to close, the staff concludes that the ECCS system satisfies PDC 35 with respect to demonstrating that the safety system function can be accomplished, assuming a single failure. The staff also discusses this issue in FSER Section 6.3.4.2.7. The staffs evaluation of NuScales PDC 35 with regard to sufficient core cooling in the ECCS system is contained in Section 6.3.4.1.8 of this FSER. On the same basis, the staff finds that the requirements of 10 CFR Part 50 Appendix K Actuation Block Valves, (Apr. 11, 2019) (ADAMS Accession No. ML19060A081).

2 See SECY-77-439, "Single Failure Criterion," (Aug. 17, 1977) (ADAMS Accession No. ML060260236).

3 SECY-94-084, "Policy and Technical Issues Associated with the Regulatory Treatment of Non-Safety Systems in Passive Plant Designs (Mar. 28, 1994) (ADAMS Accession No. ML003708068), and associated SRM (Jun. 30, 1994) (ADAMS Accession No. ML003708098).

4 See SRM-SECY-19-0036, SECY-19-0036 Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves, (Jul. 2, 2019) (ADAMS Accession No. ML19183A408).

15-8

to assume the most damaging single failure of ECCS equipment has taken place for accident evaluations under the associated requirements of 10 CFR 50.46 are met for NuScales ECCS system. Therefore, evaluation of a single failure of the NuScale IAB valves function to close is not necessary for the evaluation of design basis events in Chapter 6 or Chapter 15.

Passive failures can be initiating events, such as the assumed mechanical failure of a reactor vent valve (RVV)/reactor recirculation valve (RRV) in DCA Part 2, Tier 2, Section 15.6.6, but passive failures of fluid systems are considered only on a long-term basis, which the applicant defines as greater than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after event initiation.

DCA Part 2, Tier 2, Section 15.0.0.5 states, active and passive failures are considered for electrical components. Protective actions must be accomplished in the presence of a single detectable failure. The effects of nondetachable failures are considered concurrently as part of the most-limiting single failure.

DCA Part 2, Tier 2, Chapter 15, evaluates a range of available electrical power assumptions.

The range of electrical power assumptions, as discussed in Section 15.0.0.6.2 of this SER and evaluated for each event, is not considered a single failure but instead is used to determine if operation of electrical power systems that are not safety-related could impair the plant response to the event. Therefore, the worst single failure of a component is assumed for each electrical power system availability assumption.

Operator errors are considered as initiating events consistent with the guidance given in DSRS Section 15.0. The applicant stated that an error of omission is not relevant as the design is such that no operator action is necessary to mitigate a DBE for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The applicant also stated that errors of commission, where no operator action is necessary, but an erroneous action is taken, are bounded by the worst case single-failure assumption. The applicant gave the following reasons why a single failure of a safety-related SSC bounds an operator error of commission (ADAMS Accession No. ML18134A352):

  • Single actions taken on safety-related SSCs are bounded by the SFC since a safety-related SSC cannot be affected by a single action from the main control room (MCR), with the exception of initiating an engineered safety feature (ESF).
  • Control room operators cannot manipulate safety-related SSCs except through the use of the module protection system (MPS) hard-wired manual actuation switches located at the standup panel for each unit. Operation of any of these switches is infrequent, is directed by procedure, and normally requires a prior peer-check.
  • Operation of these switches is also expected to receive supervisory oversight, and because of the switches location, their operation is conspicuous to the operating crew.
  • An operator cannot override the MPS either before or after initiation, with the exception of containment isolation override to support either adding inventory to the reactor vessel using the chemical and volume control system (CVCS) or to the containment using the containment flooding and drain system (CFDS).
  • Once an MPS setpoint is reached, the associated safety-related SSCs will transition to their single safety position. The containment isolation override function is required only during highly improbable BDBEs, which are addressed in Chapter 19 and are beyond the scope of this RAI response, which is for Chapter 15 events only.

15-9

  • The containment isolation override function requires multiple deliberate steps, which are directed by procedures. The Conduct of Operations and generally accepted industry standards on human performance and use of error reduction tools ensure that a peer check and proper supervisory oversight would be provided to complete this Important Human Action. To accidentally perform this action in error or to complete this action on the wrong unit is not deemed credible.
  • The Chapter 15 analysis models normal operation of systems that are not safety-related that increase the consequences of the event. Normal operation of systems that are not safety-related that improve (decrease) the consequences of the event are not modeled.

Therefore, an operator act of commission performed in error on SSCs that are not safety-related, that increases the consequences of the event, is bounded in the Chapter 15 analysis.

  • Multiple operator errors or errors that result in common-mode failures are considered beyond design basis events. Chapter 19 analyzes these events.

See Chapter 18 of this report for the staffs evaluation of human factors engineering, including an audit of Conduct of Operations defined by NuScale (ADAMS Accession No. ML16259A110).

The determination that operator errors of commission are bounded by a single failure of a safety-related SCC is dependent on the design of the manual operator capabilities and the likelihood of an erroneous operator action. Section 18.10.4.4.2.4.2 of this SER presents a detailed evaluation of the likelihood of performing operator actions erroneously.

For a particular transient, the limiting single failure for one acceptance criterion may be different than the limiting single failure for a different acceptance criterion for the same DBE. The limiting single failures for Chapter 15 events are described with the event analysis and are identified in Table 15.0-9. The staff evaluates these failures as described in each of the design basis event subsections of DCA Part 2, Tier 2, Chapter 15, in the associated subsections of this SER chapter.

DCA Part 2, Tier 2, Section 15.0.0.6, addresses control rod assembly insertion characteristics, decay heat, ESF characteristics, and required operator actions.

The time for inserting control rods directly affects the amount of heat that must be removed from the core in response to a DBE. Section 4.3 of the SRP describes the analytical basis for the control rod assembly insertion rates and reactivity effect as a function of time. The analyses for the Chapter 15 DBEs apply additional conservatism to the reactivity insertion rate provided in Section 4.3 to bound potential plant operating conditions. DCA Part 2, Tier 2, Figure 15.0-1, shows the normalized control rod position versus time, and Figure 15.0-2 shows the normalized SCRAM reactivity worth versus time. The use of bounding insertion times provides conservative results for DBE analyses. GTS 3.1.4 specifies drop-time testing requirements.

Bounding values for decay heat are designated to represent the maximum decay heat of the core following an event and conservative minimum decay heats for the cooldown events.

The 1973 American Nuclear Society (ANS) decay heat standard is used in NuScale Reactor Excursion and Leak Analysis Program, Version 5 (NRELAP5) to represent bounding decay heat. The LOCA methodology calculates fission product decay heat using a bounding form of the 1973 ANS decay heat standard with a 20-percent margin to address uncertainty added to 15-10

the base value. The bounding form of the 1973 ANS standard in NRELAP5 is conservative relative to the 1971 ANS standard specified in 10 CFR Part 50, Appendix K, ECCS Evaluation Models. The applicant requested an exemption from 10 CFR Part 50, Appendix K, for certain phenomena not encountered in the NuScale NPM during a LOCA because of the NPM design.

The staffs evaluation of this exemption is in Section 15.0.2 of this SER.

For non-LOCAs, the model also uses the conservative 1973 ANS decay heat standard, which is varied by utilizing different decay heat multipliers and specifying whether to include the actinide contribution.

The following decay heat multipliers are used:

Minimum = use multiplier of 0.8 while excluding the actinide contribution Maximum = use multiplier of 1.0 while including the actinide contribution The acceptability of the multipliers used for the non-LOCA analyses are evaluated in the staffs SER (MLXXXXX) of the Non-Loss-of-Coolant Accident Analysis Methodology, topical report Commented [A3]: The staffs SER will be issued and (TR-0516-49416, Rev. 2 (ML19331A516)). the ML# provided in the Phase 6 SER.

NuScale ESF systems include the containment systems (Section 6.2), ECCS (Section 6.3), and DHRS (Section 5.4.3) as described in the DCA Part 2, Tier 2. The DHRS provides cooling for non-LOCA DBEs when normal secondary-side cooling is unavailable or otherwise not used.

The DHRS is designed to remove post reactor trip residual and core decay heat from operating conditions and transition the NPM to safe-shutdown conditions without reliance on external power. DCA Part 2, Tier 2, Section 5.4.3, provides additional description of the DHRS. In conjunction with the containment heat removal function of containment, the ECCS provides a means of core decay heat removal for LOCAs or during loss of both trains of the DHRS, which is a beyond-design-basis-event condition. The DHRS provides an additional capacity to remove decay heat during the initial blowdown period of a LOCA but is not credited in the LOCA model.

The ECCS valves and the DHRS do not rely on electrical power or on non-safety-related support systems to perform their intended safety functions. After actuation, the valves do not require a subsequent change of state or continuous availability of power to maintain their intended safety functions. One of two RRV and two of three RVVs are required for successful ECCS operation. If the redundant direct current (dc) power to the MPS or the ECCS and DHRS valve actuators is lost, the valves actuate. The ECCS valves open once RCS pressure goes below the IAB valve operating threshold.

The ability to successfully mitigate non-LOCA events using the DHRS and potentially ECCS, depending on the availability of electrical power and LOCAs (including long-term cooling (LTC)),

using the ECCS, is evaluated as part of the staffs overall DCA Part 2, Tier 2, Chapter 15, review.

Required Operator Actions The applicant stated in DCA, Tier 2, Section 15.0.0.6.4, that no operator actions are credited to mitigate DBEs for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> even with assumed failures. The staff evaluated the ability of the design to mitigate DBEs without operator action as part of the overall DCA Part 2, Tier 2, Chapter 15, review. None of the Chapter 15 events credit operator actions within the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and the staffs review of the designs capability to mitigate each DBE is contained in the Technical Evaluation section of each Chapter 15 subsection in this report.

15-11

Availability of Offsite Power Normal alternating current (ac) power systems are not safety-related and not credited to mitigate Chapter 15 events. The normal ac power systems consist of the following:

  • EHVS (high-voltage (13.8-kilovolt (kV)) ac electrical system and switchyard),
  • EMVS (medium-voltage (4.16-kV) ac electrical distribution system), and
  • ELVS (low-voltage (480-volt (V) and 120-V) ac electrical distribution system).

The onsite dc power systems are not safety-related and not credited to mitigate Chapter 15 events. The dc power systems consist of the following:

  • EDSS (highly reliable dc power system to supply essential loads) and
  • EDNS (normal dc power system to supply nonessential loads).

The loss of normal ac power causes the MPS to initiate a reactor trip, actuate the DHRS, and close the containment isolation valves. The loss of normal power also causes the loss of the EDSS chargers causing the EDSS to rely on backup batteries. At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the MPS load sheds the ECCS valves causing them to open to the fail-safe position; RCS coolant is discharged into containment when the IAB valve operating pressure threshold is reached. As no power systems in the design are safety-related, several loss of power scenarios are evaluated to ensure that the DCA Part 2, Tier 2, Chapter 15, acceptance criteria are met. The applicant evaluated the following loss of power scenarios:

  • Loss of normal ac either at the time of the initiating event or at the time of the turbine trip.

After 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the ECCS valves move to their fail-safe open position.

  • Loss of normal dc power (EDNS) and normal ac. Power to the reactor trip breakers is provided via the EDNS, so this scenario is the same as a loss of normal ac with the addition of reactor trip at the time power is lost.
  • Loss of the highly reliable dc power system (EDSS), EDNS, and normal ac. This scenario results in a reactor trip, actuation of DHRS, and closure of containment isolation valves. The ECCS valves move to their fail-safe open position when RCS pressure drops below the IAB valve operating pressure threshold.

Also evaluated are the scenarios in which power, ac or dc, remains, if the consequences of the event are more limiting.

Treatment of Systems that Are Not Safety-Related Systems that are not safety-related are assumed to function if their normal operation is assumed to increase the consequences associated with the event and are not assumed to change state to lessen or mitigate the consequences of the event.

15-12

In DCA, Tier 2, Section 15.0.0.6.6, the applicant stated that the treatment of non-safety-related systems for the DBE is as follows:

  • Non-safety-related system normal operation that increases the consequences of the event is modeled.
  • Non-safety-related system normal operation that improves (decreases) the consequences of the event is not modeled.
  • Non-safety-related system normal operation that does not significantly alter the consequences of the event may be modeled.
  • The failure of a non-safety-related system to a worst-state condition is not considered except as an event initiator.
  • Non-safety-related equipment is evaluated to consider the licensing basis assumptions defining the events, including external events; environmental effects; and offsite and onsite power availability.

The above criteria are consistent with those discussed in DSRS Section 15.0.I.8.B, which specifies that only safety-related systems or components are used in mitigating AOOs and PAs.

The DSRS Section 15.0.I.8.B states that the reviewer may consider the licensees technical justifications for the operation of systems or components that are not safety-related, for example, when used as backup protection and when not disabled, except by a detectable, random, and independent failure. The applicants design uses equipment that is not safety-related as a backup to safety-related equipment in the three following areas:

(1) The non-safety-related secondary MSIV serves as the backup isolation device to the safety-related MSIV for isolation of the main steam piping penetrating containment when the safety-related MSIV is assumed to fail.

(2) The non-safety-related feedwater regulating valve (FWRV) serves as the backup isolation device to the safety-related feedwater isolation valve (FWIV) for isolation of the feedwater system (FWS) piping penetrating the containment when the FWIV is assumed to fail.

(3) The non-safety-related feedwater check valve serves as the backup isolation device to the safety-related feedwater check valve for isolation of the DHRS when reverse flow is experienced during a break in the FWS piping.

The basis for relying on a component that is not safety-related to serve as a backup to a safety-related component is described in NUREG-0138, Staff Discussion of Fifteen Technical Issues Listed in Attachment to November 3, 1976 Memorandum from Director, NRR to NRR Staff, issued November 1976 (ADAMS Accession No. ML13267A423).

As discussed in NUREG-0138, Issue 1, the staff found it acceptable to credit the control and stop valves, which are not safety-related, during a main steamline break event based on the consequences being less than those of a LOCA and the combined reliability of the turbine stop and control valves being similar to that of a safety-related component. NUREG-0138, Issue 1, states that valves that are not safety-related can be used as a backup to safety-related valves in the FWS, assuming that the same evaluation criteria (i.e., reliability and consequence) apply.

15-13

The staff finds the use of the non-safety-related mainsteam and feedwater valves identified above acceptable because their design and treatment are consistent with the staff position of NUREG-0138, Issue 1. Specifically, the non-safety-related mainsteam and feedwater valves will have a demonstrated reliability due to augmented design, quality, and testing requirements, and technical specification surveillance and operability requirements. The staff notes that crediting the secondary MSIV to mitigate a steam generator (SG) tube rupture is beyond the scope of NUREG-0138, Issue 1, because a tube rupture is a breach of the primary system pressure boundary not previously addressed by the staff. The staffs evaluation of crediting the non-safety-related secondary MSIV for a steam generator tube failure (SGTF) event is in Section 15.6.3 of this report. See Section 3.9.6 of this report for the staffs review of the augmented quality and testing requirements applied to these components, and Section 10.3 for the staffs review of the main steam system, including the non-safety-related mainsteam isolation valves.

As systems that are not safety-related are not used to mitigate an AOO or PA, except to serve as a backup function to safety-related components, the staff finds the applicants use of equipment that is not safety-related acceptable.

Chapter 15 DBEs are analyzed for a single NPM. DCA Part 2, Tier 2, Chapter 21, discusses the suitability of shared components and the design measures taken to ensure that these components do not introduce multimodule risks. The only safety related shared system is the ultimate heat sink, which is evaluated in SER Section 9.2.5. Shared systems that are not safety-related are not credited in the NuScale transient and accident analyses; however, the failure of these systems is considered in the staffs evaluation presented in this SER chapter. In addition, Section 19.1 discusses the evaluation of multimodule events.

Radiological Consequence Using Alternative Source Terms The SRP Section 15.0.1 is focused on the application of alternative source terms to operating reactors and is not applicable to the NuScale small modular reactor (SMR) design certification review. Staffs evaluation of the NuScale design basis accident (DBA) radiological consequence analyses is discussed in Section 15.0.3 of this SER.

Review of Transient and Accident Analysis Methods DCA Part 2, Tier 2, Section 15.0.2, summarizes the analysis methods and computer codes used in non-LOCA safety analyses, LOCA evaluations, and post-LOCA LTC evaluations. In addition, DCA Part 2, Tier 2, Table 15.0-10, Referenced Topical and Technical Reports, lists the topical or technical reports used as the basis for analysis of each AOO and PA. The following SER section summarizes the methodology and computer codes used for relevant DBEs. Several different license methodologies are required to provide the neutronic, thermal-hydraulic, and radiological responses of the plant to AOOs, PAs, and IEs. DCA Part 2, Tier 2, Table 15.0-1, lists the computer codes used for each DBE.

15-14

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.0.2, summarized as follows.

The DCA Part 2, Tier 2, Section 15.0.2.1, describes the licensing methodology relevant to transient and accident analyses for non-LOCA, LOCA, and LTC events. In DCA Part 2, Tier 2, Sections 15.1 through 15.6.4, and 15.6.6 through 15.9 describe safety analyses for non-LOCA events. DCA Part 2, Tier 2, Section 15.6.5 describes the safety analysis for LOCA events. The NuScale LOCA evaluation model (EM) was designed to meet the applicable requirements of 10 CFR Part 50, Appendix K, with some exceptions as described in the related Appendix K exemption request evaluated in Section 15.0.2.4.1 of this report, and the 10 CFR 50.46 acceptance criteria. The non-LOCA analysis methodology was then designed to build on the NRELAP5 LOCA EM to address specific phenomena important for each non-LOCA event.

In DCA Part 2, Tier 2, Section 15.0.2, the applicant described the analytical methods and computer programs used in non-LOCA safety analysis, LOCA evaluation, post-LOCA LTC evaluation, and other AOOs as detailed below.

Loss-of-Coolant Accident Methodology The DCA Part 2, Tier 2, Section 15.6.5, states that LOCA analyses are performed using NRELAP5, as described further below. DCA Part 2, Tier 2, Table 1.6-1, incorporates by reference TR-0516-49422, Loss-of-Coolant Accident Evaluation Model, Revision 1, issued Commented [A4]: Issuance of the final approved -A November 2019 (ADAMS Accession No. ML19331B585). TR-0516-49422 uses the NuScale version of this topical report is a Confirmatory Item.

NRELAP5 systems computer code that is a modification and extension of the Idaho National Laboratory RELAP5-3D computer code. As described in TR-0516-49422, the applicant modified selected models and correlations to address unique features and phenomena of the NPM design and comply with the requirements of 10 CFR Part 50, Appendix K. The applicant requested exemptions from 10 CFR Part 50, Appendix K, requirements that the applicant believes are not applicable to the NuScale design in Section 10 of Part 7, Exemptions, of the DCA.

NRELAP5 employs a combination of proven RELAP5 features, models, and components as well as new and advanced features and components requiring new correlations and models to simulate the needed operating conditions and component system behavior. Of particular importance is the use of the containment vessel (CNV) as an integral part of the ECCS, the modeling of condensation under high pressure conditions, and the addition of a new hydrodynamic component for the helical coil SGs.

TR-0516-49422 is based on the deterministic ECCS performance calculation approach detailed in Appendix K to 10 CFR Part 50 and 10 CFR 50.46(a)(ii). Since the NPM is designed so that there is no core uncovery or heatup for design-basis LOCAs, the applicant indicated significant margins to the peak cladding temperature (PCT) and the other criteria (10 CFR 50.46(b)(2) through (b)(4)), such that the relevant figures of merit are not PCT but (1) collapsed liquid water level in the core, (2) the critical heat flux ratio (CHFR), and (3) containment pressure and temperature. Additionally, since the NPM is designed not to reach core uncovery, the applicants LOCA methodology does not address post-CHF heat transfer phenomena, including cladding oxidation, hydrogen production, or clad geometry changes such as swell and rupture.

15-15

This is reflected in the requested exemption from the requirements in 10 CFR Part 50, Appendix K, as follows: I.A.4 (decay heat model), I.A.5 (Baker-Just equation for metal water reaction), I.B (cladding swelling and rupture), I.C.1.b (Moody model for two-phase discharge), I.C.5.a (post-CHF heat transfer modeling), and I.C.7.a (channel cross flow during blowdown).

The progression of the LOCA event for the NPM is slower than for conventional PWRs since break sizes are significantly smaller. In addition, the ECCS includes venting RVVs and recirculation RRVs that open to remove core decay heat by establishing stabilized recirculating flow from the containment back to the reactor pressure vessel (RPV) via boiling in the core and condensing in the CNV. TR-0516-49422 addresses the first four criteria of 10 CFR 50.46(b),

and technical report TR-0916-51299, Long Term Cooling Methodology, Revision 1, dated August 2019 (ADAMS Accession No. ML19218A147), which is incorporated by reference in Commented [A5]: Revision 2 is a Confirmatory Item.

DCA Part 2, Tier 2, Table 1.6 2, addresses the LTC requirement of 10 CFR 50.46(b)(4) and The changed pages for the update to Revision 2 that (b)(5) for the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of a LOCA. TR-0916-51299 is a continuation of the LOCA the staff based its findings on are in ML19337B451.

methodology with modifications added to run simulations out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> to show that cooling temperatures and pressures are adequately low with no credit for operator action.

Non-Loss-of-Coolant Accident Methodology DCA Part 2, Tier 2, Section 15.0.2.1, states that the non-LOCA analysis methodology builds on the NRELAP5 LOCA model. Additionally, DCA Part 2, Tier 2, Section 15.0.2.1, references TR-0516-49416, Non-Loss-of-Coolant Accident Analysis Methodology, Revision 2, issued Commented [A6]: Issuance of the final approved -A November 2019 (ADAMS Accession No. ML19331A516). TR-0516-49416 describes event- version of this topical report is a Confirmatory Item.

specific methodologies for non-LOCA events including initial condition and parameter biases that present the greatest challenge to acceptance criteria. The report does not include evaluation of the minimum critical heat flux ratio (MCHFR) or radiological consequences, but it does describe the interface with the downstream subchannel and accident radiological analyses.

DCA Part 2, Tier 2, Section 15.0.2.2.2 states that the rod ejection methodology is based on the use of CASMO5, SIMULATE5, SIMULATE-3K (S3K), NRELAP5, and VIPRE-01. The CASMO5/SIMULATE5 code package for reactor core physics parameters is used with NRELAP5 for thermohydraulic input into the subchannel analysis. The nuclear analysis portion of the rod ejection transients is performed with 3D space-time kinetics code SIMULATE-3K.

VIPRE-01 is used to perform the subchannel analysis and calculate the MCHFR. This methodology is presented and reviewed in the referenced topical report TR-0716-50350, Rod Commented [A7]: Issuance of the final approved -A Ejection Accident Methodology, Revision 1, issued November 15, 2019 (ADAMS Accession version of this topical report is a Confirmatory Item.

No. ML19319C685).

Flow Instability DCA Part 2, Tier 2, Section 15.0.2.2.3, states that the NuScale proprietary code, PIM, is used to demonstrate system stability at steady-state operation and AOO. Additionally, Section 15.0.2.2.3 references Topical Report (TR)-0516-49417, Evaluation Methodology for Stability Analysis of NuScale Power Module, Revision 1, issued September 2019 (ADAMS Commented [A8]: Issuance of the final approved -A Accession No. ML19262J750). version of this topical report is a Confirmatory Item.

15-16

Subchannel Analysis DCA Part 2, Tier 2, Section 15.0.2.3, states that subchannel analyses are performed using VIPRE-01 (Versatile Internals and Component Program for Reactors; Electrical Power Research Institute, [EPRI]) with the NuScale-specific CHF correlations. Additionally, Section 15.0.2.3 references TR-0915-17564-A, Subchannel Analysis Methodology, Revision 2, issued February 2019 (ADAMS Accession No. ML19067A256), and TR-0116-21012, NuScale Power Critical Heat Flux Correlations, Revision 1, issued December 2018 (ADAMS Accession No. ML18360A632).

Radiological Consequence Analysis Methodology for the Design-Basis Accident NuScale performed its DBA radiological consequence analyses using the RADionuclide Transport, Removal, and Dose (RADTRAD) computer code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.3. Section 15.0.3 of DCA Part 2, Tier 2, describes the use of RADTRAD and the radiological EM. Several codes provided information for input to the RADTRAD code calculations. The applicant calculated short-term accident atmospheric dispersion factors using the Atmospheric Relative CONcentrations in Building Wakes ARCON96 (ARCON96 in Building Wakes, 1996) computer code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.2. The applicant used the STARNAUA aerosol transport and removal code to calculate aerosol removal coefficients to model aerosol natural deposition in containment, as described in DCA Part 2, Tier 2, Section 15.0.2.4.5. The applicant developed the NuScale pHT code, as described in DCA Part 2, Tier 2, Section 15.0.2.4.6, to calculate the post-accident time-dependent pH in containment to provide information to support the DBA dose analysis assumptions. The applicant used the Monte Carlo N-Particle (MCNP) code to evaluate the direct gamma radiation dose to operators in the control room, as described in DCA Part 2, Tier 2, Section 15.0.2.4.7.

As described in DCA Part 2, Tier 2, Table 1.6-1, DCA Part 2, Tier 2 Chapter 15 incorporates by reference NuScale topical report TR-0915-17565, Accident Source Term Methodology, which Commented [A9]: Issuance of the final approved -A describes the applicants use of the ARCON96, STARNAUA, and pHT computer codes in the version of this topical report is a Confirmatory Item.

methodology for evaluation of the accident radiological consequences.

ITAAC: There are no inspection, test, analysis, and acceptance criteria (ITAAC) items for this area of review.

Technical Specifications: The TS associated with DCA Part 2, Tier 2, Section 15.0.2, are related to analytical methods used to determine core operating limits and are described in Part 4 of the applicants Standard Plant DCA, Generic Technical Specifications, Reporting Requirement 5.6.3, Core Operating Limits Report.

Technical Reports: The applicable technical reports associated with this section are listed in DCA Part 2, Tier 2, Table 15.0-10.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 52.47, Contents of Applications; Technical Information, and 10 CFR 52.79, Contents of Applications; Technical Information in Final Safety Analysis Report, require an FSAR to describe and analyze the design and performance of SSCs.

15-17

  • The evaluation methodologies described in DCA Part 2, Tier 2, Section 15.0.2, form a partial basis for demonstrating compliance with the regulations identified in Section 15.0.0.3 of this SER.

Loss-of-Coolant Accident Methodology The staffs review of TR-0516-49422 is documented in the SER for the topical report (MLXXXXX). The staff reviewed NRELAP5 Version 1.4, and NPM base model Version 2 to Commented [A10]: The staffs SER will be issued and confirm that the code, code modifications, and modeling adequately address the requirements an ML# provided in the Phase 6 SER.

of RG 1.203, Transient and Accident Analysis Methods. The validation and modeling bases Commented [A11R10]: And issuance of the final -A developed for the LOCA methodology is extended by the applicant to support modeling bases version of the topical is a confirmatory item.

for NRELAP5 analysis used in non-LOCA, containment, and long term cooling tranisent analyses. The NRELAP5 code and input models used are key components of the applicants methodology.

As part of its review, the staff reviewed Appendix B of the LOCA TR, which covers the methodology for the EM for inadvertent opening of RPV valves. The staffs evaluation of the methodology relative to these requirements and the calculational framework established in RG 1.203 is documented in the SER for TR-0516-49422.

The staff noted that NRELAP5 models used to support the Chapter 15 accident analysis were built from a base model that used a computer aided design model to produce NPM geometry inputs. The modeling approach used was consistent with that used in the NIST-1 facility benchmark models and the base model was developed generically for non-LOCA application.

The LOCA model included removal of un-necessary secondary-side components and the addition of a hot channel. NRC staff reviewed the NuScale LOCA evaluation model methodology described in TR-0516-49422, the analysis modeling approach outlined, and the NRELAP5 input options and models selected to represent the NuScale NPM transient behavior and determined it is suitable for performing LOCA safety analysis, subject to the limitations and conditions in the staffs SER.

Exemption from 10 CFR Part 50, Appendix K, Emergency Core Cooling System Evaluation Model The staff reviewed the applicants request for exemption from certain requirements of 10 CFR Part 50, Appendix K, as described in DCA Part 7, Section 10.1.2, related to certain phenomena not encountered in the NuScale NPM during a LOCA because of the NPM design. The applicant stated that the underlying purpose of the rule is met because the NPM has been designed to avoid those phenomena, and the model conservatively calculates the consequences of postulated LOCAs from a spectrum of pipe break sizes and locations. The specific requirements in 10 CFR Part 50, Appendix K, from which the applicant requested exemption are the following:

  • I.A.4, as it relates to the heat generation rates from radioactive decay of fission products.
  • I.A.5, as it relates to the rate of energy release, hydrogen generation, and cladding oxidation from the metal/water reaction.

15-18

  • I.B, with respect to inclusion of a provision for predicting cladding swelling and rupture.
  • I.C.1.b, with respect to calculation of the discharge rate for all times after the discharging fluid has been calculated to be two-phase.
  • I.C.5.a, with respect to Post-CHF correlations of heat transfer from the fuel cladding to the surrounding fluid.
  • I.C.7.a, with respect to calculation of cross-flow between the hot and average channel regions of the core during blowdown.

Evaluation for Meeting the Exemption Criteria of 10 CFR 50.12, Specific Exemptions Pursuant to 10 CFR 52.7, the Commission may, upon application by any interested person or upon its own initiative, grant exemptions from the requirements of 10 CFR Part 52. As 10 CFR 52.7 further states, the Commissions consideration will be governed by 10 CFR 50.12, Specific exemptions, which states that an exemption may be granted when: (1) the exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security; and (2) special circumstances are present. Specifically, 10 CFR 50.12(a)(2) lists six special circumstances for which an exemption may be granted. It is necessary for one of these special circumstances to be present in order for the NRC to consider granting an exemption request.

Authorized by Law The NRC staff has determined that granting of the applicants proposed exemptions will not result in a violation of the Atomic Energy Act (AEA) of 1954, as amended, or the Commissions regulations because, as stated above, 10 CFR Part 52, allows the NRC to grant exemptions.

The staff also determined that granting the applicants proposed exemptions will not result in a violation of the AEA, or the Commissions regulations. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the exemption is authorized by law.

No Undue Risk to Public Health and Safety The staff review of the exemption request to determine if the exemption would present an undue risk to the public health and safety (10 CFR 50.12(a)(1)) is described below. In its exemption request, the applicant stated that it has designed the NuScale Power Plant to avoid those phenomena covered by the requirements of 10 CFR Part 50, Appendix K. The applicant further stated that the model conservatively calculates the consequences of postulated LOCAs from a spectrum of pipe break sizes and locations.

The staff reviewed TR-0516-49422, subject to the conditions and limitations in the staffs SER (MLXXXXX), and confirmed that the evaluation model conservatively calculates the Commented [A12]: The SER for the staffs review will consequences of postulated LOCAs. be published and the ML# provided in the staffs Phase 6 SER.

Further, the staff reviewed the results of the LOCA analyses, discussed in Section 15.6.5 of this SER, to confirm that no post-CHF phenomena will occur to invalidate the applicants stated justification for the exemption request (i.e., certain Appendix K requirements are not modeled because they are precluded by the design of the NPM). Further, Table 15.0-4 in DCA Part 2, Tier 2, Section 15.0.0.2.2 specifies that the acceptance criteria for LOCAs for the NuScale design is CHF and collapsed liquid level. Since the DCA acceptance criteria for LOCAs preclude any post-CHF phenomena, the use of an evaluation model that does not model these 15-19

aspects required by Appendix K will not result in an incomplete or nonconservative evaluation of the consequences of LOCAs. The staffs evaluation of the calculational results of the consequences of LOCAs is in Section 15.6.5 of this report. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the exemption poses no undue risk to the public health and safety.

Consistent with Common Defense and Security The proposed exemption does not affect design, function, or operation of any structures or plant equipment that is necessary to maintain a secure plant status. In addition, the proposed exemption has no impact on plant security or safeguards procedures. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the common defense and security is not impacted by this exemption.

Special Circumstances Special circumstances, in accordance with 10 CFR 50.12(a)(2)(ii), are present whenever application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule.

The underlying purpose of 10 CFR 50 Appendix K is to ensure that the LOCA evaluation model conservatively calculates the consequences of postulated LOCAs. As described earlier, Table 15.0-4 in DCA Part 2, Tier 2, Section 15.0.0.2.2 specifies that the acceptance criteria for LOCAs for the NuScale design are CHF and collapsed liquid level. Since the DCA acceptance criteria for LOCAs preclude any post-CHF phenomena, the use of an evaluation model that does not model these aspects identified in the exemption request and required by Appendix K will not result in an incomplete or nonconservative evaluation of the consequences of LOCAs.

Therefore, the underlying purpose of the rule is met by the NuScale LOCA evaluation model without inclusion of these model features.

Staff finds that the NuScale design meets the underlying purpose of these regulations because the LOCA evaluation model can conservatively calculate the consequences of LOCAs for the phenomena present in the NuScale design, and is consistent with the acceptance criteria specified in Table 15.0-4 in DCA Part 2, Tier 2, Section 15.0.0.2.2.

The applicant states in its DCA Part 7 that special circumstances described in 10 CFR 50.12(a)(2)(vi), related to any other material circumstance not considered when the regulation was adopted for which it would be in the public interest to grant an exemption, are present.

However, where the staff finds that other special circumstances are present in accordance with 10 CFR 50.12(a)(2), a staff finding on whether special circumstances are present in accordance with 10 CFR 50.12(a)(2)(vi) is not necessary for the exemption to be granted. Because the staff finds that special circumstances are present in accordance with 10 CFR 50.12(a)(2)(ii), the staff makes no finding regarding the presence of special circumstances described in 10 CFR 50.12(a)(2)(vi).

Conclusion For the reasons given above, as set forth in 10 CFR 50.12(a), the staff concludes that the proposed exemption requested in DCA Part 7, Section 10, regarding requirements stated in 10 CFR Part 50, Appendix K, paragraphs I.A.4, I.A.5, I.B, I.C.1.b, I.C.5.a, and I.C.7.a is authorized by law, will not present an undue risk to the public health and safety, and is consistent with the common defense and security. Also, the special circumstances in 10 CFR 15-20

50.12(a)(2)(ii) are present, in that the application of these portions of Appendix K in the particular circumstances is not necessary to achieve the underlying purpose of these rules.

Therefore, the staff concludes that an exemption to the requirements of 10 CFR Part 50, Appendix K, paragraphs I.A.4, I.A.5, I.B, I.C.1.b, I.C.5.a, and I.C.7.a is justified and is approved.

Non-Loss-of-Coolant Accident Methodology The staff reviewed TR-0516-49416, Non-Loss-of-Coolant Accident Analysis Methodology, Revision 2, subject to the conditions and limitations in the staffs SER (MLXXXXX). The non- Commented [A13]: The staffs SER will be published LOCA EM uses the code modeling bases developed for the LOCA methodology and the ML# provided in the Phase 6 SER.

(TR-0516-49422) to apply to non-LOCA events.

The staff reviewed TR-0516-49422, Loss-of-Coolant Accident Evaluation Model, Revision 1, subject to the conditions and limitations in the staffs SER (MLXXXXX) and confirmed that the Commented [A14]: The staffs SER will be published EM adequately applies to and is capable of calculating the consequences of postulated non- and the ML# provided in the Phase 6 SER.

LOCAs. The analytical models used for each accident analysis are developed from revision 2 of the NRELAP5 basemodel and are modified to align with the modeling guidelines prescribed in the TR-0516-49416 methodology.

Flow Instability The staff reviewed Topical Report (TR)-0516-49417, Evaluation Methodology for Stability Analysis of NuScale Power Module, Revision 1, subject to the conditions and limitations in the staffs SER dated September 2019, (ML19254C858) and confirmed that the evaluation model Commented [A15]: Confirmatory Item - TR-0516-adequately calculates the consequences of postulated instability events. Staff finds the PIM 49417 review has been completed. Advance version of computer code, as described in TR-0516-49417, acceptable for performing stability analysis of the SER can be found under ML19254C858. Currently processing for a -A version.

the NuScale power module.

Subchannel Analysis The staffs review and approval of the subchannel and CHF correlation methodologies are documented in the safety evaluations of TR-0915-17564-A and TR-0116-21012-A (ML19067A256 and ML18360A631).

Radiological Consequence Analysis Methodology for the Design-Basis Accident The NRC developed the RADTRAD code to evaluate the radiological consequences of DBAs, perform confirmatory analyses, and determine the acceptability of licensee and applicant DBA radiological consequence analyses. Therefore, the staff finds the code acceptable for use in performing DBA radiological consequence analyses. MCNP is a general-purpose code used widely to calculate neutron, photon, electron, or coupled neutron, photon, and electron transport. The staff finds it acceptable for use in calculating direct radiation doses.

The staffs review of the use of ARCON96, STARNAUA, and pHT as part of NuScales methodology for performing radiological consequence analyses was performed in the staffs review of TR-0915-17565. The staffs evaluation and approval of TR-0915-17565, with limitations and conditions, is documented in its SER dated October 24, 2019 (ADAMS Accession No. ML19297G520).

15-21

There are no combined license (COL) information items associated with DCA Part 2, Tier 2, Section 15.0.2.

Based on the reviews discussed above, staff determined that the NuScale analysis methods and computer codes used in non-LOCA safety analyses, LOCA evaluations, and post-LOCA LTC evaluations are consistent with the requirements in 10 CFR 52.47, 10 CFR 52.79, and 10 CFR Part 50, Appendix K.

Radiological Consequences of Design-Basis Accidents This section of the report describes the staffs evaluation of the information provided in Chapter 15, Transient and Accident Analysis, that describes the evaluation of the design basis source terms and the core damage source term that are assessed for events projected to result in radiological consequences.

DCA Part 2, Tier 1: The DCA Part 2, Tier 1, information associated with this section is found in DCA Part 2, Tier 1, Section 5.0, Site Parameters.

DCA Part 2, Tier 2: In DCA Part 2, Tier 2, Chapter 15, the applicant performed radiological consequence assessments for six reactor design basis accidents and the core damage event, using hypothetical site parameter atmospheric relative concentration (dispersion) values (/Q values) for accidents. Because all other aspects of the design are fixed, these /Q values help determine the required minimum distances to the exclusion area boundary (EAB) and the low population zone (LPZ) for a given site in order to provide reasonable assurance that the radiological consequences will be within the siting dose criteria given in regulation, as identified below.

Although the term "design basis accident" is not explicitly defined in the regulations, the SRP defines design basis accidents as unanticipated conditions of operation (i.e., not expected to occur during the life of the nuclear power unit) that are used to set design criteria and limits for the design and sizing of safety-related systems and components. These are based upon the set of design basis events (as defined by NuScale), giving credit for fission product mitigation by safety-related SSCs. NuScale has provided design basis source terms and radiological consequence analyses for design basis accidents and events, as well for a core damage event.

Below, the staff has used the term design basis source term or design basis event in the discussion of the accident radiological consequence analyses other than for the core damage event, and events in general. The NuScale DCA Part 2, Tier 2, Sections 15.0.3, 15.1.5, 15.4.8, 15.6.2, 15.6.3, 15.6.5, 15.7.4, 15.7.5, 15.7.6, and 15.10, with multi-module considerations discussed in Section 21.3.1.2, provide discussion of the radiological consequences analyses. The events and surrogate source terms analyzed for radiological consequences include:

  • Failure of small lines carrying primary coolant outside containment (DCA Part 2, Tier 2, Sections 15.0.3.8.1 and 15.6.2).

15-22

  • Rod ejection accident (REA) (DCA Part 2, Tier 2, Sections 15.0.3.8.4 and 15.4.8).
  • Fuel handling accident (FHA) (DCA Part 2, Tier 2, Sections 15.0.3.8.5 and 15.7.4).
  • Iodine spike design basis source term (DBST) (DCA Part 2, Tier 2, Section 15.0.3.8.6)
  • Core damage event (CDE) (DCA Part 2, Tier 2, Section 15.10).

The applicant provided information on the radiological consequences analysis methodology, assumptions, and results for the potential doses at the EAB, at the LPZ outer boundary, and in the control room. The applicant also provided information on the radiological habitability in the NuScale design technical support center (TSC) to show compliance with the onsite emergency response facility regulatory requirements.

In DCA Part 2, Tier 2, Chapter 15, the applicant concluded that the NuScale design will provide reasonable assurance that the radiological consequences resulting from any of the above analyzed events will fall within the offsite dose criterion of 0.25 Sievert (Sv) (25 roentgen equivalent man [rem]) total effective dose equivalent (TEDE), as given in 10 CFR 52.47(a)(2),

Contents of applications; technical information, and the control room operator dose criterion of 0.05 Sv (5 rem), as given in 10 CFR Part 50, Appendix A, GDC 19, Control Room, as incorporated by reference in 10 CFR 52.47(a)(3). The applicant reached this conclusion by performing the radiological consequences analyses by:

  • Using reactor accident source terms based on NuScale topical report TR-0915-17565, Accident Source Term Methodology.
  • Modeling removal of aerosols within the containment by natural phenomena using the methodology in NuScale topical report TR-0915-17565.
  • Crediting control of the pH of the water in the containment to prevent iodine evolution using the methodology in NuScale topical report TR-0915-17565.
  • Using a set of hypothetical atmospheric dispersion factor (/Q) values.

The /Q values are the relative atmospheric concentrations of radiological releases at the receptor point in terms of the rate of radioactivity release. In lieu of site-specific meteorological data, the applicant provided a reference set of site parameter short-term (accident) /Q values for the NuScale design using meteorological data that is expected to envelope offsite dispersion conditions at most potential plant site locations in the United States. NuScale DCA Part 2, Tier 1, Table 5.0-1, Site Design Parameters, under the heading, Meteorology, provides the reference set of /Q values for the NuScale design. Accident /Q values used in the design basis source term and CDE dose analyses for the EAB, LPZ, and main control room (MCR) and TSC receptors are also given in NuScale DCA Part 2, Tier 2, Table 2.0-1, Site Design Parameters.

15-23

The DCA Part 2, Tier 2, Table 15.0-12, Radiological Dose Consequences for Design Basis Analyses, summarizes the offsite and control room dose results from the design basis source terms and CDE radiological consequence evaluations and compares these results to the applicable dose acceptance criteria.

ITAAC: There are no ITAAC specific to this area of review.

Technical Specifications: There are no TS specific to this area of review.

Technical and Topical Reports: The NuScale evaluation of the radiological consequences of the design basis source terms and CDE relies upon the methodology proposed in NuScale proprietary licensing topical report TR-0915-17565, Accident Source Term Methodology.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 52.47(a)(2), as it relates to the evaluation and analysis of the offsite radiological consequences of postulated accidents with fission product release.
  • GDC 19, as it relates to maintaining the control room in a safe condition under accident conditions by providing adequate protection against radiation.
  • 10 CFR Part 50, Appendix E, Emergency Planning and Preparedness for Production and Utilization Facilities, Paragraph IV.E.8, as it relates to adequate provisions for an onsite technical support center from which effective direction can be given and effective control can be exercised during an emergency.

The NRC staff notes that NuScale has proposed a PDC in place of GDC 19. The PDC proposed by NuScale is functionally identical to the GDC with respect to the GDC 19 control room habitability requirements. The staffs review of the related exemption to GDC 19, Control Room, is discussed in Section 1.14 of this SER.

The guidance in NuScale SMR DSRS Section 15.0.3 lists the acceptance criteria adequate to meet the above requirements, as well as review interfaces with other DSRS and SRP sections.

The following document also provides additional criteria, or guidance in support of the acceptance criteria to meet the above requirements.

  • RG 1.183, as it provides guidance on acceptable methods to perform DBA radiological consequence analyses for light-water reactors.

NuScales analyses of the radiological consequences of the design basis source terms and the core damage event reference the accident source term methodology described in NuScale topical report TR-0915-17565, Accident Source Term Methodology. The staff reviewed this topical report concurrently with the review of the radiological analysis information in the DCA.

15-24

The staffs evaluation and approval of TR-0915-17565, with limitations and conditions, is documented in its SER dated October 24, 2019 (ADAMS Accession No. ML19297G520). Commented [A16]: The staffs SER for TR-0915-17565 will be published and the ML# provided in the The staff determined that the NuScale DCA met the limitations and conditions for use of TR- Phase 6 SER. A draft of the TR is available at 0915-17565 because the referenced TR is applicable to the DCA for the NuScale SMR design ML19297G520.

described on the Docket No.52-048, by definition.

The staff evaluated the applicants calculated radiological consequences against the dose criteria, given in 10 CFR 52.47(a)(2)(iv), of 0.25 Sv (25 rem) TEDE at the EAB for any 2-hour period following the onset of the postulated fission product release, and 0.25 Sv (25 rem) TEDE at the outer boundary of the LPZ for the duration of exposure to the radioactive release cloud.

NuScale SMR DSRS 15.0.3 gives accident-specific offsite dose acceptance criteria, which are derived from the regulatory criteria as either well within (0.065 Sv (6.5 rem)) or a small fraction of (0.025 Sv (2.5 rem)) the regulatory criteria based roughly on the likelihood of the accident.

The staff used a criterion of 0.05 Sv (5 rem) TEDE for evaluating the radiological consequences from the design basis source terms and the CDE in the control room of the NuScale design, pursuant to PDC 19. The staff evaluated the radiological habitability analysis for the NuScale design TSC against the onsite emergency response facility regulatory requirements in 10 CFR Part 50, Appendix E, Paragraph IV.E.8 and 10 CFR 50.47(b)(8) and (b)(11),

Emergency Plans. The staffs complete review of the emergency response facilities is discussed in Section 13.3, Emergency Planning, of this SER.

The radiological consequence analyses performed by the applicant evaluate the bounding radiological consequences design basis events described in DCA Part 2, Tier 2, Chapter 15, as applicable to the NuScale SMR. The DCA Part 2, Tier 2, Chapter 15 design basis source terms and CDE are analyzed for a single nuclear power module. DCA Part 2, Tier 2, Chapter 21, Multi-Module Design Considerations, discusses the suitability of shared components and the design measures taken to ensure these components do not introduce multi-module risks.

Section 15.0.0 of this SER describes the staffs review of the event classification.

The staff reviewed the radiological consequence analyses that were performed by the applicant using the hypothetical site parameter accident release /Q values given in DCA Part 2, Tier 1, Table 5.0-1 and DCA Part 2, Tier 2, Table 2.0-1. The staffs review found that the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria stated above for each of the analyses. To evaluate the applicants analyses, the staff performed independent confirmatory radiological calculations using the site parameter /Q values provided by the applicant and the RADTRAD computer code, run within the Symbolic Nuclear Analysis Package (SNAP) suite of integrated applications for engineering analysis, developed for the NRC. Information on the SNAP/RADTRAD code is available from the NRCs Radiation Protection Computer Code Analysis and Maintenance Program (RAMP) at https://ramp.nrc-gateway.gov/content/snapradtrad-overview. The following sections describe the staffs findings.

The applicant followed the accident analysis guidance in NuScale SMR DSRS Section 15.0.3, through implementation of the NuScale topical report accident source term methodology. The NuScale radiological consequences analyses credit natural phenomena and safety-related SSCs to mitigate the radiological consequences of the design basis source terms and CDE .

The NuScale radiological consequences analyses of the design basis source terms and CDE also take credit for selected non-safety-related fission product mitigation systems to ensure radiological habitability of the MCR. If the assumption resulted in a more limiting radiological consequence, non-safety-related SSCs were assumed operational. DCA Part 2, Tier 2, Section 15.0.0.6.6, describes the treatment of non-safety-related systems in the evaluation of design 15-25

basis events. In its radiological consequence analyses the applicant evaluated the DBEs and CDE considering a single, active failure that maximizes the radiological consequences. No credit was taken for operator actions in the initial 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of the accident. Due to NuScales passive safety feature design, loss of offsite power (LOOP) does not affect the analyses with respect to estimation of the radioactive release. Scenarios with and without loss of normal ac power were evaluated with respect to the control room and TSC ventilation systems capabilities to protect occupants during DBEs and the core damage event.

The staff used guidance in NuScale SMR DSRS Section 15.0.3 and RG 1.183, as applicable, in its review of the NuScale radiological consequence analyses of the design basis source terms and CDE. Although RG 1.183 was written to apply to currently operating LWRs, its guidance on radiological acceptance criteria, formulation of the source term, and DBA modeling is useful in the review of the NuScale design, which is a LWR design. The applicants radiological consequence analyses of the design basis source terms and CDE use the guidance in RG 1.183 as far as applicable, as described in the referenced accident source term methodology topical report. The applicant stated that deviations from the RG 1.183 guidance are due to differences between the NuScale design and large light water reactors. Staffs review of the methodology used to evaluate the radiological consequences of the design basis source terms and CDE is dependent on the acceptability of the referenced accident source term methodology topical report. This SER discusses the staffs evaluation of the applicants implementation of the topical report accident source term methodology in the DCA Part 2, Tier 2, Chapter 15, radiological consequence analyses, including the bases for analysis input values and comparison of results to the regulatory requirements listed above and the NuScale SMR DSRS 15.0.3 accident-specific dose acceptance criteria. To aid in its assessment of the applicants implementation of the accident source term methodology and evaluate the dose analysis calculation inputs, the staff conducted an audit of the design basis source term and CDE dose analysis calculations as discussed in the audit report issued on August 28, 2017 (ADAMS Accession No. ML17223A659).

The staff applied a graded review approach to evaluate those areas that have an impact on safety in more detail. The staffs review concentrated on assumptions and analysis inputs related to post-accident operation of SSCs that based on uncertainty may increase the projected dose to reduce the margin to the applicable dose criteria. For example, although the staff did assess the applicants analysis of the dose to control room operators for all potential pathways as discussed below, the staff did not do a detailed evaluation of the applicants calculations of direct dose in the main control room due to streaming from a power module containment vessel during the CDE. The staff made this decision to place less emphasis on review of the details of the applicants direct dose analysis for this pathway because of the NuScale SMR plant configuration which includes a large pool of water and several concrete walls between the containment vessel and the main control room area to provide radiation shielding. Conversely, the staff placed more emphasis on understanding the dose analysis inputs and assumptions that model the main control room, including operation of the non-safety-related control room ventilation systems that provide post-accident control room habitability to comply with PDC 19 requirements. Uncertainty in ventilation isolation and filtration capability with respect to exclusion and removal of airborne radioactive materials can have a large effect on the projected dose to the control room occupants. The discussion of the staffs review below will generally be consistent with the emphasis placed on the topic of review.

15-26

Selection of Design-Basis Accidents NuScale evaluated the radiological consequences of the DCA Part 2, Tier 2, Chapter 15 design basis events that would result in radiological releases to the atmosphere and potentially could result in offsite doses or dose to control room operators. The events include postulated deterministic accidents similar to those accidents other than the LOCA for evaluation of radiological consequences, described in SRP Chapter 15 and RG 1.183, as applicable to a PWR. NuScale also evaluated a postulated core damage event in which significant core damage occurs with release to the environment through design leakage from the intact containment in order to give a core damage source term (CDST) that is consistent with the source term description in 10 CFR 52.47(a)(2)(iv). NuScale SMR DSRS 15.0.3 identifies the same accidents as being applicable to the NuScale design, with the exception that NuScale DCA Part 2, evaluates the CDE and iodine spike DBST instead of the LOCA.

Site Characteristic Short-Term Atmospheric Dispersion Factors Because no specific site is associated with the NuScale design, the applicant defined the offsite boundaries only in terms of hypothetical atmospheric relative concentration (/Q) values at fixed EAB and LPZ distances as site parameters. The applicant assumed that the EAB and LPZ outer boundary were both located at the same analytical distance of 400 feet, which is the smallest distance to the security owner-controlled area fence from any potential release point.

The applicant also provided hypothetical site parameter /Q values for each pairing of accident release point and receptor for the MCR and TSC, both for the ventilation system intake and the assumed control room envelope inleakage location. DCA Part 2, Tier 2, Table 2.0-1 lists the site parameter accident release /Q values used in the radiological consequence analyses for the NuScale design. DCA Part 2, Tier 1, Table 5.0-1 also lists these accident /Q values as site parameters for the design. Section 2.3.4 of this SER provides discussion of the staffs review of the hypothetical atmospheric dispersion factors.

A COL applicant that references the NuScale design will provide short-term (less than or equal to 30 days) site specific atmospheric dispersion factors for potential accident consequence analyses based on the location of their EAB and LPZ outer boundary using onsite meteorological data. If the COL applicants site characteristic atmospheric dispersion factors exceed the NuScale site parameter values used in this evaluation (i.e., poorer dispersion characteristics), a COL applicant may have to consider compensatory measures, such as increasing the size of their site or providing additional ESF systems to reduce radiological releases to meet the relevant dose criteria.

Radiological Consequences The NuScale SMR is an integral PWR design, with 12 nuclear power modules included in the plant. Although the NuScale SMR is a light-water reactor, the plant design includes passive features to mitigate accidents unlike the operating power reactors. In SECY-16-0012, Accident Source Terms and Siting for Small Modular Reactors and Non-Light Water Reactors (ADAMS Accession No. ML15309A319), the staff described the history of the potential policy and licensing issues for SMRs and non-LWRs with respect to the determination of accident source terms and the resulting dose calculation and siting evaluations. The staff has found it acceptable to permit use of mechanistic source terms to account for design-specific accident scenarios and accident progression in developing radiological source terms to meet the regulatory requirement in 10 CFR 52.47(a)(2) that the accident analyses include a DBA with significant core damage and release to an intact containment. NuScale topical report TR-0915-15-27

17565 includes a methodology to determine a surrogate accident source term to meet the analysis requirements in 10 CFR 52.47(a)(2) in lieu of following prior NRC guidance regarding LOCA radiological consequence analyses for PWRs.

The NRC issued RG 1.183 in July 2000 to provide guidance to licensees of operating power reactors on acceptable applications of alternative source terms pursuant to 10 CFR 50.67, Accident source term. This RG provides guidance based on insights from NUREG-1465 and significant attributes of other alternative source terms that the staff may find acceptable for operating light-water reactors (LWRs). It also identifies acceptable radiological analysis assumptions for use in conjunction with the accepted alternative source term for operating power reactors. Although 10 CFR 50.67 is not applicable to new reactor design certification review, the guidance in RG 1.183 may be applicable to LWR designs. In SRP Section 15.0.3, the staffs review procedures direct the use of RG 1.183 regulatory positions, as applicable, to the plant design under review. The applicant followed the relevant guidance in RG 1.183 for PWRs, as applicable.

Core Radionuclide Inventory The NuScale design basis source term and CDE radiological consequence analyses are based on 102 percent of rated core thermal power. The 2 percent power uncertainty assumption is consistent with the guidance in RG 1.183 on accounting for power uncertainty in the core fission product inventory. Accordingly, the applicant calculated the core fission product isotopic inventory at 102 percent of the core rated thermal power of 160 megawatts thermal (MWt),

which is 163.2 MWt.

The applicant used the Standardized Computer Analyses for Licensing Evaluation (SCALE) 6.1 code to develop the reactor core fission product inventory. The Transport Rigor Implemented with Time-dependent Operation for Neutronic depletion (TRITON) analysis module was used to generate burnup-dependent cross sections for NuScale fuel assemblies for subsequent use in the Oak Ridge Isotope GENeration - Automatic Rapid Processing (ORIGEN-ARP) depletion module. The ORIGEN-S isotope generation and depletion computer code was also used as a standalone code to calculate the core isotopic inventory. The SCALE code suite is a comprehensive modeling and simulation suite for nuclear safety analysis and design developed and maintained by Oak Ridge National Laboratory (ORNL) under contract with the NRC, U.S.

Department of Energy, and the National Nuclear Security Administration to perform reactor physics, criticality safety, radiation shielding, and spent fuel characterization for nuclear facilities and transportation/storage package designs. For more information on the SCALE code suite see https://www.ornl.gov/scale. ORIGEN-S and ORIGEN-ARP are widely used in the nuclear industry to calculate fission product production and depletion. RG 1.183 includes guidance on use of an appropriate code for calculation of the core fission product inventory and cites versions of the ORIGEN code (ORIGEN 2 and ORIGEN-ARP) as being appropriate. ORIGEN-S is the most up-to-date version of the ORIGEN code while ORIGEN 2 is no longer supported by ORNL. ORIGEN-ARP is a fast version of the code sequence to perform point-irradiation calculations with the ORIGEN-S code using problem-dependent cross sections for fuel characterization.

The staff performed a confirmatory calculation of the core inventory using the latest version of the ORIGEN code, which is part of SCALE 6.2, (Ref. SCALE Code System, ORNL/TN-2005/39, Version 6.2.1.) The staffs calculations used information from DCA Part 2, Tier 2, Sections 4.2, 4.3, and 15.0.3 on the NuScale core and fuel assembly design, including uranium (U)-235 loading, fuel maximum burnup and irradiation cycle length, and has obtained similar 15-28

results to those reported in DCA Part 2, Tier 2, Table 11.1-1, Maximum Core Isotopic Inventory.

Coolant Activity Concentrations For DBEs other than the CDE and the FHA, the source of radioactive materials available for release are the primary and secondary coolant. DCA Part 2, Tier 2, Section 11.1 discusses estimation of the radionuclide activity concentrations in the primary and secondary coolant. For use in the radiological consequence analyses of the design basis source terms, the applicant adjusted the primary coolant radionuclide activity concentrations to the GTS 3.4.8 specific activity limits of 3.7E-02 µCi/gm Dose Equivalent (DE) I-131 and 10 µCi/gm DE Xe-133 for the equilibrium initial condition. For the pre-incident iodine spiking scenario, the applicant assumes that the primary coolant iodine activity concentration is at the GTS 3.4.8 maximum specific activity limit of 2.2 µCi/gm DE I-131.

The applicants analyses do not model the radionuclide activity concentration in the secondary coolant, which may be present by leakage of primary coolant through the steam generator tubes to the secondary coolant. NuScale topical report TR-0915-17565 discusses a sensitivity study for the SGTF and MSLB accidents which assumed that the initial condition secondary coolant radionuclide activity concentrations were equivalent to the primary coolant radionuclide activity concentrations. The sensitivity study demonstrated that the dose results are not sensitive to the secondary coolant activity concentration initial conditions.

Reactor Building Pool Boiling Radiological Consequences DCA Part 2, Tier 2, Section 15.0.3.7.3 states that it takes more than 61 hours7.060185e-4 days <br />0.0169 hours <br />1.008598e-4 weeks <br />2.32105e-5 months <br /> for the reactor building pool to reach boiling after a loss of normal ac power event and that the estimated dose associated with this condition would be less than 5 milliSievert (mSv) (0.5 rem) TEDE at the EAB, LPZ, in the MCR, and in the TSC. The applicant provided clarifying information (ADAMS Accession No. ML17213B267) to state that the postulated reactor building pool boiling event is not a DBA, and the results are not added to the dose results of each of the design basis source terms and CDE. The applicant further stated that projected dose from a reactor pool boiling event are discussed in DCA Part 2, Tier 2, Chapter 15 to provide additional information concerning the potential event. Because the reactor building pool boiling event is not a DBA, and the doses are provided only for additional information, the staff did not evaluate the applicants calculation of the reactor building pool boiling radiological consequence and makes no specific finding on this analysis.

Control Room and Technical Support Center Radiological Habitability DCA Part 2, Tier 2, Sections 15.0.3.7.1 and 15.0.3.7.2 describe the modeling of the control room and TSC in the radiological consequence analyses. The dose pathways considered include intake and inleakage to the control room envelope, direct shine, sky-shine and shine from filters. Occupancy factors are taken from RG 1.183. The control room dose analyses are performed for two cases, based on control room emergency mode. The staff evaluated the applicants analyses of the radiological consequences discussed in the DCA for each of the following control room emergency mode cases.

The first case models the operation of the CRVS with continuous filtered airflow to the control room envelope for the duration of the event. This emergency mode assumes an uninterrupted power supply. Because the TSC is included in the control room envelope for this mode, the 15-29

TSC radiological habitability evaluation uses this model. The CRVS supplemental filtration is assumed to be initiated automatically once the radioactivity measured at the intake reaches the isolation signal setpoint. The control room and TSC dose analyses include the delay time for the isolation and initiation of the system. The control room dose analyses assume 5 cubic feet per minute (cfm) unfiltered inleakage for ingress and egress through the airlock, plus 147 cfm unfiltered inleakage through the control room envelope. The TSC dose analyses assume 10 cfm unfiltered inleakage for ingress and egress through the TSC door, plus 56 cfm unfiltered inleakage through the ventilation envelope.

The second case models the operation of the CRHS to provide clean bottled air for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, followed by operation of the CRVS with continuous filtered airflow to the control room envelope for the remainder of the event duration. The CRHS is assumed to be initiated automatically to isolate and pressurize the main control room, based upon immediate loss of power. During the operation of the CRHS, the control room dose analyses assume 5 cfm unfiltered inleakage for ingress and egress through the airlock, plus 10 cfm unfiltered inleakage through the control room envelope. After 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the assumptions on filtered intake and unfiltered inleakage during operation of the CRVS are the same as in the first case. The TSC is not supplied by the CRHS, therefore TSC doses are not calculated for this case. The TSC function can be moved if the TSC is uninhabitable. The staffs evaluation of the NuScale TSC design is discussed in Section 13.3 of this SER.

Radiological Consequences of Failure of Small Lines Carrying Primary Coolant Outside Containment The radiological consequences analysis for the failure of small lines carrying primary coolant outside containment is described in DCA Part 2, Tier 2, Section 15.0.3.8.1. Additional information on the event is discussed in DCA Part 2, Tier 2, Section 15.6.2. The event is a postulated break in the CVCS letdown line or makeup line or in the pressurizer spray line, which does not result in fuel damage. Therefore, the radiological consequences analysis assumes release of the primary coolant through the break, with a coincident iodine spike that raises the equilibrium appearance rate by a factor of 500 for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. The containment isolates, and the assumed single failure is a stuck open CIV in the line which has the break. The analysis does not credit holdup or retention in the reactor building.

The staff determined that the analysis method described in the DCA Part 2, Tier 2, Section 15.0.3.8.1 is consistent with the methodology in TR-0915-17565, and uses NuScale design-specific inputs to determine the radiological consequences of the failure of small lines carrying primary coolant outside containment. The dose results are less than the applicable accident-specific dose criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the failure of small lines carrying primary coolant outside containment. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. Therefore, based upon its review of the DCA Part 2 implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the failure of small lines carrying primary coolant outside containment is acceptable.

The staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated failure of small lines carrying primary coolant outside containment will be a small fraction of dose criteria set forth in 10 CFR 52.47(a)(2).

15-30

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated failure of small lines carrying primary coolant outside containment. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated failure of small lines carrying primary coolant outside containment meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

Radiological Consequences of Steam Generator Tube Failure The SGTF radiological consequences analysis is described in DCA Part 2, Tier 2, Section 15.0.3.8.2. The analysis in DCA Part 2, Tier 2, Section 15.6.3 shows that the SGTF does not result in fuel damage. Therefore, the radiological consequences analyses assume two primary coolant iodine spiking cases; a coincident iodine spike that raises the equilibrium appearance rate by a factor of 335 for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and a pre-incident iodine spike, where the primary coolant iodine activity concentration is elevated to the TS maximum. The SGTF radiological analysis assumes a single failure of an MSIV on the faulted steam generator to maximize the radiological release. Primary coolant flows into the secondary coolant in the faulted SG through the failed SG tube at a rate and duration specified in DCA Part 2, Tier 2, Section 15.6.3. Primary coolant leaks into the secondary side of the intact SG at the maximum leak rate of 150 gallons per day allowed by design basis limits. The leakage continues until the primary system pressure is less than the secondary system pressure. The analysis does not credit holdup or retention in the reactor building.

The staff determined that the analysis method described in the DCA Part 2, Tier 2, Section 15.0.3.8.2 is consistent with the methodology in TR-0915-17565, and uses NuScale design-specific inputs to determine the radiological consequences of a postulated SGTF. The dose results are less than the applicable accident-specific dose criteria for both iodine spiking cases.

To verify the applicants assessment, the staff performed independent radiological consequence calculations for the SGTF. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. Therefore, based upon its review of the DCA Part 2 implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the SGTF is acceptable.

The staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated SGTF with coincident iodine spiking will not exceed a small fraction of the dose criteria set forth in 10 CFR 52.47(a)(2) and that the offsite radiological consequences of a postulated SGTF with pre-incident iodine spiking will not exceed the dose criteria set forth in 10 CFR 52.47(a)(2).

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated SGTF, for both iodine spiking cases. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated SGTF meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

15-31

Radiological Consequences of Main Steam Line Break Outside Containment The radiological consequences analysis for the MSLB outside containment is described in DCA Part 2, Tier 2, Section 15.0.3.8.3. The analysis in DCA Part 2, Tier 2, Section 15.1.5 shows that the MSLB outside containment does not result in fuel damage. Therefore, the radiological consequences analyses assume two primary coolant iodine spiking cases; a coincident iodine spike that raises the equilibrium appearance rate by a factor of 500 for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, and a pre-incident iodine spike, where the primary coolant iodine activity concentration is elevated to the TS maximum. Primary coolant leaks into the secondary side of the intact SGs at the maximum leak rate of 150 gallons per day allowed by design basis limits. The leakage continues until the primary system pressure is less than the secondary system pressure. The analysis does not credit holdup or retention in the reactor building.

The staff determined that the analysis method described in the DCA Part 2, Tier 2, Section 15.0.3.8.3 is consistent with the methodology in TR-0915-17565, and uses NuScale design-specific inputs to determine the radiological consequences of a postulated MSLB outside containment. The dose results are less than the applicable accident-specific dose criteria for both iodine spiking cases. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the MSLB outside containment. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. Therefore, based upon its review of the DCA Part 2 implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the MSLB outside containment is acceptable.

The staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated MSLB outside containment with coincident iodine spiking will not exceed a small fraction of the dose criteria set forth in 10 CFR 52.47(a)(2) and that the offsite radiological consequences of a postulated MSLB outside containment with pre-incident iodine spiking will not exceed the dose criteria set forth in 10 CFR 52.47(a)(2).

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated MSLB outside containment, for both iodine spiking cases. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated MSLB outside containment meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

Radiological Consequences of Rod Ejection Accident The analyses described in DCA Part 2, Tier 2, Section 15.4.8, show that there is no fuel damage predicted for the limiting REA. Therefore, the radiological consequences of the REA are bounded by other events, as stated in DCA Part 2, Tier 2, Section 15.0.3.8.4.

Section 3.2.1, Rod Ejection Accident, of TR-0915-17565 provides a source term and dose analysis method that assumes failure of one full assembly. The topical report methodology goes on to state that per the guidance in RG 1.183, Appendix H, Assumptions for Evaluating the Radiological Consequences of a PWR Rod Ejection Accident, no radiological consequence analysis is required if no fuel damage is indicated in the REA analysis. In that case, the radiological consequences of the REA are bounded by the LOCA, MSLB and steam generator 15-32

tube rupture. For the NuScale SMR design, the CDE is the equivalent analysis to the RG 1.183 LOCA, while the SGTF is the equivalent to the steam generator tube rupture.

The staff finds that the applicants analysis of the REA is consistent with the methodology in TR-0915-17565 and RG 1.183. Therefore, because the REA does not result in fuel damage, the staff finds that the radiological consequences of the REA are bounded by other events analyzed in the NuScale DCA, Part 2.

Radiological Consequences of Fuel Handling Accident The FHA radiological consequences analysis is described in DCA Part 2, Tier 2, Section 15.0.3.8.5, with supporting information in Section 15.7.4. The FHA is postulated for the dropping of a fuel assembly onto the spent fuel racks, in the reactor vessel, in a spent fuel cask during loading, or on the weir wall between the reactor pool and the spent fuel pool. The analysis assumes damage to all rods in the dropped fuel assembly, with release to the reactor pool and subsequent release to the environment. In accordance with the methodology in TR-0915-17565, the analysis assumed conservative pool scrubbing effective iodine decontamination factor of 200 based on 23 feet of water above the fuel, although the pool is much deeper. The analysis assumed no holdup or retention in the reactor building. No single failure affects this accident.

The staff determined that the analysis method described in DCA Part 2, Tier 2, Section 15.0.3.8.5 is consistent with the methodology in TR-0915-17565, and uses NuScale design-specific inputs to determine the radiological consequences of the FHA. The dose results are less than the applicable accident-specific dose criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the FHA. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. Therefore, based upon its review of the DCA Part 2 implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the FHA is acceptable.

The staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated FHA are well within the dose criteria set forth in 10 CFR 52.47(a)(2).

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated FHA.

Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated FHA meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

Radiological Consequences of Iodine Spike DBST As described in DCA Part 2, Tier 2, Section 15.0.3.8.6, the iodine spike DBST is a postulated surrogate source term to bound a spectrum of events that result in release of primary coolant to the intact containment, without damage to the fuel. The NuScale SMR has design basis events that result in primary coolant being released to the intact containment.

Neither DSRS 15.0.3 nor RG 1.183 describe a DBA with such characteristics, including the offsite dose criteria that should apply. However, the referenced TR-0915-17565 methodology 15-33

states that the assumptions for the coolant activity and modeling of iodine spiking are consistent with the assumptions for modeling a PWR main steam line break accident from RG 1.183, Appendix E. The iodine spike DBST is analyzed for two iodine spiking cases, with the same assumptions as in the SGTF and the MSLB.

The primary coolant is instantaneously released to the CNV through a non-specific release point, and homogenously mixed as a vapor into the CNV free volume. The activity is then assumed to leak into the environment at the design basis containment leak rate for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, then at 50 percent of the design leak rate for the remainder of the release. The release from containment is assumed to end at 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />, when the reactor is depressurized.

The staff determined that the analysis method described in DCA Part 2, Tier 2, Section 15.0.3.8.6 is consistent with the methodology in TR-0915-17565, and uses NuScale design-specific inputs to determine the radiological consequences of the iodine spike DBST. The dose results are less than the applicable accident-specific dose criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the iodine spike DBST. The radiological consequences calculated by the staff are consistent with those calculated by the applicant. Therefore, based upon its review of the DCA Part 2 implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the iodine spike DBST is acceptable.

The staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated iodine spike DBST will not exceed the dose criteria set forth in 10 CFR 52.47(a)(2).

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated iodine spike DBST. Therefore, the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated iodine spike DBST meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

Radiological Consequences of the Core Damage Event NuScale postulates a CDE to show compliance with the regulatory requirements cited above in Section 15.0.3.3 of this SER. This postulated event closely follows accident characteristics described in 10 CFR 52.47(a)(2) and the related footnote, and is not a single specific accident scenario. The applicant applied the methodology in NuScale topical report TR-0915-17565 to develop a surrogate core damage source term (CDST) to evaluate the CDE for the NuScale SMR, based on severe accident scenarios. The CDST associated with the CDE is composed of key radiological release and transport parameters, derived from a range of accident scenarios that result in significant damage to the reactor core with subsequent release of appreciable quantities of fission products into the containment. The CDST is used as input to radiological consequence assessments. For additional information on the staffs evaluation of the CDE radiological consequence analysis methodology, including determination of the CDST, see the SER for TR-0915-17565.

DCA Part 2, Tier 2, Section 15.10 provides a description of the applicants CDE radiological consequence analysis, including the parameters for the CDST. The key parameters that describe the CDST release from the core to the containment are the magnitude of the release, 15-34

expressed as fraction of core radionuclide inventory, and the timing of the release. The core radionuclide inventory is in accordance with the methodology in TR-0915-17565. The CDST release timing and magnitude are derived from a spectrum of severe accident scenarios based on the NuScale SMR PRA. The CDST is developed based on five accident scenarios derived from intact-containment internal events in the Level 1 PRA. Each of the five surrogate scenarios involves various failures of the ECCS, with the decay heat removal system assumed available. NuScale used the MELCOR severe accident code to estimate the release timing and core release fractions for each of the five surrogate accident scenarios, which were then used to determine the CDST release timing and core release fractions using the methodology in the topical report. The parameters describing the CDST release from the core to the containment are given in DCA Part 2, Tier 2, Table 15.10-1, Core Damage Source Term Release Timing, and Table 15.10-2, Core Inventory Release Fractions.

One consideration that bears upon the assumptions on potential re-evolution of iodine removed from the containment atmosphere is the post-accident temperature-dependent pH (pHT) of the liquid inside containment. NuScale topical report TR-0915-17565, Revision 3, Section 4.4, Post-Accident pHT, describes the methodology used for evaluating post-accident pHT in coolant water following a significant core damage event that results in the CDST and to present a method to show compliance with the radiological consequence evaluation factors in 52.47(a)(2)(iv)(A) and 52.47(a)(2)(iv)(B) for offsite doses; PDC 19 for control room radiological habitability; and the requirements related to the technical support center in 10 CFR 52.47(b)(8) and (b)(11) and Paragraph IV.E.8 of Appendix E to 10 CFR Part 50. Section 4.4 of the topical report also includes a summary of acids and bases that are expected to enter the coolant and influence the pHT during a significant core damage event.

The staff also reviewed DCA Part 2, Tier 2, Section 15.10.1.8, which describes the calculation and results for the post-accident pHT for input to the topical report methodology to develop the CDST. The results of the applicants analyses show that the post-accident pHT inside the containment is between 6.0 and 7.0, and iodine re-evolution is not explicitly included in the CDST, in accordance with the methodology in TR-0915-17565. Therefore, the staff finds the assumption that iodine re-evolution in the containment is negligible for the CDST to be acceptable.

The applicants analysis of aerosol natural deposition in containment during the CDE used the methodology in NuScale topical report TR-0915-17565. The applicants analysis method calculates time-dependent airborne aerosol mass and removal rates within the NuScale SMR containment by modeling the effects of aerosol deposition by natural processes. The staff found that the applicants analysis used design-specific inputs consistent with the description of the plant in the NuScale SMR DCA Part 2, and the event-specific information in DCA Part 2, Tier 2, Section 15.10 to calculate the time-dependent aerosol removal rates listed in DCA Part 2, Tier 2, Table 15.10-3, Containment Aerosol Removal Rates. Because the applicant used the methodology in TR-0915-17565, along with design-specific inputs, to determine the aerosol removal rates used in the CDE radiological consequence analysis, the staff finds the modeling of aerosol natural deposition in containment to be acceptable.

The CDE radiological consequence analysis models releases to the environment through design basis containment leakage. However, the staff notes the potential for release through leakage from systems that transport containment atmosphere outside the containment postaccident to monitor hydrogen and oxygen in accordance with the requirements of 10 CFR 50.44(c)(4). While the COL applicant will submit a leakage control program associated with controlling leakage from these hydrogen and oxygen monitoring systems, consistent with COL 15-35

Item 9.3-1 and as required by 10 CFR 50.34(f)(2)(xxvi), , NuScale has not analyzed potential leakage from these systems in addressing the radiological consequences of the CDE, nor have they provided assurance that the system can be re-isolated in order to mitigate potential leakage from these systems. As discussed in Chapter 12 of the SER, the COL applicant is to provide assurance that post-accident leakage from these systems does not result in the total MCR dose exceeding the dose criterion (i.e. 5 rem TEDE) for the surrogate event with significant core damage and/or include design features in accordance with 10 CFR 50.34(f)(2)(xxvi) and 10 CFR 50.34(f)(2)(xxviii). In addition, the COL applicant will also provide information to verify, as appropriate, that post-accident leakage from these systems does not result in the total dose for the surrogate event with significant core damage exceeding the offsite dose criteria, as required by 10 CFR 52.47(a)(2)(iv)

The staffs review of the applicants analysis of the radiological consequences of the CDE determined that the analyses were performed using the methodology described in NuScale topical report TR-0915-17565, and the radiological consequences calculated by the applicant meet the relevant dose acceptance criteria. To verify the applicants assessment, the staff performed independent radiological consequence calculations for the CDE. The staffs analyses followed the guidance in RG 1.183 with consideration of the applicants topical report methodology and used the applicants assumptions on accident progression, fission product source terms and transport, and design reference atmospheric dispersion factors. The radiological consequences calculated by the staff are consistent with those calculated by the applicant and confirm that the doses calculated by the applicant are within the dose criteria given in NuScale SMR DSRS Section 15.0.3 for the LOCA, which includes events such as the CDE. Therefore, based upon its review of the DCA Part 2, implementation of the TR-0915-17565 methodology and its independent confirmatory analyses, the staff finds that the applicants analysis of the CDE is acceptable. Given that the COL applicant will be required to provide additional information with respect to the post-accident hydrogen and oxygen monitoring systems to ensure that the staff findings regarding compliance with 10 CFR 52.47(a)(2)(iv) are not changed, the staff finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the offsite radiological consequences of a postulated CDE will not exceed the dose criteria set forth in 10 CFR 52.47(a)(2).

The staff also finds that the NuScale SMR design, as bounded by the atmospheric relative concentrations proposed by the applicant, will provide reasonable assurance that the estimated doses in the MCR and TSC are less than 0.05 Sv (5 rem) TEDE for the postulated CDE. As noted above, the COL applicant will be required to provide additional information regarding how the requirements of 10 CFR 50.34(f)(2)(xxviii) are being met (see also Sections 6.4 and 12.3.4 of this SER). Therefore, with the exception of the requirements associated with 10 CFR 50.34(f)(2)(xxviii), the staff finds there is reasonable assurance that the radiological consequences in the MCR and TSC following a postulated CDE meet the dose criterion given in PDC 19 and the TSC habitability regulatory requirements, respectively.

The staff has reviewed the radiological consequences analyses of the design basis source terms and CDE described in DCA Part 2, Tier 2, Chapter 15, for the NuScale SMR design.

Based on the evaluation discussed above, the staff finds that the NuScale SMR design meets 10 CFR 52.47(a)(2)(iv) dose criteria and the accident-specific offsite dose acceptance criteria given in NuScale SMR DSRS Section 15.0.3. The CDE radiological consequence analysis does not include evaluation of the potential leakage from post-accident hydrogen and oxygen 15-36

monitoring systems. Therefore, the COL applicant will be required to provide additional information to ensure that the staff findings regarding compliance with 10 CFR 52.47(a)(2)(iv) are not changed.

Based on the evaluation discussed above and with the exception of the requirements associated with 10 CFR 50.34(f)(2)(xxviii), the staff finds reasonable assurance that the main control room habitability systems, as described in DCA Part 2, Tier 2, Sections 6.4 and 9.4.1, can mitigate the dose in the main control room following design basis events and the CDE to meet the dose criterion specified in PDC 19. The COL applicant will be required to provide additional information regarding how the requirements of 10 CFR 50.34(f)(2)(xxviii) are being met.

In addition, the staff finds reasonable assurance that the main control room habitability systems can mitigate the dose in the TSC following design basis events and the CDE to be within 0.05 Sv (5 rem) TEDE, to meet the TSC habitability requirements in Paragraph IV.E.8 of Appendix E to 10 CFR Part 50, and 10 CFR 50.47(b)(8) and (b)(11).

Safe, Stabilized Condition Safety analyses of DBEs are performed from event initiation until a safe, stabilized condition is reached. A safe, stabilized condition is reached when the initiating event is mitigated, the acceptance criteria are met, and system parameters (for example, inventory levels, temperatures, and pressures) are trending in the favorable direction.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this review.

DCA Part 2, Tier 2: In DCA Part 2, Tier 2, Section 15.0.4, the applicant stated, for events that involve a reactor trip, system parameters continue changing slowly as decay and residual heat are removed and the RCS continues to cool down.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: There are no technical specifications associated with this section.

Technical Reports: There are no technical reports associated with this section.

The applicant stated, and the staff agrees, that no operator action is required to reach or maintain a safe, stabilized condition within the first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> based on meeting each of the specific event Chapter 15 acceptance criteria and SECY-18-0099.

The staffs conclusions as to whether the events have been appropriately evaluated until a safe, stabilized condition is reached are contained in the following sections:

15-37

  • For conditions where shutdown is reached and maintained, the long-term decay and residual heat removal are discussed in Section 15.0.5 of this SER.
  • Conditions that lead to a return to power in the long term are discussed in Section 15.0.6 of this SER.

Long-Term Decay Heat and Residual Heat Removal Two systems perform the safety-related function of decay and residual heat removal from the NPM following a DBE. The DHRS, described in DCA Part 2, Tier 2, Section 5.4.3, provides decay and residual heat removal, while RCS inventory is retained inside the RPV. The ECCS, described in DCA Part 2, Tier 2, Section 6.3, is the other system and provides for decay heat and residual heat removal when either RCS inventory is lost or when EDSS power to the ECCS valves is lost and the IAB pressure differential threshold has been achieved. Depending on the initiating event and the availability of electrical power, there are four long term heat removal scenarios:

(1) DHRS; (2) DHRS with the RVVs and RRVs opening 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a loss of normal ac power; (3) DHRS with the RVVs and RRVs opening after a loss of normal ac and normal dc power when the IAB pressure threshold is reached; and (4) ECCS actuation following an inadvertent opening of an RCPB valve or a LOCA.

In the first scenario, the DHRS provides long term decay heat removal. DCA Part 2, Tier 2, Section 5.4.3 discusses the ability of the DHRS to remove residual and decay heat. The staffs evaluation of the DHRS, assuming subcriticality, is in Section 5.4.4.3 of the SER. As discussed in Section 15.0.6 of this SER if RPV water level drops below the riser following a reactor trip the reactor remains subcritical out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. If RPV water stays above the riser following a reactor trip a potential return to power is possible near end of cycle using design basis assumptions. A potential return to power, which would result in need to remove fission power in addition to decay and residual heat, is discussed in Section 15.0.6 of this SER.

The LTC scenarios 2 through 4 utilize the ECCS, either by itself or following successful initiation of the DHRS, and begin with ECCS valves opening. The ECCS valves open, either at the initiation of the design basis event (such as a LOCA) or as a result of a transition from DHRS heat removal during a non-LOCA event. The opening of the ECCS valves establishes recirculation flow between the RPV and containment. Technical Report (TR) TR-0916-51299, Long Term Cooling Methodology, Revision 1, provides the methodology and results Commented [A17]: Revision 2 is a Confirmatory Item.

demonstrating that LTC using ECCS is adequate to remove decay and residual heat after the The changed pages for the update to Revision 2 that RPV and containment pressures have approximately equalized in pressure, and stable flow the staff based its findings on are in ML19337B451.

through the RRVs is established. DCA Part 2, Tier 2, Sections 6.3 and 15.6.5 discuss the short term ability of the ECCS to remove residual and decay heat. Sections 6.3 and 15.6.5 of this SER provide the staffs evaluation of this capability. A return to power during long term ECCS cooling is possible near end of cycle using design basis assumptions as discussed in Section 15.0.6 of this SER.

15-38

The staffs evaluation in this SER section is for the non-LOCA events, which use either the DHRS for long term heat removal or transition to ECCS after the IAB setpoint is reached or the 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> timer activates the ECCS. LOCA, and the inadvertent operation of the ECCS, are addressed in Section 15.6.5.2 of this SER, as the event progression and physical phenomena for these events are very similar. A potential return to power following a DBE is outside the scope of NuScale TR-0916-51299. Section 15.0.6 of this SER presents the staffs evaluation of scenarios for the return of power.

DCA Part 2Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2 Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized as follows.

Depending on the availability of normal ac and EDSS dc power, LTC residual and decay heat removal can be accomplished by either (1) the DHRS, (2) a combination of the DHRS and ECCS, or (3) the ECCS alone. The NuScale technical report TR-0916-51299, Long-Term Cooling Methodology, provides the evaluation model and analyses supporting LTC following ECCS actuation. The LTC report addresses all DBEs that evolve to a configuration where operation of the ECCS is needed for LTC. For non-LOCA events, the applicant stated that the DHRS cooling transitions into the ECCS cooling mode when either the IAB valve blocking threshold pressure is reached during a loss of dc power or 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after a loss of ac power.

For LOCA or the inadvertent opening of a reactor coolant pressure boundary valve, the ECCS system alone provides long term decay and residual heat removal. The NPM remains in a safe, stable condition out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> without operator action. As stated in the LTC report, the figures of merit are that the collapsed liquid level (CLL) in the RPV remains above the top of the core, core temperatures remain high enough to prevent boron precipitation, and cladding temperatures remain acceptably low during LTC conditions. The applicant maintained that CHF is limiting during the short term LOCA and non-LOCA transient phase and maintaining an adequate low fuel cladding temperature is sufficient to demonstrate that the MCHFR limit is met in the long term. A condition assumed in the LTC report is that subcriticality is maintained and the only heat source is residual and decay heat.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: TR-0916-51299, Revision 1, Long-Term Cooling Methodology. Commented [A18]: Revision 2 is a confirmatory item.

The changed pages the staff based its finding on may be found at ML19337B451.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 34, states that a system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that SAFDLs and the design conditions of the RCPB are not exceeded.

transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal water reaction is limited to negligible amounts.

  • For LTC, 10 CFR 50.46(b)(5) requires that, after any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptably low value and decay heat shall be removed for the extended period required by the long-lived radioactivity remaining in the core.

The staff notes that the applicant provided the principal design criteria for GDC 34 and 35. PDC 34 and 35 proposed by NuScale are functionally identical to GDC 34 and 35, with the exception of the discussion related to electric power. A discussion of NuScales reliance on electric power and the related exemption to GDC 17 can be found in Chapter 8 of this SER, as well as the staffs evaluation of TR-0815-16497, Safety Classification of Passive Nuclear Power Plant Electrical Systems, issued January 2018 (ADAMS Accession No. ML17340A524).

The LTC report assumes that subcriticality is maintained to address 10 CFR 50.46(b)(5). Under some design basis scenarios, it is possible for extended cooldown events to cause the reactor to become recritical, as discussed in DCA Part 2, Tier 2, Section 15.0.6. The staffs evaluation of this event is in Section 15.0.6 of this SER. For the NuScale design, the ECCS system may be actuated either as a result of a LOCA or to provide long term cooling for non-LOCA events as discussed in Section 15.0.5.1 in this SER. The evaluation of long term cooling for LOCA events and inadvertent operation of an ECCS valve are described in Section 15.6.5.2 of this report. Long term cooling for all other non-LOCA events are discussed in this section of this SER.

Evaluation Model A detailed discussion on the adequacy of the NRELAP5 long term cooling model is discussed in Section 15.6.5.2.4.1 of this SER. The validation of the LTC EM, in part, is based on the NuScale Integral System Test Program, specifically two (NIST 1) facility tests, HP 19a and HP 19b. HP 19a is based on vacuum containment conditions, while HP 19b is at atmospheric containment conditions. As described in Section 15.6.5.2.4.1 of this SER, NRELAP5 LTC model predicted RPV and CNV pressures and levels compared acceptably well to the test data.

The purpose of the HP 19a and HP-19b tests were to simulate the spurious opening of an RVV without DHRS actuation. The applicant stated that tests HP-19a and HP-19b are applicable for non-LOCA events as a range of LOCA break sizes were evaluated, with and without DHRS actuation, and that small break LOCAs not including DHRS cooling have ECCS cooldown actuation conditions which are conservative compared to non-LOCA transients that assume DHRS cooldown and ECCS actuation at either the IAB setpoint or at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. For small break LOCA events without DHRS cooling, RPV pressure can return to near the initial value, lowering the collapsed liquid level (CLL). For larger break sizes without DHRS, the CLL is dominated by the loss of RPV mass to the CNV. Though the HP-19a and 19-b tests represent an inadvertent opening of an RVV, a LOCA like event, the staff finds these tests acceptable for non-LOCA transients as the ECCS cooling entry conditions are less limiting. The non-LOCA events initial ECCS cooling entry conditions are less limiting due to the heat removed by the DHRS and in the long term the both LOCA and non-LOCA initiating events reach similar temperatures and pressures.

15-40

The boron precipitation methodology, and the staffs acceptance, is documented in detail in Section 15.6.5.2.4.1 of this SER. The boron precipitation model is the same for both LOCA and non-LOCA events, the only differences being the event specific collapsed liquid level and minimum inlet temperature.

Input Parameters, Initial Conditions, and Assumptions The initial conditions evaluated in the LTC report cover the range of allowable NPM operation.

The specific values chosen are a function of which figure of merit is being evaluated. The major input items and their ranges are given below:

  • Decay heat ranges from zero to 120 percent of the 1973 decay heat standard
  • Pressurizer levels from 20 to 68 percent of span
  • Pool temperatures are between 18.3 and 98.9 degrees Celsius (°C) (65 and 210 degrees Fahrenheit (°F)
  • Pool levels are between 55 and 69 feet
  • RCS average temperatures are between 279 and 290 °C (535 and 555 °F)
  • A range of noncondensable gas mass
  • The ECCS capacity is between minimum and maximum The staff finds these input parameters, initial conditions and assumptions acceptable as they are either supported by the GTS (e.g., minimum pool temperature), MPS setpoints (containment isolation at 20 percent pressurizer level) or conservative assumptions consistent with those evaluated as part of the staffs Chapter 15 review such as ECCS capacity, RCS average temperature range.

Evaluation of Analysis Results The applicant evaluated a series of non-LOCA events and determined that events which reduce RPV inventory are limiting for non-LOCAs from a collapsed liquid level and boron precipitation standpoint. However, the applicant stated that the LOCA events were more limiting than non-LOCA events for all the acceptance criteria. The evaluation of the LOCA LTC events can be found in Section 15.6.5.2.4.3 of this SER. For the non-LOCA events, the applicant states that the limiting loss of inventory event was a 100% cross-sectional area SGTF with the loss of ac and dc power. The RPV inventory loss corresponds to the mass of water to the secondary MSIV. The applicant states that the loss of ac and dc power is limiting as ECCS actuates at a higher decay heat, increasing RPV pressure and lowering the collapsed liquid level. The lower collapsed liquid level also minimizes the margin to the boron precipitation solubility limit. The applicant states the 100% SGTF maintains the collapsed liquid level well above the active fuel and margin was maintained to the boron precipitation limit. The applicant also evaluated the margin to the boron precipitation limit out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> assuming an initial reactor power of 13 percent rated thermal power (RTP). The applicant determined the boron precipitation acceptance criteria was met for the lowest temperature conditions at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. As with the full power events analyzed, the LOCA injection line break initiated at 13 percent RTP had the minimum boron precipitation margin. The applicant also evaluated the maximum fuel temperature for the limiting non-LOCA events and determined the final cladding temperature 15-41

was below the initial clad temperature and that the LOCA cases in Section 15.6.5.2.4.3 of this SER bound the maximum cladding temperatures.

The staff agrees that the SGTF analysis with a loss of ac and dc power is the limiting non-LOCA event with regard to the lowest collapsed liquid inventory and minimum margin to the boron precipitation limit. The loss of ac power and the loss of ac and dc power results in the same RCS inventory loss as both initiate the DHRS isolating the secondary side. If ac power is retained, the NPM will stay on the intact DHRS train which is outside the scope of the LTC analysis. The staff agrees that the loss of ac and dc power is more limiting as ECCS actuation will occur when the IAB threshold is reached, yielding a higher pressure and lower collapsed liquid level. The staff reviewed the results of the other non-LOCA cases analyzed, such as a break outside of containment with the loss of ac power which isolates containment at the low-low pressurizer level setpoint of 20 percent, and found them not limiting relative to the acceptance criteria. The staff reviewed and agrees that the applicant selected event specific inputs to conservatively evaluate the respective acceptance criteria. The staff reviewed the 13 percent RTP case and agrees that the margin exists to the boron precipitation limit based on the collapsed liquid level and inlet temperature at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The applicant evaluated a single failure of one RVV and RRV to open. The staff agrees that this is an appropriate single failure assumption for the minimum level and maximum cladding temperature as it increases RPV pressure lowering the collapsed liquid level and minimizes heat transfer to the UHS. No single failure of the ECCS is taken for the minimum temperature as the purpose is to transfer the maximum heat to containment. The staff finds the single failures assumed by the applicant to be acceptable.

Therefore, the staff finds that: the top of active fuel remains covered, boron precipitation will not occur, and the maximum cladding temperature remains below the initial value for the limiting non-LOCA, SGTF event.

There are no COL information items associated with Section 15.0.5 of DCA Part 2, Tier 2.

Based on the staffs evaluation documented above, the staff concludes that PDCs 34 and 35 are met as is 50.46(b)(5) for the non-LOCA events because the top of active fuel remains covered, boron precipitation will not occur, and the maximum cladding temperature remains below the initial value for the limiting non-LOCA, SGTF event. The LOCA events leading to LTC and their acceptability are addressed in Section 15.6.5.2.4.3 of this evaluation.

Evaluation of a Return to Power As demonstrated in DCA Part 2, Tier 2, Chapter 15, the NuScale control rod design provides sufficient negativity reactivity to shut down the reactor shortly after a design basis event, assuming the worst stuck rod does not insert into the core. However, because of the design of the safety-related, passive heat removal systems, an NPM could cool down sufficiently to return to power within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> under certain conditions. Specific conditions include the highest worth control rod stuck out of the core, a sufficiently negative moderator temperature coefficient 15-42

typically associated with the later part of the operating cycle, and an unavailability of the non-safety-related means of adding boron.

The NuScale design has two safety-related passive heat removal systems, the decay heat removal system (DHRS) and the emergency core cooling system (ECCS). Depending on the event scenario, either system, or the combination of the two systems, assuming loss of the non-safety-related dc power (EDSS), is capable of removing residual heat sufficiently to cause a return to power, given conservative analysis assumptions. In a non-LOCA event, with dc power, the DHRS provides residual heat removal. A cooldown on the DHRS may lead to a return to power within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In a non-LOCA event with the loss of dc power, the DHRS initially removes decay heat, but RCS coolant discharges to containment when the IAB valve unblocking operating threshold has been reached. The exception to the DHRS providing residual heat removal during non-LOCA events is the inadvertent operation of the ECCS, which is classified as a non-LOCA event but behaves similar to a LOCA event. During a LOCA, once a valid ECCS setpoint has been met and the IAB setpoint has been reached, the ECCS provides heat removal throughout the event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

In DCA Part 2, Tier 2, Section 15.0.6, the applicant stated that for the NPM to return to power, specific circumstances, in combination with conservative analysis conditions, are needed. One of the most important circumstances is the assumption of a stuck rod because if all rods insert the NPM remains subcritical for both a DHRS cooldown and ECCS actuation. GDC 26, for AOOs, and GDC 27, for PAs, specify that a stuck control rod is to be assumed for both AOOs and PAs. With a stuck control rod, there is a set of conditions in which the reactor will return to power following many of the Chapter 15 design basis events. The applicant evaluated a range of time in life conditions between BOC and EOC. For the DHRS cooldown scenarios, which include maintaining single phase natural circulation and interrupted natural circulation where the water level drops below the riser elevation, EOC was determined to be limiting due to the maximum moderator reactivity feedback. Likewise, the applicant also determined that a return to power during an ECCS cooldown is limiting at EOC. During times in core life earlier than EOC, the applicant stated in DCA Part 2 Tier 2, Section 15.0.6, that dissolved boron in the reactor coolant will concentrate in the core due to boiling such that subcriticality is maintained.

In the three scenarios no credit is taken for operator action nor non-safety-related means of boron addition. Also, consistent with the Chapter 15 analyses, the three cooldown scenarios (single phase natural circulation DHRS cooldown, interrupted natural circulation DHRS cooldown, and ECCS cooldown) cover a time period out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, where lower decay heat and xenon concentration could cause a return to power. Reactor building pool temperatures were evaluated down to the lower Technical Specification value of 65 °F. The applicant used SIMULATE5 to determine the maximum return to power and applied a reactivity bias to the limiting case to account for the potential of a reactivity difference between the model and the actual core. For the two DHRS cooldowns, single phase and interrupted natural circulation, the applicant increased the heat transfer coefficients of both the steam generators and DHRS by 30 percent to maximize the cooldown and any potential return to power.

15-43

The applicant used NRELAP5 to calculate a series of average moderator temperature state points as a function of assumed core average power for each of the cooldown scenarios. The applicant used SIMULATE5 to determine a line of criticality as a function of average moderator temperature assuming no voids and no xenon. The intersection of the NRELAP5 and SIMULATE5 lines establishes the equilibrium return to power value. For cases with a critical power level greater than the decay heat, the applicant determined the CHFR margin using the Griffith-Zuber pool boiling correlation accounting for a skewed power distribution consistent with a stuck rod. To cover any transient power overshoot the applicant evaluated the CHFR margin assuming an average core power twice the equilibrium value.

The applicant determined that the maximum return to power was a cooldown using the ECCS assuming a 65 °F pool with an equilibrium power of approximately 1 percent rated thermal power (RTP); with the SIMULATE5 reactivity biased value, the return to power value was approximately 1.8 percent RTP. The applicant evaluated the two DHRS cooldowns, and determined that only when the riser remains covered (i.e., single phase natural circulation) is a return to power possible, and the resulting equilibrium power is less than the ECCS cooldown scenario. The applicant determined that the biased, ECCS cooldown case demonstrated substantial CHFR margin thereby preserving the SAFDLs.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

These General Design Criteria establish minimum requirements for the principal design criteria for water-cooled nuclear power plants similar in design and location to plants for which construction permits have been issued by the Commission. The General Design Criteria are also considered to be generally applicable to other types of nuclear power units and are intended to provide guidance in establishing the principal design criteria for such other units.

Because a return to power can occur following either an AOO or PA, the following GDC apply:

  • 10 CFR Part 50, Appendix A, GDC 27, relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.

15-44

  • GDC 35, requires the provision of a system to provide abundant emergency core cooling. The system safety function shall be to transfer heat from the reactor core following any loss of reactor coolant at a rate such that (1) fuel and clad damage that could interfere with continued effective core cooling is prevented and (2) clad metal-water reaction is limited to negligible amounts.

The staff notes that the applicant provided principal design criteria for GDC 34 and 35. The PDCs 34 and 35 proposed by NuScale are functionally identical to GDC 34 and 35, with the exception of the discussion related to electric power.

SECY-18-0099, NuScale Power Exemption Request from 10 CFR Part 50, Appendix A, General Design Criterion 27, Combined Reactivity Control Systems Capability (ADAMS Accession No. ML18065A431), dated October 24, 2018, also provides additional criteria or guidance in support of the SRP acceptance criteria related to this event.

Exemption from General Design Criteria 27 As part of the regulatory gap analysis performed during the preapplication interactions, the staff determined that reliably controlling reactivity in GDC 27 requires that the reactor be brought to a safe, stable, subcritical (shutdown) state following a PA. The staff notified NuScale of this determination in, Response to NuScale Gap Analysis Summary Report for Reactor Systems Reactivity Control System, Addressing Gap 11, General Design Criterion 27, dated September 8, 2016 (ADAMS Accession No. ML16116A083).

The introduction to 10 CFR Part 50, Appendix A, states, in part, the following:

[T]here may be water-cooled nuclear power units for which fulfillment of some of the General Design Criteria may not be necessary or appropriate. For plants such as these, departures from the General Design Criteria must be identified and justified.

Consistent with 10 CFR Part 50, Appendix A, and pursuant to 10 CFR 52.7, the applicant requested an exemption to GDC 27 in Part 7 of the DCA, Section 15, 10 CFR 50, Appendix A, Criterion 27, Combined Reactivity Control Systems Capability. The applicant requested an exemption from GDC 27 to the extent it has been implemented to require demonstration of long-term shutdown under post-accident conditions with an assumed worst rod stuck out. In lieu of meeting GDC 27, NuScale provided PDC 27, which contains some differences from GDC

27. The differences between GDC 27 and PDC 27 are discussed below.

Evaluation for Meeting the Exemption Criteria of 10 CFR 50.12, Specific Exemptions Pursuant to 10 CFR 52.7, the Commission may, upon application by any interested person or upon its own initiative, grant exemptions from the requirements of 10 CFR Part 52. As 10 CFR 52.7 further states, the Commissions consideration will be governed by 10 CFR 50.12, Specific exemptions, which states that an exemption may be granted when: (1) the exemptions are authorized by law, will not present an undue risk to the public health and safety, and are consistent with the common defense and security; and (2) special circumstances are present. Specifically, 10 CFR 50.12(a)(2) lists six special circumstances for which an exemption may be granted. It is necessary for one of these special circumstances to be present in order for the NRC to consider granting an exemption request.

15-45

Authorized by Law The NRC staff has determined that granting of the applicants proposed exemptions will not result in a violation of the Atomic Energy Act (AEA) of 1954, as amended, or the Commissions regulations because, as stated above, 10 CFR Part 52, allows the NRC to grant exemptions.

The staff also determined that granting the applicants proposed exemptions will not result in a violation of the AEA or the Commissions regulations. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the exemption is authorized by law.

No Undue Risk to Public Health and Safety In SECY-18-0099, the staff informed the Commission of the proposed review criteria to assess the acceptability of the requested exemption. The staff outlined the following three criteria to evaluate the exemption request:

(1) The design of the reactor must provide sufficient thermal margin such that a return to power does not result in the failure of the fuel cladding fission product barrier, as demonstrated by not exceeding SAFDLs for the analyzed events. The use of SAFDLs following a PA is an appropriate criterion to ensure that any return to power poses no undue risk to public health and safety.

(2) The combination of circumstances and conditions leading to an actual post-reactor-trip return to criticality is not expected to occur during the lifetime of a module. The criterion that a recriticality is not expected to occur during the lifetime of a module is consistent with NuScales classification of IEs and PAs (see Section 15.0.0.2.1, Classification by Event Frequency and Type, in the NuScale DCA, Revision 1, issued March 2018 (ADAMS Accession No. ML18086A187)).

(3) The incremental risk to public health and safety from the hypothesized return to criticality at a NuScale facility with multiple reactor modules does not adversely erode the margin between the Commissions goals for new reactor designs related to estimated frequencies of core damage or large releases and those calculated for the NuScale design.

In determining that the exemption to GDC 27 and the adequacy of PDC 27 do not present undue risk to public health and safety, the staff used the three criteria listed in SECY-18-0099.

The staff also determined that cold shutdown can be achieved with all control rods inserted and that the NPM design satisfies the GDC listed in Section 15.0.6.3, except for GDC 27.

The staff evaluated the NuScale design against the three criteria in SECY-18-0099 as described below:

(1) The design of the reactor must provide sufficient thermal margin such that a return to power does not result in the failure of the fuel cladding fission product barrier, as demonstrated by not exceeding SAFDLs for the analyzed events.

Evaluation: The staff review of this criterion appears in Section 15.0.6.4.4 of this report.

The staff concludes that this criterion is met. The staff reviewed NuScales calculation of the consequences of a return to power event and audited (ADAMS Accession No. ML19004A098) the underlying calculations, as described in the associated audit documentation, and confirmed that a return to power event would not exceed the SAFDLs for the most limiting condition at End of Cycle (EOC). The staffs detailed 15-46

evaluation of the consequences of a return to power event is in Sections 15.0.6.4.2 through 15.0.6.4.6 of this report. To preclude a situation where fuel damaged during a PA could be subject to return to power conditions, the staff confirmed that the SAFDLs are not exceeded for any design basis event consistent with SECY 18-0099, and that the SAFDL criteria is clearly specified in DCA Part 2, Tier 2, Tables 15.0-1 and 15.0-2 for all design basis events, as described in Section 15.0.0.2 of this report. The evaluation of the analytical results for the design basis events is in Sections 15.1 through 15.6 of this report.

(2) The combination of circumstances and conditions leading to an actual post-reactor-trip return to criticality is not expected to occur during the lifetime of a module.

Evaluation: As described in DCA Part 7, Section 15.2, Justification for Exemption, the applicant calculated the probability of a return to power to be less than 1X10-6 per reactor year. The combination of circumstances and conditions leading to a post-reactor-trip return to criticality, assuming a reactor trip frequency of one per reactor year, includes (1) failure of a control rod assembly to insert, (2) failure of the CVCS to insert soluble boron, and (3) the reactor being in a state that could result in a return to power. The staff determined that the applicant considered the appropriate combination of circumstances and conditions that may lead to a return to criticality, and the estimated failure probabilities are technically justified and generally conservative. The resulting probability of a return to criticality is very low, substantially below the probability of an event occurring within the lifetime of a reactor module, which is conservatively 1E-2 per reactor year, as described in DCA Part 2, Tier 2, Section 15.0.0.2.1.

(3) The incremental risk to public health and safety from the hypothesized return to criticality at a NuScale facility with multiple reactor modules does not adversely erode the margin between the Commissions goals for new reactor designs related to estimated frequencies of core damage or large releases and those calculated for the NuScale design.

Evaluation: The applicants PDC 27 ensures that the reactivity control systems are designed such that adequate core cooling will not be precluded and accident consequences will be maintained within acceptable limits. NuScales design basis implements PDC 27 in Chapter 15 to prohibit fuel failures under postulated accident conditions by specifying acceptance criteria in DCA Part 2, Tier 2, Tables 15.0-1 and 15.0-2 that fuel cladding integrity is maintained for all design basis events, including postulated accidents. As such, the effect of a postulated return to power with failed fuel was not evaluated in the analysis of accident consequences.

As described in DCA Part 2, Tier 2, Section 15.0.6, even in a return to power scenario, fuel damage does not occur because the resultant power level is limited, and the associated heat generated is within the capacity of the passive heat removal system.

Because the applicant demonstrated that the SAFDLs are preserved as described above, and because there are no challenges to any of the fission product barriers using conservative assumptions for the return to power scenario, the staff determined that incremental risk to public health and safety, related to estimated changes to core damage frequency (CDF) and large release frequency (LRF), is negligible with respect to the Commissions goals because, without additional postulated system or component failures, the scenario above does not lead to core damage in the probabilistic risk assessment.

15-47

The proposed exemption satisfies the review criteria outlined in SECY-18-0099 in that 1) the design of the reactor provides sufficient thermal margin as demonstrated by not exceeding SAFDLs for the analyzed events and a subsequent return to power, 2) the combination of circumstances and conditions leading to an actual post-reactor-trip return to criticality is not expected to occur during the lifetime of a module, and 3) the incremental risk to public health and safety from the hypothesized return to criticality at a NuScale facility with multiple reactor modules does not adversely erode the margin between the Commissions goals for new reactor designs related to estimated frequencies of core damage or large releases and those calculated for the NuScale design. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the exemption poses no undue risk to the public health and safety.

Consistent with Common Defense and Security The proposed exemption does not affect design, function, or operation of any structures or plant equipment that is necessary to maintain a secure plant status. In addition, the proposed exemption has no impact on plant security or safeguards procedures. Therefore, as required by 10 CFR 50.12(a)(1), the staff finds that the common defense and security is not impacted by this exemption.

Special Circumstances Special circumstances, in accordance with 10 CFR 50.12(a)(2)(ii), are present whenever application of the regulation in the particular circumstances would not serve the underlying purpose of the rule or is not necessary to achieve the underlying purpose of the rule. The underlying purpose of the requirement of GDC 27 is to bring the reactor core to a safe, stable condition following a postulated accident. The staff described its interpretation of the intent of GDC 27 in SECY-18-0099, stating:

The NRC staff interprets the language reliably controlling reactivity changes" in GDC 27 to mean that reactor power is being controlled and the reactor is being moved towards a desired safe state. Under this interpretation, GDC 27 not only requires that reactivity control systems support maintaining core cooling, but it also specifies the means of achieving this goal (i.e., by "reliably controlling reactivity changes") and allows the ECCS to support the longer term control of reactivity. The desired core state to minimize risk to public health and safety following a PA is safe shutdown (i.e., subcriticality) to ensure that core heat generation is maintained below the capabilities of decay heat removal systems.

The NRC staff described the prevailing view of a safe, stable condition as safe shutdown, which includes the reactor being subcritical, in SECY-94-084, "Policy and Technical Issues Associated with the Regulatory Treatment of NonSafety Systems in Passive Plant Designs," dated March 28, 1994 (ADAMS Accession No. ML003708068). The staff views the proposed NuScale design and safety analyses as proposing an alternative to the existing construct of the GDC and the related standard definition of safe, stable condition that would not depend on long-term subcriticality using only safety-related systems.

Therefore, the specification in GDC 27 to maintain core cooling supports the underlying purpose of the rule to bring the reactor core to a safe, stable condition. The specified requirement relative to the means of achieving this goal (through reliably controlling reactivity changes in order to achieve a long term subcritical condition) is part of the construct of the GDC, and while necessary to meet the GDC requirement, is not necessary to meet the underlying purpose of 15-48

the rule. The applicant has proposed an alternate approach to achieve the underlying purpose of the rule by controlling reactivity sufficiently that, in conjunction with precluding fuel damage during design basis events and providing sufficient heat removal capacity to remove both decay heat and critical reactor heat, the core can be brought to a safe and stable condition. As discussed in Section 15.0.0.2, the applicant precludes fuel damage by applying the SAFDLs as acceptance criteria for all design basis events.

The applicant stated in its exemption request that the inclusion of a stuck rod assumption for the NuScale design is not necessary, because the design would still meet the underlying purpose of the rule, since a return to power is inherently limited with adequate core cooling being maintained by passive safety systems.

As a result of the exemption request, as reflected in DCA Part 2, Tier 2, Section 3.1.3.8, the applicant conformed to the following PDC related to PA reactivity control capability, intended to reflect the underlying purpose of the rule:

The reactivity control systems shall be designed to have a combined capability of reliably controlling reactivity changes to assure that under postulated accident conditions and with appropriate margin for stuck rods the capability to cool the core is maintained. Following a postulated accident, the control rods shall be capable of holding the reactor core subcritical under cold conditions with all rods fully inserted.

The staff concluded that adequate core cooling is maintained for a return to power scenario, as described in Section 15.0.6.4.2-15.0.6.4.6, and also summarized above under the preceding criterion (No Undue Risk to Public Health and Safety). As described in SECY--18-0099, NuScales approach to meeting the requirement of reliably controlling reactivity changes differs in some respects from the NRCs historical approach in GDC-27. Therefore, the staff interprets reliably controlling reactivity changes in the context of PDC 27 differently than the traditional GDC 27 interpretation. For NuScales PDC 27, the staff interprets the term reliably controlling reactivity changes as (1) providing sufficient reactivity control to limit fission product to within the heat removal capacity of safety-related heat removal systems, and (2) to preclude fuel damage as a result of a design basis event, including a potential return to power.

The staff finds that the NuScale design meets the underlying purpose of GDC 27, and accepts the applicants justification for its alternative PDC 27 because PDC 27 reflects the underlying purpose of the rule that core cooling will be maintained following a postulated accident; and the staff has reviewed the analyses, which were performed consistent with the acceptance criteria specified in DCA Part 2, Tier 2, Tables 15.0-1 and 15.0-2, that demonstrate that the SAFDLs are met for all PAs.

The applicant states in its DCA Part 7 that special circumstances described in 10 CFR 50.12(a)(2)(iv) associated with benefits to public health and safety are present. However, as described in 10 CFR 50.12(a)(2), where the staff finds that special circumstances are present in accordance with 10 CFR 50.12(a)(2)(ii), a staff finding on whether special circumstances are present in accordance with 10 CFR 50.12(a)(2)(iv) is not necessary for the exemption to be granted. Because the staff finds that special circumstances are present in accordance with 10 CFR 50.12(a)(2)(ii), the staff makes no finding regarding the presence of special circumstances described in 10 CFR 50.12(a)(2)(iv).

Conclusion 15-49

For the reasons given above, as set forth in 10 CFR 50.12(a), the staff concludes that the proposed exemption requested in DCA Part 7, Section 15, regarding the requirement stated in GDC 27 is authorized by law, will not present an undue risk to the public health and safety, and is consistent with the common defense and security. Also, the special circumstances in 10 CFR 50.12(a)(2)(ii) are present, in that the application of GDC 27 in the particular circumstances is not necessary to achieve the underlying purpose of this rule. Therefore, the staff concludes that an exemption to the requirement of GDC 27 is approved.

Evaluation Model The applicant evaluated three scenarios as potential return to power cases - two DHRS cooldowns, and one ECCS cooldown. The DHRS cases were one in which the riser remains covered with liquid water, and a second in which the collapsed liquid level drops below the riser.

The ECCS cooldown could be achieved by either: (1) a valid MPS signal, (2) the IAB valve reaching the differential pressure unblocking threshold or (3) a loss of AC power followed by the EDSS 24-hour timer expiring resulting in an ECCS actuation. The method the applicant used to the determine the potential equilibrium return to power uses a combination of the NRELAP5 version 1.4 long term cooling model, SIMULATE5 and a hand calculation of the MCHFR. The applicant performed all evaluations at EOC conditions. A discussion addressing non-EOC conditions, in which soluble boron may be present, is discussed in Section 15.0.6.4.4 of this report.

The applicant ran a series of NRELAP5 cases with a constant core average power for each of the cooldown scenarios. For a given pool temperature, this generates a series of NRELAP5 average moderator temperature verses power points. For a range of assumed inlet temperatures, flow rates and moderator densities, the applicant used SIMULATE5 to iterate on the core power until keff equals 1 for each input condition. The applicant derived a single SIMULATE5 line criticality verses average moderator temperature, for a fixed density factor, using the NRELAP5 power verse flow rate curve for the single-phase natural circulation DHRS cooldown. The intersection of the NRELAP5 average moderator temperature verse constant power points and SIMULATE5 criticality line determines the core equilibrium power.

Once the limiting case equilibrium core power has been determined, the applicant increased the average core power to account for any transient effects. Because of the skewed power distribution, the applicant increased the local power consistent with the worst stuck rod remaining outside the core. From the resultant peaked power distribution, the applicant determined the MCHR by a hand calculation using the Griffith-Zuber pool boiling correlation.

The staff reviewed the overall method, which uses a combination of the long term cooling NRELAP5 model, providing only thermal-hydraulic conditions (e.g., average moderator temperature for a constant core power, reactor flow verse power, etc.), and SIMULATE5 to capture the reactivity components, such as moderator and Doppler feedback and rod worths.

This methodology removes the use of point kinetics in NRELAP5 and simplifies the model to solve a steady-state heat balance problem, reducing the potential of non-physical flow oscillations caused using a control volume method and a 1-D modeling assumption. The staff agrees that using the single channel, long term cooling model as described in Section 15.0.5, Long term Cooling, to obtain average moderator temperature vs core power, in steady-state conditions is acceptable.

As discussed in DCA Section 4.3, the applicant used SIMULATE5 to determine reactivity coefficients and rod worth from cold to HFP conditions. The staff documented its approval for 15-50

the applicant to use SIMULATE5 for static keff calculations documented in the Nuclear Codes and Methods, topical report TR-0616-48793-A, Revision 1 (ADAMS Accession No. ML18348B036). Therefore, the staff finds it acceptable to use SIMULATE5 to determine the line(s) of criticality as function of average moderator temperature and core power.

This methodology lacks the ability to capture any transient effects, such as a power overshoot, before the equilibrium power is reached. To account for a transient power overshoot, the applicant multiplied the local peak power by 2 as part of the MCHFR determination. The staff finds this acceptable as the return to power is conservatively determined to occur around 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after the initiating event for the limiting ECCS cooldown. The 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is based on a staff conservative confirmatory calculation in which the rod worths are were decreased, the reactivity feedback increased, and the pool temperature was maintained at approximately 65 °F. The applicant analysis showed the point of re-criticality to be after 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The staff considers that a return to power after 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is consistent with the transient progression, as the cooldown needs to progress to the point where the shutdown margin and the negative reactivity caused by increasing xenon concentration is overcome. The decay heat generation rate at 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> is relatively stable and most of the sensible heat from reactor coolant system has already been transferred to the UHS. The staffs confirmatory EOC, reactivity biased, core power verse time behavior demonstrated no power overshoot. Due to the slow nature of the return to power event, the staff finds that increasing the local power by a factor of two is adequate to address the potential transient power overshoot.

The applicant used the Griffith-Zuber pool boiling correlation to determine the MCHR. The staff finds use of the Griffith-Zuber pool boiling correlation acceptable as some RCS flow will exist either due to boil-off, manometer effect or internal re-circulation flows, especially in the hot channel.

Based the above considerations, the staffs finds the return to power methodology acceptable.

Input Parameters and Initial Conditions The applicant assumes a single control rod fails to insert into the core, leading to the return to power scenarios evaluated. The staff considers that limiting the long term return to power evaluation to a single control rod stuck out of the core is acceptable for the NuScale design, and that the initiating events evaluated for the long term return to power are appropriate. The staff concludes that the control rod ejection accident evaluated in 15.4.8, assumed to initiate from a housing failure, need not be evaluated in the long term for the NuScale design. In the control rod ejection analysis evaluated by the staff in Section 15.4.8 of this report, the applicant assumed one control rod is ejected from the core, and another control rod fails to insert during the scram. This event is evaluated for the short term reactivity response only, consistent with the requirement in GDC 28 to appropriately limit the rate of reactivity increases associated with certain postulated reactivity accidents, including rod ejection. The staff determined that the provisions in GDC 27 for evaluating DBAs from a mechanistic perspective in the long term are met for the NuScale design in that the control rod ejection accident need not be considered in the long term due to the robust design of the control rod drive housings. The staff evaluated the control rod housing design in Section 3.9.4 of this report. Because the robust design of the control rod drive housings significantly reduces the potential of a rod ejection event, the staff considered the reactivity associated with one ejected rod and one stuck rod as a means to assess the short term reactivity margin provided by the core design and not as a credible condition for long term cooling. Therefore, the staff finds that the inclusion of the assumption of a single rod stuck out of the core for the return to power analysis is acceptable.

15-51

The EOC return to power is driven by the reactivity worth of the control rods and feedback terms and the UHS temperature. For the NRELAP5 constant power cases, lowering the average moderator temperature as function of a given reactor power yields a higher potential return to power value. To maximize the heat removed from the UHS, the applicant set reactor building pool level slightly above the technical specification maximum level and maintained the temperature constant at the lower limit. The applicant also performed sensitivity analyses with UHS temperatures of 100 and 140 deg-F to determine return to power sensitivities and ensure results behaved as expected.

For SIMULATE5 cases which create the criticality line, the primary conservatisms are the input reactivity bias and the use of a (( )) moderator density multiplier. The use of a (( )) density multiplier means the (( )) from SIMULATE5 are used during the power search.

The reactivity bias of (( )) boron forces a higher initial (per iteration) keff thereby yielding a higher power when the iteration is complete (keff=1). A (( )) bias shifts the SIMULATE5 criticality curve up yielding a higher equilibrium power. The applicant only applied the reactivity bias to the best estimate, maximum return to power case.

The remainder of the SIMULATE5 reactivity terms, including the worth of the worst stuck rod, were calculated implicitly by the code except for xenon, which was set a zero-concentration corresponding to the 72-hour period.

For the MCHFR determination, the local heat flux is multiplied by 2 to cover any transient effects before the equilibrium conditions are achieved. The staff finds the use of the factor of 2 conservative due to the slow nature of the return to power event and, as explained in Section 15.0.6.4.2 of this report, finds this input acceptable.

The major conservatisms in the inputs are the assumption of using a SIMULATE5 density multiplier of (( )), and using the NRELAP5 core power to flowrate corresponding to the covered DHRS cooldown. A return to power event would produce localized boiling in the core and increase the core void fraction resulting in the addition of negative reactivity. The NRELAP5 void fraction is approximately 3 percent, with core exit void fractions around 20 percent. Therefore, the staff finds using a moderator density of (( )), (( )),

conservative and acceptable. The covered DHRS cooldown flow rate is higher than the boil-off ECCS scenario rate flow effectively increasing limiting ECCS return to power value.

The staff also agrees that using the (( )) boron reactivity bias is adequate when considering the flow rate bias and the effect of an additional 8-10 days of burnup would have on the Doppler feedback. No adjustment is needed to account for the moderator feedback, as 5 ppm of soluble boron is used in all cases.

Results For the return to power event, the acceptance criteria of maximum RPV pressure, maximum SG pressure, and SAFDLs consistent with an AOO are evaluated. Maximum RPV pressure and maximum SG pressure are not challenged during a return to power event as the maximum return to power is approximately 2-percent rated thermal power (RTP). At 2 percent RTP, the RPV and SG pressures are well below the initial HFP values. Of the SAFDLs such as centerline temperature, clad strain, rod internal pressure, and MCHFR, the applicant maintained that only MCHFR is possibly challenged. Based on its independent confirmatory analysis, the staff agrees that SAFDLs other than the MCHFR are not challenged during the return to power event.

15-52

The staff noted that the applicants calculated best estimate return to power for the ECCS cooldown was approximately 1 percent RTP and the covered DHRS value was 0.5 percent RTP. For the DHRS cooldown, in which the water level drops below the riser, the staff noted that the applicants calculations show the reactor remains subcritical. The applicant added the

(( )) reactivity uncertainty, which yielded a limiting ECCS return to power of approximately 1.8 percent RTP.

The applicant then applied the 2x multiplier factor on heat flux to account for any transient behavior on the peaked power distribution due to the stuck rod and used the (( ))

pool boiling correlation, which yielded a MCHFR margin over 4.

The staff performed a TRACE confirmatory analysis which biased lower the control rod worth and increased the EOC reactivity coefficients while maintaining an approximate 65 °F pool. The staff calculated average return to power was approximately 1 percent RTP and no power overshoot was noted.

The staff reviewed the applicants justification (ML19332A120) that core reactivity would not be adversely affected by boron redistribution to places outside the core, and therefore, would not return to power, ensuring the EOC evaluation remained bounding. The applicant evaluated boron loss from the core through a series of physical phenomena, including boron loss to containment during the blowdown, boron volatilized and plated-out on surfaces outside the core during long term cooling, and the potential for the development of a boron concentration gradient within the core/riser causing a potential recriticality. The staff reviewed the applicants

(( )) control volume model that uses thermal-hydraulic input provided by NRELAP5.

The applicant assumed that boron loss to entrainment and flashing during the blow down is prematurely lost to containment until (( )), as well as the potential for significant boron trapped in the riser. The staff agrees that the assumption of the boron loss during blow down up (( )) is acceptable and appropriate. The applicant also assumed that the mass of boron in the downcomer and lower plenum that is not initially lost during the blowdown remains trapped within in the downcomer and lower plenum and is not available to enter the core region throughout the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period, which the staff considers to be conservative. The applicant noted that this mass of boron accounts for 30 percent of the total mass and is a significant conservatism in determining the final core boron concentration. The staff notes that the incoming recirculation flow from the RRVs would likely entrain much of the boron in the downcomer and transport it to the core region. Therefore, staff agrees that removing the mass of boron in the downcomer and lower plenum from the problem is a significant conservatism in the overall methodology.

Regarding mixing between the core and riser, the applicant uses (( )).

The applicant states that boron concentration will predominately increase in the core due to boiling, and sufficient mixing in the core/riser exists such that a significant amount of boron will not be permanently held up in the riser. The applicant states that sufficient two and single-phase buoyant mixing between the core and riser exists and, if large boron concentration gradients were to occur, that liquid density differences would reduce the boron gradient. The applicant evaluated the core/riser mixing issue using a simplified, (( ))

heat balance evaluation and a potential in core boron gradient using the VEERA boric acid mixing test data. The applicant solved a one dimensional, 3-node heat balance, riser/core mixing model for a range of core exit flow qualities. For high core exit flow qualities significant riser/core mixing is expected due to two-phase mixing. For low core exit qualities (e.g., zero) internal flow recirculation rates would have to be high indicating sufficiently high riser/core In 15-53

either case, the applicant argues, and the staff agrees, significant mixing would occur to reduce or eliminate an adverse core boron concentration gradient.

The applicant used the VEERA test data to justify the boron distribution will be axially well mixed. The VEERA tests were run to determine if boron precipitation could occur in a VVER-440 fuel assembly bundle for a LOCA during the long-term cooling phase. The VEERA tests demonstrated that core boron concentration was axially well mixed for a low decay heat with the inlet flow rate equal to the boil-off rate. The VEERA axial mixing is attributed to buoyant mixing, as the REWET-II, with a significantly smaller diameter, did not show the same well mixed behavior. The applicant noted that the NuScale core is more than 8 times larger than that of the VEERA facility and hence should be at least as well mixed. This buoyant mixing promotes core/riser boron exchange and the within core boron concentration distribution. In addition to buoyant mixing, two-phase mixing due to boiling will promote a uniform, within core boron distribution. The applicant calculated the NPM core elevation where the onset of saturated boiling occurs for the cold ECCS conditions at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. Above this point the boiling is sufficient to ensure a uniform boron concentration as demonstrated by the test data (i.e., middle and top measurement points). Below the saturated boiling core height, the applicant assumed (( ))

was present, above a conservative uniform boron concentration was assumed. The staff audited (ADAMS Accession No. ML19004A098) the applicants NPM analysis, which showed that the core remains subcritical assuming a (( )) concentration up to the point where uniform mixing would occur and the keff was below that calculated assuming the homogenized core/riser boron concentration. The staff finds that assuming a (( )) concentration is conservative, as the VEERA tests showed some core to lower plenum mixing occurs due to the manometer effect which will also occur to some degree in the NPM, some recirculation is expected through the reflector cooling channels and some mixing is expected due to nucleate boiling and single-phase convection below the core saturation elevation.

The staff agrees that the VEERA data demonstrates there will be adequate mixing and a uniform core boron concentrations exists above the point of saturated boiling. The staff notes that VEERA test data demonstrates good mixing independent of boron concentrations up to the point of boron precipitation indicating thermal-hydraulic mixing is the dominate factor in establishing a uniform boron concentration. To further examine the core/riser mixing, the staff audited (ML19004A098) NIST-1 long term cooling test data from tests HP-19a, 19b, and 43 to determine if sufficient voiding exists that two-phase mixing would promote riser and core fluid exchange. Staff examination of the NIST-1 data indicated that the amount of two-phase mixing in the riser would promote sufficient core and riser fluid exchange to prevent a significant boron gradient. The staff also notes that riser/core and within core temperature differences will exist (e.g., across the riser/downcomer and between high and low power assemblies) to further aid flow recirculation and lessen any potential boron concentration gradient. While there may be an axial boron concentration gradient between the riser and core which is not addressed by the applicants (( )), the staff finds there is reasonable assurance that core and riser mixing will be sufficient such that the final core boron concentration out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> will be greater than the initial concentration given the conservatisms in the overall evaluation model, the primary of which is the isolation of the downcomer boron concentration.

The staff reviewed the applicants method to calculate the boron potentially lost due to plate out on the surfaces of the NPM during the long term cooling period. The staff notes that this mechanism is not a major contributor to boron loss early in the period (first 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />), but becomes more important as time progresses. The staff evaluated the applicants use of the 15-54

Bhlke correlation5 to determine the volatility of the boric acid in the NuScale design and audited (ML19004A098) calculations supporting the submitted information (ML19332A120).

The Bhlke correlation includes terms in the correlation to account for varying pH, concentration, species (sodium pentaborate or boric acid), temperature and void fraction. The applicant also applied a factor to account for uncertainty in the correlation, which the staff reviewed and agrees is suitably conservative based on the staffs review of the experimental data supporting the correlation.

The staff evaluated NuScales information supporting applicability of the correlation and agrees that the expected operating conditions of the module are within the ranges of applicability of the Bhlke correlation. As part of this determination, the staff reviewed NuScales comparison of the NuScale design to the BORANalysis (BORAN) test facility at the Technische Universitt Dresden that produced some of the data that the Bhlke correlation was developed from and agrees that the designs are sufficiently similar for the aspects that impact the key parameters important to volatility. Further, the staff reviewed the applicants comparison of the Bhlke predictions of volatility compared to existing test data from a variety of other volatility studies (ML19332A120) and agrees that the comparison shows good agreement between the Bhlke predictions and the measured data, with the exception of the low temperature range of two specific sets of data, which are dispositioned as representing theoretical maximum volatility rates at fully equilibrium conditions. In contrast, at low temperatures, the NPM is not expected to approach equilibrium conditions. The staff agrees, based on its review of the test data and the test setups, and the applicable NPM operating conditions, that these two sets of data need not be bounded for the correlation to be conservative for the NuScale design since the portions of data that the correlation does not bound are not relevant to the NPM operating conditions.

The staff also considered information from the REWET-II tests and audited (ML19004A098) engineering documents the applicant made available to evaluate the calculation of volatility from measured data from those tests, as well as reviewed the applicants justification (ML19332A120) that the Bhlke correlation is appropriate considering the data from these tests. The staff agrees that the Bhlke correlation predicted value would be reasonably similar to the measured data, even though the REWET-II BOR008 test included concentrations well above the range of applicability of the Bhlke correlation, or the conditions expected in the NuScale module.

The applicant also conducted an additional margins assessment to consider a higher level of uncertainty in the volatility rate and determined that a significantly higher volatility could be tolerated during the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period, and the final boron concentration in the RCS would still not drop below the initial boron concentration. The staff also noted that the applicant made the very conservative assumption that all of the volatized boron would remain plated out and none would redissolve in the coolant. Further, as described earlier in this section, the applicant also artificially isolated a significant amount of boron in the downcomer that is approximately 5 times greater than the total mass of boron lost to volatility over a 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> period. The staff considers these assumptions to be more conservative than the typical conservatisms required by Chapter 15, and these additional measures of conservatism also provide the staff with reasonable assurance that the calculation as a whole is conservative. Based on its review described above, the staff finds the use of the Bhlke correlation, with the uncertainty factor applied by the 5

Steffen Bhlke, Christoph Schuster, and Antonio Hurtado, About the Volatility of Boron in Aqueous Solutions of Borates with Vapour in Relevance to BWR-Reactors, International Conference on the Physics of Reactors, Nuclear Power: A Sustainable Resource, Interlaken, Switzerland, September 14-19, 2008.

15-55

applicant, to calculate boron volatility for the NuScale design conservative, and therefore acceptable.

Based on the staffs review, the staff finds that the boron redistribution methodology, which does not account for transport to the core of any downcomer boron mass, nor any volatilized boron returning to the core (e.g., rewetting), nor any dissolved boron transported to containment below the RRVs returning to the core, is acceptable; and, boron will preferentially accumulate in the core and riser due to boiling. Therefore, the staff agrees that the average boron concentration in the core will increase during the 72 hour8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> time period and the core will remain subcritical. As such, a return to power is only considered for EOC conditions (very low to no soluble boron).

The staff finds that no single failures that adversely affect the return to power scenarios have been identified. The return to power will happen well after the reactor trip, and only the DHRS and ECCS are used to mitigate the event. The consequences of a return to power on the DHRS are maximized when both trains are in service, and any degradation of the DHRS would minimize the return to power. The consequences of a DHRS cooldown coincident with actuation of the ECCS are maximized if all ECCS valves discharge into containment.

Therefore, a single failure of an ECCS valve failing to open would be less limiting to the MCHFR. The consequences of a cooldown on the ECCS are also more limiting, assuming all ECCS valves are open, which would maximize the heat transfer from the CNV to the reactor building pool.

Barrier Performance The applicant concluded, and the NRC staff agrees, that the pressure in the RPV and main steam systems is maintained below 110 percent of the design values for this event. The staff agrees that the limiting return to power condition is EOC and the MCHFR remains above the limit ensuring the SAFDLS are met.

Radiological Consequences Based on maintaining the radiological barriers, the staff concluded there are no radiological consequences associated with this event.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.0.6.

Based on the staffs evaluation documented above, the staff concludes that that GDC 10, GDC 15, and NuScale specific PDC 35 are met. Likewise, the staff concludes the criteria as specified in SECY-18-0099 are met and the exemption to GDC 27 is granted.

15.1 Increase in Heat Removal by the Secondary System Decrease in Feedwater Temperature The staff reviewed DCA Part 2, Tier 2, Section 15.1.1, Decrease in Feedwater Temperature, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in 15-56

Section 15.1.1.3 of this SER. A decrease in feedwater temperature is an AOO that causes an increase in heat transfer from the primary to the secondary system. The negative MTC and the cooldown of the RCS cause an increase in core reactivity. Automatic control rod motion to maintain RCS temperature also adds positive reactivity. As a result, core power increases, and the MCHFR decreases. Continued overcooling leads to a reactor trip and subsequent actuation of the DHRS.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided information in DCA Part 2, Tier 2, Section 15.1.1, summarized below.

A decrease in feedwater temperature may result from a failure in the feedwater system (FWS).

The increase in heat transfer from the primary to the secondary system causes a reduction in RCS temperature, leading to positive reactivity insertion from the negative MTC and from the control rods attempting to maintain a programmed RCS temperature. As core power increases, the core outlet temperature also increases, leading to almost simultaneous reactor trip signals on high core power and high RCS hot-leg temperature for the limiting case. Secondary system isolation (SSI) and DHRS actuation isolate feedwater, ending the cooldown, and transition the NPM to a stable condition.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to obtain the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did not credit operator action and stated that no single failure produces a more limiting result for MCHFR.

The applicant concluded that the MCHFR remains above the 95/95 analysis limit for the NSP4 CHF correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the pressures described in DCA Part 2, Tier 2, Section 15.2, Decrease in Heat Removal by the Secondary Side.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of 15-57

appropriate controls to maintain these variables and systems within prescribed operating ranges.

  • 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so that the pressure boundary is not breached during normal operations, including AOOs.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so that SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Sections 15.1.1 through 15.1.4 list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • The most limiting moderate-frequency initiating events that result in increased heat removal are identified.
  • For the most limiting initiating events, it is verified that the plant responds to the transients in such a way that the criteria for fuel damage and system pressure are met.
  • Fuel cladding integrity shall be maintained by ensuring that the minimum departure from nucleate boiling ratio (DNBR) remains above the 95/95 DNBR based on acceptable correlations (see DSRS Section 4.4, Thermal and Hydraulic Design).
  • An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.
  • The guidance provided in RG 1.105, Setpoints for Safety-Related Instrumentation, can be used to analyze the effect of instrument spans and setpoints on the plant response to the type of transient addressed in DSRS Sections 15.1.1 through 15.1.4, to meet the requirements of GDC 10, 13, 15, 20, and 26.
  • The most limiting plant systems single failure, as defined in Definitions and Explanations, in 10 CFR Part 50, Appendix A, shall be identified and assumed in the analysis and shall satisfy the positions of RG 1.53, Application of the Single-Failure Criterion to Nuclear Power Plant Protection Systems.
  • The applicants analysis of transients caused by excessive heat removal should be performed using an acceptable analytical model and approved methodologies and computer codes. The values of the parameters used in the analytical model should be suitably conservative.

15-58

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to analyze the thermal-hydraulic response to the event. In addition, the applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER describes the staffs evaluation of these codes.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant modeled the decrease in feedwater temperature as a linear decrease from the initial biased-low temperature of 143 °C (290 °F) to the minimum feedwater temperature of 37.8 °C (100 °F). The applicant conducted a sensitivity study to identify the limiting rate of temperature decrease by varying the length of time over which the temperature decreases and found that the limiting MCHFR occurs when the decrease occurs over 86 seconds, or a rate of about 1.2 °C (2.2 °F) per second. The staff finds this modeling approach acceptable because it considers an acceptable range of temperature decrease rates, and the applicant uses the limiting cooldown rate in conjunction with limiting initial conditions in the limiting event analysis.

The staff reviewed the initial parameter values and biases to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and limiting reactivity feedback. The EOC reactivity feedback is acceptable because it maximizes the core power response and results in a more limiting MCHFR. In addition, the RCS initial conditions are consistent with the most challenging conditions for MCHFR established in TR-0915-17564-A, Revision 2, Subchannel Analysis Methodology (ADAMS Accession No. ML19067A256).

The applicant credited several MPS signals for a decrease in feedwater temperature event. For the limiting event, the high hot-leg temperature signal is reached first, but the high core power signal trips the reactor during the eight-second delay associated with the high hot-leg temperature MPS signal. The high hot-leg temperature signal actuates SSI and DHRS. The applicant added a 5-percent uncertainty to the high core power setpoint to account for the temperature decalibration effect because of cooler, denser water in the downcomer affecting ex-core detector signals. The staff notes that the 5-percent uncertainty appears conservative based on an assumed 0.9 percent per °C (0.5 percent per °F) decalibration rate and an approximately 5 °C (9 °F) decrease in downcomer temperature for limiting cooldown event in terms of MCHFR (the decrease in feedwater temperature event) and is therefore acceptable.

The staff notes that technical report TR-0616-49121, Revision 2, NuScale Instrument Setpoint Methodology Technical Report (ADAMS Accession No. ML19136A411), describes how the applicants setpoints conform to RG 1.105. The staffs review of TR-0616-49121 is in Chapter 7, Instrumentation and Controls, of this SER.

The applicant did not credit operator action to mitigate the decrease in feedwater temperature event. The applicant assumed that the rod control system operates as designed, which the staff 15-59

notes is conservative because it acts to withdraw control rods when the RCS temperature drops, inserting positive reactivity. The feedwater controls are conservatively disabled to provide a constant feedwater flow rate rather than the normal response of reducing feedwater flow.

The applicant did not assume a loss of power in the limiting event analysis. The staff notes that loss of ac power would trip the feedwater pumps, terminating the cooldown event, and therefore agrees that assuming a loss of power would not be limiting. The applicant also stated that no single failure causes a more limiting MCHFR. Although a single failure of a main steam isolation valve (MSIV) or a feedwater isolation valve (FWIV) may contribute to overcooling of the RCS, the staff notes that these valves close after a valid SSI signal. MCHFR occurs before SSI, so failure of an MSIV or FWIV to close would not produce more limiting results for MCHFR.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results, as discussed in the associated audit documentation (ADAMS Accession Nos.

ML19270G302 and ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for MCHFR.

As discussed in DCA Part 2, Tier 2, Section 15.1, Increase in Heat Removal by the Secondary System, the applicant did not apply sensitivities to maximize RCS or SG pressure for this event category because cooldown events do not significantly challenge system pressures. Rather, the applicant reported the maximum system pressures calculated when analyzing sensitivities for MCHFR. In addition, the applicant stated that the pressure responses for cooldown events are less severe than those of AOOs in DCA Part 2, Tier 2, Section 15.2, Decrease in Heat Removal by the Secondary Side. The staff agrees that the cooldown events analyzed in the DCA are not limiting with respect to system pressures. For example, the decrease in feedwater temperature event results in initial depressurization, with a relatively slow and small RCS pressurization just before the reactor trip that is bounded by the DCA Part 2, Tier 2, Section 15.2, events. The SG pressure for the decrease in feedwater temperature event increases rapidly following DHRS actuation, though the peak pressure remains below that of the limiting event in DCA Part 2, Tier 2, Section 15.2. Because of the margin to the acceptance criteria, especially for SG pressure, and the bounding nature of the inherently pressurizing DCA Part 2, Tier 2, Section 15.2 events, the staff finds the applicants treatment and calculation of maximum RCS and SG pressures for DCA Part 2, Tier 2, Section 15.1, events acceptable.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.1, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the decrease in feedwater temperature event and finds that it is consistent with the event description and assumptions about protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the events do not lead to a more serious plant condition.

DCA Part 2, Tier 2, Table 15.1-3, presents the limiting analysis results for this event. The applicant calculated maximum RCS and SG pressures of 2,005 psia and 1,541 psia, respectively. Although the applicant did not perform sensitivities to maximize system pressures, 15-60

for the reasons discussed in Section 15.1.1.4.2 of this SER, the staff has reasonable assurance that the RCS and SG pressures will remain below 110 percent of the design values (2,310 psia) even if maximized for this event. The limiting MCHFR for this event, 1.847, is the lowest MCHFR of all cooldown events analyzed in the DCA and remains above the 95/95 limit described in the DSRS.

By demonstrating that the DSRS AOO acceptance criteria are met for the most limiting decrease in feedwater temperature scenario, the applicant satisfied the requirements associated with GDC 10, 13, 15, 20, and 26 for this transient.

There are no COL information items associated with Section 15.1.1 of DCA Part 2, Tier 2.

The staff reviewed the decrease in feedwater temperature event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. The staff concludes that the applicants analysis of this event is acceptable and meets the requirements of GDC 10, 13, 15, 20, and 26 with respect to this event because it satisfies the acceptance criteria in the DSRS.

Increase in Feedwater Flow The staff reviewed DCA Part 2, Tier 2, Section 15.1.2, Increase in Feedwater Flow, to ensure that the event was analyzed appropriately and meets the acceptance criteria discussed in Section 15.1.2.3 of this SER. An increase in feedwater flow causes an increase in heat transfer from the primary to the secondary system. The negative MTC, the cooldown of the RCS, and the automatic control rod withdrawal to maintain RCS temperature cause an increase in core reactivity. Reactor power increases, while MCHFR decreases. Continued overcooling leads to a reactor trip and subsequent SSI and actuation of the DHRS.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided information in DCA Part 2, Tier 2, Section 15.1.2, summarized below.

An increase in feedwater flow may result from a failure in the FWS. The increased heat transfer from the primary to the secondary system reduces RCS temperature, leading to positive reactivity insertion from the negative MTC and from the automatic control rod withdrawal attempting to maintain a programmed RCS temperature. Core power increases and MCHFR decreases until the reactor trips on one of several MPS signals. SSI isolates feedwater and ends the overcooling event. The high RCS hot temperature or high main steam pressure MPS signal actuates DHRS, which transitions the NPM to a stable condition.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did 15-61

not credit operator action and stated that no single failure produces a more limiting result for MCHFR. The applicant considered a single failure of an FWIV to investigate possible SG overfill scenarios.

The applicant concluded that the limiting increase in feedwater flow event meets the DSRS acceptance criteria. MCHFR remains above the 95/95 analysis limit for the NSP4 CHF correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the pressures described in DCA Part 2, Tier 2, Section 15.2.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.2.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to analyze the thermal-hydraulic response to the event. In addition, the applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. To identify the limiting increase in feedwater flow scenario, the applicant analyzed a spectrum of feedwater flow increases up to the maximum flow that can be provided by two feedwater pumps. The applicant assumed that the feedwater flow linearly increases over 0.1 seconds. The staff notes that the analyzed spectrum of flow increases bounds possible causes of an increase in feedwater flow, including inadvertent startup of the backup feedwater pump at its normal speed, and is therefore acceptable. In addition, varying the magnitude of flow increase is sufficient to adequately identify the limiting rate of increase. The applicant concluded that the limiting event for MCHFR results from a 15-percent increase in feedwater flow.

The staff reviewed the initial parameter values and biases to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback caused by the most negative MTC and the least negative DTC. In addition, the RCS initial conditions are consistent with the most challenging 15-62

conditions for MCHFR established in TR-0915-17564-A, Revision 2, Subchannel Analysis Methodology (ADAMS Accession No. ML19067A256).

The applicant credited several MPS signals for an increase in feedwater flow event. The limiting event for MCHFR results in a reactor trip on the high core power signal, SSI on the high steam superheat signal, and DHRS actuation on the high main steam pressure signal. The applicant added a 5-percent uncertainty to the high core power setpoint to account for the temperature decalibration effect as a result of cooler, denser water in the downcomer affecting ex-core detector signals. The downcomer temperature decrease of 5 °C (9 °F) for the decrease in feedwater temperature event bounds the decrease for this event; therefore, as discussed in Section 15.1.1.4.2 of this SER, the staff finds that a 5-percent uncertainty is acceptable.

Technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105.

The staffs review of TR-0616-49121 is in Chapter 7 of this SER.

The applicant did not credit operator action to mitigate the increase in feedwater flow event.

The applicant assumed that the rod control system operates as designed, which is conservative because it withdraws control rods when the RCS temperature drops, inserting positive reactivity.

In addition, the applicant did not assume a loss of power or a single failure for the limiting MCHFR case. For the reasons stated in Section 15.1.1.4.2 of this SER, which also apply to this event, the staff finds these assumptions acceptable.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and assumptions to confirm that they led to the most limiting results for MCHFR, as discussed in the associated audit documentation (ADAMS Accession Nos. ML19270G302 and ML19004A098). The audited material supports the discussions about the limiting MCHFR case in the DCA, and the staff finds that the input parameters, initial conditions, and assumptions listed in the DCA are suitably conservative and result in the most limiting conditions for MCHFR.

The applicant considered a single failure of an FWIV to close to analyze the potential for SG overfill, which could degrade performance of the related DHRS train. The applicant stated in a letter dated October 31, 2019 (ADAMS Accession No. ML19304C673) that it applied initial conditions that maximize SG level and assumptions that minimize DHRS heat removal. The applicant concluded that the SGs do not overfill, and the DHRS is capable of adequately removing decay heat under these scenarios. The staff audited the underlying calculation note, Commented [A19]: The applicant provided this as discussed in the associated audit documentation (ADAMS Accession No. ML19004A098), information in a letter dated October 31, 2019 (ADAMS and confirmed that the analyses therein support the docketed information and conclusions Accession No. ML19304C673). The staff will confirm that the applicable markups are incorporated in DCA regarding SG overfill. Revision 4.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.2, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the increase in feedwater flow event and finds that it is consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to a more serious plant condition.

15-63

DCA Part 2, Tier 2, Table 15.1-6, presents the limiting analysis results for this event. The applicant calculated maximum RCS and SG pressures of 2,002 psia and 1,491 psia, respectively. Although the applicant did not perform sensitivities to maximize system pressures, for the reasons discussed in Section 15.1.1.4.2 of this SER, which are also applicable to this analysis, the staff has reasonable assurance that the RCS and SG pressures will remain below 110 percent of the design values (2,310 psia) even if maximized for this event. The limiting MCHFR for this event, 1.854, remains above the 95/95 limit.

By demonstrating that the DSRS AOO acceptance criteria are met for the increase in feedwater flow events, the applicant satisfied the requirements associated with GDC 10, 13, 15, 20, and 26 for this transient.

There are no COL information items associated with Section 15.1.2 of DCA Part 2, Tier 2.

The staff reviewed the increase in feedwater flow event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. As documented above, the applicants analysis shows that the AOO and DSRS acceptance criteria are met for this event. Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of an increase in feedwater flow event meet the relevant requirements set forth in GDC 10, 13, 15, 20, and 26.

Increase in Steam Flow The staff reviewed DCA Part 2, Tier 2, Section 15.1.3, Increase in Steam Flow, to ensure that the event was analyzed appropriately and meets the acceptance criteria discussed in Section 15.1.3.3 of this SER. This event is postulated to result from a spurious opening of the turbine bypass valve. The increased steam flow increases heat transfer from primary to secondary, cooling the RCS and causing a positive reactivity insertion. Positive reactivity is also added as control rods withdraw to maintain moderator temperature, resulting in increasing power. A reactor trip, SSI, and DHRS actuation mitigate the event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided information in DCA Part 2, Tier 2, Section 15.1.3, summarized below.

An increase in steam flow event may result from a spurious opening of the turbine bypass valve or the main steam safety valves (MSSVs). The increased steam flow increases heat transfer from the primary to the secondary system, decreasing moderator temperature and inserting positive reactivity. The control rods withdraw to maintain a programmed RCS temperature, inserting more positive reactivity. The reactivity addition increases core power and decreases MCHFR. A reactor trip, SSI, and DHRS mitigate the transient.

15-64

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the time-dependent MCHFR. The applicant stated that the chosen initial conditions result in a conservative calculation. The applicant did not credit operator action and stated that no single failure produces a more limiting result for MCHFR.

The applicant concluded that the MCHFR remains above the 95/95 analysis limit for the NSP4 CHF correlation. The applicant further stated that the primary and secondary peak pressures for this event meet the respective acceptance criteria because they are less limiting than the peak pressures calculated in DCA Part 2, Tier 2, Section 15.2, Decrease in Heat Removal by the Secondary Side.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.3.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to analyze the thermal-hydraulic response to the event. In addition, the applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions To identify the limiting increase in steam flow scenario, the applicant analyzed a spectrum of steam flow increases up to a 125-percent increase, assuming the flow linearly increases over 0.1 seconds. The staff notes that the maximum magnitude of increase is bounding because an inadvertent opening of a turbine bypass valve results in a 100-percent steam flow increase. In addition, varying the magnitude of flow increase is sufficient to reliably identify the limiting rate of increase. The applicant found that the limiting event for MCHFR results from a 12-percent increase in steam flow.

The staff reviewed the initial parameter values and biases for the increase in steam flow event to ensure that the applicant selected conservative values for the analysis. The staff notes that the applicant assumed suitably conservative parameters that maximize the consequences of the event, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and limiting EOC reactivity feedback. In addition, the RCS initial conditions are consistent with the most challenging conditions for MCHFR established in TR-0915-17564-A, Revision 2, Subchannel Analysis Methodology (ADAMS Accession No. ML19067A256).

15-65

The applicant credited several MPS signals for an increase in steam flow event, and the limiting event results in a reactor trip on the high core power signal. SSI occurs on the low low PZR pressure signal, and the high steam pressure signal eventually actuates DHRS. Technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. The staffs review of TR-0616-49121 is presented in Chapter 7 of this SER.

The applicant did not assume a loss of power in the limiting event analysis and stated that no single failure causes a more limiting MCHFR. The staff agrees that a loss of power is non-limiting for this event because it would trip the feedwater pumps and reduce the overcooling. In addition, a single failure of an MSIV or FWIV to close would have no effect because these valves close after SSI. For this event, SSI occurs after the time of MCHFR.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and assumptions to confirm that they led to the most limiting MCHFR, as discussed in the associated audit documentation (ADAMS Accession Nos. ML19270G302 and ML19004A098). The audited material supports the discussions about the limiting MCHFR case in the DCA, and the staff finds that the input parameters, initial conditions, and assumptions listed in the DCA are suitably conservative and result in the most limiting conditions for MCHFR.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.1.3, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events table for the increase in steam flow event and finds that it is consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to a more serious plant condition.

DCA Part 2, Tier 2, Table 15.1-9, presents the limiting analysis results for this event. For the limiting MCHFR event, the applicant calculated maximum RCS and SG pressures of 1,981 psia and 804 psia, respectively. Although the applicant did not perform sensitivities to maximize system pressures, for the reasons discussed in Section 15.1.1.4.2 of this SER, the staff has reasonable assurance that the RCS and SG pressures will remain below 110 percent of the design values (2,310 psia) even if maximized for this event. The limiting MCHFR for this event, 1.881, remains above the 95/95 limit.

By demonstrating that the DSRS AOO acceptance criteria are met for the increase in steam flow event, the applicant satisfied the requirements associated with GDC 10, 13, 15, 20, and 26 for this transient.

There are no COL information items associated with Section 15.1.3 of DCA Part 2, Tier 2.

The staff reviewed the increase in steam flow event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. As documented above, the applicants analysis shows that the AOO and DSRS acceptance criteria are met for this event. Therefore, the staff concludes that the applicants 15-66

analyses are acceptable, and the consequences of an increase in steam flow event meet the relevant requirements set forth in GDC 10, 13, 15, 20, and 26.

Inadvertent Opening of a Steam Generator Relief or Safety Valve DCA Part 2, Tier 2, Section 15.1.4, Inadvertent Opening of Steam Generator Relief or Safety Valve, states that the NPM design does not have SG relief or safety valves but does include two MSSVs downstream of the MSIVs. The DCA further states that an inadvertent opening of an MSSV is bounded by the increase in steam flow event analyzed in DCA Part 2, Tier 2, Section 15.1.3.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.1.4, as summarized in Section 15.1.4.1 of this SER.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: There are no technical specifications associated with this section.

Technical Reports: There are no technical reports associated with this section.

The regulatory basis described in SER Section 15.1.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.1.4.

The staff evaluated the applicants claim that this event is bounded by an increase in steam flow event. DCA Part 2, Tier 2, Section 15.1.4, states that the two MSSVs together must accommodate 100 percent of the full power steam flow. Therefore, a spurious opening of one MSSV would result in a steam flow of at least 50 percent, but less than 100 percent, of steam flow at full power. A spurious opening of the turbine bypass flow valve, also located downstream of the MSIVs, could result in a 100-percent increase in steam flow. For this reason, the applicant concluded that an inadvertent opening of the turbine bypass valve bounds the steam flow increase caused by a spurious opening of an MSSV and did not analyze an inadvertent MSSV opening event. Based on its review of the design information, the staff agrees with and confirms the applicants conclusion that the inadvertent opening of an MSSV is bounded by the increase in steam flow event analyzed in DCA Part 2, Tier 2, Section 15.1.3.

There are no COL information items associated with Section 15.1.4 of DCA Part 2, Tier 2.

For the NPM design, the staff concludes that the inadvertent opening of a steam generator relief or safety valve event is bounded by the increase in steam flow event, which is discussed in 15-67

Section 15.1.3 of this SER. Because the increase in steam flow event meets the DSRS acceptance criteria and GDC 10, 13, 15, 20, and 26, the staff finds that the inadvertent opening of a steam generator relief or safety valve also meets these requirements.

Steam System Piping Failures Inside and Outside of Containment A break in steam piping inside or outside of containment can cause an increase in the heat removal rate from the reactor coolant system (RCS) resulting in a reduction of RCS temperature and pressure.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.1.5, Steam Piping Failures inside and outside of Containment.

The applicant analyzed a spectrum of steam line break (SLB) locations with varied core and plant conditions, both inside and outside containment, to determine the scenarios with the most severe results. An SLB inside the CNV would increase the pressure inside containment, reaching the high containment pressure analytical limit. The high containment pressure signal trips the reactor, isolates the CNV, and actuates SSI. The break flow would decrease due to SG depressurization until dryout due to feedwater isolation. The containment pressure is sensitive to an SLB, so the protection system detects the break sooner than a comparable break outside of containment. The peak containment pressure response associated with an SLB event is described in DCA Part 2, Tier 2, Section 6.2. The applicant stated that aside from containment pressure, the plant conditions for an SLB inside containment are bounded by the analysis for an SLB outside of containment.

An SLB outside the CNV would cause an increase in steam flow event that could either cause a low SG pressure signal or a high core power trip due to the reactor power response from the decreased RCS temperature. The break flow would be stopped by the closure of the MSIV and depressurization of the steam system piping. The applicant concluded that a small SLB outside of containment is the most limiting type because it provides the longest event progression before detection by the protection system.

The applicant stated that the SLB accident was evaluated against the 95/95 MCHFR AOO acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

15-68

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 27, as it relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.
  • 10 CFR Part 50, Appendix A, GDC 28, as it relates to limits on the potential amount and rate of reactivity increase to ensure that the effects of postulated reactivity accidents can neither (1) result in damage to the RCPB greater than limited local yielding nor (2) sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core.
  • 10 CFR Part 50, Appendix A, GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

The DSRS Section 15.1.5 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following sections discuss the staffs technical evaluation of the applicants SLB analysis.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.1.5, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.1.5.1, that because a steamline break in the NuScale plant can result from various mechanisms, the applicant considered a spectrum of SLB sizes and locations, with varying core and plant conditions, to determine the SLB scenarios with the most limiting results.

The applicant determined that for each of the acceptance criteria, a different SLB case was most limiting. Therefore, the applicant presented various limiting cases in this DCA Part 2 section for each of the acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.1.5, are the following: limiting RCS pressure case, limiting SG pressure case, limiting MCHFR case, and limiting radiological consequences cases. The staff also notes that the applicant classified this event as an accident consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considers a spectrum of SLBs in different locations throughout the system.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER to analyze the thermal-hydraulic response to the event.

The applicant performed a subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER presents the staffs evaluation of these codes.

15-69

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that some input assumptions varied slightly among the limiting SLB cases presented because some of these parameters would affect different aspects of the transient. In any case, the staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.1.5, analysis, the staff confirmed that initial parameters, such as power level, RCS temperature, pressurizer (PZR) pressure, PZR level, RCS flow, scram characteristics (including the assumption of a stuck rod),

Doppler reactivity feedback, moderator temperature reactivity feedback, SG characteristics, and DHRS characteristics, were conservatively chosen for the analysis. The staff also confirmed that NuScale considered instrument inaccuracies and credited no operator action to mitigate the consequences of an SLB. The staff confirmed via audit (ADAMS Accession No. ML19004A098) that the applicants modeling assumptions, analysis input, and boundary conditions were supported by sensitivity analyses.

The staff reviewed the applicants single-failure assumptions for this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the SLB event.

The staff noted that, for the limiting MCHFR case, no single failure was found to have an adverse impact on either cases figure of merit. For the limiting RCS pressure case and radiological consequences cases, the staff noted that the applicant modeled a single failure of the MSIV on the affected train. The staff confirmed that a failure of the MSIV on the affected train will maximize mass and energy release after an isolation signal occurs, which is conservative for the RCS pressure case and radiological consequences cases. For the limiting SG pressure case, the staff noted that the applicant modeled a single failure of the FWIV on the affected SG. The staff confimed that a failure of the FWIV, which allows additional FW into the affected SG, is conservative for the SG pressure case.

The staff reviewed the applicants assumptions regarding break size and location. The staff noted that, as with other model assumptions, the limiting break size and location were dependent on which figure of merit (e.g., RCS pressure, MCHFR, or radiological consequences) was being analyzed. Nevertheless, the staff confirmed via audit (ADAMS Accession Nos. ML19270G302 and ML19004A098) that the applicants assumed limiting break sizes and locations were supported by sensitivity analyses.

The staff reviewed the applicants assumptions regarding the availability or unavailability of electric power systems. The staff confirmed that, for each limiting case, the applicants power assumptions were conservatively determined.

The staff finds the applicants SLB analysis-specific assumptions, input, and boundary conditions acceptable because they were selected conservatively and demonstrate acceptable mitigation of this event and protection of fission product barriers.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.1.5, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several 15-70

parameters by evaluating plots of the parameters as a function of time. The staff specifically reviewed reactor power, reactor and SG pressures, core temperatures, break flow rates, MCHFR, and reactivity.

As part of the staffs review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants SLB case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff reviewed the applicants SLB case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff notes that for an SLB accident, the secondary side naturally depressurizes, and thus, in any given case, the main steam system pressure is of no concern. However, the staff notes that when the DHRS is actuated, a pressurization of that DHRS train will occur. This pressurization is understood and expected, and for an SLB accident, is not expected to challenge pressure limits for the secondary side. The applicant provided SG pressure plots, and the NRC staff confirmed that these representative SG pressures demonstrate that main steam system pressure is non-limiting for an SLB.

The staff reviewed the applicants SLB case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit described in the DSRS.

The staff notes that the radiological analysis of the SLB accident is presented in DCA Part 2, Tier 2, Section 15.0.3. The staffs review of the radiological consequences occurring from an SLB is documented in Section 15.0.3 of this report.

The staff confirmed that the DHRS is safety-related, and under the worst single-failure assumption for this event, which could render one train of the DHRS completely inoperable, the second train of the DHRS automatically actuates and provides an adequate amount of heat removal to cool the core during and after the accident.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.1.5.

The staff concludes that the consequences of postulated steam line breaks meet the relevant requirements set forth in the GDCs 13, 27, 28, and 31 with respect to this event. As documented above, for this event sequence, the staff confirmed that the applicants analysis demonstrates that the DSRS acceptance criteria are met.

15-71

Loss of Containment Vacuum In the NuScale design, the containment vessel (CNV), which is partially submerged in the reactor pool, is normally kept at a very low absolute internal pressure. This serves to insulate the reactor pressure vessel (RPV) from the relatively cooler pool water during normal operations. An event resulting in a loss of containment vacuum conditions, whether through air or water ingress into the containment, would degrade the insulation function provided by the containment vacuum and thereby increase the heat transfer from the RPV to the pool, similar to an overcooling event. Overcooling events have the potential to decrease moderator temperature, which increases core reactivity, and can therefore lead to higher reactor power, higher RCS pressure, and reductions in MCHFR and shutdown margin. This event is expected to be of moderate frequency when compared to a pipe break, as it could result from operator action or equipment malfunction and is therefore classified as an AOO.

DCA Part 2, Tier 1: There is no Tier 1 content related to Section 15.1.6.

DCA Part 2, Tier 2: DCA Part 2, Tier 2, Section 15.1.6, Loss of Containment Vacuum/Containment Flooding, summarizes the analyses performed by the applicant related to the loss of containment vacuum or containment flooding event. During normal operation, the containment evacuation system (CES) maintains the containment vacuum conditions. DCA Part 2, Tier 2, Section 9.3.6, Containment Evacuation System and Containment Flooding and Drain System, discusses the CES. As stated by the applicant, a failure of this system could lead to an increase in containment pressure. Another means of losing containment vacuum is a pipe break or leakage of sufficient quantity to overwhelm the CES, such that containment begins to flood. In both scenarios, more severe transients exist that could cause similar effects but have other impacts and are analyzed in other sections of the DCA; for example, in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside Containment, or Section 15.1.5, Steam System Piping Failures Inside and Outside of Containment.

The applicant stated that the loss of vacuum event is bounded by a containment flooding event.

The most severe containment flooding event that is not bounded by another existing event analyzed in Chapter 15 is initiated as a break or leak in the reactor component cooling water system (RCCWS). In the event of a RCCWS leakage, the fluid leaking from the RCCWS would not immediately boil since the fluid temperature is low and would begin filling the containment.

This scenario allows for the containment to partially fill with water, increasing the heat losses from the RPV, while not generating substantial vapor so that containment pressure remains below the trip setpoint.

The limiting containment flooding event is based on an RCCWS break inside containment, with a total volume of 14.2 cubic meters (500 cubic feet) and two RCCWS pumps operating following the break event. Additionally, a CES pump operates at capacity, which delays the onset of the containment pressure trip, with no trip occurring during the period of analysis. The applicant stated that the most severe sequence for this scenario results from retaining all power, with no single failures resulting in a more limiting response with respect to the acceptance criteria.

Other combinations of available power (ac, non-safety-related dc, and highly reliable dc) are analyzed, but not considered limiting.

15-72

For the analyses, the applicant used initial conditions intended to maximize RCS power over the longest duration such that containment fills, which increases heat losses to the reactor pool and therefore increases the magnitude of the overcooling. DCA Part 2, Tier 2, Section 15.1.6.3.2, Input Parameters and Initial Conditions, and Table 15.1-16, Loss of Containment Vacuum/Containment FloodingInputs, summarize these input parameters. Figures 15.1-47 through 15.1-53 show the results for the limiting case. The applicant stated that this event results in a small overcooling transient with a slightly degraded MCHFR that is bounded by the other overcooling transients.

ITAAC: There are no ITAAC associated with Section 15.1.6.

Technical Specifications: The following generic technical specifications (GTS) are applicable to this area of review:

  • the GTS listed in Section 15.0.0 of this SER.

Technical Reports: There are no technical reports related to Section 15.1.6.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the ability of the design to reliably control reactivity changes to ensure that SAFDLs are not exceeded, including during AOOs DSRS Section 15.1.6 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

15-73

A loss of containment vacuum event is unique to the NuScale design. Because of the coupling and relative size of the RPV, the CNV, and the reactor pool, what would be a relatively benign liquid release in a traditional PWR could have an appreciable impact on the primary-side heat balance for the NuScale design. The containment is normally kept at vacuum conditions (less than 690 Pa (0.1 psia)), and therefore normally serves to insulate the RPV from the cooler reactor pool. An event in which the vacuum condition is not maintained, whether because of the ingress of water vapor or air, or the flooding of containment, degrades that insulation function.

This results in an event sequence that falls outside of the traditional Chapter 15 scope but requires analysis to confirm that safety acceptance criteria are met.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to model the thermal-hydraulic response to the event.

For the subsequent CHF analysis, the boundary conditions from the NRELAP5 analyses were passed to the subchannel CHF analyses, which the applicant performed using VIPRE-01. The applicant discussed the two code packages in DCA Tier 2, Section 15.0.2, Review of Transient and Accident Analysis Methods. The NRC staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions One means of losing containment vacuum involves a failure or degradation in CES capability such that a small amount of air or water vapor is allowed to exist within the containment. In the long term, this is similar to operating at a higher containment pressure while under the trip setpoint. The applicant performed a calculation demonstrating that an event of this nature would be bounded by a containment flooding event. The staff audited the calculation and compared it to the containment flooding analysis documented in the DCA and observed that the two calculations exhibit very similar behavior (see ADAMS Accession No. ML19270G302).

For the events the applicant has characterized as a loss of containment vacuum (not a containment flooding event), there is a minimal effect on the parameters of interest and transient acceptance criteria. In calculations audited by the staff, as discussed in the associated audit documentation (ADAMS Accession No. ML19270G302), results showed that the unit remained at power with a relatively small increase in heat loss from the RPV. RCS parameters and core power exhibited minor variations compared to nominal steady-state conditions. Because both this loss of vacuum and the flooding event ultimately end in quasi-steady states at higher power levels with no trip, the primary difference is the end-state power level and margin to the acceptance criteria. The flooding event is more limiting for the relevant figures of merit for this calculation. As such, the events in which containment flooding occurs are stated to bound the events involving only a loss of containment vacuum. The staff agrees with this characterization, and the containment flooding events are evaluated in further detail in the following paragraphs.

As stated in the DCA, another cause of a loss of containment vacuum is a pipe break or leakage of sufficient volume to overwhelm the CES pump flow rate. Non-RCS fluid sources include the feedwater line, the main steamline, the chemical and volume control system (CVCS), and the RCCWS, which cools the control rod drive system. RCS breaks could also cause containment flooding events, but most would have additional consequences and are analyzed in other 15-74

Chapter 15 sections. Some of these events are analyzed separately: feedwater pipe breaks are evaluated in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside of Containment; SLBs are evaluated in Section 15.1.5; and CVCS line breaks are evaluated in Section 15.6.2, Failure of Small Lines Carrying Primary Coolant Outside Containment. Considering these evaluations, viable loss of containment vacuum or containment flooding events that are not already analyzed elsewhere are limited to the RCCWS break and RCS high-point vent break.

The applicant also stated that the RCCWS break bounds the non-safety-related RCS high-point vent line with regards to the containment flooding event because of the subcooled nature of the break, which results in additional fluid being released into containment before the high-pressure trip setpoint is reached. The NRC staff agrees with this conclusion, especially given that other effects associated with the RCS high-point vent line break are assessed as part of the break spectrum analyzed in DCA Tier 2, Section 15.6.5, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.

Therefore, the only containment flooding event analyzed in Section 15.1.6 is the RCCWS line break.

With respect to the transient initial conditions, the applicant selected values intended to maximize RCS power and thereby maximize the amount of overcooling. The RCCWS is assumed to operate at maximum flow and minimum temperature so that liquid conditions in the containment are most conducive to transferring heat from the RPV to the reactor pool. Initial power is maximized, and the reactor is assumed to be at EOC conditions to produce a limiting power response. The NRC staff reviewed these conditions, as well as the related analyses of other input conditions in calculations audited by the staff, as discussed in the associated audit documentation (ADAMS Accession No. ML19270G302), and determined that the values selected by NuScale represent a conservative set of values for this transient, as they produce the most limiting power response.

In the event of an RCCWS line break inside containment, the CNV slowly begins to fill with a mixture of liquid water and water vapor as the result of the low vapor pressure inside the CNV.

The CES then acts to remove vapor as the containment pressure increases. For the purposes of this transient, this assumption is conservative because maintaining containment pressure under the trip setpoint prolongs the transient as the CNV fills with water. During the transient, the RCCWS line break is assumed to flood containment with a volume equal to a full piping arrangement, with no makeup. As documented in DCA Tier 2, Revision 2, Section 9.2.2, Reactor Component Cooling Water System, the RCCWS inventory is limited by the RCCWS expansion tank, which requires operator action to be refilled. Leaks from the RCCWS can be detected through a variety of means, including those associated with RCS leakage.

DCA Tier 2, Section 15.1.6.2, Sequence of Events and Systems Operation, notes that there are no single failures that would result in more severe calculated values with respect to the acceptance criteria. Staff reviewed the potential for single failure and determined that this is true, provided single failures leading to other transients analyzed in Chapter 15 are also considered, as these events would bound the scenario discussed here.

Evaluation of Analysis Results The results from the sequence discussed previously are displayed in DCA Part 2, Tier 2, Figures 15.1-47 through 15.1-53. Figure 15.1-47, Reactor Power (15.1.6 Containment Flooding), shows reactor power during the transient; as stated previously, the reactor does not 15-75

trip, and thus, reactor power stabilizes about 1 percent higher than the initial conditions.

Figure 15.1-48, Reactor Component Cooling Water System Break Flow Rate (15.1.6 Containment Flooding), displays the RCCW break flow, which is a constant based on the system flow rate until the assumed inventory is depleted. Figure 15.1-49, Reactor Pressure Vessel Heat Transfer (15.1.6 Containment Flooding), provides the integral heat losses from the RPV. The figure shows that the heat losses for this event increase fairly rapidly early in the transient before asymptotically approaching a lower, constant value. Figure 15.1-53, Critical Heat Flux Ratio (15.1.6 Loss of Containment Vacuum/Containment Flooding) shows the figure of merit for the analysis, CHF. Figures 15.1-50 through 15.1-52 are related and show the collapsed liquid level (CLL) in the CNV, the CES mass flow rate, and the containment pressure, respectively. Because the applicant assumed a limited inventory in the RCCW system, the CNV level value rapidly increases to level off at a little over 14 feet in the CNV, with some irregular spikes early in the transient. As stated in DCA Section 15.1.6.3.3, Results, incongruities in the NRELAP model where local boiling occurs can cause local pressure conditions at the top of the CNV fluid region to drop and create further spikes in level and pressure. The staff does not view these spikes as relevant to the outcome in the context of the two-phase level tracking model in NRELAP and agrees that they do not significantly affect the end state of the transient.

From the information provided in the DCA, in conjunction with the material audited by the NRC staff, as discussed in the associated audit documentation (ADAMS Accession No. ML19270G302), the staff finds this to be a transient sequence different from most of the Chapter 15 events, as this transient does not involve a reactor trip. This results in minor differences in determining what constitutes the transient end state, with the applicant choosing to terminate the transient upon reaching stable conditions at a higher reactor power level.

Because no trip setpoint is reached and the transient approaches an equilibrium state, the staff accepts this choice as reasonable for the loss of containment vacuum event, especially given that the figures of merit for the relevant acceptance criteria, discussed in the following paragraph, are bounded by the values calculated for other Chapter 15 events.

The acceptance criteria for AOOs include RCS pressure, steam pressure, containment pressure, MCHFR and fuel centerline temperature. In addition, an AOO should not progress into a more serious event without other faults occurring independently. By demonstrating that these acceptance criteria are met, the applicant satisfied the requirements associated with GDC 10, 15, 20, and 26 for this transient. For this event sequence, the applicants analysis demonstrates that pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event, and the minimum DNBR remains above the 95/95 limit in the DSRS. Fuel centerline temperature and containment pressure are considered nonlimiting for this event, with no challenge to limits expected and other events substantially bounding the values calculated for this transient. For this transient, the reactor does not trip but stabilizes at a new, higher power level. Since the transient does not progress into a more severe event, the staff agrees with the applicants conclusion that this AOO meets the defined thermal-hydraulic acceptance criteria and the radiological barriers will not be challenged.

Therefore, the staff finds that GDC 10, 15, 20, and 26 are met for this transient.

For the scope of the transient analyzed in this section, where the reactor does not trip, the indications available to the operators, particularly those indications relied on to monitor reactor leakage as stipulated by TS LCO 3.4.5, RCS Operational Leakage, provide operators a range of variables sufficient to monitor and diagnose the event and ensure that fission product barriers provide adequate safety within prescribed operating ranges, consistent with GDC 13. The plant response for this transient in the event of a reactor trip, as discussed previously, is enveloped by other transients evaluated in Chapter 15.

15-76

There are no COL information items related to Section 15.1.6.

The staff concludes that the analysis of transients resulting in loss of containment vacuum or flooding of the containment analyzed here is acceptable and meets the requirements of GDC 10, 13, 15, 20, and 26 with respect to this event. As documented above, the staff found for this event sequence, the applicants analysis showed that the AOO acceptance criteria are met.

Other events analyzed elsewhere (Section 15.1.5 and 15.2.8) in Chapter 15 substantially bound the values calculated for this transient for more severe containment flooding events. For this transient, the plant stabilizes at new, higher power level and does not trip, and therefore no escalation to a more serious plant condition will occur.

15.2 Decrease in Heat Removal by the Secondary Side Loss of External Load, Turbine Trip, and Loss of Condenser Vacuum This SER section documents the staffs review of DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, Loss of External Load, Turbine Trip, and Loss of Condenser Vacuum, respectively. These events are discussed together since the transient responses are highly similar, and the applicant presented a single set of bounding results that envelops these three events.

The staff reviewed the events in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, to ensure that they are analyzed appropriately and meet the acceptance criteria outlined in Section 15.2.1.3 of this SER. The loss of external load (LOEL), turbine trip (TT), and loss of condenser vacuum (LOCV) events all result in a decrease in heat removal by the secondary system and a corresponding temperature and pressure increase in the RCS. Secondary pressure also increases.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Sections 15.2.1 through 15.2.3, summarized below.

An LOEL is an AOO caused by loss of most or all of the turbine generator load. The LOEL generates a TT that results in isolating the steam flow from the SGs to the turbine because of the closure of the turbine control valves (TCVs). The NPM design includes a turbine bypass valve that opens to allow the reactor to remain in operation in the event of a TT by transferring the main steam flow to the condenser. However, the events in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, do not credit the turbine bypass system. Therefore, primary and secondary-side temperatures and pressures increase until a reactor trip is issued, SSI is initiated, and the DHRS is actuated. The DHRS transfers decay heat to the reactor pool. The severity of the event is ultimately determined by how long it takes to initiate and establish a steady cooldown via the DHRS.

15-77

A TT is an AOO that may result from many different conditions that cause the turbine generator control system to initiate a TT signal or a failure in the control system itself. A TT initiates closure of the turbine stop valves (TSVs), which terminates steam flow from the SGs to the turbine. The TT event proceeds similarly to the LOEL event.

An LOCV is an AOO that may occur because of a reduction in condenser cooling, failure of the main condenser evacuation system to remove noncondensable gases, or in-leakage of air. An LOCV is similar to the LOEL and TT events, except that a loss of feedwater also occurs at event initiation because of the loss of net positive suction head for the condensate pumps. Therefore, a similar system response results.

The LOEL, TT, and LOCV events potentially challenge the RCS pressure, SG pressure, and MCHFR acceptance criteria. Therefore, the applicant evaluated the limiting cases with respect to each of the acceptance criteria in the DCA. The applicant stated that the LOEL, TT, and LOCV events resulted in almost identical responses and therefore included a single bounding set of figures for the three events. The applicant concluded that the limiting cases meet all acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Sections 15.2.1 through 15.2.5 list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

15-78

  • The most limiting moderate-frequency event that results in an unplanned decrease in secondary system heat removal is identified, in particular as to primary pressure, secondary pressure, and long-term decay heat removal.
  • The predicted plant response for the most limiting event satisfies the specific criteria for fuel damage and system pressure.
  • Fuel cladding integrity must be maintained by the minimum DNBR (for NuScale, MCHFR) remaining above the 95/95 limit based on acceptable correlations (see DCA Part 2, Tier 2, Section 4.4) and by satisfaction of any other SAFDL applicable to the particular reactor design.
  • An incident of moderate frequency should not generate an aggravated plant condition without other faults occurring independently.
  • Plant protection systems setpoints assumed in the transient analyses are selected with adequate allowance for measurement inaccuracies as delineated in RG 1.105.
  • Event evaluations consider single failures, operator errors, and performance of non-safety-related systems consistent with RG 1.206, Combined License Applications for Nuclear Power Plants (LWR Edition) (June 2007).
  • The applicant should analyze these events using an acceptable analytical model. Any other analytical model proposed by the applicant will be evaluated by the staff for acceptability.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the LOEL, TT, and LOCV events. The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. Section 15.0.2 of this SER describes the staffs evaluation of these codes.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. As stated previously, the LOEL, TT, and LOCV events are similar. The main differences are that an LOEL causes TCV closure, while a TT initiates TSV closure. The applicant models TCV and TSV closure similarly, except that TCV closure is slower than TSV closure. Therefore, plant responses are generally more severe for TT than LOEL. An LOCV is similar to a TT except that it also includes a loss of feedwater at event initiation, which is typically limiting for RCS pressure and MCHFR responses.

The conditions, biases, and assumptions used to determine limiting values for each acceptance criterion (RCS pressure, SG pressure, or MCHFR) may be different to maximize the consequences for the acceptance criterion being considered. Therefore, some differences 15-79

occur in the event progressions for each acceptance criterion. However, one common assumption is that the applicant does not credit operator action. In addition, each of the analyses assumes that plant control systems perform as designed, with allowance for instrument inaccuracy, unless their action mitigates the events. Furthermore, the applicant did not assume loss of dc power in any case, which the staff finds acceptable because it would result in actuation of the engineered safety features (ESFs) earlier in the transient, thus leading to less severe consequences.

The limiting RCS pressure case is an LOCV with a concurrent loss of ac power. The immediate loss of feedwater leads to reduced heat removal by the secondary and RCS pressurization.

The high PZR pressure signal actuates reactor trip, SSI, and DHRS. The SSI closes the FWIVs, MSIVs, and the non-safety-related feedwater regulating valves and secondary MSIVs, and DHRS actuation opens the DHRS valves. DHRS actuation also deenergizes the PZR heaters, though for this case, they are already deenergized because of the loss of ac power. A reactor safety valve (RSV) opens to mitigate the RCS pressure increase. The applicant determined that no single failure is limiting for the RCS pressure case.

The limiting SG pressure scenario is a TT with an assumed failure of an FWIV to close, which causes feedwater flow to continue to the affected SG until the non-safety-related feedwater regulating valve closes. This maximizes SG pressure and leads to a reactor trip as well as SSI and DHRS actuation on high steam pressure. A loss of ac power is not limiting for SG pressure because it would terminate feedwater flow at the start of the transient.

The applicant stated that the FWIV failure could lead to overfilling and challenge the performance of one DHRS train. The staff notes that the loss of one DHRS train is not a concern because each of the two DHRS trains is designed to remove 100 percent of the RCS decay heat. Furthermore, DCA Part 2, Tier 2, Section 15.2.8, considers the loss of one DHRS train because of a double-ended guillotine feedwater line break (FWLB) inside containment and shows that the event is not limiting. The staffs review of the FWLB event is described in Section 15.2.8 of this SER.

The limiting MCHFR case is an LOCV, which leads to a reactor trip as well as SSI and DHRS actuation on high PZR pressure. An RSV lifts to mitigate the pressure increase. The applicant indicated that no loss of power scenario and no single failure results in a more limiting MCHFR.

The staff finds that a failure of an MSIV or FWIV to close would have no impact because the failure would occur after the time of MCHFR.

The staff reviewed the input parameters and initial conditions for each of the limiting cases to ensure that the applicant selected conservative values for the analyses. The staff notes that the applicant assumed suitably conservative parameters as described in DSRS Sections 15.2.1 through 15.2.5, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback. The BOC reactivity feedback is conservative for RCS overheating events because the reactivity coefficients are least negative and therefore minimize the negative reactivity feedback resulting from temperature increases. In addition, the assumptions of maximum decay heat and reactor pool temperature are limiting for overheating events since they present the greatest challenge to heat removal.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results, as discussed in the associated audit documentation (ADAMS Accession 15-80

No. ML19270G302 and ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

The staff notes that technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Sections 15.2.1 through 15.2.3, to ensure they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the LOEL, TT, and LOCV events and notes that they are consistent with the event descriptions and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event descriptions and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the events do not lead to more serious plant conditions.

DCA Part 2, Tier 2, Table 15.2-7, presents the limiting analysis results for these events. The staff finds that the predicted plant response for the most limiting events satisfy the AOO acceptance criteria because the analysis demonstrates that the limiting MCHFR of 2.441 is above the 95/95 limit of 1.284; the maximum RCS pressure of 2,161 psia remains below 110 percent of the RCS design pressure (2,310 psia); and the maximum peak secondary pressure of 1,545 psia remains below 110 percent of the secondary system design pressure (2,310 psia).

By demonstrating that the AOO acceptance criteria are met for the most limiting LOEL, TT, and LOCV events, the applicant satisfied the requirements associated with GDC 10, 13, 15, and 26 for this transient.

There are no COL information items associated with Sections 15.2.1 through 15.2.3 of DCA Part 2, Tier 2.

The staff reviewed the LOEL, TT, and LOCV events, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transients. As documented above, for these events, the applicants analyses show that the AOO and DSRS acceptance criteria are met. Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of an LOEL, TT, and LOCV meet the relevant requirements set forth in GDC 10, 13, 15, and 26 with respect to these events.

Turbine Trip The staffs review of this event is documented in SER Section 15.2.1.

Loss of Condenser Vacuum The staffs review of this event is documented in SER Section 15.2.1.

15-81

Closure of Main Steam Isolation Valve(s)

The staff reviewed DCA Part 2, Tier 2, Section 15.2.4, Closure of Main Steam Isolation Valve(s), to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.2.1.3 of this SER. The inadvertent closure of one or both MSIVs is an AOO resulting from a steamline or reactor system malfunction or inadvertent operator actions. The event results in rapid primary and secondary pressurization, as well as an RCS temperature increase.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.2.4, summarized below.

The MSIV closure event is initiated by the closure of one or both MSIVs because of a spurious closure signal or operator error. One MSIV could also fail to close on a valid MSIV closure signal. The closure of one or more MSIVs results in an increase in secondary temperature and pressure in the affected SG(s) and consequent increases in primary temperature and pressure as the result of reduced heat removal. A reactor trip, actuation of DHRS, and SSI on either the high steam pressure or high PZR pressure signal are credited to mitigate the event. The RSV lifts for a short time to limit the RCS pressure increase for the cases that reach the RSV setpoint.

The MSIV closure event potentially challenges the RCS pressure, SG pressure, and MCHFR acceptance criteria. Therefore, the applicant evaluated the limiting cases for each of the acceptance criteria in the DCA. The applicant concluded that the limiting cases meet all acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of revi The regulatory basis described in SER Section 15.2.1.3 is also applicable to DCA Part 2, Tier 2, Section 15.2.4.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the MSIV closure event.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF 15-82

correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The staff noted that the applicant identified three different limiting cases to maximize the consequences for the acceptance criterion being considered. However, one common assumption is that the applicant did not credit operator action. In addition, each of the cases assumes that plant control systems perform as designed, with allowance for instrument inaccuracy, unless their action mitigates the events.

The applicant stated that the closure of two MSIVs is limiting for all acceptance criteria. This agrees with the staffs expectations, as closing two MSIVs leads to isolation of both SGs and the maximum loss of heat removal from the RCS. The applicant also stated that no single failures resulted in more severe results for any of the acceptance criteria and provided a sensitivity study in a letter dated May 21, 2018 (ADAMS Accession No. ML18141A880), which showed that a failure of an FWIV to close did not result in a more limiting SG pressure.

The MSIV closure event progresses as described in Section 15.2.4.2 of this SER for each of the limiting cases. The MCHFR and RCS pressure cases assume a loss of ac power concurrent with reactor trip. This causes a feedwater pump trip, exacerbating the RCS heatup. Loss of ac power was not limiting for SG pressure. Furthermore, the applicant did not assume loss of dc power in any case, which the staff finds acceptable because it would result in ESF actuation sooner in the transient, thus leading to less severe consequences.

The staff reviewed the input parameters and initial conditions for each of the limiting cases to ensure that the applicant selected conservative values for the analyses. The staff notes that the applicant assumed suitably conservative parameters as described in DSRS Sections 15.2.1 through 15.2.5, including a 102-percent initial core power level, maximum time delay to scram with the most reactive rod held out of the core, and the most limiting reactivity feedback (which occurs at BOC for this event). In addition, the assumptions of biased-high reactor pool temperature and maximum DHRS valve opening time are limiting for overheating events since they present the greatest challenge to decay heat removal.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions, single failures, and loss of power assumptions, as discussed in the associated audit documentation, to confirm that they led to the most limiting results (ADAMS Accession No. ML19270G302 and ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

The staff notes that technical report TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.4, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the MSIV closure event and notes that they are consistent with the event description and the assumptions 15-83

for protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event descriptions and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to more serious plant conditions.

DCA Part 2, Tier 2, Table 15.2-14, presents the limiting analysis results for this event. The staff finds that the predicted plant response for the most limiting events satisfy the AOO acceptance criteria because the analysis demonstrates that the limiting MCHFR of 2.670 is above the 95/95 limit of 1.284; the maximum RCS pressure of 2,161 psia remains below 110 percent of the RCS design pressure (2,310 psia); and the maximum peak secondary pressure of 1,512 psia remains below 110 percent of the secondary system design pressure (2,310 psia).

By demonstrating that the AOO acceptance criteria are met for the MSIV closure event, the applicant satisfied the requirements associated with GDC 10, 13, 15, and 26 for this transient.

There are no COL information items associated with Section 15.2.4 of DCA Part 2, Tier 2.

The staff reviewed the MSIV closure event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. As documented above, for this event, the applicants analysis shows that the AOO and DSRS acceptance criteria are met. Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of an MSIV closure event meet the relevant requirements set forth in GDC 10, 13, 15, and 26 with respect to this event.

Steam Pressure Regulator Failure (Closed)

DCA Part 2, Tier 2, Section 15.2.5, Steam Pressure Regulator Failure (Closed), states that the NuScale design does not use a steam pressure regulator, and therefore, the applicant did not evaluate the steam pressure regulator failure event. The staff examined design information and drawings to confirm that there is no steam pressure regulator in the NuScale design and determined that this event is not applicable to the NuScale design.

Loss of Nonemergency ac Power to the Station Auxiliaries The staff reviewed DCA Part 2, Tier 2, Section 15.2.6, Loss of Non-Emergency AC Power to the Station Auxiliaries, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.2.6.3 of this SER. A loss of ac power event is an AOO that can result from failures in the electrical grid or the onsite ac distribution system and causes rapid primary and secondary pressurization.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

15-84

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.2.6, summarized below.

Failures in the electrical grid or plant or switchyard equipment, as well as external weather events, may lead to a loss of ac power to the station auxiliaries. A loss of ac power event causes a TT and a loss of pumps in the secondary system, leading to increasing primary temperature and pressure. The reactor trips and SSI and DHRS actuate on the high PZR pressure signal for all limiting cases. Secondary pressure increases until stable DHRS operation is established to transfer decay heat from the RCS to the reactor pool. The applicant concluded that the event meets the DSRS acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The TS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

DSRS Section 15.2.6 lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • Fuel cladding integrity must be maintained by keeping the minimum DNBR (for NuScale, MCHFR) above the 95/95 limit based on acceptable correlations (see DSRS Section 4.4).
  • An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

15-85

  • The positions of RG 1.105 are considered with respect to plant protection system setpoints assumed in this event.
  • The applicant should analyze this event using an acceptable analytical model. Any other analytical model proposed by the applicant will be evaluated by the staff.
  • The parameter values in the analytical model should be suitably conservative.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to model the NPM thermal-hydraulic response to the loss of ac power event. The applicant performed subchannel analysis using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. For the loss of ac power analysis, the applicant assumed a loss of the low-voltage ac power distribution system (ELVS), which powers dc battery chargers, plant motors, heaters, and packaged equipment. The staff reviewed the ac power distribution system drawings and notes that a loss of power from the medium- or high-voltage ac power distribution systems would result in the same plant response. Therefore, the staff finds assuming loss of the ELVS acceptable.

The applicant assumed that dc power remains available for this event. The staff finds this acceptable because loss of dc power would cause a reactor trip or ESF actuation, or both, earlier in the transient than if there were no loss of dc power.

Analyses of the loss of ac power do not credit operator action or backup diesel generators. The staff also confirmed that the analyses do not credit any action by mitigating plant control systems. The applicant assumed that the MPS performs as designed, with allowances for instrument inaccuracy. TR-0616-49121 describes how the applicants setpoints conform to RG 1.105. Chapter 7 of this SER presents the staffs review of TR-0616-49121.

For the limiting RCS pressure case, the loss of ac power causes a TT and loss of power to the PZR heaters, secondary pumps, and CVCS pumps. RCS pressure increases because of the reduction in heat removal. The reactor trips, and SSI and DHRS actuate on the high PZR pressure signal. The RSV is credited to relieve RCS pressure. Secondary pressure increases initially and then declines as stable natural circulation is established in the DHRS.

The event is similar for the SG pressure and MCHFR cases in that the reactor trip and SSI and DHRS actuation occur because of the high PZR pressure MPS signal. The applicant stated in DCA, Part 2, Tier 2, Table 15.2-18, that it selected the limiting SG pressure case as representative for MCHFR (rather than identifying the absolute limiting MCHFR case) because heatup events are not challenging for MCHFR. The staff finds this acceptable because the 15-86

other heatup events explicitly analyzed for MCHFR show relatively large margin to the 95/95 limit, especially compared to cooldown and reactivity-initiated events. The applicant stated that no single failure of an FWIV or MSIV caused more severe consequences for any case because feedwater flow is lost at the start of the transient, and MCHFR occurs before potential valve failure.

The applicant identified different initial condition biases as limiting for the RCS pressure and SG pressure/MCHFR cases. The staff reviewed the selected input parameters and initial conditions and notes that the applicant has chosen suitably conservative input as described in DSRS Section 15.2.6, including a 102-percent initial core power level, the maximum time delay to scram with the most reactive rod held out of the core, and the most limiting BOC reactivity feedback. The staff also audited the applicants sensitivity studies that investigated the most limiting initial conditions and single failures, as discussed in the associated audit documentation, to confirm that they led to the most limiting results (ADAMS Accession No. ML19270G302 and ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.6, to ensure that they meet the DSRS acceptance criteria. The staff reviewed the sequence of events tables for the loss of ac power event and finds that they are consistent with the event description and assumptions for the protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the event does not lead to more serious plant conditions.

DCA Part 2, Tier 2, Table 15.2-19, presents the limiting analysis results for this event. The staff finds that the predicted plant response for the most limiting events satisfy the AOO acceptance criteria because the analysis demonstrates that the MCHFR of 2.539 is above the 95/95 limit of 1.284; the maximum RCS pressure of 2,160 psia remains below 110 percent of the RCS design pressure (2,310 psia); and the maximum peak secondary pressure of 1,415 psia remains below 110 percent of the secondary system design pressure (2,310 psia). Even though the calculated MCHFR may not be the absolute limiting value, the large margin with respect to the 95/95 limit provides reasonable assurance that the limiting MCHFR remains above the limit.

By demonstrating that the AOO acceptance criteria are met for the loss of ac power event, the applicant satisfied the requirements associated with GDC 10, 13, 15, and 26 for this transient.

There are no COL information items associated with Section 15.2.6 of DCA Part 2, Tier 2.

The staff reviewed the loss of ac power event, including the sequence of events, values of parameters and assumptions used in the analytical model, and predicted consequences of the transient. As documented above, the applicants analysis shows that the AOO and DSRS acceptance criteria are met for this event. Therefore, the staff concludes that the applicants 15-87

analyses are acceptable, and the consequences of a loss of ac power event meet the relevant requirements set forth in GDC 10, 13, 15, and 26 with respect to this event.

Introduction A pump failure, valve malfunction, or loss of offsite power can cause a loss of normal feedwater flow. A loss of normal feedwater flow causes a decrease in the heat removal rate from the reactor coolant system (RCS) resulting in an increase in RCS pressure and temperature.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.7, Loss of Normal Feedwater Flow.

The applicant stated that a loss of normal feedwater flow could occur from the following scenarios: pump failures, valve malfunctions, or a loss of ac power. A loss of normal feedwater causes a decrease in heat removal in the steam generators resulting in an increase in RCS temperature and pressure which lead to a reactor trip. The applicant stated that the loss of normal feedwater flow event is expected to occur one or more times in the life of the plant, so it is classified as an AOO.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.

accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

DSRS Section 15.2.7 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants analysis of loss of normal feedwater flow.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.7, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.7.1, that a loss of normal feedwater flow could occur as a result of pump failures, valve malfunctions, and loss of ac power. Because of the various causes, the applicant considered and analyzed a range of scenarios to determine the most limiting loss of feedwater (LOFW) events that result in the most severe consequences. For instance, to determine what type of LOFW event resulted in the maximum SG pressure event, the applicant ran a spectrum of cases to assess the sensitivity to how much feedwater flow is lost (perhaps because of a spurious partial valve closure or other LOFW mechanism). The staff notes that a feedwater line rupture can also result in a loss of feedwater flow; however, such an event is reviewed in Section 15.2.8 of this SER.

Considering this spectrum of cases, the staff notes that the applicant presented various limiting cases in this DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.7 are (1) the limiting MCHFR and limiting RCS pressure case and (2) the limiting SG pressure case. Furthermore, the staff notes that the applicant classified this event as an AOO, consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a range of scenarios that could be experienced in an actual plant due to component failures or malfunctions.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, to analyze the thermal-hydraulic response to the event.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that input assumptions varied slightly among the presented limiting LOFW cases because some of these parameters affect different aspects of the transient (e.g., a smaller loss in feedwater flow is more limiting for the peak SG pressure case, whereas a complete loss of feedwater flow is more limiting for the MCHFR case). In any case, the staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively selected.

15-89

For all limiting cases presented as part of the DCA Part 2, Tier 2, Section 15.2.7, analysis, the staff confirmed that initial parameters, such as power level, RCS pressure, RCS temperature, RCS flow, PZR level, Doppler reactivity feedback, moderator temperature reactivity feedback, reactor kinetics parameters, and scram characteristics (including assuming a stuck rod) were conservatively selected and applied in the analysis. The staff also confirmed that the applicant considered instrument inaccuracies and that no operator action is credited to mitigate the effects of a loss of normal feedwater flow event.

The staff reviewed the applicants single-failure assumptions for this event. The staff confirmed through audit, as discussed in the associated audit documentation (ADAMS Accession No. ML19004A098), that no single failures were found to have an adverse impact on the figures of merit for this event.

The staff reviewed the applicants assumptions regarding the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power availability assumptions were conservatively applied.

The staff confirmed that the applicants LOFW analysis-specific assumptions, input, and boundary conditions were selected conservatively.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.2.7 and Table 15.2-23, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and SG pressures, net reactivity, reactor coolant temperature and flow rate, MCHFR, and PZR level.

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants LOFW case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants LOFW case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants LOFW case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit.

The staff reviewed the applicants analysis in DCA Part 2, Tier 2, Section 15.2.7, and confirmed that following a loss of normal feedwater event, stable DHRS cooling can be attained and the reactor can be safely shut down.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.7.

15-90

The staff concludes that the consequences of a loss of feedwater flow meet the relevant requirements set forth in the GDCs 10, 13, 15, and 26 with respect to this event. As documented above, for this event sequence, the staff determined that the applicants analysis showed that the AOO and DSRS acceptance criteria are met.

15.2.8 Feedwater System Pipe Breaks Inside and Outside Containment A break in feedwater piping inside or outside of containment can cause a decrease in the heat removal rate from the RCS resulting in an increase in RCS temperature and pressure.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.8, Feedwater System Pipe Breaks Inside and Outside of Containment.

A feedwater line break (FWLB) event can occur both inside and outside of the CNV. The applicant analyzed a spectrum of FWLB locations and break sizes, with varied core and plant conditions to determine the scenarios with the most severe results.

A FWLB inside the CNV will increase the pressure in the evacuated atmosphere resulting in a loss of containment vacuum, and actuating the high containment pressure module protection system (MPS) signal. The high containment pressure MPS signal actuates the reactor trip system (RTS), isolates containment, and actuates the Secondary System Isolation (SSI).

Feedwater breaks outside of containment will cause a loss of feedwater flow to the steam generators and a heatup and subsequent pressure increase in the RCS. Larger breaks will cause a rapid heatup and will trip the reactor and actuate SSI on low steam line pressure, whereas smaller breaks will cause a gradual heatup and loss of pressure in the main steam system resulting in a low steam line pressure signal, a high pressurizer pressure signal, or a high steam superheat signal that will actuate the RTS and SSI. Assuming a loss of ac power will cause a rapid heatup and will trip the reactor and actuate SSI on high pressurizer pressure.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate 15-91

safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.

  • 10 CFR Part 50, Appendix A, GDC 27, as it relates to controlling the rate of reactivity changes to ensure that, under postulated accident conditions and with appropriate margin for stuck rods, the capability to cool the core is maintained.
  • 10 CFR Part 50, Appendix A, GDC 28, as it relates to limits on the potential amount and rate of reactivity increase to ensure that the effects of postulated reactivity accidents can neither (1) result in damage to the RCPB greater than limited local yielding nor (2) sufficiently disturb the core, its support structures, or other RPV internals to impair significantly the capability to cool the core.
  • 10 CFR Part 50, Appendix A, GDC 31, as it relates to the RCS being designed with sufficient margin to ensure that the boundary behaves in a nonbrittle manner and that the probability of propagating fracture is minimized.

DSRS Section 15.2.8 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following sections discuss the staffs technical evaluation of the applicants FWLB analysis.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.8, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.8.1, that a FWLB in the NuScale plant can occur because of seismic events, thermal stress, or cracking of the feedwater piping. Because of the various causes, the applicant analyzed a range of FWLBs in different locations throughout the system. For instance, a small split crack to a double-ended guillotine rupture of the largest feedwater line was analyzed in locations inside and outside of containment. Because of the variations in event initiation, through a spectrum of analyses, the applicant was able to determine the scenarios producing the most severe results with respect to the DSRS acceptance criteria.

For these reasons, the applicant presented various limiting cases in this DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.8 are the limiting MCHFR case, limiting RCS pressure case, limiting SG pressure case, and limiting DHRS function case. Furthermore, the staff notes that the applicant classified this event as an accident consistent with the DSRS. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a spectrum of FWLBs in different locations throughout the system.

15-92

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER to analyze the thermal-hydraulic response to the event.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff noted that input assumptions varied slightly among the presented limiting FWLB cases because some of these parameters affect different aspects of the transient. The staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.2.8, analysis, the staff confirmed that initial parameters, such as power level, fuel temperature, RCS temperature, PZR pressure, PZR level, RCS flow, Doppler reactivity feedback, moderator temperature reactivity feedback, reactor kinetics, and scram characteristics (including the assumption of a stuck rod),

were conservatively applied in the analysis. The staff also confirmed that instrument inaccuracies were considered, and that no operator action is credited to mitigate the consequences of an FWLB event.

The staff reviewed the applicants single-failure assumptions regarding this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the FWLB event.

The staff reviewed the applicants assumptions regarding break size and location. The staff noted that, as with other model assumptions, the limiting break size and location depended on which figure of merit (e.g., RCS pressure, SG pressure, MCHFR, or DHRS function) was being analyzed. Nevertheless, the staff confirmed via audit, as discussed in the associated audit documentation (ADAMS Accession No. ML19004A098), that the applicants assumed limiting break sizes and locations were supported by sensitivity analyses.

The staff reviewed the applicants assumptions about the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power assumptions were conservatively determined.

The staff confirmed that the applicants FWLB analysis-specific assumptions, input, and boundary conditions were selected conservatively.

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.2.8 and Table 15.2-29, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and SG pressures, core temperatures, RCS and break flow rates, MCHFR, and DHRS heat removal rates.

15-93

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the capability to maintain core cooling considering the amount of unborated water from the secondary system that would return to the core after ECCS actuation, which could ultimately challenge subcriticality. The staffs evaluation of return to power is documented in SER Section 15.0.6.

The staff reviewed the applicants FWLB case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants FWLB case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because this meets the DSRS acceptance criteria.

The staff reviewed the applicants FWLB case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit, as described in the DSRS.

The applicant stated that the radiological analysis of the SLB bounds the radiological consequences for the FWLB. The staff finds this acceptable because the mass release through a feedline break outside containment would be significantly smaller than the mass release through an SLB outside containment. The staffs review of bounding radiological consequence analyses is documented in Section 15.0.3 of this SER.

The staff confirmed that the DHRS is safety-related, and under the worst single-failure assumption for this event, which renders one train of DHRS completely inoperable, the second train of DHRS automatically actuates and provides adequate heat removal, ensuring coolable core geometry during and after the accident.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.8.

The staff concludes that the consequences of postulated feedwater line breaks meet the relevant requirements set forth in the GDCs 13, 27, 28, 31, and 35 with respect to this event. As documented above, for this event sequence, the staff determined that the applicants analysis Commented [A20]: Confirmatory Item - The staff will showed that the DSRS acceptance criteria are met. confirm that the updates to section 15.2.8 are incorporated in the Phase 4 SER (ADAMS Accession 15.2.9 Inadvertent Operation of Decay Heat Removal System No. ML19304C673).

An inadvertent operation of the decay heat removal system (DHRS) can cause a decrease in the heat removal rate from the reactor coolant system (RCS) resulting in an increase in RCS temperature and pressure.

15-94

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.2.9, Inadvertent Operation of the Decay Heat Removal System.

The applicant analyzed a series of limiting inadvertent operation of DHRS events at higher power, which is a heatup event due to the decrease in cooling. Loss of power or an inadvertent control signal to one actuation valve on either DHRS train will open the flow path to the associated DHRS heat exchanger, providing a short circuit flow path for feedwater through the DHRS piping instead of through the steam generator. A spurious actuation could occur on one or both trains of DHRS. A full actuation of DHRS opens the two actuation valves on each of the two trains and closes the feedwater isolation valves (FWIVs) and the main steam isolation valves (MSIVs). An inadvertent signal to isolate one or both steam generators by closure of the FWIV and MSIV on the affected train(s) is also evaluated.

At low power and reduced feedwater flow rates, the inadvertent operation of the DHRS is a cooldown event. The pressure drop along the secondary decreases such that it no longer exceeds the hydrostatic pressure of the liquid inventory in the DHRS piping. If the DHRS actuation valve opens under these conditions, a portion of the DHRS liquid inventory drains into the feedwater line and momentarily increases steam generator flow. This unique variant of the inadvertent operation of the DHRS event leads to an increase in heat removal from the RCS.

The applicant states that this event is bounded by more limiting overcooling events addressed in DCA Part 2, Tier 2, Section 15.1.

The applicant stated that the inadvertent operation of DHRS is expected to occur one or more times in the life of the plant, so it is classified as an AOO.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges.

15-95

  • 10 CFR Part 50, Appendix A, GDC 15, as it relates to the RCS and its associated auxiliaries being designed with appropriate margin to ensure that the pressure boundary will not be breached during normal operations, including AOOs.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the reliable control of reactivity changes to ensure that SAFDLs are not exceeded even during AOOs. This is accomplished by ensuring that the applicant has allowed an appropriate margin for malfunctions such as stuck rods.

There is not an SRP section for this decrease in heat removal event; however, DSRS Section 15.2.7 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants analysis of an inadvertent operation of the DHRS.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.2.9, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 15.2.9.1, that the limiting cases for an inadvertent operation of the DHRS (IODHRS) occur at full power. The causes analyzed include opening of a single DHRS valve, inadvertent isolation of one SG and actuation of one DHRS train, inadvertent isolation of both SGs and actuation of both DHRS trains, inadvertent isolation of one SG and inadvertent isolation of both SGs. The staff notes that at low power and reduced feedwater flow rates, the IODHRS is a cooldown event. If the DHRS actuation valve opens under these conditions, a portion of the DHRS liquid inventory drains into the feedwater line and momentarily increases SG flow. This unique variant of the IODHRS event leads to an increase in heat removal from the RCS. DCA Part 2, Tier 2, Section 15.2.9.1, states that this IODHRS event is bounded by more limiting overcooling events addressed in Section 15.1, such as an increase in feedwater flow.

The applicant presented various limiting cases in the DCA Part 2 section, each dealing with its own acceptance criteria. The limiting cases presented in DCA Part 2, Tier 2, Section 15.2.9, are the limiting MCHFR case, the limiting RCS pressure case, and the limiting SG pressure case.

Furthermore, the staff notes that the applicant classified this event as an AOO since it is expected to occur one or more times during the life of the module. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a range of scenarios that could be experienced in an actual plant as the result of component failures or malfunctions.

Methodology The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER to analyze the thermal-hydraulic response to the event.

The applicant performed subchannel analyses using the VIPRE-01 code with the NSP4 CHF correlation to identify the limiting MCHFR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

15-96

Model Assumptions, Input, and Boundary Conditions The staff reviewed the applicants modeling assumptions, analysis input, and boundary conditions to assess the adequacy of the transient analysis model. The staff reviewed each limiting case to determine if the applicants proposed parameters were conservatively chosen.

For all cases presented as part of the DCA Part 2, Tier 2, Section 15.2.9, analysis, the staff confirmed that initial parameters, such as power level, fuel temperature, RCS temperature, PZR pressure, PZR level, RCS flow, moderator temperature reactivity feedback, reactor kinetics, and scram characteristics (including the assumption of a stuck rod), were conservatively applied in the analysis. The staff also confirmed that the applicant considered instrument inaccuracies and that no operator action is credited to mitigate the consequences of an IODHRS event.

The staff reviewed the applicants single-failure assumptions for this event. The staff confirmed that the applicant considered and analyzed single failures for each limiting case of the IODHRS event.

The staff reviewed the applicants assumptions as to the availability or unavailability of power systems. The staff confirmed that for each limiting case, the applicants power availability assumptions were conservatively applied.

The staff confirmed that the applicants IODHRS analysis-specific assumptions, input, and boundary conditions were selected conservatively.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.2.9 and Table 15.2-33, to determine if they meet the SAFDL acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and SG pressures, reactor coolant temperature and flow rate, MCHFR, and PZR level.

As part of its review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

The staff reviewed the applicants IODHRS case that resulted in a limiting RCS pressure. The staff confirmed that for the worst RCS pressure case, the RCS pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants IODHRS case that resulted in a limiting SG pressure. The staff confirmed that for the worst SG pressure case, the SG pressure remained below 110 percent of the design pressure. The staff finds this acceptable because it meets the DSRS acceptance criteria.

The staff reviewed the applicants IODHRS case that resulted in a limiting MCHFR. The staff confirmed that for the worst MCHFR case, the MCHFR remained above the 95/95 DNBR limit in the DSRS.

The staff reviewed the applicants analysis presented in DCA Part 2, Tier 2, Section 15.2.9, and confirmed that IODHRS events do not result in pressure or temperature transients that exceed 15-97

the criteria for which the reactor pressure vessel, SG, CNV, or fuel are designed. Therefore, these barriers to the transport of radionuclides to the environment will function as designed.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.2.9.

The staff concludes that the consequences of inadvertent operation of the DHRS meet the relevant requirements set forth in the GDCs 10, 13, 15, and 26 with respect to this event. As documented above, for this event sequence, the staff determined that the applicants analysis showed that the AOO and DSRS acceptance criteria are met.

15.3 Decrease in Reactor Coolant System Flow Rate Decrease in RCS flow rate events do not apply to the NPM design because the NPM operates on the principle of natural circulation with no forced cooling.

15.4 Reactivity and Power Distribution Anomalies Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low-Power Startup Condition The staff reviewed DCA Part 2, Tier 2, Section 15.4.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power or Startup Condition, to ensure that the event was analyzed appropriately and meets the acceptance criteria outlined in Section 15.4.1.3 of this SER. An uncontrolled control rod assembly (CRA) withdrawal from a subcritical or low-power startup condition is an AOO that results in a rapid addition of reactivity to the core because of the CRA withdrawal. This causes an increase in core power and a decrease in MCHFR.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.1, summarized below.

An uncontrolled CRA withdrawal from a subcritical or low-power startup condition could be caused by an operator error or a malfunction in the control rod drive system. Withdrawal of the regulating CRA bank causes an unexpected reactivity addition, which increases core power and decreases MCHFR. The MPS initiates a reactor trip if MPS setpoints are exceeded. The applicant investigated a spectrum of reactivity insertion rates and initial power levels to identify the limiting cases for MCHFR and fuel centerline temperature using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to find the MCHFR and fuel centerline temperature response. The applicant stated that the limiting cases meet the MCHFR and fuel centerline temperature acceptance criteria.

15-98

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 10, which requires that the reactor core and associated coolant, control, and protection systems are designed with appropriate margin so SAFDLs are not exceeded during normal operations, including AOOs.
  • 10 CFR Part 50, Appendix A, GDC 13, which requires availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges.

The guidance in SRP Section 15.4.1, Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power Startup Condition, lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • The thermal margin limits (DNBR (for NuScale, MCHFR)), as specified in SRP Section 4.4, Thermal and Hydraulic Design, are met.
  • Fuel centerline temperatures, as specified in SRP Section 4.2, do not exceed the melting point.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to analyze the thermal-hydraulic response to the event. In addition, the applicant used the VIPRE-01 code with the NSP4 CHF correlation to perform the subchannel analysis, which identified the limiting MCHFR and maximum fuel centerline temperature. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

15-99

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant assumed that the entire regulating bank withdraws for this event, which provides the maximum reactivity insertion. The credited MPS signals for this analysis are high core power (at 25 percent of full power), source range and intermediate range power rate, high source range count rate, and high PZR pressure.

Different initial power levels and reactivity insertion rates result in reactor trips on different MPS signals. Therefore, the applicant analyzed a spectrum of reactivity insertion rates at different initial power levels ranging from 1 watt to 15-percent rated thermal power (RTP), which is the upper limit for low-power operation. The applicant analyzed reactivity insertion rates up to 35 percent millirho per second (pcm/s), which bounds possible boron dilution scenarios, as well as CRA regulating bank withdrawal at the maximum speed.

The applicant determined that the limiting case for both MCHFR and fuel centerline temperature has an initial power of 24 megawatts (MW) and a reactivity insertion rate of 0.014 pcm/s. The reactor power rise for the limiting case is terminated by a reactor scram, which is actuated after the high power (25 percent of rated thermal power) MPS limit is reached.

The staff reviewed other initial parameter values and biases in the DCA, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The applicant assumed the most positive MTC and least negative DTC, which are conservative because they minimize negative reactivity feedback as moderator and fuel temperatures increase.

The staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results. In addition, as described in the associated audit documentation, the staff confirmed through the audit that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology, as stated in DCA Part 2, Tier 2, Section 15.4.1. The staff also verified through the audit that appropriate cases from the transient analysis were passed on for subchannel analysis (ADAMS Accession No. ML19270G302 and ML19004A098).

According to DCA Part 2, Tier 2, Table 15.0-7, the applicant treated the source range count rate trip as an overpower trip that occurs at an analytical limit of 500 kW, which functionally equates count rate to core power. A future COL applicant will need to verify this assumption since the source range trips are relied on to prevent unacceptable power excursions from source range power levels.

The applicant did not credit operator action to mitigate the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event. The staff agrees with the applicants conclusion that no single failure is limiting for this event because a failure of an ex-core detector would have no effect on a symmetric reactivity transient, and a failure of an MSIV or FWIV to close would have no effect on MCHFR since DHRS does not actuate for that event sequence.

The DCA states that loss of power is not limiting for the event. The staff notes that a loss of normal ac power would trip the feedwater pumps and turbine, but the effect would be negligible because of the low initial power level. Furthermore, the effects of a loss of ac power for this event are bounded by the effects of a loss of ac power on the uncontrolled CRA withdrawal at power event in DCA Part 2, Tier 2, Section 15.4.2. Therefore, the staff finds that the applicants treatment of loss of power for this event is acceptable.15-100

For the reasons stated above, the staff finds that the input parameters, initial conditions, and assumptions associated with the applicants uncontrolled CRA withdrawal from a subcritical or low power startup condition analysis are suitably conservative and result in the most limiting conditions for the acceptance criteria.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.1, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables that apply to the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event and finds that they are consistent with the event description and assumptions for protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met.

DCA Part 2, Tier 2, Table 15.4-3, presents the limiting analysis results for this event. The maximum fuel centerline temperature of 1051.8 °F is well below the limit of 4816 °F, and the limiting MCHFR of 10 remains above the 95/95 limit of 1.284.

The staff finds that the uncontrolled CRA withdrawal from a subcritical or low power startup condition event satisfies the SRP acceptance criteria because the response of the fuel is within the SAFDLs, and thus no fuel damage is anticipated from this event. By demonstrating that the SRP acceptance criteria are met for the most limiting scenario, the applicant satisfied the requirements associated with GDC 10, 13, 20, and 25 for this event.

There are no COL information items associated with Section 15.4.1 of DCA Part 2, Tier 2.

The staff reviewed the uncontrolled CRA withdrawal from a subcritical or low-power startup condition event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. As documented above, the applicants analyses show that the SRP acceptance criteria are met for this event.

Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of an uncontrolled CRA withdrawal from a subcritical or low-power startup condition event meet the relevant requirements set forth in GDC 10, 13, 20, and 25 with respect to this event.

Uncontrolled Control Rod Assembly Withdrawal at Power The staff reviewed DCA Part 2, Tier 2, Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power, to ensure that the event was analyzed appropriately and meets the acceptance criteria discussed in Section 15.4.2.3 of this SER. An uncontrolled CRA withdrawal at power is an AOO that causes an unexpected positive reactivity insertion and a corresponding increase in core power. The power increase and resulting RCS temperature and pressure increases lead to a decrease in MCHFR.15-101

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.2, summarized below.

The uncontrolled CRA withdrawal at power analysis simulates withdrawal of the regulating CRA bank, which causes an unplanned reactivity addition to the core. Core power increases, and because the secondary system lags the primary system response, RCS temperature and pressure increase. Such conditions could challenge SAFDLs. The MPS initiates a reactor trip on high power, high power rate, high PZR pressure, or high RCS hot temperature, depending on the initial conditions and assumptions. The DHRS may be actuated on high RCS hot temperature, high PZR pressure, or high steam pressure to maintain post-trip core cooling.

The applicant analyzed a spectrum of reactivity insertion rates and initial power levels, including loss of power scenarios, to identify the limiting cases for MCHFR and fuel centerline temperature (as evaluated using linear heat generation rate (LHGR)). The applicant used NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response and VIPRE-01 to obtain the MCHFR and LHGR. The applicant stated that the limiting cases meet the SRP acceptance criteria for this event.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The regulations listed in SER Section 15.4.1.3 are also applicable to DCA Part 2, Tier 2, Section 15.4.2. The guidance in SRP Section 15.4.2, Uncontrolled Control Rod Assembly Withdrawal at Power, lists the same acceptance criteria as SRP Section 15.4.1 for demonstrating conformance to the applicable requirements, as well as review interfaces with other SRP/DSRS sections.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to analyze the thermal-hydraulic response to the event. In addition, the applicant used the VIPRE-01 code with the NSP4 CHF correlation to perform the subchannel analysis, which identified the limiting MCHFR and LHGR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the transient analysis model. The applicant assumed that the entire regulating bank withdraws for this event, which provides the maximum reactivity insertion. This15-102

analysis credits the high core power, high core power rate, high RCS hot temperature, and high PZR pressure MPS reactor trip signals. Different initial conditions and reactivity insertion rates result in reactor trips on different MPS signals. To account for the range of transient progressions and trip scenarios, the applicant analyzed a spectrum of reactivity insertion rates at initial power levels of 25, 50, 75, and 102 percent. The applicant included reactivity insertion rates up to 35 pcm/s, which bounds possible boron dilution scenarios as well as CRA regulating bank withdrawal at the maximum speed.

The applicant determined that the limiting case for MCHFR has an initial power of 75 percent and a reactivity insertion rate of 0.92 pcm/s. This case reaches the high RCS hot temperature analytical limit first, and during the eight-second time delay before reactor trip, also reaches and trips on the high PZR pressure signal. The limiting LHGR case initiates from 102-percent power, with a reactivity insertion rate of 35.0 pcm/s. The rapid power increase during the maximum LHGR case causes a high-power rate trip.

The staff reviewed other initial parameter values and biases, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The applicant assumed the least negative MTC and DTC, which are conservative because they minimize negative reactivity feedback as moderator and fuel temperatures increase. In addition, the applicant assumed that the regulating bank is initially inserted to the power-dependent insertion limit (PDIL) plus six steps for rod position uncertainty. The staff finds this treatment conservative because it provides for the maximum reactivity to be added for a given power level.

As described in the associated audit documentation, the staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results. The staff also confirmed that the subchannel analysis uses limiting axial and radial power shapes in accordance with the subchannel analysis methodology, as stated in DCA Part 2, Tier 2, Section 15.4.2 (ADAMS Accession No. ML19270G302 and ML19004A098).

The staff confirmed that the applicant treated control systems conservatively in the analysis. If control system operation leads to a less severe plant response, the applicant assumed that the control system is disabled. However, control system operation is allowed if it causes a more severe transient. For example, the applicant allowed PZR spray operation for some MCHFR cases to delay a trip on high PZR pressure.

The applicant did not credit operator action to mitigate the uncontrolled CRA withdrawal at power event. In addition, the staff agrees with the applicants assertion that no single failure is limiting for this event because a failure of an ex-core detector would have no effect on a symmetric reactivity transient, and a failure of an MSIV or FWIV to close would occur after the time of limiting MCHFR and maximum power.

The applicant considered loss of power scenarios and concluded that a loss of normal ac power at event initiation is non-limiting, and a loss of normal ac power at the time of reactor trip has a negligible impact. The staff confirmed through an audit, as discussed in the associated audit documentation, that the applicants sensitivity studies support the loss of power considerations in the DCA (ADAMS Accession No. ML19270G302 and ML19004A098).15-103

For the reasons stated above, the staff finds that the input parameters, initial conditions, and assumptions associated with the applicants uncontrolled CRA withdrawal at power analysis are suitably conservative and result in the most limiting conditions for the acceptance criteria.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.2, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables that apply to the uncontrolled CRA withdrawal at power event and finds that they are consistent with the event description and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progression and finds that they support the applicants event description and assertion that the acceptance criteria are met.

Furthermore, the figures show that the NPM reaches a stable condition, indicating that the events do not lead to more serious plant conditions.

DCA Part 2, Tier 2, Table 15.4-6, presents the limiting analysis results for this event. The staff notes that the applicant applies an LHGR limit to the uncontrolled CRA withdrawal at power event to evaluate whether fuel centerline melting occurs. This is consistent with the methodology described in topical report TR-0915-17564-A, Subchannel Analysis Methodology, Revision 2, which is approved by the staff (ADAMS Accession No. ML19067A256) and is therefore acceptable. The limiting LHGR of 9.16 kW/ft remains well under the bounding fuel centerline melt limits presented in technical report TR-0816-51127, NuFuel-HTP2' Fuel and Control Rod Assembly Designs, Revision 2, which is evaluated in Section 4.2 of this SER. The limiting MCHFR of 1.499 remains above the 95/95 limit of 1.284.

The staff finds that the uncontrolled CRA withdrawal at power event satisfies the SRP acceptance criteria because the response of the fuel is within the SAFDLs, and thus no fuel damage is anticipated from this event. By demonstrating that the SRP acceptance criteria are met for the most limiting uncontrolled CRA withdrawal at power event, the applicant satisfied the requirements associated with GDC 10, 13, 20, and 25 for this event.

There are no COL information items associated with Section 15.4.2 of the NuScale DCA Part 2, Tier 2.

The staff reviewed the uncontrolled CRA withdrawal at power event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. As documented above, the applicants analyses show that the SRP acceptance criteria are met for this event. Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of an uncontrolled CRA withdrawal at power event meet the relevant requirements set forth in GDC 10, 13, 20, and 25 with respect to this event.

Control Rod Misoperation (System Malfunction or Operator Error)

The staff reviewed DCA Part 2, Tier 2, Section 15.4.3, Control Rod Misoperation (System Malfunction or Operator Error), to ensure that the events were analyzed appropriately and meet 15-104

the acceptance criteria outlined in Section 15.4.3.3 of this SER. The applicant considered three different control rod misoperation events, which are all AOOs: (1) a CRA misalignment (DCA Part 2, Tier 2, Section 15.4.3.3), (2) a single CRA withdrawal (DCA Part 2, Tier 2, Section 15.4.3.4), and (3) a single or multiple CRA drop (DCA Part 2, Tier 2, Section 15.3.5).

Each of these events has the potential to challenge SAFDLs.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.3, summarized below.

The applicant considered three events for the control rod misoperation analysis: a CRA misalignment, a single CRA withdrawal, and a drop of single or multiple CRAs. Each of these events are AOOs and could unexpectedly affect core reactivity and power distributions such that SAFDLs could be challenged.

The CRA misalignment event assumes that all CRAs are withdrawn except for one that is misaligned to the 25-percent rated power PDIL with six steps of additional insertion added for rod position uncertainty. The applicant performed steady-state core analyses using SIMULATE5 to identify the limiting CRA misalignment and inform the radial peaking augmentation factor to be input to the subchannel analysis using VIPRE-01. The applicant states that no transient analysis is needed for this event, as it is a static misalignment in which core power and thermal-hydraulic conditions do not change.

The applicant used NRELAP5 and VIPRE-01 to model both the single CRA withdrawal and a CRA drop. For both events, the applicant credited the high PZR pressure, high power, high power rate, and high hot-leg temperature MPS reactor trip signals.

A single CRA withdrawal may occur because of equipment failure or operator error. For this event, the applicant assumed that the regulating bank is inserted to the PDIL plus an additional six steps of insertion for rod position uncertainty, and a single rod withdraws. This adds positive reactivity to the core, increasing power, RCS temperature, and pressure, and causes the power distribution to become asymmetric. The applicant analyzed a spectrum of initial power levels and reactivity insertion rates to identify the limiting cases for MCHFR and LHGR. Withdrawal of an entire regulating bank is analyzed in DCA Part 2, Tier 2, Section 15.4.2.

A CRA drop can occur because of mechanical or electrical failures and may include a single CRA or an entire group of a control or shutdown bank. The applicant analyzed several CRA drop scenarios from different initial power levels to find the limiting cases for MCHFR and LHGR.

For each of the events in DCA Part 2, Tier 2, Section 15.4.3, the applicant concluded that the limiting cases meet the SRP acceptance criteria.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.15-105

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 10, requires that the reactor core and associated coolant, control, and protection systems be designed with appropriate margin so that SAFDLs are not exceeded during normal operations, including AOOs.
  • 10 CFR Part 50, Appendix A, GDC 13, requires the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges.

The guidance in SRP Section 15.4.3, Control Rod Misoperation (System Malfunction or Operator Error), lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • The thermal margin limits (DNBR (for NuScale, MCHFR)), as specified in SRP Section 4.4, are met.
  • Fuel centerline temperatures, as specified in SRP Section 4.2, do not exceed the melting point.
  • Uniform cladding strain as specified in SRP Section 4.2, does not exceed 1 percent.

The applicant presents the analyses of a CRA misalignment, single CRA withdrawal, and single or bank CRA drops in DCA Part 2, Tier 2, Section 15.4.3. The staff considers this to be a complete scope of CRA misoperation events (excluding the events in DCA Part 2, Tier 2, Sections 15.4.1 and 15.4.2) and therefore acceptable.

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including the NRELAP5 code, to model the thermal-hydraulic response to the single CRA withdrawal and CRA drop events. The applicant also used SIMULATE5 to calculate the radial peaking augmentation factors for each of the events covered in this review section. The applicant used the NRELAP5 and SIMULATE5 results as input to the subchannel analyses using VIPRE-01 and the NSP4 CHF correlation to identify the limiting MCHFR and LHGR. The staffs evaluation of these codes is described in Section 15.0.2 of this SER.15-106

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the analysis models. The control rod misoperation events share some common assumptions. First, the applicant did not credit operator action to mitigate these events. In addition, the analyses assume that plant control systems function as designed, except when they cause less severe consequences for the transient, which the staff notes is conservative. The credited MPS reactor trip signals for these events include high power, high power rate, high RCS hot temperature, and high PZR pressure. The latter two signals, in addition to high steam pressure, are also credited for DHRS actuation. The same signals credited for DHRS actuation, as well as the high steam line superheat signal, are credited for SSI. Event-specific inputs, initial conditions, and assumptions are discussed in the following paragraphs.

Control Rod Assembly Misalignment The DCA discusses three potential CRA misalignment scenarios. The first occurs at full-power conditions with the rods inserted to the PDIL with one rod left fully withdrawn, which the applicant stated is bounded by a single CRA withdrawal. The staff notes that the single CRA withdrawal analysis simulates essentially the same conditions except in a transient simulation, so the staff agrees that this scenario is adequately covered. The second scenario is that all CRAs are inserted to the PDIL except one is fully inserted. The applicant stated that this scenario is not credible because reactor hold points would prevent rod motion in that case due to severe peaking distortion; furthermore, the staff notes that this scenario is bounded by a CRA drop. The final scenario, and the one the applicant analyzed, is a case at full power with all CRAs fully withdrawn except one regulating CRA misaligned in to the 25-percent PDIL, plus six steps of rod position uncertainty.

The applicant considered different power levels, axial offsets, misaligned CRAs, and times in cycle in its SIMULATE5 calculations to find the limiting CRA misalignment. As discussed in the associated audit documentation, the staff audited the underlying calculations and confirmed that the applicant identified the limiting case considering a comprehensive range of conditions (ADAMS Accession Nos. ML19270G302 and ML19004A098).

Also, as part of the audit, the staff verified that the initial RCS parameter values and biases used in the subchannel analysis are conservative with respect to MCHFR. In addition, the staff confirmed the bounding nature of the radial peaking augmentation factor input to the subchannel analysis.

For the reasons stated above, the staff finds that the input parameters and assumptions associated with the applicants CRA misalignment analysis are suitably conservative and result in the most limiting conditions for the acceptance criteria.

Single Control Rod Assembly Withdrawal The applicant analyzed a spectrum of reactivity insertion rates up to 12 pcm/s to capture the maximum reactivity insertion caused by a single rod withdrawal at initial power levels of 25, 50, 75, and 102 percent. The applicant determined that the limiting cases for both MCHFR and LHGR have an initial power of 75 percent and a reactivity insertion rate of 1.32 pcm/s. The difference between these cases is the biasing of the initial RCS average temperature. Both 15-107

cases result in a reactor trip and SSI and DHRS actuation on the high PZR pressure signal during the eight-second time delay after reaching the high hot-leg temperature analytical limit.

The staff reviewed other initial parameter values and biases, including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The applicant used the least negative DTC and MTC corresponding to BOC conditions, which is conservative since they minimize negative reactivity feedback as fuel and moderator temperatures increase.

As discussed in the associated audit documentation, the staff audited the applicants sensitivity studies that investigated the most limiting initial conditions and reactivity insertion rates to confirm that they led to the most limiting results and to confirm that those values are implemented in the DCA analysis. The staff also audited the subchannel analysis calculation for the single CRA withdrawal event and confirmed that the applicant used suitably conservative axial and radial power shapes and the associated peaking factors as input to the subchannel analysis, supporting the statement in the DCA that limiting radial and axial power shapes were used (ADAMS Accession No. ML19270G302 and ML19004A098).

The DCA states that the limiting single failure for the single CRA withdrawal is a failure of an ex-core detector. The analysis assumes that the remaining detectors see the lowest possible flux resulting from the power asymmetry, which is conservative because it delays MPS actuation on power-related trips. The staff notes that a single failure of an MSIV or FWIV to close would occur after the MCHFR has occurred and is therefore not a limiting single failure.

The applicant stated that a loss of power is not limiting for MCHFR. The staff agrees, noting that a loss of power at the beginning of the event would terminate the transient earlier than would otherwise occur for both the MCHFR case and the LHGR case. A loss of power at the time of reactor trip would not affect the drop in core power, which drives the margin to acceptance criteria at that point in the transient. Therefore, the staff finds that the applicant applied conservative loss of power assumptions.

For the reasons stated above, the staff finds that the input parameters, initial conditions, and assumptions associated with the applicants single CRA withdrawal analysis are suitably conservative and result in the most limiting conditions for the acceptance criteria.

Control Rod Assembly Drop The applicant investigated several CRA drop scenarios to find the one that results in the most severe power peaking change. The applicant examined different initial power levels, times in life, and dropped rods. The limiting case for MCHFR and LHGR is identical. This case assumes the drop of a single CRA, starts from 102-percent power, and results in a reactor trip on the high core power rate signal.

The staff reviewed the initial parameter values and biases, including initial RCS conditions and reactivity coefficients. The staff finds that the selected values are the most challenging to MCHFR. For example, the initial RCS temperature and PZR pressure are biased high, and the EOC reactivity coefficients (i.e., most negative MTC and DTC) maximize positive reactivity feedback to mitigate the power decrease due to the dropped rod.

As discussed in the associated audit documentation, the staff audited the applicants sensitivity studies that investigated the most limiting rod drop scenarios and initial conditions to confirm that they led to the most limiting results. The staff also audited the subchannel analysis15-108

calculation for the CRA drop event and confirmed that the applicant used suitably conservative axial and radial power shapes and the associated radial peaking augmentation factor as input to the subchannel analysis, supporting the statement in the DCA that limiting radial and axial power shapes were used (ADAMS Accession No. ML19270G302 and ML19004A098). In addition, the power peaking caused by the CRA drop is conservatively applied to the entire transient in the subchannel analysis.

The applicant applied the same single failure and loss of power assumptions it used for the single CRA withdrawal event to the CRA drop event. The staff finds that the assumed single failure of an ex-core detector is the most limiting single failure for this event because other possible single failures, such as failure of an MSIV or FWIV to close, have no bearing on the MCHFR acceptance criterion due to event timing. In addition, the assumption of no loss of power is acceptable to the staff because a loss of power at any time would have a negligible effect due to the rapid reactor trip actuation.

For the reasons stated above, the staff finds that the input parameters, initial conditions, and assumptions associated with the applicants CRA drop analysis are suitably conservative and result in the most limiting conditions for the acceptance criteria.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.3, to ensure that they meet the SRP acceptance criteria. The staff reviewed the sequence of events tables for the CRA misoperation transients and finds that they are consistent with the event descriptions and assumptions regarding protective system actuation and delay times. In addition, the staff reviewed the figures showing the transient progressions and finds that they support the applicants event description and assertion that the acceptance criteria are met. Furthermore, the figures show that the NPM reaches a stable condition, indicating that the events do not lead to more serious plant conditions.

DCA Part 2, Tier 2, Table 15.4-11, presents the limiting analysis results for the CRA misoperation events. Similar to DCA Part 2, Tier 2, Section 15.4.2, the applicant applies an LHGR limit to the CRA misoperation events to evaluate whether fuel centerline melting and unacceptable cladding strain would occur. The limiting LHGR of 8.39 kW/ft occurs for the static CRA misalignment and remains well under the bounding fuel centerline melt and transient cladding strain limits presented in technical report TR-0816-51127, Revision 2, which is evaluated in Section 4.2 of this SER. The single CRA withdrawal event produces the limiting MCHFR of 1.375, which remains above the 95/95 limit of 1.284.

The staff finds that the CRA misoperation events satisfy the SRP acceptance criteria because the response of the fuel is within the SAFDLs, and thus no fuel damage is anticipated from this event. By demonstrating that the SRP acceptance criteria are met for the most limiting CRA misoperation events, the applicant satisfied the requirements associated with GDC 10, 13, 20, and 25 for these events.

There are no COL information items associated with Section 15.4.3 of DCA Part 2, Tier 2.15-109

The staff reviewed the various control rod misoperation events, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transients. As documented above, the applicants analyses show that the SRP acceptance criteria are met for these events. Therefore, the staff concludes that the applicants analyses are acceptable, and the consequences of a control rod misoperation event meet the relevant requirements set forth in GDC 10, 13, 20, and 25 with respect to these events.

Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature A startup of an inactive loop or recirculation loop at an incorrect temperature is not applicable to the NPM design because the NPM does not have multiple reactor coolant loops.

Flow Controller Malfunction Causing an Increase in Boiling-Water Reactor Core Flow Rate A flow controller malfunction causing an increase in core flow rate is not applicable to the NPM design because the NPM design does not have a flow controller that could increase recirculation flow. The NPM operates on the principle of natural circulation with no forced cooling.

Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (Pressurized-Water Reactor)

A malfunction in the CVCS or an operator error could result in an inadvertent dilution of boron in the RCS. The inadvertent dilution causes a positive reactivity addition to the core.

Section 15.0.6 of this SER documents the staffs review of the potential for boron redistribution following ECCS actuation.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System.

In the NuScale design, a boric acid blend system allows the operator to match or adjust the boron concentration of the reactor coolant makeup water during normal operation. Boron dilution can be either an automatic or a manual operation. In either case, the dilution is governed by administrative controls with procedures that establish the limits on the rate and duration of dilution. An unintended decrease in boron concentration increases the reactivity of the core and decreases the shutdown margin. An inadvertent decrease in boron concentration in the RCS is expected to occur one or more times during the lifetime of the reactor, and is classified as an AOO.

ITAAC: There are no ITAAC items for this area of review.15-110

Technical Specifications: The following GTS are applicable to this area of review:

  • the GTS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 15, as it relates to design of the RCS and its auxiliaries with appropriate margin so that the pressure boundary is not breached during normal operations, including AOOs.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so that SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).

The guidance in SRP Section 15.4.6, Inadvertent Decrease in Boron Concentration in the Reactor Coolant System (PWR), lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The CVCS can adjust boron concentration and allows operators to match or modify boron concentration of the RCS during normal operation. Failures in the CVCS or operator error can result in unborated water being inadvertently introduced to the RCS. This event is considered to occur one or more times during the lifetime of the reactor, and is therefore, classified as an AOO. The limiting CVCS dilution source considered in the safety analysis is the demineralized water system (DWS) supply. Each CVCS makeup pump is assumed to provide 25 gallons per minute (gpm) of demineralized water, which includes 5 gpm to account for uncertainties.

The boron dilution analysis, described in DCA Part 2, Tier 2, Section 15.4.6, determines the range of possible reactivity insertion rates resulting from an inadvertent boron dilution and evaluates whether boron dilution could lead to a complete loss of TS shutdown margin before detection and isolation of the dilution source.

Evaluation Model DCA Part 2, Tier 2, Section 15.4.6.3.1, Evaluation Methodology Summary, states that two calculation techniques are used to analyze the boron dilution event for the NuScale module.15-111

One method assumes unborated water injected into the RCS mixes instantaneously with the effective system volume. The applicant considers this assumption to be conservative for Mode 1 operating conditions because it provides a slower reactivity insertion rate, thus delaying its detection and allowing further loss of shutdown margin. The other method evaluates the boron dilution event by using a wave front model to maximize the amount of reactivity as the diluted slug of water sweeps through the core and does not assume any axial mixing. This diluted slug is assumed to move through the riser, SGs, downcomer, and the reactor core. Both the perfect mixing and wave front models are used for the evaluation of Mode 1 operations. For all other modes where limited mixing exists, the wave front model is used.

Input Parameters, Initial Conditions, and Assumptions For the purposes of the analysis, the CRAs are not assumed to mitigate reactivity changes.

Each of the two regulating bank groups is assumed to be at its respective PDIL so that the rods do not insert automatically as a result of the reactivity addition of an RCS boron dilution. The shutdown margin reactivity credited in the analysis is 2,041 pcm for Mode 1, 527 pcm for Modes 2 and 3, and 11,111 pcm for Modes 4 and 5.

DCA Part 2, Tier 2, Section 15.4.6.1, states that the loss of ac and dc power during this event is considered, but results in nonlimiting scenarios, and there are no single failures that could occur that result in a more severe outcome for the limiting case.

The analysis does not credit operator actions to terminate the event. Instead, the CVCS is designed with automated features that limit the amount and rate of reactivity increase caused by an inadvertent boron dilution event. To mitigate inadvertent dilution events, the CVCS incorporates two redundant safety-related demineralized supply isolation valves. The isolation valves automatically close upon any of the following MPS signals:

  • high subcritical multiplication
  • low RCS flow Generic Technical Specification 3.1.9 and associated bases limit demineralized flowrate and pump operation below 50 percent RTP. In letter dated July 18, 2017, (ML17200A105) the applicant added that the CVCS makeup pump flow rate is designed to provide 20 gpm and the analysis assumes 25 gpm to account for uncertainty. The staff finds this acceptable because the TS appropriately include the limits and controls for the CVCS and demineralization system consistent with the assumption in the analysis regarding inadvertent decrease in boron concentration.

The staff reviewed the safety analysis to verify that a boron dilution event has been analyzed for all plant conditions, such as refueling, startup, power operation, hot standby, hot shutdown, and cold shutdown. DCA Part 2, Tier 2, Section 15.4.6.3.4, Input Parameters and Initial Conditions, states that the limiting cases for Mode 1 include hot zero power (HZP) and hot full power (HFP). The staff notes that TR-0516-49416, Section 7.2.16, Inadvertent Decrease in Boron Concentration, also evaluates intermediate power levels to confirm they are nonlimiting compared to the reactivity insertion rates for dilutions initiated from HFP and HZP conditions.

Mode 1Hot Full Power 15-112

During a boron dilution transient at HFP, reactor power will increase, and RCS temperature and pressure will increase until the reactor trips on high power, high power rate, high PZR pressure, or high RCS riser temperature. The calculations performed by the applicant for this mode of operation use the perfect mixing model (DCA Part 2, Tier 2, Section 15.4.6, Equation 15.4-2) and the wave front model (DCA Part 2, Tier 2, Section 15.4.6, Equation 15.4-3). The applicant determined that the reactivity insertion rates in DCA Part 2, Tier 2, Table 15.4-14 and Table 15.4-15 are bounded by the range of the reactivity insertion rates that are evaluated in the uncontrolled CRA withdrawal analysis presented in DCA Part 2, Tier 2, Section 15.4.1 and 15.4.2, respectively. Mathematical models used by the applicant are discussed further in the following sections related to other modes of operation.

Mode 1Hot Zero Power During a boron dilution transient at HZP, reactor power will increase; however, RCS temperature, pressure, and level remain relatively constant for rapid boron dilution scenarios, as reactor trip occurs quickly on either the high rate or high reactor power setpoint before RCS conditions can degrade. The reactor trip signals that protect the reactor against boron dilution in this mode of operation include high count rate, high power, and high startup rate. The calculations performed by the applicant for this mode of operation use the perfect mixing model and the wave front model. The applicant asserted that a shutdown margin of 771 pcm remained after the DWS isolation.

Mode 2 (Hot Shutdown) and Mode 3 (Safe Shutdown)

For Modes 2 and 3, if the RCS flow rate is less than 48.1 kilograms per second (kg/s)

(763 gpm), the MPS logic ensures that the DWS isolation valves are closed and precludes the possibility of a boron dilution event from a CVCS malfunction. If the RCS flow rate is greater than 48.1 kg/s (763 gpm), the analysis assumes a dilution flow rate of up to 25 gpm from one CVCS makeup pump. This causes a gradual increase in reactor power and ultimately a high subcritical multiplication engineered safety features actuation system signal to close the DWS isolation valves and terminate the boron dilution event. The calculations performed by the applicant for the limiting mode of operation used the wave front model and determined that a shutdown margin of 605 pcm remained after the DWS isolation.

Mode 4 (Transition) and Mode 5 (Refueling)

During Mode 4, a boron dilution event is precluded because the CVCS is disconnected and isolated from the RCS. The applicant also analyzed the potential to dilute the RCS during Mode 5 refueling operations. DCA Part 2, Tier 2, Table 15.4-12, lists internal flooding sources and volumes that have the large potential for dilution. The applicant concluded that a total dilution volume of 444,650 gallons would be required to lose shutdown margin; therefore, reactor pool flooding as a result of pipe breaks and potential flooding sources is nonlimiting and can be accommodated by the initial reactivity condition of keff of 0.90 or less.

Evaluation of Analysis Results In DCA Part 2, Tier 2, Tables 15.4-11 through 15.4-16 present the results of the applicants analysis for the modes of operation. The results of the analysis demonstrate that for Modes 1 through 4, the MPS ensures that the CVCS dilution source is isolated before shutdown margin is lost without the need for operator action. However, the maximum reactivity insertion rate during HFP is bounded by the range of reactivity insertion rates evaluated for uncontrolled CRA 15-113

withdrawal reviewed in Section 15.4.2 of this SER. Likewise, the reactivity insertion rates from a dilution at HZP is bounded by the analysis performed for uncontrolled CRA withdrawal from a subcritical or low-power startup condition (evaluated in Section 15.4.1 of this SER).

The limiting boron dilution event for the potential loss of shutdown margin occurs in Mode 2 when the DWS isolation valves are open because of the time it takes for the MPS to detect the dilution event. The results indicate that limiting loss of shutdown margin occurs at 1,523 minutes; however, the DWS isolation occurs at 1,349 minutes. Therefore, the results show that automatic isolation of the DWS valves terminates the boron dilution before shutdown margin is lost. The staff determined that the analysis meets the guidance in SRP Section 15.4.6 with respect to subcriticality.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.4.6.

The applicant has demonstrated the module protection system will isolate the DWS and terminate a dilution event before the loss of shutdown margin occurs for Modes 1 through 4.

Further, there is not a sufficient flooding source to dilute the reactor pool during refueling operations that could result in the loss of shutdown margin. Thus, the reactor coolant boundary pressure remains below 110 percent of the design value, and fuel cladding integrity is maintained as the minimum DNBR remains above the limit. As documented above, the applicants analyses show that the AOO and SRP acceptance criteria are met. Therefore, the staff concludes that analysis for the decrease in the reactor coolant boron concentration event is acceptable and meets GDC 10, 13, 15, and 26 requirements.

Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position An inadvertent loading and operation of a fuel assembly in an improper position is an IE that can result in reduced CHFR, which may challenge SAFDLs. The staff reviewed DCA Part 2, Tier 2, Section 15.4.7, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position, to ensure that this event was analyzed appropriately and does not result in unacceptable consequences.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information in Section 15.4.7, summarized below.

An inadvertent loading and operation of a fuel assembly in an improper position is an IE that could affect power distribution and power peaking of the reactor core. If undetected, such an event could lead to reduced CHFR and reduced margin to fuel centerline melt.

An inadvertent loading and operation of a fuel assembly in an improper position is not expected to occur during the lifetime of the reactor because of fuel loading controls and procedures. The 15-114

in-core instrumentation detects all fuel misloads that result in power shape deviations greater than the detection thresholds, but not all misloads are detectable.

The applicant analyzed a spectrum of fuel misload configurations, including shuffle misloads and 180-degree rotational misloads, using SIMULATE5 to compute core power distributions, identify the limiting undetectable fuel misload, and inform the radial power peaking augmentation factor used as input to the subchannel analysis. The applicant performed the subchannel analysis using VIPRE-01 to obtain MCHFR and fuel centerline temperatures. The applicant concluded that all SRP Section 15.4.7, Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position, acceptance criteria are met and that no fuel damage is expected.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS applicable to this area of review are listed in Section 15.0.0 of this SER.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to providing instrumentation to monitor variables over anticipated ranges for normal operations, AOOs, and accident conditions The guidance in SRP Section 15.4.7 lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:
  • Plant operating procedures should include a provision requiring that reactor instrumentation be used to search for potential fuel-loading errors after fueling operations.
  • If the error is not detectable by the instrumentation system and fuel rod failure limits could be exceeded during normal operation, offsite consequences should be a small fraction of the 10 CFR Part 100 criteria. For the purpose of a design certification review, the staff applies the 10 CFR 52.47(a)(2)(iv)(A) and (B) criteria. A small fraction is interpreted to be less than 10 percent of the 10 CFR 52.47(a)(2)(iv)(A) and (B) reference values.

The applicant classified the inadvertent loading and operation of a fuel assembly in an improper position as an IE considering existing fuel-handling controls and procedures. While operating procedures that apply subsequent to the initial fuel load and startup are deferred to the COL stage, as described in DCA Part 2, Tier 2, Chapter 13, Conduct of Operations, the staff identified two initial startup tests in DCA Part 2, Tier 2, Chapter 14, related to this review section. The acceptance criterion for the Initial Fuel Load Test (Test # 76) states that each fuel assembly and control component is installed in the location specified by the design of the initial reactor core, which provides reasonable assurance that a misload will be prevented for the 15-115

initial plant startup. The Core Power Distribution Map Test (Test # 91) specifies taking core power maps at 25-, 50-, 75-, and 100-percent power to verify that the power distribution is consistent with design predictions and TS limits.

In addition, DCA Part 2, Tier 2, Section 4.3.2.2.8, Testing, describes startup physics testing and states, in part, that power distributions must be confirmed for each newly loaded core. This confirmation is achieved by comparing measured and predicted core neutron flux at low, intermediate, and higher power levels. Test # 91 for the first cycle and startup physics testing for subsequent cycles provide reasonable assurance that any fuel-loading errors severe enough to exceed the in-core instrumentation detection threshold will be detected during plant startup.

GTS LCO 3.2.1, which applies during plant operation at and above 25 percent rated thermal power, limits the enthalpy rise hot channel factor (FH) to the value specified in the core operating limits report. The value of FH is computed continuously based on measurements from the in-core instrumentation and is displayed in the control room, and it must be verified after each refueling and in accordance with the surveillance frequency control program. DCA Part 2, Tier 2, Table 16.1-1, Surveillance Frequency Control Program Base Frequencies, provides a base frequency of 31 effective full power days. This LCO and associated surveillance frequency provide reasonable assurance that the actual FH will remain within the limiting value assumed within the safety analyses.

However, not all fuel-loading errors are detectable. In particular, the in-core instrumentation will detect all fuel assemblies that are 44 percent above or 35 percent below their predicted power, though it may detect some misloads before these thresholds are reached.

The consequences of a fuel-loading error vary based on the reactivity of the misloaded fuel.

Interchanging fuel assemblies with large reactivity differences would result in higher power peaking and lower MCHFR. Therefore, the applicant considered a spectrum of fuel assembly misloads to identify the limiting misload that is undetectable by the in-core instrumentation.

The staffs review of the applicants evaluation model, input parameters and initial conditions, and analysis results is provided in the following paragraphs.

Evaluation Model The applicant performed neutronics analysis with the three-dimensional, steady-state solver, SIMULATE5, to identify the limiting undetectable fuel misload and obtain the associated radial peaking augmentation factor. As discussed in SER Section 4.3, Nuclear Design, the staff finds the applicants use of SIMULATE5 for neutronic analysis acceptable.

The applicant performed the subchannel analysis using VIPRE-01 with the NSP4 CHF correlation and a bounding radial peaking augmentation factor as input. As discussed in the subchannel methodology topical report, TR-0915-17564, cycle-specific nuclear analyses will confirm that the analyzed bounding radial peaking augmentation factor is not violated.

Section 15.0.2 of this SER further discusses the VIPRE-01 code.

Because thermal-hydraulic conditions remain constant for this event, a transient analysis using NRELAP5 is not necessary.15-116

Input Parameters, Initial Conditions, and Assumptions The applicant considered a spectrum of 231 potential shuffle misloads (i.e., swapping two fuel assemblies), including quarter-core, half-core, and cross-core configurations. The applicant also examined rotational misloads by rotating fuel assemblies by 180 degrees, even though fuel alignment features would preclude such rotation. The staff finds this analyzed spectrum of fuel misloads acceptable because it adequately covers the possible misloading scenarios.

The applicant did not consider misloads resulting from unprescribed enrichment or burnable poisons. The staff notes that the DCA references a fabricated fuel design, and fuel fabrication is subject to quality assurance requirements. Furthermore, a licensee will procure the fuel under a quality assurance process. Therefore, fuel with unprescribed enrichment or burnable poisons will not be available at the reactor site and need not be considered in the misload analysis.

The applicant referred to the subchannel analysis methodology topical report, TR-0915-17564, for other key inputs and assumptions used in the subchannel analysis. TR-0915-17564 has been approved by the staff (ADAMS Accession No. ML19067A256). The staff notes that the example biases for core exit pressure and core inlet temperature in TR-0915-17564 are smaller than those in DCA Part 2, Tier 2, Table 15.0-6. However, the staff confirmed through an audit, as discussed in the associated audit documentation (ADAMS Accession No. ML19004A098),

that the applicant used biases consistent with DCA Part 2, Tier 2, Table 15.0-6, in the subchannel analysis. Therefore, the staff finds that the applicant used conservative input parameters, initial conditions, and assumptions for the fuel misload analysis.

Evaluation of Analysis Results The staff reviewed the results in DCA Part 2, Tier 2, Section 15.4.7, to determine if they meet the SRP acceptance criteria. The applicant determined the limiting undetectable misload to be a swap of a fuel assembly on the core periphery with an adjacent assembly closer to the center of the core. The applicant verified that a radial peaking augmentation factor analysis value of 1.25 bounds the radial peaking augmentation factor resulting from the limiting undetectable misload. Rotational misloads are nonlimiting because the resulting change in power distribution is much less than that of a shuffle misload.

DCA Part 2, Tier 2, Table 15.4-20, presents the MCHFR and LHGR assuming a bounding radial peaking augmentation factor of 1.25. The staff confirmed that the MCHFR remains above the 95/95 analysis limit of the NSP4 CHF correlation, and the LHGR remains well under the design limit. Because the SAFDLs are met, and because this event does not involve coolant leakage, no fission product release is postulated. Therefore, radiological evaluation and analysis to determine compliance with 10 CFR 52.47(a)(2)(iv)(A) and (B) are not necessary for the NuScale design.

Table 15.4.7-1 below provides the COL information items related to this review section and their descriptions. COL Items 13.5-2 and 13.5-5 provide for the development, implementation, control, and description of operating procedures. Operating procedures typically include fuel loading and startup physics testing procedures. The detailed staff review of these proposed COL items is performed in SER Chapter 13, Conduct of Operations.15-117

Table 15.4.7-1 NuScale COL Information Items related to Section 15.4.7 DCA Part 2, COL Item Description Tier 2 No.

Section A COL applicant that references the NuScale Power Plant design certification will describe the site-specific procedures that operators use in the main control room and locally in the plant, including normal operating 13.5-2 13.5.2 procedures, abnormal operating procedures, and emergency operating procedures. The COL applicant will describe the classification system for these procedures, and the general format and content of the different classifications.

A COL applicant that references the NuScale Power Plant design certification will provide a plan for the development, implementation, and 13.5-5 control of operating procedures, including preliminary schedules for 13.5.2 preparation and target dates for completion. Additionally, the COL applicant will identify the group within the operating organization responsible for maintaining these procedures.

The staff has evaluated the consequences of a spectrum of postulated fuel-loading errors. The staff concludes that some errors are detectable by the available instrumentation (and hence remediable). The in-core instrumentation will be used after each refueling to confirm that power distributions and FH are consistent with design predictions, and FH is periodically verified during operation. Furthermore, the applicant has included safe fuel loading procedures and low power physics tests in its initial plant test program as well as COL items that address development of operating procedures that typically cover fuel loading and reload physics testing. Therefore, the applicant has met the requirements of GDC 13 with respect to having adequate provisions to minimize the potential of a misloaded fuel assembly going undetected.

The staff further concludes that the applicants analysis provides reasonable assurance that no fuel rod failures will result from undetectable fuel-loading errors. For this reason, the applicant does not need to provide radiological evaluation and analysis to demonstrate compliance with 10 CFR 52.47(a)(2)(iv)(A) and (B).

Spectrum of Rod Ejection Accidents (Pressurized-Water Reactor)

The applicant postulated the ejection of a control rod assembly (CRA) resulting from a mechanical failure that causes an instantaneous circumferential rupture of the control rod drive mechanism (CRDM). The CRA ejection adds positive reactivity to the core, which results in a rapid power increase for a short period of time. The power rise is limited by the Doppler feedback. Reactor shutdown is initiated by the MPS upon receipt of a reactor trip (i.e., high core power, high core power rate, high steam superheat, or high RCS pressure trip) shortly after the CRA ejection. This event is classified as a postulated accident in Table 15.0-1 of DCA Part 2, Tier 2. This classification is consistent with SRP Section 15.0.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.15-118

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2 information, summarized below.

The applicant analyzed the CRA ejection event using six different initial powers: 0, 25, 50, 70, 80, and 100 percent. Each power level was investigated at beginning of cycle (BOC), middle of cycle (MOC), and end of cycle (EOC). The applicant evaluated the event using several codes, including SIMULATE5 to determine the peaking factors and limiting CRA worth during the CRA ejection event and SIMULATE-3K to determine the transient core average power response.

The applicant obtained the nuclear steam supply system response using NRELAP5 and used VIPRE-01 to perform the minimum critical heat flux ratio (MCHFR) calculation. A conservative adiabatic heatup model was also used to calculate the fuel rod enthalpy during the Rod Ejection Accident (REA). MCHFR calculations used the NSP4 CHF correlation. The NuScale methodology does not permit any fuel failures resulting from MCHFR criteria. No fuel failures were calculated as a result of a CRA ejection.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following GTS are applicable to this area:

  • the GTS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and appropriate controls to maintain these variables and systems within prescribed operating ranges
  • 10 CFR Part 50, Appendix A, GDC 28, as it relates to the effects of postulated reactivity accidents that result in neither damage to the RCPB greater than limited local yielding nor sufficient damage to significantly impair core cooling capacity The guidance in SRP Section 15.4.8, Spectrum of Rod Ejection Accidents (PWR), lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following document also provides additional criteria or guidance in support of the SRP acceptance criteria to meet the requirements:

  • RG 1.77, Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors, Revision 0 The applicant proposes CRA ejection accident regulatory criteria in topical report TR-0716-50350, Rod Ejection Accident Methodology, Revision 1, December 30, 2016 15-119

(ADAMS Accession No. ML16365A242), which the NRC staff has reviewed, subject to the limitations and conditions in its SER (ML19319C684). The criteria, summarized in DCA Part 2, Tier 2, Section 15.4.8.3.3, cover fuel cladding failure, core coolability, and RCS peak pressure.

See section 15.0.6.4.3 of this report for a discussion of this event relative to GDC 27 and associated PDC 27.

Evaluation Model The evaluation model is presented in topical report TR-0716-50350, referenced in DCA Part 2, Chapter 15. The applicant used several codes in the evaluation model for the REA event including SIMULATE5, SIMULATE-3K, NRELAP5, VIPRE-01, and an adiabatic heatup fuel response hand calculation:

SIMULATE5 SIMULATE5 is a three-dimensional, steady-state, nodal diffusion, reactor simulator code used to solve the multigroup nodal diffusion equation. SIMULATE5 provides the steady-state nuclear analysis parameters used to initiate SIMULATE-3K.

SIMULATE-3K SIMULATE-3K is a three-dimensional nodal reactor kinetics code that couples core neutronics with detailed thermal-hydraulic models to model transient neutronic analysis of the REA at various times in core life, power level, CRA positions, and initial core conditions.

NRELAP5 The NuScale NRELAP5 code is based on the Idaho National Laboratory RELAP5-3D code, Version 4.1.3. NRELAP5 addresses unique aspects of the NuScale design and licensing methodology. NuScales NRELAP5 includes models for characterization of hydrodynamics, heat transfer between structures and fluids, modeling of fuel, reactor kinetics models, and control systems. It is used to calculate the dynamic system response and peak RCS pressure and to provide input to the VIPRE-01 subchannel CHF evaluation.

VIPRE-01 VIPRE-01 was developed based on the COBRA family of codes from Pacific Northwest Laboratories. It is used to evaluate nuclear reactor parameters MCHF.

The validation and applicability of these codes to the NuScale design is described in DCA Part 2, Tier 2, Section 15.0.2, topical report TR-0516-49416 Non-Loss-of-Coolant Accident Analysis Methodology, Revision 2 (ML19331A516), topical report TR-0516-49422, Loss-of- Commented [A21]: Issuance of the final approved -A Coolant Accident Evaluation Model, Revision 1, issued November 2019 (ADAMS Accession version of this topical report is a Confirmatory Item.

No. ML19331B585) and topical report TR-0716-50350, Rod Ejection Accident Methodology, Commented [A22]: Issuance of the final approved -A Revision 1, December 30, 2016 (ADAMS Accession No. ML16365A242). The staffs evaluation version of this topical report is a Confirmatory Item of the validation and applicability for these codes is found in the respective SERs for the topical reports.

Input Parameters and Initial Conditions The applicant analyzed peak RCS pressure, MCHF, and fuel rod temperature and enthalpy.

The analysis covers HZP; power at 25, 50, 70, and 80 percent; and full power. Each power 15-120

level includes BOC, MOC, and EOC conditions. DCA Part 2, Tier 2, Section 15.4.8.3.2, presents the input parameters and initial conditions for the models. The staff compared the input values and initial conditions used against the methodology presented in TR-0716-50350 (ADAMS Accession No. ML ML19319C684). The staff finds that the inputs and initial conditions used to analyze the NuScale response to a rod ejection accident were consistent with the methodology.

Evaluation of Analysis Results The applicants analysis shows that maximum core power is reached within a second from initiation of the REA event and is limited by Doppler feedback. Additionally, the applicants analysis results show some of the conservative inputs such as the conservative scram characteristics per the methodology such as a 2-second delay before dropping the rods into the core. As noted in the following discussion, the analysis results may be affected by the closeout of any open items. However, the results are summarized in the following paragraphs.

Peak Pressure The applicant calculated the peak pressure in the RCS to be 2,160 psia, which is below the RPV limit of 2,520 psia. Therefore, the staff finds that the peak pressure criterion is met.

Fuel Cladding Failure The applicant performed the MCHFR calculations at initial conditions corresponding to HZP and 25-, 50-, 70-, 80-, and 100-percent power. Each power level was investigated at BOC, MOC, and EOC conditions. The limiting MCHFR is 1.838, which is above the design limit.

Therefore, the applicants analysis shows that no fuel cladding violates the MCHFR criterion.

The applicant calculated the peak radial average fuel enthalpy at zero power conditions to be 49.1 calories per gram (cal/g). The hot zero power high temperature cladding failure limit is defined as 100 cal/g in TR-0716-50350 (ADAMS Accession No. ML19319C684). Therefore, the limit is met.

Per TR-0716-50350, the PCMI failure threshold limit is 75 cal/g. The applicant calculated the maximum change in peak radial average fuel enthalpy as 27.8 cal/g, which is below the limit.

Core Coolability The staff reviewed the fuel temperature and peak radial average fuel enthalpy evaluation models summarized in DCA Part 2, Section 15.4.8.3.1, and confirmed that the applicants analysis followed the fuel temperature methodology as presented in the referenced topical report TR-0716-50350 (ADAMS Accession No. ML19319C684).

The applicant discussed the fuel and cladding integrity results in DCA Part 2, Section 15.4.8.3.4.

The analysis presented includes various initial power levels and times in cycle, which is consistent with the guidance in SRP Section 15.4.8, Revision 3.

The applicants analyses result in a limiting peak radial average fuel enthalpy of 84 cal/g, which corresponds to an initial power of 80 percent at BOC conditions. This value is below the limit of 230 cal/g provided in TR-0716-50350.15-121

The applicant calculated the limiting peak fuel temperature to be 1,285 °C (2,345 °F), which is below the fuel melting temperature.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.4.8.

The staff reviewed the control rod ejection accident, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the accident. Through this review, the staff verified that the applicant provided sufficient information and that the review supports the conclusions as discussed in section 15.4.8.4.

The staff concludes that the applicant meets GDC 13 requirements in terms of the rod ejection accident analysis by demonstrating that all credited instrumentation was available, and that actuations of protection systems, automatic and manual, occurred at values of monitored parameters that were within the instruments prescribed operating ranges. The staffs review of the instrumentation is provided in Chapter 7, Instrumentation and Control, of the SER.

The staff also concludes that the applicant meets GDC 28 requirements for prevention of postulated reactivity accidents that could result in damage to the reactor coolant pressure boundary greater than limited local yielding or result in sufficient damage to impair the core cooling capability significantly. The requirements are met by the use of the approved methodology and demonstrating compliance with the prescribed limits. The staff has evaluated the applicants analysis of the assumed control rod ejection accident and finds the assumptions, calculation techniques, and consequences acceptable. As the calculations demonstrate peak fuel temperatures below melting conditions, prompt fuel rupture with consequent rapid heat transfer to the coolant from finely dispersed molten UO2 presumably did not occur. The pressure surge results in a pressure increase below pressure limits for the maximum control rod worths assumed. The staff believes that the calculations are sufficiently conservative, both in initial assumptions and analytical models to maintain primary system integrity.

Spectrum of Rod Drop Accidents (Boiling-Water Reactor)

This event is specific to BWRs and therefore does not apply to the NPM design. The PWR equivalent of a rod drop is rod ejection, which is discussed in SER Section 15.4.8. SER Section 15.4.3 discusses control rod misoperations, including a dropped CRA.

15.5 Increase in Reactor Coolant Inventory Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory A CVCS malfunction may cause an increase in the RCS inventory and pressure. The relatively cold makeup water combined with a negative moderator temperature coefficient can increase core reactivity. For limiting scenarios, the RCS pressure or level increase results in a reactor trip. The applicant classified this event as an AOO, which is consistent with the design specific review standard (DSRS) for the NuScale small modular reactor design.15-122

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided DCA Part 2, Tier 2, information, summarized below.

The applicant identified the malfunction of the two 20 gpm CVCS makeup pumps that maximize makeup flow as the limiting scenario for a CVCS malfunction that increases RCS inventory.

The applicant stated that no single failure, including any loss of ac or dc power, would result in a more serious outcome for the increase in RCS inventory events. The thermal hydraulic analysis of the NPM response to the event was performed using NRELAP5, and the subchannel critical heat flux (CHF) analysis was performed using VIPRE-01. The applicants analysis resulted in a peak RCS pressure of 2,160 psia (93.5% of limit), a peak SG pressure of 1,430 psia (61.9 percent of limit), and an MCHFR of 2.702 (compared to the safety limit and minimum value of 1.284).

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following GTS are applicable to this area of review:

  • LCO 3.4.10, Low Temperature Overpressure Protection (LTOP) Valves; and
  • the GTS listed in Section 15.0.0 of this SER.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain relevant requirements for this review:

  • 10 CFR 52.47(a)(2), which requires evaluations to show that safety functions will be accomplished. Descriptions shall be sufficient to permit understanding of the system design relationships to the safety evaluations.
  • 10 CFR Part 50, Appendix A, GDC 10, which requires that the reactor core and associated coolant control, and protection systems be designed with appropriate margin to ensure that SAFDLs are not exceeded during any condition of normal operation, including the effects of AOOs.
  • 10 CFR Part 50, Appendix A, GDC 13, which requires, in part, that instrumentation shall be provided to monitor variables and systems over their anticipated ranges for AOOs, as appropriate, to ensure adequate safety. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 15, which requires that the RCS and its associated auxiliary control and protection systems be designed with sufficient margin to assure that the design conditions of the RCPB are not exceeded during any condition of normal operations, including AOOs.15-123

DSRS Sections 15.5.1 - 15.5.2, Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory, list the following AOO acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs based on acceptable correlations (see DSRS Section 4.4).
  • An AOO should not generate a more serious plant condition without other faults occurring independently.

The applicant organized Section 15.5.1 of DCA Part 2, Tier 2, Chemical and Volume Control System Malfunction, to reflect the DSRS. This technical evaluation is organized accordingly.

Identification of Causes and Accident Description The applicant identified the malfunction of the CVCS makeup pumps resulting in 40-gpm makeup (and zero letdown) as the limiting scenario for the increase in RCS inventory. The applicant stated in the non-LOCA methodology topical report, TR-0516-49416, that the pump malfunction could be caused by a spurious PZR water-level signal. The applicant classified this event as an AOO, which is consistent with the DSRS. The case of a CVCS malfunction resulting in a boron dilution event is evaluated in SER Section 15.4.6.

Sequence of Events and Systems Operation The increase in reactor coolant inventory event terminates with automatic reactor trip on high PZR pressure or high PZR level, CVCS isolation on high PZR level or RCS low-low flow, and DHRS actuation on high PZR or steamline pressure. The applicant credited these automated safety functions (e.g., CVCS isolation, Secondary System Isolation), and did not credit operator action to mitigate this event. The sequence of automatic actions depends on the set of initial conditions. The applicant stated that its analysis assumed the availability of ac (ELVS) and dc (EDNS and EDSS) power because the CVCS cannot function without ELVS or EDNS power, and the CVCS flow pathways are isolated on a loss of EDSS. The staff agrees that this is a conservative assumption because loss of any of those power supplies would terminate the CVCS flow addition event and be non-limiting. The sequence of events is documented in Section 15.5.1 of DCA Part 2, Tier 2, Table 15.5-1, Sequence of Events CVCS Malfunction Limiting SG Pressure (Pressurizer Spray Available), Table 15.5-2, Sequence of Events CVCS MalfunctionLimiting RCS Pressure (No Pressurizer Spray), Table 15.5-3, Sequence of Events CVCS Malfunction-limiting MCHFR (No Pressurizer Spray), and Figure 15.5-1, Pressurizer LevelIncrease in RCS Inventory (No PZR Spray) through Figure 15.5-10, Minimum Critical Heat Flux RatioIncrease in RCS Inventory (No PZR Spray).15-124

Evaluation Model The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5, to analyze the thermal hydraulic response to the event. In addition, the applicant performed a subchannel analysis using the VIPRE-01 code to identify the limiting MCHFR. Section 15.0.2 of this SER describes the staffs evaluation of these codes.

Input Parameters, Initial Conditions, and Assumptions The applicant conducted sensitivity studies to determine the initial conditions that maximize RCS and SG pressure and minimize MCHFR. The initial conditions included the core thermal power, RCS pressure, RCS temperature, PZR level, RSV setpoint, CVCS isolation valve closure time, CVCS makeup fluid temperature, coefficients of reactivity, maximum regulating control rod speed, minimum RCS flowrate, and the availability of PZR spray.

The staff agrees that the applicants limiting sets of initial conditions are conservative for the following reasons: (1) the applicant provided a conservative basis for each initial condition, (2) the applicant demonstrated with sensitivity studies, listed in the nonLOCA- topical report, that reasonable variations of the initial conditions did not significantly alter the peak pressures, and (3) the applicant assumed the secondary system containment isolation valves closed after 0.1 second, which is conservative because it ignored the actuation delays listed in DCA Part 2, Tier 2, Table 15.07 and resulted in increased system heat up and pressurization.

The staff agree that the applicants total makeup flow rate of 40 gpm is suitably conservative.

The capacity of each of the two CVCS makeup pumps is 20 gpm; the makeup flow rate of 40 gpm assumes each pump operates at full capacity. The applicant did not add additional makeup flow to account for potential uncertainties in the pump flow rate. The staff reviewed this assumption and agree it is suitably conservative for the following reasons. (1) A small increase in makeup flow to account for uncertainty is not expected to impact peak RCS pressure because RCS pressure is limited by release of RCS inventory to containment by actuation of one of the two RSVs. Additional makeup flow to account for pump uncertainty would be significantly less than the capacity of each RSV (63,360 lbm/hr). (2) Limiting SG pressure is 61.9% of the limit (2310 psia) and has significant margin for small variations in primary makeup flow rate. (3) Minimum MCHFR occurs at the initiation of the event and is insensitive to small variations in makeup flow.

Evaluation of Analysis Results The applicant demonstrated that pressure in the reactor coolant and main steam system remained below 110 percent of the design values and the MCHFR remained above the design minimum. The staff confirmed that the automatic actions credited occurred while the MPS instrumentation was within its range. The applicants analysis also demonstrated that the NPM reached a stable, safe condition after the CVCS malfunction. SER Section 15.0 addresses considerations for a return to power.

Radiological Consequences Based on the results of the analysis and barrier performance, the applicant concludes, and the staff agree, that there are no radiological consequences for this AOO.15-125

There are no COL information items associated with Section 15.5 of DCA Part 2, Tier 2.

The staff reviewed the CVCS malfunction event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. The staff concludes that that the DSRS acceptance criteria are met and therefore the consequences of the CVCS malfunction event meet the requirements set forth in GDCs 10, 13, 15, and 26, and 10 CFR 52.47(a)(2).

15.6 Decrease in Reactor Coolant Inventory Inadvertent Opening of a Pressurizer Safety Valve or an Automatic Depressurization Valve DCA Part 2, Tier 2, Section 15.6.1, Inadvertent Opening of a Reactor Safety Valve, states that an inadvertent opening of an RSV has the same thermal-hydraulic effects as, and is bounded by, an inadvertent opening of an RVV. The staff notes that the RSVs and RVVs are both located on top of the RPV, meaning the thermal-hydraulic conditions to which both sets of valves are exposed are highly similar. In addition, the RVV opening size, which is larger than that of an RSV, presents a greater challenge in terms of mass and energy release. Therefore, the staff agrees with and confirms the applicants conclusion that the inadvertent opening of an RSV is bounded by the inadvertent opening of an ECCS valve, which is analyzed in DCA Part 2, Tier 2, Section 15.6.6.

Nonradiological Consequences of the Failure of Small Lines Carrying Primary Coolant outside Containment A break or leak from a line connected to the reactor coolant system (RCS) that penetrates containment can cause a direct release of reactor coolant outside containment. The staffs review in this section of the SER focuses on the nonradiological aspects of this event (e.g., RCS mass release, break location, fuel integrity) to ensure that conservative and bounding thermal-hydraulic inputs are used in the radiological aspect of this event. Section 15.0.3 of this SER documents the review of the radiological aspect of this event.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.2, Failure of Small Lines Carrying Primary Coolant outside Containment.

Lines that carry primary coolant outside containment are the chemical and volume control system (CVCS) lines: makeup and letdown lines, pressurizer spray lines, and RPV high point degasification line. Failure of lines carrying primary coolant outside containment is a non-mechanistic break in the CVCS makeup line, CVCS letdown line, or pressurizer spray line. The containment isolation valves on the RPV high point degasification line are normally closed, therefore, a break in this line outside containment is not considered. The applicant stated that a 15-126

break in the pressurizer spray lines was determined to be bounded by the CVCS makeup and letdown lines based on size and location. To determine the most severe consequences of the failure of lines carrying primary coolant outside containment, the applicant analyzed a spectrum of break sizes and locations for the CVCS makeup and letdown lines. Primary coolant is released from the break into the reactor building until CVCS containment isolation valves close.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

The following NRC regulations contain the relevant requirements for this review:

The guidance in SRP Section 15.6.2, Radiological Consequences of the Failure of Small Lines Carrying Primary Coolant Outside Containment, lists the non-radiological acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants small primary coolant line failure outside containment analysis.

Causes In DCA Part 2, Tier 2, Section 15.6.2, the applicant stated that the small lines carrying primary coolant outside containment are the CVCS makeup and letdown lines, PZR spray line, and the RPV high-point degasification line. These lines extend from the RPV through the containment vessel (CNV) and include double isolation capability by means of containment isolation valves.

The applicant states that valves isolate on a containment isolation signal, or a low-low pressurizer level, low-low pressurizer pressure or low-low-RCS flow signals. Failure of these lines is evaluated for both thermal-hydraulic and radiological consequences. A non-mechanistic break in these lines is considered. The applicant states that breaks in the RPV high-point degasification line and the PZR spray line were determined to be bounded by the CVCS makeup and letdown lines and therefore are not addressed. The staff confirmed that a break in either of these lines is bounded by the CVCS makeup and letdown lines with respect to this events acceptance criteria. The staff finds the applicants assessment of causes leading to the event acceptable because it considered a spectrum of CVCS breaks in different locations throughout the system.15-127

Methodology In the failure of small lines carrying primary coolant outside containment analyses, the staff notes that the applicant evaluated a spectrum of break sizes and locations. The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER to analyze the thermal-hydraulic response to the event.

The applicant did not perform a CHF calculation for this event. DCA Part 2, Tier 2, Section 15.6.2.5, states that the MCHFR response for this event is bounded by the rapid depressurization event in DCA Part 2, Tier 2, Section 15.6.6. The staff notes that the behavior of important parameters to MCHFR (e.g., reactor power, RCS flow, core inlet temperature, core exit pressure) for a break in a small line carrying primary coolant is less limiting than for other MCHFR-challenging events, such as cooldown and reactivity insertion events. In addition, fuel temperature decreases upon reactor trip, and the core water level remains well above the top of the active fuel for the failure of small lines carrying primary coolant outside containment event.

For these reasons, the staff finds that the potential for fuel failure is precluded for this event.

The staffs evaluation of the radiological effects of failure of small lines carrying primary coolant outside containment is documented in Section 15.0.3 of this SER.

Model Assumptions, Input, and Boundary Conditions The applicants analyses assume that ESFs perform as designed, with allowance for instrument uncertainty, unless otherwise noted. No operator action is credited to mitigate the effects of line breaks outside containment. In addition, no external power source is credited.

The applicant evaluated various inputs and assumptions to determine the limiting break scenario with respect to radiological and thermal-hydraulic consequences. The results are presented in graphical form. The maximum mass and energy release scenario identified is a break in the CVCS letdown line outside containment with a coincident loss of normal ac power.

The staff reviewed the applicants single-failure assumptions regarding this event. The staff confirmed that the applicant considered and analyzed single failures for each case of the event.

Evaluation of Analysis Results In these analyses, reactor trip and DHRS actuation occur, but the ECCS trip setpoints are not reached. Upon isolation of the break, a normal shutdown of the module proceeds using the DHRS. The mass and energy releases to the reactor building are maximized in order to conservatively maximize the potential radiological consequences. The applicants results presented in DCA Part 2, Tier 2, Section 15.6.2.3.3, show that the reactor water level remains well above the top of the active fuel and that the core remains subcritical for all break cases and with all power assumptions. The RCS and fuel temperatures stabilize following the breaks and continue to decline.

The staff audited the applicants calculations supporting this DCA section (ADAMS Accession No. ML19270G302 and ML19004A098) and consider them to be reasonable.

The staff finds that the maximum mass and energy releases calculated by the applicant are appropriate for purposes of input into the downstream radiological analysis. The staff also finds that fuel integrity is maintained during this event because the water level in the reactor vessel remains above the top of the core.15-128

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.2.

The staffs evaluation of the radiological effects of failure of small lines carrying primary coolant outside containment is documented in Section 15.0.3 of this SER, which address the regulatory requirements in 10 CFR 52.47(a)(2)(iv)(A) and 10 CFR 52.47(a)(2)(iv)(B).

As documented above, for this event sequence, the staff determined that the applicants analysis demonstrates that the SRP acceptance criteria are met. Therefore, the staff concludes that the consequences of failure of small lines carrying primary coolant outside containment meet the relevant requirements set forth in GDC 10 and 55, with respect to this event.

Steam Generator Tube Rupture A steam generator tube rupture (SGTR) is a postulated accident caused by a rapid propagation of a circumferential crack that leads to a double-ended rupture of the tube. Reactor coolant passes from the primary side of the SG into the secondary side and travels through the main steamlines to the turbine into the environment. A secondary criterion is to prevent overfill of the SG secondary to prevent water from entering the steamlines and potentially preventing closure of the main steam isolation valves (MSIVs).

Radionuclides contained in the primary coolant are discharged through the failed tube until the faulted SG is isolated by automatic closure of the MSIVs.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.3, Steam Generator Tube Failure (Thermal Hydraulic).

The applicant analyzed the SGTR event in terms of margin to fuel thermal design limits and maximized radiological consequences. Analyses were performed for many scenarios, including with and without power available, to ensure that the most limiting conditions are considered.

The applicant evaluated this event using NRELAP5 to obtain the NPM thermal-hydraulic responses in accordance with Topical Report TR-0516-49416, Non-Loss-of-Coolant Accident Analysis Methodology. The applicant determined the SGTR coincident with power available to be limiting in terms of MCHFR and radiological consequences. The applicant determined that the MCHFR is above the 95/95 DNBR limit; hence, no fuel failure is predicted to occur. The applicants DCA Part 2 analysis also concludes that, with conservative initial conditions, the SGTR event can be controlled by no operator actions with radiological releases remaining below 10 CFR Part 100, Reactor Site Criteria, regulatory limits (or within the limits of 10 CFR 50.67, Accident Source Term, for alternate source term) and that the affected SG liquid level increase does not lead to more severe consequences (i.e., the MSIV is unable to close).15-129

It is also important to note that the design of the helical coil SGs, as described in DCA Part 2, Section 5.4, is different from conventional PWR design SGs in that the primary coolant is located on the outside (shell side) of the tubes. Thus, the volume of the secondary inventory is considerably smaller than in conventional designs, increasing the potential for SG overfill and other differences in transient responses.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The following GTS are applicable to this area of review:

  • the GTS listed in Section 15.0.0 of this SER Technical Reports: There are no technical reports associated with this section of DCA Part 2.

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, GDC 19, as it relates to the requirement that a control room be provided from which personnel can operate the nuclear power unit during both normal operating and accident conditions, including a LOCA.
  • 10 CFR Part 50, GDC 34, as it relates to the requirement that a system to remove residual heat shall be provided. The system safety function shall be to transfer fission product decay heat and other residual heat from the reactor core at a rate such that SAFDLs and the design conditions of the RCPB are not exceeded.

DSRS Section 15.0.3 and SRP Section 15.6.3, Radiological Consequences of Steam Generator Tube Failure, list the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • Affected SG time to isolate and unaffected SG(s) until cold shutdown is established should be identified.
  • The potential for fuel failures and the core thermal margins resulting from the postulated accident should be verified.
  • It should be verified that the most severe case has been considered with respect to the release of fission products and calculated doses.15-130

Evaluation Model The event is initiated by the failure of an SG tube that causes a decrease in PZR pressure and level. The applicant used the non-LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.4 and Revision 2 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event.

The non-LOCA topical report reviews highly ranked phenomena related to SGTR ((

)). The helical coil SG modeling methodology relies on benchmarks to KAIST, SIET, and NIST-1 separate effects tests HP-03 and HP-04 for code validation.

The SGTR NRELAP5 model is developed from the NPM base plant base model with an averaged lumped core with point kinetics used to calculate reactivity feedback to the core power from the moderator, fuel, and decay heat. The model simulations are performed using event-specific conservatisms.

Input Parameters, Initial Conditions, and Assumptions The applicant conducted sensitivity studies to identify the limiting input conditions to identify the most challenging break location, main steam pressure, SG tube plugging, loss of power, single failure, feedwater temperature, and reactor coolant temperature and pressure with respect to total mass released and iodine spiking duration for the SGTR transient. The iodine spiking duration is the time calculated between reactor trip and isolation of the affected SG.

The staff reviewed the initial parameter values and biases and noted that the applicant assumed suitably conservative parameters that maximize the consequences of the maximum release event, including a 102-percent initial core power level, maximum RCS temperature and pressure, low steam pressure, high pool temperature, and single failure of the primary MSIV.

Additionally, different assumptions were used for cases that target maximum iodine spiking, maximum primary pressure, and maximum secondary pressure. For each analysis performed, the applicants evaluations of the SGTR event considered a range of initial conditions, biases,15-131

and conservatisms including loss of AC power, single failure (e.g., for peak RCS pressure, no failure of the affected SG primary MSIVs is conservative).

As discussed in the associated audit documentation, the staff audited the applicants SGTR sensitivity studies, which investigated the most limiting initial conditions and loss of power assumptions, to confirm that they led to the most limiting results (ADAMS Accession No. ML19270G302 and ML19004A098). The audited material supports the discussions in the DCA, and the staff finds that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for the MCHFR and radiological mass releases.

No operator action is assumed; however, the staff noted that the secondary MSIVs that are required to isolate the leakage are non-safety-related valves, as shown in DCA Part 2, Tier 2, Table 3.2-1. This approach extends beyond the existing staff position for crediting non-safety-related components as a backup when assuming a single failure. Specifically, NUREG-0138, Issue 1 allows flexibility in the acceptance of non-safety grade (i.e., non-safety-related) equipment for failures of secondary system piping, in part, because they have a significantly lower potential for release of fission products than a breach of the primary system boundary like the SGTR event. The staff reviewed the basis for crediting the secondary MSIVs for event mitigation, design descriptions and specifications, augmented quality and testing requirements in DCA Part 2, Tier 2 Table 3.2-1 and Table 3.9-17, and DCA Part 2, Tier 2 Section 3.9.6.5, Section 10.3.2.2, Section 15.0.0.6.6 and associated technical specifications. In addition, in letter dated July 9, 2018 (ML18190A509) the applicant provided the results of a sensitivity calculation performed to demonstrate that a failure of the secondary MSIVs to close during a SGTR event would not result in exceeding design basis dose release limits. The staff performed a confirmatory radiological analysis and the results were consistent with the applicants statements and showed significant margin to the dose criteria of 10 CFR 52.47(a)(2)(iv).

Based on the information above, including the valve design, testing, surveillance and operability requirements, and the consequences assessed by sensitivity analysis, the staff finds the use of the non-safety-related secondary MSIV for mitigating a SGTR event for the NuScale design acceptable. See Section 3.9.6 of this report for the staffs detailed review of the augmented quality and testing requirements applied to the secondary MSIVs.

Results The tube rupture causes a decrease in PZR pressure and level which results in reactor trip actuation on a low PZR pressure signal or a low PZR level signal. The DHRS is actuated, and closure of the FWIVs and MSIVs follows to isolate the SGs and terminate the loss of reactor coolant to the environment. Core decay heat then drives natural circulation, which transfers thermal energy from the RCS to the reactor pool via the DHRS associated with the intact SG.

The applicant performed two primary analyses for the SGTR event. The first analysis to investigate the radiological consequences uses conservative input parameters that maximize the potential for RCS mass and radiological release. The second analysis investigates the pressure responses in the RPV and helical coil SGs to ensure that peak pressures remain below the design pressures. The analyses considered four limiting scenarios to identify maximum SGTR (1) maximum mass release, (2) maximum iodine spiking time, (3) maximum RCS pressure, and (4) maximum SG pressure. Additionally, the analyses considered full double ended guillotine down to partial tube split breaks.15-132

The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.6.3, to determine if they meet the SRP acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the core power, SG pressures and levels, core temperature and levels, RCS leak flow rate, and DHRS heat removal rates. The SGTR is a slow depressurization that does not result in increase in power or significant decrease in RCS flow. The applicant stated that fuel integrity is not challenged by a SGTR event and the event is bounded by the inadvertent RVV opening event.

Therefore, the applicant did not specifically address fuel integrity in the SGTR analysis results.

The staff agreed that the SGTR event is not limiting in regard to MCHFR, and that the CHFR will remain well above the 95/95 DNBR limit based on comparison to more limiting events, e.g.,

inadvertent opening of an ECCS valve, decrease in feedwater temperature and uncontrolled CRA withdrawal. The staff also found that the fuel temperature decreases upon the reactor trip and that core water level remains well above the top of the active fuel, such that the potential for fuel failure is precluded in all cases.

As part of the staffs review of transient parameters, the staff verified that the sequence of events was reasonable given the automatic actuations of protection systems at their analytical setpoints.

Maximum Mass Release The magnitude of mass released from an SGTR event depends on the timing of SG isolation, since SG isolation ends the release of mass from the RPV to other plant areas. Maximizing the mass released to the environment and the duration of the iodine spike (elapsed time from reactor trip to SG isolation) maximizes the radiological consequences.

This SGTR event initiated from full power and biased high RCS pressure because the higher pressure difference between the primary and secondary leads to a higher break flow, and thus a higher integrated mass released. The results of sensitivity studies on break type and location indicate that a rupture of a tube at the bottom of the SG provides the greatest integrated mass released. This case also assumes (1) failure of the primary MSIV to close on affected SG which delays isolation since closure of the secondary MSIVs is slower, leading to additional mass released and a longer iodine spike duration, and (2) no loss of power. The event starts with a 55 percent split break tube failure at the bottom of the SG. As the leakage continues, the reactor pressure and PZR level decreases, and the MPS initiates a reactor trip and PZR heater trip based on a low PZR level signal at 1249 seconds. The RCS temperature then begins to cool more rapidly because of the reactor trip and the energy lost to the faulted SG. The RCS pressure continues to decrease until reaching the low PZR pressure setpoint, which activates containment isolation including closure of the primary MSIVs, secondary MSIVs, FWIVs, FWRVs, and opening of the DHRS actuation valves at 1295 seconds. Since the faulted SG primary MSIV fails to close, the SGTR leak flow continues until the secondary MSIV closes 7 seconds later. In this analysis, the SG levels are predicted to remain below 30 percent at the time of the secondary MSIV closure; therefore, the valve closes in a steam environment, and SG overfill occurs well after secondary MSIV closure. After the faulted SG is isolated, the NPM continues a gradual depressurization and cooldown as the DHRS associated with the intact SG removes decay heat.

As discussed in the associated audit documentation, the staff audited (ADAMS Accession No. ML19270G302 and ML19004A098) the applicants calculations and confirmed that the most severe case for mass release of fission products has been considered. The staff also reviewed all the limiting accident analysis transients noted and determined that the analysis method and 15-133

results were acceptable and consistent with requirements of the SRP. Additionally, the staff performed confirmatory calculations with the TRACE code to determine that any unique behaviors relative to the new helicoil SGs were captured. The staffs confirmatory calculations showed good agreement with the applicants analysis.

Maximum Iodine Spiking Time This sensitivity analysis provides the limiting iodine spiking time case by evaluating the longest time between reactor trip and secondary system isolation. This SGTR event is initiated from full power and biased high RCS pressure. The results of sensitivity studies indicate that a rupture of a 16 percent split break tube failure at the bottom of the SG provides the longest spiking time.

This case also assumes (1) failure of the primary MSIV to close on affected SG and (2) no loss of power. The event starts with the break at the bottom of the SG and as a slower leakage continues, the PZR level initiates a reactor trip and PZR heater trip based on a low PZR level signal at 1543 seconds. As the RCS temperature begins to cool more rapidly because of the reactor trip, the low-low PZR pressure setpoint is reached, which activates containment isolation, i.e., closure of the primary MSIVs, secondary MSIVs, FWIVs, FWRVs, and DHRS actuation at 1605 seconds. The faulted SG primary MSIV fails to close, and the secondary MSIV closes 7 seconds later. The SG levels again remain below 30 percent at the time of the secondary MSIV closure; allowing the valve to close in a fully steam environment. The NPM then continues a gradual depressurization and cooldown as the DHRS associated with the intact SG removes decay heat. The maximum spiking time was found to be about 50 seconds.

Maximum Reactor Coolant System and Steam Generator Pressure The staff reviewed the applicants SGTR case that resulted in a limiting RCS pressure. This case assumes a 16 percent split break tube failure at the bottom of the SG with a coincident loss of normal ac power, resulting in immediate closure of the turbine stop valves by 0.5 seconds. The RCS pressurizes because of loss of SG heat removal, and the MPS actuates a reactor trip based on a high PZR pressure signal at 6 seconds, which also results in containment isolation and DHRS actuation 2 seconds later. The peak RCS pressure of 2,158 psia occurs at about 12 seconds. The limiting SG pressure case assumes a high RCS average temperature, low RCS flow, high SG pressure, SG tube plugging, and double ended tube failure at the bottom of the SG, also with coincident loss of normal ac power. The MPS actuates a reactor trip based on a high PZR pressure signal at 11 seconds, which also causes containment isolation and DHRS actuation. The peak RCS pressure of approximately 2,096 psia occurs at about 16 seconds. The SG secondary pressurizes because of the SGTR and the turbine stop valve closure. The affected SG reaches a higher pressure because of the break, approaches the RCS pressure, and peaks at 1,871 psia at about 106 seconds. Afterwards, the RCS and secondary begin a gradual decline as the RCS is cooled by the intact SG and its associated DHRS. The staff confirmed that for the worst RCS pressure and SG pressure cases, the RCS and secondary pressure remained below 120 percent of their design pressures.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.3.

Based on the review of the SGTR analyses, including the sequence of events, initial conditions, and single failure assumptions used in the analytical models, and the predicted consequences15-134

of the transient, the staff concludes that the applicable requirements of GDCs 13, 14, and 34 have been met. The SGTR accident was evaluated and large CHFR margins were found which confirms that fuel damage in the core would not occur. The staffs assessment of the radiological consequences of a SGTR are provided in Section 15.0.3 of this report.

Main Steamline Failure outside Containment (Boiling-Water Reactor)

A main steamline failure outside containment is a BWR-specific event and therefore does not apply to the NPM design.

Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary This section describes the evaluation of the applicants DCA Part 2, Tier 2, analyses of the NuScale reactor responses to postulated LOCAs as the result of piping breaks within the RCPB, including LTC up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event. These analyses are used to determine the limiting conditions for operation, limiting safety system settings, and design specifications for safety-related components and systems.

Introduction A LOCA is a postulated accident resulting from instantaneous rupture of an RCS pipe within the RCS boundary. A spectrum of break sizes for both double-ended guillotine break and split break types are analyzed. For the NPM LOCA event, the most limiting scenario was found to occur in the CVCS injection line, which is a 2-inch line connected to the core riser. The methodology used is based on the NuScale topical report TR-0516-49422, Revision 1, Loss-of-Coolant Accident Evaluation Model, described in Section 15.0.2 of this report.

The LOCA event for the NuScale NPM design is unique compared to traditional PWRs because of the small size of RCS piping and because RCS inventory lost during a LOCA is preserved within containment and relied on for recirculation back to the core sometime after event initiation, depending on the size of the break. The methodology uses the deterministic 10 CFR Part 50, Appendix K, approach, and the NPM is designed to eliminate or reduce many of the design-basis LOCA consequences compared to a typical large PWR, in which the most important LOCA consequences would be peak cladding temperature resulting from core uncovery, core refilling, core reflooding, fuel cladding swelling and rupture, and fuel metal-water reaction. Consequently, NuScale has requested exemptions in Part 7 of the DCA from Appendix K, Parts 1.A.5, 1.B, 1.C.5, and 1.C.7 since phenomena related to these Appendix K criteria are essentially avoided by design of the NPM ECCS. Section 15.0.2 of this SER gives details of staffs review of the exemption request. The NPM LOCA calculations show significant margins to peak cladding temperature (PCT) of 1,204 °C (2,200 °F) as required by 10 CFR 50.46(b)(1) and the other criteria contained in 10 CFR 50.46(b)(2) through (b)(4). The relevant figures of merit are not PCT but (1) collapsed liquid water level above the core, (2) the critical heat flux ratio (CHFR), and (3) containment pressure and temperature. Therefore, applicability of the LOCA methodology is limited by design as described in SER Section 15.0.2.2 as it does not address post-CHF heat transfer phenomena, including cladding oxidation, clad hydrogen production, or clad geometry changes such as swell and rupture, which are not encountered due to unique design of ECCS recirculation cooling.15-135

The NPM LOCA event addresses the ECCS performance up to the time when a stable recirculation flow is established from the containment back to the reactor pressure vessel (RPV), pressures and levels in containment and the RPV approach a stable equilibrium condition (i.e., steady flow is recirculating through the RRVs), and core decay heat is removed by boiling in the core with steam exiting through the RVVs and then condensing in the containment. The DHRS is also available to supplement core cooling but is not credited in the LOCA analysis. The DHRS adds additional core cooling capacity during the NPM LOCA that results in faster depressurization and impacts primarily the smaller break sizes. The faster depressurization allows for earlier actuation of ECCS, less loss of RCS inventory, and greater margins to the figures of merit.

Summary of Application DCA Part 2, Tier 1: There are no Tier 1 entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 system description in Section 15.6.5, summarized below.

The LOCA event simulates a compromise in the RCPB resulting in RCS inventory loss at a rate that exceeds the capacity of normal makeup flow. The applicant assessed a spectrum of break sizes and locations of the RCS pressure boundary piping, and the event is analyzed for core thermal-hydraulic effects and is classified as a postulated accident.

The LOCA break spectrum is separated into two categories: (1) a liquid space break consisting of the RCS injection (i.e., charging) line and discharge line and (2) a steam space break consisting of the high-point vent line and PZR spray supply line. The progression of these events is similar, with the steam space breaks depressurizing the RCS faster, resulting in slight differences in timing of the key events because of the composition of the liquid or steam break flow. There are two distinct phases of the LOCA progression: (1) the blowdown phase that begins with the initiation of the postulated break in the RCS into the containment to the point that the MPS actuates the ECCS valves to open and the IAB release pressure is reached, and (2) a second, more rapid blowdown that begins with the opening of ECCS valves resulting in pressure equalization between the RCS and containment allowing the cooled, depressurized RCS inventory to fill the containment to the point that the discharged RCS fluid from the CNV is returned to the RPV downcomer. The MPS is actuated early in the event to initiate reactor trip, generally based on high CNV pressure or high PZR pressure, which then isolates containment, and initiates DHRS although DHRS is not credited. The ECCS is actuated by high containment level, loss of ac power after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, or loss of dc power. No operator action is credited in this event analysis.

The applicant analyzed this event using NRELAP5 to obtain the NPM time-dependent thermal-hydraulic response for collapsed level above the core and MCHFR. The applicant stated that the input parameters and initial conditions used in the LOCA analysis are selected to provide conservative calculational results in compliance with the Appendix K requirements.

The applicant concluded that criteria 1 through 4 in 10 CFR 50.46(b) are met and that the MCHFR remains greater than the safety limit. The applicant further stated that CNV pressure and temperature remain within design limits, and that the collapsed level remains above the top of the active fuel.15-136

The transition from the LOCA analysis to the post-LOCA long-term core cooling begins a third phase after natural circulation between the RPV and the containment through the RVVs and RRVs has reached a stable steady-state with adequate decay heat cooling. The latter phase (up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the event) is addressed in a separate technical report; the staff evaluation is contained in Section 15.6.5.2 of this SER.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this area of review.

Regulatory Basis The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR 50.46, as it relates to ECCS equipment being provided that refills the vessel in a timely manner for a LOCA resulting from a spectrum of postulated piping breaks within the RCPB.
  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to assure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 35, as it relates to demonstrating that the ECCS would provide abundant emergency core cooling to satisfy the ECCS safety function of transferring heat from the reactor core following any loss of reactor coolant at a rate that (1) fuel and clad damage that could interfere with continued effective core cooling would be prevented, and (2) clad metal-water reaction would be limited to negligible amounts.
  • 10 CFR Part 100, as it relates to mitigating the radiological consequences of an accident.
  • 10 CFR Part 50, Appendix A, GDC 27, as it relates to the reactivity control systems being designed to have a combined capability of reliably controlling reactivity changes to assure that under postulated accident conditions, and with appropriate margin for stuck rods, the capability to cool the core is maintained (see SER section 15.0.6.4 - Exemption from General Design Criteria 27).
  • 10 CFR 52.47(a) and 10 CFR 52.79(a), as they relate to demonstrating compliance with any technically relevant portions of requirements related to Three Mile Island in 10 CFR 50.34(f), except paragraphs (f)(1)(xii), (f)(2)(ix), and (f)(3)(v).

The staff notes that the applicant provided principal design criteria (PDC) for GDC 34 and 35.

PDC 34 and 35 proposed by the applicant are functionally identical to GDC 34 and 35 with the exception of the discussion related to electric power, which PDC 34 and 35 eliminate. A detailed discussion of NuScales reliance on electric power and the related exemption to 15-137

GDCs 17 and 18, as well as the electrical power provisions of GDC 34 and 35 can be found in the SER for Chapter 8, as well as the staffs evaluation (ADAMS Accession No. ML17340A524) of the NuScale topical report on electrical systems (TR-0815-16497). Neither PDC 34 nor PDC 35 requires the DHRS or ECCS to have electrical power (offsite or onsite) to perform their safety functions. The staffs evaluation of these exemptions under 10 CFR 50.12 from GDC 17 and 18 and the electrical power provisions of GDCs 34 and 35, are described in Section 8.1.5 of this report.

DSRS Section 15.6.5, Loss-of-Coolant Accidents Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary, lists the following acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP sections:

  • The calculated maximum fuel element cladding temperature does not exceed 1,200 degrees C (2,200 °F).
  • The calculated total local oxidation of the cladding does not exceed 17 percent of the total cladding thickness before oxidation. Total local oxidation includes pre-accident oxidation, as well as oxidation that occurs during the accident.
  • The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 1 percent of the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.
  • Calculated changes in core geometry are such that the core remains amenable to cooling.
  • After any calculated successful initial operation of the ECCS, the calculated core temperature is maintained at an acceptably low value, and decay heat is removed for the extended period required by the long-lived radioactivity.
  • An analysis of a spectrum of LOCAs ensures that boric acid precipitation is precluded for all break sizes and locations.
  • The radiological consequences of the most severe LOCA are within the guidelines of 10 CFR Part 100 or 10 CFR 50.67. For applications under 10 CFR Part 52, reviewers should use SRP Section 15.0.3, Design Basis Accident Radiological Consequence Analyses for Advanced Light Water Reactors.15-138
  • The Three Mile Island Action Plan requirements for II.E.2.3, II.K.3.30, and II.K.3.31 have been met.

DSRS Section 15.6.5 lists the following items that are included in the staffs review procedures for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections:

  • Adequate failure mode analysis has been performed to justify the selection of the most limiting single active failure consistent with DSRS Section 6.3.
  • If core uncovery is not expected during the entire period of a LOCA, the staff should ensure that a significant number of fuel rods will not be damaged because of local dryout conditions. This may be demonstrated by showing that the limiting fuel rod heat flux remains below the CHF at a given pressure after depressurization has taken place.
  • The parameters and assumptions used for the calculations were conservatively chosen.

These choices include taking the initial power level as the licensed core thermal power plus an allowance of 2 percent to account for power measurement uncertainties, using the maximum LHGR, addressing permitted axial power shapes, and conservatively calculating the initial stored energy.

NuScale may base its ECCS and RCS designs on prevention of core uncovery. If that is the case, the reviewer should compare the applicants analysis with the staffs independent analysis to determine if the predicted level of core coverage is consistent.

Technical Evaluation Evaluation Model The applicant used the LOCA methodology discussed in Section 15.0.2 of this SER, including NRELAP5 Version 1.4 and Revision 2 of the NRELAP5 plant model, to analyze the thermal-hydraulic response to the event. Section 15.0.2 of this SER also provides a summary of the staffs evaluation of the code and methodology, as well as the applicants request for exemption from certain requirements in 10 CFR Part 50, Appendix K. Therefore, the staffs evaluation is based on the NRELAP5 Version 1.4 analysis and the corresponding information in DCA Part 2, Tier 2, Revision 3, Section 15.6.5.

The NRELAP5 input model for LOCA was developed from the applicants base plant model, which was developed generically for both LOCA and non-LOCA transient analyses. The base modeling contained a set nodalization to model thermal-hydraulic fluid volumes and connecting heat structures for (1) the reactor vessel primary loop, including the lower plenum, core, riser, PZR, SG primary side, RPV downcomer, with CVCS piping for RCS injection, discharge, and PZR spray lines, (2) reactor vessel secondary systems, including the helical coil SG secondary, steamlines and feedwater lines, (3) the containment, (4) the reactor pool with DHRS included, and (5) ECCS valves and connections. Additionally, the base model considers averaged reactor kinetics and MPS control systems logic including PZR pressure, PZR level, vessel riser temperature, steam pressure, turbine load, and ESF controls for the ECCS.

The LOCA modeling uses a simplified model that eliminates ((15-139

)). The NuScale-specific CHF correlations used in the LOCA EM are a function of the core mass flux. As discussed in the associated audit documentation, the staff audited the applicants break spectrum calculations that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting LOCA results (ADAMS Accession No. ML19270G302, ML19004A098 and ML19255F022). The applicant requested exemptions in Part 7 of the DCA from parts of Appendix K to 10 CFR Part 50. This exemption request is evaluated in Section 15.0.2 of this SER.

Additionally, the staff performed a preliminary confirmatory analysis using the NRCs TRACE thermal-hydraulic code for the 100-percent CVCS injection line break case, which demonstrated that the applicants methodology produces reasonably conservative results. The staff found that the overall NRELAP prediction, with embedded conservatisms required by Appendix K, is more conservative in predicting the peak containment pressure and core collapsed level. The staff confirmatory cases did not consider the limiting 5-percent injection line break, but it appeared that the overall trends in the behavior tracked well for all the important phenomena.

Input Parameters, Initial Conditions, and Assumptions The staff reviewed the applicants input parameters, initial conditions, and assumptions to assess the adequacy of the analysis model. This included checking input parameters and initial conditions used in the LOCA analysis to ensure that selections provide conservative assumptions for initial stored energy in the RCS, MCHFR, and minimum collapsed liquid level (CLL) in the core. The key biases are maximum initial core power, 102-percent power, maximum RCS average temperature to maximize RCS energy, maximum PZR pressure of 1,920 psia to maximize RCS flow out of the break, minimum PZR level of 52 percent to minimize RCS inventory availability, and a reactor pool temperature of 43 °C (110 °F) maximum to minimize heat transfer rate to the pool.

The staff noted that the applicant selected the RCS average temperature 291 °C (555 °F) consistent with DCA Part 2, Tier 2, Table 15.0-6, and that the RCS flow was minimized to the minimum value in DCA Part 2, Tier 2, Table 15.0-6, to ensure that initial stored energy of the RCS is maximized. The NRC staff finds this modeling acceptable because it maximizes the amount of stored energy within the RCS, which is conservative for LOCA analyses.

Since the NPM relies on natural circulation for reactor coolant flow and does not include external RCS piping, there are no large-diameter pipe breaks to consider. Consequently, the applicant postulated a LOCA spectrum of breaks at various locations in comparatively small piping within the RCS pressure boundary. The breaks analyzed focused on the CVCS injection and discharge, high-point vent, and PZR spray lines inside containment.

The staff reviewed the break locations considered. As part of the LOCA break location and size evaluation, the staff evaluated NuScales justification that the bolted ECCS valve-to-vessel connection provides confidence that the probability of gross rupture is extremely low such that it can be treated as a break exclusion area. The staffs evaluation of this issue is provided in Section 3.6.2 of this document.

Additionally, the applicant confirmed that the inner diameter of the CRDM nozzle is bounded by the flow area of an inadvertent opening of a reactor vent valve analyzed in DCA Part 2,15-140

Section 15.6.6. The staff then concluded that the break spectrum considered by the applicant was in accordance with 10 CFR Part 50 Appendix K, paragraph I.C.1.

The staff additionally reviewed initial parameter values and biases including initial RCS conditions and reactivity coefficients, to ensure that the applicant selected conservative values for the analysis. The staff agreed that the parameters are sufficiently conservative for LOCA initial conditions. The staff noted that since the effective break area of the RRV (2.5 inch diameter) is larger than the largest CVCS line break (1.69 inch diameter), the LOCA event would not be expected to exceed the limiting MCHFR resulting from the inadvertent operation of ECCS event (DCA Part 2, Tier 2, Section 15.6.6).

The applicant did not credit operator action to mitigate a LOCA event. The applicant also considered the single failures of an RVV or RRV to open. Since the maximum rate of depressurization during ECCS activation yields the minimum core collapsed levels, the assumption of no single failure of ECCS valves to open should generally provide the limiting results. However, staff noted that the applicants definition, in TR-0516-49422, of collapsed level is a volume based accounting of the liquid in the core, riser, and bypass regions and is less limiting than the conventional method that uses an axial node length summation of the liquid fractions. The volume based approach more heavily weights liquid that is not physically in the core. Also, staff notes that the conventional method was used in the NRELAP5 RPV level calculations to benchmark the NIST-1 test data. Therefore, staff considers the NuScale collapse level prediction as a volume-averaged riser level rather than a minimum core collapsed level.

Additionally, staff believes this method may mask depressed levels in the hot channel and shift the limiting level such that assumptions other than no single failure produces limiting results.

However, since CHF remains a figure of merit for the event, in addition to CLL, if the hot channel level is depressed, that would be reflected in the CHF figure of merit.

The loss of normal ac power was determined to conservatively maximize the RCS thermal conditions after event initiation for a LOCA. When normal ac power is lost, the feedwater pumps coast down and a TT is initiated, thus limiting cooling to the RCS provided via the secondary system.

As discussed in the associated audit documentation, the staff audited the applicants break spectrum calculations that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting LOCA results (ADAMS Accession No. ML19270G302, ML19004A098 and ML19255F022). The audited material generally supports the discussions in the DCA, and the staff confirmed that the input parameters and initial conditions listed in the DCA are suitably conservative and result in the most limiting conditions for each of the respective acceptance criteria.

Results The submitted NPM break spectrum is separated into two categories: (1) liquid space breaks (RCS injection line or discharge line) and (2) steam space breaks (high-point vent line and PZR spray supply). A steam space break initiates a blowdown of the RCS inventory into the CNV from the top of the RPV. A liquid space break causes blowdown of the RCS inventory into the CNV from the RPV downcomer. The event progresses much faster if the break is from a liquid space.

The applicant determined the 5-percent CVCS injection line break case to be limiting for CLL above the core, and the 100-percent CVCS discharge line case to be limiting for MCHFR and 15-141

peak CNV pressure. The limiting case assumed a loss of ac power and single failure of one ECCS division (i.e., one RVV and one RRV) to open. Single-failure evaluations also included consideration of staggered release pressure where RVVs open at 1000 psi and RRVs open at 900 psi, and vice versa. The staggered ECCS opening pressures were determined to have no impact on the bounding scenario. The staff reviewed the accident progression and agrees that the 5-percent case delays ECCS actuation such that break flow is maximized from the RCS into the containment, which minimizes RCS inventory and core CLL. The staff also agrees that the 100-percent discharge line case is limiting for CHF since it results in maximum blowdown of break flow from the RPV early in the event. Within the first few seconds after the break, flow stagnation, core voiding, and high core stored energy cause the minimum departure from nucleate boiling (or CHF) to occur. Additionally, limiting CHF scenarios can occur for very small breaks where flow stagnation is augmented by increase in RCS pressure and stored energy due to small amount of inventory leaving via the break to cool the reactor.

The limiting 5-percent CVCS break event begins coincident with a loss of normal ac, and upon initiation, RCS inventory flows out of the break into the containment. The loss of normal ac power trips feedwater pumps and ends RCS cooling via the secondary system. Because of the small break size and the loss of secondary cooling, the RCS undergoes a short-term pressurization where RCS pressure reaches the high PZR pressure setpoint of 2,000 psia, causing the reactor trip. The high PZR pressure signal also initiates secondary isolation and DHRS actuation, which provides additional cooling by a recirculation loop between SG steaming and the DHRS heat exchangers in the reactor pool. However, for conservatism, the DHRS cooling is not credited.

As the pressure and inventory inside the RCS continue to decrease, the pressure and inventory inside the containment continue to increase. The high containment pressure signal causes containment isolation. The NPM ECCS is actuated by high containment level limit and after the level setpoint is reached, the ECCS IAB feature prevents the ECCS valves from opening until the differential pressure between the RPV and containment reaches the 900-psi threshold. As the ECCS (RVVs and RRVs) opens, the pressure in the RPV drops quickly, causing a second round of flashing and voiding in the core and a sharp but brief reduction in the core CLL above the active fuel level. However, the core remains covered and the MCHFR remains well above the safety limit. The core level recovers rapidly, as liquid in the riser collapses downward, RCS flow re-stabilizes, and inventory in the containment begins to flow back into the RPV downcomer through the RRVs. Containment pressure and temperature reach a maximum value at about 15 seconds after the ECCS valves open. After that, the core thermal energy is slowly discharged to the reactor pool through the containment wall via boiler condenser mode heat transfer. At this point, the gradual cooldown and depressurization continue, and the LOCA event transitions to the post-LOCA LTC phase.

The CLL above the top of the core was approximately 1.5 feet, and the MCHFR was approximately 1.74, well above the LOCA CHFR safety limit of 1.29. Since the MCHFR remained above the safety limit, the applicant concluded that the acceptance criteria for LOCA are met for the maximum peak clad temperature, total percentage of fuel cladding oxidation, amount of hydrogen generation, and maintenance of coolable geometry of the reactor core.

The staff reviewed the plotted results and sequence of events tables and finds that they are consistent with the event description and progression of ECCS behavior. In addition, the staff concludes that they support the applicants assertion that the acceptance criteria are met.

However, the staff notes that NuScale uses a volume-based method that does not compute true minimum CLL such that depressed levels in the hot channel may occur and be mask by liquid in the riser and bypass. Staff review of the LOCA CHF limit indicated that the correlations used 15-142

are adequate to conservatively predict CHF if voiding in core significantly depresses level in the hot channel. Therefore, even if depressed core levels occurred, conservatisms in the CHF correlation would preclude DNB and preserve adequate margin to CHF.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.5.

Conclusion Based on the LOCA analysis results reviewed, the staff determined that the requirements in 10 CFR 50.46, 52.47(a), and 52.79(a); GDCs 13, 35, and 27; 10 CFR Part 50, Appendix K; and 10 CFR Part 100 regarding the LOCA event have been met. The staff found that the loss-of-coolant analysis resulting from a spectrum of postulated piping breaks within the RPV pressure boundary is acceptable and demonstrates compliance to 10 CFR 50.46 with a large margin due to unique design of the ECCS where RCS coolant is cooled and recirculated from CNV and downcomer back to the core.

Introduction The post-LOCA LTC assessment described in Section 15.6.5 of DCA Part 2, Tier 2, provides an evaluation of the ECCS LTC capability of the NPM after a successful initial short-term response to the DBEs discussed in Section 15.6.5.1 of this SER up to a period of 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the events. The assessment does not credit for normal ac power, the non-safety-related dc power system, or any operator action. The methodology used is based on technical report TR-0916-51299, Revision 1, dated August 2019 (ADAMS Accession No. ML19218A147), which Commented [A23]: Revision 2 is a Confirmatory Item.

is incorporated by reference in Table 1.6-2 of DCA Part 2, Tier 2. This technical report The changed pages for the update to Revision 2 that addresses LTC phenomena related to both LOCA and non-LOCA events. The staff evaluation the staff based its findings on are in ML19337B451.

here addresses LTC phenomena initiated from the LOCA (SER Section 15.6.5.1) event or IORV event (SER Section 15.6.6), whereas non-LOCA event LTC phenomena are evaluated by staff in SER Section 15.0.5.

The long-term core cooling phase starts after the ECCS is actuated and the NPM reaches a quasi-steady state condition such that steam from the PZR region of the RPV is released to the CNV through the RVVs, the steam is condensed on the CNV walls, and, the condensed liquid flows from the CNV through the RRVs back into the downcomer core inlet. This recirculation flow loop continues, and the NPM is gradually cooled. This LTC configuration is reached through both LOCA and non-LOCA initiating events; however, this review covers only LOCAs as the initiating event. The non-LOCA initiating events generally involve the DHRS cooldown to the point where the ECCS is initiated, much later than for LOCA cases (i.e., after the IAB threshold pressure is reached or after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if ac power is unavailable (see SER Section 15.0.5)). Consequently, the long-term core cooling requirements of 10 CFR 50.46(b)(4) and (b)(5) must be demonstrated for these LOCA or non-LOCA events. The LTC analyses are intended to demonstrate that decay heat removal and reactor cooldown via the reactor pool ultimate heat sink are effective such that the reactor module(s) will remain in a safe, stable condition for up to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following a postulated LOCA event.

For the purposes of the post-LOCA LTC analysis, NuScale applied the same acceptance criteria used for the LOCA analysis as described in DCA, Part 2, Tier 2, Table 15.0-4, Acceptance Criteria Specific to Loss of Coolant Accidents. The applicant also assumed that the reactor 15-143

remained subcritical during post-LOCA LTC in accordance with the methodology described in TR-0916-51299, Revision 1, Long-Term Cooling Methodology. The staffs assessment of post-LOCA LTC in this section of the SER is consistent with the subcriticality assumption.

However, the staff notes that these is a potential for a recriticality and return to power post-LOCA. Section 15.0.6 of this SER addresses the return power condition and the potential for boron dilution and redistribution.

Summary of Application DCA Part 2, Tier 1: There are no Tier 1 entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 system description in Section 15.6.5, summarized below.

The transition from the LOCA analysis to the post-LOCA long-term core cooling phase results in a stable state where decay heat is being removed leading to gradual plant cooldown. The LTC evaluation performed by the applicant also states that the continued cooling occurs without boron precipitation or dilution for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after the initiation of a LOCA.

The applicant concluded that Criteria 4 and 5 of 10 CFR 50.46(b) are met, the collapsed level remains above the top of the active fuel, and the MCHFR remains greater than the safety limit.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS are the same as those described in Section 15.6.5.1.2 of this SER.

Technical Reports: TR-0916-51299, Revision 1, Long-Term Cooling Methodology Commented [A24]: Revision 2 is a confirmatory item.

The changed pages the staff based its finding on may Regulatory Basis be found at ML19337B451.

The relevant requirements of the regulations for this area of review and the associated acceptance criteria, given in SRP Section 15.6.5 (ADAMS Accession No. ML070550016), are the same as those previously summarized in the LOCA section of this SER (15.6.5.1), with the primary acceptance criteria set in GDC 35 and 10 CFR 50.46(b)(4) and (b)(5).

DSRS Section 15.6.5 lists the following additional guidance important for determining conformance to LTC requirements, as well as review interfaces with other SRP/DSRS sections:

  • Verify that the analyses include a spectrum of LOCAs to ensure that boric acid precipitation is precluded for all break sizes and locations.
  • Confirm CNV peak pressure and heat transfer capacity to remove the decay heat.
  • Verify that the analysis of boric acid precipitation includes a justified mixing volume, which is computed as a function of time as emergency core cooling injection enters the core region. The precipitation limit must also be justified in the EM.15-144

Technical Evaluation Evaluation Model The applicant used the NRELAP5 code with the methodology specified in the LOCA topical report (TR-0516-49422, Revision 1) and the LTC methodology technical report (TR-0916-51299) to model the NPM responses for this long-term post-LOCA event. The methodology does not address the effects of debris on ECCS operation in regard to Generic Safety Issue 191, Assessment of Debris Accumulation on PWR Sump Pump Performance, (ADAMS Accession No. ML16054A259) or return to power due to overcooling or boron dilution. The staffs assessment of GSI 191 is described in Section 6.3 of this SER, and return to power is addressed in Section 15.0.6.

The LTC technical report identifies the highly ranked LTC phenomena for the NPM. The phenomena identification and ranking table (PIRT) is developed using figures of merit that include CHFR, core coolant collapsed level, and subcriticality. Broadly speaking, the LTC PIRT can be divided into three general categories:

(1) phenomena addressed by NRELAP5 code models ((

))

(2) phenomena related to NRELAP5 boundary conditions and NPM characteristics ((

))

(3) phenomena related to boron mixing, distribution, and behavior ((

))

The LTC technical report evaluates the applicability of the NRELAP5 code to the LTC methodology by (1) comparisons to the LOCA EM Topical Report and (2) benchmarks to two LTC tests without DHRS activation performed at the NIST-1 facility (NIST-1 tests HP-19a and HP-19b).

The applicant developed the NRELAP5 input model for LTC from the NPM base model for transient analyses, with some of the simplifications taken from the LOCA model and other changes made to run longer transient cases. Since validation of the NRELAP5 code for LTC depends heavily on the LOCA topical report assessments, the LTC NRELAP5 model is benchmarked to the LOCA EM input model to show consistency of results. The axial modeling is based on coarser scheme noted in Table 9-3 of TR-0516-49422. The key LTC model differences are ((

)). Additionally, decay heat modeling is used, with a multiplier of up to 1.2, depending on the LTC scenario considered. The events analyzed includes the full LOCA spectrum considered in SER Section 15.6.5.1 and inadvertent opening of an RVV or RRV (SER Section 15.6.6) with and without DHRS out to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, with objective of confirming (1) adequate decay heat removal capability and (2) maintaining a coolable geometry via precluding boron precipitation. The concentration of boron and the RCS temperature determine if boron can precipitate out of solution and consequently restrict core flow.15-145

These criteria are demonstrated by evaluation three limiting LTC scenarios, (1) Maximum temperature via minimum cooldown to confirm that fuel cladding temperature is maintained at an acceptable level, (2) Minimum temperature via maximum cooldown with DHRS to confirm that the collapsed liquid level is above the active fuel and that minimum RCS temperature precludes boron precipitation during the LTC evaluation period with the conservative assumption that all boron is concentrated in the core and riser regions, and (3) Minimum level via maximum cooldown with minimum RCS inventory and maximum losses to the CNV to confirm that collapsed liquid level is maintained above the active fuel.

The analysis assumptions include loss of AC/DC power and single failure. In additions multi-module effects are addressed by using an extremely high pool temperature for maximum temperature cases. Other conditions and biases are also used to determine the worst cases, including, reactor power level, decay heat multiplier, RCS average temperature and pressure, PZR level, and noncondensable gas content. Since decay heat continually decreases overtime at a known rate, RCS and CNV pressure continues to decline, and the core return flow and CNV level stabilizes over the long term, the applicant assumes that the NPM reaches a quasi-steady state condition governed by the decay heat. Therefore, the LTC transient analyses are run with NRELAP5 only out to 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> to capture key transient phenomena, and a state point method is used to infer the NPM conditions at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, to save computational time and effort. The staff acknowledges that the RELAP5 codes numerically (e.g., calculated flow regimes and heat transfer modes) are not designed to compute conditions for near stagnant flow conditions as that which occurs during LTC and that the results may be dominated by numerical noise.

Additionally, the staff agrees that with the assumption of subcriticality, the LTC transient cooldown is a very benign event depending only on decay heat and the initial boundary conditions and biases that were postulated for the event. The applicant compared the state point method results to a 72-hour code simulation and found that the results were reasonably similar.

The 100-percent discharge and injection line break cases were used for the LOCA EM benchmarks starting at low pressure conditions of 1780 psia and a high RCS average temperature of 555 °F. According to Revision 1 of the LTC technical report, LTC-specific changes to the LOCA modeling included ((

)).

For the LTC to LOCA EM benchmarking, the applicant plotted detailed results for the first hour and then out to 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (45,000 seconds), see TR-0916-51299, Revision 1, Section 4.3, Commented [A25]: Revision 2 is a confirmatory item.

Figures 4-17 through 4-27. These results show that the LTC model (( The changed pages the staff based its finding on may be found at ML19337B451.

)).

The validation of NRELAP5 for ECCS LTC are support by LOCA EM documented in TR-0516-49422 and the two integral effect test runs performed at NIST-1. The NRELAP5 validation benchmarks were performed for NIST-1 tests HP-19a and HP-19b, which simulated a LOCA for LTC with each initiated by opening an RVV with slightly different atmospheric conditions in the 15-146

containment pressure vessel. Blowdown of the NIST-1 reactor pressure vessel inventory into containment resulted with the event transitioning to ECCS recirculation and then to LTC. ((The

)). From these tests, the applicant compared the experimental data to the NRELAP5 predictions for eight parameters. The comparison showed reasonable agreement, with NRELAP5 tending to ((

CNV)) showed good agreement. For each of the experiments, the applicant compared the NRELAP5 results to the following eight key parameters, including:

(1) CNV level, (2) RPV level, (3) CNV pressure, (4) RPV pressure, (5) cooling pool level and (6-8) lower, middle, and upper cooling pool temperatures. The NRELAP5 prediction of ((

)). ((

)), the applicant implied that the predicted heat transfer to the pool was consistent with the experiment.

Overall, the staff finds that the NRELAP5 predictions of the NIST-1 tests (HP-19a and HP-19b) are acceptable since the CNV and RPV pressure and level show good agreement. The staff also agrees that one-dimensional modeling in the cooling pool cannot capture all the realistic phenomena and that small differences in the predictions of cooling temperature and level are not crucial to the success of the benchmarks.

The LTC technical report identifies a methodology to assess boron precipitation during long-term ECCS operation. The analysis consists of a simplified mixing volume approach that compares the average boron concentration in the core and riser region to a solubility limit. The methodology uses conservative assumptions, including (1) the core inlet temperature is used to calculate boron solubility in the core and riser region, and (2) all boron initially in the RCS is retained in the core and riser region. In Revision 1 of the LTC technical report, ((

)).

The assessment relies on the NRELAP5 LTC calculations to provide NPM core inlet temperature and CLL in the core and riser region to determine the success of coolability. The limiting core temperature case is then extrapolated to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> using the state point method.

The state point method inherently assumes the accumulated effect of stored energy can be neglected, however, very conservatively biased inputs and the slow quasi-steady state progression of this transient are considered to outweigh this assumption. The staff reviewed this simplified approach and found that it was reasonably conservative and appropriate.15-147

The LTC technical report does not address a methodology to assess the potential for boron dilution during long-term ECCS operation but assumes boron dilution cannot occur (i.e., the reactor remains subcritical). For traditional PWRs, ECCS actuation generally includes abundant injection of pumped borated water, but the NPM ECCS only recirculates RCS fluid and relies on boiling in the core to concentrate boron in the core and riser regions, and there is no safety-related system to inject boron. The staffs evaluation of core reactivity being adversely affected by diluted water from the RRVs during long-term ECCS recirculation is addressed in SER Section 15.0.6.

Input Parameters, Initial Conditions, and Assumptions The input parameters and initial conditions used in the post-LOCA LTC analysis are selected to provide a conservative initial stored energy in the RCS, and the key parameters of interest are minimum CHFR, minimum collapsed liquid level (CLL) in the core, maximum fuel temperature, and minimum core inlet temperature to preclude boron precipitation. Therefore, the applicant used three general limiting sets of LTC conditions that address the thermal-hydraulic response:

(1) minimize the level in the riser, (3) minimum temperature for addressing boron precipitation, and (3) maximum temperature to maximize the fuel cladding temperature and minimize the CHFR. The applicant considered a broad range of assumptions and initial conditions to simulate the various cases to determine the limiting responses including variations in initial reactor power level, decay heat, ranging from no decay heat to 120 percent of nominal; reactor pool temperature, ranging from 18.3 °C (65 °F) to 98.9 °C (210 °F); reactor pool level, down to 45 feet (nominal at 69 feet); with and without DHRS, and PZR level, down to 20-percent level for liquid and steam space breaks.

The CVCS injection line break, in conjunction with loss of normal ac power, was determined to be the limiting scenario for most criteria. The staff reviewed the case selection and determined that the injection line break is limiting for core levels since it results in greater inventory loss from the RCS.

Results The LTC technical report evaluates the ability of the ECCS to provide decay heat removal and an orderly cooldown of the plant to a stable condition of LTC with natural circulation cooling.

For all cases, the applicant concluded that the decay heat removal via the ECCS is acceptable since the PCT drops steadily from the initial temperature, the CLL remains above the top of the fuel, and positive flow through the core is maintained.

The results of the post-LOCA LTC analysis are contained in TR-0916-51299 and incorporated by reference in Table 1.6-2 of DCA Part 2, Tier 2. Based on the applicants three limiting case scenarios, the staff reviewed the results out to 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and found that the NRELAP5 predicted behavior for each scenario trended to essentially the same long term temperature and pressure condition regardless of the initiating event.

Maximum Temperature (minimum cooldown rate)

The minimum cooldown rate injection line case produces the highest RCS temperatures and pressures and highest CNV pressure of the cases considered. The fuel cladding temperatures are well within the fuel cladding limits, with the maximum RCS inlet temperature in the LTC phase converging to about 138 °C (280 °F) for a case where reactor pool level was assumed at 45 feet.15-148

Minimum Temperature (maximum cooldown rate)

The maximum cooldown showed that fuel cladding temperature is not challenged and that core CLLs do not drop below the top of active fuel. The minimum RCS inlet temperature in the LTC phase converged to about 34.4 °C (94 °F) for a case where reactor power was initialized at 13 percent of full power.

Minimum Level The minimum level evaluation showed that core CLLs do not drop below the top of active fuel and that fuel cladding temperature is not challenged. The minimum level for this 100% injection line break occurs as RCS energy is maximum, inventory is minimum, ECCS capacity is minimum, and decay heat is maximum (multiplier of 1.2). The minimum level in the LTC phase dropped to about 2.8 feet early in the transient but then converged to about 7.3 feet at 12.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> and 8.0 feet at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The applicant concluded that decay heat removal via the ECCS is acceptable, regardless of the short-term initiating conditions, and that stable long-term CLLs in the riser cover the core and preclude any occurrence of CHF. The minimum CLL was found to be 2.8 feet above the core for the minimum level case, with 1.2 times decay heat and an initial PZR level of 20 percent.

In addition to the LOCA, the applicant considered inventory loss through possible containment leakage. With conservative assumptions of CNV pressure, the calculated leakage resulted in a very slight decrease in riser level of just over 1 inch of CLL in the riser region during the 72-hour LTC transient. The staff reviewed these results and finds that initial conditions were conservative and the plotted trends reasonably consistent and acceptable.

Boron Precipitation Analysis The applicants results indicate that boron precipitation will not occur during the limiting LTC scenario analyzed. The minimum temperature with power initialized at 13 percent power, DHRS enabled, a 0.8 decay heat multiplier and initial PZR level of 20 percent, indicated a margin of about 9.4 °C (17 °F) until boron precipitation. Based on the conservatisms of the boron precipitation modeling, the staff finds these results acceptable.

Boron Redistribution The applicants methodology does not address the boron redistribution phenomena because the applicant stated that there is no credible mechanism of introducing a large slug of deborated water unmixed into the core region. As previously stated, the staffs assessment of potential boron redistribution during long-term ECCS cooling is addressed in SER Section 15.0.6.

Boron Precipitation/Plate-out The applicants methodology also does not address the boron plate-out phenomenon. The staff notes that localized boron plate-out above the two-phase water level in the riser, the pressurizer baffle plate, higher up in the pressurizer, and/or in the RVVs caused by aggressive boiling in the core region during LTC could occur. The staff subsequently agreed with the applicant that the entrainment of droplets was not large enough to cause any significant plate-out that could impede operation of the RVVs or the flow holes in the pressurizer baffle plate. The staff therefore concluded that potential plate-out from entrainment would not affect operation of the ECCS during LTC. The staff also considered that some plate-out could occur due to boron 15-149

volatility (i.e., boron carried in steam flow) resulting in potential buildup primarily on cooler surfaces outside of the RPV, and concluded that any buildup would not impede operation of the ECCS for LTC.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.5.

Conclusion Based on analysis results reviewed, staff determined that the requirements in 10 CFR 50.46, 52.47(a), and 52.79(a); GDCs 13, 35, and 27; 10 CFR Part 50, Appendix K; and 10 CFR Part 100 for post-LOCA LTC have been met when the reactor is maintained in a subcritical state throughout the 72-hour ECCS cooldown. Therefore, based on the situation with maintained subcriticality, the staff has determined that the analysis of LTC resulting from LOCA events contain ample margin to the acceptance criteria, including (1) collapsed liquid level in the reactor vessel remains above the top of the core, (2) cladding temperatures remain acceptably low and maintain a downward trend, (3) minimum RCS inlet temperatures are high enough to preclude boron precipitation, and (4) large margins to MCHFR are maintained. The staff addresses the potential for a recriticality and a return to power following actuation of ECCS in Section 15.0.6 of this SER.

Inadvertent Operation of the Emergency Core Cooling System A spurious signal, hardware malfunction, or operator error can cause an ECCS valve to inadvertently open, resulting in a loss of reactor coolant from the reactor pressure vessel (RPV) and an RPV depressurization. This event is classified as an AOO.

DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.6.6, Inadvertent Operation of Emergency Core Cooling System.

An inadvertent operation of emergency core cooling system (ECCS) is defined as an accidental reactor vessel depressurization and decrease of reactor vessel coolant inventory that could be caused by a spurious electrical signal, hardware malfunction, or operator error. The inadvertent opening of more than one ECCS valve is considered a beyond design basis event due to the design of the ECCS valves. Thus, the inadvertent operation of ECCS consists of the inadvertent opening of one RVV or one RRV. The failure of an ECCS valve to a partially open position was evaluated and determined not to be a credible initiating event.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.15-150

The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to the availability of instrumentation to monitor variables and systems over their anticipated ranges to ensure adequate safety and of appropriate controls to maintain these variables and systems within prescribed operating ranges.
  • 10 CFR Part 50, Appendix A, GDC 26, as it relates to the control of reactivity changes so SAFDLs are not exceeded during AOOs. This control is accomplished by provisions for appropriate margin for malfunctions (e.g., stuck rods).
  • 10 CFR Part 50, Appendix A, GDC 29, which requires that protection and reactivity control systems be designed to assure an extremely high probability of accomplishing their safety functions in the event of AOOs.
  • 10 CFR Part 50, Appendix A, GDC 35, as it relates to ensuring that fuel and clad damage, should it occur, must not interfere with continued effective core cooling, and that clad metal-water reactor must be limited to negligible amounts.

DSRS Section 15.6.6 lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

The following discusses the staffs technical evaluation of the applicants inadvertent operation of ECCS analysis.

Causes The staff reviewed DCA Part 2, Tier 2, Section 15.6.6, to assess the applicants identification of causes leading to this event. The staff notes, from DCA Part 2, Tier 2, Section 6.3, that for the NuScale ECCS valve to open, two things must occur: the dc solenoid-operated trip pilot valve must open on either an ECCS actuation signal or loss of power, and, if at high pressure, the IAB valve moves to the blocked position such that the IAB must unblock when the RCS differential pressure threshold is met. As a result of the design of these valves, for the analysis presented in DCA Part 2, Tier 2, Section 15.6.6, the applicant stated that an opening of an ECCS valve can result if a failure of one of the IAB devices is present with an ECCS actuation signal or loss of dc power (EDSS), or a mechanical failure of an ECCS valve assembly. For the analysis15-151

presented in DCA Part 2, Tier 2, Section 15.6.6, the applicant assumed that the initiating event is a mechanical failure of one ECCS valve and did not assume a single failure of an IAB valve.

Single failure assumptions for this event are discussed in more detail below.

In DCA Part 2, Tier 2, Section 15.6.6.1, the applicant stated that it does not expect the spurious opening of a single ECCS valve to occur during the lifetime of a module; however, the applicant categorized this event conservatively as an AOO.

Evaluation Model DCA Part 2, Tier 2, Section 15.6.6.3.1, states that the inadvertent operation of an ECCS valve is evaluated using a modified LOCA EM, which is documented in Appendix B to topical report TR-0516-49422, Revision 1 (ADAMS Accession No. ML19331B585).

As part of its review, the staff reviewed Appendix B of the LOCA TR, which covers the methodology for the EM for this event. The staffs evaluation of the methodology relative to these requirements and the calculational framework established in RG 1.203 is documented in the SER for TR-0516-49422 (MLXXXXX). Commented [A26]: The staffs SER will be issued and an ML# provided in the Phase 6 SER.

Model Assumptions, Input, and Boundary Conditions DCA Part 2, Tier 2, Section 15.6.6.3.2, states that input parameters and initial conditions were selected to minimize MCHFR. SER Table 15.6.6-1 provides these input parameters. The staffs evaluation of the input parameters is also provided in Table 15.6.6-1 and in the subsequent paragraphs. The applicant selected several input parameters based on the results of sensitivity analyses. The staff conducted an audit as part of the review, which included an examination of the sensitivity studies associated with the transient analyses, as discussed in the associated audit documentation (ADAMS Accession No. ML19270G302 and ML19004A098).

During this audit, the staff observed that the outcome of sensitivity analyses associated with the inadvertent operation of the ECCS event was consistent with the statements made in DCA Part 2, Tier 2, Section 15.6.6.3.2. Additional parameter selection is based on the methodology presented in topical report TR-0516-49422.

Table 15.6.6-1: Initial Conditions and Input Parameters for the Inadvertent Operation of ECCS Event Model Parameter Applicants Assumption Basis Maximize core power to Initial power level Biased high minimize MCHFR Initial RCS average Biased high Sensitivity analysis temperature RCS flow Biased low Sensitivity analysis PZR pressure Biased low Sensitivity analysis15-152

Model Parameter Applicants Assumption Basis PZR level Biased high Sensitivity analysis Reactivity feedback coefficients Minimal TR-0516-49422 Beginning of cycle + additional Kinetics parameters TR-0516-49422 biasing Maximum time delay, bounding Minimize reactivity Scram characteristics scram worth with most reactive rod insertion for limiting stuck, bounding control rod drop rate MCHFR Axial power distribution Bounding middle peaked shape Sensitivity analysis Changed as part of LOCA EM Radial power distribution TR-0516-49422 changes to analyze this event Limiting ECCS valve RVV Sensitivity analysis Additional considerations include loss of electric power and single failure. DCA Part 2, Tier 2, Section 15.6.6.3.2, states that several loss of power scenarios were considered, but that the results are not sensitive to power availability because of the rapid nature of the transient. The staff agrees that the inadvertent operation of an ECCS valve is not sensitive to power availability because MCHFR occurs before the systems affected by the loss of electrical power can impact the analysis.

The staff reviewed the applicants single-failure assumptions for this event. The inadvertent actuation block (IAB) valve is a first-of-a-kind, safety-significant, active component integral to the NuScale ECCS. The ECCS system and the IAB are described in Section 6.3 of this report, and the component descriptions are in Section 3.9.6 of this report. During its review, the staff noted that the applicant did not apply the SFC to the IAB valve; specifically, the valves function to close. A discussion of the Commission decision in SRM-SECY-19-0036, Staff Requirements SECY-19-0036Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves, may be found in section 15.0.0.5 of this report. DCA Part 2, Tier 2, Section 15.6.6.3.2, states that the single-failure evaluation considered one reactor vent valve (RVV) failing to open, one reactor recirculating valve (RRV) failing to open, and failure of one ECCS division causing one RVV and one RRV failing to open. The staff agrees with the applicants assertion that the assumed single failures do not occur in a timeframe sufficient to affect the results and have no adverse impact on the limiting MCHFR case because the limiting MCHFR occurs very early in the transient.15-153

Evaluation of Analysis Results The staff reviewed the results presented in DCA Part 2, Tier 2, Section 15.6.6, to determine if they meet the DSRS acceptance criteria. The staff reviewed the transient behavior of several parameters by evaluating plots of the parameters as a function of time. The staff considered the reactor power, reactor and containment pressure, flow rates (including ECCS valve flow rates and RCS flow rates), CLL above top of active fuel, RCS temperature, and fuel and clad temperatures. DCA Part 2, Tier 2, Figure 15.6-67, shows that the MCHFR remains significantly above the safety limit for the inadvertent operation of an ECCS valve event. Additionally, in DCA Part 2, Tier 2, Tables 15.6-57 and 15.6-61 show that the RCS and main steam pressures are maintained far below 110 percent of design pressure. Further, the staff performed a confirmatory analysis of this event using TRACE and found that both TRACE and NRELAP predict similar phenomena and major plant parameter trends for the inadvertent ECCS valve opening event. As discussed in the associated audit documentation, the staff audited the applicants inadvertent operation of ECCS calculations that investigated the most limiting initial conditions, single failures, and loss of power assumptions to confirm that they led to the most limiting results (ADAMS Accession No. ML19270G302, ML19004A098 and ML19255F022).

Based on the accident description, and results in DCA Part 2, Tier 2, Section 15.6.6, the staff finds the MCHFR fuel safety limit remains above the acceptance criterion and that RCS and main steam pressure is maintained below 110 percent of design pressure because the inadvertent operation of an ECCS valve event is a depressurization event for the NPM.

DCA Part 2, Tier 2, Section 15.6.6.5, states that the event escalation acceptance criteria are satisfied because the NPM continues to be cooled with natural circulation through the ECCS valves. The staff previously addressed the potential for event escalation in Section 3.2 of the safety evaluation for TR-0815-16497, Revision 1 (ADAMS Accession No. ML18054B607), in which the staff (1) addressed the concern that reliance on the containment to mitigate an AOO may not be consistent with the underlying defense-in-depth purpose of 10 CFR Part 50, Appendix A, GDC 15, and (2) established Condition 4.4 on TR-0815-16497 to address reliability requirements for the systems necessary to retain reactor coolant within the RCPB. The staff addressed Condition 4.4 for TR 0815-16497 in Chapter 1 of this SER and found that the condition is satisfied. Based on the information in Chapter 1 of this SER regarding the disposition of Condition 4.4 for TR-0815-16497 and the information in DCA Part 2, Tier 2, Section 15.6.6.1, the staff finds that the event escalation acceptance criteria are met because (1) a realistic analysis shows that ECCS actuation in response to an AOO or infrequent event is expected to occur much less than once in the lifetime of an NPM, and (2) the spurious opening of a single ECCS valve is not expected to occur during the lifetime of an NPM.

There are no COL information items associated with DCA Part 2, Tier 2, Section 15.6.6.

The staff reviewed the inadvertent operation of the ECCS event, including the sequence of events, values of parameters and assumptions used in the analytical models, and predicted consequences of the transient. The staff concludes that the applicants analysis of this event is acceptable and meets the requirements of GDC 10, 13, 15, 20, 26, 29 and 35 with respect to this event because it satisfies the acceptance criteria in the DSRS.15-154

15.7 Radioactive Release from a Subsystem or Component Radioactive Release from a Subsystem or Component DCA Part 2, Tier 2, Section 15.7, Radioactive Release from a Subsystem or Component, describes events that could result in radioactive releases from a component or system other than the RCS. DCA Part 2, Tier 2, Section 15.7, points to other parts of the DCA that contain the evaluation of these events.

Gaseous Waste Management System Leak or Failure SER Section 11.3, Gaseous Waste Management System, contains the staffs evaluation of a gaseous waste management system leak or failure.

Liquid Waste Management System Leak or Failure SER Section 11.2, Liquid Waste Management System, contains the staffs evaluation of a liquid waste management system leak or failure.

Postulated Radioactive Releases Due to Liquid-Containing Tank Failures SER Section 11.2 contains the staffs evaluation of a postulated radioactive release resulting from liquid-containing tank failures.

Radiological Consequences of Fuel-Handling Accidents SER Section 15.0.3 contains the staffs evaluation of the radiological consequences of a fuel-handling accident.

Spent Fuel Cask Drop Accidents DCA Part 2, Tier 2, Section 15.7.5, Spent Fuel Cask Drop Accidents, states that the applicant has not performed a DBA analysis to assess the radiological consequences of a spent fuel cask drop accident because of the design of the single-failure-proof crane. SRP Section 15.7.5, Spent Fuel Cask Drop Accidents, states that accident analysis for a spent fuel cask drop is not required if the spent fuel cask handling design and procedures prevent the cask from falling or tipping onto spent fuel. The applicant further stated that the reactor building crane (RBC) system design conforms to the single-failure-proof guidelines of NUREG-0612, Control of Heavy Loads at Nuclear Power Plants: Resolution of Generic Technical Activity A-36, so that a credible failure of a single component will not result in the loss of capability to stop and hold a critical load. The staff agrees that, based on crane design single failure provisions, the dropping of a spent fuel cask is not considered to be a credible design basis event. Section 9.1.5 of this SER, Overhead Heavy Load Handling Systems, presents the staffs evaluation of the reactor building crane system design and capabilities.

NuScale Power Module Drop Accident DCA Part 2, Tier 2, Section 15.7.6, NuScale Power Module Drop Accident, states that the applicant has not performed a DBA analysis to assess the radiological consequences of an NPM drop accident due to the design of the single-failure-proof crane. The applicant stated that that the RBC system design conforms to the single-failure-proof guidelines of NUREG-0612 so that a credible failure of a single component will not result in the loss of capability to stop and 15-155

hold a critical load. The staff agrees that, based on crane design single failure provisions, the dropping of an NPM is not considered to be a credible design basis event. SER Section 9.1.5 provides the staffs evaluation of the reactor building crane system design and capabilities.

DCA Part 2, Tier 2, Section 19.1.6, Safety Insights from the Probabilistic Risk Assessment for Other Modes of Operation, discusses the evaluation of an NPM drop event in the NuScale probabilistic risk assessment.

15.8 Anticipated Transients without Scram Introduction An anticipated transient without scram (ATWS) is characterized as a failure of the MPS to initiate a reactor trip in response to an anticipated operational occurrence (AOO). The probability of an AOO, in coincidence with a failure to scram, is much lower than the probability of any other event analyzed in this chapter. Therefore, an ATWS event is classified as a beyond design basis event (BDBE). The regulatory requirements associated with the mitigation of the consequences of ATWS are referred to in this section as the ATWS rule.

The underlying purpose of the specific design features required by the ATWS rule (10 CFR 50.62, Requirements for Reduction of Risk from Anticipated Transients without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants) is to reduce the risk associated with ATWS events by reducing the likelihood of failure of the reactor protection system to shutdown the reactor (scram) following anticipated transients and to mitigate the consequences of ATWS events. For evolutionary plants where the ATWS rule does not explicitly require a diverse scram system, SRP Section 15.8, Anticipated Transients without Scram, notes that an applicant may provide either of two options to reduce the risks associated with ATWS. The first option is to provide a diverse scram system, which would reduce the probability of a failure to scram. The Statement of Considerations for the ATWS rule in Commission Paper SECY-83-293, Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (ATWS) Events, issued July 1983, suggests that the safety goal of the specific design features in 10 CFR 50.62 is to reduce the expected core damage frequency (CDF) associated with ATWS to about 1x10-5 per year. Therefore, a diverse scram system or other design feature should reduce the ATWS CDF to a level close to 1x10-5 per year to reduce the risks of ATWS to an acceptable level to satisfy this option. The second option is to demonstrate that SRP Section 15.8 ATWS safety criteria are met when evaluating the consequences of an ATWS occurrence.

Summary of Application DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.8, Anticipated Transients without Scram.

In DCA Part 2, Tier 2, Section 15.8, the applicant stated that, in the NuScale design, the ATWS contribution to CDF is significantly below the safety goal of 1x10-5 per year, as demonstrated in the probabilistic risk assessment described in DCA Part 2, Tier 2, Section 19.1. This low contribution is based on the reliability of the reactor trip function of the MPS. The MPS, which is described in DCA Part 2, Tier 2, Sections 7.1 and 7.2, includes a robust reactor protection system with internal diversity, which avoids common cause failures and reduces the probability of a failure to scram. The MPS uses the highly integrated protection system (HIPS) platform.15-156

The HIPS topical report (ADAMS Accession No. ML17256A892) describes integration of fundamental instrumentation and controls design principles into the HIPS design. The HIPS platform encompasses the principles of independence, redundancy, predictability and repeatability, and diversity and defense in depth. The applicant further stated that the redundancy and diversity of the MPS design ensures that an ATWS occurrence is a very low probability event for the NuScale Power Plant, which meets the intent of the first criterion of SRP Section 15.8 for evolutionary plants. The applicant also stated that the NuScale design supports an exemption from the portion of 10 CFR 50.62(c)(1) requiring diverse turbine trip capabilities because the NuScale design does not rely on a turbine trip to reduce the risk associated with ATWS events.

Additionally, the applicant stated that the NuScale design does not include an auxiliary feedwater system, and therefore, the portion of 10 CFR 50.62(c)(1) that requires diverse capability to initiate an auxiliary feedwater system is not applicable to the NuScale design. DCA Part 2, Tier 2, Section 19.2, describes the analysis of this beyond design basis ATWS event.

The applicants request for exemption from the turbine trip requirement of 10 CFR 50.62(c)(1) is documented in Part 7 of the NuScale DCA. Paragraph (c)(1) of 10 CFR 50.62 states the following:

Each pressurized water reactor must have equipment from sensor output to final actuation device, that is diverse from the reactor trip system, to automatically initiate the auxiliary (or emergency) feedwater system and initiate a turbine trip under conditions indicative of an ATWS. This equipment must be designed to perform its function in a reliable manner and be independent (from sensor output to the final actuation device) from the existing reactor trip system.

The applicant provided additional description of ATWS and the MPS mitigation systems in DCA Part 2, Tier 2, Chapter 19, and DCA Part 2, Tier 2, Chapter 7, respectively.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA.

Topical Reports: Topical Report TR-1015-18653, The Highly Integrated Protection System, issued September 13, 2017 (ADAMS Accession No. ML17256A892) is associated with this section of the applicants DCA.

Regulatory Basis SRP 15.8 acceptance criteria for ATWS are based on meeting the relevant requirements of the following Commission regulations:

  • 10 CFR 50.62 (the ATWS rule), as it relates to the acceptable reduction of risk from ATWS events via (1) inclusion of prescribed design features and (2) demonstration of their adequacy.15-157
  • 10 CFR 50.46, as it relates to maximum allowable PCTs, maximum cladding oxidation, and coolable geometry.
  • 10 CFR Part 50, Appendix A, GDC 12, as it relates to whether the design of the reactor core and associated coolant, control, and protection systems ensures that power oscillations, which can result in conditions exceeding SAFDLs, are not possible or can be reliably and readily detected and suppressed.
  • 10 CFR Part 50, Appendix A, GDC 16, as it relates to ensuring that containment design conditions important to safety are not exceeded because of postulated accidents.
  • 10 CFR Part 50, Appendix A, GDC 35, as it relates to ensuring that fuel and clad damage, should it occur, must not interfere with continued effective core cooling, and that clad metal-water reaction must be limited to negligible amounts.
  • 10 CFR Part 50, Appendix A, GDC 50, as it relates to ensuring that the containment does not exceed the design leakage rate when subjected to the calculated pressure and temperature conditions resulting from any accident that deposits reactor coolant in the containment.

The guidance in SRP Section 15.8 details the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

Technical Evaluation The staff reviewed DCA Part 2, Tier 2, Section 15.8, to ensure that the regulatory and technical acceptance criteria described in the SRP for this section are satisfied. For evolutionary plants, the Statement of Considerations for the rule in SECY-83-293 allows the option either to provide a diverse scram system satisfying the design and quality assurance requirements specified in SRP Section 7.2, Reactor Trip System, or to demonstrate that the consequences of an ATWS event are within acceptable values. The applicant states that the redundancy and diversity of the MPS design ensures that an ATWS occurrence is a very low probability event which meets the underlying purpose of the first criterion of SRP 15.8 for evolutionary plants. The MPS includes a robust reactor protection system with internal diversity, which avoids common cause failures and reduces the probability of a failure to scram.

The staffs review of the applicants request for exemption from the turbine trip requirements of 10 CFR 50.62(c)(1) is documented in Chapter 7 of this FSAR. The key component of the MPS is the HIPS, which provides the reactor trip, diversity, and defense-in-depth functions necessary to meet the intent of the ATWS rule. The staff approval of the HIPS design is documented in the safety evaluation for the HIPS topical report (ADAMS Accession No. ML17111A596).15-158

During preapplication interactions with NuScale, the staff documented its view that the 10 CFR 50.34(f)(2)(xii) and 10 CFR 50.62(c)(1) requirements relating to conventional PWR auxiliary feedwater system automatic initiation may not apply to the NuScale small modular reactor design and that an exemption request may not be needed. NuScales view was documented as Gap 3, Auxiliary Feedwater System Actuation and Flow Indication, of NP-RP-0612-023, Revision 1, the Gap Analysis Summary Report, issued July 2014 (ADAMS Accession No. ML14212A832). The staff documented the basis for its statements in a February 2016 letter to the applicant (ADAMS Accession No. ML15272A208). The staffs rationale for its statements was that the NuScale DHRS would perform the decay heat removal functions that would normally be expected of auxiliary feedwater systems found at typical light-water PWRs. The staff reviewed the information in DCA Part 2, Tier 2, Sections 10.4.9, Auxiliary Feedwater System, and 5.4.3, Decay Heat Removal System. Sections 10.4.9 and 5.4.3 of this SER document that review. Analyses of ATWS event sequences performed by the applicant and documented in DCA Part 2, Tier 2, Chapter 19, show that successful opening of a single RSV, even without consideration of the DHRS heat removal or ECCS valve actuation, provides sufficient natural circulation cooling to prevent core damage. The staff independently confirmed this conclusion. Because the decay heat removal function can be performed passively, the staff finds that a conventional PWR auxiliary feedwater system automatic initiation does not need to be applied to the NuScale small modular reactor design to prevent core damage. Therefore, the 10 CFR 50.62(c)(1) requirement associated with automatic initiation of auxiliary feedwater does not apply to the NuScale design.

The staff reviewed the information submitted in DCA Part 2, Tier 2, Section 15.8, to ensure the requirement in 10 CFR 50.62 (c)(6), that information sufficient to demonstrate the adequacy of items in 10 CFR 50.62 (c)(1)-(5), was submitted in accordance with 10 CFR 50.4, Written Communications. The staff finds that the information submitted in support of the request for exemption from the turbine trip requirements of 10 CFR 50.62(c)(1) is sufficient to demonstrate the adequacy of items in 10 CFR 50.62(c)(1) based on the staffs safety evaluation for DCA Tier 2, Chapter 7. The staff confirmed that the items in 10 CFR 50.62(c)(2)-(5) do not apply to the NuScale design.

The staff evaluation of the ATWS BDBE and its associated CDF is discussed in the Chapter 19 safety evaluation.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.8.

Conclusion As described in Section 7.1.5.4.5.1 of this SER, the staff concludes that the NuScale design meets the exemption criteria in 10 CFR 50.12 for the applicable portion of the ATWS rule. The other portions of the ATWS rule are not applicable, for the reasons described above. As discussed in further detail in SER Section 7.1.5.4.5.1, the NuScale design provides acceptable reduction of risk from ATWS events via (1) inclusion of prescribed design features that provide redundancy and diversity through the MPS design and (2) demonstration of their adequacy by ensuring that an ATWS occurrence is a very low probability event. The staff finds that the NPM design meets the underlying purpose of the ATWS rule as specified in the staff requirements memoranda and the discussion contained in the Statement of Considerations for the final rule.15-159

15.9 Stability Introduction Thermal-hydraulic and coupled thermal-hydraulic/neutronic instabilities can occur in reactors using natural circulation to drive primary flow. Certain conditions, such as low flow and high power, could result in two-phase flow (boiling, subcooled boiling, or flashing), which results in flow and pressure oscillations. Such oscillations are typically denoted as density wave oscillations. If these oscillations are growing, in primary pressure and flow, they are called density wave instabilities. For natural circulation systems, oscillations or instabilities could occur because of buoyancy-induced density difference, including those from transition to two-phase flow, and are also coupled with neutron kinetics (core power) and secondary-side changes.

One approach is to determine the range of parameters and conditions in which the system remains stable and exclude operation of the reactor outside this range. Such an exclusion region limits operation to conditions under which long-term instabilities will not develop.

However, an unmitigated instability could result in a new steady-state condition or initiation of the applicants MPS.

Summary of Application DCA Part 2, Tier 1: There are no DCA Part 2, Tier 1, entries for this area of review.

DCA Part 2, Tier 2: The applicant provided a Tier 2 event description in DCA Part 2, Tier 2, Section 15.9, Stability.

With the natural circulation design feature of the NPM, core flow is driven by density variations in place of pumps that produce forced circulation. Thus, variations in power level may result in changes in flow. The response of the NPM to perturbations and the behavior to flow instability are evaluated. The evaluation considers reactivity coefficients that span the range associated with beginning to end of cycle. The applicant demonstrates that the NPM is protected from unstable flow oscillations provided that operation is limited by an exclusion zone that precludes boiling in the riser area above the core.

ITAAC: There are no ITAAC items for this area of review.

Technical Specifications: The GTS listed in Section 15.0.0 of this SER are applicable to this area of review.

Technical Reports: There are no technical reports associated with this section of the applicants DCA Part 2.

Regulatory Basis The following NRC regulations contain the relevant requirements for this review:

  • 10 CFR Part 50, Appendix A, GDC 13, as it relates to instrumentation provided to monitor variables and systems over their anticipated ranges for normal operation, for AOOs, and for accident conditions, and to maintain these variables and systems within prescribed operating ranges.

Conditions that result in unstable power oscillations are AOOs.

  • 10 CFR Part 50, Appendix A, GDC 29, which requires that protection and reactivity control systems be designed to assure an extremely high probability of accomplishing their safety functions in the event of AOOs.

DSRS Section 15.9.A lists the acceptance criteria for demonstrating conformance to these requirements, as well as review interfaces with other SRP/DSRS sections.

Technical Evaluation The staff reviewed DCA Part 2, Tier 2, Section 15.9 to assess the applicants approach to preventing or mitigating instabilities and power oscillations that could pose unfavorable flow or thermal conditions and result in SAFDLs being exceeded.

In DCA Part 2, Tier 2, Section 15.9.1, the applicant stated that use of the exclusion region stability protection solution is an acceptable approach for preventing the occurrence of instabilities in the NPM. The staff reviewed the exclusion region that the applicant applies to their long-term stability solution. NuScale shows in DCA Part 2, Tier 2, Figure 15.9-1, that the region of potential instability is defined by a loss of riser subcooling, therefore the applicant forbids NPM operation for a riser subcooling margin less than 2.8 °C (5 °F). NuScale states in DCA Part 2, Tier 2, Section 15.9.1, that the Module Protection System (MPS) trips the NPM five (5) °F before reaching the region where instability is possible. The staff noted the analytical boundaries that separate the acceptable NPM operating region from the exclusion region are plotted as RCS hot temperature versus PZR pressure in DCA Part 2, Tier 2, Figure 4.4-9.

In DCA Part 2, Tier 2, Section 4.4.3.2, the applicant states that the low-pressure analytical limit is 1,600 psia for RCS hot-leg temperatures less than 316 °C (600 °F) and 1,720 psia for RCS hot-leg temperatures greater than 316 °C (600 °F). The staff notes that the subcooling margins are slightly less than 2.8 °C (5 °F) (approximately 2.7 °C (4.8 °F and 4.9 °F, respectively)) for the analytical limits at and near two exclusion boundary points represented by (316 °C (600 °F),

1,600 psia) and (321 °C (610 °F), 1,720 psia) in DCA Part 2, Tier 2, Figure 4.4-9. While the exclusion region is not strictly defined by a subcooling margin of 2.8 °C (5 °F) (or greater), the staff finds it acceptable because it provides an exclusion region consistent with the referenced stability methodology.

The applicant used the stability methodology discussed in Section 15.0.2 of this SER, including use of the PIM thermal-hydraulic computer code to simulate the dynamics of the flow in the NPM coolant loop with attention to optimal resolution of its stability. The applicants evaluation 15-161

methodology for the stability analysis is described TR 0516-49417 dated September 2019, (ML19254C858). Commented [A27]: Issuance of the final approved -A version of this topical report is a Confirmatory Item.

DCA Part 2, Tier 2, Section 15.9.2.1.3, discusses the input parameters and initial conditions for the limiting stability case, and DCA Part 2, Tier 2, Sections 15.9.3.1.3, 15.9.3.2.3, and 15.9.3.5.3, discuss the input parameters and initial conditions for the transient scenarios analyzed. The applicant stated that both BOC and EOC conditions were analyzed; however, BOC results are presented for the perturbed steady-state analyses, while EOC results are typically presented for the transient analyses in DCA Part 2, Tier 2, Section 15.9, since these results were more limiting. NuScale further stated that input conditions are nominal input parameter values for three core power levels of 160 megawatts thermal (MWt) (100-percent RTP), 32 MWt (20-percent RTP), and 1.6 MWt (1-percent RTP). As discussed in the associated audit documentation, the staff audited (ADAMS Accession No. ML18164A255) selected stability calculations and confirmed that the applicant applied reasonable values to some key parameters and conditions. The staff also reviewed the key conditions described in Sections 15.9.4.3.1 through 15.9.4.3.4 of this report and the allowable ranges for these parameters based on similar considerations for other events analyzed in DCA Part 2, Tier 2, Chapter 15.

Core Inlet and Core Average Temperature The core inlet and core average temperature can be affected by changes in secondary-side operation or other operational considerations such as SG tube fouling. The stability characteristics (and analysis results) are not sensitive to the primary-side temperature so long as the primary-side temperature is maintained within the exclusion region boundary of 2.8 °C (5 °F) subcooling. This is because of a cancellation of errors in the steady-state operation whereby a higher temperature in the core corresponds to higher temperature throughout the RCS, leading to essentially the same stability characteristics. In the transient depressurization analysis, the initial temperature has a negligible effect on the analysis because the RPV is depressurized until the pressure reaches the MPS trip setpoint. Therefore, the analysis does not need to consider variation in the RCS temperature in the same manner as other events in Chapter 15.

Pressurizer Pressure PZR pressure may vary by 35 psia. However, it is not necessary to consider such variation in the stability analysis. For decay ratio (DR) calculations, the PZR pressure (much like the RCS temperature) affects both the hot and cold legs equally and can therefore be expected to have minimal effect on the stability characteristics of the power module. The initial pressure, much like RCS temperature, affects the subcooling margin. However, the depressurization event is analyzed in such a manner that the RPV is depressurized until an MPS trip occurs which subsequently protects the subcooling margin. Therefore, the initial subcooling margin does not affect the analysis.

Feedwater Temperature and Feedwater Flow The feedwater temperature and feedwater flow can affect the initial RCS temperature; therefore, the impact of these parameters on the steady-state DR is the same as for the RCS temperature.

During the transient analysis, the FWS parameters are not assumed to change, and thus the 15-162

effect of these parameters on the transient analysis is the same as the impact given by the associated change in the RCS temperature. In other words, for the same reason that variations in RCS temperature are insignificant, the variations in feedwater temperature and flow are insignificant to the stability analysis.

Reactor Coolant System Flow and Reactor Power Level The RCS flow and reactor power level are interrelated. The uncertainty in RCS flow rate at a given power level is considered part of the stability analysis methodology and factors into the DR acceptance criterion. Therefore, the impacts of the initial conditions here are related because a change in the power level causes a change in the core flow rate. To this end, the stability analysis considers a variation of power and flow conditions ranging from 1-percent to 100-percent power conditions. Since the reactor tends to become more stable at higher power levels, the low power level of 1 percent analyzed is sufficient to address any staff concerns regarding the range of initial power levels. The staff notes that performing the analysis down to the 1-percent power level is conservative because the stability analysis methodology only requires consideration of the DR for power levels where thermal limits may be challenged, which occurs for core powers in excess of 1 percent.

Additionally, the staff notes that reactor physics parameters are selected based on the stability EM described in TR 0516-49417. Commented [A28]: Issuance of the final approved -A version of this topical report is a Confirmatory Item.

The staff reviewed the analyses presented in DCA Part 2, Tier 2, Section 15.9, to determine if they meet the DSRS acceptance criteria. The staff notes that the applicant performed stability analyses over a spectrum of events that include perturbation of steady-state and transient operations where the initiating events are variations of selected AOOs. The staff further notes that the applicant considers transient events from six AOO classification types and considers two other events: startup and cooldown.

Perturbed Steady-State Operation The staff reviewed NPM stability under conditions of steady-state operation in DCA Part 2, Tier 2, Section 15.9.2. The applicant considered a variety of power levels to demonstrate that the DR remains below the acceptance criterion (0.8) for all conditions. The staff notes that the most limiting case the applicant analyzed is for low power (1 percent RTP) where the DR is 0.70. The results of the calculations show that for steady-state operation conditions, the NPM is stable.

Increase in Heat Removal by the Secondary System The staff reviewed NPM stability AOOs that increase heat removal by the secondary system in DCA Part 2, Tier 2, Section 15.9.3.1. The applicant analyzed an increase in feedwater flow that results in an increase in heat removal that would likely result in an automatic trip of the reactor.

The staff agrees that the analysis is conservative since it ignores (does not simulate) the trip to bound less severe feedwater flow increase events. The staff confirms the applicant determined the limiting conditions with respect to this class of AOOs for stability analysis. The staff notes that a feedwater flow increase yielding a power increase sufficient to produce a reactor trip bounds less severe flow increases that would not necessarily result in a reactor trip. The applicant performed calculations at rated power initial conditions and at 20 percent of rated power (32 MWt), which show that the reactor remains stable.15-163

Decrease in Heat Removal by the Secondary System The staff reviewed NPM stability AOOs that decrease heat removal by the secondary system in DCA Part 2, Tier 2, Section 15.9.3.2. For stability analyses, conditions that produce the largest reduction in secondary side heat removal are not limiting because they would likely lead to a prompt, automatic reactor trip due to an increase in PZR pressure. The most adverse event from a stability perspective would be an AOO that maximizes the potential for the riser to void while avoiding the high PZR pressure trip.

To establish a conservative, bounding analysis method, TR-0516-49417 assumes a 50-percent feedwater flow reduction. This reduction is large enough to cause a reactor trip due to high PZR pressure, which is not credited in the TR-0516-49417 analysis. Therefore, TR-0516-49417 defined a methodology that, if followed, conservatively bounds feedwater flow reduction transients.

However, the analysis in DCA Part 2, Tier 2, Section 15.9.3.2, departs from the methodology in TR-0516-49417 since the feedwater flow is reduced by only 10 percent in the DCA compared to the 50-percent reduction prescribed by TR-0516-49417. According to the applicants analyses, and its description in DCA Part 2, Tier 2, Section 15.9.3.1.2, the 10 percent feedwater flow reduction will not actuate a high PZR pressure trip but will eventually actuate a high hot-leg temperature trip, which protects subcooling margin. To demonstrate long term stability, the applicant presents results in figures 15.9-8 and 15.9-11 from analyses where the high hot-leg temperature trip is ignored. These results show core flow and power oscillations that rapidly decay in time over intervals of 2000 to 3000 seconds, which are greater than 10 times the period of the reactor and sufficiently long to characterize long term stability. Since the applicant departed from the methodology and did not use the prescribed 50-percent feedwater flow reduction, the staff evaluated the margin available in the analysis over a wide spectrum of flow reductions and noted the stability margin is insensitive to the feedwater reduction level.

Therefore, the DCA Part 2, Tier 2, Section 15.9.4.4.3 analysis demonstrates that the long-term stability solution meets the requirement of GDC 12 since the riser voiding is mitigated following a decrease in secondary heat removal which prevents instabilities that could challenge SAFDLs.

The applicants analyses for feedwater flow reduction demonstrate that the RCS heats up and that a reactor trip protecting the riser subcooling margin is eventually initiated. Based on these analyses, the staff finds that this event progression is generally applicable and occurs regardless of the magnitude of the feedwater flow reduction. The staff also finds that the long-term stability solution is effective in preventing the reactor from reaching an unstable condition by initiating a reactor trip before such an instability would occur and therefore meets the requirement of GDC 12.

The analysis presented in DCA Part 2, Tier 2, Section 15.9.3.2, is a departure from, and non-conservative with respect to, the stability analysis methodology presented in TR-0516-49417.

Therefore, the staff finds that DCA Part 2, Tier 2, Section 15.9.3.2, safety conclusions shall not be construed as approval of the departure or as tacit acceptance of a change in the stability evaluation methodology presented in TR 0516-49417. Nevertheless, for the reasons indicated above, the staff notes that for the NuScale NPM, the long-term stability solution is effective in preventing instability during AOOs that cause a decrease in secondary side heat removal.15-164

Decrease in Reactor Coolant System Flow Rate The staff reviewed NPM stability AOOs that decrease RCS flow rate in DCA Part 2, Tier 2, Section 15.9.3.3. The applicant stated that it does not consider a decrease in the RCS flow rate a credible event for stability analyses. However, the staff notes that during a postulated AOO, it is conceivable that a sequence involving inadvertent operation of components related to the CVCS that could lead to reduced or increased primary system flow (such as CVCS pump overspeed or pump trip). The staff notes that since the CVCS is essentially external to the primary flow circuit, such AOOs could impact the RCS without other effects. The staff disagrees with the applicants assertion that a CVCS malfunction leading to a reduction in RCS flow rate is not a credible event. However, the staff finds it a credible but nonlimiting event and agrees with the applicant that this class of events is bounded by events resulting in a decrease in secondary-side heat removal. Therefore, a separate analysis is not required for this class of events.

Increase in Reactor Coolant Inventory The staff reviewed NPM stability AOOs that increase reactor coolant inventory in DCA Part 2, Tier 2, Section 15.9.3.4. In Section 15.9.3.4, the applicant states that the subcooling margin in the riser increases with increasing RCS pressure. However, a decrease and subsequent loss in riser subcooling margin could result in unstable behavior. Therefore, the applicant dispositions pressurization events as unimportant to stability analyses, since these events would increase the subcooling margin. The staff finds that the applicants disposition acceptable as events that increase the RCS inventory and simultaneously increase pressure do not result in unstable RCS behavior because the subcooling margin in the riser increases with increasing pressure.

Reactivity and Power Distribution Anomalies The staff reviewed NPM stability AOOs with respect to reactivity and power distribution anomalies in DCA Part 2, Tier 2, Section 15.9.3.5. The staff notes that DCA Part 2, Tier 2, Section 15.9.3.5, states that boron concentration changes via the CVCS are slow and that these events would likely be bounded by other analyses. The staff agrees that a CVCS malfunction resulting in boration or dilution would likely be a slowly evolving transient and would be bounded, or at least similar to, the events that increase or decrease heat removal from the primary system. In terms of control rod withdrawal, the staff agrees that protective trips are designed to protect thermal margins for control rod withdrawal events. The staff notes that the applicant analyzed a hypothetical reactivity increase of 65 cents starting from low power (20 percent of rated). The staff finds this approach to be reasonable given these considerations. BOC and EOC conditions were considered, with the EOC case being the more limiting event. The applicants results indicate substantial stability margin.

Decrease in Reactor Coolant Inventory The staff reviewed NPM stability AOOs that decrease reactor coolant inventory in DCA Part 2, Tier 2, Section 15.9.3.6. The staff notes that a decrease in inventory without a commensurate decrease in pressure would result simply in a reactor trip based on low PZR level, and therefore, those types of events need not be considered. The applicant discussed events that result in reduced pressure and concluded that events that do not reduce pressure sufficiently to result in riser flashing will not result in instability. The staff agrees that a low PZR pressure trip would occur before loss of subcooling margin, protecting the NPM against instabilities.15-165

Additionally, the staff reviewed AOOs that could result in riser flashing. In DCA Part 2, Tier 2, Section 15.9.3.6, the applicant simulated a depressurization event that decreases the reactor pressure to 1,378 psia (which corresponds to saturated conditions in the riser). In order to perform this analysis, the applicant suppressed the low-low PZR pressure trip at 1,600 psi. The analysis showed that oscillations begin to develop at approximately 927 seconds. However, the low-low pressure trip would be initiated by the MPS at approximately 530 seconds. The staff notes that the DCA Part 2, Tier 2, Figure 15.9-15 shows the results of the primary-side flow calculation, which indicates that the MPS trip occurs well before the onset of flow instability.

Demonstration of Module Protection Systems to Preclude Instability The staff reviewed the capability of the MPS to preclude instability in DCA Part 2, Tier 2, Section 15.9.4. The applicant stated that the NPM minimum loop transit time is greater than 60 seconds at rated power, while the time to scram is less than 11 seconds. The applicant concluded, and the staff agrees, that the MPS will enforce the exclusion region and shut down the reactor before violating thermal limits because the scram time is significantly less than the loop transit time.

The applicant concluded, and the staff agrees, that the pressure in the reactor coolant and main steam systems is maintained below 110 percent of the design values for this event, and the minimum DNBR remains above the 95/95 limit. Based on these conclusions, the staff finds that there is no challenge to any of the fission product barriers for this AOO.

Radiological Consequences Based on the results of the analysis and barrier performance, the applicant concluded, and the staff agrees, that there are no radiological consequences associated with events that could result in thermal-hydraulic instability.

Combined License Information Items There are no COL information items associated with DCA Part 2, Tier 2, Section 15.9.

Conclusion The staff concludes that the consequences of postulated instabilities and power oscillations meet the relevant requirements set forth in the GDCs 10, 12, 13, 20, and 29. As documented above, the applicants analysis and exclusion region showed that the DSRS acceptance criteria are met.15-166

Retrieved from "https://kanterella.com/w/index.php?title=ML20028D595&oldid=2597940"