ML20125E221

Forwards Draft Commission Paper Requesting Guidance for Areas Staff Proposing to Depart from Current Regulatory Requirements in Preapplication Review of Advanced Reactor & Candu 3 Designs,Per 921202 Memo from EDO to Commissioners

ML20125E221
Person / Time
Issue date:	12/14/1992
From:	Slosson M Office of Nuclear Reactor Regulation
To:	NRC OFFICE OF INFORMATION RESOURCES MANAGEMENT (IRM)
References
NUDOCS 9212160251
Download: ML20125E221 (46)

Text

.- . .- --_ --

DECEMBER 14, 1992 NOTE FOR: DOCUMENT CONTROL DESK FROM: MARYLEE SLOSSON, ACTING CHIEF ADVANCED REACTOR PROJECT DIRECTORATE NRR

SUBJECT:

SUBMITTAL OF DRAFT COMMISSION PAPER TO PDR

PER A DECEMBER 2, 1992 MEMORANDUM FROM THE EDO TO THE COMMISSIONERS, THE ENCLOSED DRAFT COMMISSION PAPER SHOULD BE SUBMITTED TO THE PDR FOR PUBLIC RELEASE.

1 f

b

~

(pu j

I i

4 i

)

4 v)pP uooto i 9212160251 921214

~

PDR ORO NRRB PDR

DRAFT fp.t: The Commissioners fr.9.m: James M. Taylor Executive Director for Operations Sub.iect: ISSUE!l PERTAINING TO THE ADVANCED REACTOR (PRISH, MHTGR, AND PIUS) AND CANDU 3 DESIGNS AND THEIR RELATIONSHIP TO CURRENT REGULATORY REQUIREMENTS Purcose: To request Commission guidance for those areas where the staff is proposing to depart from current regulatory requirements in the preapplication review of the advanced reactor and CANDU 3 designs.

Ibekoround: The Advanced Reactor Policy Statement (51 FR 24643) and NUREG-1226, " Development and Utilization of the NRC Policy Statement on the Regulation of Advanced Nuclear Power Plants," define advanced reactors as those with innovative designs for which licensing requirements will be signif-icantly different from the existing light-water reactor (LWR) requirements. These documents also provide guidance for the development of new regulatory requirements to support the advanced designs. Staff reviews of these advanced reactor designs should utilize existing regulations to the maximum extent practicable. When new requirements are necessary, the staff should move towards performance standard regulations and away from prescriptive regulations.

Each designer is encouraged to propose new criteria and novel approaches for evaluation of their designs, and an objective of early designer-staff interaction should be tc

~

develop guidance on licensing criteria for the advanced

, reactor design and to make a preliminary assessment of the potential of that design to meet those criteria.

CONTACTS:

M.H. Slosson 504-1111 T.H. Cox 504-1109

J' o

!* The Comissioners i i

\

The staff is conducting preapplication reviews of the j following four designs:

?

• General Atomics (GA) 350-MWt Modular High Temperature Gas-Cooled Reactor (MHTGR) design sponsored by the U.S.

Department of Energy (DOE) Gas Cooled Reactor Program i

General Electric (GE) 471-MWt Power Reactor Innovative l Small Module (PRISM) reactor design sponsored by the DOE Advanced Liquid Metal Reactor (ALMR) Program

• Atomic Energy of Canada, Limited. Technologies (AECLT) 1 1378-MWt Canadian Deuterium Natural-Uranium (CANDU 3)

reactor design

• Asea Brown Boveri-Combustion Engineering (ABB-CE) 2000-MWt Proces:: Inherent Ultimate Safety (PIVS) reactor design Enclosure 3 provides a listing of pertinent Commission papers and reference NUREG documents for these preap-plication designs. Some information in the original 4 documents may be superseded by more recent prarpplicant l submittals. A sumary of the current designs is provided as i

Enclosure 2.

In response to Commission staff requirements memorandum

! (SRMs), in SECY-91-202, ' Departures from Current Regulatory i Requirements in Conducting Advanced Reactor Reviews," the staff committed to identify issues during tiie preapplication review that require Commission policy guidance or staff

technical resolution for design certification, including situations in which advanced reactor designs significantly

< deviate from current regulatory rtquirements.

Policy issues for evolutionary and passive LWRs have been identified in the following Commission papers:

!

• SECY-90-016, " Evolutionary Light Water Reactor (LWR)

Certification Issues and Their Relationship to Current Regulatory Requirements"

• Draft SECY_(distributed for coments on February 27, 1992), " Issues Pertaining to Evolutionary and Passive

( Light Water Reactors and Their Relationship to Current l Regulatory Requirements" l

e i

1he Comissioners i i

'

• Draft SCCY (distributed for coments on June 25,1992),

' Design Certification and Licensing Policy Issues

Pertaining to Passive and Evolutionary Advanced Light-Water Reactor Designs" l Discussion

As part of their submittals, the preapplicants identified how their design complied with the current LWR licensing requirements and, where it did not, provided alternative criteria for evaluating their designs. The staff has conducted a preliminary review of the four preapplication j designs using existing LWR regulations and the evolutionary light-water reactor (ELWR) and advanced light-water reactor

! (ALWR) policy guidance. This initial review identified

10 issues that require policy direction from the Comission

'i for proposed deviations from existing regulations. These are instances where either existing regulations do not apply to the design or preapplicants' proposed criteria are sig-j nificantly different from the current regulations. These i issues, background information on current requirements, pre-applicants' proposed approaches, and staff recomendations for Comission approval, are provided in Enclosure 1.

The recomendations for Comission approval were develo)ed i by the staff with inputs from the preapplicants, the pu)1ic, i and the ACRS. The staff considered the preapplicants' l proposals in light of the Comission's policy statements and

! guidance on severe accidents, advanced reactors, and safety goals to develop a single consistent policy recomendation l to be applied to all applicable advanced reactor designs.

In some instances, the staff recomends that current regulations continue to be applied to the advanced reactor designs despite preapplicant proposals to do otherwise.

Where deviations are recomended, the staff proposes more conservative alternatives to the preapplicants' proposals to

account for uncertainties associated with the conceptual l design, which should ensure that conclusions sade during the preapplication review will provide a reasonable basis for the detailed design being found acceptable at design certi-fication. It'is intended that the safety level standards for these designs will be consistent with Commission guidance at design certification.

Some issues are closely related. Accident evaluation and i

source term provide a basis for containment performance and l- emergency planning. Approaches taken for. residual heat removal and reactivity control are intended to be consistent with the accident evaluation categories and consequences.

l.

L

4

. The Comissioners The staff proposes to treat the HHTGR, PRISH, and PIUS designs as advanced reactors in accordance with the policy statement. The CANDU 3 design is considered to be an evolutionary heavy-water design deriving from the larger CANDU reactor designs operating in Canada and elsewhere.

Therefore, the staff has concluded that a prototype CANDU 3 is not required for design certification. This position is consistent with staff conclusions in SECY-89-350, " Canadian CANDU 3 Design Certification," and SECY-90-133, " Prototype Requirement for CANDU 3 Design." The preapplicant, AECLT, has stated that a CANDU 3 reference plant is a key element in their plan for standard design certification. If AECLT holds to that position, the regulatory review and con-struction in Canada would lead the NRC's design certi-fication review. The staff believes that this regulatory review and construction in Canada would greatly benefit our review of CANDU 3. During the preapp11 cation review, the staff intends to utilize the foreign operating experience and accident analysis to aid in predicting the expected behavior of the CANDU 3 design. AECLT uakes no claim of passive shutdown or decay heat removal capabilities.

However, because of its unique heavy-water, pressure-tube reactor design and evolution under a different regulatory structure, it does not conform to some current NRC regulations. The staff proposes to apply preapplication review criteria to the CANDU 3 reactor that are consistent with ELWR review requirements.

l The staff intends to use the Comission's guidance on these recomendations to conduct preapp11 cation reviews of the l

conceptual designs. Guidance for review of prototype requirements for advanced reactors will follow SECY-91-074,

" Prototype Decisions for Advanced Reactor Designs."

Consistent with the requirements of Title 10 of the Code of Federal Regulations (CfR) Section 52.47(b)(2), novel safety features of the advanced reactors and CANDU 3 will be required to be demonstr_ated through analysis, test programs, experience, or a combination of these methods. Feedback from the review process will be factored into recomended revisions to the policy guidance, and recomendations for the development of licensing criteria and regulations will be made after the preapplication safety evaluation reports (PSER) are issued. Additional issues may be developed during the preap>11 cation review process; they will be identified in s osequent Commission papers.

=

I.

h The Comissioners  !

• In an SRM dated May 8,1992, the Comission requested the i

staff to prioritize the issues for Comission review. The staff recomends that the priority for review be consistent j with the PSER issuance schedules and requests that direction

be provided in sufficient time to allow the staff to incor-porate Comission decisions into the final PSERs. Since the i PRISM design is scheduled as the first preapplication

review, Comission attention is recuested on a highest priority for those items identifisc in the enclosure as

~

]

j applicable to the PRISM design.

l

Conclusions:

The staff requests approval of, or alternate guidance on, j these proposed positions to be taken in the preapplication l-review of the advanced reactor-and CANDU 3 designs.

l Coordination:. The Office of the General Counsel has reviewed this paper i and has no legal objection. The staff has forwarded a draft l of this paper to the ACRS for its re*/iew and coments.

Recomenddient That the Comission i

!

• Approve the staff recomendations in Enclosure 1 for-l conduct of the preapplication reviews.

. . Approve of the staff's conclusion that, based on the

position that the CANDU 3-design is an evolutionary

! heavy-water design. deriving.from CANDU designs operating l in Canada and elsewhere, a prototype CANDU 3 is'not ,

l required for design certification, t

l

• Note that positions which change as preapplication l review experience is!obtained will be comunicated to l the Comission and that as the staff identifies new l issues it will-inform the Comission.

• Note that-the Comission is requested to provide highest priority attention to those issues identified in the enclosure as being applicable to the PRISM design.

p

= Note that due to the preliminary nature of the design L information on the advanced reactor and CANDU 3 designs, E

and the preliminary nature of the staff's preapp11 cation-l l

l l

l

? ., - . . _ _ - ~ . , . - - , , . - . - , . , _ - . , - - - , . . . . - - . - . _ . - _ . . . . ~ . ~ . . . . - - . . . , ~ , . - _ . - . .

i* l 1

I-The Commissioners reviews, the staff does not recommend proceeding with generic rulemaking on any of the policy issues

- Identified in this paper. The staff will consider

generic rulemaking, as appropriate, as the reviews i progress and the staff gains greater confidence in the

[

final design information.

i James M. Taylor i Executive Director for Operations j-

Enclosures:

i 1. Policy issue Analysis

2. Design Summaries

3. List - Reference Documents l

3 i

1 h'

j l

+ , , ,

^

\

,. 1 POLICY ISSUES ANALYSIS AND RECOMMENDATIONS f

i As part of a preliminary review of the PRISH, CANDU 3, NHTGR, and PIUS designs, the staff has identified 10 instances where either the staff or the preapplicants have proposed to deviate from current light-water reactor (LWR) guidance for the review of the designs. This occurred when existing regulations were not applicable to the technology or when the staff identified new departures from existing regulations that are considered warranted based

, on the preapplicants' design and proposed criteria. The staff has grouped the

! issues into two categories: (1) those issues for which the staff agrees that departures from current regulations should be considered; and (2) those issues which the staff does not believe a departure from current regulations is

warranted at this time. The following is a matrix of the issues identifying the plant applicability:

~

CATEGORY ISSUES PRISM MHTGR CANDU PlVS 3

A. Accident Evaluation X X X X i

B. Source Term X X X C. Containment Performance X X X X a D. Emergency Planning X X X

• 9 # E. Reactivity Control l X F. Operator Staffing X X X X G. Residual Heat Removal X X X H. Positive Void Reactivity X X Category I. Control Room Design X X X X

? J. Safety Classification X l

i Discussions of these issues are on the following pages, including a brief summary of the issue, current LWR regulations, preapplicant positions, discussion of staff considerations and a proposed recommendation for staff action. The staff considered the preapplicant's proposals in light of l

applicable Commission policy statements.

i i

l f

I 1- DRAFT l

Enclosure _1

,y- , ,.p.e.,+9-~ , - , - , , , , - .,- ,.yc , , , , ,, s , , ,%_. . , .

_ __ _ _ _ _ - _ . _ . _ . . . _ . _ _ _ . _ . . _ _ _ _ _ . _ _ . _ . _ _ _ . - . . _ . _ . _ --..._..__. ~

At this preliminary review stage, the staff has limited the scope of the issues to those which could affect the licensability of the proposed design.

Additionally, if. a similar issue had already been raised for the LWR designs

• and the -staff's advanced reactor design recommendation was essentially the same, it was not repeated in this paper. In those cases where the preapplicants proposed different considerations from the evolutionary or passive LWRs, the issue is treated in this paper in light of the work done in the advanced light-water reactor policy papers.

J l

2- DRAFT

.- _ _ _ _ _ _ __ _ . _. . _ ~ _ _ _ _ _ _ . _ _ _ _ _ . . _ . . ._ _ _ _ ,

11 j i

1

. A. ACCIDENT EVALUATION  !

f IUillt i Identify appropriate event categories, associated frequency ranges, and 1 evaluation criteria for events that will be used to assess the safety of the l proposed designs.

l ,(.yrrent Reaulations

' General Design Criterion (GDC) 4 requires the consideration of accidents in the design basis. Also,10 CFR 52.47 requires the consideration of conse-

, quences for both severe accidents (through the required probabilistic risk assessment) and design basis accidents (DBA) for designs which differ signif-4 icantly from evolutionary designs or uttlize passive or other innovative means  :

to accomplish safety functions, i Preacolicants' Anoroach I All three advanced reactor preapplicants proposed to analyz6 accidents signif- .

icantly 1sss probable than the present desi5a basis range and to assure j through their design that these accidents had acceptable consequences limited

to specific dose levels to the public. All chose to utilize the Environmental Protection Agency's (EPA) lower level Protective Action Guidelines (PAG) of I rem whole body and 5 rem thyroid as their limits for a significant portion of their accident spectrum. The MHTGR accident guidelines invo

{

1evel PAG dose limit for all sequences more probable than 5x10'pe the lower-per reactor-

year. The PIUS p l

probable than 10,uldelines invokeThe per reactor-year. the PAGs for accident sequences more i accident sequences more probable thanper 10', PRISM guidelines reactor-year. The PRISMinvoke the PAGs for -

accident evaluati l probable than 10',on guidelines also per reactor-year limit to the 10 consequences CFR Part 100 dose fromlimits.

any sequence more

! Guidelines for onsite consequences and offsite consequences from operational i

transients for all vendors are consistent with or more conservative than -

! present LWR regulations as contained in 10 CFR Part 100.

l l The CANDU 3 preapplicant, in their current safety analyses, has excluded i analyses of the consequences of_ events with frequencies of less than 10 per t year from the-safety evaluation. Events which would be excluded from l consideration, based on the CANDU 3 design characteristics and system

! reliabilities, would include anticipated transient without scram (ATWS),

i unscrammed loss-of-coolant accidents (LOCAs), delayed scram events, and other i events which could affect reactivity insertion (for example, from control

! system failures . As a result of the positive void reactivity coefficient

associated with)the CANDU design, events invo.1ving even a relatively short scram delay could result in a core disruption ace' dent. -

I DRAFT l

Dbcussion The structure proposed by the PRISH, HMGR, and PIUS preapplicants for selecting accidents to be evaluated was developed to support their positions for reduction of emergency planning requirements as des:ribed in Section D of this enclosure. As discussed in Section D, the staff is not ready to make a recomendation on whether the Cornission should consider a reduction in the emergency planning requirements. The CANDU 3 approach which limits the scope of severe accidents examined appears to be inconsistent with the provisions of 10 CFR 52.47. The accident evaluation scheme envisioned by the staff examines challenging events to the designs to provide information for a later decision on emergency p nning requirements for advanced reactors and includes consideration of the potential consequences of severe accidents. Addi-tionally, for the roulti-module designs (PRISH and HHTGR), the impact of specific events on other reactor modules for the multi-module sites must be assessed.

The staff's approach is intended to be structured conservatively so that

positive conclusions made on the licensability of the conceptual designs during the preapplication review will provide a reasonable basis for acceptability of the design at design certification. Several sources of uncertainty er.lst with the conceptual designs including limited performance and reliability data for passive safety features, lack of final design information, unverified analytical tools used to predict plant response, limited supporting technology and research, limited construction and operating experience, and incomplete quality control information on new fuel manufacturing processes. Later, during the design certification process, some i of the conservatism coul<f be removed based on improved understanding of the

design and analytical tools through completed research.

Recomenddiga l The staff proposes to develop a single approach for accident evaluation to be l applied to all advanced reactor designs during the preapplication revied. The approach will have the following characteristics:

• Events will be selected deterministically and supplemented with insights l from probabilistic risk assessments of the specific designs.

l l

• Categories of events will be established based on expected frequency of

! occurrence. The selected range of events will encompass events of a lower likelihood than traditional LWR design bcsis accidents.

l

• Consequence acceptance limits for core damage and onsite/offsite releases I will be established for each category to be consistent with Comission l policy geidance with appropriate conservatisms factored in to account for uncertainties.

l

• Hethodologies and evaluation assumptions will be developed for analyzing each category of events consistent with existing LWR practices.

l

. - DRAFT

's < e I

j-

• Source term determination will be performed as approved by the Commission .

j in Section B of this enclosure. l r

i

• A set of events will be selected deterministically to assess the safety 1 margins of the proposed designs determine scenarios to mechanistically i determine a source term and to Identify a containment challenge scenario.

i j . External events will be chosen deterministically on a basis consistent

with that used for LWRs.

4 i + Evaluations of multi-module reactor designs will consider whether specific j events apply to some or all reactors onsite for the given scenario cf -

i operations pernitted by proposed operating practices.

i i

i i

5 l t i

f

{

I I

i l

DRAFT

.e

=

u P.~ _-..._... -- _ . _ , .

....-_...._...._._..__.,?_.-_._..._.,..__..._.~._.....,_..

4 B. SOURCE TERM h12t Should mechanistic source terms be developed in order to evaluate the advanced reactor and CANDU 3 designs?

A mechanistic source term is the result of an analysis of fission product release based on the amount of cladding damage, fuel damage, and core damage resulting from the specific accident sequences being evaluated, it is developed using best estimate phenomenological models of the transport of the fission products from the fuel through the reactor coolant system, through all holdup volumes and barriers, taking into account mitigation features, and finally, into the environs.

Current Reoulations Appendix I to 10 CFR Part 50 (ALARA),10 CFR Part 100 (Reactor Site Criteria, which references the Technical Information Document (TID) 14844 source term),

and 10 CFR Part 20 (Standards for Protection Against Radiation) all have limitations on releases related to power plant source terms.

GDC 60 requires that the design include means to control suitably the release of radioactive materials in liquid and gaseous effluents and to handle waste produced during operations including anticipated operational occurrences.

Preapolitants' Acoroach PRISM designers have proposed the calculation of a source term different from that done for LWRs. They have proposed siting source terms to bound the release from accidents considered in the design; the magnitude of these source terms is less than the TID-14844 LWR assumed source term. Additionally, at this time there is insufficient experimental data on the PRISM fuel to quantify the fission product release fractions or the behavior of those fission products migrating from the metal fuel through the sodium coolant.

MHTGR designers have proposed siting source terms for accidents based on the expected fuel integrity. The coated microsphere fuel particles in the core are preditted by the preapplicant to contain all the fission products except for that released from the small number of failed particles resulting from in-service particle failures and added particle failures during accidents.

Insufficient data currently exists to determine whether the MHTGR fuel performance will meet these expectations.

The PIUS designer has proposed using a mechanistic LWR lource term.

Information has been provided in the Preliminary Safety Information Document (PSID) for fission product concentrations in both liquid and gaseous effluents. It is expected that PlVS designers will adopt the results of the ongoing EPRl/NRC effort to revise the TID-14844 source term previously used for LWRs.

DRAFT

The CANDU 3 designer uses a source term for each scenario. Each accident is evaluated and fission product release and transport is determined individually for each scenario. The staff has not, at this time, evaluated the CANDU 3 codes and c:ethods.

Discussion In order to evaluate the safety characteristics of advanced reactor designs that are significantly different from LWRs, a method for calculating postulated radionuclide releases (source terms) needs to be developed. In a June 26, 1990, staff requirements memorandum (SRM) related to SECY-90-016, the Comission requested the staff to submit a aaper describing the status of efforts to develop an updated source term t1at takes into account "best available estimates" and current knowledge ori the subject. Based on this direction, the staff is now develcping for LWRs a revision to the T!D-14844 source term (NUREG-1465, " Accident Source Terms for Light-Water Nuclear Power Plants," draft report for comment, June 1992).

The differences between the LWR designs and the MHTGR and PRISM designs warrant a separate evaluation of source terms. The CANDU 3 will also be different from LWR designs in certain respects. The coolant contains significant amounts of trititm. Following failure of a pressure tube there is no heavy-walled reactor vessel to contain releases (there are large volumes of water in two concentric low-pressure tanks; moderator and shield water).

Consequently, the timing of releases is expected to be different from LWRs.

Therefore, CANDU 3 also warrants a separate evaluation of source terms.

The NRC staff is currently developing revisions to 10 CFR Part 50 and 10 CFR Part 100 to separate siting from source term dose calculations. The revisions to Part 100 being considered by the staff replace the present individual dose criteria with a population density standard. A fixed ininimum exclusion area radius of 0.4 miles is specified. Other criteria regarding po)ulation protection and seismic criteria factors are also included in tie source term Part 100 revision. The staff's recommendations for the preapplication review i are intended to be compatible with the proposed revisions.

l The staff's recommendations envision developing a set of scenoiio-specific source terms for each of the advanced reactors and CANDU 3 to allow a judgment as to whether the release from each specific sequence meets the accident evaluation criteria for sequences of that event category. Also, a source term may be developed mechanistically for core damage sequences to compare against i applicable safety criteria, f

Recommendation l -

Advanced reactor and CANDU 3 source terms should be based upon mechanistic analyses, provided that:

l DRAFT

i 1. The performance of the reactor and fuel under normal and off-normal J

conditions is sufficiently well understood to permit a mechanistic i analysis. Sufficient data should exist on the reactor and fuel i

performance through the research, development, and testing programs to j provide adequate confidence in the mechanistic approach.

2. The transport of fission products can be adequately modeled for all barriers and pathways, including specific consideration of containment design to the environs. The calculations should be as realistic as possible so that the values and limitations of any mechanism or barrier are not obscured.

3. The events considered in the analyses to develop the set of source terms

. for each design are selected to bound credible severe accidents and design-dependent uncertainties.

The design specific source terms for each accident category would constitute one component for evaluating the acceptability of the design.

I a

I i

i l

DRAFT

1 i '.

C. CONTAINMENT i hat

} Should advanced reactor designs be allowed to employ alternative approaches to traditional " essentially leak-tight" containment structures to provide for the

control of fission product release to the environment? ,

a i

Current Reculations e

General Design Criterion (GDC) 16 requires that LWR reactor containments provide an essentially leak-tight barrier against the uncontrolled release of '

radioactivity to the environment, and that containment-associated systems

assure that containment design conditions important to safety are not exceeded for as long as postulated accident conditions require. GDC 38-40 set requirements for containment heat removal, GDC 41-43 for containment I atmosphere cleanup, and GDC 50-57 for containment design, testing, inspection,

} and integrity. Requirements for LWR containment leakage testing are .

established in 10 CFR Part 50, Appendix J.

! Prescolicants' Acoroach

) The MHTGR is not designed with a leak-tight containment barrier. The design relies upon high integrity fuel particles to minimize radionuclide release,

and on a below-grade, safety-related concrete reactor building to provide

retention and holdup of any radioactive releases. The reactor vessel and the steam generator vessel are in separate cavities within the concrete structure.

In the event of a reactor coolant pressure boundary (RCPB) rupture, louvers in

, the reactor building are designed to allow the i

environment, preventing building overpressure.The passage of design building gases to thenot does

' include containment isolation valves for the ventilation line from the-building and has an open path to the environment via a drain line in the reactor cavity cooling system (RCCS) panels. Accident dose calculations assume a constant 100 percent volume per day building leak rate, and take

, credit for plateout on the building walls.

PIUS, above grade, is designed with a low-leakage containment based on a pressure-sup)ression scheme that is integral with the reactor building, similar to tie ABWR and SBWR. Below grade, the concrete pool wall and floor,

.i which is the reactor pressure boundary, and the containment are contiguous, separated only by a steel membrane. '

CANDU 3'is designed with a large, dry, steel-lined, concrete containment, i

' without containment spray. The maximum leak rate.

5 percent volome per day at the design pressure of(used in safety approximately 30analyses) psig. The-is -

. structure is designed for 3 test-acceptance leak rate of 2 percent per day at

! the design pressure. These let.k rates are significantly higher-than those of a typical U.S. PWR containment.

S

- DRAFT

The PRISM containment design is a high strength steel, low leakage, pressure-reteining boundary, consisting of two components, the upper containnient dome and lower containment vessel. The upper containment is a steel deme. It differs from light-water reactor containments functionelly in the following respects. The containment is specifically designed to mitigate the radioactive release consequences of severe events. The PRISM containment volume is markedly smaller than is typical of LWR containments; there is little separation between the reactor vessel and the containment boundary; and no safety-grade containment coolers or spray systems are provided. The entire containment structure is located below grade within the reactor building.

Discussion Each of the advanced de',igns and CMDU 3 maintain an accident mitigation approach in which containment of fission products is a part. Two of the advanced reactor designs (PRISH and Mh'GR) place the reactor building below grade, providing protection from external hazards. Generally, the advanced designs focus more attention than dc LWRs on protecting the plant by providing passive means of reactor shutdown and decay heat removal (DHR). As a result, designers proposed less stringent containment design requsrements.

The staff recognizes that reactor designs, without traditional containment structures or systems, represent a significant departure from past practice on LWRs, Imd that existing LWR containment structures have proven to be an effective component of our defense-in-dtpth approach to regulation. However, the Advanced Reactor Policy Stateaent recognhes that to encourage incorporation of enhanced safety margins (such as in fuel design) in advanced reactor designs, the Commission would look favorably on desirable design related features or reduced administrative requirements. New reactor designs

, that deviate from current practice need to be extensively reviewed to assure a 1

level of safety at least equivalent to that of current generation LWRs is provided, and that uncertainties in the design and performance are taken into account.

The staff believes that new reactor designs with limited operational experience require a containment system that provides a substantial level of accident mitigt. tion for defense-in-depth against unforeseen events, including core damage accidents. This requirement may not necessarily result in a high-pressure, low-leakage structure that meets all of the current LWR requirements for containment, but it should be an independent barrier to fission product release. The proposed criteria will heed to provide an appropriate level of protection of the public and the environment considering both the safety advantages of the advanced designs and the lack of an experience base in evaluating their performance. For evolutionary LWRs, the staff, in SECY-90-016, proposed to use a conditional containment failure 3robability (CCFP) or deterministic cents- went performance goal to ensure a salance between accident prevention and L asequence mitigation. During the evolutionary LW reviews, a great deal of careful review was necessary to assure that a probabilistic CCFP would not bc used in a way that could detract from a balanced approach of severe accident prevention and consequence mitigation. For advanced designs and the CANDU 3, limited experience exists DRAFT G

in the analysis and evaluation of severe accidents which would lead to significant difficulty and uncertainty in assessing a CCFP. For this reason,

, the staff recommends that the deterministic containment performance goal be adopted for the advanced designs and the CA C U 3. The staff proposes to postulate a core damage accident as a containment challenge event and require that containment integrity is maintained for a period of approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the onset of core damage. This approach is used because the prdiminary nature of the advanced des'.gns precludes a reliable assessment of

he failure probability of accident mitigation systems and, therefore, of containment failure probability. Further, the CCFP is grounded in a firm understanding of LWR safety systems and accident progression. Intrinsic differences exist between LWR and advanced reactor tecnnologies and their approaches to the balance between accident prevention and mitigation. A quantitative level of understanding of new technologies and systems comparable to that of LWRs is not yet available. Thus, the use of a performance based criterion rather than a quantitative one appears to be more appropriate for advanced reactor and CAliDU 3 preapplication review given the current level of knowledge of advanced reactor and CAf100 3 risk and its prevention / mitigation elements.

Recommendation The staff proposes to utilize a standard based upon containment functional performance to evaluate the acceptability of proposed designs rather than to rely exclusively on prescriptive containmer.t design criteria. The staff intends to approach this by comparing containment performance with the accident evaluation criteria.

• Containment designs must be adequate to meet the onsite and offsite radionuclide release limits for the event categories to be developed as i

described in Section A to this enclosure within their design envelope.

l

• For a period of approximately 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the onsct of core damage,

! the specified containment challenge event results in no greater than the limiting containment leak rate used in evaluation of the event categories, i

i and structural stresses are maintained within acceptable limits (i.e.,

ASME Level C requirements or equivalent). Afte- this period, the l containment must prevent uncontrolled releases of radioactivity.

l l

i i

l i DRAFT i

t

D. EMERGENCYPLANNING(EP)

Lua Should advanced reactors with passive design safety features be able to reduce emergency planning zones and requirements? l Current Reaulations Although emergency plans are not necessary for the issuance of a design certification under 10 CFR Part 52, they would be necessary for the issuance of a combined license under Part 52 or a license issued under 10 CFR Part 50.

10 CFR 50.47 requires that no operating license be issued ualess a finding is made by the NRC that there-is reason +ble assurance that adequate protective

, measures can and will be taken in the event of a radiological emergency.

Currently, offsite protective actions are recommended when an accident occurs that could lead to offsite doses in excess of the Environmental Protection Agency's (EPA) Protective Action Guidelines (PAG), which are 1-5 rem whole body and 5-25 rem thyroid. At the lower projected doses, protective actions should be considered. At the higher projected doses, protective actions are warranted.

Preacolicants' Acoroach The proposed PRISM approach to emergency planning is significantly different from that of previous LWR applications, particularly in the area of offsite EP. A design objective of PRISM is to meet the lower level PAG criteria such that formal offsite emergency planning involving early notification, detailed evacuation planning, and provisions for exercise of the plan would not be required. In order to attain this objective, the PRISM design emphasizes accident prevention, long response times (36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />) between the initiation of an accident and the release of any radiation, and containment of accidents if they should occur.

MHTGR proposed reduced offsite emergency planning for similar reasons as those 4

proposed for PRISM. There would be an emergency plan for.an MHTGR and the plan would include any agency that could become involved in a radiological emergency (i.e., sheltering and evacuating the public and controlling the food supply). The differences and reductions from a typical plan for LWRs are that the MH1GR plan would have the exclusion area boundary (EAB) of 10 CFR Part 100 as the boundary of the emergency planning zone (EPZ), as may be allowed by Appendix E of 10 CFR Part 50 for gas-ccoled reactorc; and that there would be no rapid notification or annual drills for offsite agencies. This is based on the preapplicants' assertion that (1) the predicted dose consequences I c

estimated at the EAB/EPZ for accidents are below the lower-level EPA sheltering PAGs and the public can be excluded from the EAB, (2) the significantly long time expected for the core to return to criticality after being shut down by the doppler coefficient without the reactor protection system functioning (i.e., about 37 hours4.282407e-4 days <br />0.0103 hours <br />6.117725e-5 weeks <br />1.40785e-5 months <br />), and (3) the long time for the fuel and reactor vessel to reach maximum temperatures (i.e., about 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />)

DRAFT

2 during accidents. The preappilcant asserts that the public around the plant would be outside the area that needs to be sheltered or evacuated and, further, there is ample time to notify and move the public during an event.

With regard to PIUS. ABB expects that due tc the passive safety features of the PIUS design, ensite and offsite emergency planning will be considerably simplified in conparison with current day LWRs. ABB/CE asserts that there appears to be no credible accident sequences that would lead to severe core damage. Offsite dose for the large break LOCA is claimed to be below the lower level EPA FAGS at 500 meters distance from the containment. No specific information on emergency planning was provided by the preapplicant for review beyond the general assertion that they intend to limit offsite doses to the 4

PAGs.

Discussion The advant.ed reactor desi probabilities (<1.0 x 10'gners haveofobjectives per year) exceeding of theachieving very low EPA lower-levc1 PAGs.

The vendors claim that these advanced reactors, with their passive reactor shutdown cod cooling systems, and with core heatup times much Ic.ger J than those of existing LWRs, are sufficiently safe that the EP2 radius can be reduced to the site boundary, and that detailed planning and exercising of offsite response capabilities need not be required by NRC regulation. The preapplicant's state that this does not mean that there would be no offsite emergency plan developed, but rather that such a plan could have reduced details concerning movement of people, and need not contain provisions for early notification of the general public or periodic exercises of the offsite plan on the scale of present reactors.

A similar policy issue was identified for the passive LWR design, but renains open. EPRI is currently working with the NRC staff to define a process for addressing simplification of emergency planning. The results of this effort should be applicable to advanced reactor designs.

Recommendatiqn The staff propose.: that advanced reactor licensees be required to develop offsite emergency plans. Additionally, exercises, including offsite exercises, provisions for periodic These should be developed. emergency actions are required by existing NRC regulations which include the r2 quired establishment of an offsite emergency planning zone (EPZ). Consistent with the current regulatory approach, the staff views the inclusion of emergency preparedness by advanced reactor licensees as an added conservatism to NRC's

" defense-in-depth" philosophy. Briefly stated, this philosophy: (1) requires high quality in the design, construction, and ' operation of nuclear plants to reduce the likelihood of malfunctions in the first instance; (2) recognizes that equipment can fail and operators can make mistakes, therefors requiring safety systens to reduce the chances that malfunctions will lead to accidents that releasa fission products from the fuel; and (3) recognizes th:t, in spite of these precautions, serious fuel damage accidents can happen, therefore requiring containment structures and other safety features to prevent the

~

DRATT

l j-i

,' release of fission products offsite. The added feature of emergency planning to the defense-in-depth philosophy provides that, even in the unlikely event l of an offsite fission product release, there is reasonable assurance that

emergency protective actions can be taken to protect the population around nuclear power plants.  ;

I Information obtained from accident evaluations conducted as outlined in

Section A of-this enclosure will provide input to the Emergency Plannir.g 1

requirements for advanced reactor designs. Based in part upon these accident evaluations, the staff will consider whether some relaxation from current requirements may be appropriate for advanced reactor offsite emergency plans, t The relaxations to be evaluated will include, but not be limited to, notification requirements, size of EPZ, and frequency irf exercises. This

. evaluation will take into account the results of passive LWR emergency planning policy decisions.

l l

4 I

i 1

l

? ,

i l

i o

g

-. g + r,we-- - n

E. REACTIVITY CONTROL SYSTEM hali .

Should the NRC accept a reactivity control system design that has no control

, rodsf Current Reaulations General Design Criterion (GDC) 26 requires that two independent reactivity l control systems be provided. One of the systems shall use control rods, l preferably using a positive means for insertion. The other system shall be capable of controlling planned reactivity changes to assure fuel limits are not exceeded, i

Etugplicants' P_gsition l The PIUS design does not have control rods. However, the preapplicant proposes that the design complies with the intent of General Design i Criterion 26 by having two independent liquid boron reactivity control l systems. The normal reactivity control system pumps boron into the pHmary coolant loop *.o control reactor power or effect a reactor shutdown; this system is only safety-grade within the bounds of the containment isolation valves. The fully safety-grade reactivity control system relies on the

, ingress of highly borated water through the density lock from the reactor pressure vessel to scram the reactor. This ingress occurs when the equilibrium conditions across the thermal barrier of the density locks are disturbed by an imbalance between the thermal core heat generation and removal rates. Either a trip of as few as one of the four reactor coolant pumps or a reactor overpower event (with forced flow) could initiate borated water flow into the core. The reactor protection system initiates the scram function by i

tripping a single reactor coolant pump. Other reactivity control features of the design are in-core burnable poisons for power shaping, and limitations in -

core size for control of xenon oscillations for slow, large, and small reactivity changes. For rapid changes, the design relies on the highly neg:tive moderator temperature coefficient of reactivity.

l The density locks, essentially bundles of open, parallel tubes about 3 inches l in diameter, have no moving parts. They are of safety-grade construction and intended to be highly reliable. However, their function must be demonstrated ,

and the potential for blockage and high cycle thermal fatigue cracking, and the effects of blockage and fatigue must be evaluated. A failure of the i density locks would not only >revent a scram, but would interrupt the only safety-grado core cooling mecianism.

Discussion The existing LWR regulations provide prescriptive design guidance for one reactivity control system to contain rods. Of the three advanced reactor designs, only PlVS does not have the capability to control reactivity with control rods. The PIUS design does have, however, three ways to introduce l DRAFT

liquid boron into the core to control and shutdown the reactor. Two of the three rely on flow through the density lock from a common supply of borated 2001 water. The other system is the normal reactivity control system which-ins a separate boron tank and is used for normal shutdown.1he latter system is only safety grade within the bounds of the containment isolatien valves.

Recommendation -

The staff concludes that a reactivity control system without control rods {

should not necessarily disqualify a reactor design. A design without control rods may be acceptable, but the applicant must provide sufficient information to justify that the~e is an equivalent level of safety in reactor control and protection as compared to a traditionc1 rodded system. This information must include the areas of:

a. reliability and efficacy of scram function

b. suppression of oscillations

c. control of power distribution

d. Shutdown margin

e. operational control h

DRAFT 4

m_ _ _ _ _ _ _ _ . _ . _ _ _ _ ___._._m __ . . ______.__m_ _ _ _ _ . _ _

1 I

I F. OPERATOR STAFFING AND FUNCTION Issue  !

Should advanced reactor designs be allowed to operate with a staffing complement that is less than that currently required by the LWR regulations.

2M AM2 Lt10D1 The NRC has established the requirements for control room staffing in 10 CFR 50.54(m)(2)(111) which states a senior operator must be present in the control room at all times and a licensed operator or senior operator must be present at the controls of a fueled nuclear power unit. 50.34(m)(2)(i) provides a table identifying the minimum staffing requirements for an operating reactor.

Standard Review Plan 13.1.2,Section II.C states that at any time a licensed nuclear unit is being operated in modes other than cold shutdown, the minimum shift crew shall include two licensed senior reactor operators (SRO), one of whom shall be designated as the shift supervisor, two licer ad reactor operators (RO), and two unlicensed auxiliary operators (/ Jj Preacolicants' Position The MHTGR plant is presently four rncte .nedules with two modules feeding a single steam supply system. The design includes a snift-staffing level of eight persons who would be dedicated to plant operations; a senior licensed shift supervisor, two licensed reactor operators in the contro' ecom, and five roving non-licensed operators. This results in three licensed ana five non-

licensed operators for four reactor modules.

The PRISM control room would contain the instrumentation and controls for all nine reactor modules and their power conversion systems. The objective for

the minimum number of operating staff would include: one SR0 shift l supervisor, one SR0 assistant supervisor, one RO per power block (three .

modules) in the control room, and three plant R0s. This results in a minimum l of eight licensed operators far nine reactor modules.

During normal plant operations the PIUS main control room would be manned by two R0s and a SRO shift supervisor. The shift supervisor would not be required to be in the control room at all times.

The CANDV 3 preapplicant has not proposed a specific number of licensed operators, but the staff's expectation is that CANDU 3 will meet the current LUR staffing requirements.

Discussion Present day LWRs would raquira a minimum of one shift supervisor, one SRO, and two operators per reactor. The designers of advanced reactors have stated that the highly automated operating systems, the passive design of safety DRAFT

l i

l features, and the large heat capacity results in reactor designs that respond to transients in a manner that demands less of the o>erator than do the current operating plants or evolutionary designs. T1e preapplicants assert that the passive safety features and, in some cases, large coolant inventory of the PRISH, ilHTGR, and PIUS designs may not require an operator to act or intervene for several days following an accident. These designs also automate systems that start up, shut down, and control these reactors. The vendors of these reactors have suggested that they could be operated with fewer licensed operatcrs and believe that this would reduce significantly the training and operating costs to licensees.

A similar policy issue, Role of the Operator ia a Passive Plant Control Room, was identified in the staff's June 25, 1992, draft policy paper on passive reactors. In that paper, the staff expressed concern that tie man-machine interface for the passive reactors had not been sufficiently addressed and that actual testing needed to be done on a control room prototype. The staff believes that position is also applicable to advanced reactors.

Recomendation The staff believes that operator staffing may be design dependent and intends to review the justification for a smaller crew size for the advanced reactor designs by evaluating the function and task analyses for normal operation and accident management. The function and task analyses must demonstrate and confirm through test and evaluation the following:

• Smaller operating crews can provide effective response to a worst case array of power maneuvers, refueling and maintenance activities, and accident conditions.

a An accident on a single unit can be mitigated with the proposed number of

licensed operators, less one, while all other units could be taken to a .

. cold shutdown condition from a variety of potential operating conditions fncluding a fire in one unit.

l The units can be safely shut down with eventual progression to a safe

! shutdown condition under each of the following conditions: (1) a complete i

loss of computer control capability, (2) a complete station blackout, or (3) a design basis seismic event.

• The adequacy of these analyses shall be tested and deir,onstrated on an L actual control room prototype, i

I l

l f

DRAFT l

G. RESIDUAL HEAT REMOVAL inn Should advanced reactor designs that rely on a single completely passive, safety-related Residual Heat Removal (RHR) system be acceptable?

Current Reaulatigm General Design Criteria (GDC) 34 requires the RHR function to be accomplished using only safety-grade systems, assuming a loss of either onsite or offsite power, and assuming a single failure within the safety system. Regulatory Guide 1.139 (issued in draft for comment), augmenting the GDC, states that the RHR function mest be performed to reach a safe shutdown condition within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> of reactor shutdown. Branch Technical Position (BTP) RSB 5-1 states that the RHR function must be performed in a reasonable period of time following reactor shutdown.

Preacolitants' Position The PRISH design uses tne reactor vessel auxiliary cooling system (RVACS) as the safety-grade system for residual heat removal from the reactr' core.

Reactor generated heat is transferred through the reactor vessel to the containment vessel outer surface. RHR is then accomplished through natural circulation heat transfer to the atmosphere. Cooler air flows downward into the below grade reactor silo, where it is turned inward and upward to be heated by the containment vessel outer surface and a special collector cylinder. This heated air then flows out of the silo and is released to the '

atmosphere. The RVACS is completely passive and always in operation. The RVACS is proposed as a backup to tiormal non-safety-grade cooling through the intermediate heat transport system, the steam generator, and condenser. If the condenser is not available for cooling but the intermediate sodium loop remains available, then the non-safety-grade auxiliary cooling system (ACS) supplements RVACS. The ACS operates through natural circulation air cooling of the steam generator. The RVACS design basis analysis (performed by the designer) results in high temperature conditions (within design limits) for an extended period of time if no other system is operated. However, use of the ACS system in conjunction with RVACS can limit peak coolant temperature for decay heat removal to about 15 *C above normal' operating temperatures.

The MHTGR is designed with only one safety-grade system for removing residual heat from the core, the reactor cavity cooling system (RCCS). The RCCS consists of panels within the reactor cavity and ducts connecting the RCCS panels to four inlet / outlet ports. Redundancy is provided by these separate ports and a cross-connected header. that surrounds the reactor vessel (i.e.,

any panel can be fed from any inlet and can discharge to any outlet). The RCCS operates by absorbing radiant heat from the reactor vessel to the panels which surround the reacter vessel and transferring the heat by convection to the air flowing by natural circulation in the panels. As the heated air rises, cooler, atmospheric air is drawn to the panels through the inlet ports.

There are no active components in the RCCS. The system is always in DRAFT

caeration. The RCCS is relied upon when the heat transport system (HTS) and tie shutdown cooling subsystem (SCS) are inoperable. The HTS utilizes the steam generators and non-safety-grade feed system and condensers and is used during nomal operations, startup/ shutdown and refueling. The SCS is a non-safety-grade backup to the HTS. The SCS system uses an alternate helium circulator for core cooling and an additional heat sink, the shutdown cooling heat exchanger. Again, use of the non-safety-grade backup RHR systems reduces the frequency, magnitude and duration of high temperature challenges to the reactor vessel.

The PIUS design uses a safety-grade passive closed cooling system (PCCS) for residual heat removal from the reactor pool. The system consists of eight independent parallel loops located in four separate compartments that are physically separated from each other. Heat is'dissi)ated through four (4) natural draft cooling towers located on the top of tie reactor building. One cooling tower is in each quadrant of the reactor building. The reactor pool water can be maintained at 95 *C with one loop out of service. The system is always in operation. Reactor residual hett can be removed with the condenser during startup/ shutdown and refueling conditions. If the condenser is not available, a non-safety-grade diesel-backed pump system can cool the pool water.

D11tn119.0 Similar issues were identified for the RHR system of the passive LWR designs.

In a draft Commission paper issued for comment on February 27, 1992, the staff identified issues relating to the ability of passive systems to reach safe shutdown, definition of a passive failure, and treatment of non-safety systems which reduce challenges to the passive systems. These issues remain open and the staff will propose recommendations in the future for resolution.

In the case of advanced reactors the safety-grade RHR systems are completely passive and are in continuous operation. Continuous performance monitoring of the passive systems is one advantsge of the constant operation. The high heat

' capacity cf PRISM and MHTGR lead to longer time periods before exceeding temperature limits. PRISH and MHTGR use the natural circulation of air to remove residual heat. PIUS uses natural circulation of water through natural draft cooling towers for its RHR system. The lack of check and squib valves, the continuous operation and use of a single phase fluid in the system appear to offer increased reliability over the passive LWR systems.

However, reliance only on passive systems may lead to high temperature challenges to the reactor vessel and reactor internal structures since higher heat removal rates in passive cooling situations require larger temperature differences between the reactor and cooling medium (air). Elevated temperatures (above_ normal operating values) may exist in the vessel and internal structures for long periods of time. Particularly in the high temperature reactors, the PRISM and MHTGR, creep damage may be more likely as the result of these high-temperature transients.

l DRAFT

.. . = , . . - - . - - . _ ._ - . _ _ _ - _ - _ _ _ _ _ _ _ _ _

d i

-RecommeadatioJ1 i As a result of the unique design features of the PRISM,.MHTGR, and P!US designs, the staff believes that reliance on a single, completely passive, safety-related RHR system may be acceptable. In carrying out its future detailed design evaluation, the staff will assure that NRC regulatory treatment of non-safety-related backup RHR systems is consistent with 4

Commission decisions on passive light-water reactor design requirements, d

l t

4 C

!~

1 i

i h

I i

h i-1 l

21 - DRAFI e

4 4

.A

,, ,r ,..rww- c-- .x,--, ., -- , , , 9 94- - --- , , y - - , ,

H. POSITIVE VOID REACTIVITY COEFFICIENT Issue Should a design in which the overall inherent reactivity tends to increase under specific conditions or accidents be acceptable?

Current Reaulations General Design Criterion (CDC) 11 requires that the reactor core and coolant system be designed so that in the power operating range the net effect of prompt inherent nuclear feedback characteristics tend to compensate for rapid increases in reactivity.

Preacolicants' Position In the PRISM design, the maximum sodium void worth, according to the preapplicant, assuming only driver fuel and internal blanket assemblies void, is nominally $5.50. If radial blanket assemblies are included, the sodium void worth is nominally $5.26 which does not include the -70 cents from gas expansion modules (GEM). Should sodium boiling begin, on a core-wide basis under failure to scram conditions with a total loss of flow without coastdown, the reactor could experience a severe power excursion and core disruption.

The predicted temperature reactivity feedback is approximately -80 cents prior to the onset of sodium voiding. This mitigates to some extent the positive reactivity addition. For sodium voiding to occur, multiple failures of redundant and diverse safety-grade systems would be required.

Although the overall power coefficient for a CANDU 3 reactor is claimed to be slightly negative and very close to zero, the coolant void reactivity is positive throughout the fuel core lifetime. The total core void worth is between $1 and $2. The positive void coefficient is not a concern during normal operation, but, during a large LOCA at specific location., void reactivity increases dramaticaily. If CANDU 3 were to experience a large-break LOCA (guillotine rupture of an inlet header) with a failure of both shutdown systems, the positive void reactivity insertien could lead to a power excursion followed by core melting. The CANDU 3 design is intended to prevent an unstrammed event from occurring through the use of two separate shutdown systems each to be independent, redundant, diverse, and safety grade.

Discussion The staff considers the existence of positive coolant void coefficients, or any reactivity effect that tends to make a postulated accident more severe, a significant concern. As a result of a positive void reactivity coefficient, events involving even a relatively short scram delay could result in a core disruption accident. The staff intends to require the preapplicant to analyze the consequences of events (such as ATWS, unscrammed LOCAs, delayed scram events, and transients which affect reactivity control) that could lead to core damage as a result of the positive void coefficient, taking into account the overall risk perspective of the designs. A core disruption accident in DRAFT

,i*

1 either the PRISM or CANDU 3 designs may not necessarily lead to a large scale release of the radionuclide inventory to the atmosphere due to- their-respective mitigative designs.' - In the CANDU 3 reactor, multiple redundant, diverse fast acting scram systems are provided to address the positive coefficients.

l Attempts to modify the designs-to reduce the effects of these positive coefficients may result in other consequences potentially as serious. For example, in the PRISM design, the positive -void coefficient seems to result 4

from the design objectives of maintsining a passive shutdown capability and of 4 minimizing the reactivity swing over core life. Attempts to reduce the PRISM l void worth might have the effect of . increasing.tne severity of rod. withdrawal-accidents or reducing the ability to withstand an unscrasned loss of heat sink events without core damage.

Recommendation j The staff concludes that a positive voto coefficient should not necessarily l disqualify a-reactor design. The staff is. proposing to require that the PRISM

and CANDU 3 preapplicants analyze the consequences of events:(such as ATWS, unscrammed LOCAs, delayed scrams, and-transients affecting reactivity control) that ~could lead to core damage as a result of the positive void-coefficients.

The staff's review of these analyses will take11nto account theLoverall risk -

perspective of the designs. Whether the preappitcants will be required to

, consider changes in the. designs-to mitigate the consequences of these accidents will depend on the estimated probability of the accidents as well as the severity of the consequences.

5 l-l l

I i

l -

i L

l

[L I

l i.-

DRAFT L.--.,..- .-..

4

~

I. CONTROL ROOM AND REMOTi. SHUTDOWN AREA DESIGN liin Can current requirements for a seismic Category I/ Class lE control roo:a and alternate shutdown panel be fulfilled by a Remote Shutdown Area, and a non-seismic Category I, non-Class lE control room?

Current Beoulations The current LWR requirements for control room and remote shutdown area design are provided in 10 CFR Part 50, Appendix A, and 10 CFR Part 100. General Design Criterion (GDC) 19 requires that a centrol room with adequate radiation protection be provided to operate the plant safely under normal and accident conditions and that there be an ability to shut down the plant from outside the control room. GDC 17 requires that the electrical system for the control room and remote shutdown equipment meet the requirements for quality and independence. These requirements are defined as Class IE in the supporting IEEE standards. GDC 2 and 10 CFR Part 100 require tMt structures and systems important to safety be designed to seismic Category I standards to remain functional during a safe shutdown earthquake, frH noiicants' Egillion The control room for PR:"M contains the instrumentation and controls for all nine reactor modules and their power conversion systems. The enntrol room structure is not considered safety related and, therefore, the room is not designed to seismic Category 1 design requirements. Additionally, no equip-ment in the control room is safety grade. A separate alternate shutdown console is located in the protected area of the reactor service building. The alternate shutdown console is within a seismic Category I structure and is equipped with the necessary Class IE controls and instrumentation to protect the core and has the required habitability control system.

The MHTGR design has, for the four modules, a non-safety-related central con-trol room to operate the plant and a seismic Category I remote shutdown area from which to respond to accidents if necessary. Neither the equipment in the control room nor the remote shutdown area are Class IE. The remote shutdown area does not contain safety related equipment, nor does it include a ventilation system for operator habitability, or a safety-related manual scram. This is based on the preapplicant's position that accidents do not require operator response. The only manual scrams are non-safety-related and are ic.ated in the remote shutdown area, not the main control room.

The CANDU 3 design utilizes a main control room to perform all monitoring and control functions for normal operation and all accident conditions, except those events for which the control room becomes unavailable. The main control room is not designed to be operable following an earthquake, tornado, fire, or loss of Group 1 (nea-essential) electrical power, but the operator must remain available to proceed to the secondary control area. The secondary control area duplicates, to the fullest extent possible, the control locations, lAATT

i d

layouts, and capabilities present in the Main Control Room. The secondary control area is seismically qualified and is electrically isolated from the main control roem so that failures occurring in the Group 1 area will not interfere with control and monitoring of safety systems from the secondary 3 control area. All equipment located in the route from the main control room 4 to the secondary control area is to be qualified to the extent necessary to prevent route blockage, fire, ar flood. CANDU 3 has specified requirements to assure habitability during accident conditions.

The central control room for the PIUS design is a seismic Category I structure. However, the safety-related systems within this structure are for monitoring only to assure that the core is protected. Although the operator 2

could take actions, these actions would be with the use of non-safety-grade controls. The two remote shutdown areas are housed in separate compartments

. at the bottom of the reactor building in protected seismic Category I areas.

Each remote area contains one half of the safety-grade cont:rol equipment, e.g., the reactor trip and interlock system, control of certain isolation i valves,-and safety-grade monitoring systems.. The manual reactor trip system is a push-button control of the main reactor coolant pumps. Both the main i

control room and the emergency shutdown areas are serviced by a safety-grade -

ventilation system to assure habitability during accidents.

i Mscussion f

The staff believes that the operators remain a critical element in ensuring reactor plant safety and that no increased burden should be placed on operators managing off-normal operations. The control room is the space in i

the plant where operators are most familiar with the surroundings and-normally manage plant activities. The staff is reluctant to approve any design that l would increase the frequency of evacuation of the control room during design basis accident conditions or hamper the control or. monitoring of upset 4

conditions as the event sequence progresses. The staff believes human performance will still play a large role in the safety of the advanced plants and CANDU 3 and that the quality of support provided by the safety-related, j seismic Category I and electrical Class IE control room is appropriate, i

l The staff also believes that any remote shutdown area should be designed to

! complement the main control room. Sufficient Class lE instrumentation and 6

controls should be available to effectively manage anticipated accidents that L would result in a loss of the control room functions. The location and I structure of the remote shutdown areas should also ensure continuity of operattors to the greatest extent possible, l

A related policy issue was identified in the staff's February 27, 1992, draft-i paper on policy issues for the passive 1.WRs where EPRI proposed less conservative control room habitability requirements and that analyses cf control room habitability.be limited to 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> instead of the accident i duration. The staff disagreed with the proposed EPRI guidance and offered -

- different criteria. 51milarly, the staff in its June 25, 1992, draft policy )

DRAfl f

o

4 i'

paper defined positions on common mode failures in digital systems and on annunciator reliability. Staff requirements for advanced reactor designs will 4 be consistent'with passive LWR policy guidance for these issues, once the guidance is finalized.

i Recommendation

The staff recommends that until passive LWR pollcy for design requirements of

control rooms and remote shutdown facilities is finalized, the staff will apply current LWR regulations and g~uidance to the review of advanced reactor designs. -This will ensure that plant controls and the operators will be-

adequately protected so th'at safe shutdown can be assured in accident l situations. -

d l

l v

h

!~

i I

a l

I '

i i e l~ DRATT r

i L ,, . . . - , . .. . _ . _ ...~.m-.

J. SAFETY CLASSIFICATION OF STRUCTURES, SYSTEMS, AND COMPONENTS hin

What criteria should the NRC apply to the advanced reactor designs to identify i the safety-related structures, systems, and components?

Current Reaulations

Title 10 of the Code of Federal Regulation Section 50.49(b)(1) and the current l Appendix A.VI(a)(1) of 10 CFR Part 100 list the following criteria to define the safety-related structures, systems and components:

a. those needed to maintain the integrity of the reactor coolant prassure

. boundary (RCPB);

t l b. those needed to shut down the reactor and maintain it in a safe condition;

and 4 c. those needed to prevent or mitigate the consequences of accidents that -

could result in doses comparable to Part-100 guidelines.

Amendments to Parts 50 and 100 have been proposed (77 FR 47862) to update i

criteria used in decisions regarding. reactor siting and design for future nuclear power plants, including the advanced LWR designs. These proposed 9

revisions include the temporary relocation of the dose considerations for reactor siting (i.e., the current Part 100 guidelines) from Part 100 to Part 50 until such time as more specific requirements are developed regarding

accident source terens and severe accident insights.

j Preaonlicants' P2111.iDB The advanced reactor designs rely on a limited number of safety-related -

systems to protect the core and the public. Some of these -systems are entirely: passive, with no moving components.and do not require operator. '

l- . action. The vendors believe that this reduction 1n safety-related equipment results in simpler plant designs with lower costs. This also resultsiin many structures, systems, and components, which are considered as safety related in

' LWR designs, being classified as non-safety-related in the advanced reactor designs.

Of the advanced reactor' designs, only the MHTGR design:is not using the

' current. LWR criteria above~ for safety classification. For the NHTGR design, the only criterion for safety-grade classification is those structures, '

systems,:and components needed to mitigate the dose consequences at the site 4

boundary from accidents or events to below the guidelines in the current

-10 CFR Part 100. Several major issues with safety classification were-identified previously by the staff in the Draft PSER (NUREG-1338): (1)_the

RCPB is not entirely. safety related, (2) no safety-related equipment is used' i' to pressurite and depressurize the RCP8, (3) the coolant moisture monitor is-not safety related, and (4) neither the control room or remote shutdown area l

_ DRAFT

., _,,pg .mm.w S.+ q f w

• er am i- m-a-----.------

4 I-L p

L are safety related, and (5) no safety-related instrumentation providing reactor protection or monitoring functions are available in the control room .

i or remote shutdown area.

!' gjscussio'n '

F The NRC LWR criteria are intended to require defense in depth; the advanced i reactor designs-include high quality, non-safety-related active systems to-

! provide defense 4n-depth capabilities for reactor. coolant makeup and decay

heat removal. These would be the first line of defense in the event of 4

transients or plant upsets. The non-safety-related systems are, according to 4 -the designers, not required for mitigation of design bas _is events,. but doe "

provide alternate mitigation capability. In a recent-draft SECY paper f covering the passive ALWRs, the NRC staff stated that .it was still evaluating l - the issue of treatment.cf non-safety-related systems for the passive ALWRs and i the proposed resolution to. this issue would be provided later. The staff l- plans to treat non-safety-related systems consistent with the eventual

!- . position for passive LWRs.

Recommendations

{

! The staff intends to: apply the LWR criteria for identification _of safety -

l related structures, systems, and' components toLthe MHTGR' design. Requirements

!- for non-safety-related systems will be consistent lwith:the NRC position for j - passive LWRs.- We have noted that LWR criteria may_be restructured,within Parts 50 and-100, and our expectation.is that the criteria in Part 50 will l;

i apply to the standard design certification.

e l

c e

4 a

l .

L i

.,28 -

DRAFT-l p

7 5wr e ,--,s- .- , , , , i--, y. 3,- ew,y.yry.y.,+gp- ,..y ye y .y g g 9 wwg ap y y ,, 9 - g air,vgw,,- w g,or+,,,r, w -v%w, ---v,y3y(

4 A. CANADIAN DEUTERIUM URANIUM (CANDU) 3 REACTOR DESIGN Develooment History The CANDU 3 is the latest version of the pressurized heavy-water reactor (PHWR) system developed in Canada. The CANDU 3 design evolved from other CANDU PHWRs, most notably the CANDU 6 design. The CANDU 3 is a generic standard design that has retained many key components (steam generators, coolant pumps, pressure tubes, fuel, on-line refueling machines, instrumentation, etc.) that have been proven in service on operating CANDU power reactors. Currently, there are 25 CANDU reactors in operation in 6 different countries and 19 under construction. The first CANDU reactor was placed in service in 1968. CANDU experience to date amounts to over 175-years of effective full power operation.

On May 25, 1989, Atomic Energy of Canada, Limited, Technologies (AECLT) informed the NRC of their intent to submit the CANDU 3 reactor design for standard design certification in accordance with Part 52. AECLT of Rockville, Maryland, is a wholly-owned subsidiary of Atomic Energy of Canada, Limited (AECL) (a crown corporation of Canada), and is the preapplicant for the CANDU 3 design. AECL in Canada is also pursuing standard design certification of the CANDU 3 with the NRC's Canadian counterpart, the Atomic Energy Control Board of Canada. AECLT's current plans are to submit a standard design certification application for CANDU 3 in the 1995-1996 time frame.

Desion Description The CANDU 3 is a 450 MWe heavy-water-cooled and -moderated, horizontal pressure tube reactor that evolved from the CANDU 6 design. The CANDU 3 uses deuterium oxide (heavy water) as a moderator because its small thermal neutron capture cross section allows the use of natural uranium as fuel. However, because the moderation properties of heavy water are not as good as light water, the volume ratio of moderator to fuel is five to eight times that of an LWR, Thus, the CANDU core is larger than an LWR core generating the same power. This results in a lower core power density for CANDU 3. In addition, the CANDU 3 core is neutronically loosely coupled which results in xenon induced flux tilts that requires a relatively complicated computer operated spatial flux control system.

As in LWRs, CANDU 3 fuel elements consist of pressed and sintered uranium

, dioxide pellets enclosed in a zirconium cladding. Each CANDU 3 fuel bundle is about 20 inches long, consists of 37 fuel compacts and is loaded into each of the 232 horizontal fuel channels. Each of the 232 horizontal fuel channels consists of a pressure tube concentrically placed inside a calandria tube.

The pressure tubes form part of the reactor coolant system pressure boundary.

Because of the low excess reactivity associated with a natural uranium core, DRAFT Enclosurel

the CANDU design must be fueled on a continuous basis during power operation by an automatic fueling machine. On-line fueling is the primary means of changing reactivity in the CANDU 3.

For the CANDU 3 design, heavy water coolant flow through the core is uni-directional, thereby facilitating on-line fueling from one end of the reactor with a single fueling machine. lhe primary system operating pressure (nominally 1435 psig) is maintained by a pressurizer connected to one of the outlet headers. The CANDU 3 light-water secondary system is similar to that of a PWR.

The fuel channel assemblies are enclosed in a horizontal, cylindrical vessel called a calandria that contains the low-temperature (140 *F), low-pressure, heavy-water moderator. The calandria vessel, in conjunction with the integral end shields, supports the horizontal fuel channel assemblies and the vertical and horizontal reactivity control unit components. The CANDU 3 utilizes four reactivity control systems for reactor control and shutdown during normal operation, and two redundant and diverse safety-grade shutdown systems are used for reactor shutdown following a transient. A separate moderator heat removal system ensures that the moderator remains subcooled.

All systems in the CANDU 3 design are assigned to one of two groups - either Group 1 or Group 2. The systems of each group are capable of shutting down the reactor, maintaining cooling of the fuel, and providing plant monitoring capability in the event that the other group of systems is unavailable.

Group 1 systems are those primarily dedicated to normal plant power pro-duction. The Group 2 systems include four special safety systems and other safety-related systems. These maintain plant safety in the event of a loss or partial loss of Group 1 systems, and mitigate the effects of accidents, including the design basis earthquake. The Group 1 and Group 2 systems are, to the greatest extent possible, located in separate areas of the plant.

CANDU 3 employs two fast-acting, redundant, and diverse Group 2 shutdown systems, separate from the Group 1 reactor regulating system. Shutdown System No.1 (SDSI) consists of 24 vertically inserted control rods. Shutdown System No. 2 (SDS2) consists of six horizontal nozzles through which a gadolinium nitrate solution is injected. Both shutdown systems inject into the low-pressure moderator, precluding a rod ejection accident. In addition to the two shutdown systems, the remaining special safety systems include containment and emergency core cooling system (ECCS).

The CANDU 3 containment system includes a reinforced concrete containment structure with a reinforced concrete dome and an internal steel liner. The containment is designed with a test acceptance leakage rate of 2 percent per day. ECCS supplies light-water coolant to the reactor in the event of a loss-of-coolant accident. Each of the four safety' systems is required to demonstrate during operation, a dormant unavailability of less than 10'3 or abcut 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> per year, and be physically and functionally separate from the normal process systems and from one another. The CANDU 3 shutdown cooling system is designed to remove heat from the HTS at nominal operating temperature and pressure.

ORAFT

r-B. MHTGR (MODULAR HIGH-TEMPERATURE GAS-COOLED REACTOR) l Development History

The Modular High Temperature Gas-cooled Reactor (MHTGR) was proposed to NRC by i the U.S. Department of Energy (DOE) in 1986 in response to the Commission's i Advani

ed Reactor Policy Statement (51 FR 24643). A preliminary safety information document (PSID) and twelve amendments were submitted from October

, 1986 to March 1992. The PSID and 10 amendments were reviewed by the Office of

Nuclear Regulatory Research and a draft preapplication safety evaluation i report (PSER) was issued by NRC in March 1989. DOE recently advised the NRC

that the MHTGR design certification applicstion schedule will be established i in August 1993, when a DOE decision on the gas-cooled new production reactor i funding will be made. The Energy Policy Act of 1992 requires DOE to submit a j preliminary design approval applici. tion by September 30, 1996.

Commercial gas-cooled reactors began with the graphite-moderated, carbon i

dioxide-cooled Magnor reactors developed.in the early 1950's in the United Kingdom and France. In the United States, gas reactor development resulted in i the-40 MWe Peach Bottom 1, which operated from 1967 to 1974, and the 330 MWe Fort St. Vrain, which operated from 1976.to 1989. There have been about 50

. gas-cooled reactors in the. world totaling about 1000 reactor-years of operation. In this total, there'has been about 50 reactor-years of experience i

with the HTGRs. ,

! The BISO and TRISO (trade names) multi-layered microsphere fuel form is used in HTCas. The BISO fuel form, a fuel kernel with two major layers, was usea

, in Peach Bottom 1; and the TRISO fuel form, a fuel kernel with four major l- layers (including a ' silicon carbide layer), was used at Fort St. Vrain. The TRISO fuel form provides higher fuel integrity requirements than the BISO fuel and-is the reference fuel for the MHTGR. DOE maintains. agreements with Germany and France for the exchange of technical information concerning the integrity of'the reference MHTGR fuel, and experiments'will be conducted in France. As part of DOE's-Techn' ology Development Program for the MHTGR, post i irradiation-testing of develcpment fuel at Oak Ridge National Laboratory is i.

being performed, and a technical-information exchange-agreement was established with Japan, which'is building an experimental. HTGR.

J

[ Major trends in recent HTGR designs, including the MHTGR, are the following:

(1) increased system pressure, (2)' steel' pressure vessels- for the smaller-

' HTGRs, including the MHTGR, versus the prestressed concrete reactor vessel for 4

larger HTGR de witha6x10'pigns-asFortSt.Vrain,(3)proposedgreaterfuel-integrity, fraction of failed fuel assumed for the MHTGR, and (4) lower

, enriched uranium fuel.- ,

Desion Oe.scription

- The standard MHTGR olant is fnur reactor-steam generator modules and two steam turbine-gener' tar; sets .- Each module is designed for a thermal output of

- 350 MWt. Two reactor modules are coupled to a steam turbine-generator set to

, produce a total plant electrical output of 540 MWe.

3- DRAFT 1-m - - ,.u.. ,, . - - . . - . . m . ..v. . .,-c , .c+.. ,, # , , . <

The low-power density (5.9 watts /cc) reactor core it helium cooled and graphite moderated, and uses ceramic coated (four major layers) microspheres

! in an organic bonded cylindrical compact as the fuel. The core design is intended to provide a large negative doppler coefficient to shutdown the reactor with heatup. The microsphere fuel design is stated to allow fuel temperatures as high as 2900 *F without significant fission product release.

The compacts are placed in small vertical holes in the hexagonal graphite block fuel assemblies. The fuel assemblies are cooled through passages in the blocks . There are about 660 graphite blocks in the 66-column annular core region between the inner and outer reflector regions. The helium is a single 4

phase coolant chemically and neutronically inert.

The MHTGR has a below-grade, safety-related reactor building, containing the

, reactor and steam generatur vessels. The core is in a steel vessel located, with the steam generator, in the reactor building below ground to reduce seismic loads. The reactor vessel is above the steam generator vessel to prevent natural circulation and connected to this vessel by a horizontal crossduct vessel. The reactor and steam generator vessels are in separate cavities. The secondary side water is superheated in the steam generator.

The core outlet helium temperature is about 1300 *F and the steam outlet temperature is about 1005 'F. The secondary side pressure is higher (about 2500 psig) than that on the primary side (about 025 psig), so water would leak into t's coolant with a steam generator tube leak or failure.

Reactor protection is provided by two safety-related reactor protection systems (control rods and boron carbide balls), which are diverse and

' redundant, and one non-safety-related system (control rods). The non-r W tyc related system is independent from and redundant to the safety-grade sy', ass.

The equilibrium shutdown core temperature would be approximately 250 4 , " e j design temperature for refueling.

The safety-related RCCS is a set of panels surrounding the reactor vessel with a header connection to four inlet and exhaust ports above ground. This allows f

hot air to rise thus removing heat transferred from the reactor vessel while i cold air is drawn from outside into the panels. The system (1) is entirely passive with no moving components, (2) is always operating, (3) automatically i

responds to rising temperatures through thermal radiation and t,atural circv-

' Intion, and (4) has flow path redundancy to the cooling panels through a cross-connected header. In addition, there are two other non-safety related, active heat removal systems: (1) the shutdown cooling system in the bottom of the reactor vessel, and (2) the main circulator / steam generator 'in the primary cooling loop. The non-safety-related systems are not relied upon for accident l safety analyses.

The multiple barriers to fission product release are the coated fuel i

microspheres, the graphite blocks, the ASME Code reactor coolant pressure boundary (RCPB), and the containment. The containment is the reactor building j below ground with containment isolation valves on the steam generator i

OTATT

4 main steam and 'feedwates' inlet piping. It will not retain the gases from a rapid RCPB depressurl7ation, but is designed to have a leak rate of less than 100 percent / day after-initial depressurization.

4 4

4 a

i, d

1.

s I

1 k

i i

e i

i k

I .

1 i '

t f

i i

i_

(

I i

( c.

i .

i-e==

.- DRAFT.'

!i t' ,

r, i

, , , , , -, - , , , ,..v., .. ,, , ,r--.-- -- , a n ~. ,~ .,,-,,,n-, -, ----.,.-~,.,4,,,- , ....~...:....------

6 C. PIUS (PROCESS INHERENT ULTIMATE SAFETY)

Historical Development The Process Inherent Ultimate Safety (PIUS) reactor is beir,g designed by ASEA Brown Boveri Atom (ABB-Atom). The concept evolved in the early 1980's from an extension of then ABB-Atom's low temperature district heating design. In October 1989, ABB requested a licensability review of the PIUS design in accordance with NUREG-1226, and in May 1990, ABB submitted the PIUS preliminary safety information document (PSID) for staff review. ABB plans to apply "or design certification of the PIUS design in the 1994-1995 time frame, assuming a favorable preapplication review.

The FIUS design concept has already undergone tests related to the desip.

principles. ABB has completed testing using the MAGNE Test Rig to simulate PIUS parameters such as diffusion and mixing across the primary loop / pool boundary with consideration for effects of turbulence, stratification, migration of boron, and others. Large scale tests of the PIUS design principles, such as flow and density lock operation, were dme at the ATLE Test Rig. These tests were used to validate the RIGEL code to calculate the design's safety and transient performance. ATLE was a full height simulation of the PIUS pool. Other tests of the PIUS design principles have been carried out at MIT and TVA, and other additional large scale tests and a larger test rig are planned to be started this year for the purpose of design optimization, at, well as special component testing. It is planned that this larger test rig will serve as the basic test facility for developing data for the detailed design and verification.

Desian De_scriotion PIUS is a 640 MWe advanced pressurized water reactor (PWR) design with four loops. It relies on thermal hydraulic effects to accomplish the control and safety functions that are usually performed by mechanical means. The safety-grade reactor heat removal system for the PIUS design is completely passive and is always in operation. The PIUS design consists of a vertical hollow cylinder, the reactor module, which contains the reactor core. The reactor3 module is submerged in a large concrete reactor vessel containing 3,300 M (870,000 gallons) of highly borated water. The reactor module is open to the borated pool at the bottom t.d at the top of the reactor module.

At these two openings, density locks keep the borated pool water from the reactor module during normal operation. Under normal operations, the primary loop reactor water flows up through the core, out of the top of the reactor module to the steam generators, and is pumped back into the bottom of the reactor module, bypassing both the top and bottom density locks. There is no

' physical flow barrier in the density locks between the primary loop and the borated pool, however, the difference in density between the pri. nary loop reactor water and the cooler borated pool water provides a relatively stationary interface. When sufficiently upset during transient conditions, such as loss of flow or a power mismatch, the density difference is overcome 1

., 6 - b.JT

f and the borated water flows into the core and-shuts down the reactor. A

} natural circulaticn: flow path is then established from the borated pool i through the lower density lock. up through the core, and back into the borated

! pool. through the upper density lock for long term shutdown cooling. Unlike asost reactors, PIUS does not emplo.'y mechanical control rods for regulating -

i reactivity.- Reactivity is controlled by the boron ~ concentration and l temperature of the primary loop reactor water.

l An active reactor protection ystem (RPS), with associated instrumentation and actuation syctems, is also provided in. PIUS. The RPS and the associated

systems have the task of_ detecting departures from acceptable operating

conditions and initiating coolant pump trip to cause density lock flow and a reactor scram.

!* Other aspects of-the PIUS design are similar to_ the passive LWRs being considered by the staff (AP-600 and the SBWR), .Although_ PIUS is a PWR, its operating pressure (1,305 psi) is close to that of a BWR. The proposed-containment for-the PIUS design is:_ integral with the reactor _ building, .similar -

l to the ABWR and SFWR. Leak-rate has been defined as-not.to exceed-1 volume

- percent per day at a design pressure of 26 psig. The-acceptance leakage value i is expected to be 0.5 percent at design pressure.

I 4

i i-

{

I i

- r-

[ DRAH

a 1

D. PRISM (POWER REACTOR INNOVATIVE SMALL MODULE)

Develooment History l

The U.S. Department of Energy (DOE) selected the Power Reactor Innovative Small Module (PRISM) design as the advanced liquid metal reactor (ALMR) design to sponsor for NRC design certification. The conceptual design for PRISM was

developed by General Electric (GE) Company in conjunction with an industrial team of commercial engineering firms. Research and development support is i being supplied by the Argonne National Laboratory, Energy Technology Engineering Center, Hanford Engineering Development Laboratory, and Oak Ridge l National Laboratory. In addition, a steering group of utility representatives  !

was involved in the PRISM design effort.

4 DOE chose to sponsor the PRISM design as part of its National Energy Strategy 3 because of the design's potential for enhanced safety through the use of passive safety systems and greater safety margins, reduced cost through modular design and construction, and possible future development of an actinide recycling capability. Although this last alternative has not yet been proposed in the current application, DOE has supported studies evaluating 4

the use of actinides separated from spent fuel in an advanced-liquid metal reactor (AlhR) fast-flux core.

The PRISM design has considered liquid metal reactor (LMR) experience to date developed both nationally and internationally in terms of systems and components design, reliability data, and safety assessments. This experience

consists of operation of a number of facilities such as, EBR-II, Phenix, the

! Fast Flux Test Facility (FFTF), the Joyo reactor in Japan, and others.

1 The PRISM Preliminary Safety Information Document (PSID) was submitted to the NRC for review in November 1986, and the results of an early NRC staff review was the draft PSER (NUREG-1368) issued in September 1989. In order to obtain

! NRC approval of its planned prototype, DOE plans to apply for preliminary-design approval in 1995. The DOE also plans to apply for standard design certification in 2003 after a prototype demonstration. These plans are based on the current DOE goals to demonstrate the commercial potential for the ALHR

[

by 2010, as called for in the Energy Policy Act of 1992. -

Plart Descriotion l The PRISM plant design consists of three se)arate power blocks each made up of i

three reactor modules. Each module has a tiermal output of 471 MWt and-an

! electric output of-155 MWe for a total (plant) output of 1395.MWe. The PRISM l design contains three turbines, each supplied.from a power block. Options for

one or two power blocks are possible. PRISM operates at much higher

temperatures than current LWRs which will require a rigorous evaluation of the l

effects of creep and creep rupture on reactor vessel and systems. The PRISM design also relies on a highly automated and complex control system utilizing digital processing.

j DRAFT L

l

j. -

c.

I' The reactor module consists of the containment system, the reactor vessel, the core. and the reactor's internal components. The reactor vessel encloses and

, supports the core, the primary sodium coolant system, the. intermediate coolant system heat exchangers (IHXs), and other internal components. The vessel is l located just inside the containment vessel, which is located below grade in L the reactor silo. The reactor vessel is penetrated only in the closure head.

, The head is supported by the floor-structure, and the floor structure is -

i- supported by seismic isolator bearings to reduce horizontal movement-during i seismic events. The upper head of the reactor vessel is the closure head.

! The closure head also supports the intermediate heat exchangers (IHX) and the electromagnetic (EM) pumps.

j The main components of the Nuclear Steam Supply' System (NSSS) in PRISM are the i

reactor module, primary sodium loop, EM pumps, IHX, intermediate sodium loop l

and steam generators (SG). The primary sodium loop is contained completely within the reactor vessel, which is hermetically sealed to prevent leakage of j the primary coolant. The EM pumps-provide the primary sodium circulation.

1 Synchronous machines provide flow coastdown capability to the EM pumps. Flow

coastdown is very important for preventing sodium boiling during'a loss of EM i

pump power without reactor scram. Reactor-generated heat in the primary loop is transferred through the IHX to the intermediate' heat transfer system j (IHTS). IHTS sodium is circulated by a centrifugal pump. The IHTS operates l at a higher prensure than the primary loop so that, in case of-a tube rupture

in the IHX, the sodium would not flow out of_ the reactor vessel. A pressure i of approximately 15 psig is used to assure a minimum 10 psi positive pressure

} differential across the IHX from the IHTS to the PHTS is maintained. A i

sodium-water reaction protection system mitigates the effects of reactions between IHTS sodium and water in the SG.

The reference fuel for the ALMR is a uranium-plutonium-zirconium (U-Pu-Ir) alloy. The ferritic alloy HT9 is;used for cladding and channels to minimize swelling caused by high burnups. The= PRISM core is a heterogeneous arrangement of driver fuel and blankets, i

l The PRISM core design is.such that the net power reactivity feedback is-negative in all ranges of o'peration,-in all transients, and in all accidents not involving voiding. For certain-very low probability accident scenarios l involving sodium boiling, a i positive feedback can occur. positive void situations In all other coefficient without dominates and a net extensive l

voiding, an increase in-temperatures producesLnegative fudbacks from Doppler i and thermal expansion of the core and related structures that dominates the l positive moderator density coefficient.' The net' negative temperature.

i coefficient-is so large that analyses predict all non-boiling transients and accidents to be terminated by the temperature feedback reactivity at temperatures low enough to not threaten fuel or vessel integrity. This F passive shutdown function allows the~ reactor to sustain:all non-boiling l_ transient scenarios-without damage, even with a failure to scram.

s I

4 DRAFT 7

j;

= , _ - _ _ _ _ _. ._. 2_ _m _ . _ _ _ . _ _ _ _ _ _ .

!* There are six control rods in the main reactivity control _ and shutdown system.

, Inserting any one of the six will shut the core down. The control rods can be-I inserted using (1) the plant control system (PCS) for normal insertion, (2) the safety-grade reactor-protection system (RPS) for rapid insertion, and (3)'gravitydropintothecore. If both the normal and safety-grade systems 4

fail, the operator can activate the ultimate shutdown system (USS) which sends l'

boron balls into the central location'of the core causing shutdown independ-ently of the control rods. The PRISM design also includes passive mechanisms for controlling reactivity: three gas expansion modules (GEMS) consisting of-

! tubes, closed at the top and open'at the bottom, and filled with_ helium. -If 4

the pumps are running, the static pressure is high, causing.the sodium level to rise to a high point in the GEM. -However, with the pumps off, the static j pressure and sodium level drop, which increases neutron leakage. The reac-

. tivity change provided by the GEMS between 1:ase two states is about

-70 cents.

Normal shutdown cooling is achieved with-the nonWsafety-grade condenser. If i.' the condenser becomes unavailable,_ the safety-grade reactor vessel- auxiliary cooling system (RVACS) is used for RHR.- The RVACS provides-natural circulation air cooling of the containment vessel.

The design-basis-RVACS-l event assumes that the normal and auxiliary heat removal systems,: as well as the Intermediate-Heat Transport System (IHTS) sodium, are lost-immediately following reactor and primary EM pump trips. The preapplicants' analysis has shown'that the RVACS heat removal rate'is sufficient.to maintain fuel i temperatures within acceptable limits,-and temperatures of the internal structures within the reactor-vessel under American Society of Mechanical i Engineers (ASME) Level C conditions. The PRISM design also contains the non-

! safety-grade auxiliary coolingisystem (ACS) to assist the RVACS. The ACS uses j natural circulation within the steam generator (SG)-to remove heat indirectly from the reactor vessel, and natural circulation air _ cooling of the SG,- with 3-- heat-rejection.directly to the atmosphere. The ACS can be used in combination

' with the RVACS to reduce the cooldown time.: Some of the inherent safety-characteristics of the PRISM design with- respect to RHR are: (1) the i favorable combination of viscosity, thermal conductivity, and vapor pressure associated with-the use of--sodium to remove heat,-(2):the ability to operate at essentially ambient pressure, thus reducing the pressure exerted on the i

coolant system boundaries, 'and (3) operation far below the: sodium boiling temperature, thus obtaining the operational and analytical simplicity l associated with a single phase coolant.

i l

- -DRAFT f

V

4 .  !

• SECY-86-368, "NRC Activities Related to the Commission's Policy on the Regulation of Advanced Nuclear Power Plants," December 10, 1986

• SECY-89-350, " Canadian CANDU 3 Design Certification," November 21, 1989

• SECY-90-055, " PIUS Design Review," February 20, 1990

• NUREG-1338, " Draft Preapplication SER for the MHTGR"

• NUREG-1368, " Draft Preapplication SER for PRISM"

• NUREG/CR-5261, " Safety Evaluation of MHTGR Licensing Basis Accident Scenarios" l

• NUREG/CR-5364, " Summary of Advanced LMR Evaluations-PRISM and SAFR" NUREG/CR-5514, "Modeling and Performance of the MHTGR Reactor Cavity

, Cooling System" NUREG/CR-5647, " Fission Product Plateout in the MHTGR Primary System" NUREG/CR-5815 " Evaluation of 1990 PRISM Design Revisions" i

i e

o 1

J DRAFT Enclosure 3

.