ML20128L144

Forwards Repts Provided to NRC During Past Year on Matters Related to Agency Research Program,Per Requirements of Section 29 of Atomic Energy Act,As Amended by Section 5 of Public Law 95-209

ML20128L144
Person / Time
Issue date:	01/28/1993
From:	Shewmon P Advisory Committee on Reactor Safeguards
To:	Foley T, Gore A HOUSE OF REP., SPEAKER OF THE HOUSE, SENATE, PRESIDENT OF THE SENATE
References
ACRS-R-1508, NUDOCS 9302190098
Download: ML20128L144 (4)

Text

- _ - - - _

. ~

1. RICt/

gg3R-)668 l

8

[& o, UNITED STATES l  ! u j NUCLEAR REGULATORY COMMISSION 3 ADVISORY COMMITTEE ON REACTOR SAFEGUARDS Io, f WASHING TON, O. C,20555

/

January 28, 1993 The Honorable Thomas S. Foley Speaker of the United States House of Representatives Washington, D.C. 20515

Dear Mr. Speaker:

In accordance with the requirements of Section 29 of the-Atomic Energy.Act of 1954, as amended by Section 5 of Public Law 95-209, the Advisory Committee on Reactor Safeguards (ACRS) has reported to the Congress each year on the Safety Research Program of the Nuclear Regulatory Commission (NRC). In our December 18, 198G, letter to the Congress, we proposed to provide reports on specific issues rather than one all-inclusive report, before 1986. Accordingly, enclosed are copiesasofwe had provided reports that we have provided to the NRC during the past year on matters related to the agency's research program.

We expectProgram Research to continue to review various elements of the NRC Safety and provide reports to the Commission as warranted.

Sincerely, WS Paul Shevmon Chairman,_ACRS

Enclosures:

1.

Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Requirements for Full-Height, Full-Pressure Integral System Testing of-the Westinghouse AP600 Passive Plant Design, March 10, 1992 2.

Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Full-Height, Full-Pressure Integral System Testing 6, 1992 for the Westinghouse AP600 Passive Plant Design, April

3. Report from David A. Ward, ACRS Chairman, to James M. Taylor, Executive Director for Operations, NRC,

Subject:

Evaluation cf the Risks During Shutdown and Low-Power Operations for US, Nuclear Power Plants, April 9, 1992 l

9302190098 930128 PDR ACRS ,

^Q R-1508 PDR . t x

'\

The Honorable Thomas S. Foley 2 January 28, 1993-

4. Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Testing and Analysis Programs _in Support of the Simplified Boiling Water Reactor Design Certification, June 10, 1992

5. Report from Paul Shevmon, ACRS Acting Chairman,; to Ivan Selin, NRC Chairman,

Subject:

Integral System and Separate Effects Testing in Support of the Westinghouse AP600 Plant Design Certification, July 17, 1992

6. Report from David A. Ward, ACRS Chairman, to James M. Taylor, Executive Director _ for Operations, NRC,

Subject:

Proposed Resolution of Generic Safety Issue 106, " Piping and the' Use of Highly Combustible Gases in Vital Areas," August 14, 1992

7. Report from David A. Ward, ACRS Chairman,-:to Ivan-Selin',-.NRC Chairman,

Subject:

Severe Accident Research' Program Plan, August'18, 1992

8. Report from-David A. Ward, ACRS Chairman, to Ivan Solin, NRC Chairman,

Subject:

Digital Instrumentation and Control System -

Reliability, September 16, 1992

9. Report from Paul'Shewmon, ACRS Chairman, to Ivan-Selin, NRC Chairman,

Subject:

Environmental Qualification for Digital Instrumentation and Control Systems, November 12, 1992

e f e,.

an asog

/ o UNITED STATES l' , NUCLEAR REGULATORY COMMISSION

{o g

j ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON, D. C. 20555

....+

/

January 28, 1993 The Honorable Albert Gore, Jr.

President of the United States Senate Washington, D.C. 20510

Dear Mr. Prasident:

In accordance with the requirements of Section 29 of the Atomic Energy Act of 1954, as amended by Section 5 of Public Law 95-209, the Advisory Committee on Reactor Safeguards (ACRS) has reported to the Congress each year on the Safety Research Program of the Nuclear F.egulatory Commission (NRC). In our December 18, 1986, letter tc, the Congress, we proposed to provide reports on specific issues rather than one all-inclusive report, as we had provided before 1986. Accordingly, enclosed are copies of reports that we have provided to the NRC during the past year on matters related to the agency's research program.

We exptset to continue to review various elements of the NRC Safety Research Program and provide reports to the Commission as warrarited.

Sincerely, CM 6 Paul Shewmon Chairman, ACRS Ent:losures:

1. Report from David A. Ward i ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Requirements for Full-Height, Full-Pressure Integral System Testing of the Westinghouse AP600 Passive Plant Design, March-10, 1992

2. Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Full-Height, Full-Pressure Integral System Testing for the Westinghouse AP600 Passive Plant Design, April 6, 1992

3. Report from David A. Ward, ACRS Chairman, to James M. Taylor, Executive Director for Operations, NRC,

Subject:

Evaluation of the Risks During Shutdown and Low-Power Operations for_U.S.

Nuclear Power Plants, April 9, 1992

g The Honorable Albert Gore, Jr. 2 January 28, 1993

4. Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Testing and Analysis Programs in Support of the Simplified Boiling Water Reactor Design Certification, June 10, 1992

5. Report from Paul Shevmon, ACRS Acting Chairman, to Ivan Selin, NRC Chairman,

Subject:

Integral System and Separate Effects Testing in Support of the Westinghouse AP600 Plant Design Certification, July 17, 1992

6. Report from David A. Ward, ACRS Chairman, to James M. Taylor, Executive Director for Operations, NRC,

Subject:

. Proposed Resolution of Generic Safety Issue 106, " Piping and the Use of '

Highly Combustible 1 Gases in Vital Areas," August 14, 1992

7. Report from David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,-

Subject:

Severe Accident Research Program Plan, August 18, 1992

8. Report from' David A. Ward, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Digital Instrumentation and Control System Reliability, September 16, 1992

9. Report from Paul Shevmon, ACRS Chairman, to Ivan Selin, NRC Chairman,

Subject:

Environmental Qualification for Digital Instrumentation and Control Systems, November 12, 1992 e

i i

I.

1

E sn esco,

/ 'o, UNITED STATES y  % NUCLEAR REGULATORY COMMISSION

.{ f ADVISORY COMMITTEE ON REACTOR SAFEGUARDS o g WASHINGTON, D. C. 20555

,6 March 10, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

REQUIREMENTS FOR FULL-HEIGHT, FULL-PRESSURE INTEGRAL SYSTEM TESTING OF THE WESTINGHOUSE AP600 PASSIVE PLANT DESIGN During the 383rd meeting of the Advisory Committee on Reactor Safeguards, March 5-7, 1992, we discussed the issue of the requirements for full-height, full-pressure (FHFP) integral system testing of the Westinghouse Electric Corporation's.AP600 passive plant design. We also considered this matter during our 382nd meeting, February 6-8, 1992, and our 381st meeting, January 9-11, 1992. Our Subcommittee on . Thermal Hydraulic Phenomena met on March 3, 1992, and December 17, 1991, to discuss this matter.

During these meetings, we had the benefit of discussions. wli.a representatives of the NRC staff and the Westinghouse Electric Corporation and of the referenced documents.

We have been asked to comment on two separate but related actions.

The first is a user-need letter from the Office of Nuclear Reactor Regulation (NRR) to the Office of Nuclear Regulatory Research (RES) requesting that FHFP integral system testing for the AP600 passive plant design be carried out by the NRC. The RES response to the user-need letter is the recommendation ~to the 92-037. The second is the recommendation made in SECY-92-030 that-Commission in SECY-Westinghouse also be required to do FHFP integral system testing.

Westinghouse has planned a robust separate effects test program combined with low-pressure integral system testing. Westinghouse believes that the behavior of AP600 under high-pressure conditions is well enough understood and that the Westinghouse low-pressure test program combined with high-pressure separate effects tests will fully address all ' areas of -need. On the one -hand, Westinghouse believes it is premature to be asked to do FHFP integral system testing. On the other hand, the staff believes that potential complex interactions taking place at high pressure are sufficiently important and insuf ficiently understood to require O I('6 C 2 /P;dir--~b/'[ ron ne m ,.

The Honorable Ivan Selin 2 March 10, 1992 FHFP integral system testing. The staff made a good case in support of its views, however, neither Westinghouse nor the staff has done enough work to defend their positions convincingly. A technically sound approach would be to wait until the Westinghouse test program is complete, and then consider the need for FHFP integral system testing. The present certification schedule precludes this approach.

Inasmuch as FHFP integral system testing will require at least three to four years to complete, there is a risk that the present certification schedule will be af fected unless the test program it, begun now. We believe that the likelihood of such an impact in great. If the present certification schedule is to be adhered to, we recommend that a FHFP integral system testing program be initiated now.

The need for both Westinghouse and NRC to embark on separate testing programs was not demonstrated in the numerous presentations we have received. We recommend that a joint program be implemented in order to bring the best technical expertise to bear, to limit costs to both Westinghouse and the NRC, and to ensure the acceptability of the results.

Further, we recommend that the joint test program be modeled after the cooperative approach used to study small-break LOCAs in Babcock and Wilcox plants (the MIST program). In that case, a program of tests and associated analyses was established that was jointly planned, managed, and funded by the NRC, the vendor, the associated Owners Group, and the Electric Power Research Institute (EPRI) .- In this case, consideration should be given to joint financing of the proposed program by such entities as DOE, EPRI, Westinghouse, and the NRC.

If a decision is made to go forward with FHFP integral system-testing, we would like the opportunity to perform a more definitive review. We have concerns about the adequacy of the foreign test facilities under consideration.

Sincerely, David A. Ward Chairman

References:

1. U.S. Nuclear Regulatory Commission, SECY-92-030, Memorandum to the Commissioners from James M. Taylor, NRC Executive Director for Operations, dated January 27, 1992,

Subject:

Integral System Testing Requirements for Westinghouse's AP600 Plant 3

m 4

(4 The Honorable Ivan Selin 3 March 10, 1992

2. U.S. Nuclear Regulatory Commission, SECY-92-037, Memcrandum to the Commissioners from James.M. Taylor, NRC Executive Director for Operations, dated January 31, 1992,

Subject:

Need for NRC-Sponsored Confirmatory Integral System Testing of the Westinghouse AP600 Design

3. Letter dated January 30, 1992, to B. A. McIntyre, Westinghouse Electric Corporation, from D. M. Crutchfield, NRC Office of Nuclear Reactor Regulation,

Subject:

AP600 Design - Issues to be Resolved by High-Pressure, Full-Height Integral Testing

4. Letter dated February 25, 1992, to I. Selin, NRC Chairman, from C. Caso, Westinghouse Electric Corporation,

Subject:

Westinghouse Comments on SECY-92-030

5. Memorandum dated November 15, 1991, to E. Beckjord, NRC Of fice of Nuclear Regulatory Research, from T. Murley, NRC Office of Nuclear Reactor Regulation,

Subject:

Research User Need for Confirmatory Thermal-Hydraulic Testing of Westinghouse AP600 Design l

l l

L I

l l

l

4

[pm A8Gs.,g 'o, UNITED STATES

. i' *  % NUCLEAR REGULATORY COMMISSION

'{o t ADVISORY COMMITTEE ON REACTOR SAFEGUAPDS WASHINGTON, D. C. 20555 h, /g April 6, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

FULL-HEIGHT, FULL-PRESSURE INTEGRAL SYSTEM TESTING FOR THE WESTINGHOUSE AP600 PASSIVE PLANT DESIGN-During the 384th meeting of the Advisory Committee on Reactor Safeguards, April 2-4, 1992, we met with representatives of the-NRC staf f to discuss the need for conducting full-height, full-pressure integral system testing - at the Japanese ROSA-IV f acility, in support of certification for the Westinghouse AP600 passive plant design. We also had the benefit of the referenced documents.-

We do not agree with the need for an immediate decision on whether or not testing should be carried out.at the ROSA-IV facility. We are not even sure testing at ROSA-IV is necessary.

Since our March 10, 1992 report to you on the need for testing of the AP600 passive safety features, Westinghouse has volunteered to do full-height, full-pressure testing at the SPES f acility, located in Italy. This testing, combined with the Westinghouse commitment to perform low-pressure integral system testing at,a facility at Oregon State University, covers the pressure range needed. We' have not seen the details of the Westinghouse plans or the necessary scaling analysis for either facility and reserve judgment as to the completeress of the ef fort., We do believe, however, that the sense of urgency caused by the certification schedule has been addressed.

The staff plans to conduct further tests, as yet undefined,.at the Oregon State University facility when Westinghouse is finished with its program. We see no reason-why a similar approach could not be- -

taken to satisfy the staff's residual concerns about the' behavior of the AP600 passive systems at full-pressure conditions. The Westinghouse plans for the SPES f acility appear to call for testing early enough for the staff to do confirmatory testing at this facility before the certification date.-

We do not have enough information to make a recommendation at this )

time. Both the staff and Westinghouse indicate that they will be N /D F Mw Enclosure 2

I I.

The Honorable Ivan Selin- 2 April 6, 1992 prepared to defend their views during May 1992. If this is the case, we will be prepared to make a definitive recommendation af ter meeting with them.

Sincerely, O

l David A. Ward Chairman

References:

1. Memorandum dated April 1, 1992, from E. Beckjord, Office of Nuclear Regulatory Research, NRC, for R. F. Fraley, ACRS,

Subject:

Information on AP600 Testing (Predecisional)

2. Letter dated April 1, 1992, from J. M. Taylor, Executive Director for Operations, NRC, to D. A. Ward, ACRS,

Subject:

Requirements for Full-Height, Full-Pressure Integral System Testing of the Westinghouse AP600 Passive Plant Design (Contains Proprietary Information)

3. Memorandum dated March 27, 1992 from J. M. Taylor, Executive Director for Operations, NRC, for the Commission,

Subject:

Staff Requirements -

SECY-92-037 -

Need for NRC-Spensored confirmatory Integral System Testing of the Westinghouse AP600 Design (Predecisional)

4. Letter dated March 10, 1992 from David A. Ward, Chairman, ACRS, to Ivan Selin, Chairman, NRC,

Subject:

Requirements for Full-Height, Full-Pressure" Integral System Testing of the Westinghouse AP600 Passive Plant Design

, e

@ MCy

/ ~

'o UNITED STATES er g NUCLEAR REGULATORY COMMISSION

[' ADVISORY COMMITTEE ON REACTOR SAFEGUARDS

$, WASHINGTON, D. C. 20555

• 1. g e....

April 9, 1992 Mr. James M. Taylor Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

EVALUATION OF THE RISKS DURING SHUTDOWN AND LOW-POWER OPERATIONS FOR U.S. NUCLEAR POWER PLANTS During the 384th meeting of the Advisory Committee on Reactor Safeguards, April 2-4, 1992, we reviewed the staff's program to evaluate the risks posed by U.S. nuclear power plants during shutdown and low-power operations. Our Subcommittee on Plant Operations considered this matter during its April 1,1992 meeting.

During these meetings, we had the benefit of discussions with representatives of the NRC staff and NUMARC. We - also had the benefit of the referenced documents. In our letter of' August 13, 1991, we commented on the staff's program for carrying out this evaluation.

The current status of the staff rs review and the proposed plans for future staff actions are described in SECY-92-067, " Evaluation of Shutdown and Low-Power Operation" and in NUREG-1449 (Draft Report for Comment), " Shutdown and Low-Power Operation at Commercial l Nuclear Power Plants in the United States." The staff expects to l complete its formal regulatory analysis by late summer 1992.

l l We believe that the staff has done a commendable job in evaluating l risks from shutdown and low-power operations and in developing a plan for future actions. We were particularly impressed by the insights gained by the staff participants who visited 17 nuclear power plants to observe low-power and shutdown operations. _These insights are described in Section 3 of NUREG-1449 and provide what we regard as the principal bases for the staff's technical findings and conclusions. We were also positively impressed with the industry's efforts and believe that industry. positions and recomnendations expressed in NUMARC 91-06, " Guidelines for Industry Actions to Assess Shutdown Management," are consistent with and complementary to the staff's. We encourage continued interaction with NUMARC on this issue.

The staff's evaluation provided satisfactory responses to earlier comments in our August 13, 1991 letter to you. We believe that the

? N700 W Ef' Enclosure 3

Mr. James M. Taylor 2 April 9, 1992 staff's actions relative to the concerns noted in that letter are appropriate. However, we have the following additional comments.

We support the office of Nuclear Regulatory Research's efforts on developing two plant-specific low-power and shutdown PRAs.

However, these PRAs will not be completed in time for the results to provide useful input into decision making on possible further regulatory actions resulting from this study. Therefore, we recommend that these efforts be refocused to emphasize development of better methods to deal with the human factors aspects of these PRAs and toward more definitive separation of the various contributing elements to the core damage frequency (e.g. , equipment reliability, maintenance activities, adequacy of instrumentation, and the human factor elements).

Section 6.7.1 of NUREG-1449 discusses the use of freeze seals in the maintenance of otherwise nonisolable nuclear power plant piping systems. We agree with the proposed NRC staff action as described in Section 8.2.3 of NUREG-1449, but recommend an explicit requirement for participation of a knowledgeable structural expert in the licensee's 10 CFR 50.59 review of each freeze seal application. This recommendation is based on our concern that inappropriate use of cryogenic freezing media, which have boiling i points well below the nil-ductility transition temperature of l carbon and low-alloy steels, could lead to brittle failure of l piping systems and thus initiate a loss-of-coolant accident.

The insights gained from this study appear to us to have lessons

! relevant to full power and othei modes of operation. For example,

! there have been unanticipated plant trips at power caused by poor i

control over maintenance activities. We recommend that the guidelines under development be evaluated for broadened application

to all modes of operation.

The proposed guidelines focus on activities only within the plant boundaries. Activities outside the plant boundaries (within switchyards or on transmission lines) have caused unanticipated plant trips and loss of offsite power events. We recommend that appropriate action, perhaps a utility corporate level directive, be taken to ensure the proper control over such activities.

Sincerely, l

David A. Ward l Chairman l

l

Mr.' James M. Taylor- 2 April 9,-1992

References:

1. U.S. -Nuclear Regulatory Commission, NUREG-1449, " Shutdown and -

Low-Power Operation at Commercial Nuclear Power Plants in the United States" (Draft Report for Comment), February 1992

2. SECY-92-067, dated February 25, 1992, from James.M. Taylor, Executive Director for Operations, NRC, for the Commissioners,

Subject:

Evaluation of Shutdown and Low-Power-Operation'

3. NUMARC . 91-06, " Guidelines for Industry Actions to - Assess Shutdown Management," December 1991

4. Letter dated August 13, 1991, from-David A. Ward, Chairman, ACRS, to James M. Taylor, Executive Director.for Operations, N R C ,-

Subject:

_ Evaluation of;- Risks _ During . Low-Power and Shutdown operations of Nuclear Power Plants Memorandum dated January _10, 1992, from A. Thadani,.NRC, for.

5.

David A. Ward, ACRS,

Subject:

Information on Containment Hatches

6. NRC Information Notice IN 91-81, " Switchyard Problems That Contribute to Loss of Offsite Power," December 16, 1991-Il

, a f

/p*

• tago, UNITED STATES f ' 7, NUCLEAR REGULATORY COMMISSION

1. ADVl50RY COMMITTEE ON REACTOR SAFEGUARDS e WA$HINGTON,0 C. 205$5

%...../

June 10, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

TESTING AND ANALYSIS PROGRAMS IN SUPPORT OF THE SIMPLIFIED BOILING WATER REACTOR DESIGN CERTIFICATION During the 385th and 386th meetings of the Advisory Committee on Reactor Safeguards, May 6-9 and June 4-5, 1992, we reviewed the testing and analysis programs in progress and proposed by GE Nuclear Energy (GE) in support of the certification effort for the Simplified Boiling Whter Reactor (SBWR) passive plant design. Our Subcommittee on Thermal Hydraulic Phenomena held meetings to discuss this topic on April 23 and June 2, 1992. During these meetings, we had the benefit of discussions with representatives of GE and the NRC staff. We also had the benefit of the documents referenced.

GE will use its best-estimate coele, TRACG, to evaluate-the SBWR thermal hydraulic behavior under accident conditions ranging from ATWS with instabilities to long-term behavior of the Passive Containment Cooling System (PCCS). GE representatives presented a very good analysis of processes and phenomena important to accident scenarios postulated for the SBWR. The results were summarized in tables which are to be used by GE to validate the TRACG computer code. However, these same tables appear not to have been used to guide the design and operation of the experimental facilities that are to support the code validation process.

The GE experimental program consists-of three elements:

1) Laboratory scale experiments to obta.in fundamental heat transfer data,

2) Separate effects tests to obtain data for parts of the total-system and full-scale components where necessary, and

3) Integral system tests-to obtain system data.

gg.gg )g

r l

l- .

The Honorable Ivan Selin 2 June 10, 1992 Although we were shown some comparisons of TRACG predictions with data from GE's integral system tests (GIST and GIRAFFE facilities),

the question of whether or not the facilities can scale the important phenomena was not addressed in either GE's presentation or in the documents supplied to the ACRS by GE. A rigorous scaling analysis is needed if integral system test data alone are to be used to demonstrate that a TRACG calculation is meaningful.

We have some comments about the elements of the GE test plan. The initial conditions for the integral system tests are based on conditions assumed to exist some time after vessel depressurization. These conditions include an initial drywell and PCCS nitrogen mass fraction of 15 percent. The nitrogen concentration could be much higher. GE should develop a basis for its choices of initial conditions or broaden its test matrix to include some tests at much higher values of the nitrogen concentration, both in the drywell and in the PCCS.

Separate effects tests to be conducted in the PANTHERS facility will yield the data needed to characterize heat exchanger behavior under a variety of expected conditions. In particular, GE has agreed to add instr,umentation to the individual heat exchanger tubes to obtain local heat transfer data. This will make the GIRAFFE integral system experiments more meaningful. We believe GE has been very responsive to issues raised by both the ACRS and the NRC staff in this regard.

The oscillatory behavior observed in the GIRAFFE integral system tests needs more detailed study td' ensure that the suppression pool does not overheat due to steam bypass of the PCCS through the suppression pool-top horizontal vents. The steam flow rate will be low which could lead to a stratified condition. The suppression pool is not a very effective heat sink when this process occurs.

This may well require a separate effects study to obtain data for development of a low steam flow model for the horizontal vent.

Further, review of the GIRAFFE facility instrumentation is needed to ensure that the resulting data will support TRACG mode 1 validation.

The SBWR has full pressure isolation condensers (IC) capable of removing 4.5 percent of full power decay heat -at full system pressure. The behavior of isolation condensers is well understood and introduces no new processes. GE has indicated that it will collect relevant IC operating data for staff review. The SBWR is automatically depressurized when the vessel water level drops to some prescribed value by a staged opening of squib-type valves.

Further, GE has had a areat deal of experience with automatic depressurization and only the squib-type valve itself is of a new design. As a result, we do not believe that full-heigb', full-l

~ - . - . . .- . .

a. =,

.c The Honorable Ivan selin' 3 June 10, 1992 1 pressure integral system. testing is required for certification of-the SBWR design.

The GE program includes conduct of integral system testing at the PANDA facility located in Switzerland. The NRC staff would like GE to obtain data from this facility in time =to supportiits. design certification review of the.SBWR. To do so, GE wouldhave to accelerate its schedule by six months. We agree with the'NRC staff that further integral system testing of-the PCCS is needed- prior to- ,

the final design approval. It has not been demonstrated by GE that

- existing data obtained from GIRAFFE or GIST testing are suf ficient for validation of the TRACG code, nor that the PANDA test facility _

will-yield the needed data. A-more definitive assessment by GE is needed; this assessment should include both the scaling. rationale for the GIRAFFE, GIST, and PANDA facilities, and a demonstration of how the effects of test f acility scaling _ distortion impact _ the -

important processes and phenomena outlined by GE in its evaluation of TRACG. As a part of such an effort, it may be possible to : chow that one can obtain the needed data - by some combination of -

additional separate effects tests and judicious use of the GIRAFFE and GIST facilities.

To summarize, we agrSe with the NRC staff views that: full-height, full-pressure integral syst'em testing is not needed to support the=

SBWR design certification.- Further, we-agree that early integral system testing of the- PCCS is essential to meet the present design

. certification schedule. We have not, however, seen'avidence that the PANDA facility is adequate to obtain the needed data.

Sincerely, David A. Ward Chairma'n

References:

1. Memorandum dated February 26,1992,: for the Commissioners from James M. Taylor, Executive Director- for Operations,.

transmitting Advance.~ Copy of _ proposed Commission paper,

" Evaluation .of' the ' General - Electric Company's1 . (GE's) - Test ;

Program to Support ~ Design Certification for' the . Simplified Boiling Water Reactor (SBWR)" '

2. Letter dated February 3,1992, from R'. C. Mitchell, GE Nuclear Energy, to U.S. Nuclear' Regulatory Commission,

Subject:

GE Response.to Request for Information on'SBWR Testing Program

. ,: o

.The Honorable.Ivan Selir 4 June 10, 1992

3. Joint Study -Report, ." Feature _ Technology. of Simplifled BWR (Phase I) . GIRAFFE (Fina1 Report)," dated-November _._1990,- The-Japan . Atomic Power Company, et ' a 1. (GE . Proprietary Information)

4. GC Nuclear Energy, GEFR-00850, " Simplified : Boi, ling Water Reactor (SBWR) Program Gravity-Driven CoolingiSystem (GDCS)

Integrated Systems Test - Final. Report," A.F. Billig, dated ~

October 1989 (Applied Technology Restriction) ,

5. " ALPHA - The Long. Term Passive Decay Heat Removal and-Aerosol ~-

Retention Program _ at the Paul Scherrer Institute, Switzerland," by- P. Coddington, . 'et al., Paul Scherrer ,

Institute, undated

6. Paper from the Proceedings of The International Conference on' Multiphase Flows '91 -

Tsukuba, . Japan, September 24-27,

" Condensation in a Natural Circulation Loop with Noncondensable Ga Jes Part 1 - Heat Transfer," K. M. ' Vierow, GE Nuclear Energy,.end V. Schrock, University of California

7. GE Draft Report: " Test Specification f or . ' IC &.PCC Tests,"

undated (GE Proprietary Information)

8. Paper submittad to the Department of Energy,. "The Effect of Noncondensable Gases = on Steam Condensation Under ~ Forced-Convection Conditions," M. Siddique,- Ph.D.- ' Thesis -

Massachusrcts Institute of Technology, dated January 1992 l

l.

' ' . _ __ 3 - -

-l a

' J p asc4'o '

^ UNITE D STATES

!" W NUCLEAR REGULATORY COMMISSION.- *

{O ,I . ADVISORY COMMITTEE ON REACTOR SAFEGUARDS -

g - WASHINGTON, D. C. 20665

'_/  %

July 17, 1992 '

i The Honorable Ivan Selin f

~

Chairman U.S. Nuclear Regulatory Commission

• Washington, D.C. 20555

SUBJECT:

INTEGRAL SYSTEM AND SEPARATE EFFECTS TESTING IN. SUPPORT OF THE WESTINGHOUSE AP600-PLANT DESIGN CERTIFICATION!

During the 387th meeting of the Advisory Committee on! Reactor Safeguards, July 9-11,.1992,_.we discussed the programs--of integral- '

system ~and ' separate effects ' testing being' planned by both Westinghouse-and NRC to support the certification' effort for;the Westinghouse Electric Corporation's AP600: passive plant-design. We held discussions on. this matter during our 381st (through '384th (January-April ~ 1992) meetings, inclusive. Our - Subcommittee- on '

Thermal Hydraulic Phenomena - held meetings .on December , 1991, March these 3,_1992, and June 23-24,.1992. to reviewfthisfissue. -During(

meetings, we had the- benefit of- d i s c u s s i o n s :' - w i t h -

• representatives of the Westinghouse;ElectricLCorporationTandJthe-NRC staff. We also had benefit of'the-referenced documents.- 'We have prevlously reported ' to you "on :this matter ini our letters 1 of .

March 10-and April-6, 1992.

BACKGROUND -

Appropriately validated thermal hydraulic computer models must"be; l relied: on to support the; safety . assessments _ required)~for certification of~the;AP600. Westinghouse' haslindicatedithat "'it plans to' use its- more smechanistic assessment code, ECOBRA/ TRAC,

--only for -large-break LOCA analyses,1and will rely on' its evaluation" +

mode 1~,'NOTRUHP, for. analyses of -all_ other design-basis events ~. The-NRC plans'to use_RELAPS/ MOD 3.to support its. assessments.--

The NOTRUMP code is an" evaluation model code = that ._ iso based ~ on' 10 CFR 2 P&rt ;50, . Appendix K, n requirements. _ The ' other two codes, .

.ECOBRA/ TRAC and;RELAP5/ MOD 3, arei more N mechanistic codes;that'have=

been1gualified:as'best-estimate tools'only forilarge-break-LOCAs.

All.of these-analysis tools will be required:to. simulate the AP600 behavior:in' regimes where the-codes are.known to be. weak. These regimes -include- phenomena suchl as- horizontal ';(perhaps:  :

countercurrent- stratified) ' flows ' - interface movements, , thermal. .

Enclosure 15:

f 2 $ & C- W 9,9,_

~

The Honorable Ivan Selin 2 July 17,-1992 stratification, rapid " shock" condensation, boron mixing, and' low-pressure gravity-driven flows.

To develop the necessary data for improvement and validation of these models for AP600 assessment, Westinghouse now has plans for conducting a number of separate effects tests at several different facilities, and integral system tests. The integral system test programs are to be conducted in a low-pressure facility now nearing final design at the Oregon State University (OSU) and in an existing high-pressure facility, T ES (in Italy), to be modified to better simulate AP600.

The NRC has proposed to conduct high-pressure confirmatory testing by modifying and using the existing ROSA-IV facility at JAERI in Japan. The modified facility will be referred to es ROSA-V. The NRC has no specific plans for additional separate effects testing.

The staf f does plan to conduct low-pressure integral system testing in the OSU facility after the Westinghouse program has been completed.

At this time, we have the following comments and recommendations regarding various aspects of these planned and proposed' efforts.

WESTINGHOUSE PROGRAM We believe that, with certain enhancements, the Westinghouse program will be adequate for the certification process. We have the following specific comments and recommendations:

e We are concerned that Westinghouse plans to rely primarily on its NOTRUMP evaluation model (EM) code. It is a ~ step backwards to use computer codes of only EM sophistication and capabilities to evaluate the thermal hydraulic behavior of new nuclear power plants.

e The Westinghouse separate ef fects tests of most importance to the certification of AP600 are the Core Make-up Tank (CMT) tests and the Automatic Depressurization System (ADS) tests.

The test matrices for these do not cover ranges of conditions l that are broad enough to yield-an adequate data base for the required model development. We recommend - that pressure l disturbances of the types that would be caused by either ADS valve actuation or by rapid steam condensation when. cold CMT l

fluid is injected into the downcomer region be part of the test program, e

An additional separate effects test facility is needed to investigate the asymmetric effects associated with the downcomer and with the cold-side plenum of the steam generator.

The Honorable Ivan Selin 3 July 17, 1992 e SPES is generally a good choice for conducting full-height, full-pressure integral system tests. However, in addition-to the scaling problems associated with a high ratio of surface area to fluid volume that plague small-scale simulations of this kind (and must be dealt with), the proposed modified version, SPES-II, has two important scaling defects that should be eliminated: (a) the aspect ratio (height to diameter) of the simulated pressurizer is different from that of the AP600 and (b) the cold leg configuration is not geometrically similar to that of AP600.

We recommend that Westinghouse be required to preserve the scaling of the pressurizer and the geometrical configuration of the cold legs, to better simulate AP600 behavior (this would include simulation of a reactor coolant pump in each leg).

• The method proposed for simulating steam generator tube ruptures in SPES-II is flawed in that it does not appear to allow the break flow from the primari system to be from both the hot and cold sides of the tube. We recommend that Westinghouse develop a better simulation method.

The OSU low-pressure integral system testing facility is well conceived. We commend Westinghouse for its efforts with respect to this facility. Our evaluation of the scaling rationale for the facility design (discussed during the subcommittee meeting of June 23-24, 1992) is that it is soundly based. Further, the.400 psia design capability should allow considerable simulation of high-pressure effects, while providing the more important low-pressure behavior.

NRC PROGRAM Our understanding of the justification provided by the NRC staff i

for its proposed confirmatory high-pressure integral system testing l in the ROSA-V facility is as follows:

e Because ROSA-V is considerably larger than SPES-II, such confirmatory testing would provide an additional check on the

, adequacy of the scaling capabilities of the codes, and would help confirm that important effects have not been overlooked.

The confirmatory test program would provide the opportunity to maintain the staff's thermal hydraulic expertise and up-to-date knowledge in this field.

While we agree that the above considerations have some merit, we o

have not been persuaded that confirmatory high-pressure testing by l the staff is needed before the AP600 design certification and, even if this were the case, we have s3gnificant reservations about the i

The Honorable Ivan Selin 4 July 17, 1992 adequacy of the ROSA-V facility for this purpose. These positions are based on the following observations:

e The NRC staff has not presented convincing arguments supporting its needs for confirmatory testing, particularly at high pressures.

e The SPES-II facility appears to be sufficient to meet all the high-pressure integral system testing needs. The NRC will be able to use the SPES-II facility for its confirmatory testing needs just as it plans to use the OSU facility.

The desired staff experience will come from pre-test and post-test evaluations of the various tests using the RELAPS/ MOD 3 code. This experience can just as easily be obtained by evaluating the SPES-II and OSU tests and results.

• The ROSA-V facility contains several atypicalities that will manifest themselves in difficult-to-explain behavior relative to that expected for AP600 (the sensitivity of the ROSA-V thermal hydraulic- behavior is well documented in the INEL report, NUREG/CR-5853).

e The tests would be in a distant location. There would be a very limited number of tests, because of the expense involved.

In . addition, we are concerned that the adequacy of instrumentation (for example) might have to be compromised in order to reduce overall program costs.

For the above reasons, we belfeve that NRC -resources would be better used by focusing on three areas: (a)^possible additional separate effects testing to support the modeling needs for RELAPS/ MOD 3, (b) participation in the pre-test .and post-test analyses efforts associated with the SPES-II~and~ the OSU test programs, and (c) consideration of utilizing the SPES-II facility for high-pressure confirmatory. testing needs in the same way the staff plans to use the .- OSU facility for - its . confirmatory low-pressure testing needs.

To accomplish the above- objectives, we believe that the staff should consider the establishment of a task force of experts in related fields to assist-it in the development of the analytical and experimental programs necessary for timely certification of the AP600 passive plant design.

Sincerely, b

Paul Shewmon Acting Chairman l

l

The Honorable Ivan Selin 5 ~ July 17, 1992

References:

1. U.S. Nuclear Regulatory Commission, NUREG/CR-5853,

" Investigation of the Applicability and Limitations of the ROSA-IV Large Scale Test Facility for AP600 Safety Assessment (Draft)," dated May 1992

2. T. Boucher, Idaho National Engineering Laboratory, et al.,

" Scaling Issues for a Thermal-Hydraulic Integral Test Facility," Paper transmitted via a memorandum from L. Shotkin, NRC-RES, for P. Boehnert, ACRS, dated June 29, 1992

3. Oregon State University Report, OSU-NE-9204 (Draft), " Scaling Analysis for the OSU AP600 Integral System and Long Term Cooling Test Facility," J. Reyes, Jr., dated June 1992 (!

Proprietary Report)

4. Letter dated January 22, 1992, from G. Saporano, ENEA, Italy, to E. S. Beckjord, NRC, transmitting documentation on SPES test facility S. Memorandum dated June 13, 1991 from S. Modro, INEL, for L.

Shotkin, NRC-RES, transmitting draft report, " Evaluation of Scaled Integral Test Facility Concepts for the AP600" by Modro, et al.

6. U.S. Nuclear Regulatory Commission, SECY-92-219, "NRC-Sponsored Confirmatory Testing of the Westinghouse AP600 Design," dated June 16, 1992 (Predecisional)

7. U.S. Nuclear Regulatory Commission, SECY-92-219A, " Addendum to SECY-92-219 - Providing Additional Information to Justify Sole Source Procurement," dated July 9,. 1992 (Predecisional)

8. Memorandum dated April 21, 1992, from S. Chilk, Secretary, for J._M. Taylor, EDO, and W. Parler, General Counsel, ~

Subject:

SECY-92-037 - Need for NRC-Sponsored Confirmatory Integral System Testing of the Westinghouse AP600 Design

9. Westinghouse Topical Report, WCAP-13277, " Scaling, Design and Verification of the SPES-2, the Italian Experimental Facility Simulator of the AP600 Plant," dated April 1992 (E Proprietary Report) i-l

- .~

/ja are g 4

" ' , UNITED STATES y' # g NUCLEAR REGULATORY COMMISSION S e

1. ADVISORY COMMITTEE ON REACTOR SAFEGUARDS

$ WASHINGTON, D. C. 20555

%....a/

)

August 14 1992 Mr. James M. Taylor Executive Director for Operations U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

PROPOSED RESOLUTION OF GENERIC SAFETY -ISSUE 106, " PIPING AND THE USE OF HIGHLY COMBUSTIBLE GASES IN VITAL AREAS" During the 387th and 388th meetings of the Advisory Committee on Reactor Safeguards, July 9-11 and August 6-8, 1992, we reviewed the NRC staff's proposed resolution of Generic Safety Issue 106 (GI-106), " Piping and the Use of Highly Combustible Gases in Vital Areas." Our subcommittee on Auxiliary and Secondary Systems also reviewed this matter during its meeting on July 8, 1992. During this review, we had the benefit of discussions with representatives of the NRC staff and its contractor and of the documents referenced.

The proposed resolution deals with the piping and use of combustible gases, principally hydrogen, within nuclear power plant bui dings. Storage facilities external to plant buildings are being dealt with by a new separate licensing issue. Hydrogen is stored usually in large quantities, and used in both boiling water reactor (BWR) and pressurized water reactor (PWR) units. The concern is that a large release of hydrogen may lead to fires or explosions that could jeopardize safety. Although scoping analyses reported in the Regulatory Analysis (NUREG-1364) indicate that the risk is generally small, detailed analyses for some PWRs have shown that certain corrective measures may be justifiable under the Backfit Rule. For the selected BWRs the analyses showed that corrective measures were not necessary.

The staff is intending to implement the proposed resolution by issuing a generic letter to inform all licensees and applicants of the findings. Only affected PWR licensees and a (i.e.,

those who find corrective measures are necessary) pplicants are requested to resporid , but no new staff requirements or positions are being imposed. The response will require an evaluation which may be performed separately or as a part of the IPE or IPEEE. The staff resolution does not cover hydrogen water chemistry installations for BWR units or liquified petroleum gas installations for PWR or BWR plants. These are being treated as a separate Licensing Issue identified as LI-136.

g 7 c) cu c/gg 3 .

Enclosure 6

Mr. James M. Taylor 2 August 14, 1992 We have the following comments concerning the proposed generic letter:

1. The letter should apply to both BWR and PWR units. Otherwise, the hydrogen distribution system for a BWR main generator will not receive an evaluation. Further, a BWR turbine building may contain safety-related equipment.

2. The letter should point out that the turbine building evaluation should include consideration of the effects of hydrogen detonations on the physical separation barrier wall (including penetrations such as doors) between the turbine building and adjoining reactor, control, or auxiliary buildings. It is not clear that this ' consideration was included by the NRC staff in deciding to exclude BWR_ units from the evaluation and response requirements of the letter.

A similar detonation vulnerability consideration should apply to separation barriers (e.g., fire barriers) within PWR auxiliary buildings.

3. The letter should indicate what preoperational and periodic testing provisions and requirements should apply when the evaluation takes credit for the functioning of excess flow--

check valves or other active isolation provisions.

4. The letter should provide guidance on dealing with hydrogen fires, our concern is that extinguishing a hydrogen fire could result in the accumulation and possible detonation of the hydrogen.

If these comments are appropriately addressed in the generic letter, we would agree with the NRC staff that NUREG-1364 provides a satisfactory basis for - the resolution of GI-106 and that the proposed generic letter constitutes a suitable-implementation of the resolution. We would like to review the final revision of the generic letter before it is issued.

As part of the GI-106 effort to arrive at resolution, a study of hydrogen combustion and detonation was done by INEL. This study- is currently in draft form and is under peer review. The study yielded the shock loadings on concrete walls as a function of distance from the ignition point and amount of hydrogen involved.

The shock 'oading was used by- INEL and its contractor, RPK Structural Mechanics Consulting, to establish separation distances needed to prevent unacceptable damage to the walls. The staff and its contractor' are to be commended for a fine analysis of a difficult problem. We recommend that the draft report describing the effort be released as soon as possible so that it can benefit

. . l i

Mr. James M. Taylor J August 14. 1992 1

i those who must make decisions about severe accident containment l loading.

Sincerely,

)

.,-VV b ,

David A. Ward Chairman

Reference:

Memorandum dated April 3, 1992, from Warren Minners, office of Nuclear Regulatory Research, for Raymond F. Fraley, ACRS, transmitting resolution package for review, including:

(a) U.S. Nuclear Regulatory Commission, NUREG-1364, " Regulatory '

Analysis for the Resolution cf Generic Issue 106: Piping and the Use of Highly combustible Gases in Vital Areas" (b) Generic Letter to Licensees and Applicants, Subjects -Request for Information Related to the Resolution of Janeric Issue 106, " Piping and the Use of Highly Combustible Gases in Vital Areas," Pursuant to 10 CPR 50.54(f) - Generic Letter 29-XX (c) W. W. Madsen, D. H. Van Haaften, EG&G Idaho, Inc.,.and R. P.

Kennedy, RPK Structural Mechanics Consulting, EGG-SSRE-9747,.

" Improved Estimates of Separation Distances to Prevent Unacceptable - Damage to Nuclear Power -Plant -Structures from Hydrogen Detonation for Gaseous Hydrogen Storage," December '

1991 9

g'&+v- wm-y -- - *q .*

[pm #1Cg UNIT ED ST AT ES l' er h'g NUCLEAR HEGULATORY COMMISSION

{ j ADVISORY COMMITTEE ON REACTOR SAFEGUAHDS w Asmuotow, o. c. r es August 18, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555  ;

Dear Chairman Selin:

SUDJECTr SEVERE ACCIDENT RESEARCH PROGRAM PLAN During the 387th and 388th meetings of the Advisory Committee on Reactor Safeguards, July 9-11 and August 6-8, 1992, we reviewed the Severa A::ident Research Program (SARP) Islan that is being directed by the Office of Nuclear Regulatory Research (RES). This review followed meetings of our Severe Accidents Subcommittee on October 25 att i 26, 1991, May 27, 1992, and June 25, 1992, at which this matter was discussed. We had the benefit of discussions with representatives of the NRC staff and of the documents referenced.

GENERAL COMMENT

S First, we consider the updated GARP Plan, described in draf t NUREG-1365, Revision 1, a noticeable improvement over what we have seen in the paet. The document is well written. The goal of the overall program is said to be the reduction of the likelihood of early containment failure. Generally, the goals and objectives of individual projects are more clearly stated than we have'seen in the past. Even so there are occasional ambiguities, and the organization needs improvement. For example, there is duplication as well as some inconsistency among the appendices and the main report. In addition, some project descriptions begin with statemer.ts that this is a very complex area, that large uncertair.-

ties exist in the understanding of severe accident phenomena, and that the proposed research will remove some of the uncertainty.

There is no indication of how much uncertainty is likely to be removed by the proposed research, nor how much must be removed in order that the regulatory program proceed satisfactorily. The objectives of several projects are still described as an effort to

" gain insights" without an indication of how much or what type of insight is required, or to achieve a "better understanding" of some phenomenon without an indication of where the existing understand-ing is deficient or of what will be contributed to the regulatory process by an increased understanding. We do observe that effort 1

i l

Enclosure 7

-fpd-ff$6-W/ CQ _ _ _ _ _

s. .

The Honorable Ivan Selin 2 August 18, 1992 is now being made to identify the point at which the objectives of a project will have been achieved.

Second, we commend the staff for the extensive peer reviews that are now being required. The planning of research, the results of the research, and the conclusions drawn from the work are now being subjected to review. Our observati.ons lead us to believe that, as a resuit, the current research activities are making more efficient use of resources, rurther ' review of the results and of their interpretation by those outside RES should produce conclusions that have greater general acceptance and are more broadly useful than has been the case in the past.

Third, we observe that those responsible for, severe accident research labor under a significant handicap. As we have reported to you earlier, there has not yet been a decision as to how the severe accident issues are to be dealt with in the regulatory arena, either for evolutionary or advanced reactor designs. The Office of Research is thus in the position of a traveler with no road maps.

COMMENTS ON SPECIFIC ACTIVITIES Ihe Mark I Liner Failure Issue RES reported to us that ' the Mark I liner issue is close to resolution based on the following developments:

e The report, NUREG/CR-5423, "The Probability of Liner Failure in a Mark I Costainment," has been extensively reviewed and revised to take account of the reviewers' comments.

• The core-concrete interaction (CCI) issue has been resolved.

We agree that NUREG/CR-5423 provides a coherent treatment of early failure of the Mark I liner. We note that the effects of ex-vessel steam explosions, which might result if water is on the containment floor, were not treated. We also call attention to and agree with the observation of Dr. S. Hodge, Oak Ridge National Laboratory (ORNL), in his letter appended to the report, that the report concludes only that early failure is implausible. Later failure is not ruled out by the results of the report.

Chemical Form of Iodine Released to Containment We discussed work recently completed at ORNL (NUREG/CR-5752) on the chemical form of iodine expected to be released to containment.

This work contributes to the formulation of the new source term, and should lead to a more reliable calculation of iodine released

. - - - - ~ _ _ . _ -

- - . . - ~ . - - . ..~ - _

e, , ,

)

The Honorable Ivan Solin 3 August 18, 1992 outside containment. It is not clear how these results will '

influence calculated risk of existing plants nor how the informa-tion will be used in the review of the individual plant examina-tions (IPEs) being performed. This should be investigated further.

Direct containment Heatina ,

An experimental program expectpd to produce information that will--

provide a resolution of the direct containment heating.(DCH) issue is now said to be on a solid technical base.- A resolution is  :

expected within about a year. The program was delayed because of-questions about scaling. The recently issued severe accident scaling methodology (SASM) report, NUREG/CR-5809, provides the needed guidance. Experimental work at Sandia National Laboratories (SNL) has begun. Work at Argonne National- Laboratory (ANL) is also under way. Early results indicate that a defensible case can be made for the loads on containment being well below the structural -

, failure loads, at least for the large dry containments.

We note, however, that for many of the PWR PRAs, including two of' those treated in NUREG-1150, containment bypass is the risk-dominant failure mode. Thus, it is expected that resolution of the 3 DCH issue will not have a significant effect on the estimated risk- '

or on the risk uncertainty for these plants. We are encouraged. -

that-useful guidance in this area has been provided by the severe accident scaling methodology.

Hydrocen We have some concerns about the conclusions concerning effects of hydrogen detonations on containments such as the steel shell proposed for.the Westinghouse- AP600. It appears that the NRC staf f has not considered thin shell containments, . nor have they gone  ;

beyond planar or spherical shocks. Some recent co'nversations that we have had with the members of the German RSK indicate that their investigations have convinced them that three dimensional calcula 7 tions are required because of the shock interactions that will _

occur.

We are not satisfied that there has been adequate investigation of the following questions for containments generally:

e . Where is the hydrogen in containment? '

e How is appropriate igniter placement. determined? .

e How effective are igniters in removing hydrogen from-l mixtures of steam and other noncondensable gases?

l l

. -- ..__a .~_m. . . . . _ - - ~ , . . ,a ,__ ,~A. - . ,- n - ~ , ? , u ,-

i. '

l The lionorable Ivan Selin 4 August 18, 1992 e How ef f ective are containment passive cooling systems as hydrogen concentrators?

e How likely is a detonation?

Core-Concrete Intera.11DD C 4

We agree with the report by .Dr. A. Powers, SNL, that, in his view, the experimental work that has been completed is adequate for the validation of the models in the NRC severe accident codes that model core-concrete interaction. A major uncertainty in the results of calculations using current codes is the state of the molton material that exits the vessel. He considers the agreement between CORCON calculations and the German BETA Test to be very good.

Rebris coolability This research is particularly important to an evaluation of the effrets of molten corium on the containment loading for the new reactor designs currently being reviewed. A number of programs over the past several years, both in the U.S. and abroad, have investigated the cooling of n.olten corium on the containment floor covered by a layer of water. Data are sparse, and the issue of whether cooling will occur,in actual containments under accident conditions is still open. How applicants will be required to demonstrate debris coolability in containments is also still not established. If it is to be done experimentally, additional research will be required. The small-scale Melt Attack and Debris Coolability Experiment (MACE) tests at ANL, scheduled for comple-tion in FY 1993, are expected to provide additional information, but are unlikely to provide conclusive evidence of coolability of debris. Some additional experiments may be required af ter the results of the MACE tests are analyzed. The magnitude and scope of these should be determined by regulatory needs. Work on debris spreading, an important consideration in coolability, is planned for 1994.

Fuel-Coolant Interactiplig The principal concern is whether explosive energy releases can occur when molten corium encounters coolant either in the vessel or af ter the corium has lef t the vessel. Despite. a recognition of the problem almost two decades ago, no generally accepted method exists for calculating the conversion of thermal energy to mechanical energy in this situation. Currently there are saveral small programs in the U.S. being supported by the NRC, as well an a program in Europe in which the NRC is participating. It is questionable whether any of these will produce information that will resolve the issue. We recommend further research in this area.

6, 4 ,

i 4

The Honorable Ivan Selin 5 August 18, 1992 In-Vessel Core Melt Proaression The staff proposes relatively modest expenditures for core-melt progression research. The purpose of the work is said to be e the resolution of the question of whether to expect TMI-like blockage as a general behavior for BWRs, and '

e to provide some technical basis for validation of blocked-pool models under development, and their predictions regarding the f ailure location of the crust and the melt relocation into the bottom head. l The above items, along with new models, may permic better estimates of the amount, superheat, metal content, and timing of melt relocation into and subsequent failure of the bottom head. This should provide a basis for better models for quintifying risk. If interpreted properly, the results may also provide guidance in the choice of accident management strategies, assist in the Safety Goal-Policy implementation, and remove some of the uncertainty from cost / benefit analysis for backfit decisions.

We suggest, however, that the models that' result from this work should be taken as representing only one possible severe accident progression. Puture severe, accidents, if they occur, may take as unexpected a course as those few that we have experienced. _Thus predictions of their course-and consequences with models based on limited past experience may be misleading. Analyses of the type i

reported by Dr. S. Levy (S. Levy, Inc.) in the SASM report could be useful for evaluating the uncertainties associated with such incomplete models.

We also believe that additional fundamental separate effects experiments are needed to better define the crusting behavior and the thermal hydraulics associated with molten pool conditions.

l Lower Head Failure Analysis Lower head failure analysis _ (NUREG/CR-5642) of the TMI-2 vessel should be of considerable value if it can be - shown that what happened there has general applicability. We suggest that further attention be given tot

• How typical is the TMI-2 accident, even for a PWR, and how well is it understood? For example, it was reported to us that SCDAP/RELAP5 still does not_ provide a good estimate of the lower head temperature rise.

• What are the uncertainties or the contributors to uncer-'

tainty in the results of the lower head failure analysis?

+ +

4 The Honorable Ivan Selin 6 August 18, 1992 Review of Severe Accident Codes We were told that a program of peer review of the codes that RES expects the NRC staff to use over the next few years is under way.

Dr. B. Boyack of Los Alamos National Laboratory (LANL) reported on a peer review of MELCOR that has been completed (LA-12240) . After an extensive study of the code, the review group, chaired by Dr.

Boyack, reported a significant number of deficiencies. It appears that the code should be used'with considerable caution until these deficiencies have been corrected. It would also be desirable, before deciding on performance goals for the code, to decide how it is to be used in the regulatory process. We note that it is not being used in the formulation of the source term, which will replace the one that has been used as part of the siting rule (10 CTR Part 100). It is not clear whether the staff plans to use MELCOR in evaluation of IPE results. Such use appears undesirable ur 11 the code has been improved.

In light of the rather significant number of problems identified by the peer review, the RES staff should consider the development of procedures to make it less likely that so many problems would exist at such an advanced stage of a code's development.

We understand that a peer review of the ScDAP/RELAPS code is onder way. Since the results are not yet available, we choose not to comment generally on that code in this report. However, we are concerned that the modeling of parts of the severe accident sequence, which the code treats, are said to be based on bounding models rather than on best estinates. This could lead to. genera-tion of misinformation, especially if used in formulating accident management strategies, or in evaluating the results of Level 2 and Level 3 PRAs that may be submitted in response to the IPE program.

Use of Risk Analysis in the Plannina of Severe Accident Research We are not convinced that enough attention is being given to the.

results o; risk analysis in the planning of severe accident research. Both operating experience and analysis provide convinc-ing evider.ce that severe accidents are low-probability and in many cases low-risk events. Further, as the industry accumulates additional experience, the risk should decrease. Indeed, there are some who would argue that the risk is already sufficiently low that additional research is unwarranted. We have.not yet reached that conclusion. Nevertheless, we would like to see more evidence that the chc ice of research areas and the approach to the research is made with risk reduction as a principal focus.

The work at SNL described by Dr. F. Harper may be an ef fort in this direction. It is, however, at a very formative stage. . The general approach, i.e., development of simplified event trees to approxi-mate complex structures such as those found in NUREG-1150, might be l

_ _ _ _ _ _ _ - - - - - . - _ - - - - - - , - m

4-The Honorable Ivan selin 7 August 18, 1992 a useful complement to engineering judgment in planning research or in making closure decisions on severe accident issues.

Whatever method is finally used, we believe that more attention should be given to the risk expected from an accident scenario before investments are made in its further elucidation. <

Summary of Cgggents on Soecific-KEErvities e We see no reason for further work on the Mark I early containment failure issue, e The work on the chemical form of iodine released to l

containment provides important input to formulation of a new siting source term. The implication of the new information to risk of existing plants should be ex-

! plored.

e The experimental program on DCH is soundly based, and j should resolve the issue.

• We do not believe that some important aspects of the hydrogen issue have received the attention they deserve.

• Existing information is adequate to treat core-concrete interaction on a dry floor.

l e Debris coolability is still an open issue. It will probably not be resolved by existing or planned programs.

• The question of energy _ release associated with. violent.

interaction of liquid corium and water as unresolved, and a resolution is not in sight. We recommend additional research in this area, e Significant weaknesses have been identified by the peer reviewers of the MELCOR code. Decisions on the use of L severe accident codes and on their required capability are needed before plans for further developments are made.

• We endorse, with the caveats noted, the core melt progression program.

CLOSING COMMENTS The description of the Severe Accident Research Program Plan provided by draft NUREG-1365, Revision 1, is a significant improvement over previous reports that we have reviewed. The descriptions of the proposed. research are- generally clear and specific. The report defines a goal for the program, i.e.,-the

4 - J' lg g

i.

t The Honorable Ivan Selin 8 August _18, 1992 exploration of. phenomena that are expected to influence early ,

containment failure.

We see a need . for better communication among ' the . various units  ;

working on parts of a larger problem. During the course'of our '

review, we encountered several examples of lack of communication <

between the Accident Evaluation Branch and other. branches engaged ~

in closely related work._ For ettiiiiIple, we asked about the MACCS code, a key code in the evalua, tion of severe = accident risk. The answer we got was that it was in another branch. Yet it.is the. l MACCS code. that eventually calculates risk, and unless its!

limitations ~and capabilities are well understood, information -

provided as input to the code may not- be appropriate. Wo. received-  :

a similar response-when we asked.about work _on component heating-due to natural convection of gases in a core damaging accident.

But if either steam generator tubes or. other = upper reactor. coolant  ;

system components are- overheated to failure by this process,- the course and consequences of'the accident _can be markedly-affected.

Finally, last this report seem overly negative, we emphasize that  !

we concentrated our comments primarily on areas that were perceived to require further attention. We thank the NRC staff for the time and effort that was-put-into preparing for the many presentations _

that were part of this review.. In general the presentations were well organized and well presented, and;our questions were dealt with patiently and with good humor. ,

Dr. Thomas S. Kress did not participate; in those>fCommittee deliberations that would impact directly on his outside interests.

Sincerely,.

D-David A. Ward

References:

1. Memorandum dated April 22, 1992, from Brian W.:Sharon,LOffice of Nuclear Regulatory Research,1NRC,_for R.' F. Fraley,:ACRS,

Subject:

Severe Accident Research _ Program Plan -Update,~

attaching NUREG-1365, Revision-1, April 1992 _(Draf t Predecisi-~- '

onal)- , .. ,

2.- U. . S . - Nuclear ' Regulatory commission, NUREG/CR-5423,. ~ "The Probability of.' Liner Failure in? a Mark-I: Containment," T.

Theof anous, et al. (UCSB) , August 1991, with Appendix K, Post-Workshop Summary. Comments;by'the. Experts, includingi"Recom- .

mendations for Additional Technical Work, Mark .I_ Shell- l Survivability. Issue," S. Hodge, November 12,'1990  ;

't h

1 'J'

=_

__I __

, ,n, , , , - , , , , , . . . - - -- , . . , . . - - - - - - . - , . - . _ - - . - - ~ - - - - ~ _ _ . - -

I The Honorable Ivan Selin 9 August 18, 1992

3. U. S. Nuclear Regulatory Commission, NUREG/CR-5732, " Iodine Chemical Forms in LWR Severe Accidents" (Draft Report for Conment), E. Beahm, et al. (ORNL) , July 1991 ,

4. U. S. Nuclear Regulatory Commission, NUREG/CR-5809, "An Integrated Structure and Scaling Methodology for Severe .

Accident Technical Issue Resolution" (Draft Report for Comment), Technical Program Group, November 1991, with Appendix G, " Amount of Matertal' Involved In DCH During a PWR Station Blackout Transient," S. Levy (S. Levy, Inc.)

5. U. S. Nuclear Regulatory Commission, NUREG-1150, " Severe Accident Risks: An Assessment f or Five U.S. Nuclear Power Plants," Of fice of Nuclear Regulatory Research,- December 1990

6. U. S. Nuclear Regulatory Commission, Draft HUREG/CR-5642,

" Light Water Reactor Lower Head Failure Analysis," J. Rempe, et al. (EG&G), March 1992 (Draft Predecisional)

7. Los Alamos National Laboratory, LA-12240, "MELCOR Peer Review," B. Boyack, et al., March 1992

8. Verbal presentation by Dr. D. Powers (SNL) to the ACRS Severe Accidents Subcommittee, October 21, 1991

9. Verbal presentation by.Dr. F. Harper (SNL) to the ACRS Severe Accidents Subcommittec, May 27, 1992

10. Letter dated April 24, 1990, f rom Carlyle Michelson, Chairman, ACRS, to Kenneth M. Carr, Chairman, NRC,

Subject:

Severe Accident Research Prograa Y

,- 4_~ . . , , _.- .-.-,,J.- ..i... ._- ., ,m.. . , .._.,.i,-. - - . - . - . --

• ~

. s

[eran ~ , , o UNITED STATES l' c I NUCLEAR REGULATORY COMMISSION i

0, c ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON, D C. 20565 e . . . s *#,

September 16, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

DIGITAL INSTRUMENTATION AND CONTROL SYSTEM RELIABILITY During the 389th meeting of the Advisory Committee on Reactor Safeguards, September 10-12, 1992, we reviewed the staff's proposed approach with respect to defense against common-mode faalure of digital I&C systems, as discussed in policy issue "A" of the draft Commission paper entitled, Policy Issues Pertainin " Design Certification and Licensing Water Reactor Designs,g" to Passive and Evolutionary Advanced Light 1992. Specific comments forwarded on policytoissue the Commission on June 25, "A"

letter to raise here Taylor dated September 16, 1992. areThe Mr.are, contained in a however, more generally applicable,concerns we

• e.g., in digital replacements. connection with the staff's proposed generic letter on analog-to-The toward trend theinreplacement most industries over the last few decades has been of analog instrumentation and control systems been with digital alternativas, and the nuclear industry has no exception.

replacements within existing This hasnuclear been true for both functional designs, facilities and for new so it has been necessary for the staff to develop regulatory practices to deal with both the novel opportunities and the novel threats posed by these systems.

Experience, both military and industrial, has generally shown the digital systems to be more reliable and versatile than their analog counterparts.

conundrums. There are, however, some caveats and some regulatory of An advantage is that the digital systems are capable more complex functions, so it is possible to build in self-testing ity withcapabilities negligiblethat provide continuous assurance of operabil-system stress. In addition, the digital systems don't wear out; more damaging than a thousand. a billion activations of a CMOS gate are no While much has been made cl_the vulnerabilities of which are doubtless real, multiplexed data transmission systems, some of fidelity and reliability of data transfer, along with greater faultsuch systems l

) 7

• O_ 0 The Honorable Ivan Selin 2 September 16, 1992 tolerance through error-correcting coding. (If an analog signal is corrupted, it is often not possible to know it has happened.)

Indeed, error detection and error correction can be carried to arbitrary lengths for digitized data. There are many other advantages, and the future clearly belongs to digital systems, where they can be used.

On the negative side, the available complexity of function afforded by digital systems invites the creation of complex sof tware, which can be difficult to validate and can be subject to surprising error

modes. Such systems are also hard to regulate, because only the '

simplest programs are amenable to formal validation and verifica-tion (V&V), in the sense of a complete analysis of the mapping of the input space to the output space. For more complex programs (relevant to nuclear control systems, but not - necessarily -to ,

instrumentation or safety actuation systems), there are many analytical techniques in use, none perfect. That is also true of analog systems. Solid-state systems, whether digital,or analog, are also peculiarly vulnerable to environmental-damage, e.g. , from overheating. Finally, programmable digital systems have their own special vulnerabilities to human error.

The staff has concentrated its attention on one of these many issues, the vulnerability of digital systems to certain kinds of' r common-mode failures, principally through programming errors i introduced into the sof tware, and therefore common to all channels. ,

To deal with this supposedly special susceptibility:to common-mode' failure, the staff has proposed a set of regulatory requirements.

The set includes some unarguable items, like the provision of adequate diversity to cope with common-mode failures that can ,

affect safety systems, and analysis of the appropriate accident sequences. The set also includes some items whose desirability is less clear, and we now surn to these.. Since each of these would require an extensive discussion to-develop the point completely, and points, we will be brief.

since our recommendation is that theLataff revisit all these There is no special-order.

The lack of explicit and quantifiable . safety. standards .for instrumentation and control systems is particularly troublesome here. The staff speaks of-reliability for digital systems in-the same terms (failures per. demand) that it uses for items which do wear out, like relays and switches. The entirely dif ferent failure i-mechanisms- make this an inappropriate transfer of terminology.

! Indeed, a simple software-based-system, in_which the hardware is kept within its environmental' constraints, and whose software _is simple enough to have been subjected to a full validation and

-verification - (in the sense used above) : can be expected ' to' never-fail.- (Never is only a - slight exaggeration.) The failure anecdotes we all know are typically in systems that are too complex L -for formal V&V, leaving the door open to sof tware errorr., or have- +

i M - mer e v w m , , 4 & , 4,- c'

The Honorable Ivan Selin 3 September 16, 1992 been mistreated, opening the door to hardware failures. The latter problem is not unique to digital systems.

In view of the lack of explicit standards for the reliability of the digital systems, the staff seems to have drifted to what has been called the " bring me a rock" posture, in which the industry is asked to analyze its own vulnerabilities, after which the staff will make its ruling about the adequacy of the design. The spirit of the safety-goal initiative was presumably to help make regula-

. tion more predictable, and this approach is clearly in the other direction.

The focus on common-mode failures is troublesome. Software errors in single systems can lead to accidents just as serious as those due to common-mode failures in redundant systems, and the entire question of software reliability greatly transcends the issues raised here. We have been conducting a coordinated series of meetings on the safety issues involved in the inevitable computer-ization of the industry, already in progress. When we report on these, we will doubtless raise the question of whether sufficient talent, both in quantity and in experience, is being directed at these issues by imC. That question is also an underlying issue here.

For the specific issue of protection against common-mode failures, whether for digital systems or such devices as diesel generators, .

there is a set of standard prophylaxes like diversity and. defense in depth, which are useful when applied sensibly. (Slogans can be overplayed. It makes no sense to insist that multi-engine aircraf t have a suitable mix of turbine and piston engines.)

The most controversial specific position taken by the staff is that there must be a safety-grade set of displays and controls located in the control room, independent of the computer systems, and

" conventionally hardwired" to the lowest level practicable. Though the intent of the words in quotations is unclear, we were assured that it was to require analog backup systems. We do not concur in this proposed requirement. We think that the staff is unnecessari-ly mixing up the issues of digital / analog, hard wire / multiplex, and software / hardware.-

l Each instrumentation and control system that is important to the i safety of a plant ought to meet some . identifiable standard of reliability and fault tolerance, regardless of the hard-ware / software basis used in designing and fabricating the system.

l It is not necessary that any given element of the system be perfect, but that the system as 'a whole meet some recognized standard, presumably in the form of a relevant surrogah for the Commission's safety goals. Both the identification of that standard and the evaluation of conformance for the system in l- question pose problems,- but each should somehow be completed l ..

1

l l

The Honorable Ivan Selin 4 September 16, 1992 before, not after, a regulatory position is established. For example, the staf f proposes to require that a backup system provide protection equivalent to that of the primary system, whereas the need is for sufficient protection to assure the adequate safety of the plant. It is not at all uncommon for backv? systems to be designed to lower standards than the primaries, taking into account the f act that they will be called upon less of ten. (Consider spara tires.)

It is entirely possible that a digital system may turn out to be a

'better backup than an analog system. (The proposed position does accommodate this idea, but the staff briefings did not.) For some situations a light beam is a more reliable means of communication than a hard wire. A general-purpose microprocessor that is in widespread commercial use may be more reliable (and more thoroughly tested) than a special-purpose analog switch. And so forth.

In each case it is necessary to make a specific reliability analysis, measured against a reasonable standard, and the staff gave no evidence of having done so for any case. Instead, it has adopted a general requirement for an analog backup for all cases, and we were not convinced by the justification provided.

We recommend that the staff revisit these issues, augment its own capabilities, and broaden its interaction with those elements of the outside world who have previously dealt with such problems. It ,

would be unwise, however, to read too literally into the nuclear arena the considerations that are relevant to far more complex systems. We are dealing here with the relatively simple safety-centered parts of the computerized instrumentation and control system, and an architecture that exploits this fact may be more robust.

Sincerely, David A. Ward Chairman

References:

1. Memorandum dated June 25, 1992, from James M. Taylor, Execu-tive Director for Operations, NRC, for The Commissioners, Sub; t: Rt. view of the Draft Commission Paper, " Design Cert.fication and Licensing Policy Issues Portaining to Passive and Evolutionary Advanced Light Water Reactor Designs"

2. 57 Federal Reaister, 36680, August 14, 1992, Proposed Generic Communication; Analog-to-Digital Replacements Under the 10 CFR 50.59 Rule

.. .* o

.# p neso 'o UNITED $TATES

~

! *' n NUCLEAR REGULATORY COMMISSION f

• I ADVISORY COMMITTEE ON REACTOR SAFEGUARDS o WAsamaTos,o.c mss s.,...../

November 12, 1992 The Honorable Ivan Selin Chairman U.S. Nuclear Regulatory Commission Washington, D.C. 20555

SUBJECT:

ENVIRONMENTAL QUALIFICATION FOR DIGITAL INSTRUMENTATION AND CONTROL SYSTEMS During the 390th meeting of the Advisory Committee on Reactor Safeguards, October 8-10, 1992, we were briefed on the staff's research program to define the environmental qualificntion requirements needed for digital instrumentation and control systems. In addition, on June 16, 1992, our Subcommittees on Computers in Nuclear Power Plant operations, and Reliability and Quality met jointly to considor this matter. During these meetings, we had the benefit of discussions with members of the NRC staff and its contractors.

As part of its continuing effort to meet the challenges posed by the emergence of modern digital instrumentation and control systems, the staff is concerned.about the peculiar vulnerabilities of such systems to environmental stress. There is, therefore, a research program responsive to NRR's perceived needs, directed at uncovering enough information to provide regulatory guidance. The program is far from complete. We were told that it will ultimately study about a dozen environmental stressors, including temperature, moisture, smoke, etc. , but the preliminary results presented to us were in fact confined to the area of EMI/RFI (electromagnetic /

radio-frequency interference).

We were told that the staff had made no effort to set priorities or to assess the risk levels associated with the various stressors before deciding to concentrate on EMI/RFI, and are therefore concerned that it may be emphasizing the problem easiest to s olve, rather than the most risk-significant. A coherent approach to risk management and regulation would assign the NRC's scarce resources and expertise through risk-besed criteria.

Our judgment (in f airness, also not based on detailed priority analyscs) is that the problems of EMI/RFI are receiving unwarranted emphasis. This is not to say that they are unreal-there are many l

l2/zcto zu zy.

l J. j l

l The Honorable Ivan Selin 2 November 12, 1992 ,

anecdotes of interference-induced failure-but only that the nature  ;

of the threat and of its solutions are well understood, from work ,

done in different contexts. Careful attention to shielding and to l grounding, together with electromagnetic discipline when shielding is compromised (as, perhaps, by opening metal cabinets), can go a long way toward alleviating any vulnerabilities that may exist.

The techniques are well known, and in no way mysterious.

Indeed, in the military world, where susceptibility to intentional jamming is a constant threat, and even vulnerability to extremes of temperature, moisture, and smoke is an endemic concern, there is an enormous body of information about measures and countermeasures.

We were therefore surprised to be told that NRC hsd made no contact with the relevant agencies before embarking on its own research program.

We do agree that the NRC must develop guidance for the protection of vital electronic systems (and indeed for all other vital systems) from potentially disabling environmental influences, but we heard no rationale for the specific concentration on the one.

threat singled out for attention.

We recommend that the' direction of the program be reassessed to account for some kind of risk ordering of a suite of likely stressors, and that diligent efforts be made to ' draw on the experience of the community, including the military community, for relevant information. None of these phenomena are unique to the nuclear world. -

Sincerely, Paul Shevmon Chairman-