ML20151H805
| ML20151H805 | |
| Person / Time | |
|---|---|
| Issue date: | 07/20/1988 |
| From: | Kerr W Advisory Committee on Reactor Safeguards |
| To: | Zech L NRC COMMISSION (OCM) |
| References | |
| ACRS-R-1312, NUDOCS 8808020056 | |
| Download: ML20151H805 (9) | |
Text
c
[,,n.s#
g7&N- /.SM UNITED STATES 8'
NUCLEAR REGULATORY COMMISSION PD4 e
U
.I ADVISORY COMMITTEE ON REACTOR SAFEGUARDS Y
W ASHINGTON, O. C. 20656
....+
July 20, 1988 The Honorable 1.ando W. Zech, Jr.
Chairman U.S. Nuclear Regulatory Commission Washington, D.C.
20555
Dear Chairman Zech:
l
SUBJECT:
REPORT ON KEY LICENSING t'SL'ES ASSOCIATED WITH DOE SPONSORED REACTOR DESIGNS l
During the 339th meeting of the Advisory Comittee on Reactor Safe-l guards, July 14-16, 1988, we met with members of the NRC Staff and the Department of Energy (DOE) Staff and reviewed a draf t Comission Paper on "Key Licensing Issues Associated with DOE Sponsored Reactor De-signs," dated February 9, 1988.
This subject was also considered during our 334th, 335th 336th, and 337th meetings on February 11-13, 1988; March 10-12,1988; April 7-9,1988; and May 5-7, 1958, respec-tively.
Our Subcomittee en Advanced Reactor Designs met on January 1
6, 1988 to discuss this matter.
We also had the benefit of the I
documents referenced to this letter, j
The Comission, in a l6tter dated July 9,1987, instructed the staff f
to develop such a key-issues paper in advance of projected safety I
evaluation reports on each of the three conceptual designs being proposed by DOE and its contractors. The Comittee believes this was a wise decision; it is appropriate to confront and attempt to resolve i
i the most important safety and licensing issues in a general and direct way, rather than only by reacting to design proposals.
In doing this, the NRC Staff has undertaken an important and difilcult task.
It can l
be viewed as an attempt to create, from the top down, a comprehensive rationale for licensing requirements.
This would be very different from the existing body of reCulations for light water reactors (LWRs),
which has grown an element at a time in a more reactive and pragmatic fashion.
The nation has more than thirty years of experience in the development and realization of practical nuclear power.
The DOE sponsored de-signers have made use of this experience and of associated research h
II 9
'NM l
pA m as - e gov
The Honorable Lar.do W. Zech, Jr. July 20, 1988 and analytical development tu create three conceptual designs which they believe offer significant advantages over existing LWR plants.
Similarly, the NRC should take advantage of experience it, the regu-lation ard safety analysis of plants to create an improved approach to the specification of safety requirements.
In doing this, care must be taken that regulatory requirements do not unnecessarily frustrate the dt.velopment of advanced reactors.
The regulations should permit the application of innovative reactor concepts while protecting the health and safety of the public. Ve believe this can be done, but additional effort on the part of the Comissicners and the NRC Staff will be required.
False urgency should be aveided; it is nore important to do the jcb right than to do it socn.
The staff effort so far has been thoughtful and productive, and pro-vides appropriate preliminary guidance. They have identified four key issues as a basis for review of the design proposals:
Accident selection Siting source term selection anu use Ader,uacy of containment systems Adequacy of off-site emergency planning.
We believe these are irportant issues, but they do not adequately enccapass the full set of cencerns. We conent below on these issues and then discuss severel additional issues that we believe are also i
important and deserve further development.
We suggest that the staff's key-issues paper be regarded as preliminary guidance and that a continuing program of development and dialogue is necessary before criteria are considered final.
l ACCIDENT SELECTION The staff has prcposed four eve?+ categories for selection of design basis events based on estimates of the probability of events that right challerce a given system and on past practice and engineering j udgn.ent.
I For the second of these event categories (EC-!!), the staff would require that there be tolerance for single failures, that only safety-l grade systems should be credited in reeting the event cha11erge, and that retetor plant systems should continue to operate normally in response to the challenge. We believe this general approach is sound, but requires two caveats:
s The Honorable Lando W. Zech, Jr. July 20, 1988
- Credit for performance of nonsafety grade equipment in this class of events should be i.ermitted when this can be justified.
Designation of a component or system as safety grade is intended to ensure it has certain specific attributes.
Among these are the ability to resist certain seismic events, ability to function within certain harsh environmcrts, and a high level of reliabil-ity (supposedly guaranteed by a q nlity assurance program).
Not all postulated initiating events are challenges to all of these attributes.
Selectivity should be permitted when sufficient information is available about the nature of the design basis event.
- We agree there should not be conplete dependence on probabilistic arguments. Although estirnates of prctability are a proper first-cut approach to the definition of event categories, uncertainty in these estimates is large.
Judgments are needed about whether anc how to include as design criterit the capability to accomro-date phenomena and secuences that are not specifically indicated to be necessary by probabilistic estimates.
CONTAlbMENT SYSTEMS Contairment structures clearly are intended to restrict release to the environn.ent of radioactive materials resulting from a severe accident.
For LWRs althcugh the design bases for conteinmerts have included a source t' rm related to severe accidents, the design pressures and temperatures have been those related to a large-break LOCA rather than those resulting from an accident involving severe core damage.
Whether this seeringly inconsistent but pragmatic approach has served the r.uclear pcwer enterprise well can be debated.
On the one hand, some of the severe accident issues f acing the NRC and the incustry today are a legacy of that approach.
On the other hand, such a containment performed very well in the TMI-2 accident.
Research over the pest few years indicates that most existing conteinments would be l
reasonably effective in reducing the consequences of severe accidents.
The staff proposal for severe accident and containnent requirements for advanced reactors seers to be taking e different, but not neces-sarily better approach, than that used for LWRs.
Their contention is that, if the early lirts of defense, namely:
- prevention of challenges to protection systems, and
- prevention of core damage by protection systems
\\
j s
The Horerab'e Lando W. Zech, Jr. July 20, 1988 are effective encugh, thtn the next two lines of defense, namely:
- a conventional containment structure, and
- an emergency plan for the area around the site, are not necessary.
The so-called prevention and protection attributes of the three desigrs being proposed by DOF end its contractors are indeed im-pressive. The modular high terperature cas cooled reactor (MHTGR) has no conventional containment structure, but relies instead on the capacity of its unique fael particles to retain fissico products, even at abnormally high temperatures, with high reliability.
The two ligeid metal reactor (LHR) designs have containers around the reactor vessels, but these have low volume and pressure capacity.
It is unclear how they would accomodate a challenge greater than minor leakage of.codi m coolant.
Accidents can be postulated that would challenge the defense-in-depth concepts being advar.ced.
For the LMRs, a contemporaneous failure of the guard vessel and the reactor vessel, coupled with a sodium fire, would seen to lead to severe consequences.
For the MHTGR, a fire in the graphite moderator, perhaps perraitted by massive failures of the reactor sessel and core support, might also have severe consequences.
Whether these o other accidents could be effectively mitigated by a containment enclosure, or a filtered vent, has not been determined.
We note that in all three designs, absence of containment helps to make feasible one of the major safety advantages, passive systems for removing decay heat.
In each case, the reactor vessel surrcundings are designed so that air from outside the plant will flow by natural buoyancy through the reactor vessel cavity and thereby remove decay heat. This seems to be a highly effective heat transfer reans if the reactor vessel ar.o core are intact.
If they are not, this ready supply of oxygen and access to the environment might be a problem.
This seems to be a major safety trade-off.
We are not prepartd at the present time to accept these approaches to defense in depth as being completely adequate.
Further, we are not prepared at this time to accept the arguments that increased preven-tion of core nelt or increased retention capacity of the fuel provide adequate defense in depth to justify the elimination of the need for conventional containment structures. This is not to say that we could not decide othervise in the future, in response to an unusually persuasive argument.
l t
L
The Honerable Londo W. Zech, Jr. July 20, 1988 EPERGENCY PLANNING We agree with the present approach of the staff's proposal.
- However, we believe that emergency planning should be reexamined in an effort to describe an approach that would be applicable to all types of reactors.
ADp!TIONAL ISSUES Hew safe should these plants be?
We believe the debate about how safe is safe enough is concluded. The safety goal policy is in place.
That should stand as the definition of huw safe these advanced reactors, as well as future LWRs, should be.
Therr are, of course, ratters of interpretation and deplementa-tion with regard to safety goal policy.
These need to be dealt with for all types of reacter plant designs.
The focus of licensing and regulation for advanced reactors should be consistent with the safety goal policy; no rore, no less, no enhancements, no compromises.
The Advanced Reacter Policy states that advanced reactors rust be at least as safe as the current generation of LkRs. The staff interprets this to mean thc "evoluticr,ary" generation of LWRs now being reviewed by the NRC fer preliminary design certification.
We believe the Advanced Reactor Policy requires no more than, and should require no morr. than, the Itvel of safety called for in the safety goal pclicy.
Reactor developers, i.e., 00E and the industry, ncy seek a design that is safer than the safety goal would suggest as necessary, or whose safety is more readily apparent to the public.
Thost are not unreascrable goals for a developer in seeking public acceptance or more econocic operation.
However, it setas to us inappropriate for the NRC to ratchet on the standard of safety it has established as necessary and sufficient.
To what Extent should regulatory requirements accommodate public perception?
The draft paper states that the staff has incorporated only technical considerations in the development of its proposed positions.
In particular, they have not atterpted to accommodate external factors, such as public perception. We applaud this restraint. And we counsel the Commission to keep safety regulations unambiguously related to i
protection of the public health and safety.
i l
l l
l I
s I
The Honorable Lardo W. Zech, Jr. July 20, 1988 Extra capacity in decey heat removal and scram systems The three DOE designs provide much more capacity in decay heat removal and scram systenc than are provided in present LWRs.
While these important systems in LWRs must be tolerant of sirgle failures, the advanced reactors go well beyond that.
The reason for this is the intent to build more robustness into the first two layers of defense in depth and thus permit less in the last two layers, centainment and energency planning.
Two independent scram systems are provided in two of the three pro-poseo oesigns.
Each system is somewhat diverse in design and toler-ant, within itself, of single failure.
All three design proposals have ru1tiple systems for decay heat removal.
In additien to being dherse and resistant to single failure, the extra systems have inherent passive attributes.
They apparently will function effec-tively witicut motive pcher or operator in*,ervention.
However, a caution is necessary.
Experience in operation and analysis has indicated that redunder.cy, i.e., extra systers or components, is not as powerful in improvir.g reliability as might be expected.
Too often the r.ature of initiating challenges, or of the corplex sequence of events in accidents, seems to cause the extra parts of a system to be faulted alcng with the main system. The civerse and passive nature of tbc three designs being censidered might ameliorate such unwanted interdr. pendency, but further study is warranted.
In addition, while the three proposed designs have these positive features, it is not clear that the NRC's proposed requirerents would provide assurance that these desirable diverse and passive attributes would be guaren-teed.
Need for prctotyping The staff proprses only eccest requirerents for prototype testing of the ahanced reactor desigrs.
Although, they have recently added a proposed requircrent that any designs not incorporating a containment must be tested in prototype at a remote site, we question whether this is enough to carry the process to a point at which the NRC would be i
l willing to license an unlimited nurber of new power plants.
For example, the retallic LkR cores are claimed to have very favorable, inherently stable characteristics in respending to possible tran-sients. These characteristics were not well understood a decade ago.
An excellent experirental and analytical program by Ahl with the EBR.!! reacter at INEL has effectively demonstrated that the EBR !!
system does exhibit such inherently stable and predictable behavior.
Mcwever, it is not yet clear that such characteristics can be assured
s The Fenorable Lando W. Zech, Jr. July 20, 1988 for the larger and different & Rs to be used in comercial electric power prcduction.
We believe that a nore and extensive series of prototype tests will be necessary before design certification could be granted.
Use of cest-benefit analysis The staff paper proposes that prospective licensees should be required to dercrstrate through cost-benefit analysis that design features alttrnative to those being proposed are not warranted.
Presumably, the NRC staff would review such analyses and perhaps suggest alterna-tives.
K f. believe this is an urworkable and t.rnecessary strategy.
The NRC shculd concentrate its efforts on specifying design renuire-rtrts that will result in plants that are in conformance with the sWty goal.
Consideration of alternatives and ccsts is properly a function of the designer and owner of a plant.
The hRC should have enough confidence in its safety gcel that it does not feel the need fnr the proposed approach.
Desien for resistance to sabotage It is often stated that sigrificant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the drsign process.
Unfortunately, this hat, not been done consistently because the NRC has dtveloped no guidance or requirements specific for plant design features, and there seens to have been no systematic attempt by the industry to fill the resulting vacuum. We believe the LFC can and shculd develop some guidance for designers of advenced reactors.
It is probably unwise anc counterpreductive to specify highly detailed requirements, as those for present physical security systers, but er attempt should be made te develop scme general
- guidance, r
Operation and staffire Little is said in the staff paper about requirements for operation and l
staffing cf advanced reactors.
We find this to be a sericus over-sight.
Experience with LWPs has shown that issues of operation and staffing are prct, ably r. ore irportant in protecting public health and i
safety then are issucs of design ard construction.
The designers of the three reactor preposals seer to be claiming that the designs are so inherently stable and error-resistert that the questions of cpera-tion and staffing, so irpertant for LkRs are unirportant for the advanced reactors.
And that, in fact, the advance <
plants can be operated with only a very small staff.
We believe these clains are unproven ard that more evidence is recuired before they can be ac-l certed.
i
1 l
1 The Honorable Lando W. Zech, Jr. July 20, 1988 l
l i
The two irajor accidents that have been experienced in nuclear power, those at THI-2 and Chernobyl 4, were caused, in large measure, by human error. These were not simple "operator errors" but instead were caused by deliterate, but wrcng, actions.
There are some indications I
that the advanced reactor designs being considered have certain i
characteristics tending to make them less vulnerable to such mal-I operation.
But, this has not been demonstrated in any systematic way.
[
The traditiont1 methods of htA are not capable of such analyses; but, I
we believe a systematic evaluation should be n.ade. There seems little j
merit in mtking claims for the improved safety of new reactor designs r
if they havt not been evaluated against the actual causes of the most importent reactor accidents in cur experience.
i Will regulatory criteria evolve?
I The Staff propesal provides for a future milestene in the ongoing design-review-licensing process at which the hTC will step back and rake sure that the agreements reached early in the process are still valid, given possibic new information and understandings.
We believe j
this is wise and necessary, although it does place a potential licen-l see at some risk.
It should be recognized that this ru,lestone activ-j ity might have to include the possibility of changes in the actual r
requirements, as well es interpretations of requirements, j
Focus on the rest important residual uncertainties Although t F t-staff paper discusses uncertainties relative to the development of requirerents and designs, it should provide a clearer i
l statement of what the staff believes to be the mest important of I
these.
This would assist policyrakers in making judgments about the designs and requirerents and, perhaps, about whither certain avenues I
of research should be further pursued before or in parallel with l
licensing.
l Additional coments by ACRS Member Carlyle Michelson are presented I
below.
[
I 1
Sincerely, f
Willliam Kerr Chairman Additional Cements by ACRS Meeber Carlyle Michelsen f
It is not clear to me that the safety goal in its present form was intended to apply to advanced reactors which do not have conventional I
l I
The Honorable Lando W. Zech, Jr. July 20, 1988 I
containtrent systems.
The guidelines for regulatory implementation might have been different if the Comission had considered that the defense-in-depth approach might not include a containment system on l
future plants, j
It would be unfortunate if the frequency of large release criterion suggested in the present guidelines is used as a basis for justifying the omission of a containtent system for an advanced reactor plant at a titre when advanced LWRs which might be able to meet the same crite-rien are required te have containments.
i
References:
l cwt Cemission Paper from Victor Stello, Jr., for the Comis-l sioners,
Subject:
V.ey licensing issues associated with DOE spensored advanced reactor designs, dated February 9, 1988 2.
U.S. Nuclear Regulatory Contrission, NUREG-1226. "Development and Utilization of the hRC Policy Statement on the Regulation of i
Advanced Nuclear Power Plants," published June 1988 i
I r
r I
i l
[
l i
t
{
f l
1 l
!