ML20246D697

Commission Response to Pr Sharp Subcommittee on Energy & Power Question 14 for 890315 Hearing

ML20246D697
Person / Time
Issue date:	03/15/1989
From:	Zech L NRC COMMISSION (OCM)
To:	Sharp P HOUSE OF REP., ENERGY & COMMERCE
Shared Package
ML20246D630	List: ML20246D627 ML20246D635 ML20246D646 ML20246D650 ML20246D654 ML20246D660 ML20246D665 ML20246D675 ML20246D678 ML20246D683 ML20246D686 ML20246D689 ML20246D694 ML20246D697 ML20246N988 ML20246N998 ML20246P016 ML20246P029 ML20246P033 ML20246P043 ML20247D807
References
CCS, MARKEY-890315, NUDOCS 8907110399
Download: ML20246D697 (1)

Text

-.-

1. '.,j.

=OUESTION 14 Please explain what mechanisms exist to prevent duplication of effort between DOE and NRC in the advanced reactor area.

ANSWER DOE has requested NRC to perform a safety evaluation on the licensability of certain advanced reactor concepts that are under development.

DOE has provided documentation and information necessary for the review and has kept NRC infonned of progress.

There is no duplication of effort by virtue of the two separate roles of HRC and DOE; nar.ely i(RC's role to independently evaluate the safety of the design and DOE's role to support concept development.

l l'

8907110999 890502 PDR COMMS NRCC CORRESPONDENCE PDC

1 ENCLOSURE TO QUESTION 5 1 of 5 i

o UNITED STATES f

g v

NUCLEAR REGULATORY COMMISSION j

e

(

a 7.

' E WASMkNGTON, D, C. 20065

\\p*"e**

AUG 171998 Mr. Theodore J. Garrish Assistant Secretary for Nuclear Energy U.S. Department of Energy Washington, D.C.

20585

Dear Mr. Garrish:

For approximately the past 18 months we have been reviewing, at the Department's request, three advanced reactor conceptual designs, i.e. a 350 Mwt Modular High Temperature Gas-Cooled Reactor (MNTGR), a 425 Mwt sodium-cooled Power Reactor Inherently Safety Module (PRISM) and a 900 Mwt sodium-cooled Sodium Advanced Fast Reactor (SAFR).

This review is being conducted consistent with the Comission's Advanced Reactor Policy Statement with the purpose of providing preliminary guidance to the Department, early in the design process, on the acceptability of these designs. However, two issues have recently developed for which we need your response in order for us to complete our review.

j The first of these iss'ves is associated with the approach to containment utilized on the above desigr.s. As proposed by the Department, these reactors would be sited at standard commercial reactor sites, even though none of these designs have a containment structure similar to that required on current generation light water reactors and, in the case of the MHTGR, no containment structure. We are aware of the Department's recent decision to recomend, as one of the production reactor concepts, a reactor design which appears to us to be very close to the MHTGR design presented for our review. Our under-standing of this recommendation is that the production reactor would be j

located at the Department's remote Idaho site and would have a containment t

structure associated with it. This appears to us to represent a fundamental difference in approach for the two apparently similar MHTGR designs and raises the questien of whether the Department is abandoning the containment position proposed in the MHTGR, PRISM and SAFR commercial designs. Prior to making a 1

decision on the acceptability of the containment approach proposed for the DOE

]

conceptual designs provided for our review, I would like to understand DOE's l

current position on this issue. Accordingly, I believe that it is essential that you provide the Department's rationale for the contrary views about containment requirements for the two apparently similar MHTGR designs and the implications DOE foresees for the development of comercial advanced reactor designs without containment structures.

The second of these issues was raised by the recently received notification (letter D. Bunch to V. Stello, dated August 15,1988) regarding the Department's selection of the PRISM design over the SAFR design. Since the Department was able to make this decision without fir.al input on licensability prospects from the Comission and the results of our safety evaluation of these designs including

-iD M

L([

l l

l Theodore Garrish 2

the Comission's views on such fundamental issues as containment, we are unclear as to what additional review and guidance is required from the Department on its advanced reactor concepts.

In order for us to plan our future work in this area and respond to your current needs, please clarify what guidance the Department still desires on the three advanced concepts currently under review, how the Department intends to use this guidance and when such guidance is needed.

I would be pleased to meet with you to discuss these issues if you so desire.

Sincerely, W W %-

Victor Stello, Executive Director for Operations Nuclear Regulatory Comission DISTRIBUTION: LETTER TO GARRISH/

AkGIB Subj/ circ /chron Stello Murley Beckjord Speis Morris Ros2toczy King ACRS GPA OGC SECY PDR EDO 3903 0FFC:pli /DRA :DRA:Dir RES D D1 RE. ir.

EDO

sy:BMORRIk :

NAMEl K

CL ORD :VSTELLO DATE:g/D/88

)/l]/88:

8 :

/88 : / /88 :

OFFICI ECORD COPY

ENCLOSURE TO QUESTION 5 1

2 of 5

"*N 83

.4eckjove % - L. y r i

• ct G

Department of Energy cys:Ste11o War,hington, DC 20585 Taylor i

=

Hoyle Mat Taylor Murley SEP 141988 Mr. Victor Stello i

Executive Director I

for Operations l

Nuclear Regulatory Comission j

Washington, DC 20695

Dear Mr. Stello:

This letter is in response to your letter dated August 17, 1988.

We appreciate your coments on ne apparent conflict between the approach to containment for the New Production Reactor (NPR) versus the system proposed for the standardized Modular High Temperature Gas Reactor (MHTGR) that has been under review by the Nuclear Regulatory Commission (NRC). For the reasons set forth below, we believe that these differences can be reconciled.

In any event we request that you issue as soon as possible a i

report that documents the results of the NRC staff reviews to <! ate.

The primary mission of the new production reactor capacity is to produce goal quantities of tritium at the earliest possible date and in an assured, sustained, safe and environmentally and institutionally acceptable way.

Also, it is recognized that the new production reactor capacity will incorporate special target materials and that future missions could include other materials in quantities and core configurations not yet identified.

These conditions represent changes from the civilian MHTGR plant.

Ac such, the inclusion of the containment structure was prescribed by the Department of Energy (DOE)/ Office of Defense Programs as one of the criteria to be used by the program.

In addition, ilo specific safety evaluation by the NRC staff of the MHTGR was in hand.

The MHTGR concept submitted for NRC staff review was intended to be one that would be used as a standardized pre-certified product. Similarly, the application did not prejudge a decisinn to locate the first unit at a remote site.

The MHTGR standardized design is intended to provide a substantial ~

A capability to protect against severe accidents and to be fully consistent with NRC's proposed policies related to advanced reactors.

The passive G

systems are intended to provide optimum protection from a public health and safety standpoint and should be better than a set of active safety systems that comply with NRC requirements. The NRC review of the MHTGR civilian reactor design should be completed based on its own merits against criteria appropriate for civilian nuclear power facilities.

The feedback from the NRC review on this matter will be most important and is needed input for the ongoing preliminary design development effort.

If the NRC present view i

l

-qq W&M q

L

- ---- -- - ~

w"'m----

me,

2 is that special features should be included-in the first, or prototype unit, it would be helpful if the Safety Evaluation Report (SER) dealt separately with that topic.

Accordingly, we urge that the SER be issued as soon as possible.

With regard to the selection of the reference Liquid Metal Reactor (LMR),

we believe that our detailed interactions with NRC staff and the Advisory Committee on Reactor Safeguards over the past 3-1/2 years provided us with sufficient input to complete our selection. Licensability is one of the l

most important DOE criteria for the advanced LMR and, in this regard, the

~

SER's for both Power Reactor Inherently Safe Module (PRISM) and Sodium Advanced Fast Reactor (SAFR) should be completed.

Both SER's are nearly complete and, although the PRISM design was selected, we expect that many SAFR features will be considered in the PRISM design effort.

Continuing interactions with the NRC regarding safety reviews and licensability of the advanced reactor designs are essential to develop end deploy nuclear plants that meet future energy needs in a safe and environmentally acceptable manner.

We appreciate your continuing efforts and look forward to early issuance of the SER's.

4 Sincerely, f

f heodore J. Garrish Assistant Secretary for Nuclear Energy l

l l

I L_____--------------

f

.w ENCLOSURE TO QUESTION 5 Y

3 of 5 l

),,

UNITED STATES

.[

g, NUCLEAR REGULATORY COMMISSION s

p wasmorow. o. c. rosss s

October 3, 1988 MEMORANDUM FOR:

Chairman Zech Commissioner Roberts Commissioner Carr Commissioner Rogers FROM:

Victor Stello, Jr., Executive Director for Operations

SUBJECT:

CONTAINMENT ISSUE FOR THE MHTGR

References:

1._ Ltr. to Theodore J, Garrish, Assistant Secretary for Nuclear Energy, U.S. DOE, from Victor Stello, EDO, U.S.

NRC dtd. August 17, 1988.

2.

Ltr. to Victor Stello, EDO U.S. NRC from Theodore Garrish, Assistant Secretary for Nuclear Energy, U.S. DOE, dtd.

September 16, 1988.

In Reference 1, I asked DOE to provide a ationale for its apparently contradictory views with res new production reactor (NPR)pect to requiring a containment structure for the version of the modular high-temperature on the comercial MHTGR concept provided for our review. g In Reference 2, Mr. Garrish responded that the differences resided in "the incorporation of special target materials and that future missions could include other materials in quantities and core configurations not yet identified."

In reviewing this matter, we have had the benefit of other available DOE Report - DOE /S-0064, " Assessment of Candidate Production Reactor," July 1988, (Enclosure 1) and an August 3,1988 memo from J. Salgado to the Secretary of Energy (Enclosure 2) which recomm MHTGR-NPR, with a containment and located at DOE's Idaho site, be incl the NPR acquisition strategy.

in-depthevaluationofthedifferences(bothpolicyandtechnicalAfter revie of action on the containment question for Comission c between the Consequently, Mr. Beckjord and I plan to meet with Mr. Garrish, Mr. Wade a others from DOE on October 18, 1988 to discuss this matter.

oo63 3g

I _d 1+;,,_

Commissioners 2

Specifically, the items which r.eed further discussion are:

Policy items It appears from the enclosed document that the KPR containment decision was based largely on the following policy considerations which were established long before the NPR reactor technolo selected:

the desire to have enhanced safety, to promote public acceptance, and to contribute to the advancement of nuclear technology by proving a reactor concept that has potential merit in the market place.

Technical items Certain technical considerations also af feet the ne on the NPR versus the commercial MHTGR.

The most significant of thest seem to be:

the use of highly enriched Uranium fuel in the NPR (versus approximately 20% enriched in the commercial MHTGR) and its impact on:

• reactivity coefficients

• fuel performance and integrity, the production and retention of tritium in the NPR, maintaining NPR flexibility for additional missions, and the status of supporting R&D programs.

1 1

f

. O g

Commissioners 3

different approaches'to containment and our conti concept without a containment structure; however,'I believe we need to m MHTGR clearly understand both the policy and technical considerations an in this decision process before we proceed.

matter as further information becomes available.I will keep you informed on this Origi2Cl8 # **

netotstel 4 '

Victor Stello, Jr.

Executive Director for Operations

Enclosures:

1.

DOE Energy Research Advisory Board Report 2.

Memorandum from J. Salgado to Secretary of Energy dtd 8/3/88.

cc:

SECY OGC ACRS DISTRIBUTION:

[TO CHAIRMAN AND COMMISSIONERS]

ARGIB R/F Circ./Chron.

VStello TNurley EDO R/F Note:

l.Rubenstein EBeckjord E003903 9/16/88 DOE ltr includ, TSpets BMorris JTaylor as an attachment.

ZRoszteczy TKing MTaylor JWilson PWilliams i

• See previous concurrences ptFC:ARGlB:DRA* :ARGIB:DRA*:ARGIB:DRA*:DD:DRA NAME: Williams 5y :JWilson

D:DRA e'j

DDy SE5

0:RES -

LW\\

TKing

ZRosztoczy:BMorris

Mis

E5eckjord :. V:Fe

- DATE:9/30/88

9/30/88

9/30/88

/ /88 : M/V /88

,3 /. *, /88

o 4,,/88

v /?r&5 0FFICIAL RECORD COPY

]y F

l

f

1. g.2 ENCLOSURE OF QUESTION 5 iw UNITED 5TAHS 4 of 5 Oi NUCLEAR REGULATORY COMMISSION t

s i

WASHING TON, D. C. 20665

"%,,,,, /

OCT 151G88 4

MEMORANDUM FOR: Chairman Zech Commissioner Roberts Commissioner Carr Commissioner Rogers Commissioner Curtiss FROM:

Victor Stello, Jr., Executive Director for Operations

SUBJECT:

HEETING WITH DOE ON MHTGR CD(TAINMENT In my October 3,1988 memorandum to you on the Modular High Temperature Gas-Cooled Reactor (MHTGR) containment issue I indicated that Mr. Beckjord and 1

I were planning to meeting with representatives from DOE to discuss the apparently contradictory position taken by the Department on containment for two very similar desi version of the MHTGR)gns (the commercial MHTGR and the production reactor We ha'd the subject meeting on October 18, 1988 and the key points and action items are sumarized below:

1)

It was clear that the decision to put a containment on the new production reactor (NPR) version of the MHTGR was based upon policy considerations.

In fact, the NPR containment decision was made prior to DOE's technical evaluation of the candidate technologies and irrespective of the remote site location.

2)

If, in the future, the NPR-MHTGR designers were to make a case on technical grounds for no containment, it is very unlikely that DOE Defense Programs would seriously consider it.

3)

It is 'not clear that the technical differences between the two MHTG concepts are sufficient to support the differing positions on containment.

No DOE technical evaluation was available or planned, beyond that provided in Mr. Garrish's September 16, 1988 letter, to document the rationale for the differing positions.

I requested that DOE prepare such an evaluation, but it is not clear that they will.

Fr. D. Bunch of DOE indicated he will call me in 2-3 weeks with their plans in this area.

{

In summary, I believe that we should not take action on the MHTGR containment question until we fully understand and have documented the Department's rationale for their differing positions.

in a position of having to explain the difference.I do not want to put the Comission If and when such a A Y U'>T].bO VI L (7('

E t

L' Memo to Chairman 2ech

.. rationale is provided, we can resume action on the containment que containment question or indicate to DOE that If MHTGR should have a containment until sufficient testing and ope experience is gained to justify its removal.

I will keep you informed of DOE's response,

"' ** . 3 t. ;;. a d

5. e:. 3.m f DiNtor Stello, Jr.

Executive Director for Operations cc: OGC SECY DISTRIUBTION:

Circ /Chron ARGIG Rdg.

ACRS Hurray Beckjord Morris Speis Rosztoczy King Wilson Williams VStello JTaylor JHoyle EDO r/f l

1

[ MEMO TO CHAIRF.AN 2ECH)f O WW D

5FFC:RESIAMIB

RES:D '

E00l'\\

NAME:l#1(gYpsA :

DATE: d/ u'/88 EBeckjoro :VSteAlo

f/1/ v /88 :/s N /88 :

OfflCIKL RECORD COPY

I l

+,.

e n

ENCLOSURE TO QUESTION 5 f.

m 5 of 5

/pwc h l' 3 i

UNITED STATES NUCLEAR REGULATORY COMMISSION wAswsworow. o. c. rosss t

r p

i.

NOV 1 41983 I

1 i

MEMORANDUM FOR:

i'ictor Stello, Jr.

Executive Director for Operations 4

FROM:

Eric S. Beckjt.,rd, Director Office of lluelear Regulatory Research

SUBJECT:

DOE HTGR SER I spoke with Del Bunch this morning.

agreement on DOE's position on this subject by 11/15.He said that he expects probably on Tuesday.

He will call you, He made several points in our discussion:

1.

Decay Heat Removal System can be improved.

2.

Containment can be improved.

3.

Emergency Core Cooling appears susceptible to several faults.

4 Adequacy of local core cooling 19 emergency could be improved; consideration is being given te provision of forced cooling in event that natural circulation is not adequate.

Del expects that these matters will be resolved in engineering terms by June, 1989.

staff SER report for their use.Meanwhile he would very much like for DOE to hav to resolving the containment question and the other po in SECY-88-203, by issuing the staff's SER as a draft for comment.

this we would be careful to remove from the SER any words that draw a finalIn doin conclusion on these policy matters and replace them with words that make it clear these matters are still under consideration 6nd that other vie being solicited.

In fact, this would be a good way to obtain broader feedback briefing to the Commission on SECY-88-203 on August 9,19 It would also get the documentation of the more detailed results of our review (at least in draft form) into the public record, which DOE has indicated would be of use to them.

j i

)

mtwLQ i

(

s..

4 p

N0Y 8 4 Iggg Victor Stello, Jr.

F At a later date, after coments are received and after DOE.has resp our questions on the NPR containment, the Commission could resum on the policy matters and we could finalize the SER.

b.

review and revise the MHTGR SER, as approp If it is decided to T.

J Eric S. Beckjord, 1 rector Office of Nuclear egulatory Research cc:

T. P. Speis D. F. Ross B. H. Morris T. King DISTRIBUTION:

o Circ /Chron/Subj ESBeckjord 1.

I l

RES:DIR ESBeckjord:saf 11/ /88 1

l l

/

ENCLOSURE TO QUESTION 6

~'

Attachment A 0

^

l mamm.

!mAtep j-o UNITED STATES NUCLEAR REGULATORY COMMISSION L-n 5

i ADVISORY COMMITTEE ON REACTOR SAFEGUARDS i

/

wAswiworon o, c.2osas October 13, 1988 j

H i

i l

The Honorable Lando U. Zech, Jr.

)

Chairman U.S. Nuclear Regulatory Commission i

Washington, D.C.

20555 i

{

SUBJECT:

PREAPPLICATION SAFETY EVALUATION REPORT FOR THE MODUL TEMPERATURE CAS COOLED REACTOR Introduction During the 342nd meeting of the Advisory Committee on Reactor Safe-guards, October 6-7, 1988, and in previous meetings of the Committee and our Subcommittee on Advanced Reactor Designs, we reviewed a draft of the subject Safety Eveluation Report (SER).

During these meetings, we had the benefit of discussions with representatives of the NRC staff and its consultants, with representatives of the Department of Energy (00E), and representatives of General Atomics, the chief design contracter for the Modular High Temperature Gas Cooled Reactor (MHTGR).

We also had the benefit of the documents referenced.

The MHTGP. concept is a product cf a icint DOE / industry program to develop a design for a nuclear power plant using HTGR technology and having important inherently safe characteristics.

The NRC staff is reviewing the concept under the advanc'd reactor policy to help assure that the final design will develop alen, lines acceptable to the NRC.

The draft SER indicates that the staff believes the conceptual design is generally satisfactory and that work directed 6., erd eietal :ert:.'ica-I tion should continue.

The staff has provided a number of conditions

)

along with this endorsement and also believes that a continuing program of research and development will be necessary to support final design and eventual licensing.

We are in general agreement that design and development should continue along the lines cutlined by the NRC staff.

We can agree to moving forward, however, only because we understand that an NRC endorsement at this time does not imply a final comitment either to the general design or to its details. We believe that ongoing research and development can resolve important safety issues before licensing.

We have a number of comments discussed below about the design.

U N [v[oo t

y' t

q The Honorable Lando W. Zech, Jr. October 13, 1988 Key Features of the MHTGR The MHTGR differs in. important ways from existing light water reactor (LWR) plants. and from previous gas cooled reactor plants, including j

s several new safety characteristics.

The goal of the designers is that the improved safety features will more than make up for the absence of others (e.g., containment).

They believe the MHTGR design will provide a plant that is safer than LWRs.

Safety of the MHTGR is keyed to properties of its unique fuel particles.

Millions of these microspheres of enriched uranium oxycarbide, each the size of a grain.of sand, are in the reactor core. Each fuel particle is coated with four successive protective shells that includes a buffer it.yer of a porous carbon and then bonded with others into a fuel rod which is, in turn, sealed in vertical holes in graphite blocks.

These graphite blocks provide neutron moderation and are the chief structural material in the core.

The maximum fuel particle temperature in normal operation will be about 1150*C.

6 expected very small fraction of defective particles will cause a measurable, but acceptably low, level of chronic fission-product activity in the coolant and reactor systems.

So long as the particles are maintained below 1600*C, fuel, transur-I anics, and fission products will be retained by the particle coatings, with very high efficiency. At temperatures above about 2000*C, failures of particle coating will become significant, and above about 2300*C the 3

(

coatings will fail completely. All other safety features of the reactor j

systems are designed to assure that particles will remain below 1600'C over a wide range of challenges and circumstances.

j It is expected that temperatures can be maintained below 1600*C, in any conceivable reactor transient, because of two favorable characteristics of the reactor cere:

(1) Strong negative reactivity changes with increased temperatures in fuel or moderator and (2) Large thermal inertia of the core and fuel structure, i

i It is also expected that temperatures will be maintained below 1600'C even with loss of normal decay heat removal because of the following important features:

(1) The same strong temperature-reactivity effects will assure a very low equilibrium' power even with failure of reactivity control and i

shutdown systems.

(2) At these low or decay power levels, if nomal heat transfer systems fail, all heat can be removed from the reactor by a passive heat transfer system that permits atmospheric air to flow by natural i

w..

uT,-

L L

f:

The Monorable Lando W. Zech, Jr. October 13, 1988 l

convection through a cavity surrounding the reactor vessel.

Under these conditions, the reactor core and the vessel will attain h

temperatures only slightly above their normal operating values.

-(3)

If this passive heat removal system should become unavailable (e.g.. by blockage of air flow), heat at low power or at decay heat levels would be transferred from the reactor cavity by conduction directly to the' earth surrounding the reactor building.

Under these conditions, fuel would remain below 1600*C, but the reactor vessel would eventually heat te well beyond its normal operating temperature.

Whether the reactor could be returned to normal operation after exposure of the vessel to such overtemperature is problematic at the present time.

But, the vessel would remain sufficiently intact for the safe removal of decay heat.

The passive heat transfer functions in items (2) and (3) above require that.the reactor core and vessel be small enough so that heat transfer can be accomplished without core temperatures becoming excessive.

This dictates the reactor size and leads to the modular design and the long, small-diarieter core.

The reactor core is normally cooled by inert helium gas circulated through the core at high pressure.

Certain improbable failures of the reactor vessel could permit air to enter the core.

However, air flow through the core by natural convection would be at a very low rate.

With this restricted supply of oxygen, oxidation of graphite would be so slow that af ter many hours only a small fraction of the graphite would be consumed and the core would remain structurally intact.

Even'if the graphite should burn, through some undetermined mechanism, the indica-tions are that the graphite temperature would be well below the 1600*C i

critical temperature for the fuel particles. The combination of nuclear decay and combustion heat would not be expected to increase core tem-perature to greater than 1600'C.

The Safety Issues The challenge in assuring that the key safety characteristics claimed for the MHTGR design are realized in an actual plant is, in simplest terms, in assuring that the following icsues are adequately addressed:

(1) Fuel particles must have the retention capabilities attributed to them and this must be assured with recognition of inevitable variability and im in the fuel particles and their compaction process. perfection This will require a higher level of quality in manufacture than has been achieved and must be experimentally verified.

i

+

/. ".

g,;

c The Honorable Lando W. Zech, Jr. October 13, 1988 L

(2) The reactivity and. temperature-reactivity characteristics used in safety analyses are based on limited data.

Further verification of g

these-characteristics as a function of fuel burnup, core shuff1tng, and a variety of operational transients is needed.

(3)

Inadvertent ingress of water or steem into the core must be pre-cluded with.high reliability.. Water or steam could cause carrosion l

and mechanical damage to the graphite and would also add a positive

' reactivity contribution.

This seems to be a possible complication l'

of, for example, steam generator tube failures that is not present in LWRs.

Internal floodin L

lead to similar problems. g of the underground reactor cavity cculd (a) There must be assurance that decay and low-power heat transfer can

.be accomplished without causing excessively high core temperatures.

Performance of the passive atmospheric cooling system and the ability to ccnduct heat to the surrounding earth must be demon-L strated.

(5) The structural properties of the graphite must be demonstrated and assured.

(6) Some of the important safety benefits of the design (e.g., passive decay heat removal and resistance to graphite burning) depend upon o

the core geometry remaining unperturbed.

Questions of seismic resistance, effects of aging, and the possible cascading effects of certain reactor accidents remain to be fully answered.

A major issue is whether a conventional containment structure or some other mitigation system or process should be required.

Neither the designers, the NRC staff, nor the members of the ACRS have been able to postulate accident scenarios of reasonable credibility, for which an additional physical barrier to release of fission products is required in order to provide adequate protection to the public.

This does not mean that a conventional containment should not be provided or required as further defense in depth against unforeseen and unforeseeable events.

However, it does mean that the design basis for a containment would have to be arbitrary, not altogether unlike what was done in the early days for LWRs.

We believe that the decision to require a containment will have to be made on the basis of technical judgment, with appropriate o

consideration of the effects on other technically based safety features i

now a part of the design.

In addition, there may be safety and economic tradeoffs between provision for containment and provision for passive decay heat removal.

.h.

x ;-

p y.

I The Honorable Lando W. Zech, Jr. October 13, 1988

. Recommendations

. A substantial program of research and development must be continued to support the final design for the MHTGR.

This program should concentrate on providing assurances relative to the safety issues we have discussed above.

General Atomics has generated extensive data on fuel perfomance, but a comprehensive program on the reference fuel appears to be needed.

This would include testing of irradiated fuel, fuel from large-scale man-ufacturing, and. fuel exposed to a variety of environmental conditions and temperatures such as might be encountered in possible accidents.

A hot critical experiment may be necessary.

The core is of an unusual geometry and has nuclear characteristics different from those in previ-ous HTGRs.

Assuring that the safety response of the plant is as pre-dicted will require comprehensive information on the reactivity charac-teristics of the core over a broad range of normal and accident con-ditions.

More extensive analysis is needed of the response of the plant to accidents that might change the core geometry. Certain accident scenar-ios can be hypothesized that would affect core geometry and influence coolant distribution and reactivity characteristics.

A prototype should be built and appropriately tested before design certification.

Concepts for a containment or another sort of physical mitigation system require further study.

Finally, there are two issues identified in our letter to you dated July 20, 1988, " Report on Key Licensing Issues Associated With DOE Sponsored Reactor Designs," that we believe should be given early consideration as the design of this plant progresses. These issues are related to design for (1) resistance to sabotage and (2) operation and staffing.

The appropriate excerpts from that letter are attached.

Additional connents by ACRS Members Forrest J. Remick and Charles J.

Wylie, and William Kerr are presented below.

Sincerely, William Kerr Chaiman

.l.

N i

The Honorable Lando W. Zech, Jr. October 13, 1988 i

Additional Comments by ACRS Members Forrest J. Remick and Charles J.

Wylie In general, we agree with our colleagues in the above letter.. However, we. cannot in good conscience recommend a design of a nuclear power plant for design certification which does not have a conventional containment or other mitigation system which would serve as a more robust external barrier than is currently proposed. to protect the public from radio-logical releases.

The designers of the NHTGR deserve much credit ' for their effort to incorporate inherent and passive safety features in the design concept.

However, even though we believe that potential for providing enhanced safety, experience has shown that n reactor designs have technical unknowns.

Because of the possible technical unknowns, the known uncertainties associated with the pos-tulated inherent and passive safety features and the lack of experience with operation of a reacter of this new design, we do not these reactors for design certification without a more extensive ex-recommend ternal barrier consisting either of a conventional containment structure or other appropriate mitigation system.

We think it important that the ACRS and the Commission make this techni-cal judgment at this time in order that the designers of this promising reactor concept have ample opportunity to thoroughly consider alternate designs.

Additional Comments by ACRS Member William Kerr I remind the Commission of the comments on containment included in Committee's letter of July 20, 1988, namely:

"We are not prepared at the present time to accept these approaches to defense in depth as being completely adequate.

~

Further, we are not prepared at this time to accept the arguments that increased prevention of core melt or increased retention capacity of the fuel provide adequate defense in depth to justify the elimination of the need for conventional containment structures.

This is not to say that we ceuld not decide otherwise in the future, in response to an unusually l

l persuasive argument."

That is still my position on the containment issue.

that I have not yet heard the " persuasive argument."

I would add only l

-_______m_.t_____m__

-_.--___.i_____.____-

D-

=

w,

'The Honorable Lando W. Zech, Jr. October 13, 1988

References:

1.

Office.of Nuclear Regulatory Research, " Pre-Application Safety Evaluatien Report for the Modular High Temperature -Gas Cooled Reactor,"datedAugust1988(PredecisionalDraft) 2.

Stone Webster Engineering Corporation (DOE Contract).

HTGR-86-024, "HTGR Preliminary Safety Information Document for the Standard itHTGR," Volumes 1-5, 1986 3.

GA Technologies, Inc.

(DOE Contract),

DOE-HTGR-86-011, "HTGR Probabilistic Risk Assessment for the Standard Modular High Temperature Gas-Cooled Reactor," Volumes 1-2, January 1987

Attachment:

Excerpts frem July 20, 1988 ACRS Letter, " Report on Key Licensing issues Associated With DOE Sponsored Reactor Designs" I

i f

ufj.i;n y,.

? m+..

h ff r

p r<

4 ATTACH 6ENT TO 'ACRS LETTER ~ ON MODULAR HIGH TEMPE GAS COOLED REACTOR.

Excerpt from July 20, 1988 ACRS Letter, " Report on Key Licensing Issues' Associated With DOE 5ponsored Reactor Designs" 4

. Design for resistance to sabotace It is~ often stated that significant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the -

design process. :Unfortunately, this has not been done consistently because the NRC.has developed no guidance or requirements specific for plant design: features, and there seems to have been no systematic attempt by the industry to fill the resulting vacuum. We believe the NRC can and should develop some guidance for designers of advanced reactors.

It.is probably unwise and counterproductive to specify highly detailed requirements, as'those for present physical security systems, but an attempt should be made to develop some general guidance.

Operation' and staffing -

Little-is said in the staff paper about requirements for operation and

. staffing of advanced reactors.

We find this to be a serious over-

. sight.- Experience with LWRs has shown that issues of operation and staffing are probably more important in protecting public health and safety than are issues of design and construction.

The designers of the three reactor proposals seem to be claiming that the designs are so inherently stable and error-resistant. that the questions of opera-tion and staffing, so important for LWRs, are' unimportant for the advanced reactors.

And that in fact, the advanced plants can be operated with only a very sma,ll staff. We believe these claims are unproven and that more evidence is required before they can be ac-cepted.

The two major accidents that have been experienced in nuclear power, those at TMI-2 and Chernobyl 4, were caused, in large measure, by human error.

These were not simple " operator errors" but instead were i

caused by deliberate, but wrong, actions.

There are some indications that the advanced reactor designs being considered have certain characteristics tending to make them less vulnerable to such mal-E operation.

But, this has not been demonstrated in any systematic way.

L The traditional methods of PRA are not capable of such analyses; but,

?

we believe a systematic evaluation should be made. There seems little merit in making claims for the improved safety of new reactor designs if they have not been evaluated against the actual causes of the most important reactor accidents in our experience.

L p

i

I~

,[-

ENCLOSURE TO QUESTION 6 a ' ;;'

.fg,,

Attachment B A

UNITED STATES NUCLEAR REGULATORY COMMISSION

{

,i ADVISORY COMMITTEE ON REACTOA SAFEGUARDS 0,

a WA$HINGTON, D. C. 20655

%... f July 20, 1988 The Honorable Lando W. Zech, Jr.

Chairman U.S. Nuclear Regulatory Commission Washington, D.C.

20555 Lear Chairman Zech:

SUBJECT:

REPCRT ON KEY LICENSING ISSL'ES ASSOCIATED WITH DO REACTOR DESIGt;S During the 339th meeting of the Advisory Committee on Reactor Safe-guards, July 14-16, 1988, we met with members of the NRC Staff and the Department of Energy (DOE) Staff and reviewed a draft Commission Paper on " Key Licensing Issues Associated with DOE Sponsored Reactor De-signs," dated February 9, 1988.

This subject was also considered during cur 334th, 335th, 336th, and 337th meetings on February 11-13, 1988; March 10-12,1988; April 7-9,1988; and May 5-7, 1988, respec-tively.

Our Subcommittee en Advanced Reactor Designs met on January 6,

1988 to discuss this matter.

documents referenced to this letter. We also had the benefit of the The Commission, in a letter dated July 9,1987, instructed the staff to develop such a key-issues paper in advance of projected safety evaluation reports on each of the three conceptual designs being proposed by UOE and its contractors.

The Comittee elieves this was a wise decision; it is appropriate to confront and attempt to resolve the most important safety and licensing issues in a general and direct way, rather than only by reacting to design nrnnnsals.

in W

'M-irie an6 Storf has undertaken an important and difficult task.

It can be viewed as an attempt to create, from the top down, a comprehensive rationale for licensing requirements.

This would be very different from the existing body of regulations for light water reactors (LWRs),

which has grown an element at a time in a more reactive and pragmatic fashion.

The nation has more than thirty years of experience in the development and realization of practical nuclear power.

The DOE sponsored de-signers have made use of this experience and of associated research i

/

W Wu Lu % 4 c,y

f 1. ^,., '

'4

-y e

The Hencrable Lar.do W. Zech, Jr. July 20, 1988 and analytical development to create three conceptual designs which they believe offer significant advantages over existing LWR plants.

Similcrly, the NRC should take advantage of experience in the regu-lation ar.d safety analysis of plants to create an improved approach to the specification of safety requirements.

In doing this, care must be taken that regulatory requirements do not unnecessarily frustrate the dr;velopment of advanced reactors.

The regulations should permit the application of innovative reactor concepts while protecting the health and safety.of the public.

We believe this can be done, but additional effort on the part of the Commissioners ' and the NRC Staff will be required.

the jcb right than to do it soct. False urgency should be evcided; it is n The staff. effort so f ar has been thcughtful and productive, and pro-sides appropriate preliminary guidance.

issues as a basis for review of the design propesals:They have identified four Accident selection Siting source term selection and use 1

Aceciuacy of containment systems Adeqtacy of off-site emerger.cy planning.

i We believe these are important issues, but they do not adequately encen. pass the fril set of concerns.

We comment below on these issues i

and then discuss severel additional issues that we believe are also important ano oeserve further development.

We suggest that the staff's key-issues paper be regarded as preliminary guidance and that a continuing program of development and dialogue is necessary before criteria are considerec final.

j ACCIDENT SELECTION The staff has prcposed four event categories for selection of design basis events based on estimates of the probability of events that i

might challer.pe a given system and on past practice and engineering judgment.

1 For the second of these event categories (EC-II), the staff would require that there be tolerance for single failures, that only safety-grade systems should be credited in meeting the event challenge, and that reactor plant systems should continue to operate normally in response to the challenge.

1 but requires two caveats:

We believe this general approach is sound, l

H w

)

6

.' ~

The Honorable Lande W. Zech, Jr. July 20, 1988

• Credit for performance of ncnsafety grade equipment in this class

(

of events should be permitted when this can be justified.

l Desigr.ation of a component or system as safety grade is intended to ensure it has certain specific attributes.

Among these are the ability to resist certain seismic events, ability to function within certain harsh environments, and a high level of reliabil-i ity (supposedly guaranteed by a quality assurance program).

l Fot.

1 all postulated : initiating events are challenges to all of these ettributes.

Selectivity should.be permitted when sufficient information is available about the nature of the design basis event.

• ke agree there should not be complete dependence on probabilistic arguments. Although est4raates of prctability are a proper first-cut apprcath to the definition cf event categories, uncertainty in these esticates is large.

Judgrrents are needed about whether l

ano how to include as design criterie the capability to acccmmo-j date phenomena and secuences that are not specifically indicated

{

te be necessary by probabilistic estimates.

1 C0hTAl WENT SYSTEM _S i

Con:cirment structures c early are intenced to restrict release to the environn.ent of radioteth e materials resulting from a severe accident.

For LWRs, altF0 ugh the ossion bases for containments have included a source term related to severe accidents, the design pressures and temperatures have bEen those related to a large-break.LOCA rather than those resulting from an accident involving severe core damage.

Whether this seerringly inccr.sistent but pragmatic approach has served th r.uclear pcwer enterprise well can be debated.

On the one hand, some of the severe accident issues facing the NRC and the industry i

today are a legacy ct that approach.

On the other hand, such a containment performed very well in the TMI-2 accident.

Research over the prst few years indicates thLt most existing containments would be reasonably effective ia reducing :;he consequences of severe accidents.

3 j

The staff proposal fcr severe accident and containment requirements I

j for advanced reactors seems to be taking a different, but not neces-sarily better approach, than that used for LWRs.

Their contention is that, if the early lines of defense, namely:

- prevention of challenges to protection systems, and

- prevention of core damage by protection systems i

I l

l

A '. ;

'l The Horerable Lanoo W. Zech, Jr. July 20, 1988

)

are effective encugh, then the next two lines of defense, namely:

- a conventional containment structure, and

{

- an emergency plan for the area around the site, are not necessary.

L The so-called prevention and protection attributes of the three designs being proposed by DOE and its contractors are indeed im-pressive... The modular high temperature gas cooled reactor (MHTGR) has oc. conventional containment s tructt.re, but relies instead on the capacity cf its unique fuel particles to retain fissicn products, even at abnormally high temperatures, with high reliability.

The two ligeid metal reactor (LMR) designs have containers around the reactor vessels, but these have low volume and pressure capacity.

It is unclear how they would accommodate a challenge greater than minor leakage cf sodium coolant.

Accidents can be postulateo that would challenge the defense-in-depth concepts being advar.ced.

For the LMRs, a contemporaneous. failure of the guard vessel and the reactor vessel, coupled with a sodium fire, would seen: to lead to severe consequences.

For the MHTGR, a fire in the grapnite moderator, perhaps perniitted by massive failures of the reactor sessel and core support, might also have severe consequences.

Whether these or other accidents could be effectively mitigated by a containment enclosure, or a filtered vent, has not been determined.

We note that in all three designs, absence of containment helps to make feasible one of the major safety advantages, passive systems for removing decay heat.

In each case, the reactor vessel surroundings are designed so that air from outside the plant will flow by natural buoyancy through the reactor vessel cavity and thereby remove decay heat.

This seems to be a highly effective heat transfer treans if the reactor vessel ar.o core are intact.

If they are not, tnis ready supply of oxygen and access to the environment might be a problem.

This seems to be a major safety trade-off.

We are not prepared at the present time to accept these approaches to defense in depth as being completely adequate.

Further, we are not prepared at this time to accept the arguments that increased preven-tion of core melt or increased retention capacity of the fuel provide adequate defense in depth to justify the elimination of the need for i

conventional containment structures.

This is not to say that we could not decide otherwise in the future, in response to an unusually persuasive argument.

i

g=~

gj QiY

? W,}

~

The Honorable Lando W. Zech, Jr. July 20, 1988 1

EMERGENCY PLANNING We agree with the present approach of the staff's proposal.

However, we.believe that emergency' planning should be reexamined in an effort to describe.an approach that would be applicable to' all types of-reactors.

ADb1TIONAL ISSl'ES Few safe should these. plants'be?-

We believe the debate about how safe is safe enough is concluded. The safety goal policy'is. in place.

That should stand as the definition of huw safe these advanced. reactors, as well as future LWRs, should be.

There are, of course, matters of interpretation and implementa-tion with regard to safety goal policy.

These need to be dealt with for. all types of reacter. plant designs.

The focus of licensing and regulation for. advanced reactors should be consistent with the safety goal. policy; no more, no less, no enhancements, no compromises.

- The-Advanced Reacter Policy states that advanced reactors must be at least as safe as the current generation of LWRs.

The staff interprets

-this to mean the " evolutionary" generation of LWRs now being reviewed by the NRC for preliminary desigr certification.

We believe the Advanced Reactor Policy requires no more than, and should require no morr. than, the level of safety called for in the safety goal pclicy.

Reactor developers, i.e., 00E and the industry, ucy seek a design that is safer than the safety goal would suggest as necessary, 'or whose safety is more readily apparent to the public.

Those are not unreasonable goals for a developer in seeking public acceptance or more economic operation.

However, it seems to us inappropriate for the NRC to ratchet on the standard of safety it has established as necessary and sufficient, l'

To what extent should regulatory requirements accommodate public perception?

The draft paper states that the staff has incorporated only technical considerations in the development of its proposed positions.

In particular, they have not attempted to accommodate external factors, such as public perception.

We applevd this restraint. And we counsel the Commission to keep safety regulations unambiguously related to protection of the public health and safety.

a The Henorable Lardo W. Zech, Jr. July 20, 1988 i

Extra cacacity in decay heat remeval and scram systems The three DOE designs provide much more capacity in decay heat removal and scram systems than are provided in present LWRs.

While these important systems in LWRs must be tolerant of single failures, the advanced reactors go well beyond that.

The reason for this is the intent to build more robustness into the first two layers of defense in depth and thus permit less in the last two layers, containment and emergency planning.

Two independent scram systems are provided in two of the three pro-posec cesigns.

Each system is somewhat diverse in design and toler-ant, within itself, of single failure.

All have multiple systems for decay beat removal. three design proposals In addition to being diverse and resistant to single failure, the extra systems have inherent passive attributes.

They apparently will function effec-tively withcut motive pewer or operator intervention.

However, a caution is necessary.

Experience in operation and analysis has inoicated that redundancy, i.e., extra systems or components, is net as powerful in improving reliability as might be expected.

Too often the r.ature of initiating challenges, or of the ccmplex sequence i

of events in accidents, seems to cause the extra parts of a system to be faulted alcng with the main system. The diverse and passive nature of the three designs being ccnsidered might ameliorate such unwanted j

interdr. pendency, but further study is warranted.

In addition, while the three proposed designs have these positive features, it is not i

clear that the NRC's proposed requirements would provide assurance i

that these desirable diverse and passive attributes would be guaren-teed.

Meed for prototypina i

The staff proprses only modest requirements for prototype testing of the advanced reactor designs.

Although, they have recently added a proposed requirement that any designs not incorporating a containment must be tested in prototype at a remote site, we question whether this is enough to carry the process to a point at which the NRC would be willing to license an unlimited number of new power plants.

For example, the metallic LMR cores are claimed to have very favorable, inherently stable characteristics in responding to possible tran-sients.

These characteristics were not well understood a decade ago.

i An excellent experimental and analytical program by ANL with the EBR-II reactor at INEL has effectively demonstrated that the EBR-II system does exhibit such inherently stable and predictable behavior.

However, it is not yet clear that such characteristics can be assured I

l fo

+

.. 3 The Fenorable Lando W. Zech, Jr. July 20, 1988 for the larger and different & Rs to be used in comercial electric power ~ prcduction.

We believe that a more and extensive series of prototype tests will be necessary before design certification could be granted.

Use of cost-benefit analysis

The staff paper proposes that prospective licensees should be required to demcestrate through cost-benefit analysis that design features alternative to those being proposed are not warranted.

Presumably, the NF.C staff would review such analyses and perhaps suggest alterna-tives.

We believe this is an unworkable and unnecessary strategy.

The NRC shculd concentrate its efforts on specifying design require.

tents that Will result in plants that are in conformance with the.

safety goal.

Consideration of alternatives and costs is prcperly a function of the designer ano owner of a plant.

The NRC should have enough confidence in its safety gcal that it does not feel the need for the proposed approach.

Design for resistance to sabotaae It is often stated that significant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the design process.

Unfortunately, this has not been done consistently because the NRC has dtveloped no guidance or requirements specific for plant design features, and there seens to have been no systematic attempt by the industry to fill the resulting vacuum. We believe the hFC can and shculd develop some guidance for designers of advanced reactors.

It is probably unwise and counterproductive to specify highly detailed requirements, as those for present physical security systems, but er r.ttempt should be made te develop some general guidance.

Operation and staffire

{

Little is said in the staff paper about requirements for operation and staffing af advanced reactors.

We find this to be a serious over-sight.

Experience with LWRs has shown that issues of operation and staffing are prcbably more important in protecting public health and safety than are issues of design and construction.

The designers of the three reactor proposals seem to be claiming that the designs are so inherently stable and error-resistant that the questions of cpera-tion and staffing, so important for LWRs, are unimportant for the advanced reactors.

And that in fact, the advanced plants can be operated with only a very sma,ll staff.

We believe these claims are unproven and that more evidence is required before they can be ac-

cepted,

,,y',-

The Honorable Lando W.-Zech, Jr. July 20, 1988 The'two major accidents that have been experienced in nuclear power, those at TM1-2 and Chernobyl 4, were caused, in large measure, by human error.

These were not simple " operator errors" but instead were caused by deliberate, but wrong, actions.

There are some indications that the advanced reactor designs being considered have certain characteristics tending to make

'. hem less vulnerable to such mal-operction.

But, this has not been demonstrated in any systematic way.

The traditional methods of pRA are not capable of such analyses; but, we believe a systematic evaluation should be made.

There seems little merit in making claims for the improved safety of new reactor designs if they have not been evaluated against the actual causes of the most importent reactor accidents in our experience.

Wili reculatory criteria evolve?

The Staff prcpesal provides for a design-review-licensing process at which the NFC will step back andfu make sure that the agreements reached early in the process are still valid, given possible new information and understandings.

We believe this is wise and necessary, although it does place a potential licen-see at some risk.

It should be recognized that this milestone activ-ity might have to include the possibility of changes in the actual requirements, as well es interpretations of requirements.

Focus on the most important residual uncertainties Although the staff paper discusses uncertainties relative to the development of requirements and designs, it should provide a clearer statement of what the staff believes to be the most important of these.

This would assist policymakers in making judgments about the designs and requirements and, perhaps, about whether certain avenues of research should be further pursued before or licensing.

in parallel with Additional coments by ACRS Member Carlyle Michelson are presented below.

1 Sincerely, l

Willliam Kerr Chairman Additional Comments by ACRS Member Carlyle Michelsen

't is not clear to me that the safety goal in its present form was intended to apply to advanced reactors which do not have conventional i

u____-__

4,,

g. 7,,)

The Honorable Lar.do W..Zech, Jr. July 20..1988 containment 1 systems.

The guidelines for regulatory implementation might. have been different if. the Commission had considered that the defense-in-depth approach might not future plants.

include a containment system on It would be unfortunate if the frequency of large release. criterion suggested in the present guidelines.is used as a basis f:,r justifying the omission of a containment system for an advanced reactor plant at a time when advanced LWRs which might be 6ble to meet the same crite-rien are required te have containments.

References:

1.

Draf t Commission Paper from Victor Stello, Jr., for the Commis-sioners,

Subject:

Key licensing issues associated with DOE sper,sored advarced reactor designs, dated February 9, 1988 2.

U.S. feuclear Reculatory Commission,. NUREG-1226

" Development and Utilization of the NRC Policy Statement on the Regulation of Advanced Nuclear Power Plants," published June 1988 i

1

~

.c ENCLOSURE TO QUESTION 9 Norri s Attachment A 8

jg

'o,,

UNITED $TATES H cf.ar NUCLEAR REGULATORY COMMISSION Rfani n

3 I

ADVISORY COMMITTEE ON REACTOR SAFEGUARDS

1. 1 *

/[

0,,

W ASHINGTON, D. C. 20665 e

L pt November 22, 1988 The Honorable Lando W. Zech, Jr.

. Chairman U.S. Nuclear Regulatory Comission Washington, D.C.

20555

SUBJECT:

SAFETY EVALUATION REPORT FOR THE " POWER REACTOR IN SAFE MODULE" (PRISM) DESIGN During the 343rd meeting of the Advisory Comittee on Reactor Safe-guards, November 17-18, 1988, we reviewed a draf t of the subject safety evaluation report (SER).

The ACRS and its Subcommittee on Advanced Reactor Designs have reviewed these matters in previous meetings.

During these meetings we had the benefit of discussions with representa-tives of the NRC staff and its consultants, and with representatives of the Department of Energy (DOE) and its contractors, including represen-tatives of the General Electric Company, the lead design contractor.

We also had the benefit of the documents referenced.

The PRISM conceptual design is a product of a DOE program to develop designs for possible future power. reactor systems that would have 1

enhanced safety characteristics.

Other design projects in the program the Modular High Temperature Gas-Cooled Reactor (MHTGR) and the are Sodium Advanced Fast Reactor (SAFR).

The NRC staff is reviewing these designs in accordance with the Comission policy on Advanced Nuclear Power Plants.

These preapplication reviews are intended to provide NRC guidance on licensing issues at a relatively early stage of design development.

The ACRS has previously comented to you on NUREG-1226,

" Development end Utilinon of the C" "clicy ~detement on the Regula-tion of Advanced Nuclear Power Plants," in June 1987, on key licensing issues essociated with the entire program in July 1988, and cn the SER l

for the MHTGR in October 1988.

We understand that issuance of the SER will not constitute approval of the PRISM design.

Further engineering development and documentation will be required to support a future application for design certifica-tion.

The PRISH design incorporates several small, modular reactors cooled by liquid sodium.

The standard PRISM plant would consist of nine reactor modules, each generating 425 MWt, providing a total plant output of 1245

$ 1 n l & s g>

1

-~

t

(

y,1

• .f i

E

,4 The Honorable Lando W. Zech, Jr...

November 22, 1988 MWe.. Each reactor, along with its intermediate heat exchangers and pumps, is inmersed in a pool of sodium.

A steel vessel containing this pool is located within a secondary steel container.

The steel con-tainers share -a common head.

Each such unit is installed within an underground concrete silo.

Secondary sodium coolant flows. to steam

. generators which are also located below grade, but are outside the silo 3'

along'with the remainder of the " balance of plant" (80P) equipment.

The PRISM - design provides several features for enhancing safety of a -

nuclear power plant.

• a-passive system for emergency removal of decay heat

• inherent mechanisms for negative feedback of reactivity

• 1arge thermal inertia in the pool of sodium coolant l

• metal fuel, offering greater opportunity for on-site fuel reprocessing

• small component sizes, providing opportunities for factory

' fabrication

• opportunity for prototype testing of a single module

• separation of safety-related functions from BOP systems On the basis of its review, the NRC staff-has concluded that the PRISM design has the potential for a level of safety at least equivalent.to I

current light water reacter (LWR) plants, provided that a number of specific issues are resolved. Our general recommendation is that, from the perspective of safety and licensing, design development of PRISM should continue, taking into account the points made by the staff.

A number of safety issues remain to be completely addressed, a program cf continuing research and development is necessary to support further design, and plans for extensive prototype testing should be developed.

In the following paragraphs we coment on a number of specific safety issues which we believe should be considered by the staff in its final J

SER, and by DOE in its continuing development and design activities.

Containment Although a secondary vessel is provided to contain leakage of sodium coolant, the PRISM design does not include a conventional containment capable of resisting high temperatures and pressures.

It is contended that the potential for core disruptive accidents, for which such a l

,j, The Honorable Lando W. Zech, Jr. November 22, 1988 containment might provide mitigation, is so low that a conventional contair: ment is not needed.

Both deterministic and probabilistic argu-ments are made in support of this contention.

Although these arguments have technical merit, we are not yet convinced.

Our position is as stated in our report to you of July 20, 1988 on the key licensing issues associated.with DOE sponsored reactor designs and our report to you of October 13, 1988 on the preapplication safety evaluation report for the modular high temperature gas-cooled reactor.

However, there is a problem. One reason for providing a strong physical containment is to protect the public against unforeseen accidents. But, precisely because they are not foreseen, the design requirements for a containment are not obvious.

Therefore, engineering and policy judg-ments must be made about the need for, and nature of, containment that might be used with PRISM.

We believe that further study is appropriate before final judgments are made.

Absence of a Backup Shutdown System The PRISM design provides a control rod system consisting of six control reds, a safety grade means of scramming these rods by gravity, and a safety grade electrical system to drive the rods into the core.

How-ever, the design provides no backup to this control rod system other than the inherent characteristics of the core.

We question whether these inherent characteristics are adequate as a backup system, for two 4

reasons.

First, they may not act fast enough to compensate for certain fast transients without scram.

Second, they are not capable of making the reactor subcritical and ta king it to cold shutdown conditions.

Therefore, we believe the need for a backup system or suitable demon-stration of scram reliability deserves further study.

1 Need for Local Flow and Temperature Monitoring i

The TRISH safety analysis indicates that blockage of flow through one fuel assembly may possibly damage that assembly, but will not damage j

adjacent assemblies.

Early work with oxide fuel has demonstrated that

)ropagation is unlikely, but experiments and analysis with rietal fuel i

aave not been as extensive.

Especially because the design does not i

provide for monitoring flow and effluent temperature from individual j

assemblies, we believe this requires further study.

1 I

1 Individual Rod Worth Each of the six control rods is sufficient, individually, to shut down the reactor and maintain it in cold shutdown.

Therefore each rod has a very large reactivity worth, about two dollars. There is thus potential

-_ _ a

A

, W/ x s,

4 LThe Honorable Lando W. Zech,. Jr. November 22, 1988 l

for serious' consequences from a rod ejection accident.

This potential is ameliorated in two ways.

First, for. startup, rod operations are interlocked so that the rods can 'be withdrawn.only in a carefully.

orchestrated sequence.

This. rod sequencing system will have to be very carefully. designed, operated, and maintained.

Second, for power opera-tion,: the expected reactivity change of a core through its lifetime is.

expected. to be. so. flat that only very small rod insertion will be n

necessary at the beginning of core life, thus reducing the effect of a rod ejection accident.

These - features will be effective only with L

accompanying administrative controls on core design and rod operation i

over the lifetime.of PRISM plant-operations.

This should be acknowl--

edged in the SER.

l Role of the Operator l

We believe that insufficient attention has been given to the role of the l

operator.

Claims that a PRISM plant would have such. inherently stable and safe - characteristics that the operator will have essentially no safety function -are unproven.

Operation of nine reactors, possibly in i

p several different operational states at any given time, may be a daunt-ing challenge for the small operations crew envisioned.

Opportunities for cognitive error, which might defeat favorable safety-characteristics i

of'the reactor, might be more abundant than is now recognized.

Further i

study appears to be desirable.

We believe insufficient attention has been given to the physical securi-ty of the plant's operating and technical support staff.

It is claimed that the control room, with all of its contents, including operating personr.el, can be destroyed and that the plant can be safely shut down from remote control stations that are within the physical security controlled areas of the plEnt.

Therefore, the control room and techni-cal support areas are now proposed to be located outside the physical security boundary.

We believe, given an external threat, such as an attack by terrorists, that it is essenti:1 to preserve the operating and technical expertise on-site, and recommend that the control room and appropriate technical support personnel be located within the physical security boundary.

l -

Other Operational Considerations i

In addition, certain features that have been found to be desirable in i'

LWR plants are not provided in the PRISM design.

No technical support center is provided. Although remote shutdown capability is provided, it appears to lack some of the attributes of such systems in current LWR plants. Also, the design does not include Class IE AC electric power systems, but relies entirely on IE DC power from batteries.

It is not clear that adequate consideration has been given to the potentially l

U-_-_-_-_-_------------

~

L..,^.-

j

]

i t

The Honorable Lando W. Zech, Jr.

-S-November 22, 1986 i

large power needs of essential auxiliary functions such as space cooling and emergency lighting, j

Protection Against Sabotage With regard to the need for designhg protection against sabotage, the.

following statement from our report of July 20, 1988 should be given early consideration as the design of this plant progresses:

"It is often stated that significant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the design process. Unfortunately, this has not been done consistently because the NRC has developed no guidance or requirements specific for plant' design features, and there seems to have been no systematic attempt by the industry to fill the resulting vacuum.

We believe the NRC can and should develop some guidance for designers of. advanced reactors.

It is probably unwise and coun-i terproductive to specify highly detailed requirements, as those for present physical security systems, but an attempt should be made to develop some general guidance."

_Sodica Fires Further study of the potential for and suppression of sodium fires and

{

consideration of their possible consequences is reeded.

Such studies should include the possibility of fires resulting from earthquake effects.

j 1

Sincerely, Forrest J. Remick Acting Chairman

References:

1.

Office of Nuclear Regulatory Research, " Safety Evaluation Report for the Power Reactor Inherently Safe Module (PRISM)/ Liquid Metal Reacter Conceptual Design," dated September 10,1988 (Predecisional Draft) 2.

General Electric / Nuclear Systems Technology Operation (DOE Con-tract), GEFR-00793, " PRISM Preliminary Safety Information Docu-ment," Volumes I through Y, 1986

r YY407

• i.

.., I ENCLOSURETOQUESTION9 i

Attachment B

.M

/p* **cvq'o f

UNITED STATES

! ' 7,,y NUCLEAR REGULATORY COMMISSION

* "[j[- [g r

ADVISORY COMMITTEE ON REACTOR SAFEGUARDS E

t, W ASHINGTON, D. C. 20555 gva...*f January 19, 1989 The Honorable Lando W. Zech, Jr.

Chairman U.S. Nuclear Regulatory Commission Washingten, D.C.

20555

SUBJECT:

SAFETY EVALUATION REPORT FOR TFE S001011 ADVANCED REACTOR (5AFR) DESIGt!

During the 345th meeting of the Advisory Committee on Reactor Safe-guards, January 12-14, 1989, we completed our review of a draft of the -

subject safety evaluatien report (SER).

sidered during our 344th meetinp on DecemberThis subject was also con-15-17, 1988.

Our Sub-ecmmittee on Advanced Reactor Designs met on December 13, 1988 to discuss this natter.

During these meetings, we had the benefit of discussions with representatives of the NRC staff and its consultants, with representatives of the Department of Energy (DOE) and its con-tractors, inrluding representatives of Rockwell International, the lead design contractor.

We riso had the. benefit of the documents referenced.

The SAFR conceptual desion is a product of a DOE program to develop designs for ressible future power reactor systems that would 'have enhanced safety characteristics.

are the Medular High Temperature Gas Cooled ReactorOther design projec (MHTGR) and the Pcwer Reactor Inherently Safe Module (PRISM).

The NRC staff has re-viewed these designs in accordance with the 'emmission Policy on Ad-venced Nuclear Power Plants.

These preapplication reviews are intended to provide NRC guidance on licensing issues at a relatively early stage of dasign development.

The ACRS has previcesly comm:nt :d +r :-" i

'ac 19R7 on NUREG-1226, " Development and Utilization of the NRC Policy Statement on the Regulation of Advanced Nuclear Power Plants," in July 1988 on key licensing issues associated with the entire program, in October 1988 on the SER for the MHTGR, and in November 1988 on the SER for PRIS!!.

We understand that issuance of the SER wil'1 not ct.nstitute approval of the SAFR design.

Further engineering development and documentation would be required to support a future app 1tcation for design certifi-cation.

The SAFR design incorporates small modular reactors cooled by liquid sodiun.

The standard SAFR plant would consist of one or more " power paks."

Each " power pak" would comprise four reactor modules that would

~f 3 0 f L) p l H S V

~

i i

e.

.x e.,

s The Honorable Lando W. Zech, Jr. January 19, 1989 I

produce a total of 3600 MWt (1400 MWe).

Each reactor, along with its intermediate heat exchangers and pumps is immersed in a pool of sodium.

A steel vessel centaining this pool is surrounded by a secondary steel contairer and each module is installed within a concrete structure above grade.

Secondary sodium cociant will flew from each reactor module to a pair of steam generators, located above grade alonn with the remainder of the balance of plant (B0P) equipment.

Tbc SAFR modular design prevides several desirable features for enhanc-ing safety of a nuclear power plant:

• a passive systen for emergency removal of decay power

[

• inherent nechanisms for negative feedback of reectivity 1

• tvo independent scram systems, one capable of self-actuation

• large thermal inertia in the pcol of sodium coolant

• metal fuel, offering greater opportunity for on-site fuel repro-cessing

' small ccmpenent sizes, providing opportunities for factory fabrica-tion

• opportunity for prototype testing of a single module

• sEparatier. of safety-related functions from BOP systems SAFR, while similar to PRISM, has some important differences.

Each SAFR reactor module is larger and would eenerate 900 tiWt compared with 425 1:Wt for PRISM.

SAFR primary sodium trould run hotter than in PRISM with a nominal core exit temperature of 950"F compared with 875*F for PRISM.

SAFR steam conditions are 850*F and 2700 psig, ccmpared with 545'F and 990 psig for PRISM.

SAFR has two reactivity control and scram systems while PRISM has one. SAFR's main coolant pumps are conventional centri-fugal while PRISM's are electromagnetic.

The DOE has decided to discontinue its development of the SAFR design and concentrate liquid metal reactor (LMR) efforts in the PRISM design organization, but has requested that the NRC staff complete its review of both SAFR and PRIS!!.

The NRC staff has expressed no opinion that there appears to be a net adver.tage in the PRISM design over that of SAFR, or vice versa.

On the basis of its review, the NRC staff has concluded that the SATR design has the potential for a level of safety at least equival nt to

.. :. * +

\\ : e.y..

L 1:

s.

J The. Honorable Lande W. Zech, Jr. January 19, 1989 l

current light water reactor (LWR) plants. We have no reason to disa l

and believe that SAFR, like PRISM, could be development work is pursued successfully.

licensed if continuing 1

A nurrber of safety issues remain to be completely addressed.

ing progran of research and development will be necessary *A continu-further design.

Plans for extensive prototype testing should be includ-o support ed.

safety issues which we believe should be consid final SER, and by DOE if it continues design and development of this concept.

Positive Sedium Void Coefficient SAFR, like PRISM, will experience a large increase in reactivity in the event of significant boiling or other voiding of the sodium coolant.

The desioner's' analyses cannot show that such voiding is impossible they have concluded that it is very improbable.

able enough and whether the consequences of such voiding can be tole l

eted is the rajor safety issue that must be resolved befnre these reactor desiens could be licensed.

The simultaneous and sudden loss of bcth main circulation pumps, without scram, in a reactor module might cause significant sodium boiling and a reactivity increase.

If the petitive voiding coefficient shown to be of extremely low probability.is to be accepted, such events desior end safety analysis work is needed in this area.We believe that addition Other Reactivity Coefficients The satisfactory performance of the system in certain icw probability transients is very dependent on the changes in core reactivity with variations in power, temperature, and flow that can make subtle changes in the core gecmetry.

between the calculated response and unacceptable response siderable design and development effort will be necessary to assure that A con-challenges. response of the core will be acceptable over a wide range of poteI Scram Systems The SAFR desion includes two sets of control rods either of whi independently shut down the reactor in response to a scram signal and maintain it subcritical.

loss of holding power in a special clutch containing a magnet.O mally high sodium temperature, Abnor-Curie point temperature of the magnet to be exceeded. greater then 1050*F, w We note, however, that this feature depends on there being maintained a sufficient flow of l

(

y f/

,,a,-

(o y ;.:

.g I

i The Honerable Lando W. Zech, Jr.

( January 19, 1989 sodium coolant over the magnet.

This

.autenatic shutdewn is to be assured.

flow must be assured if the Neither of the control rod systens is fully safety grade.

the systems de have some of the most important features of safety g Apparently,

systems, e.g.,

tolerance of single failures.

While we agree that

{

grade is not a guarantee of high reliability, we su i

4 nation cf a non-safety grade is flouting not only convention but good s l!st of PRA The KRC staff seems to have been disappointed in the extent to which PRA has been useful in reviewing the design of SAFR, as well as the earlier revicw of the PRISt* and MHTGR.

developed in so little detail that risk analysts have little to work with and the benefits of the analysis are limited.

Decision makers should regard with caution quantitative claims of high safety perform-ance for reacter systems still at the conceptual design stage, Containment Although a secondery vessel is provided to centain leakage of sodium coolant, the SAFR design does not include a conventional containment capable of resisting high temperatures and pressures.

It is contended that the pctential for accidents, for which such a containment might provide mitigation, is so low that a conventional containment is not needed.

Both deterministic and probabilistic arguments are made in of this contention.

suppert Although these arguments have technical merit, we are not yet ccnvinced.

Our positten is as stated in our repcrt to you cf iluly 20, 1988 en the key licensing issues associated with DOE-spenscred reactor designs and our report to you of October 13, 1988 on the preapplication safety evaluation report fer the Modular High Temperature Gas Cooled Reactor.

However there is a problem in specifying containment design criteria.

One reas,on for providing a strong physical containment is to protect t public against unforeseen accidents.

But, precisely because they are not foreseen the design requirements for a containment are not obvicus.

Therefore, en,gineering and policy judgments must be made about the nee for, and nature of, containment that might be used with SAFR.

We believe that further study is appropriate befere final judgments are made.

pe w-1 o

..py

4, ;. y.?, :

H

?-

l' I

lO

'l The' Honorable Lande W. Zech, Jr. January 19, 1989 Lx q

l 4

Individual' Rod Worth There' are two shutdown systems utilized in SAFR.

Neither is currently l

safety grade..The automatic plant trip system can drive in all six of the primary control rods, which have a net reactivity worth of about ten -

tollars.. It-can also interrupt power to the electromagnetic latch and drop three secondary control rods, with a net reactivity worth of. about seven dollars.

The minimum number of primary centrol rods needed for reactor shutdown 'is tuo cut of the six to insert about three dollars.

.The seccndary system needs but one rod (about 2.2 dollars) to enter the Pith this very large reactivity worth for each rod, there is a core.

potential for - serious consequences from a rod ejection accident.- We believe that this requires further study.

Need for total Flow and Temperature Fenitorino i

The SAFR safety analysis indicates that blockage of flow through one fuel asserbly may damage that assembly, but will not damege adjacent assemblies.

Early work with oxide fuel ' bas demonstrated that propa-gaticn is unlikely, but experiments and analysis with metal fuel have not been as extensive.

Especially because the design does not provide for renitcring flow and effluent temperature frem individual assemblies, we believe that this requires further study.

Pc'e of the Operator We believe,that insufficient attention has been given to the role of the epe ra tor.

Claims that a SAFR plant would have such inherently stable and safe characteristics that the operator will have essentially no safety function are unproven.

Operation of feur reactors, possibly in several different operational states at any given time, may be a signif-icant challenge for the small operations crew envisioned. Opportunities for cognitive error, which might defeat favorable safety characteristics of the reactor, micht be more abundant than is now recognized.

Further study is needed.

Other Operational Considerations In addition, certain features that have been found to be desirable in LWR plants are not provided in the SAFR desien.

Although remote shut-down capability is provided, it appears to lack some of the attributes of such systens in current LWR plants.

Also, the design does not include Class 1E AC electric power systems, but relies entirely on Class 1E DC pcwer frem batteries.

We recomend that further consideration be given to the potentially large power needs of essential auxiliary Yunctions such as space cooling.

D

1'1 1

f Q.[p.o 4

ou,

f The Hencrable Lar.do W.' Zech, Jr. January 19, 1989.

1 Protectien'tecinst Sabotage With regard to the need for designing protection against sabotage, the followirg statement frem our report of July 20, 1988 should be. given

.early consideration as the design of this plant progresses:

"It is often. stated that significant protection against sabotace can be inexpensively incorporated tr,to a plant if it is done early in the. design process.

Unfortunately.. this has not been done consistently because the NRC has developed no guidance or-require-ments specific fcr plant design features, and there seems to have been no systematic attempt by the industry to fill the resulting We believe the FRC can and should develop some guidance vacuum.

for designers of advanced reactors.

It is probably unwise and ccunterprcductive to specify highly detailed requirements, as those for present physical security systems, but an attempt should be rade to develop some general guidance."

Sedium Fires-Further study of the potential for and suppression cf sodium fires and. ccrsideration of their possible-consequences is needed.

Such studies should include the possibility of fires resulting

-from earthquake effects.

Sincerely.

Forrest J. Remick Chairman r.cferences 1.

Office of Nuclear Regulatory

Research,

" Safety Evaluation j

Report for the Sodium Advanced Fast Reactor (SAFR)," Novem-L ber 9,1988 (Predecisional Draft).

2.

Rockwell International (DOE contractor),

Al-DOE-135?7, "SAFR Preliminary Safety Information Decument,"

Volumes I

through L

III, October 1985.

O I

-