ML20305A595
| ML20305A595 | |
| Person / Time | |
|---|---|
| Site: | 05200049 |
| Issue date: | 10/30/2020 |
| From: | Oklo Inc |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML20305A582 | List: |
| References | |
| Download: ML20305A595 (8) | |
Text
Oklo Responses to NRC Request for Additional Information 4: Aurora Step 1 - SSC October 2020 Oklo Inc.
Oklo Response to RAI 4: Aurora Step 1 - SSC TABLE OF CONTENTS 1 RAI: Aurora Step 1 - SSC - 1............................................................................................ 3 1.1 Oklo response ............................................................................................................. 3 1.1.1 Summary ................................................................................................................ 3 1.1.2 Detailed response .................................................................................................. 3 1.2 Associated changes to the FSAR............................................................................ 6 2 RAI: Aurora Step 1 - SSC - 2............................................................................................ 8 2.1 Oklo response ............................................................................................................. 8 2.2 Associated changes to the FSAR............................................................................ 8 Oklo-2020-R20-NP, Rev. 0 2
Oklo Response to RAI 4: Aurora Step 1 - SSC 1 RAI: AURORA STEP 1 - SSC - 1 Please describe how quality assurance is addressed for SSCs that are relied on to (1) shutdown the reactor, or (2) prevent or mitigate the consequences of accidents. In support of this description, please update the FSAR to describe and justify the methods used to design, fabricate, erect, and test SSCs commensurate with their importance to safety (i.e., SSCs that perform fundamental safety-functions) including the extent to which generally accepted consensus standards are applied. This update should consider additions to design bases, design commitments, and programmatic controls as necessary.
1.1 Oklo response 1.1.1 Summary The Oklo response to RAI 2: Aurora Step 1 - QA provides a description of how quality assurance is addressed for the Aurora, and details how specific portions of the Oklo Quality Assurance Program Description (QAPD) are applied. In summary, functions and inherent features ensured by design bases fall under Part III of the QAPD, and the subset of these functions or inherent features that are determined to be safety-related are additionally subject to the requirements of Part II of the QAPD. The focus of this RAI is on SSCs that are relied on to (1) shutdown the reactor, or (2) prevent or mitigate the consequences of accidents. Most of the functions and inherent features in these categories fall under Part III of the QAPD, while a specific characteristic of the fuel falls under Part II of the QAPD.
1.1.2 Detailed response 1.1.2.1 Application of quality assurance As part of the response to Request for Additional Information 1: Aurora Step 1 - MCA, Oklo uploaded a document titled Maximum Credible Accident Methodology: Summary of Methodology (referred to here as the MCA methodology summary) to the electronic reading room. In that document, Oklo explains that the definition from 10 CFR 50.2 is not relevant to the Aurora when designating safety-related SSCs, because the definition is specifically applicable to light water reactors, and should not be applied piecemeal to reactors that are not light water reactors. This RAI implicitly refers to that definition in addressing SSCs that are relied on to (1) shutdown the reactor, or (2) prevent or mitigate the consequences of accidents.
Because the 10 CFR 50.2 definition is not relevant to Oklos approach, the application of quality assurance is not uniform across the specific groups of SSCs that are the focus of this RAI.
Further, as described in the MCA methodology summary, Oklo specifically applies quality assurance to functions and inherent features rather than to SSCs as a whole. The relationship of quality assurance to specific functions and inherent features in the Aurora is described in Oklo Responses to NRC Request for Additional Information 2: Aurora Step 1 - QA. In Section 2.2 of that response, a proposed change to the FSAR adds a new section that describes the applicability of specific portions of the QAPD, replicated here (shown in blue underline to indicate this is an update proposed in a prior RAI response):
Oklo-2020-R20-NP, Rev. 0 3
Oklo Response to RAI 4: Aurora Step 1 - SSC 2.1.4 Applicability of QAPD As described in Section 2.1.1, the design bases are the characteristics of a system that ensure the safe operation of the reactor. The functions and inherent features described by the design basis summaries (i.e., gray boxes) in this chapter fall under Part III of the Oklo Quality Assurance Program Description (QAPD). More specifically, the functions and inherent features that are committed to as design commitments, and verified by programmatic controls, are the characteristics that fall under Part III of the QAPD. Key dimensions are also considered to inherently be part of the design bases and fall under Part III of the QAPD. A subset of functions and inherent features described in the design basis summaries that would fall under Part III of the QAPD may be determined through the safety analysis to be safety-related, and in that case would instead fall under the requirements of Part II of the QAPD. Further, functions or inherent features that are not determined to be safety-related may nevertheless be treated under Part II of the QAPD. In each of these cases, the treatment under Part II of the QAPD will be explicitly stated in the relevant design commitment in the design basis summary.
As described in the new proposed section, functions and inherent features required to meet the design bases fall under Part III of the QAPD. This is a key distinction from entire SSCs being subject to the program controls of the QAPD. Note that Part III of the QAPD is specifically geared towards this approach. Part III Section 1 of the QAPD states:
The specific program controls consistent with applicable sections of the QAP are applied to those items in a selected manner, targeted at those characteristics or critical attributes that render the SSC a significant contributor to plant safety.
The assignment of design bases and the resultant design commitments is specifically done for characteristics of systems that ensure safe operation of the reactor, and it is therefore those characteristics that must meet the appropriate level of quality.
Certain functions and inherent features that are determined to be safety-related must additionally meet the requirements of Part II of the QAPD, and additional functions or inherent features may be treated under Part II of the QAPD regardless of safety classification. The response to RAI: Aurora Step 1 - QA -1 specifically describes items that fall under Part II of the QAPD and proposes new wording for the FSAR to make this applicability clearer.
In response to the specific question in this RAI, the functions and inherent features of SSCs that are relied on to shut down the reactor are controlled by design bases, and therefore subject to Part III of the QAPD. Several design bases are applicable to achieving shutdown. These include design bases of the shutdown rod system (DB.SRS.01, and DB.SRS.02), and the reactor trip system (DB.ICS.01, DB.ICS.02, DB.ICS.03, DB.ICS.04, DB.ICS.05, and DB.ICS.06). The functions and inherent features that prevent and mitigate the consequences of accidents are less clearly delineated in Oklos approach and subject to interpretation of the definition. As described, all functions and inherent features that ensure safe operation of the reactor are controlled by design bases and are subject to Part III of the QAPD. The specific inherent feature that is most clearly relied on to mitigate the consequences of accidents relates to the fuel, as described in DB.RXS.01. This critical characteristic is subject to Part II of the QAPD, as described in Section 1.1.2.2.
Oklo-2020-R20-NP, Rev. 0 4
Oklo Response to RAI 4: Aurora Step 1 - SSC 1.1.2.2 Safety-related classification In general, as described in the MCA methodology summary, Oklo only classifies functions or inherent features as safety-related if they are needed to meet the Dose Acceptance Criteria. This criteria requires dose consequences to be below those allowed by 10 CFR for accident scenarios in the context of siting requirements. In the specific case of the Aurora, the extremely small radionuclide inventory, the simple design of the system, and the generally passive or inherent nature of the plant ensure that the none of the functions or inherent features are required to meet the Dose Acceptance Criterion. This was confirmed through the conduction of several iterations of analyses of hypothetical radionuclide release. These analyses simply assumed a release from the fuel, and were hypothetical and extreme, but none of them were close to exceeding the Dose Acceptance Criterion. Therefore, no functions or inherent features are required to be classified as safety-related according to the MCA methodology.
Even though hypothetical releases do not cause the Dose Acceptance Criterion to be exceeded, the safety goal of the Aurora is to control the release of radionuclides by maintaining fuel integrity. The safety goal requires maintaining fuel temperatures below 1200C to prevent fuel melt, which would drastically reduce fission product retention in the fuel. The most critical assumption in the analysis for determining fuel temperature is the thermal conductivity of the fuel. Therefore, this inherent feature was subject to Part II of the QAPD even though it was not classified as safety-related. In response to the NRC staffs questions during the MCA Audit on October 22, 2020, Oklo will upload a new version of the MCA methodology document (Oklo Inc.
- Maximum Credible Accident Methodology: Summary of Methodology, Rev.1) with an expanded Appendix B to provide further description of this. Oklo also proposes to update the FSAR to describe how the determination of safety-related functions and inherent features was made.
1.1.2.3 Treatment in the FSAR As described in Section 2.1.1 of the FSAR, the information provided for each system of the Aurora in FSAR Chapter 2 is scoped to the appropriate level of detail required to evaluate the sufficiency of the design bases in ensuring safe operation. The simplicity of the system results in a relatively small number of functions and inherent features that are controlled by design commitments. Further, the simplicity of the system allows for the simulation of the transient thermal response of the entire system to the MCA and other bounding events, with each key assumption controlled by the corresponding design commitments.
As described in Section 4.1.2, the design of the reactor took an iterative approach:
The design bases for the Aurora were developed through an iterative process between design of systems and subsequent safety analysis of those systems. As the design of the Aurora evolved, the safety analysis advanced to continue confirming the design assumptions. As a result, design bases were developed to describe the various Aurora systems.
Therefore, design bases are the characteristics of a system that ensure the safe operation of the Aurora reactor.
This iterative design approach included both the transient analyses described in Chapter 5 of the FSAR, and the steady-state analyses described in Chapter 2 of the FSAR which provide the initial conditions for the transients. Once a design was arrived at that not only met the Dose Acceptance Criterion described in Section 1.1.2.2, but further met both the safety goal, and the much more conservative operational goal (both defined in Section 5.3 of the FSAR), the design Oklo-2020-R20-NP, Rev. 0 5
Oklo Response to RAI 4: Aurora Step 1 - SSC bases and design commitments were finalized. During this design process, Oklo referenced consensus standards when appropriate, but did not commit explicitly to any of these standards.
Because these standards were not committed to, they were not included in the FSAR; Oklo does commit to certain standards through the QAPD. Rather, Oklo relies on their safety analysis to demonstrate that the design meets the operational and safety goals, and on a performance-based approach to verify that the as-built system functions as designed.
The performance-based approach Oklo has taken is to ensure that the design commitments made in Chapter 2 of the FSAR are met through the use of programmatic controls. These programmatic controls include preoperational tests (POTs), inspections, tests, and analysis acceptance criteria (ITAAC), startup tests (SUTs), and technical specifications (TS), and they collectively ensure that the fabrication and erection of the SSCs is done in such a way that each of the design commitments are met. The purpose of the programmatic controls is described in Section 2.2.1 of the FSAR:
The programmatic controls function not only to verify that the design commitments are met (i.e., that the as-built system is as described in this chapter), but to provide assurance that the assumptions in the safety analysis are valid (i.e., that the modeled system is representative of the as-built system).
This aspect of the Oklo approach is critical. Rather than provide specific fabrication or erection methods that will be used for each SSC in the FSAR, analyses are provided that show which functions or inherent features of each SSC are important, specific commitments are made to ensuring those characteristics will be met, and those characteristics are verified by a comprehensive testing program after they are fabricated and erected. This approach is also important for the construction of a first of a kind reactor, because it offers flexibility in how commitments are met, and reduces the burden of conducting an expansive test program prior to the beginning of the licensing process.
The Initial Test Program (ITP), described in Chapter 14 of the FSAR, and the Technical Specifications, described in Part IV of the COLA, therefore represent the testing of functions and inherent features commensurate to safety. The ITP consists of the tests conducted prior to normal operations, with completion of tests required to meet an ITAAC, and the TS ensure that the design commitments that require additional surveillance and testing over the course of normal operations continue to be adequately met. Because the completion of pre-operational tests is required by an ITAAC, this approach offers assurance that a reactor that does not meet the design commitments cannot start up or operate. This approach guarantees a successful licensing outcome because the health and safety of the public would not be negatively impacted.
Further, the use of TS ensures that an operating reactor that no longer meets the design commitments will be taken offline and restored to compliance before operating again.
1.2 Associated changes to the FSAR The following portions of the FSAR will be revised as described above and shown in the provided markup below.
Oklo-2020-R20-NP, Rev. 0 6
Oklo Response to RAI 4: Aurora Step 1 - SSC FSAR Chapter 5, a sub-section (Section 5.3.3 Safety classification) will be added:
5.3.3 Safety classification Oklo classifies functions or inherent features of SSCs as safety-related if they are needed to meet the offsite dose consequence limit for siting, as per 10 CFR Part 100. In the case of the Aurora, the extremely small radionuclide inventory, the simple design of the system, and the generally passive or inherent nature of the plant ensure that the none of the functions or inherent features are required to meet this criterion, referred to as the Dose Acceptance Criterion. This was confirmed through the conduction of several iterations of analyses of hypothetical radionuclide release. These analyses simply assumed a release from the fuel, and were hypothetical and extreme, but none of them were close to exceeding the Dose Acceptance Criterion. Therefore, no functions or inherent features are required to be classified as safety-related according to the MCA methodology.
Even though hypothetical releases do not cause the Dose Acceptance Criteria to be exceeded, the safety goal described in Section 5.3.1 is to control the release of radionuclides. This is achieved by maintaining fuel integrity, and the primary inherent feature of the reactor system that is relied on to achieve this is the thermal conductivity of the fuel. Therefore, although it is not required to meet the Dose Acceptance Criterion, and therefore not considered safety-related, the thermal conductivity of the fuel is subjected to elevated quality assurance treatment as described in the design basis summary in Chapter 2.
Oklo-2020-R20-NP, Rev. 0 7
Oklo Response to RAI 4: Aurora Step 1 - SSC 2 RAI: AURORA STEP 1 - SSC - 2 Please update the FSAR to describe and justify the methods used to design, fabricate, erect, and test SSCs that are not identified as performing fundamental safety functions, but that support the Aurora safety case through defense-in-depth or other risk-reducing functions. This description should include factors considered such as the extent to which generally accepted consensus standards are applied to the design of the SSCs, and the use of controls such as defining performance bases with licensee-controlled performance commitments and programmatic controls.
2.1 Oklo response As described in Section 1.1, the functions and inherent features of SSCs that are credited in the safety analysis, and that ensure the safe operation of the reactor, are controlled by design bases, and subject to Part III of the Oklo QAPD. Certain characteristics of the fuel are of particular importance to achieving the safety goal of the reactor, and therefore subjected to Part II of the QAPD.
The FSAR discusses many other functions and inherent features of the Aurora that provide additional defense-in-depth that are not credited in the safety analysis, and therefore not controlled by design bases, and the associated design commitments and programmatic controls.
Although these other functions and inherent features do not have associated design basis summaries, it is key to highlight that they are still fundamentally a part of the Aurora design.
In other words, complete ignorance of the non-design basis summary functions and inherent features would not be technically complete or prudent.
Oklo is highly motivated to ensure that each of the functions and inherent features that are not credited are nevertheless effective, both because they are beneficial for operational and investment protection reasons, and because they provide additional assurance of the public health and safety. However, Oklos safety analysis has shown that the operational goals of the Aurora are met during the maximum credible accident, including more than 500C in margin to the safety goal, when the design commitments are enforced. Further, as described in Section 1.1.2.2, none of the design commitments are needed to meet the dose consequence limits of 10 CFR Part 100. Therefore, although the additional layers of defense-in-depth are important to describe for full understanding of the Aurora, additional details will not be provided in the FSAR at this time.
2.2 Associated changes to the FSAR There are no changes to the FSAR as a result of this response at this time.
Oklo-2020-R20-NP, Rev. 0 8