ML25139A552

Input for ACRS Review of the NuScale US460 Standard Design Approval Application - Safety Evaluation Report for Chapter 15, Transient and Accident Analyses

ML25139A552
Person / Time
Issue date:	05/20/2025
From:	Martin R Advisory Committee on Reactor Safeguards
To:	Walter Kirchner Advisory Committee on Reactor Safeguards
References
Download: ML25139A552 (1)

Text

UNITED STATES NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS WASHINGTON, DC 20555 - 0001 May 20, 2025 MEMORANDUM TO:

Walter L. Kirchner, Lead NuScale Design-Centered Subcommittee Advisory Committee on Reactor Safeguards FROM:

Robert P. Martin, Member NuScale Design-Centered Subcommittee Advisory Committee on Reactor Safeguards

SUBJECT:

INPUT FOR ACRS REVIEW OF THE NUSCALE US460 STANDARD DESIGN APPROVAL APPLICATION - SAFETY EVALUATION REPORT FOR CHAPTER 15, TRANSIENT AND ACCIDENT ANALYSES In response to the Subcommittees request, I have reviewed the NRC staffs safety evaluation report (SER) provided to support ACRS review of the standard design approval application (SDAA), with no open items for Chapter 15, Transient and Accident Analyses. The following is my recommended course of action concerning further review of this chapter of the SDAA and the staffs associated SER.

=

Background===

US600 to US460 Design Changes Relevant to Chapter 15 Analyses The design evolution from the US600 to the US460 NuScale Power Module introduced several key modifications with direct implications for Chapter 15 accident and transient analyses. The primary motivation was an increase in thermal powerfrom 160 MWt to 250 MWtrequiring adjustments to core design and power density. These changes affect figures of merit used with safety criterion such as collapsed liquid level and minimum critical heat flux ratio, which necessitated updates to the NRELAP5-based thermal-hydraulic evaluation models to preserve conservatism under postulated events.

Modifications to the emergency core cooling system (ECCS) and decay heat removal system further support the uprated power level. ECCS actuation is now triggered by a reactor vessel coolant level signal rather than a containment vessel liquid-level setpoint. In the US460 design, the ECCS reactor vent and recirculation valve flow paths include venturi-type flow restrictors that limit blowdown during valve opening, and the inadvertent actuation block (IAB) valves were removed from the reactor vent valves. These changes improve system response and reduce failure complexity.

To support extended passive cooling, and, in particular, boron mixing within the reactor pressure vessel and containment, holes in the lower riser and boron baskets affixed on the inner containment vessel wall were added in the US460 design to address concerns about boron redistribution and dilution following ECCS actuation. These features reinforce the passive ROBERT MARTIN Digitally signed by ROBERT MARTIN Date: 2025.05.20 14:41:37 -04'00'

W.

design objective that the reactor remains subcritical for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> without operator action, consistent with the extended passive cooling strategy. Containment vessel temperature and pressure ratings were also increased, in part, to ensure structural integrity during high-energy events.

Several changes to system operating parameters impact initial conditions for safety analyses.

The plant now uses average temperature rather than hot leg temperature control, and feedwater temperature has been reduced. These adjustments influence the thermal-hydraulic response to transients and required reevaluation of bounding event progressions. The reactor coolant system design was also refined to promote natural circulation and limit stagnation regions.

Finally, measures were taken to address potential flow instabilities in the steam generator, particularly density wave oscillations. Inlet flow restrictors were optimized to mitigate these instabilities.

SER Summary The NRC staffs evaluation of the US460 design reflects its evolution from the US600, incorporating both design changes and refinements in evaluation methods. While the overall safety case and analytical framework remain consistent, the US460 review concentrated on verifying that updated design featuressuch as revised ECCS actuation logic, enhanced passive cooling, and modified material specificationsdo not adversely affect the conservative basis of Chapter 15 analyses.

A distinguishing feature of the US460 evaluation is the formal identification of several High Impact Technical Issues (HITIs), which served as focal points for staff review and resolution. At least four HITIs have direct relevance to Chapter 15, including: (1) the design and classification of the non-safety-related Augmented DC Power System (EDAS), which is credited in limiting inadvertent ECCS valve actuation; (2) the loss-of-coolant accident (LOCA) break spectrum, influenced by the addition of ECCS venturis; (3) the potential for LOCA outside containment at the chemical and volume control system (CVCS) nozzle welds and containment isolation valves; and (4) the combined impact of density wave oscillation behavior and inlet flow restrictor design on system response and code applicability under transient conditions. Each of these issues was subject to extended audit, confirmatory analysis, and in some cases involved staff-wide deliberation on regulatory policy and technical sufficiency.

The NRC staff determined that the Chapter 15 safety analysis for the NuScale US460 design is acceptable and provides reasonable assurance that the plant can safely withstand a broad spectrum of design-basis events (DBEs). The staffs review addressed and resolved technical issues identified during the US600 evaluation, and the staff concluded that the evaluation models, assumptions, and results conform to applicable regulatory requirements and guidance.

Discussion The principal focus of the subcommittee discussions related to Chapter 15 analyses was the design changes and their impact on safety criteria. Based on my review, Ive concluded that those changes not only justify the higher nominal power of the US460 design but also strengthen its overall safety. As such, I concur with the staffs conclusions. The following observations highlight areas where the design evolution, evaluation model updates, or safety criteria were most relevant to the Committees deliberations.

Event Classification & Licensing Methodology

W.

The framework for event classification, assumptions, and boundary conditions forms the foundation of the Chapter 15 analyses and remains consistent with accepted industry practices.

NuScales approach to event classification is consistent with NuScales Design-Specific Review Standard guidance and regulatory expectations. The Chapter 15 evaluation model topical reports appropriately categorize events as anticipated operational occurrences and postulated accidents and apply conservative assumptions that align with the passive safety claims of the NuScale design.

NuScales set of DBEs capture a wide range of potential transients, including NuScale-specific events. All applicable regulatory categories were addressed, and bounding conditions were chosen to represent the most limiting conditions for each class. Along with staff audit analyses, including TRACE simulations, I find that the selected events conservatively envelope expected plant behavior.

Passive Safety and Operator Actions (72-hour criterion)

A central assumption in NuScales Chapter 15 methodology is that decay heat removal, core cooling, and reactivity control are maintained without reliance on administrative actions for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> following an initiating event. This assumption, including the design of the control room interface, expected environmental conditions, and the passive systems credited for safety functions, is justified primarily by their consistency with the approved US600 design. Where design changes have impacted system response, new tests and conservative analyses provide strong evidence of significant safety margin.

Application of the Single-Failure Criterion and EDAS Consistent with a traditional deterministic approach to safety, NuScale applied the Single-Failure Criterion (SFC) in designing and analyzing the US460, as they had done with the US600. During the US600 review, one issue related to the application of the SFC was elevated to the Commission, as recorded in SECY-19-0036. There the staff was directed to apply risk insights to address whether application of the SFC to the IAB valves was necessary. They were also directed to broadly consider risk insights should similar issues arise in the future. For the US460 design, the IABs were removed from the reactor vent valves, which brought into question the role and safety classification of the EDAS. Both the applicant and the NRC staff concluded that the non-safety classification of the EDAS continues to be justified. From these arguments and related evidence provided, I concur with this conclusion.

The EDAS system, while not classified as safety-related, plays a key role in preventing inadvertent ECCS actuation in several non-LOCA scenarios. The staff reviewed whether reliance on a non-safety-related power source is acceptable for preserving the reactor coolant pressure boundary, consistent with General Design Criterion (GDC) 15. Concerns over this reliance prompted the filing of a staff non-concurrence on the Chapter 15 SER, and, as of this writing, it continues to be processed.

Treatment of Non-Safety-Related Systems Regarding other non-safety-related systems, NuScale stated that these are only included in their analyses when their failure could increase the consequences of an event. Otherwise, such systems are assumed to fail conservatively or are not credited. Key examples include the main steam isolation valves and CVCS containment isolation valves. I agree with NuScales approach

W.

and the staff assessment that treatment of these systems is appropriate under deterministic safety principles.

Decay Heat Assumptions The staff evaluated NuScales decay heat modeling and confirmed the use of the draft ANS-5.1/N18.6 standard, supplemented by conservative multipliers to account for uncertainty. For long-term cooling evaluations of non-LOCA events, ORIGEN results were used to supplement decay heat predictions under specific cooldown conditions. The staff found these models acceptable and reaffirmed the validity of previously granted exemptions from Title 10 of the Code of Federal Regulations (10 CFR) 50 Appendix K, which were maintained in the US460 review given the absence of post-critical heat flux (CHF) behavior in NuScales design. This conclusion is well supported by the applicants modeling approach, and I concur with the staffs finding.

Reactivity Control Assumptions Rod insertion times and control rod reactivity worth were evaluated for their impact on reactivity insertion events and return to power scenarios. Staff reviewed NuScales assumptions and confirmed their acceptability. These are supported by tests performed by NuScale, including drop time, for which requirements are included in the technical specifications (Chapter 16). In the context of ECCS actuation and long-term cooling, the applied evaluation models assume conservative rod positions and coolant conditions to ensure sufficient shutdown margin. The staff concluded that these assumptions are appropriate for bounding plant behavior under design-basis conditions.

Anticipated transient without scram (ATWS) events, though beyond-design-basis, were also reviewed as part of NuScales reactivity control strategy. NuScale estimated that the frequency of ATWS events remains well below safety goal thresholds due to the high reliability and internal diversity of the Module Protection System (MPS). The NRC staff concluded that this approach satisfies the intent of 10 CFR 50.62 without requiring a separate diverse scram system, further supporting the adequacy of NuScales reactivity control design under both design-basis and beyond-design-basis conditions.

While Chapter 15 emphasizes the role of MPS reliability, the broader safety case incorporates analyses from Chapter 19 that credit both MPS reliability and the limited consequences resulting from a failure to scram, providing the basis for the staffs acceptance of NuScales approach to ATWS mitigation. This approach does not explicitly evaluate non-digital failures, such as analog circuits, a common supply chain, a common environment, and operator errors. Rather, staff acceptance rests on the demonstration that even with failure to scram, the plants response is sufficient to avoid fuel damage.

Boron Dilution and Return to Criticality To deal with the potential criticality issues identified in the design certification application associated with boron redistribution, dilution, and stratification, NuScale incorporated additional features in the NPM-20 design, including lower, midplane, and near-top riser holes and slots, and the ECCS spplemental boron system baskets within the containment. By enhancing mixing and mitigating stratification that could otherwise lead to localized deboration, the design changes maintain the core in a subcritical state in event of a small break LOCA, decay heat removal system actuation, and after ECCS actuation and into extended passive cooling. I

W.

reviewed NuScales methodology to evaluate the ECCS and decay heat removal system extended passive cooling function and the effectiveness of these measures in its accident analyses as presented in Chapter 15 of the FSAR. In its methodology, NuScale used the following figures of merit to assess performance: a) subcriticality, b) coolable geometry (boron concentration below solubility limit for precipitation), and c) collapsed liquid level above the top of active fuel. The extended passive cooling topical report and analyzed events show that coolable geometry is retained and the collapsed liquid level remains above the active fuel height, and I agree with these conclusions.

However, the ability to remain subcritical after an ECCS actuation depends on the behavior of several core parameters that affect core reactivity. These include the following: initial concentration of boron present in the RCS coolant, which increases in the core region due to coolant boiling; uncertainty in boron concentration returned through the reactor recirculation valves from containment due to concentration stratification of the boron added from the ECCS supplemental boron system dissolver baskets; core cooling down substantially over the 72-hour period, which adds positive reactivity; xenon peaking, then decay until at 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, the xenon is almost gone, while samarium is increasing over the same period; and all control rods, except the highest worth rod, are considered inserted. It should be noted that some parameters that are considered beneficial to core cooling, such as lower decay heat and lower coolant temperatures, make it more difficult to remain subcritical.

For the NuScale Power Module, the most limiting criticality conditions occur at the end of cycle, when the RCS boron concentration in the core is near zero. NuScales evaluation model conservatively applies cold water temperatures, worst-case control rod configurations, and low initial boron concentration to bound the minimum shutdown margin throughout this period. From all cases analyzed, the core remains subcritical, but the margin to criticality can be relatively small. The smallest margin to criticality shown was 28 parts per million (ppm) boron. This margin to criticality is within the predicted boron concentration uncertainty usually assumed in pressurized water reactors, which is typically 50 - 100 ppm. Cold, off-nominal conditions usually increase the amount of uncertainty. NuScale has indicated that there are many conservatisms built into their methodology that increase the margin to criticality, such as the use of conservative temperatures in the analysis. The NRC staff also ran computational fluid dynamic calculations that show that there is additional conservatism in the NuScale boron tracking model. In their analyses, the computational fluid dynamic calculations added approximately 180 ppm to the shutdown margin. With these conservatisms, it is shown that the core remains subcritical after an ECCS actuation. I find that the modeling assumptions are appropriately conservative. At the request of the Committee, the staff indicated that future technical specifications would ensure that boron concentration requirements necessary to preserve this margin are maintained across reload cores.

Radiological Consequence Evaluation NuScales radiological consequence methodology applies a modified alternative source term approach based on Regulatory Guide 1.183. Their assumptions for release fraction, decontamination factors, and release timing were presented, noting conservatisms. With the higher power level of the US460, the per-module source term will be higher than that for the US600. NuScale conservatively departed from the previously accepted methodology for the US600 by using a bounding source term for most events. That source term was shown to be as much as 300% higher than accident-specific source terms. The treatment of radiological consequences is consistent with prior guidance, and I support the staffs conclusion that

W.

NuScales radiological evaluation model complies with dose criteria under 10 CFR Part 100 and 10 CFR Part 20.

LOCA Evaluation Methodology NuScales LOCA evaluation model was updated for the US460 module design through TR-0516-49422; however, it is still fundamentally based on 10 CFR 50 Appendix K with exemptions for post-CHF conditions. The NRELAP5 code (version 1.7) and associated system model reflect changes in operating pressure, ECCS configuration, and containment design. As with the LOCA methodology applied to the US600, collapsed liquid level, critical heat flux margin, and containment pressure/temperature are the safety figures of merit, serving as a surrogate for peak clad temperature. NuScale presented new integral testing results from their NIST-2 facility that reflect the design changes between the US600 and US460 modules. These data were used by NuScale, and subsequently by the staff, to confirm the adequacy of the NRELAP5 code for this application. This evaluation model is consistent with prior approvals, and I agree that its application to the US460 is appropriate.

Flow Instability Flow instability during natural circulation was addressed through design enhancements and refined modeling. Inlet flow restrictors were retained in the US460 module design and optimized to dampen such instabilities. New testing and analyses were used to confirm that flow oscillations are not expected under normal and DBEs. Analyses by the staff using TRACE results supported the conservatism claimed by NuScale. The stability margin is sufficient to avoid adverse system response during cooldown transients. The design changes, testing, analysis methods and results, and operational limits support my conclusion that flow instabilities are highly unlikely to occur.

Subchannel Analysis & CHF Correlation NuScale updated their subchannel analysis evaluation model, including the CHF correlations applied through VIPRE-01, for the US460. With this update, they prepared new tests and accompanying analyses used for validation of NRELAP5. The staffs confirmatory analyses with the TRACE code showed that NuScales results are conservative. The methodology remains largely consistent with that previously applied to the US600 design, with appropriate updates to reflect the uprated power and fuel configuration. As such, I conclude that it remains appropriate for predicting local thermal limits and ensuring fuel performance criteria are met across the spectrum of transients.

Human Factors The design of NuScales control systems minimizes opportunities for operator-induced errors during DBEs. The Chapter 15 analyses assume no operator action within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />, and the staff reviewed whether errors of commission could realistically compromise system response.

NuScale noted, and the staff confirmed, that design and operational features render operator errors unlikely. I find that the human factors assumptions are consistent with Chapter 18 evaluations and support the deterministic safety case.

Use of Exemptions to GDCs

W.

NuScale requested exemptions from several General Design Criteria, including GDCs 17, 34, 35, and 55, on claims that the US460 safety features provide functional equivalency. For example, the exemption from GDC 35 regarding ECCS performance without safety-related power was justified based on the plants passive design features. From their review, the staff concluded that the requested exemptions do not compromise safety and are supported by robust design and analytical justifications. Based on the argument and evidence presented, I consider the requested exemptions to be consistent with the intent of the original GDCs and thus acceptable from a safety perspective.

High Impact Technical Issues Several topics addressed in the Chapter 15 review were designated as HITIs due to their potential to affect regulatory decisions. These included the reliance on EDAS to prevent ECCS valve opening, the LOCA break spectrum resulting from ECCS venturi flow restrictor additions, and the potential for LOCA outside containment at CVCS isolation locations. Each HITI was subjected to detailed staff review, and audit analysis. Consistent with the staff, I observe that all HITIs relevant to Chapter 15 have been adequately resolved, justified through design and analysis, or addressed via exemption paths and licensing conditions.

Recommendation I recommend that the Committee not perform any additional review of this chapter.

References

1. U. S. Nuclear Regulatory Commission, Safety Evaluation of NuScale SDAA Chapter 15, Transient and Accident Analyses, March 26, 2025 (ADAMS Accession Nos.

ML25029A125 (Public) ML25084A091 (Non-Public)).

2. NuScale Power, LLC, Standard Design Approval Application, Part 2, Chapter 15, Transient and Accident Analyses, Revision 1, October 31, 2023 (ADAMS Accession No. ML23304A365).

3. NuScale Power, LLC, Submittal of Chapter 15 US460 Standard Design Approval Application Revision 1 to Revision 2 Snapshot, February 26, 2025 (ADAMS Accession No. ML25057A294).

4. NuScale Power, LLC, Submittal of Supplement to Chapter 15 US460 Standard Design Approval Application Revision 1 to Revision 2 Snapshot, February 27, 2025 (ADAMS Accession No. ML25058A253).

5. NuScale Power, LLC, Licensing Topical Report, TR-0516-49422, Loss-of-Coolant Accident Evaluation Model, Revision 3, October 31, 2023 (ADAMS Accession Nos. ML23008A002 (Public) and ML23008A003 (Non-Public)).

6. NuScale Power, LLC, TR-124587, Extended Passive Cooling and Reactivity Control Methodology, Revision 0, January 5, 2023 (ADAMS Accession Nos. ML23005A308 (Public)

ML23005A309 (Non-Public)).

W.

7. NuScale Power, LLC, TR-0516-49416, Non-Loss-of-Coolant-Accident Analysis Methodology, Revision 4, January 5, 2023 (ADAMS Accession Nos. ML23005A305 (Public)

ML23005A306 (Non-Public)).

8. U. S. Nuclear Regulatory Commission, SECY-19-0036, Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves, April 11, 2019 (ADAMS Accession No. ML19060A081).

W.

May 20, 2025

SUBJECT:

INPUT FOR ACRS REVIEW OF THE NUSCALE US460 STANDARD DESIGN APPROVAL APPLICATION - SAFETY EVALUATION REPORT FOR CHAPTER 15, TRANSIENT AND ACCIDENT ANALYSES Package Accession No: ML25091A091 Accession No: ML25139A552 Publicly Available (Y/N): Y Sensitive (Y/N): N If Sensitive, which category?

Viewing Rights:

NRC Users or ACRS only or See restricted distribution OFFICE ACRS SUNSI Review ACRS ACRS NAME MSnodderly MSnodderly LBurkhart (MSnodderly for)

RMartin DATE 5/20/25 5/20/25 5/20/25 5/20/25 OFFICIAL RECORD COPY