ML25342A024
| ML25342A024 | |
| Person / Time | |
|---|---|
| Site: | 99902103 |
| Issue date: | 12/19/2025 |
| From: | Joshua Borromeo Office of Nuclear Reactor Regulation |
| To: | Lotti R ARC Clean Technology |
| References | |
| EPID L-20225-LRO-0013 | |
| Download: ML25342A024 (0) | |
Text
December 19, 2025 Robert Iotti Project Manager ARC Clean Technology, Inc.
901 K Street, NW Suite 900 Washington, DC 20001
SUBJECT:
U.S. NUCLEAR REGULATORY COMMISSION STAFF FEEDBACK REGARDING ARC CLEAN TECHNOLOGY, INC., ALTERNATE SHUTDOWN SYSTEM - WHY IT IS NOT NEEDED WHITE PAPER, REVISION 1.0 (EPID NO. L-2025-LRO-0013)
Dear Robert Iotti:
By letter dated January 29, 2025 (Agencywide Documents Access and Management System (ADAMS)
Package Accession No. ML25030A122) ARC Clean Technology (ARC) submitted for the U.S. Nuclear Regulatory Commission staffs (the staff) review the white paper (WP) entitled ARC-100 - Alternate Shutdown System - Why it is Not Needed White Paper, Revision 1.0. The WP summarizes ARCs plan for an alternate shutdown system of the ARC-100 reactor.
ARC asked the staff to perform a review of this WP and provide written feedback on the WP. The staffs feedback is provided in the enclosure to this letter.
If you have any questions regarding this matter, please contact Stephanie Devlin-Gill at 301-415-5301 or via email at Stephanie.Devlin-Gill@nrc.gov.
Sincerely,
/RA/
Josh Borromeo, Chief Advanced Reactor Licensing Branch 1 Division of Advanced Reactors and Non-Power Production and Utilization Facilities Office of Nuclear Reactor Regulation Project No.: 99902103
Enclosures:
As stated cc: ARC Clean Technology ARC-100 via GovDelivery
ML25342A024 OFFICE NRR/DANU/UTB2:TR NRR/DANU/UTB2:BC NRR/DANU/UAL1:PM NAME HOzaltun CdeMessieres DAtkinson DATE 09/05/2025 12/15/2025 12/16/2025 OFFICE NRR/DANU/UAL1:PM NRR/DANU/UAL1:LA NRR/DANU/UAL1:BC NAME SDevlin-Gill DGreene JBorromeo DATE 12/19/2025 12/11/2025 12/19/2025
Enclosure U.S. NUCLEAR REGULATORY COMMISSION STAFF FEEDBACK REGARDING ARC CLEAN TECHNOLOGY, INC., ARC-100 - ALTERNATE SHUTDOWN SYSTEM - WHY IT IS NOT NEEDED WHITE PAPER REVISION 1.0 (EPID NO. L-2025-LRO-0013)
SPONSOR INFORMATION Sponsor:
Sponsor Address:
901 K Street, NW, Washington, DC 20001 Project No.:
99902103 DOCUMENT INFORMATION Submittal Date:
December 19, 2025 Submittal Agencywide Documents Access and Management System (ADAMS) Accession No.:
ML25030A122 Purpose of the White Paper: By letter dated January 29, 2025, ARC Clean Technology, Inc. (ARC) submitted for the U.S. Nuclear Regulatory Commission (NRC) staffs (the staff) review the white paper (WP) entitled ARC-100 - Alternate Shutdown System - Why it is Not Needed White Paper, Revision 1.0.
ARC stated that the purpose of the WP is to provide its position that an alternate, non-rod-based reactor shutdown system, is not necessary to meet regulatory requirements. The WP describes proposed ARC-100 design features that support this assertion. These features include two independent rod-based systems that have separate diverse drive systems and redundant and diverse actuation systems and are backed by a system that uses the drive motors to ensure insertion into the core if necessary.
Action Request: ARC requested that the NRC staff review the WP and provide feedback on whether the proposed rod-based approach, consisting solely of two rod-based systems, is sufficient without a non-rod-based alternative shutdown system supporting a future license application.
FEEDBACK AND OBSERVATIONS The feedback and observations on this WP are preliminary and subject to change. The feedback and observations are not regulatory findings on any specific licensing matter and are not official agency positions. The feedback and observations on this WP are also not intended to be comprehensive; a lack of feedback or observations should not be interpreted as NRC staff agreement with ARCs position.
Regulatory Background Regulatory requirements pertaining to principal design criteria (PDC) are as follows:
Title 10 of the Code of Federal Regulations (10 CFR) 50.34(a)(1), (3), (4);
10 CFR 50.35, Issuance of Construction Permits; and 10 CFR Part 50, Appendix A, General Design Criteria for Nuclear Power Plants.
Guidance relevant to the staffs observations below includes:
Regulatory Guide (RG) 1.232, Guidance for Developing Principal Design Criteria for Non-Light-Water Reactors, Revision 0 (ML17325A611) provides guidance on how the general design criteria (GDC) in Appendix A, General Design Criteria for Nuclear Power Plants, of 10 CFR 50 may be adapted for non-light-water reactor designs.
RG 1.231, Acceptance of Commercial-Grade Design and Analysis Computer Programs Used in Safety-Related Applications for Nuclear Power Plants Revision 0 (ML16126A183) describes acceptable methods for meeting regulatory requirements for acceptance and dedication of commercial-grade design and analysis computer programs used in safety-related applications for nuclear power plants.
General Observations The staffs feedback was informed by the guidance in RG 1.232. RG 1.232 Sodium-Cooled Fast Reactor (SFR) Design Criteria (SFR-DC) 26, Reactivity control systems, requires at least two reactivity control systems or means, capable of inserting negative reactivity and maintaining reactor shutdown under all applicable conditions. ARC proposed to meet this requirement through the design of the primary and secondary control rod assembly (CRAs), along with the performance characteristics of the fuel assemblies and ducts, to ensure unobstructed CRA insertion.
While SFR-DC 26 provides essential characteristics, SFR-DC 28, Reactivity limits, also limits the magnitude and rate of reactivity increase to protect the primary coolant boundary and core.
This is addressed primarily through control rod drive system (CRD) design, supported by fuel and CRA acceptance criteria to ensure core integrity. Similarly, SFR-DC 29, Protection against anticipated operational occurrences, requires the reactivity control system to perform its safety function with extremely high probability during an anticipated operational occurrence (AOO). As the ARC design evolves, consistency with cited SFR-DCs will depend in part on the fuel design, control element design, and the design of the protection and reactivity control systems to ensure reliability. Such information should be provided in future submittals.
ARC proposed that an approach consisting solely of two rod-based systems is sufficient without a non-rod-based alternative shutdown system. The staff considered this proposal against the criteria of SFR-DC 26 that a minimum of two reactivity control systems or means shall provide:
(1) A means of inserting negative reactivity at a sufficient rate and amount to assure, with appropriate margin for malfunctions, that the design limits for the fission product barriers are not exceeded, and safe shutdown is achieved and maintained during normal operation, including anticipated operational occurrences.
(2) A means which is independent and diverse from the other(s), shall be capable of controlling the rate of reactivity changes resulting from planned, normal power changes to ensure that the design limits for the fission product barriers are not exceeded.
(3) A means of inserting negative reactivity at a sufficient rate and amount to assure, with appropriate margin for malfunctions, that the capability to cool the core is maintained and a means of shutting down the reactor and maintaining, at a minimum, a safe shutdown condition following a postulated accident.
(4) A means for holding the reactor shutdown under conditions which allow for interventions such as fuel loading, inspection and repair shall be provided.
In the WP, the two proposed rod-based reactivity control systems, the primary CRA and secondary shutdown assemblies (SDA), differ in geometric design, actuation, drive-in method, working principles, latching mechanisms, and support systems. These differences are intended to meet SFR-DC 26 requirements while adhering to the principles of defense-in-depth. Based on the information given in the WP, the staff observed the following key distinctions between the CRA and the SDA.
In terms of functional roles, the CRA consists of independently controlled absorber assemblies that provide startup control, power regulation, burnup compensation, and rapid shutdown capabilities. In contrast, the SDA does not participate in power regulation during normal operation; its rods remain fully withdrawn and stationed above the core. The SDA serves solely as an independent shutdown system, providing a backup capability if the CRA fails to achieve reactor shutdown.
In terms of geometry, the CRA consists of six hexagonal absorber assemblies, each containing seven helically wrapped boron carbide (BC) pins housed within an HT9 duct, with an approximate 9 millimeter (mm) annular clearance to the external duct. In contrast, the SDA comprises three cylindrical absorber assemblies containing eight compacted BC pellets, arranged with seven equal-diameter pins surrounding a larger central pin, all enclosed within a cylindrical sheath. The SDA sheath features an average gap of 11 mm and a minimum gap of 6.73 mm relative to the external duct.
In terms of actuation, the CRA is held in position by dual electromagnetic solenoids, which de-energize during a scram to allow gravity-driven insertion. The SDA, in contrast, uses a mechanically actuated latch with motor-driven insertion and optional pneumatic assistance, providing functional independence from the CRAs actuation system.
In terms of drive-in and work principles, the CRA utilizes roller-nut shim motors to achieve precise positioning during normal operation and to ensure complete insertion during a scram, supporting both reactivity regulation and rapid shutdown functions. In contrast, the SDA employs a rack-and-pinion mechanism, supplemented by gravity and optional pneumatic assistance, serving exclusively as a shutdown system rather than a power regulating mechanism.
In terms of latching and gripping, the CRA relies on continuous electromagnetic holding to maintain rod position, whereas the SDA employs a mechanical latch that remains engaged without continuous power, providing electrical independence.
In terms of power and logic, the CRA is integrated with the Reactor Protection System (RPS),
with electrically actuated solenoids and motor drives, drawing on electrical circuits for both control and scram initiation, while the SDA is actuated by mechanical release and pneumatic drive, independent of CRA electrical logic and thus resistant to shared-cause electrical failures.
In terms of sourcing and vendor basis, the CRA design follows established SFR practices with conventional vendor support, whereas the SDA employs a mechanically and pneumatically based system with a distinct supply chain and technological basis to ensure a principle of diversity.
The staff makes the following specific observations regarding this information:
- 1. Based on the comparative observations summarized above, the staff notes that the CRA and SDA designs provide reasonable functional and design diversity, independence, and redundancy consistent with SFR-DC 26, SFR-DC 28, and SFR-DC 29. The differences in geometry, actuation, drive mechanisms, latching, power and logic integration, and sourcing appear to align with RG 1.232 guidance.
However, while the proposed design supports geometric diversity, defense-in-depth, and possibly reduces susceptibility to common-cause failures, the staff notes that a smaller minimum clearance of the SDA compared to the CRA may present a potential vulnerability.
Although the SDA has a larger average clearance (11 mm) compared to the CRAs nominal clearance (9 mm), its minimum clearance (6.73 mm) is smaller than the CRAs nominal value. This smaller minimum clearance could increase the risk of insertion issues, such as duct binding under deformations not accounted for in the design. While ARC proposed a forced-insertion mechanism to address potential binding, the reduced minimum clearance could still compromise the SDAs intended independence, making it susceptible to the same binding or duct deformation failure modes that the CRA was designed to avoid.
To assure sufficient redundancy, diversity, and independence of the shutdown mechanisms, the design should ensure that the secondary system is not susceptible to the same failure modes as the primary system; for example, this could be achieved by increasing the minimum clearance between the pins and ducts.
- 2. The staff observed that the mechanical latching system on the SDA does not appear to fail safe on a loss of electrical power, in that the latch would remain engaged and maintain the SDA suspended above the core. Additional clarification regarding why electrical independence is more important than maintaining a condition where the maximum number of control and shutdown rods would insert on a loss of power would be helpful to support the staffs understanding in its review of a future licensing submittal.
- 3. In the WP, several computational codes are referenced, including NUBOW-3D, Argonne Reactor Computation, MC2-3, and DIF3D, which were used to support various evaluations, claims and conclusions. The staff notes that, although many of these codes and methods have a history of successful application in SFR design and analysis, few have been reviewed or approved by the NRC for licensing purposes. To ensure the acceptability of these tools, ARC may consider the guidance provided in RG 1.231 and relevant parts of American Society of Mechanical Engineers (ASME) Nuclear Quality Assurance-1 (NQA-1),1 such as, Part II, Subpart 2.7, Quality assurance requirements for computer software for nuclear facility applications, which addresses computer software used in nuclear applications.
- 4. WP section 2.4, Core Deformation, provides estimates of duct and assembly deflections.
WP figure 2-7, Elevation view of residual bowing deformation from the center to the outer core showing permanent assembly bowing and contact during refueling, and table 2-1, Maximum Deflections of Control and Safety Rod Assembly Ducts at BOL (beginning of life),
MOL (middle of life), and EOL (end of life), present the calculated deformations. In section 2.6, ARC asserts that the probability of the control rods or safety rods being unable to insert due to core deformation is extremely small, based on these calculated deformations.
This assertion would be reasonable based on the NUBOW-3D results. However, to substantiate this low probability assertion, the deformation results should be further validated in future submissions. Given that the reported deformations are specified to two decimal places in millimeters, achieving such high precision may be challenging. This is significant because the clearances between the pins and ducts are small, and deviations from nominal estimates could hinder rod insertion, potentially compromising the backup functionality and reliability of the SDA system.
Further, the WP does not address the potential for deformation and control rod-to-duct interaction that could occur from a seismic event. These effects could inhibit control rod insertion during or after seismic events, or result in a degraded reactivity insertion curve, even in the presence of motor drive-in capability. Potential SFR fuel failures may result from certain transients even while inserting negative reactivity because the speed of the reactivity insertion is not sufficient to maintain an appropriate power-to-flow ratio, as highlighted in a recent staff evaluation of a preliminary SFR design (ML2539A252).
- 5. In WP section 3, Potential Alternate Shutdown Schemes, ARC evaluated conceptual alternate designs and assessed their applicability in the ARC-100 design with supporting justifications. The staff reviewed the evaluations and observed that ARCs justification on accepting or rejecting the different options is reasonable. Based on the assessments made in table 3-1 (Alternate) Passive Shutdown Schemes, of section 3, ARC proposed B4C spheres as the alternate shutdown scheme for ARC-100 design in section 4. In this alternative shutdown concept, the RPS releases B4C spheres as an absorber system, introducing negative reactivity into the core to shut down the reactor, analogous to a control rod system but using discrete neutron-absorbing spheres instead of rods.
In section 5.2, If Needed, a Proposed ARC-100 Alternate Shutdown System, ARC asked if the staff would consider the concept of an alternative shutdown system employing BC spheres, if the two rod-based shutdown systems was not acceptable. This concept was previously proposed and evaluated by the NRC in section 4.5 Active Reactivity Control and Shutdown System, and section 4.6 Passive Safety System Design, of NUREG-1368, Preapplication Safety Evaluation Report for the Power Reactor Innovative Small Module (PRISM) Liquid-Metal Reactor (ML063410561). The staff observed that those prior 1 ASME NQA-1 Part II, Subpart 2.7, Quality assurance requirements for computer software for nuclear facility applications.
assessments remain applicable to the ARC-100 design. In NUREG-1368, a principal concern identified was the inherent delay in reactivity insertion when using BC spheres compared to the immediate response of control rod insertion. Nevertheless, the staff observed that the sphere-based shutdown concept is reasonable, provided that its effectiveness in reliably inserting negative reactivity into the core is sufficiently demonstrated.
- 6. WP appendix A, SFR DC 26, NRC rationale for adaptation, provides ARCs justification for updating advance reactor design criteria 26 and discusses ARCs interpretation of the reactivity control requirements from GDC 26, Reactivity control system redundancy and capability, and 27, Combined reactivity control systems capability. ARC acknowledges the need for inserting negative reactivity at a sufficient rate to protect fission product barriers, while distinguishing between safety-related shutdown functions and reactivity control for normal operation. While most of the rationale provided by ARC is consistent with the SFR-DCs, the staff notes that classifying the inherent negative reactivity feedback of the ARC-100 design as a shutdown means presents challenges, as described below.
In 1986, Experimental Breeder Reactor-II (EBR-II) conducted two safety demonstration tests: (1) a loss-of-flow without scram test, and (2) a loss-of-heat-sink without scram test. In both cases, operators shut down the pumps in either the primary or secondary loop and disabled scram capabilities. In response, physics-based natural feedback, fuel, core, and CRD expansion, doppler broadening, and other reactivity effects, slowed and ultimately reversed the power rise, followed by a rapid power decrease. No fuel damage was observed. These tests demonstrated EBR-IIs safety characteristics and its ability to stabilize core temperatures and maintain controlled conditions without operator action or active systems.
However, inherent negative reactivity feedback does not fully constitute a shutdown mechanism, as it cannot reliably maintain the reactor subcritical. Instead, if relying solely on inherent feedback mechanisms, the reactor will oscillate around a zero-power condition.
Moreover, the potential for positive sodium void worth limits reliance on passive safety features and necessitates further qualification. The availability of diverse shutdown systems (CRA and SDA) appropriately reduces dependence on passive feedback for power reduction. While widespread sodium voiding is unlikely, it cannot be entirely excluded.
Additionally, crediting passive feedback relies on maintaining sodium below its boiling point.
In a failure-to-scram scenario, widespread sodium boiling could lead to a severe power excursion and, potentially, more severe accidents. Similarly, under conditions involving substantial sodium coolant loss, negative feedback may not be assumed. Past fuel melt incidents, such as EBR-I (1955, power excursion) and Fermi-I (1966, coolant channel blockage), underscore the potential consequences when feedback effects are insufficient.
Finally, reliance on inherent feedback mechanisms to meet SFR-DC 26 presents a challenge because these feedback mechanisms have uncertainties that can be relatively substantial and difficult to characterize conservatively for both the initial turnaround in power and the potential for recriticality later in the transient. In an SFR, these uncertainties are compounded by the use of designs where there is limited validation data (such as rod bow in a core restraint system) and the long duration of transients.
That said, while challenging to characterize as a shutdown means, negative reactivity feedback plays an important role in transient behavior. It is expected to stabilize the reactor at elevated temperatures; however, in the absence of control rod insertion, the reactor may remain critical rather than achieve cold shutdown.
- 7. WP appendix B ARC-100 RPS Common Cause Failures, provides an evaluation of potential common-cause failures. Figure B-2 Reactor Protection System (RPS) Scram Logic, illustrates the minimal RPS scram trip matrix (control rod run-in). The staff notes that the list may be expanded to address additional parameters. For example, a future submittal should include additional clarification on how the RPS would respond to certain scenarios such as seismic events, sodium leak detection, fire detection, sodium-water reactions (resulting in hydrogen in sodium), or RPS logic self-tests failures, and clarify whether these scenarios were considered in the probabilistic safety assessment.
- 8. WP appendix C Shutdown Systems (Including Alternate) Proposed by Other Reactors, summarizes shutdown system designs from other non-light-water reactor designs and associated regulatory documents.
For example, Kairos Power, LLC Hermes design employed a geometrically distinct and significantly different design for the secondary SDA. PRISM initially utilized rod-based CRAs and a BC ball system but later switched to two rod-based systems. TerraPower, LLC (TerraPower) Natrium design, also employed two rod-based systems. As ARC indicated, NRC staff found the Natrium approach to SFR-DC 26 generally reasonable, as it credited two rod systems with different geometries and insertion methods, supported by probabilistic risk assessment (PRA) insights. In addition, TerraPower indicated that it is committed to verify secondary system performance for Natrium (ML23024A281).
The staff observed that in the proposed ARC-100 reactivity control system design, the secondary absorber bundle of the SDA differs from the primary absorber bundle of the CRA in terms of bundle configuration (circular versus hexagonal), pin size (7 equal absorber pins versus 7 equal pins surrounding a larger central pin), duct geometry, and nominal clearances. The staff notes that these constitute reasonable geometric differences, except for the minimum clearance that was discussed earlier.
Staffs response to ARC requested questions In addition to considering the technical information in the WP and providing general feedback, ARC requested that the staff respond to the following specific questions.
- 1. Does the proposed shutdown system, including its absorber elements, actuation methods, drive mechanisms, and deformation prevention/detection features, contain all the necessary elements, or should ARC provide additional information at this stage?
Conceptually, the WP provides the information necessary to demonstrate that the proposed design incorporates diverse absorber configurations, actuation methods, and drive mechanisms. Supported by the inherent safety features and negative reactivity feedback characteristics of the SFR, the staff notes that ARCs proposed use of two rod-based shutdown systems is a reasonable approach that generally aligns with the intent of RG 1.232, provided sufficient redundancy and diversity can be demonstrated, and that there is sufficient reliability of the scram system. The staff anticipates requesting additional details regarding supporting simulations if ARC submits a licensing action for the ARC-100 design to the NRC.
- 2. Has ARC provided sufficient information to support the conclusion that the likelihood of core or assembly deformations impeding rod insertion is very low?
ARC provided analysis of core deformations, including NUBOW-3D analysis, periodic measurements and design features to accommodate potential deformations. While these measures collectively support a case that the likelihood of deformations impeding rod insertion is low, in future submissions, ARC should consider providing further details on corroboration of deformation estimates from simulations, system validation, including performance under various operational scenarios, detection measures, and contingency plans for unexpected failures. As discussed above, the NUBOW-3D core and assembly deformations do not account for seismic effects, which the staff identified as potentially significant to control rod insertion. The staff also notes that reliance on motor drive systems to overcome insertion forces may be challenging because the system will have to be designed to withstand compressive loading, with margin to account for uncertainties. As also discussed above, significant insertion forces may affect the speed of reactivity insertion.
- 3. Has ARC provided an adequately comprehensive assessment demonstrating the high reliability of the shutdown system to safely shut down the reactor?
SFR-DC 29 requires the reactivity control system to be designed to assure an extremely high probability of accomplishing its safety function in the event of an AOO.
While the ARCs overall approach appears reasonable, additional detail is needed to support a future licensing submittal, particularly regarding verification and validation of the results. For example, although the WP presents some insights from probability calculations using SAPHIRE, it is not clear to the staff whether estimates appropriately account for potential rod binding due to core deformation. The WP concludes that binding is highly unlikely, based on negligible deformation predicted by the NUBOW-3D code. However, this conclusion is derived solely from simulation results and is not supported by adequate verification or validation of the code predictions, which limits the confidence in the assessment.
The staff notes that the RPS failure frequency reported in section 2.3 of the WP is consistent with what has been observed for similar protection systems. However, the staff also notes that failure of RPS is not the only contributor to a failure of control rods to insert. A more comprehensive evaluation of the CRD system is needed to support staff conclusions regarding the reliability of the shutdown system.
Additional Remarks Though not noted in the WP, during a public meeting with the staff (ML25157A133), ARC stated its intent to utilize the proposed 10 CFR Part 53, Risk-Informed, Technology-Inclusive Regulatory Framework for Commercial Nuclear Plants, as their licensing path, once finalized.
As of the date of this feedback, the final 10 CFR Part 53 rule has not been published. The staff's observations below relate primarily to the development of PDCs leveraging RG 1.232 and associated technical considerations regarding the design of reactivity control systems.
Additional considerations may need to be addressed to demonstrate that ARCs approach is consistent with the requirements of 10 CFR Part 53 when it is finalized.
Specifically, under 10 CFR Part 50, PDCs establish the necessary design, fabrication, construction, testing, and performance requirements for structures, systems, and components (SSCs) of a proposed facility to provide reasonable assurance that the facility can be operated without undue risk to the health and safety of the public. The minimum requirements for PDC for water-cooled nuclear power plants are provided in the GDCs in Appendix A to 10 CFR Part 50.
A related concept included in the 10 CFR Part 53 proposed rule (89 Federal Register 86918) is that of functional design criteria, which would serve a similar purpose to PDCs in that they also describe requirements for SSCs and human actions needed to satisfy design features.
However, under the 10 CFR Part 53 proposed rule, the functional design criteria would be required to be developed based on a holistic analysis of the design using risk analyses and other generally accepted approaches for systematically evaluating engineered systems. In that regard, while the PDC for advanced non-light-water reactors described in RG 1.232 could potentially provide a useful starting point for the development of functional design criteria, the analysis requirements under the 10 CFR Part 53 proposed rule, should they remain in the final rule, would still need to be met.
Summary The staff considered the information provided in the WP and notes that ARCs proposed use of two rod-based shutdown systems is a reasonable approach that generally aligns with the intent of SFR-DC 26. Supported by the inherent negative reactivity feedback characteristics of an SFR with metallic fuels, the two rod-based systems are expected to provide layered shutdown capability (defense-in-depth) by employing diverse geometries, mechanisms, latches, and vendors, maintaining independence of function and actuation paths, and delivering redundant negative reactivity insertion means consistent with SFR-DC 26. In addition, it can also be supportive of SFR-DC 28 and SFR-DC 29 when paired with appropriate CRD and fuel acceptance criteria.
The staff notes that the secondary systems reduced minimum clearance relative to the primary could limit the intended margin against insertion or binding under deformation, and expects future submissions to demonstrate its performance, considering the integrated risk assessment, failure mode and effects analysis of CRA and drive system failure analyses, and more comprehensive safety evaluation.