ML20195H904

Confirms Understanding That Issuance of SER Will Not Constitute Approval of Power Reactor Inherently Safe Module Design

ML20195H904
Person / Time
Issue date:	11/22/1988
From:	Remick F Advisory Committee on Reactor Safeguards
To:	Zech L NRC COMMISSION (OCM)
References
ACRS-R-1326, NUDOCS 8812010110
Download: ML20195H904 (5)

Text

. _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - _ _ _ _ _ _ _ ._ _ _ _ _ _ _ _ _ _

. . WRM-196 tok

1. UNITED STATES

! g NUCLEAR REGULATORY COMMISSION

1. ADVISORY COMMITTEE ON REACTOR SAFEGUARD 4 (

• wAsmorow. o. c.aoses

/

November 22, 1988 The Honorable Lando W. Zech, Jr.  !

Chairman U.S. Nuclear Regulatory Comission '.

Washington, D.C. 20555

SUBJECT:

SAFETY EVALVATION REPORT FOR THE "POWER REACTOR INHERENTLY SAFEMODULE"(PRISM) DESIGN During the 343rd meeting of the Advisory Comittee en Reactor Safe-  !

guards, November 17-18, 1988, we reviewed a draft of the subject safety ,

evaluation report (SER). The ACRS and its Subcomittee on Advanced  !

Reactor Designs have reviewed these matters in previous meetings. I During these meetings we had the benefit of discussions with representa- ,

tives of the NRC staff and its consultants, and with representatives of '

the Departnent of Energy (DOE) and its contractors, including represen- ,

l tatives of the General Electric Company, the lead design contractor. We i also had the benefit of the docunents referenced. 1 The PRISM conceptual design is a product of a 00E progran to develop 1

designs for possible future power reactor systems that would have ,

enhanced safety characteristics. Oth.r design projects in the progran are the Modular High Temperature Gas-Cooled Reactor (MMTGR) and the  !

Sodium Advanced Fast Reactor (SAFR). The NRC staff is reviewing these designs in accordance with the Comissico policy on Advanced Nuclear l Power Plants. These preapplication revicws are intended to provide NRC guidance on licensing issues at a relatively early stage of design  !

development. The ACRS has previously comented to you on NUREG-1226, "Develernent and Utilization of the NRC Policy Statement on the Regula- t tion of Advanced Nuclear Power Plants," in June 1987, on key licensing issues associated with th entire program in July 1988, and on the SER for the MHTGR in October 19P.8. i We understand that issuance of the SER will not constitute approval of '

the PRISM design. Further engineering developrent and docurentation will be required to support a future applicatien for design certifica- i

) tion.

The PRISM design incorporates several small, redular reactors cooled by liquid sodium. The standard PRISM plant would consist of nine reactor w dules, each generating 425 MWt, previding a total plant output of 1245  ;

{

1 i i 881 010110 881122 gys b-13; PDC ,

o

The Honorable Lando W. Zech, Jr. November 22, 1988 i

MWe. Each reactor, along with its intermediate heat exchanoers and pumps, is imersed in a pool of sodium. A steel vessel contain'ing this pool is located within a secondary steel container. The steel con-toiners share a comon head. Each such unit is installed within an underground concrete silo. Secondary sodium coolant flows to steam generators which are also located below grade, but are outside the silo '

alongwiththeremainderofthe"balanceofplant"(BOP) equipment.

The PRISM design provides several features for enhancing safety of a nuclear power plant. '

' a passive system for emergency removal of decay heat  !

• inherent p.'thanisms for negative feedback of reactivity

' large thermal inertia in the pool of sodium toolant

• metal fuel, offering greater opportunity for on-site fuel -

reprocessing

• small component sizes, providing opportunities for factory fabrication i

' opportunity for prototype testing of a single module

' separation of safety-related functions from BOP systems On the basis of its review, the NRC staff has concluded that the PRISM design has the potential for a level of safety at least equivalent to i current light water reactor (LWR) plants, provided that a nurber of L specific issues are resolved. Our general recomendation is that, from j t4e perspectivv of safety and licensing, design development of PRISM  !

should continue, taking into account the points made by the staff. l t

A number of safety issues remain to be completely addressed, a prcgram  !

of continuing research and developnein is necessary to support furtoer i design, and plans for extensive prototype testing should be developed -

In the follewing paragraphs we corrent on a number of specific safety  !

issues which we believe should be considered by the staff in its final  !

SER, and by DOE in its continuing development and design activities.

Containment Although a secondary vessel is provided to contain leakage of sodium coolant, the PRISH design does not include a conventional containcent  ;

capable of resisting high terperatures and pressures. It is contended l that the potential for core disruptive accidents, for which such a ,

i t

I

The Honorable Lando W Zech, Jr. 3- November 22, 1988 containment might provide mitigation, is so low that a conventional containment is not needed. Both deterministic and probabilistic argu- (

ments are made in support of this contention. Although these arguments i have technical mecit, we are not yet convinced. Our position is as '

stated in our report to you of July 20, 1988 on the key licensing issues associated wi'.h DOE sponsored reactor designs and our report to you of October 13, 1988 on the preapplication safety evaluation report for the modular high temperature gas-cooled reactor.

However, there is a problem. One reason for providing a strong physical containment is to protect the public against unfo eseen ac .idents. But, precisely because they are not foreseen, the design requirements for a containment are not obvious. Therefore, engineering and policy judg-ments must be made about the need for, and n:ture of, containment th6t might be used with PRISM. We believe that further study is appropriate before final judgments are made.

Absence of a Backup Shutdown System The PRISM design provides a control rod system coasisting of six control r3ds, a safety grade means of scranning these rods by gravity, and a safety grade electrical system to drive the rods into the core. How-ever, the design provides no backup to this control rod system other than the inherent characteristics of the core. We question whether these inherent characteristics are adequate as a backup system, for two reasons. First, they may not act fast enough to compensate for certain fast transients without scram. Second, they are not capable of making the reactor suberitical and taking it to cold shutdown conditions.

Therefore, we believe the need for a backup system or suitable demon-stration of scram reliability deserves further study.

Need for Local Flow and Temperature Monitorini The PRISM safety analysis indicates that blockage of flow through one fuel assembly may possibly damage that assembly, but will not damage adjacent assemblies. Early work wlth oxide fuel has demonstrated that 3ropagation is unlikely, but experiments and analysis with metal fuel lave not been as extensive. Especially because the design does not provide for monitor ing flow and effluent temperature from individual assemblies, we believe this requires further study.

l l

Individual Rod Worth Each of the six control rods is sufficient, individually, to shut down the reactor and maintain it in cold shutdown. Therefore each rod has a very large reactivity worth, e' out two dollars. There is thus potential i

1 The Honorable Lando W. Zech, Jr. November 22, 1988 for serious consequences from a rod ejection accident. This potential is ameliorated in two ways. First, for startup, rod operations are interlocked so that the rods can be withdrawn only in a carefully orchestrated sequence. This rod sequencing system will have to be very carefully designed, operated, and maintained. Second, for power opera- I tion, the expected reactivity change of a core through its lifetime is l expcted to be so flat that only very small rod insertion will be necessary at the beginning of core life, thus reducing the effect of a I rod ejection accident. These features will be effective only with I accompanying administrative controls on core design and rod operation over the lifetime of PRISH plant operaticns. This should be acknowl-edged in the SER.

Role of the Operator he believe that insufficient attention has been given to the role of the operator. Claims that a PRISM plant would have such inherently stable and safe characteristics that the operator will have essentially no safety function are unproven. Operation of nine reactors, possibly in several different operational states at any given time, may be a daunt-ing cha11enga for the small operations crew envisioned. Opportucities for cognitive errnr, which might defeat favorable safety characterit tics of the reactor, might be more abundant than is now recognized. Fur ther study appears to be desirable.

We believe insufficient attention has been given to the physical securi-ty of the plant's cperating and technical support staff. It is claimed that the control room, with all of its contents, including operating personnel, can be destroyed and that the plant can be safely shut down

from i note control stations that are within the physical security l controllet treas of the plant. Therefore, the control room and techni-l cal support areas are now proposed to be located outside the physical security boundary. We believe, given an external threat, such as an attack by terrorists, that it is essential to preserve the operating and l technical expertise on-site, and reconnend that the control room and I

appropriate technical support personnel be located within the physical security boundary.

Other Operational Considerations In addition, certain features that have been found to be desirable in LWR plants are not provided in the PRISM design. No technical support center is provided. Although remote shutdown capability is provided, it appears to lack some of the attributes of such systems in current LWR plants. Also, the design does not include Class 1E AC electric power systems, but relies entirely on IE DC pcwer from batteries. It is not clear that adequate consideration has been given to the potentially

The Honorable Lando W. Zech, Jr. November 22, 1988 l

J 1arge power needs of essential auxiliary functions such as space cooling j and emergency lighting.

Protection Against Sabotage With regard to the need for designing protection against sabotage, the ,

following statement from our report of July 20, 1988 should be given j early consideration as the design of this plant progresses:

"It is of ten stated that significant protection against sabotage can be inexpensively incorporated into a plant if it is done early in the design )rocess. Unfortunately, this has not been done consistently because the NRC has developed no Cuidance or requirements specific for plant design features, and there seems to have been no systematic attempt by the industry to fill the resulting vacuum. We believe the NRC can and should develop some guidance for designers of advanced reactors. It is probably unwise and coun-terproductive to specify highly detailed requirements, as those for present physical security systems, but an attempt should be made to develop some general guidance."

Sodium Fires Further study of the potential for and suppression of sodium fires and consideration of their possible consequences is needed. Such studies should include the possibility of fires resulting from earthquake effects.

Sincerely, l Forrest J. Remick Acting Chairman l

References:

1. Office of Nuclear Regulatory Research, "Safety Evaluation Report for the Power Reactor Inherently Safe Module (PRISM)/ Liquid Metal Reactor Conceptual Design," dated September 10, 1988 (Predecisional Draft)

2. General Electr:c/ Nuclear Systems Technology Operation (DOE Con-l tract), GEFR-00793, "PRISM Preliminary Safety Infornation Docu-ment," Volumes I through Y, 1986 L

.