ML21050A431

LLC - Lessons-Learned from the Design Certification Review of the NuScale Power, LLC Small Modular Reactor

ML21050A431
Person / Time
Site:	NuScale
Issue date:	02/19/2021
From:	Bergman T NuScale
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
LO-0221-74035
Download: ML21050A431 (26)

Text

LO-0221-74035 February 1, 2021 Margaret M. Doane Executive Director of Operations U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Lessons-Learned from the Design Certification Review of the NuScale Power, LLC Small Modular Reactor

Dear Ms. Doane:

This letter presents lessons learned from the U.S. NRC review of the NuScale Power, LLC (NuScale) design certification application (DCA). These lessons learned are not comprehensive.

Rather, they are limited to those that can be implemented in time, and offer substantial enhancement, to support submission and review of the next iteration of the NuScale small modular reactor (SMR) for standard design approval (SDA) in 2022.

The recommendations are:

1. Establish an appeal process to resolve disagreements between applicants and the NRC staff with respect to preliminary interpretations of requirements and guidance. The consequence of the absence of such a process is that regulatory burden has steadily increased from one applicant to the next without consideration of whether new staff positions have merit from a safety perspective.

2. Implement risk-informed decision making consistent with the Commissions direction in Staff Requirements Memorandum SRM-SECY-19-0036 to apply risk-informed principles when strict, prescriptive application of deterministic criteriais unnecessary to provide for reasonable assurance of adequate protection. NuScale did not observe application of the SRM in the DCA review outside the specific decision rendered by that SRM. The consequence of this limited application increased review durations and costs even where risk insights demonstrated adequate protection.

3. Define credible. Numerous NRC requirements incorporate the concept of credible. The consequence of a lack of a definition is unpredictability in the review as interpretations vary among the staff, resulting in increased review durations and costs even for events of incredibly low frequencies and often with insignificant radiological consequences. In a complementary effort, NRC should endorse IAEA standard SSR-2/1 as an acceptable method for evaluating the adequacy of defense in depth.

4. Rely on downstream requirements and programs to supplement design detail and test data as part of NRC safety findings. Downstream programs include programs required by regulation; e.g., Appendix B quality assurance, the ASME Code, and ITAAC. The Thomas Bergman

• Vice President, Regulatory Affairs www.nuscalepower.com 11333 Woodglen Dr., Suite 205, Rockville, MD 20852

• Phone: 541.360.0740

• Email: tbergman@nuscalepower.com COPYRIGHT © 2021 NUSCALE POWER, LLC.

Thomas A. Bergman LO-0221-74035 February 1, 2021 consequence of not relying on these required programs is increased cost and time to develop applications and obtain approval, without improving the safety of the constructed facility. In the case of the NuScale DCA, application development and review costs exceeded half a billion dollars.

5. Clarify the role of the Advisory Committee on Reactor Safeguards (ACRS). The ACRSs approach during the NuScale DCA review worked because the NuScale SMR was the only advanced reactor design under review. However, it was unnecessarily broad and burdensome and the same approach may not work if there are multiple advanced reactor designs under review, as expected in the near future. The consequence of not clarifying the role of the ACRS is that the ACRS, due to resource constraints, may delay the approval and deployment of nuclear power plants with advanced safety features.

The enclosure to this letter provides more information and justification for these recommendations. It includes an appendix that provides NuScales detailed perspective on Staffs proposal in SECY-21-0004 to exclude from issue resolution the design of NuScales combustible gas monitoring equipment. This example illustrates the purpose and benefits of implementing these five recommendations.

The enclosure discusses NuScales perspective as a light-water SMR applicant seeking design certification; the lessons-learned and recommendations are broadly applicable to other designs and licensing processes under the Part 50 and 52 regulatory framework. Discussions between NuScale and other advanced reactor developers and industry organizations indicates support for these recommendations. Assuming some of these entities express interest to the NRC, NuScale encourages the NRC to engage all stakeholders, industry and the public, to develop implementation approaches for these recommendations on a priority basis. In order to incorporate these recommendations into the forthcoming NuScale SDA application and review of that application, the recommendations should be in place by mid-2022.

I appreciate your consideration of these recommendations. If you have any questions, please contact me at 541.360.0740 or at tbergman@nuscalepower.com.

Sincerely, Thomas Bergman Vice President, Regulatory Affairs

'LVWULEXWLRQ6FRWW0RRUH([HFXWLYH'LUHFWRU2IILFHRIWKH$&56

$QQHWWH/9LHWWL&RRN6HFUHWDU\RIWKH&RPPLVVLRQ

&KDLUPDQ&KULVWRSKHU7+DQVRQ

&RPPLVVLRQHU-HII%DUDQ

&RPPLVVLRQHU$QQLH&DSXWR

&RPPLVVLRQHU'DYLG$:ULJKW

(QFORVXUH/HVVRQV/HDUQHGIURPWKH'HVLJQ&HUWLILFDWLRQ5HYLHZRIWKH1X6FDOH6PDOO 0RGXODU5HDFWRUQRQSURSULHWDU\

2 l nuscalepower.com

• COPYRIGHT © 2021 NUSCALE POWER, LLC.

LO-0221-74035 Enclosure Page 1 of 16 Lessons-Learned from the Design Certification Review of the NuScale Small Modular Reactor 1.0 Purpose and Summary This report identifies and discusses significant issues and challenges NuScale observed during the NRCs review of the NuScale design certification application (DCA), and identifies potential improvements in the review process to ameliorate these challenges for future applications.

Starting with the NuScale DCA, NRC has begun a period of reviewing novel reactor designs at what may prove an unprecedented pace, with several advanced light water and non-light-water reactor designs in various stages of active review, pre-application consideration, or under development for future submittal.

Amongst those designs in pre-application is the next iteration of NuScales light-water small modular reactor (SMR), planned for submittal for standard design approval (SDA) in 2022.

NuScale views the issues addressed herein as major challenges for efficient and timely review of a new reactor design, and those that are of utmost concern for the NRCs attention prior to submittal of the SDA application. This report discusses NuScales perspective as a light-water SMR applicant seeking design certification. The lessons-learned are broadly applicable to other designs and licensing processes under NRCs Parts 50 and 52 frameworks. The recommendations are:

1. Establish an appeal process. Presently an applicant has no clear or established means to challenge Staffs preliminary conclusions on the adequacy of the design with respect to regulatory requirements. In order to promote regulatory clarity, certainty, and efficiency, a process and arbiter should be established to consider and decide significant disagreements in a timely manner.

2. Implement risk-informed decision making consistent with the Commissions Staff Requirements Memorandum SRM-SECY-19-0036. The Commission directed the Staff to apply risk-informed principles when strict, prescriptive application of deterministic criteriais unnecessary to provide for reasonable assurance of adequate protection. NuScale supports this position, but has not yet seen it applied outside the specific decision rendered by that SRM. The Commissions direction needs to be effectively implemented by the NRC Staff, ACRS, and, if established, appeal body in their respective deliberations.

3. Define credible. Numerous NRC requirements incorporate the concept of credible. The lack of its definition results in inconsistent interpretation of which events must be evaluated by applicants and reviewed by the NRC Staff. NuScale was required to evaluate events with frequencies orders of magnitude less than the Commissions safety goals or the 10-6 per reactor year limit the Commission has stated as a threshold of credibility, and in some cases even where no core damage would result. NRC should define credible with respect to various aspects of the regulatory framework. In a complementary effort, NRC should also establish IAEA standard SSR-2/1 as an acceptable method for evaluating the adequacy of defense in depth.

4. Rely on downstream requirements and programs to supplement design detail and test data as part of NRC safety findings. The design review process as currently implemented requires a high degree of design finalization and an enormous amount of design information to be provided by the vendor. In many cases requirements and processes downstream of the design review, such as quality assurance, the ASME Code, and ITAAC, can form the basis for a safety conclusion in lieu of additional design detail and test data. This approach can provide reasonable assurance while reducing the cost of developing applications and maintaining design standardization.

LO-0221-74035 Enclosure Page 2 of 16

5. Clarify the role of the ACRS. The ACRS review produced useful insights, but was unnecessarily broad and burdensome. In order to handle a potential influx of novel reactor design application in the near future, clarify the role of the ACRS to yield more effective and efficient reviews. This necessitates that the ACRS focus on matters of safety significance only, and rely on NRC staff interpretations of regulatory requirements and regulatory process issues.

2.0 Background NuScale completed the first NRC review of an advanced reactor application, and overall the NuScale DCA review was a success. Staff completed review of the first small modular reactor design in 41 months following docketing of the application. The review was thorough; it involved over a quarter million review hours, about two million pages of documentation made available for review or audit, and about 100 gigabytes of test data. The ACRS conducted some 40 meetings1 totaling approximately 440 hours0.00509 days <br />0.122 hours <br />7.275132e-4 weeks <br />1.6742e-4 months <br />.

While successful, the level of effort for reviewing the NuScale DCA may not be repeatable for future reviews. Significant resources were expended on issues with little bearing on the safety of the design, matters well beyond the purview of reasonable assurance of adequate protection. Several issues were left unresolved by Staff, which could have been avoided were the recommendations here in place. During the course of review, NuScale identified several overarching problems with the review process and review criteria that could yield significant efficiencies in the review of future applications, without impacting the effectiveness of NRCs review.

3.0 Discussion 3.1 Appeal process 3.1.1 NuScales experience and problem statement With an application review process as extensive and thorough as NRCs, it is expected and common that technical experts from the applicant and Staff will disagree on aspects of a design under review. Thus, as with each applicant before, Staff and NuScale grappled with numerous disagreements concerning the design, ranging from minor to significant.

Each disagreement is a source of delay in the application review, and thus a cost borne by the applicant.

To some extent, of course, such issues are a normal part of the review process and to be expected and, in most instances, such disagreements were resolved through the ordinary course via an exchange of information in RAI responses and in public meetings. Too often, NuScalelike previous applicants effectively has little choice but to concede Staffs position in order to keep the application moving forward toward completion of the Final Safety Evaluation Report (FSER), even where NuScales technical experts view a change as unwarranted and of no safety benefit. For NuScale, the impact of conciliations has been significant, cumulatively and in some cases individually. At a minimum, each required a change in the licensing basis and underlying engineering work to support it. For some there was a material change to the design or future operations, with no justified safety benefit.

In some cases, though, because of a significant negative impact to NuScales design, the cost of complying with Staffs position, or a risk of regulatory uncertainty, NuScale was unwilling to concede for expediency and reached an impasse with Staff. In the case of the inadvertent block actuation (IAB) device, NuScale sought to elevate the issue. Lacking an established process for resolving these issues, 1 Advisory Committee on Reactor Safeguards, Report on the Safety Aspects of the NuScale Small Modular Reactor, July 29, 2020, App. I.

LO-0221-74035 Enclosure Page 3 of 16 the only option was to seek resolution from the Commission directly.2 Even though the Commission was responsive, that resolution was an inefficient use of resources and would be inappropriate for questions where policy issues do not exist. The case of reactivity control and General Design Criterion (GDC) 27, discussed below, is another example where NuScale sought to elevate the issue but lacked an established way to do so.

NuScales novel SMR technology differs substantially from the designs reflected in NRCs current regulations and guidance. NuScale observed two categories where opposing views arose often: (1) disagreement as to the meaning of a requirement or Staff position, and (2) cases where the design or application departs from an established requirement or position. The former involves a determination of whether the design satisfies or conforms to the regulation or guidance. The latter whether the proposed alternative is adequate to meet the intent of the requirement or position.

The appendix to this report details one of these significant disagreements with Staff: whether potential leakage from combustible gas monitoring following a beyond-design-basis severe accident must be accounted for in evaluating offsite and onsite dose consequences. That example illustrates NuScales difficulties with the status quo. Staffs position on the issue was fluid and not clearly documented and communicated to NuScale. In fact, other than a partial preview in a December 2019 ACRS meeting,3 NuScale first learned of Staffs final regulatory basis and position in the Final Safety Evaluation Report and the design certification proposed rule package.4 As the appendix details, NuScale has fundamental disagreements with Staff on their position because it is a departure from guidance, misconstrues the underlying regulations, and is unnecessary to reach a conclusion of reasonable assurance of adequate protection. However, NuScale lacks a process to resolve this disagreement in a timely and efficient manner. As a result, the Staffs proposed rule for design certification5 of NuScales design includes a carve out6 that is unnecessary and inappropriate, but was the only viable option to bring the Staffs review to timely completion.

Combustible gas monitoring is just one example of a substantial disagreement with Staff that resulted in unnecessary impacts to the review and licensing basis. Other examples included:

x Wall penetration radiation shielding. Staff insisted upon a level of detail for shielding penetrations that had not previously been required to reach a safety finding and that lacked a clear regulatory basis. NuScales DCA, as with previous applicants, describes the general principles and performance characteristics for the shielding of penetrations through the reactor building shield wall, but leaves the specific shielding provisions for the final design stage. Although prior Staff reviews have reached safety findings using this approach,7 Staff determined that it was inadequate for NuScales DCA and insisted that if the penetration designs were not completed for DCA, that a Tier 1 interface requirement was necessary.8 Prior DCDs did not include an interface requirement. In response to Staff, NuScale proposed a Tier 2 interface for penetration designs, an approach with far less regulatory burden. This approach is appropriate because shielding depends on final pipe routing, and penetration shielding methods are well understood. Thus, 2 NuScale Power, LLC Request for Commission Clarification on the Application of the Single Failure Criterion to Active-Passive Components, Letter LO-1218-63707, Dec. 14, 2018 (ML18351A145).

3 Transcript, Advisory Committee on Reactor Safeguards Open Session, Dec. 4 2019, pp. 124-125 (ML20029E958).

4 SECY-21-0004, Proposed Rule: NuScale Small Modular Reactor Design Certification (RIN 3150-AJ98; NRC-2017-0029), Enclosure 1, Proposed Rule, Jan. 14, 2021.

5 Id.

6 A carve out colloquially refers to excluding an aspect of the design from issue resolution within the rule certifying the NuScale design.

7 See, e.g., AP1000 DCD Tier 2 § 12.3.1.1.2, and SER § 12.4.1.

8 NRC Staff Views on the Bioshield Wall Major Penetrations Shielding, and the Reactor Building Nuclear Power Module Ventilation System Fire Damper Controls, or Ventilation Duct Radiation Source Term Description, for Discussion at July 22, 2019, Public Phone Call, ML19204A277.

LO-0221-74035 Enclosure Page 4 of 16 Staffs imposition would increase regulatory burden associated with Tier 1 without a safety benefit. NuScale was unwilling to agree to this increase in regulatory burden, and thus a carve-out was included in the Staffs proposed DC rule on this issue.9 If presented an opportunity to appeal Staffs position, NuScale would have argued that the information presented in the DCA was sufficient with respect to regulatory requirements and agency positions on the scope and level of detail necessary for design certification, as supported by precedent.

x General Design Criterion 27. As addressed by SECY-18-0099,10 NuScale disagreed with Staff on the proper interpretation of GDC 27s requirements for reactivity control under postulated accident conditions. Staffs interpretation required NuScale to request and receive an exemption from GDC 27 that NuScale believes was unnecessary. Lacking a process to formally appeal Staffs determination, NuScale could only submit a letter requesting that NuScales position be included in Staffs informational SECY paper, completed two years later, on their planned approach for resolving the issue.11 While this issue was ultimately resolved satisfactorily in accordance with Staffs position, if presented an opportunity to appeal, NuScale would have argued that NuScales design complied with GDC 27.

The problem in these instances, and others of lesser visibility, is that a process is not available to gain a clear understanding of Staffs position and the basis for it, or to appeal that position to a separate decision maker. Therefore, an applicant is forced to concede to Staffs position in order to maintain schedule and manage review costs, or to informally engage management in an effort to reach consensus. In order to promote regulatory clarity, certainty, and efficiency, a process and arbiter should be established to consider and decide significant disagreements in a timely manner.

3.1.2 Proposal An appeal process should be developed and implemented for new license applications. Specifically, where an applicant believes that Staff are misconstruing regulatory requirements, changing position on meeting requirements, or erroneously concluding the design fails to meet acceptance criteria, an applicant and Staff should be able to present their positions to a neutral arbiter to render a decision.

Important features of this process include:

x That the decision maker be neutral and well informed of both perspectives, x That the process is carried out and the decision rendered transparently and efficiently, and x That the decision be binding to the extent feasible on the Staff and ACRS.

Several models of such a process are in use or envisioned, with varying degrees of formality. The Canadian Nuclear Safety Commission, for example, includes in its Project Execution Plan for Vendor Design Review a protocol for escalating issue resolution through successive layers of agency and applicant management with explicit time frames for each step in the process.12 Such an approach would be an improvement over the status quo, but not fully respond to the problem. Others have proposed that 9 SECY-21-0004, Proposed Rule: NuScale Small Modular Reactor Design Certification (RIN 3150-AJ98; NRC-2017-0029), Enclosure 1, Proposed Rule, Jan. 14, 2021.

10 SECY-18-0099, NuScale Power Exemption Request from 10 CFR Part 50, Appendix A, General Design Criterion 27, "Combined Reactivity Control Systems Capability," Oct. 19, 2018.

11 NuScale Power, LLC Submittal of White Paper Entitled NuScale Reactivity Control Regulatory Compliance and Safety, Revision 0 (NRC Project No. 0769), Letter LO-1116-51829, Nov. 2, 2016, (SECY-18-0099, Enclosure 1).

12 E.g., Project Execution Plan NuScale Power, LLC Combined Phase 1 & 2 Pre-Licensing Vendor Design Review, Rev. 0, July 19, 2019 (e-Doc-5724958v2) (not publicly available; NuScale can make available to NRC upon request).

LO-0221-74035 Enclosure Page 5 of 16 procedures be established to formally resolve such disputes through the ASLB.13 While that approach yields maximum finality, the regulatory changes to implement it do not support near-term advanced reactor applications, and it may be too cumbersome for all but the most significant disagreements. A model similar to the NRCs Committee to Review Generic Requirements (CRGR) also presents several features of an effective and efficient process for this purpose, but a formalized opportunity for affected-stakeholder involvement is needed in this case.

Accordingly, NuScale suggests an intermediate approach, inspired by the backfit appeal process. Indeed, recent changes to Management Directive (MD) and Handbook 8.4 note that while a new application is not strictly protected from backfit, applicants should be anticipated to reasonably rely upon [the SRP] in development of their applications.14 Therefore, the Commission states in changes to Directive Handbook 8.4 that any change in requirements or regulatory staff positions from that version of the SRP interpreting the Commissions requirements should follow the same reasoned decision-making process as a forward fit. This direction, if fully implemented, would be a useful tool in identifying and resolving some disputes with Staff. However, an appeal process covering a broader scope of issues should be established separately from the backfit process. This would allow a process and timeline tailored to the purposes of a new reactor application, where an expeditious review is essential.

Similar to a backfit appeal, Staff would identify a change in position or an applicant would raise a Staff determination for appeal. The Staff would be required to clearly and succinctly state, in writing, their interpretation or position and the specific regulatory bases for it, and the applicant would be afforded an opportunity to see and respond to Staffs statement. A public meeting would provide an opportunity for the decision maker to hear from both sides and inform their decision, and they could reach out to other resources (e.g., legal counsel) as needed. Finally, the decision maker would render a determination in writing.

That appeal decision would be presumptively binding on the Staff. Because the new application is not protected by backfit regulations, Staff are not strictly prohibited from changing a position. But if the Staff seek to override the decision, they would be required to inform the Commission via vote paper of their intention to do so. Likewise, the ACRS would need to abide by the decision or state their reason for disagreeing with it. The appeal decision would thusly inform the Safety Evaluation and ACRS reports, but would not be binding on the Commissions responsibility to reach the ultimate safety findings.15 While this process needs to have an established structure, it need not be unduly formalized because it is not tied to a regulatory imperative (like the backfit rule) and not binding on the Commissions findings.

Completing this process in a 60-day timeframe supports fast-moving application reviews. The effort and time involved dissuades an applicant from appealing trivial disagreements, bringing only consequential matters for appeal.

3.2 Risk-informed decision making 3.2.1 NuScales experience and problem statement The NuScale design presents an exceptionally low risk to public safety as demonstrated by both deterministic analyses and the probabilistic risk assessment (PRA): the mean value of the core damage 13 M. Segarnick and S. Desai, Preparing for Advanced Reactors: Exploring Regulatory and Licensing Reform, NUCLEAR LAW, Nov. 14, 2018.

14 Staff Requirements Memorandum, Staff Requirements SECY-18-0049 Management Directive and Handbook 8.4, "Management of Backfitting, Issue Finality, and Information Collection," Enclosure 2 - Edits to Directive Handbook 8.4, May 29, 2019.

ML19149A308 - SRM-18-0049: Enclosure 1 - Edit to Management Directive 8.4 (16 page(s), 5/29/2019) 15 In the case of an SDA, where the Commissions final safety findings only occur in issuing a license that references the SDA, the same principle would apply.

LO-0221-74035 Enclosure Page 6 of 16 frequency of a NuScale Power Module achieves a core damage frequency several orders of magnitude smaller than the Commissions safety goal subsidiary objective.16 This lower frequency is coupled to a design with much lower consequences: a source term less than 5 percent that of a large light water reactor. The PRA results are backed by deterministic safety analyses that show fuel damage is prevented for design basis accidents, without reliance on operator actions, electric power, or makeup water.

In the Advanced Reactor Policy Statement, the Commission established that advanced reactors were to provide at least the same degree of protection of public health and the environment as the then-current LWRs of 1994.17 Together with a general expectation for enhanced safety margins and/or simplified or passive safety features, the Commission identified several attributes that could assist in establishing the licensability of a proposed design. Among them:

x Highly reliable and less complex shutdown and decay heat removal systems.

x Longer event progressions, x Simplified safety systems that reduce required operator actions and equipment subjected to severe environments, x A minimized potential for severe accidents, x Reduced challenges to safety systems caused by balance of plant SSCs.

Finally, the Commission presented an incentive for exceeding the safety of current LWRs: Some or all of the above attributes may help obtain early licensing approval with minimum regulatory burden.18 The NuScale design satisfies each of the above criteria and others. NuScale engaged in an extensive pre-application process as envisioned by the policy statement. The Staff completed the FSER more quickly than for prior design certifications, yet the regulatory burden of the review was excessive.

A common theme of many contentious issues during the review is that the interrelated design features and the overarching safety profile do not bear on Staffs probing of a particular aspect of the design or an individual acceptance criterion. A holistic review of the design is necessary. For example, the Staffs position that the IAB must be assumed as a potential single failure was due to its role in meeting anticipated operation occurrence (AOO) acceptance criteria when conservatively analyzing deterministic event sequences in Chapter 15. Those acceptance criteria and the safety analyses to demonstrate them are themselves a reflection of the large LWR designs for which the GDCs were created. Staff discounted that the underlying critical safety functionsadequate core cooling to prevent core damage and containment of fission productswould be assured even in the very low likelihood of the postulated events and single failure actually occurring. Those aspects of the design were envisioned by the Advanced Reactor Policy Statement to reduce regulatory burden, but did not prevent a protracted disagreement.

As the Commission concluded in SRM-SECY-19-0036,19 risk information is an important tool to help resolve such contentious issues. The value of risk information in such cases is that it provides a quantified representation of a new designs safety performance with respect to specific issues that Staff historically consider deterministically, where Staff might otherwise apply acceptance criteria and positions developed for large LWRs with different safety profiles. Risk information effectively quantifies and distills 16 The NPM mean value internal events CDF is 3.0x10-10 per module critical year, as compared to the CDF goal of 1.0x10-4 per reactor year.

17 Regulation of Advanced Nuclear Power Plants; Statement of Policy, 59 Fed. Reg. 35,461, July 12, 1994.

18 Id. At 35,462 (emphasis added).

19 Staff Requirements Memorandum, Staff Requirements - SECY-19-0036 - Application of the Single Failure Criterion to NuScale Power LLCs Inadvertent Actuation Block Valves, July 2, 2019.

LO-0221-74035 Enclosure Page 7 of 16 into cognizable form the attributes of advanced reactors that were expected by the Advanced Reactor Policy Statement to expedite review and minimize regulatory burden.

Hence, NuScale supports the Commissions direction in SRM-SECY-19-0036, that the staff should apply risk-informed principles when strict, prescriptive application of deterministic criteria such as the single failure criterion is unnecessary to provide for reasonable assurance of adequate protection of public health and safety. In some cases, Staff successfully did so, such as the GDC 27 example where, although NuScale disagreed with the legal basis for Staffs position, Staff ultimately considered the likelihood and consequences of a return to power in approving NuScales exemption request.

Nevertheless, that result (which predates the IAB decision) came after a lengthy back-and-forth and assertions that the NuScale design should be modified to conform to Staffs interpretation of the deterministic GDC 27 criterion.

In other cases, NuScale proffered risk information to justify features of the design that was not duly considered by Staff in resolving those issues. For example, the surrogate core damage event postulated for the purposes of analyzing control room and offsite dose consequences has a probability of less than 3x10-10 per year and calculated consequences a fraction of the acceptance criteria. 20 Yet, as detailed in the appendix to this report, Staff concluded that it is necessary to calculate the dose contribution from potential leakage from combustible gas monitoring following such an event. This view represents a strict, prescriptive application of deterministic criteria, where a risk-informed view of the issue may have yielded resolution of the combustible gas monitoring system design.21 Additional examples are cited in the discussion on credible, below.

New designs such as NuScales substantially differ from the designs on which the existing regulatory framework was built, in ways that fundamentally alter the presumed safety profile of the plant, such that the existing framework of requirements and guidance identifies apparent gaps in the design with little safety significance when considered holistically. Until a risk-informed, technology-neutral framework is completed and proven, use of risk information in individual licensing decisions is an important tool to close such gaps. Despite Commissions direction in SRM-SECY-19-0036, though, NuScale has seen no indication that risk-informed principles are being applied by Staff when strict, prescriptive application of deterministic criteria is unnecessary to provide for reasonable assurance of adequate protection.

3.2.2 Proposal Application of risk-informed principles needs to occur early and proactively. NRC Staff have been reluctant to mix Chapter 19 with other parts of the application review. In part this stems from the regulatory requirements and guidance that fail to incorporate or point to risk insights in satisfying acceptance criteria in other chapters of the FSAR. In the short term, this can be addressed by reinforcing in top-level guidance, such as SRP Chapter 1, the Commissions direction in the SRM-SECY-19-0036, including explanation and examples of how that position should be implemented. Eventually, direction that is more specific is necessary.

Additionally, Staffs reluctance to incorporate risk insights stemmed in part from perceptions that NuScales PRA was not developed for that purpose and that NuScale was advancing a risk-based rather than risk-informed approach. NRC guidance on PRA acceptability for risk-informed applications before fuel loading is incomplete and ambiguous. Despite the extensive resources spent by NuScale to establish the quality of the NuScale PRA, the lack of guidance allowed NRC Staff to dismiss risk justifications that NuScale offered due to uncertain deficiencies in NuScales PRA. NRC should clarify the guidance on utilizing risk insights for a licensing application during the pre-fuel-load phases of a plant life-20 The total core damage frequency for internal-events at full-power is 3E-10 per module critical-year, and the several intact containment events comprising the surrogate CDE are a subset of those. See also Appendix Section 2.3.1.

21 As discussed in the appendix, NuScale believes Staffs position is not supported by the regulatory requirements.

Assuming it is, however, a risk-informed review could have allowed resolution of the issue.

LO-0221-74035 Enclosure Page 8 of 16 cycle, which is essential for new designs.22 In so doing, the criteria for PRA acceptability should reflect the state of a new design and the broader safety review conducted by NRC to approve a new licensing basis; existing guidance is focused on changes to a previously-approved licensing basis previously found to provide reasonable assurance of adequate protection under a deterministic framework. Use of risk insights to inform Staffs position on whether strict, prescriptive application of deterministic criteria during an initial licensing review is a function that can and should be readily compatible with a high-quality design-application PRA such as NuScales.

Finally, Staff procedures and training are necessary to ensure that risk insights are incorporated into Staffs review early and effectively. While NuScale will continue to point to risk insights in the SDA FSAR and in responding to RAIs, Staff should be empowered to look to those insights on their own initiative, thereby preventing some RAIs from being issued in the first place and reducing the burden of review. At some point, the very low risk posed by the NuScale design (as exemplified by the very low core damage frequency and large release frequency) is the risk-insight that has meaning. Given a low enough risk level, public health and safety are adequately protected and the NRC mission is satisfied.

3.3 Define Credible 3.3.1 NuScales experience and problem statement The notion of whether an occurrence is credible is the basis for, a pervasive feature of, and an inextricable aspect of NRCs regulatory framework. Whether an event is credible or not informs the scope of numerous requirements and Staff positions, either explicitly or implicitly. Yet the meaning of credible in any of its various contexts continues to elude definition, impeding regulatory certainty and review predictability.

NuScale encountered this issue in several aspects of the DCA review, and it continues to challenge the review of NuScales Emergency Planning Zone methodology. For example:

x NuScales design precludes large-break LOCAs by eliminating large bore piping. NRCs rules and precedent clearly limit LOCAs to piping ruptures,23 based on a rupture of the reactor vessel and its appurtenances being incredible due to the quality of design, fabrication, and inspection.24 Where NuScale initially demonstrated the acceptability of the design with respect to any pipe rupture within the reactor coolant pressure boundary, consistent with 10 CFR 50.46, NRC Staff determined that it was necessary for NuScale to additionally evaluate ruptures of valve nozzles as a design-basis LOCA. This new Staff position was a deterministic extension of existing rules, without regard to the probability of such a rupture actually occurring.

x With respect to reactivity control and GDC 27, NuScale argued that in addition to the regulatory basis for NuScales interpretation, it is also incredible that an initiating event would yield a return to power.25 Yet NuScale was unable to reach agreement with Staff on that approach.

22 Regulatory Guide 1.233, Guidance for a Technology-Inclusive, Risk-Informed, and Performance-Based Methodology to Inform the Licensing Basis and Content of Applications for Licenses, Certifications, and Approvals for Non-Light Water Reactors, relies on an expanded role for PRA beyond its uses in existing facilities or completed design reviews such as NuScales. No guidance on the acceptability of such a PRA for that purpose is provided.

23 10 CFR 50.46(c)(1) (defining LOCAs as breaks in pipes in the reactor coolant pressure boundary).

24 In the Matter of Consolidated Edison Company of New York (Indian Point Unit No. 2), 5 A.E.C. 20 (1972). Staff stated their position that the probability of vessel failure has been found to be so low as not to require consideration of the consequences of such failure in the assumptions employed in determining site suitability.

25 Although GDC 27 is phrased deterministically, the limits of its scope could be defined by the credibility of the events to be addressed under it. By comparison, GDC 35, which does not explicitly limit LOCAs to piping, was already deemed to exclude RPV rupture prior to 10 CFR 50.46.

LO-0221-74035 Enclosure Page 9 of 16 x NuScales position on the maximum hypothetical accident that serves as the design basis source term was informed and justified by the credibility of a core damage event occurring for the NuScale design.26 NuScale argued that such an occurrence was orders of magnitude less likely than a comparable event considered as the design basis source term for large LWRs, and thus not similarly credible. Staff were unwilling to rely on a probabilistic credibility threshold, which led to an event with less than 3x10-10 per year likelihood serving as a source term for design basis dose consequence analysis, siting, and EPZ considerations.

x With respect to NuScales PRA, NuScale responded to several RAIs concerning potential severe accidents of doubtful credibility. In eRAI 8882,27 Staff questioned the radiological consequences of a beyond-design-basis module drop event with a calculated mean CDF of 8.8x10-8 per calendar year.28 In eRAI 8889,29 Staff questioned NuScales calculated probability for an induced steam generator tube failure (SGTF) during a core damage event. However, even if NuScale were to conservatively assume SGTF in response to every core damage event, the resulting event frequency would be the same as the internal events CDF of 3x10-10 per year.

x NuScale continues to engage Staff on review of the EPZ sizing methodology. Regulatory history, precedent, and the proposed EP Rulemaking all explicitly reference credible as the scope of events to be considered in evaluating the need for advance emergency planning. However, NuScales effort to define credibility in probabilistic terms has been opposed in both substance and principle: Staff will not agree with NuScales specific threshold and have resisted the definition of any specific numeric criterion. Staff have stated that the approval of the Clinch River ESP, with numeric thresholds included in its EPZ sizing methodology, did not constitute approval of those thresholds and have further indicated the those thresholds have no broader applicability.30 Other instances abound. In the safety goal policy statement31 the baseline level of acceptable nuclear risk is established by the Quantitative Health Objectives (QHOs), where it is stated that the operation of a nuclear power plant should not increase the risk to the public by more than 0.1% of the sum of all existing risk. The implication of a nuclear power plant satisfying the QHOs is that the public is adequately protected. Using fatality information from the U.S. Center for Disease Control (CDC) and bounding assumptions on the consequences of a nuclear power plant core damage accident, the QHOs conservatively translate to an equivalent core damage frequency (CDF) of 5x10-7 core damage accidents per year. It is in this context that NuScale experienced scrutiny of its DCA with respect to potential plant upset conditions that were shown to be below the 5x10-7 frequency necessary to adequately protect the public health and safety. When NuScale staff questioned the value of engaging on these issues, the NRC Staff response was that clarity on these very low likelihood event sequences was necessary to ensure confidence on the risk insights to be obtained from the DCA PRA. To this end, frequency thresholds below which further scrutiny is unwarranted should be established. As an example, in the context of the Licensing Modernization Project32 that threshold is 5x10-7 per year for beyond design basis events.

26 NuScale Power, LLC Submittal of WP-0318-58980, Accident Source Terms Regulatory Framework, Letter LO-0518-59973, May 16, 2018 (ML18136A850).

27 NuScale Power, LLC Supplemental Response to NRC Request for Additional Information No. 63 (eRAI No. 8882) on the NuScale Design Certification Application, Letter RAIO-0618-60459, June 14, 2018 (ML18165A438).

28 NuScale FSAR Section 19.1.6.2.

29 NuScale Power, LLC Supplemental Response to NRC Request for Additional Information No. 71 (eRAI No. 8889) on the NuScale Design Certification Application, Letter RAIO-0118-58186, Jan. 15, 2018 (ML18016A240).

30 See U.S. Nuclear Regulatory Commission, Summary of the January 12, 2021, U.S. Nuclear Regulatory Commission Category 1 Public Teleconference with NuScale Power, LLC, to Discuss Staff Comments on NuScale Power LLCs Topical Report, TR-0915-17772, Revision 2 (ADAMS accession number pending).

31 Safety Goals for the Operations of Nuclear Power Plants; Policy Statement; Republication, 51 Fed. Reg. 28,044, Aug. 21, 1986.

32 Regulatory Guide 1.232 and NEI 18-04.

LO-0221-74035 Enclosure Page 10 of 16 Similar thresholds should be clearly defined and available to LWRs, especially given the vastly greater relevant operating experience base.

Within NRC, the current view of credible seems to be that Staff know it when they see it. For example, Staff concluded that the estimated frequencies of ex-vessel and late in-vessel core damage accidents are low enough for evolutionary and passive LWRs that the associated source terms are not considered credible for the purposes of evaluating offsite dose limits.33 Other U.S. agencies have defined credible or an analogous limit on event occurrence frequency. The National Aeronautics and Space Administration (NASA) defines34 a credible failure mode of concern for spacecraft explosion as a failure probability exceeding 1x10-6. The Federal Aviation Administration defines an extremely improbable occurrence, which is the allowable frequency of a potentially catastrophic failure condition, as one having a likelihood of less than about 2x10-6 per year.35 The lack of a definition, or even clear explanation, of the meaning of credible frustrates applicants and introduces significant regulatory uncertainty. Despite a history of attempts,38 challenges, and reluctance to define credible, a clear and consistent NRC definition should be achievable and is appropriate given the state of PRA technology and the tools available to compensate for it.

3.3.2 Proposal The NRC, with industry and public involvement, should develop probabilistic criteria defining credible.

Possible mechanisms to implement the definition would be through guidance, a regulatory interpretation, or commission action.

Credible may have different meanings within different contexts. For instance, a design basis internal initiating event is a credible one, often but unofficially considered one with a likelihood of more than about 1x10-4 of occurring.39 Meanwhile, the Commission recognized in the Statements of Consideration for a Part 100 rulemaking that, with respect to event sequences for source term and siting considerations, events having the very low likelihood of about 10-6 per reactor year or lower have been regarded in past licensing actions to be incredible, and as such, have not been required to be incorporated into the design basis of the plant.40 A criterion for the credibility of events to be considered in sizing the emergency planning zone has not yet been determined, but the Clinch River precedent indicates 1x10 -6 is appropriate.41 33 SECY-34-302, Source Term-Related Technical and Licensing Issues Pertaining to Evolutionary and Passive Light-Water-Reactor Designs, Dec. 19, 1994, p. 6.

34 NASA Technical Standard NASA-STD-8719.14B, Process for Limiting Orbital Debris, April 25, 2019.

35 An extremely improbable failure conditions is defined as one having a probability on the order of 1x10-9 or less per flight-hour. FAA Advisory Circular 25.1309-1A, System Design and Analysis, June 21, 1988. Conservatively assuming 2,000 flight hours per year yields a probability of 2x10-6 per flight year. Data from one source indicates that in 2019, U.S carriers utilized their large narrowbody aircrafts an average of 3,082 hours9.490741e-4 days <br />0.0228 hours <br />1.35582e-4 weeks <br />3.1201e-5 months <br /> per year, which would yield a higher threshold for extremely improbable. MIT Airline Data Project, http://web.mit.edu/airlinedata/www/Aircraft&Related.html.

38 See, e.g., Memorandum from James M. Taylor, Executive Director for Operations, U.S. NRC, Response to SRM for SECY-91-229, "Severe Accident Mitigation Design Alternatives For Certified Standard Designs," Jan. 28, 1982, p.2 (The staff is working on its final definition of what is a "credible" severe accident for possible rulemaking.).

39 See, e.g., D. Powers, Advisory Committee on Reactor Safeguards, Accident Analysis Design Basis and Beyond Design Basis (ML090060320).

40 Reactor Site Criteria Including Seismic and Earthquake Engineering Criteria for Nuclear Power Plants, 61 Fed.

Reg. 65,157, Dec. 11, 1996.

41 The Clinch River ESP Site Safety Analysis Report proposes that events with frequency greater than 1x10-6 per reactor-year be compared against the Protective Action Guidelines. CITE. The EP proposed rulemaking, consistent with precedent, suggests that credible sequences are to be compared against the PAGs. CITE.

LO-0221-74035 Enclosure Page 11 of 16 Those criteria may be intentionally distinct, as they characterize and implement different aspects of the defense-in-depth (DID) regime, but they should be cohesive. In contrast, the current criteria for design basis external initiating events lack consistency either amongst the various hazards or with design basis internal events. For example, a design basis tornado includes one with 1x10-7 probability of occurrence, while a design basis earthquake is not defined probabilistically but does not approach that infrequency nor should it.42 Staff should determine comprehensively what is or is not credible to consider as any type of design-basis initiating event, design basis event sequence, or beyond design basis event sequence.

NuScale recognizes the state and limits of PRA. NuScale also recognizes Commissions policy on use of PRA and risk information, which preclude exclusive reliance on probabilistic criteria in justifying the licensing basis. Nevertheless, it is acceptable and consistent with those policies to define credibility thresholds in probabilistic terms. First, the existing licensing framework is extensively based on qualitative judgments of likelihood:

The deterministic approach involves implied, but unquantified, elements of probability in the selection of the specific accidents to be analyzed as design basis events.43 If the informed, qualitative judgement of Staff members was sufficient to establish the regulatory framework in the first instance, then probabilistic values backed by modern PRA techniques should have sufficient veracity to inform requirements going forward. The NRC has made similar observations:

Regulators using a deterministic approach simply tried to imagine credible mishaps and their consequences at a nuclear facility and then required the defense-in-depth approachlayers of redundant safety featuresto guard against them.

These maximum credible accidents were, in turn, used to define design-basis events, which were then used to determine the values of controlling design parameters for structures, systems and components (SSCs); the safety classification of SSCs; the contents of licensing-basis documents (such as final safety analysis reports (FSARs) and technical specifications); and needed supporting documents, such as plant procedures. The licensing efforts for early plants focused, therefore, on design-basis events.44 As this history exemplifies, probabilistic criteria are fully compatible with a risk-informed DID regulatory framework. The entirety of the NRCs regulatory framework, applied comprehensively, ensures DID.

Moreover, NuScale believes that at some point a very low risk in and of itself implies sufficient DID.

Individual layers of that DID can and should be defined using probabilistic criteria to ensure it serves its intended purpose of achieving adequate protection of the public health and safety and common defense and security. The quality of a PRA to implement the credibility criteria will also require consideration, but this should not prevent establishing the criteria in the first place. To reiterate, NRC should not require undue precision or excessive site-specific or post-construction details in a PRA to bring greater clarity to a licensing framework currently built on qualitative judgement.

In an effort complementary to clarifying the meaning of credible, NuScale recommends that NRC establish an acceptable method for evaluating DID. As the discussion above illustrates, credibility and DID are interrelated: event credibility helps to establish adequate DID, and DID ensures that the design, siting, and emergency planning provide robust protection commensurate with their relevance to events of 42 In the context of mixed oxide fuel fabrication facilities, Staff have at least adopted a single probability criterion for all external eventsan incredible external event is one with a frequency of occurrence conservatively estimated as less than once in a million years (1x10-5). NUREG-1718, Standard Review Plan for the Review of an Application for a Mixed Oxide (MOX) Fuel Fabrication Facility, Aug. 2000, p. 5.0-22.

43 SECY-98-144, White Paper on Risk-Informed and Performance-Based Regulation, June 22, 1998.

44 COMSECY-14-0037, Integration of Mitigating Strategies for Beyond-Design-Basis External Events and the Reevaluation of Flooding Hazards, Nov. 1, 2014, Enclosure 1, quoting A Short History of Nuclear Regulation, 1946-2009.

LO-0221-74035 Enclosure Page 12 of 16 varying likelihood and severity. During NuScales pre-application engagement, the DCA review, and the EPZ topical report review the Staff position regarding the evaluation of DID fluctuated. This resulted in costs with no benefits realized. The root cause is the NRC has no accepted method to evaluate DID, which, combined with turnover in the NRC staff evaluating NuScales application, resulted Staff changing position.. NuScale recommends that the NRC endorse the IAEA method documented in IAEA SSR-2/1 to bring consistency and predictability to NRC reviews, which will also benefit vendors who plan to deploy their designs in other countries that use the IAEA guidance.

3.4 Downstream Requirements and Programs 3.4.1 NuScales experience and problem statement During the DCA review process, Staff raised design issues addressed by processes and programs downstream of the DCA-phase design, which could be appropriately resolved by relying on those downstream requirements to supplement design details and test information provided for DCA review.

The review of radiation protection (RP) included numerous such instances. In one case, Staff asked for a description of the airborne activity assessment for the Radioactive Waste Building with respect to potential alpha-emitting sources. In response, NuScale noted that the potential for airborne radionuclides is not different from currently licensed plants or approved designs, and the control of alpha-emitting radionuclides for the protection of workers will be part of the COLs RP Program.45 Staff did not accept that as resolution even though a licensees RP Program is required by 10 CFR 20.1101 to maintain doses within regulatory limits and as low as reasonably achievable.46 The experience with penetration radiation shielding, discussed above, is another case. There, a generic description of shielding characteristics together with the licensees and NRCs processes for construction, inspection, and verification of that shielding would have assured that the as-built penetrations are adequately shielded. The staff appeared to be under the assumption that the design is fixed at certification; in reality the shielding design and operational exposures will be modified throughout operation depending on actual radiological conditions in the plant.

The issue of density wave oscillation (DWO) within NuScales steam generator (SG) tubes presents another example.47 While DWO is an issue requiring attention post-DCA, it will be addressed by downstream processes that ensure the plant will be designed, constructed and operated safely. The DCA defines an acceptable IFR design as one that ensures ASME Code criteria are met with respect to flow instabilities; the development, validation, and implementation of a methodology for the evaluation of DWO would be addressed by a COL Item; and the adequacy of the design would be assured by completion of an ITAAC requiring that the requirements of ASME Code Section III are met. Each step of this process would be subject to rigorous QA requirements and NRC inspection. Staff initially concurred with NuScales approach; the Advanced Final Safety Evaluation Report with No Open Items proposed to resolve DWO based on subsequent testing and inspection requirements.48 However, in the FSER Staff 45 NuScale Power, LLC Response to NRC Request for Additional Information No. 445 (eRAI No. 9255) on the NuScale Design Certification Application, Letter RAIO-0518-59925, May 9, 2018 (ML18129A415).

46 Rather than relying on the RP Program, Staff performed an independent assessment to determine that the potential airborne concentration of isotopes will not be significant. See NuScale FSER p. 12-19.

47 See SECY-21-0004, Enclosure 1,Section III.C.3 for a summary of SG integrity with respect to potential DWO.

48 See, e.g., Advanced Final SER with No Open Items, Section 3.9.2.4.3: There is no analysis for the array of [steam generator inlet flow restrictors] that diffuses secondary coolant inlet flow and mitigates the possibility of DWO within the [helical coil steam generator] tubing. Instead, various flow restrictor designs were tested in a special fixture. The final SGIFR design is based on a concept that showed no signs of LFI or any other significant FIV. The NRC staff concluded that the applicants LFI analysis methods and calculations are based on validated methods, there is significant estimated margin against LFI, all components evaluated for LFI will be tested during initial startup, and those components are part of the inservice inspection plan. Therefore, the NRC staff finds that there is reasonable assurance of no significant LFI induced vibration and structural damage for the life of an NPM.

LO-0221-74035 Enclosure Page 13 of 16 concluded that SG integrity due to DWO could not be resolved, implicitly concluding that they would not rely on the downstream processes to resolve DWO at the DC stage.49 The design review process as currently implemented necessitates a high degree of design finalization and an enormous and ever-increasing amount of design information from the vendor, typically for a design that has not yet been completed or built. The degree of design finalization achievable or reasonable for a design approval applicant has practical limits, as recognized by SECY-90-377.50 This is especially the case for advanced reactor designswhile NuScale developed a large test program and benefitted from a large operating experience base, future designs may not have access to such resources. Required downstream requirements and processes, necessary under NRCs existing regulations or from the DC itself, can provide an acceptable basis for Staff to conclude that there is reasonable assurance the design complies with NRC regulations.51 Applied prudently, this approach will maintain an appropriate level of design completion at the design review stage consistent with the Commissions Standardization Policy,52 while allowing detailed design to occur at a time compatible with the vendors design process.

3.4.2 Proposal Staff guidance, and potentially the NRCs regulations, should be revised to clarify Staffs ability to rely on downstream requirements, programs, and processes as part of their safety findings.

Although NuScale agrees with NEIs recent comment that 10 CFR 52.47 should be revised as part of the Alignment of Licensing Processes and Lessons Learned From New Reactor Licensing rulemaking53 to explicitly allow reliance on design and programmatic controls,54 the current regulations already contain such leeway. The DC requirements state that an application must provide a level of design information sufficient to reach a final conclusion on all safety questions associated with the design, and the Staff need reasonable assurance that the design complies with the Atomic Energy Act and NRCs regulations to issue the DC. Downstream requirements, processes, and programs that are required by regulation or by the DC can form the basis for that reasonable assurance, offsetting the amount of design information that might otherwise be necessary to reach a final safety conclusion.

In the case of Standard Design Approval, the regulations are less prescriptive, commensurate with the degree of finality and final issue resolution provided by that process. Thus, regardless of potential regulatory obstacles for this approach under the DC regulations, NuScale believes Staff may more liberally rely on downstream processes in completing their safety evaluation for an SDA application.

3.5 Role of the ACRS 3.5.1 NuScales experience and problem statement 49 See, e.g., FSER section 3.9.2.4.4.1: However, the staff cannot make a safety finding on the long-term integrity of the SGIFRs under possible reverse secondary coolant flow (either subcooled or two-phase) due to DWO instabilities.

As discussed above in Section 3.9.2.4.3.11, a future COL applicant referencing the NuScale design will be responsible for providing an analysis of the potential for DWO secondary-side instabilities in the SGs for staff review and approval.

50 SECY-90-377, Requirements for Design Certification Under 10 CFR Part 52, Nov. 8, 1990.

51 See 10 CFR 52.54.

52 Nuclear Power Plant Standardization, 52 Fed. Reg. 34,884, Sept. 15, 1987.

53 Incorporation of Lessons Learned from New Reactor Licensing Process (Parts 50 and 52 Licensing Process Alignment), Docket ID NRC-2009-0196.

54 Nuclear Energy Institute, Part 50/52 Lessons Learned Rulemaking - Addressing the term Essentially Complete, Sept. 24, 2020 (ML20268C271). NEI recommended that 10 CFR 52.47 be revised to expressly acknowledge, Design and programmatic controls can substitute for design information where those controls provide reasonable assurance that the as-built design will meet NRC requirements.

LO-0221-74035 Enclosure Page 14 of 16 The DCA review included a broad and intensive review by the ACRS that ultimately yielded a conclusion that the NuScale design provided enhanced safety margins, presented no undue risk, and should be approved by the Staff and certified by the NRC.55 The ACRS review was successful and exhibited some innovation for enhancing the process in its use of crosscutting focus area reviews. NuScale observed other aspects that could be improved to achieve a more efficient and safety-focused review.

For example, during the DCA review the ACRS explored some issues that are already well-addressed by the regulatory framework and peripheral to the safety of the design; for example, the use of assumptions (open design items in NuScale terminology), and the flow down of requirements to subsequent processes such as combined licenses and test programs required by NRC. Similarly, absent some unexpected and novel approach to meeting NRCs quality assurance requirements, an ACRS report on the applicants QA program is unnecessary to allow Staff to reach a conclusion of conformance with NRC requirements.

Beyond those peripheral process issues, NuScale also found that in the review of issues more directly bearing on safety, ACRSs role was abstruse. The applicants role is clear: to ensure its application meets applicable standards and requirements and that the design meets, with reasonable assurance, applicable regulations and guidance, or justifies alternatives or exemptions from those standards where it differs.

The Staffs role is likewise clear: to confirm that, with reasonable assurance, the applicant has fulfilled its responsibility as described above and thus the design presents no undue risk to public health and safety and is consistent with the common defense and security. If necessary due to novel features or approaches, additional standards are developed in the course of the review.

In contrast, the role of the ACRS appeared unconstrained in scope and purpose, or by the NRCs regulatory framework. This often put NuScale in the position of defending NRC requirements and that compliance with those requirements was adequate, which should not be the responsibility of an applicant.

To NRC Staffs credit, they were willing to and encouraged NuScale to defer such inquiries to the NRC Staff. Even here, the Staff were not always persuasive. This results in excessive time and cost for applicants as matters of regulation and process are resolved.

Applicants should not be expected to address ACRS (or Staff) requests that fall outside the responsibility to demonstrate that the application meets NRCs standards.

3.5.2 Proposal The role of the ACRS should be clarified to result in more effective and efficient reviews. This is necessary considering there may be multiple novel design reviews conducted concurrently in the near future. The approach taken for the NuScale DCA will not work; the statutory limitations on ACRS resources preclude that amount of review on multiple designs. If changes are not made the ACRS will constrain the deployment of advanced nuclear power. To succeed, the ACRS should focus on matters of safety significance only, and rely on NRC staff interpretations of regulatory requirements and regulatory process issues.

In their review of an application, the ACRS should explicitly address and evaluate established regulatory criteria in their letter reports. Where the ACRS questions the safety of the design, its concerns should be stated in terms of the specific criteria at issue, and how the design does not meet them. Where ACRS views an established standard as inadequate, the issue should be raised and considered by NRC generically, separate from completing the review of a particular application.56 Only in such cases where established criteria are not met, or where they do not exist because of an exemption request or other alternative to current standards, would the ACRS consider de novo whether an aspect of the design reasonably assures adequate protection. Legal expertise on the regulatory framework and history, either 55 Advisory Committee on Reactor Safeguards, Report on the Safety Aspects of the NuScale Small Modular Reactor, July 29, 2020 (ML20211M386).

56 Compare the hearing procedures, which absent special circumstances preclude attack of the Commissions regulations during an individual license proceeding. 10 CFR 2.335.

LO-0221-74035 Enclosure Page 15 of 16 from within ACRS or from without, may be useful to facilitate such a review. Additionally, NuScales above recommendations on risk-informed review and crediting downstream requirements should inform ACRSs conclusions.

With respect to the scope and mechanics of ACRS review, NuScale commends the cross-cutting issues approach used in the DCA review. To build upon that approach, an informational ACRS briefing should occur relatively early in the review, such as the ACRS visit to NuScales office in July 2019 to tour the test facilities, simulator, and discuss items of mutual interest. Then the Commission should delegate to Staff to identify significant issues or cross-cutting issues that ACRS is requested to report upon. Such issues would exclude those with either minimal safety significance or where no novel question is presented, such as the examples cited above. Based on the informational briefing and subsequent substantive meetings, ACRS could propose additional issues for consideration, but these could be subject to EDO approval.

4.0 Conclusion NuScale views the DCA review as a successful demonstration of the NRCs ability to review an advanced reactor design in a reasonable timeframe. However, the review process needs to and can continue to be made more efficient and predictable, reducing the substantial burden on applicants and the NRC while enhancing focus on matters important to safety. To that end, NuScale recommends that NRC:

1. Establish an appeal process to resolve disagreements between applicants and the NRC staff with respect to preliminary interpretations of requirements and guidance. The consequence of the absence of such a process is that regulatory burden has steadily increased from one applicant to the next without consideration of whether new staff positions have merit from a safety perspective.

2. Implement risk-informed decision making consistent with the Commissions direction in Staff Requirements Memorandum SRM-SECY-19-0036 to apply risk-informed principles when strict, prescriptive application of deterministic criteriais unnecessary to provide for reasonable assurance of adequate protection. NuScale did not observe application of the SRM in the DCA review outside the specific decision rendered by that SRM. The consequence of this limited application increased review durations and costs even where risk insights demonstrated adequate protection.

3. Define credible. Numerous NRC requirements incorporate the concept of credible. The consequence of a lack of a definition is unpredictability in the review as interpretations vary among the staff, resulting in increased review durations and costs even for events of incredibly low frequencies and often with insignificant radiological consequences. In a complementary effort, NRC should endorse IAEA standard SSR-2/1 as an acceptable method for evaluating the adequacy of defense in depth.

4. Rely on downstream requirements and programs to supplement of design detail and test data as part of NRC safety findings. Downstream programs include programs required by regulation; e.g.,

Appendix B quality assurance, the ASME Code, and ITAAC. The consequence of not relying on these required programs is increased cost and time to develop applications and obtain approval, without improving the safety of the constructed facility.

5. Clarify the role of the ACRS. The ACRSs approach during the NuScale DCA review worked because the NuScale SMR was the only advanced reactor design under review. However, it was unnecessarily broad and burdensome and the same approach will not work if there are multiple advanced reactor designs under review, as expected in the near future. The consequence of not clarifying the role of the ACRS is that the ACRS, due to resource constraints, may delay the approval and deployment of nuclear power plants with advanced safety features.

LO-0221-74035 Enclosure Page 16 of 16 These recommendations can be implemented relatively quickly in order to prepare the NRC for forthcoming reviews of numerous advanced reactor designs, including NuScales next application.

NuScale looks forward to further discussions with NRC and other interested stakeholders on these topics.

LO-0221-74035 Enclosure Appendix Page A1 of A8 Appendix: Leakage from Combustible Gas Monitoring 1.0 Background In accordance with NRC requirements, the NuScale design includes the capability for monitoring the concentration of hydrogen and oxygen in the containment atmosphere following a significant beyond design-basis accident. The principal design and function of that combustible gas monitoring capability (CGMC) has not changed since initial DCA submittal. The Combustible Gas Control technical report describes the CGMC.57 During review of a revision to the Accident Source Term Topical Report,58 NRC first raised the issue of leakage from combustible gas monitoring (CGM).

The CGMC is distinct from monitoring and sampling functions that support normal operations; CGMC is provided because it is prescribed by 10 CFR 50.44 to support beyond-design-basis accident management. It does not serve a purpose in the NuScale design that is unique from other light water reactors. In fact, the NuScale design does not require inerting or hydrogen reduction to ensure containment integrity for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. As compared to large LWRs, CGMC in the NuScale only supports potential long-term emergency actions for an extremely unlikely severe accident scenario.

Staff concluded that they were unable to make a safety finding on the design of the CGMC to minimize and control leakage outside containment, which could impact the offsite dose analyses, the dose analyses for the main control room, and the dose to an operator re-isolating CGM if necessary.59 NRCs complete regulatory basis and position on the issue was first stated in the NuScale Final Safety Evaluation Report. Staffs evaluation raises numerous interrelated regulations without a clear explanation of how each relates to the issue or how they together justify NRCs position. Based on the discussion provided and informed by prior interactions, the crux of Staffs position seems to be that because the CGMC equipment is required by regulation, the potential doses resulting from using that function during a severe accident must be accounted for in onsite and offsite dose calculations. Staff have stated that their concern arose because NuScales CGMC design is unique in transporting containment atmosphere outside containment, thus giving rise to a new leakage path not heretofore considered in prior reviews. As discussed below, both Staffs concern and the justification for their ultimate position are novel and unfounded.

2.0 Discussion 2.1 Regulatory Framework 10 CFR 50.44(c)(4) requires a water-cooled reactor design with an inerted containment60 to include equipment for monitoring oxygen and hydrogen following a significant beyond design-basis accident for combustible gas control and accident management, including emergency planning. In 2003 that 57 NuScale Letter LO-0319-64935, NuScale Power, LLC Submittal of Combustible Gas Control, TR-0716-50424, Revision 1, March 28, 2019.

58 NuScale Power, LLC, Accident Source Term Methodology, TR-0915-17565, Revision 3.

59 FSER Section 12.3.4.1.3 60 Hydrogen monitoring is required for all water-cooled reactors; oxygen monitoring is required only for reactors that rely on an inerted containment atmosphere for combustible gas control. The NuScale containment is not inerted for combustible gas control, but because of the partial vacuum conditions would become inerted during an accident sequence. Therefore the design includes the capability for oxygen monitoring.

LO-0221-74035 Enclosure Appendix Page A2 of A8 regulation underwent risk-informed revision, wherein NRC concluded that combustible gas control was necessary only for severe accidents.61 10 CFR 52.47(a)(2)(iv) establishes the offsite dose limits for a DCA. An applicant must show that for a fission product release into containment resulting for a core damage accident,62 the containment leak rate, any fission product cleanup systems intended to mitigate the accident consequences, and the postulated site parameters maintain offsite doses within the 25 rem total effective dose equivalent (TEDE) limits.

General Design Criterion 19 establishes the control room dose limit.63 The design must provide adequate radiation protection to permit access and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 5 rem TEDE.

Several Three Mile Island-related requirements address radiation protection following accidents. Each of these rules assumes an accident source term equivalent to the core damage accident postulated for the offsite dose analysis.

x 10 CFR 50.34(f)(2)(vii) requires an applicant to perform radiation and shielding design reviews of spaces around systems that may, as a result of an accident, contain accident source term radioactive materials, and design as necessary to permit adequate access to important areas and to protect safety equipment from the radiation environment. The associated guidance64 prescribes the GDC 19 dose limit (5 rem whole body65) for operator access to those important areas.

x 10 CFR 50.34(f)(2)(xxvi) requires an applicant to provide for leakage control and detection in the design of systems outside containment that may contain accident source term following a severe accident. An applicant must submit a leakage control programfor minimizing leakage from such systems. The goal of the requirement is to minimize potential exposures to workers and public, and to provide reasonable assurance that excessive leakage will not prevent the use of systems needed in an emergency.

x 10 CFR 50.34(f)(2)(xxviii) requires an applicant to evaluate potential pathways for radioactivity and radiation that may lead to control room habitability problems under severe accident conditions and make necessary design provisions to preclude such problems.

2.2 NRC Staff Position and NuScales Response In Staffs proposed DC rule,66 Staff state:

As documented in Section 12.3.4.1.3 of the final safety evaluation report, there was insufficient information available regarding NuScale combustible gas monitoring system and the potential for leakage from this system outside containment. Without 61 Combustible Gas Control in Containment, 68 Fed. Reg. 54,123, Sept. 16, 2003.

62 10 CFR 52.47(a)(2)(iv) requires an accident with fission product release from the core into containment be analyzed. A footnote states that these accidents have generally been assumed to result in substantial meltdown of the core (emphasis added). NuScale argued that the general assumption of core damage should not apply to the NuScale design due to an extremely low likelihood of core damage occurring with an intact containment, but Staff disagreed. See NuScale Power, LLC Submittal of WP-0318-58980, Accident Source Terms Regulatory Framework, Letter LO-0518-59973, May 16, 2018 (ML18136A850), and SECY-19-0079, Staff Approach to Evaluate Accident Source Terms for the NuScale Power Design Certification Application, Aug. 16, 2019.

63 10 CFR 50 Appendix A, Criterion 19.

64 NUREG-0737, Clarification of TMI Action Plan Requirements, Nov. 1990, Item II.B.2.

65 GDC 19 was subsequently amended to a 5 rem TEDE dose limit.

66 SECY-21-0004, Proposed Rule: Nuscale Small Modular Reactor Design Certification (RIN 3150-AJ98; NRC-2017-0029), Enclosure 1, Proposed Rule, Jan. 14, 2021.

LO-0221-74035 Enclosure Appendix Page A3 of A8 additional information regarding the potential for leakage from this system, the NRC was unable to determine whether this leakage could impact analyses performed to assess main control room dose consequences and offsite dose consequences to members of the public and whether this system can be safely re-isolated after monitoring is initiated due to potentially high dose levels at or near the isolation valve location.

FSER Section 12.3.4.1.3 provides Staffs specific regulatory basis for their conclusion that the design of CGM could not be resolved by the DC. There, Staff state first:

10 CFR 50.34(f)(2)(xxvi) requires applicants to provide for leakage control and detection in the design of systems outside containment that contain (or might contain) accident source term (i.e., a core damage source term) radioactive materials following an accident. However, the applicant has not provided information necessary for the staff to address the leakage control and detection in systems outside containment, such as the maximum allowable total leakage from the systems used to perform combustible gas monitoring.

Staff omitted essential details concerning this requirement. As NuScale documented in response to eRAI 9690, 10 CFR 50.34(f)(2)(xxvi) does not impose a requirement for a quantitative dose assessment or a dose limit related to leakage from systems outside containment. As described in the corresponding NUREG-0737 Item II.B.2, the only requirement is that licensees and applicants develop and submit a leakage control program to reduce leakage to as-low-as-practical levels.67 The wording of 10 CFR 50.34(f)(2)(xxvi) is consistent with NUREG-0737 in that it omits a dose criterion and describes the goal as minimizing potential exposures. NuScale surveyed numerous leakage control programs from the industry, and each specifies that the acceptance criterion for leakage in systems subject to this requirement is as low as practical, not a quantified leakage limit.

NRC knows how to set a dose limit where it intends to do so,68 but here NRC did not. That intent is confirmed by another, interrelated TMI Action Item. NUREG-0737 Item II.B.2 (the radiation and shielding design review per 10 CFR 50.34(f)(2)(vii)) does prescribe a dose limit for operator access to important areas and requires an analysis to evaluate that dose. Yet Item II.B.2 states unequivocally: Radiation from leakage of systems located outside of containment need not be considered for this analysis, and leakage measurement and reduction is treated under Item III.D.1.1. It is specious for Staff to impose a dose limit where there intentionally is none, and to then conclude that NuScale must specify a maximum allowable total leakage and analyze the resulting doses from CGM in order to provide assurance that dose criteria are not exceeded.69 Next, Staff state in FSER Section 12.3.4.1.3 that they are unable to reach a conclusion that [the CGMC] can be re-isolated in order to mitigate potential leakage from these systems that may impact the ability to demonstrate compliance with the requirements of 10 CFR 50.34(f)(2)(xxviii) to limit radiation exposure to control room operators; the requirements of 10 CFR 52.47(a)(2)(iv) to limit exposure to members of the public; and the requirements of 10 CFR 50.34(f)(2)(vii) to perform radiation and shielding design reviews The concern over re-isolation arises because, when postulating that operators use CGM some 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after an extremely unlikely core damage accident, Staff further postulated that those operators may 67 See NUREG-0737 Item III.D.1.1, Documentation Required.

68 Cf. 10 CFR 50.34(f)(2)(viii), another TMI Action Item that requires the capability to sample post-accident without radiation exposures to any individual exceeding 5 rems to the whole body or 50 rems to the extremities.

69 FSER Section 12.3.4.1.3.

LO-0221-74035 Enclosure Appendix Page A4 of A8 discover leakage from the CGM equipment that requires re-isolation to limit release. Here again, Staffs regulatory basis does not hold up. Each of these cited regulations are addressed in turn.

10 CFR 50.34(f)(2)(xxviii) 10 CFR 50.34(f)(2)(xxviii) does require an applicant to evaluate and address potential radiological leakage into the control room to ensure control room habitability under core damage source term conditions. But that requirement, TMI Action Item III.D.3.4, is redundant to GDC 19 for any new applicant.

As NUREG-0737 makes clear, the intent of the requirement was to ensure existing licensees were in compliance with the control room habitability criteria of Standard Review Plan (SRP) Section 6.4.70 Older facilities may not have been licensed under the SRP or subsequent design changes may have impacted continued compliance.71 For a new reactor, compliance with GDC 19 as implemented by SRP 6.4 achieves compliance with 10 CFR 50.34(f)(2)(xxviii). The current version of SRP 6.4 specifies that for new reactors implementing an alternate source term, the guidance on dose analysis of Regulatory Guide 1.183 is applicable for ensuring control room radiological habitability. Regulatory Guide (RG) 1.183 does not require that leakage from severe accident mitigation features be included in the source term analysis.72 Per RG 1.183 Appendix A, the scope of potential radiation sources analyzed includes containment leakage and engineered safety featuresin other words, safety-related systems credited for meeting dose limits following a design basis accident. In contrast, RG 1.183 states that containment purging capabilities maintained for purposes of severe accident management [that] are not credited in any design basis analysis do not need to be evaluated for dose contribution.

NRC Staff reasoned that although CGMC is not an ESF, it does not look like containment purging either.73 The only function of CGMC is monitoring following a beyond-design-basis accident; it is not credited in any design basis analysis. Instead of recognizing RG 1.183s clear and logical distinction between systems necessary to mitigate a design basis accident and those that perform only severe accident functions, Staff erroneously concluded that whether the radiological source was piping outside containment was the pertinent question. Under this view, a large radiological release during a severe accident (containment purge) could be excluded from dose analysis but small line leakage cannot.

Because CGMC is only a severe accident monitoring feature it is not required by RG 1.183 to be analyzed in assessing control room doses. Therefore, the NuScale control room dose analysis meets RG 1.183, meets SRP 6.4, and thereby demonstrates compliance with 10 CFR 50.34(f)(2)(xxviii) to limit radiation exposure to control room operators.

10 CFR 52.47(a)(2)(iv)

Staff next cite CGMC leakage as precluding their finding that offsite dose requirements of 10 CFR 52.47(a)(2)(iv) are met. It is uncontroverted that CGM is a requirement only for beyond design basis accidents, as stated in the rule itself. The NuScale design does not need and would not use CGM for any design basis accident.74 The offsite dose limits of 10 CFR 52.47(a)(2)(iv) apply to the most limiting design basis accident (which NuScale refers to as the maximum hypothetical accident, or MHA).75 Although that 70 NUREG-0737 Item III.D.3.4, Clarification (licensees that meet the criteria of the SRPs should provide the basis for their conclusion that SRP 6.4 requirements are met.)

71 See NUREG-0660, Item III.D.3.4: NRR will require all facilities that have not been reviewed for conformance to

[SRP 6.4] to do the evaluations and establish a schedule for necessary modifications.

72 Regulatory Guide 1.183, Rev. 0, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

73 Transcript, Advisory Committee on Reactor Safeguards (ACRS) NuScale Subcommittee, Open Session, Nov. 20, 2019, p. 356.

74 Even in a severe accident, the design is demonstrated to maintain containment integrity for at least 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> regardless of combustible gas levels.

75 While RAI 9690 also identified GDC 19 as part of the regulatory basis, it was omitted in Staffs FSER discussion.

LO-0221-74035 Enclosure Appendix Page A5 of A8 MHA assumes a source term that would in reality result only from a severe accident, the rule deterministically imposes it as a design basis source term for the specific purposes of evaluating containment performance and plant site characteristics under design basis conditions.

The MHA dose evaluation is distinct from other regulatory requirements, such as the limiting LOCA for ECCS performance and containment integrity, for which severe core damage is not allowed to occur. A mechanistically-derived core damage event is beyond the design basis of all licensed plants. Where NRC substantiates a safety concern from a potential beyond-design-basis core damage accident, the agency has prescribed design enhancements to assist in coping and reducing the consequences from it. In other words, NRC does not require that potential mechanistic core damage sequences such as one resulting from station blackout meet the design basis dose limits of 10 CFR 52.47(a)(2)(iv). By expecting NuScale to include leakage from the beyond-design-basis accident function of CGM in evaluating conformance with offsite dose limits, NRC Staffs position contradicts agency practice and the regulatory framework.

10 CFR 50.34(f)(2)(vii)

Finally, Staff cite CGMC leakage as precluding their finding on the requirements of 10 CFR 50.34(f)(2)(vii) to perform radiation and shielding design reviews. As noted in Section 2.1 above, this requirement and its guidance do impose a 5 rem dose limit for operator access to important areas. Again, though, NUREG-0737 explicitly excludes leakage from CGMC from the dose analysis required: Radiation from leakage of systems located outside of containment need not be considered for this analysis.

NUREG-0737 instead relies on the leakage control program of Item III.D.1.1 and its as-low-as-practical leakage control standard to reasonably assure acceptable doses from such systems. The NuScale DCA requires a leakage control program to ensure CGMC leakage is as low as practical. Therefore, the NuScale DCA satisfies 10 CFR 50.34(f)(2)(vii).

For the reasons discussed above, each regulation that Staff cite in FSER 12.3.4.1.3 as a shortcoming is satisfied by the NuScale DCA without a specified CGMC leakage limit or dose analysis. In the proposed DC rule of SECY-21-0004, Staff introduced an additional regulatory basis:

The issue may be resolved by performing radiation dose calculations and demonstrating that doses will remain within applicable dose limits in 10 CFR part 20, Standards for Protection Against Radiation.

The dose limits of Part 20 are occupational and public dose limits for operational exposures. Part 20 does not impose limits on doses from any accident condition, let alone a beyond-design-basis core damage accident that would necessitate combustible gas monitoring. In fact, 10 CFR 20.1201 contemplates doses in excess of annual occupational limits due to an emergency condition.76 NuScale recognizes that the Commission has stated that the Part 20 dose limits should remain guidelines for emergency response exposures.77 However, that general guideline should not be understood to extend the regulatory reach of Part 20 or the various regulations cited by Staff in FSER 12.3.4.1.3, which have a different or purposefully lack a dose criterion. Imposing the Part 20 dose limits as a severe accident design dose criterion changes the NRCs regulations without following the process to do so.

2.3 NuScales Position 2.3.1 CGM leakage is not a safety concern 76 Doses received in excess of the annual limits, including doses received during accidents, emergencies, and planned special exposures, must be subtracted from the limits 10 CFR 20.1201(b).

77 Standard for Protection Against Radiation, 56 Fed. Reg. 23,360, May 21, 1991, p. 23,365. But see NUREG-1736, Consolidated Guidance: 10 CFR Part 20- Standards for Protection Against Radiation, Oct. 2001, p. 3-2 (This section also makes clear that Part 20 regulations do not apply to licensee activities performed in order to mitigate potential health and safety consequences from accidents or from other incidents involving radioactive material.).

LO-0221-74035 Enclosure Appendix Page A6 of A8 Potential leakage from the CGM presents no undue risk to the health and safety of the public or site personnel.

Consistent with NRC requirements and precedent, NuScale postulates for the purposes of radiological dose analyses a maximum hypothetical accident source term that would result from substantial damage to the reactor core. NuScales core damage event (CDE) source term represents a set of key source term parameters derived from a spectrum of surrogate severe accident scenarios. No design basis accident in the NuScale design uncovers the core or damages fuel, let alone results in severe core damage. The CDE has a probability of occurring less than 3x10-10 per year. The estimated doses from the CDE, conservatively calculated in accordance with traditional Chapter 15 methods and approved codes, are less than 3 percent of the exclusion area boundary dose limit78 and less than half of the control room dose limit.79 Thus, the entirety of containment leakage, which has been conservatively analyzed using maximum leakage rates assured through design, preoperational, and operational testing, amounts to much less than the acceptance limits. Events that would yield a CDE-level source term in the 160 MWt NuScale reactor are predicted to occur with a frequency orders of magnitude less than what the Safety Goals allow for a large release80 from a gigawatt-scale plant. At the frequency of intact containment core damage at a NuScale reactor, any release from the CGM pathway would necessarily be non-risk significant. The required leakage control program will minimize leakage from CGM.

2.3.2 The DCA meets all applicable requirements Staffs conclusion that leakage from NuScales CGMC must be included in dose assessments is erroneous because it conflates two distinct aspects of NRCs regulations. On the one hand, required dose analyses make use of a postulated non-mechanistic, stylized core damage source term. On the other hand, CGM is required to assist emergency response following a mechanistically-possible beyond-design-basis severe accident.

Staff would have NuScale analyze the CGM doses because they reason that CGM would be used following the core damage event that constitutes NuScales MHA. If applied elsewhere, this position would foreclose design features NRC has already approved or required to mitigate the consequences of core damage events. For example, containment venting as a remedy to over-pressurization, as mandated for some designs in response to Fukushima, would not be possible if the Chapter 15 dose assessment based on a core damage source termhas to include the dose from containment venting. The CGM function required by 10 CFR 50.44 is analogous in its purpose and basis.

As detailed in Section 2.2 above, NuScales DCA complies with the relevant regulatory requirements because (1) the specified dose limits do not require consideration of radiological sources that are not used to mitigate a design basis event, and (2) implementation of a leakage control program to reduce leakage to as-low-as-practical levels complies with 10 CFR 50.34(f)(2)(xxvi) without modeling the dose consequences of hypothetical leakage from combustible gas monitoring.

2.3.3 Precedent supports NuScales position Precedent supports NuScale's position. For example:

x The ESBWR design includes a Containment Monitoring System (CMS) that is partially routed outside of containment and is used to monitor the hydrogen and oxygen gas concentrations in the 78 0.63 rem TEDE compared to the acceptance limit of 25 rem.

79 2.14 rem TEDE compared to the 5 rem TEDE limit of GDC 19.

80 Safety Goals for the Operations of Nuclear Power Plants; Policy Statement; Republication, 51 Fed. Reg. 28,044, Aug. 21, 1986.

LO-0221-74035 Enclosure Appendix Page A7 of A8 drywell and wetwell during post-accident conditions. No leakage is assumed from the CMS in the accident dose evaluations, and the leakage control program specifies that leakage from that and other systems containing accident source term outside containment be as low as practicable.81 x The APR1400 includes a hydrogen monitor outside containment as part of its CMS. The CMS is included in scope of the leakage control program without quantifying an acceptance criterion.82 x The ABWR includes 13 systems outside containment that may contain source term following an accident, including post-accident sampling, process sampling, containment atmospheric monitoring, fission product monitoring. Such systems are subject to the leakage control program and leakage from them does not appear to be included in accident dose evaluations.83 The ABWR SER concludes that a requirement for COL applicants procedures to reduce detected leakages to lowest practical levels satisfied TMI item III.D.1.1.84 In response to this precedent, NRC Staff noted differences between the ESBWR CGM equipment and the NuScale design, and cited reasons why the CGM leakage might be more significant for NuScale.85 However, the differences cited are immaterial to the matter at hand.86 Staff did not address the other design certification precedents.

Review of operating plant licensing basis information indicates that NuScales approach is also consistent with the plants that were initially subject to the TMI requirements. In justifying removal of post-accident sampling systems (PASS) from their plants, the CE Owners Group documents that:

Based on plant-specific experience using PASS, several utilities have included leakage from PASS during post-accident plant sampling in demonstrating adherence to 10CFR100.11 and GDC 19 exposure guidelines. For example, a 350 cc/hr leakage from the PASS is estimated to contribute approximately 2 rem to the thyroid doses at the exclusion area boundary and low population zone. PASS leakage is also estimated to contribute 1.7 rem to the Control Room thyroid dose.87 Even though PASS is potentially a significant contributor to offsite and control room doses, only several plants included that potential dose in their offsite and control room dose consequence analysis. Many, it follows, excluded that dose contributor and relied only on their leakage control program to maintain leakage as low as practical. As with NuScales CGM, PASS in those facilities served a post-accident monitoring function to inform emergency response, would contain accident source term following core damage, and is not safety-related. Reliance on the leakage control program was compliant for those facilities and must also be for NuScales design.

81 ESBWR DCD, Chapter 7, Figure 7.5-1; Chapter 15; Chapter 16, Generic Technical Specification 5.5.2.

82 APR1400 DCD, Section 6.2.5.2.2; Chapter 16, Generic Technical Specification 5.5.2.

83 ABWR DCD, Section 1A.2.34, Rev. 4.

84 NUREG-1503, Section 20.5.38.

85 Transcript, Advisory Committee on Reactor Safeguards (ACRS) NuScale Subcommittee, Open Session, Nov. 20, 2019, p. 193.

86 Staff favorably noted that the ESBWR CMS is redundant. However redundancy would not reduce the likelihood or magnitude of potential leakage. Staff also noted the CMS is safety-related and Seismic Category 1, but those attributes do not preclude leakage or the analysis of it in other contexts (see discussion of RG 1.183 and ESF systems, above). Per NRC regulation and guidance, the CGMC does not need to be safety-related (10 CFR 50.44(c)(3) and Regulatory Guide 1.7, Section 2.1). Still, the ACRS remarked that the system was not safety grade.

Advisory Committee on Reactor Safeguards, Safety Evaluation of the NuScale Power, LLC Topical Report TR- 0915-17565, Revision 3, Accident Source Term Methodology, and Source Term Area of Focus Review for the NuScale Small Modular Reactor, Dec. 20 2019.

87 CEOG, CENPSD-1157, Rev. 1, pg. 11 (ML003699802) (emphasis added).

LO-0221-74035 Enclosure Appendix Page A8 of A8 2.3.4 If combustible gas monitoring leakage is a safety concern, it should be addressed generically Based on the above, NuScale believes NRC Staff have either misconstrued the existing regulatory requirements or seek to implement a new interpretation based on perceived safety significance. If the latter, then NuScale believes this issue must be addressed generically and not as a new requirement unique to the NuScale design. As indicated by the CE Owners Group example, small leaks from small lines outside containment may be meaningful dose contributors during a severe accident. This is the precise issue NRC addressed with TMI item III.D.1.1s requirement to reduce leakage to levels as low as practical. If NRCs current view is that approach is inadequate and quantified dose analysis and limits are now a requirement for those same systems, NRC should pursue the matter generically. NuScale believes such a review would conclude that the leakage is not risk significant whether for existing designs or for NuScales design with a CDF orders of magnitude lower.

3.0 Conclusion The NuScale DCA presents a CGMC design and sufficient information for the NRC to conclude that it meets relevant regulatory requirements. Therefore, Staffs proposal to exclude CGM leakage from issue resolution is unwarranted.