ML20191A069

Research Paper on NuScale Boron Dilution and Incursion

ML20191A069
Person / Time
Issue date:	07/01/2020
From:	Peter Yarsky Office of Nuclear Regulatory Research
To:
Bravol B (415)-6715
References
NRR-2020-014-IAR
Download: ML20191A069 (38)

Text

USNRC Office of Nuclear Regulatory Research NuScale Core Reactivity Consequences of Boron Dilution and Incursion during Postulated SBLOCA with Coincident Rod Insertion Failure Events NuScale Core Reactivity Consequences of Boron Dilution and Incursion during Postulated Small Break Loss-of-Coolant-Accidents with Coincident Rod Insertion Failure Events. Work Done to support NRR-2020-014-IAR.

Yarsky, P 7-1-2020 0

1 Introduction On June 9, 2020, the Office of Nuclear Reactor Regulation (NRR) requested that the Office of Nuclear Regulatory Research (RES) provide technical evaluation assistance to the review of the Probabilistic Risk Assessment (PRA) for the NuScale design certification [Ref. 1]. In particular, this request (NRR-2020-014-IAR) focuses on core damage during sequences where there is significant boron dilution in the reactor coolant system. RES has been requested to provide technical insight into the physical processes affecting the boron dilution and how those processes might impact the likelihood for core damage to occur during the postulated events.

The key event sequence is a beyond design basis event initiated by a loss of coolant accident with a simultaneous failure of the control rods to insert. In the parlance of this white paper this event has been referred to as an ATWS [anticipated transient without SCRAM] event even though the initiating event is not an anticipated transient.

It has been postulated that if there is significant boron dilution (i.e., boron that has a very low boron concentration) somewhere in the reactor coolant system that this diluted water could transport to the core region (which is uncontrolled) and lead to a super prompt reactivity excursion. Such an excursion, depending on the severity of the reactivity excursion, hypothetically, could lead to core damage if the ensuing power transient deposits excessive energy in the fuel rods. The purpose of this white paper is to document the physical mechanism of boron dilution in the NuScale design, cover the expected event progression, and to highlight physical phenomena or processes that could affect the likelihood for core damage.

1.1 Mechanism of Boron Dilution During certain postulated event sequences it is possible for the water in the reactor coolant system (RCS) downcomer to become relatively diluted in boric acid compared to the water in the balance of the reactor pressure vessel (RPV). This boron dilution may occur during an event where the riser uncovers and the decay heat removal system (DHRS) is operating. When the riser uncovers, the normal natural circulation flow pattern in the RCS is broken. When this circulation flow pattern breaks, the core flow will stagnate. The core power will heat the coolant and cause some amount of the coolant to boil-off. The core will act as a distiller concentrating the boric acid in the core and/or riser sections while the steam leaving the riser can potentially condense on the steam generator tubes. If the DHRS is active, the steam generator will act as a heat sink and remove heat from the steam above the liquid level in the downcomer. The DHRS may condense the steam in the steam generator annulus and this return condensate produces a flow of pure water from the steam generator annulus to the downcomer. Over time the boiling in the core and the condensing on the steam generator tubes creates a distillation effect whereby the boron becomes more and more concentrated in the core/riser region and more and more dilute in the downcomer region.

1

Figure 1: Boron Dilution during SBLOCA with No Rod Insertion Figure 1 presents results from a TRACE calculation for a postulated 7 percent break of the chemical and volume control system (CVCS) discharge line in containment [Ref. 3] and shows the difference in core and downcomer region coolant boron concentration. If the rods fail to insert, TRACE shows that, prior to emergency core cooling system (ECCS) actuation, a significant difference in boron concentration between the core and downcomer can develop.

When the ECCS actuates (shortly after 4000 seconds), there is a very brief period where the boron concentration in the core spikes downward and this relates to the concern regarding the transport of the diluted boron back into the core region.

1.2 NuScale Design Features affecting Boron Dilution According to [Ref. 7], the NuScale design was modified to reduce the possibility of prompt reactivity consequences resulting from the transport of diluted water from the downcomer to the core region. There are two primary design updates: the first relates to the ECCS actuation logic and the second relates to the riser component. The former change includes a change to the containment level setpoint and includes an actuation criterion based on the RCS pressure.

These changes to the actuation logic reduce the downcomer boron dilution period and limit the possibility of diluted water flowing rapidly from the downcomer to the core by preventing the reactor recirculation valves (RRVs) from opening under conditions where flow would be from the 2

containment to the RPV. The latter change to the riser is intended to reduce the dilution effect by allowing mixing of the riser and downcomer inventories through the riser holes during conditions when the riser becomes uncovered.

1.2.1 ECCS Actuation Logic The ECCS actuation logic changes are described in [Ref. 7], but amount to changes to the low containment vessel (CNV) level setpoints, new low RCS pressure actuation mechanism and interlocks. The CNV level setpoint was lowered, which ensures that the ECCS actuation will occur earlier during LOCA. The earlier initiation precludes the possibility of actuation occurring at a time when the RPV pressure is low and CNV level exceeds the RPV level. Therefore, scenarios where the RRVs open are ensured to result in a new outward flow from the RPV to the CNV. This reduces the possibility of high level in the CNV driving flow from the CNV to the RPV, which in turn precludes the level difference from driving diluted downcomer inventory into the core.

A new ECCS actuation criterion has been added which initiates the ECCS when the RCS pressure drops below 800 psia. The addition of this new actuation signal accelerates ECCS actuation during small break LOCA (SBLOCA) scenarios. Before the design change it was possible during SBLOCA scenarios to uncover the riser for a long time before the CNV level reached the ECCS actuation setpoint. The long duration between riser uncovery and ECCS actuation led to a large boron dilution in the downcomer. However, the actuation logic change speeds up the ECCS actuation during SBLOCA and reduces the time during which dilution might occur.

Interlocks are added to the logic to prevent the ECCS actuation in non-LOCA scenarios. These interlocks are designed to prevent actuation of ECCS when there is an anticipated transient without SCRAM (ATWS) event with DHRS cool down. By eliminating the ECCS actuation, this eliminates the possibility for level reduction below the top of the riser and, consequently, the possibility for boron dilution to occur.

1.2.2 Riser Holes Small holes have been added to the riser at the mid elevation of the steam generator tubes

[Ref. 7]. These small bypass holes allow for a diverse flow path from the riser to the downcomer in instances where the level drops below the top of the riser. By allowing the liquid flow path from the riser to the downcomer even in cases where level might drop below the riser, these flow holes may preclude, or at least delay the onset of, boron dilution in the downcomer region if there is flow through the riser holes.

2 Candidate Loss-of-Coolant-Accidents In this section, the staff evaluates different loss of coolant accident (LOCA) scenarios to determine those aspects of the LOCA that are expected to produce the most adverse consequences from the standpoint of boron dilution and subsequent core flow incursion. The staff considered break location, size, and time in cycle. Because of the change in the design to include flow holes in the riser, non-LOCA initiating events are not expected to produce 3

conditions that could result in boron dilution because there will still be liquid flow to the downcomer from the riser.

2.1 Vapor vs. Liquid Space Break A vapor space break can be expected to lead to a more rapid reduction in pressure and a slower loss of inventory compared to a liquid space break. Therefore, the staff expects that boron dilution will be worse for a liquid space break. A liquid space break could result in a substantial loss of inventory with only a smaller reduction in pressure. This could result in riser uncovery before the pressure drops low enough to allow actuation of the ECCS valves.

Therefore, the steam generators will be uncovered at high pressure. If the decay heat removal system (DHRS) is operating the steam generators will condense steam in the vapor space above the downcomer level leading to a distillation effect where boron is concentrated within the riser but diluted in the downcomer. At higher pressure the reactor power (and hence steaming rate) can be expected to be higher because of the moderator density feedback effect. The condensation heat transfer (and hence condensation rate) can also be expected to be higher.

Since the liquid space break is more likely to result in riser and steam generator uncovery at higher pressure, the staff expects that this kind of break will produce the most rapid dilution of boron in the downcomer region.

2.2 Large vs. Small Break The staff considered both large and small breaks. As discussed above, a higher pressure in combination with low level should lead to more adverse boron dilution in the downcomer. If the LOCA is a large break the RPV should rapidly depressurize while a small break LOCA can lead to a loss of inventory without significant loss in RPV pressure. Therefore, the staff expects that a small break will bound a large break in terms of the consequences of boron dilution.

2.3 Time in Cycle The beginning of cycle is the most limiting condition because this point in cycle represents the highest possible coolant boron concentration; and therefore, the maximum difference in reactivity worth between the nominal and diluted coolant.

3 Event Progression The postulated scenario is initiated by a small break LOCA in the liquid space. Depending on the break size, core parameters, and operator actions the event may progress in slightly different trajectories. This section describes a postulated progression of the event, but the staff notes that differences in assumptions could change the order of the key events and phases in the progression. The staff assumes that there is a mechanical binding of all control rods and all control rods fail to insert to when demanded by the module protection system (MPS) and further, that rods do not insert at any point in the transient.

3.1 Actuation of Engineered Safety Features 4

The initiating event (SBLOCA) will rapidly lead, based on various signals, to several trips. The high containment pressure signal can be used as a surrogate for the purpose of the discussion.

Once the high containment pressure signal is received, this will lead to an automatic trip of the reactor, turbine, and feed systems. In the postulated scenario, the MPS reactor trip fails. The loss of heat sink will lead to an early actuation signal for the decay heat removal system (DHRS). For a hypothetical SBLOCA without rod insertion, the loss of heat sink will lead to an increase in RPV pressure and the DHRS may actuate based on high pressurizer pressure. The details of the actuating signals are not very important to the long term trajectory, but one can reasonably expect that early in the progression the DHRS becomes the primary heat sink.

3.2 Level Drops Below Pressurizer Plate The event may progress either slowly or rapidly depending on the reactor power response. If the reactor power remains high, and in excess of the DHRS capacity, then the RPV will lose inventory through the break as well as though the reactor safety valves (RSVs). If the power is low, then inventory loss will be driven primarily by the break. In either case, the pressurizer level drops and eventually uncovers the pressurizer plate.

3.3 Level Drops Below Top of Riser The level continues to drop. In the postulated scenario the reactor power remains sufficiently high to ensure that the RPV pressure remains relatively high. If the reactor were to have tripped, the DHRS heat removal would be sufficient to lead to a depressurization of the RPV. In the current scenario it is postulated that the failure to insert rods maintains a high power level in the core. Since the RPV pressure stays high, the break continues to remove inventory but the high RPV pressure prevents opening of the ECCS valves. Therefore, the level continues to drop. Eventually the level drops below the top of the riser and this causes the natural flow circulation loop between the riser and downcomer to break. If the RCS pressure remains above the low RCS pressure ECCS actuation setpoint and the CNV level remains below the high level setpoint the ECCS valves remain closed and the boron distillation process begins where boron is concentrated in the core region and diluted in the downcomer.

3.4 Reactor Subcriticality When the natural circulation flow loop breaks, the core flow will decrease significantly. The decrease in flow will lead to more substantial voiding in the core and this will likely be sufficient to lead to reactor shutdown. If the core does not shut down immediately, then the continued progression of the event at low flow will lead to boil-off and the concentration of boron in the core region. As level continues to drop the combination of lower flow and higher concentration will eventually provide sufficient negative reactivity to shut down the reactor. Steam produced in the core can be removed by RSV cycling (if pressure is very high) or by condensation on the steam generator coils. Condensation will produce a pathway for unborated water to enter the downcomer region.

3.5 Level Drops Below Riser Holes Once the riser uncovers the core power will decrease due to the reduction in core flow. Due to the break the level will continue to drop. Once the level drops below the riser holes there will no 5

longer be a liquid flow path from the riser section to the downcomer. Condensation on the steam generator tubes will add unborated water to the downcomer, but after severing the flow path through the holes, the more highly concentrated borated coolant remains in the riser section. Assuming limited flow oscillations between the core and downcomer regions, continued condensation will cause the downcomer water to become increasingly more diluted.

3.6 RCS Pressure Decreases and ECCS Valves Open There will be heat removal through both the DHRS as well as though conduction to the RPV.

The RPV can transfer heat to the fluid now occupying the containment vessel (CNV) through convection between the RPV outer surface and the CNV inventory and more directly through the break. Once the reactor shuts down due to a combination of the effect of voiding and boric acid distillation and concentration, the heat removal will be sufficient to start decreasing the RPV pressure. There will be reactivity driven effects that will affect the rate of the depressurization and the core may become recritical. Even with recriticality, though, the continued inventory loss should lead to an overall reduction in RPV pressure with time. Eventually the RPV pressure will drop low enough to permit the ECCS actuation.

ECCS actuation will result in the opening of the reactor vent valves (RVVs) and the reactor recirculation valves (RRVs). When the RVVs open the RPV will rapidly depressurize and the opening of the RRVs will lead to addition level reduction. The depressurization brought on by the RVV opening will cause flashing, which will occur preferentially in the core and riser region due to the higher temperature of the coolant. The flashing will cause a flow reversal as the void eruption in the core and riser causes the coolant to significantly expand. The void eruption expansion drives liquid downward and through the lower plenum to the downcomer. This will cause the level in the downcomer to swell. Following the swell, once the rapid depressurization and flashing period ends, the downcomer level will be substantially higher than the riser level and the flow will surge back into the core.

With RVVs and RRVs open, the RPV pressure and level will continue to decrease.

3.7 Level Reaches RRV With the ECCS valves open, inventory will rapidly transfer from the RPV to the CNV. CNV level rises as steam condenses on the CNV wall and as liquid is transferred from the break and the RRVs. The combined RPV/CNV system will approach a condition where level is equalized between the riser, downcomer, and CNV with level stabilizing around the elevation of the RRV.

The long term recirculation flow path will be for steam generated in the core to flow through the riser, then RVVs, to condense on the CNV, and flow from the CNV back through the RRVs to the downcomer and finally from downcomer to core. At low pressure with high void fraction and high boron concentration the core may remain subcritical and flow rates will be low throughout the system.

3.8 Recovery At some point in the transient, operators may intervene to add boron, control level, restore level, or reduce RPV pressure. Particularly if there is a complete or partial failure of the ECCS valves, the operators may intervene during the event with the chemical and volume control system (CVCS) to control pressure or level. Operation of the CVCS in its various different modes may 6

depend on the initiating SBLOCA - for example a discharge line break may complicate operation of the CVCS during the event. CVCS may inject water into the riser, downcomer, or pressurizer. Additionally, the operators may attempt to control or restore level with the containment flooding and drain system (CFDS) which can inject water into the CNV. Without detailed emergency operating procedures (EOPs) it is not evident what are the specific symptom-based conditions that would prompt operators to take these various actions with the CVCS or CFDS.

The staff recommends conducting the review in a manner where only reasonable operator actions are considered in the final safety evaluation. Manual operator actions that clearly produce more adverse conditions will most likely be precluded in the final EOPs and it would not be reasonable to postulate such actions in the current review.

4 Heat Balance The staff has previously analyzed anticipated transient without SCRAM for the NuScale power module [Ref. 2] and found that, generally, the event progresses in a manner where reactor power comes into balance with the heat removal from the RCS. This balance generally occurs because as RCS heats up, reactivity feedback mechanisms generally lead to a reduction in power generation; while at the same time as the RCS heats up the heat removal capacity of the various heat removal pathways increases. So, if power outpaces the heat removal capacity, the RCS temperature increases until power drops to the point where it is balanced by the increased heat removal. The staff found that analyzing the heat balance during postulated ATWS events clarified the long-term progression and ultimate consequences. Therefore, this section focuses on expanding the discussion of the heat balance as it may be affected by not only changes in RCS temperature, but also system pressure and coolant distribution.

4.1 Effect of Vessel Pressure on Decay Heat Removal When considering the effect of pressure on heat removal, the staff considered two scenarios. In the first, the riser remains covered and there is no substantial inventory in the containment vessel. This can be thought of as representing the early phase of a hypothetical LOCA scenario. If the riser remains covered the primary heat removal mechanism will be the convective heat transfer from the coolant in the steam generator annulus to the coils. The natural circulation flow rate on the primary side is driven by the density difference created by the thermal expansion of the coolant as it is heated in the core and then subsequently cooled in the annulus. The thermal expansion coefficient is only a weak function of the system pressure [Ref.

15]. Therefore, the flow rate through the primary will remain roughly the same regardless of the system pressure. Since the convective heat transfer dominates during the early transient the total heat removal will be largely dictated by the DHRS capacity and will be insensitive to the primary side pressure. It should be noted that there is also energy loss through the break, but the limiting event is initiated by a small break, so this energy loss should be small and result in a slow change in the RPV pressure - meaning that the choked flow rate will vary slowly as well.

Therefore, during the initial phase the heat removal should not be very sensitive to the change in pressure.

When the riser uncovers, either through sustained break flow or by ECCS actuation, the situation fundamentally changes. Level dropping below the riser breaks the natural circulation flow loop and causes the core flow to stagnate. Under these conditions there is significantly reduced convective heat transfer in the steam generator annulus because the flow rates are 7

much lower than when the riser is covered. This reduction in the convective heat transfer means that the DHRS may not dominate the heat removal from the primary and the various heat removal pathways may compete for which path is dominant in the longer-term. Under these conditions, the heat removal will be much more sensitive to the RPV pressure. The three primary paths to consider are: (1) DHRS, (2) passive heat removal via conduction through the riser, downcomer, RPV and CNV to the reactor pool, and (3) break/ECCS valve flow and CNV condensation.

In the heat balance, these three pathways will generally be matched to the core power level.

The DHRS heat removal will switch from a convective mode to a condensation heat transfer regime as the coils become uncovered and are exposed to a steam atmosphere above the downcomer liquid level. The steam will condense on the coils and the condensate will flow into the lower downcomer. Condensation heat removal should be substantially lower than the convective heat removal. However, condensation heat transfer will be sensitive to the pressure.

As pressure increases the condensation rate should also increase. Figure 2 (taken from [Ref.

9]) shows a relationship between condensation heat removal and pressure. The experimental data are more representative of condensation heat transfer in the DHRS heat exchanger tubes but is shown here just to illustrate only the functional dependence between condensation heat transfer and pressure. As pressure increases, condensation heat transfer is more effective.

Figure 2: Relationship between Condensation Heat Removal and Pressure from [Ref. 9]

As for the second pathway, while there is a convective element to the overall heat transfer due to internal recirculation flows within the riser, within the downcomer, and within the CNV, for brevity this pathway will be referred to as the conduction pathway because it also relies on conducting heat through the vessel structures. The heat removal is driven by the temperature difference between the core and the reactor pool on the outside of the CNV. When the riser uncovers the coolant in the core will approach saturation temperature whereas the reactor pool water will remain approximately constant. Since the saturation temperature increases with pressure, the conduction heat removal will increase with increasing RPV pressure.

The final pathway is the break/ECCS valve flow. The flow of fluid from the RPV to the CNV removes energy from the primary side and leads to condensation on the CNV inner wall in the steam space above the CNV liquid level. At higher RPV pressure, the flow is driven from the RPV to the CNV, removing energy from the primary side. After the blowdown the RPV and 8

CNV pressures will equalize. Then the heat removal is dictated by condensation heat transfer on the CNV wall, which will be a strong function of pressure (see Figure 2). Therefore, heat removal is higher when pressure is higher before equalization because of higher break flow and heat removal is higher when pressure is higher after equalization because of higher condensation heat transfer on the CNV inner wall.

In conclusion, heat removal is likely to be fairly insensitive to pressure changes prior to riser uncovery and then to increase with increasing pressure following uncovery.

4.2 Effect of Containment Level on Passive Heat Removal As containment level increases more of the axial span that is coplanar with the active core is covered by liquid and this increases the heat removal capability from the RPV to the CNV, and promotes overall passive heat removal. Therefore, the conduction path can become more dominant and effective as the level increases above the level of the active core region.

4.3 Condensation vs. Conduction Heat Removal At a certain point in the LOCA progression as pressure decreases, containment level increases, and downcomer level decreases, the DHRS heat removal via condensation will be less dominant and the conduction heat removal through the RPV to the CNV liquid inventory (and ultimately through the CNV to the reactor pool) will come to dominate the heat removal pathway, assuming that the core remains subcritical due to a combination of voiding and increased boric acid concentration.

As more of the decay power is transferred through conduction, the relative contribution of condensation to the total heat removal decreases. This is important to understanding the progression of the dilution. If the reactor remains subcritical and most of the decay heat can be removed through conduction, the condensation rate is very low and the dilution of the downcomer inventory will slow. However, if the reactor power continues to outpace the conduction heat removal, then condensation will continue at a higher rate and lead to more dilution in the downcomer.

This is key for scenarios such as partial ATWS where only a subset of the rods fail to insert. In this case, the reactor will likely remain subcritical through the transient, conduction will dominate condensation and dilution rates will slow as the event progresses.

4.4 Choking and Repressurization A postulated mechanism for core damage would be for a run-away pressurization event to occur. A similar mechanism has been studied for BWRs during ATWS whereby the vapor generation rate in the vessel exceeds the choked flow rate through the open valves linking the RPV to the containment. A similar mechanism might be postulated for the NuScale design whereby during an ATWS scenario the steaming rate remains sufficiently high that the production of steam cannot be exhausted through the ECCS valves to the containment. If this were to occur after the ECCS valves were opened, this would likely cause an increase in RPV pressure. It is possible, if the core had been critical with some void fraction, for the pressure increase to cause a run-away response where the voids collapse, causing a further power 9

increase, and a further increase in the steam production as the core reactivity balance chases a critical core-average void fraction.

The NuScale design differs from a BWR in many ways, one among these is the relative capacity of the ECCS to discharge steam compared to the automatic depressurization system (ADS) of a typical BWR. If the RVV capacity to discharge steam is much higher than the steaming rate, then it is highly unlikely for valve choking to produce a positive-feedback pressure excursion.

To examine the likelihood the staff performed calculations of the total RVV steam discharge capacity under choked flow conditions and compared these steam flow rates to the steam production rate for the core at various power levels. The results are summarized in Table 1.

Table 1: RVV Discharge Capacity and Steam Rates Function of Power and Pressure The pressure range considers high pressure (900 psi) consistent with ECCS actuation logic (i.e., the highest pressure when RVVs would be open) and low pressure (50 psi). So long as the reactor power is below 20 percent the RVVs have sufficient capacity to discharge the full steam production rate, preventing the possibility of pressure excursion. The only situation where the steam production rate exceeds the RVV capacity is at simultaneous conditions of low pressure and high reactor power, but these conditions are exceptionally unlikely because at low pressure the coolant will void and naturally lead to negative reactivity feedback to limit reactor power.

The staffs calculations here are also conservative because it neglects possible steam condensation from the DHRS, neglects possible overpressure relief through the RRVs if RVV choking occurs, and neglects cooling from passive containment cooling. If pressure were to begin increasing the strength of all these neglected mechanisms also increases, further limiting the possibility for a positive-feedback pressure excursion.

5 Core Response to Diluted Coolant Incursion This section discusses just the key processes affecting core response if there were a hypothetical influx of diluted coolant. This section addresses the immediate reactivity feedback mechanisms as well as other thermal-hydraulic processes that affect the evolution of the core power response.

10

5.1 Reactivity Feedback The most prompt reactivity feedback mechanism is the Doppler feedback. An increase in reactor power will cause an increase in the fuel temperature which, in turn, will cause a reduction in reactivity. During the postulated event the Doppler reactivity can be expected to increase as the power level decreases and fuel temperature decreases commensurately.

However, in the event of any reactivity insertion, the power increase from that insertion will cause a prompt negative feedback from the Doppler effect.

The next feedback mechanism is from coolant density. As heat is transferred to the coolant from the fuel elements, the coolant generally expands - causing a reduction in the moderator density and a negative reactivity feedback. The evolution of the moderator feedback can be difficult to model for the postulated scenario because the physical process of the density response changes. At high pressure, near system operating pressure, the temperature remains far below the saturation temperature and the coolant is primarily in the liquid phase. In response to an increase in heat flux, the coolant expands due to thermal expansion, and thereby, inserting some negative reactivity. However, at lower pressure the coolant will reach saturated conditions and begin boiling. Once the coolant is boiling, the addition of heat will cause more voiding. In both instances an increase in heat flux translates to a reduction in coolant density and therefore a negative reactivity feedback. In the case of a flow incursion, the coolant flowing into the core may be more subcooled, and therefore, contribute to a reactivity insertion.

Here, it is important to clarify the effect of pressure on the moderator reactivity. At lower pressure the saturation temperature is lower and therefore, coolant can boil more easily. A sudden reduction in pressure can therefore lead to void formation and have a negative reactivity contribution as a result of the void formation. However, over a longer time frame, at low pressure, if the RCS approaches an equilibrium, the liquid density will be higher because liquid water density at lower pressure is higher than liquid density at higher pressure. Generally, a reduction in pressure will lead to void formation and hence, contribute to a negative reactivity insertion through the moderator density feedback mechanism. However, it is important to consider the ramifications of lower pressure on coolant density prior to a flow incursion. If a flow incursion were to initiate from a lower pressure, that incoming coolant would be at a higher density. That higher initial density of the coolant would increase the reactivity insertion from the flow incursion compared to an incursion initiated at a higher pressure.

It is even more important to differentiate void formation in the coolant from thermal expansion of the coolant when considering the reactivity effect of boric acid dissolved in the coolant. When the coolant expands it displaces both boron and water from the core, and therefore, has a mixed reactivity effect. At high boric acid concentrations, the reactivity feedback from moderator thermal expansion may transition from having a negative feedback to a positive feedback.

However, if the coolant voids, because of the distillation effect, the boron becomes concentrated in the liquid phase and the moderator density decreases without necessarily displacing boron to the same degree. This implies that moderator feedback may be weak at high pressure due to competing effects from the thermal expansion, but at low pressure the effects are not so coupled. When the coolant is close to the saturation temperature the negative moderator feedback should become stronger as voiding overcomes boron displacement.

The interplay between the changes in water density and the implications in terms of boron density affect the progression of the reactivity transient. In systems analysis it is a challenge to 11

capture this dynamic in cases where the coolant may begin to void. First, many nuclear design codes, which are used to compute reactivity coefficients, do not make a distinction between liquid and vapor phases of the coolant. Therefore, the nuclear design codes that are used to compute the reactivity effect from a change in coolant density may not correctly adjust the boron density if the mechanism of the coolant density change is from voiding compared to thermal expansion. Second, while it may seem straightforward to presume that any voiding leaves all the boric acid in the liquid phase, there are many physical mechanisms affecting the evolution of the boron concentration (e.g., entrainment) that may make the calculation of the boron mass in the core more complicated.

For the event of interest, the reduction in pressure should lead to void generation in the core and result, over time, in the buildup of high concentration of boric acid in the liquid phase in the core and riser region of the RCS. At the same time, this void formation will displace coolant and boron from the core volume. Because of the interplay between the moderator and boron effects it is especially difficult to judge a priori how much more significant one effect will be than another. While void formation will surely add negative reactivity, the net effect from combining consideration of the reduction in density with the partial displacement of the more highly concentrated boric acid in the liquid water makes it difficult to calculate the net reactivity contribution without meticulous care in the generation of the nuclear parameters driving the kinetics model in an analysis.

As an example, a method may rely on functionalizing the core average absorption cross-section as a function of water density and boron concentration. If there is significant void formation the boron will become highly concentrated in the liquid phase, but only a small fraction of the coolant may be in the liquid phase. Since a nuclear code does not differentiate between the phases there may be a disconnect between the assumptions used to generate the nuclear parameters and the thermal-hydraulic conditions that develop during the event simulation. In short, without detailed review of any systems analysis methodology, the reactivity predicted because of boron concentration changes under voided coolant conditions should be approached skeptically.

5.2 Thermal Hydraulic Coupling and Fuel Thermal Inertia The thermal hydraulic state of the core and the core power are coupled through the reactivity feedback mechanisms. However, a change in the reactor power does not immediately feedback into a change in the thermal hydraulic state. The moderator feedback is delayed by the thermal inertia of the fuel element. The staff used geometry information from the DCD [Ref.

5] and an approximation recommended by Elenkov, et al. [Ref. 10] to estimate the fuel thermal time constant. The staff approximates the time constant as being fairly insensitive to the exposure, but in the range of ~5-7 seconds [Ref. 12]. This time constant characterizes the dynamic coupling between the reactor power and the coolant. Processes that are much faster than the time constant can be thought of as affecting the power without having that power feed back into an effect on the coolant. Conversely, processes that occur much more slowly than the time constant will be affected by moderator feedback effects.

For a postulated flow incursion, if that flow incursion ramps up over a period of multiple time constants, any reactivity insertion postulated from the incursion will be effectively damped by 12

moderator feedback effects. That is, if one imagines a cold slug impinging on the core at a rate such that the cold slug would traverse the core over one minute (i.e., many time constants),

there is sufficient time for the reactivity inserted by the cold slug to manifest a power response and for that power response to heat the cold slug and act to reverse the transient.

Therefore, when considering potential consequences from flow incursions that add reactivity, processes slower than the time constant will be at least partially, if not fully, self-mitigated by the moderator feedback effect.

5.3 Internal Recirculation and Mixing If it takes a long time to move the diluted water into the core region, the water that enters the region (and presumably adds positive reactivity) will get mixed by internal recirculation patterns and this erases the inherent positive reactivity from the insertion over time. Therefore, the positive reactivity addition has a sort of shelf-life in the core before it can be remixed with the highly concentrated borated water in the riser/core section.

TRACE results are shown in Figure 3 which give the internal flows within the core region during a postulated SBLOCA [Ref. 11]. The results show that the internal recirculation produces liquid velocities of approximately 0.05 m/sec. The mixing time can be computed by taking the ratio of the core height to the vertical liquid velocity because this represents the time it takes for the incoming fluid to traverse the core (and hence by replaced by returning flow from the riser section). Using the core height of 2 meters yields a mixing time of 40 seconds. That is, diluted coolant entering the core will mix with the riser inventory within about 40 seconds.

13

Figure 3: Liquid Velocity in the Core during SBLOCA [Ref. 11]

Because of this internal recirculation flow pattern, it is not possible for a slug of diluted water to slowly fill the core region. For example, if a mechanism is postulated that raises the level at a slow rate and would fill the core over a period of several minutes, the core should not be assumed to fill with diluted water. Rather, as that diluted water is slowly added it will mix with the riser inventory and the average concentration will remain high in the core region. Therefore, when considering possible flow incursion mechanisms, only those occurring rapidly enough to insert a large positive reactivity worth more quickly than 40 seconds need be considered.

It is worth noting that this timing relies on TRACE calculations using a model that was not developed for the purpose of characterizing the internal natural recirculation. The 40 second number here is meant only to indicate the approximate magnitude of the mixing time. If this value were to be used as a strict threshold the staff recommends performing a more detailed evaluation to quantify the mixing time.

6 Potential Mechanisms for Core Flow Surge The staff considered various phenomena and processes that might cause an increase in core flow during the postulated event progression. The staffs list here is meant to be a comprehensive examination of all mechanisms that could result in the transfer of diluted water from the downcomer to core region.

6.1 Density Wave Instability For density wave oscillations to grow, the reactor coolant system requires some phase lag between an inlet core flow perturbation and a downstream change in the pressure drop.

Conventionally this is achieved in boiling water reactors (BWRs) because the two-phase friction losses occur in the upper portion of the core and are out-of-phase with the core inlet flow. The NuScale design is different in that the flow is driven by the natural circulation driving head difference supplied by the cooler water in the steam generator annulus and downcomer compared to the hot water in the core and riser.

For the scenario of interest, it is postulated that the level drops below the top of the riser. Under these circumstances, the core flow rate drops dramatically because the natural circulation loop breaks. Internal recirculation will develop within the riser as well as in the downcomer/annulus region. One could speculate about the nature of the loop flow dynamics if the two-phase level in the riser column remains above and covers the small flow holes in the riser. In that case, however, there would be a liquid flow path through these holes which would tend to promote mixing of highly borated water (from the riser) with condensed water in the downcomer. Under any postulated flow oscillations occurring from a condition where riser level covers the flow holes, the downcomer water should remain at a relatively high boron concentration and a flow incursion would not have dramatic reactivity consequences. Therefore, it is only important to consider the possibility of the density wave instability if the level drops below the riser holes.

Density wave driven instability is highly unlikely to occur under these low level conditions. First, the core average flow rate is dramatically reduced as the core/riser and downcomer/annulus form a sort of manometer where level will approach an equilibrium between the two columns.

The low flow rate means that friction losses will be relatively small in the core and riser. Since friction losses are small, the primary flow feedback mechanism will be through the gravity head.

14

The gravity head will depend on the integrated mass of liquid in the core/riser column.

Hypothetical, rapid flow oscillations would produce an oscillation in the density, but, when considering the integral of these oscillations, they could not produce a change in the average density head so long as the oscillation period is smaller than the transit time from the bottom of the core to the top of the two-phase level in the riser. This transit time is estimated to be approximately 40 seconds [Ref. 11]. If the flow were to oscillate on a similar period the core heat flux response (5-7 seconds) or the core mixing (~20 seconds) would occur and dampen the perturbation during just one period. Without the possibility for a rapid flow change to affect a change in the gravity head, it is unlikely that there would be a self-sustaining feedback loop to drive instability.

Second, the situation is further stabilized due to a decrease in the reactor pressure vessel pressure. This may seem counterintuitive because a decrease in pressure increases the likelihood of riser flashing, which is a destabilizing phenomenon normally. However, the depressurization during LOCA is much more severe than during AOOs. When the pressure drops, in combination with the reduction in core flow due level drop below the top of the riser, voiding will occur not only in the riser but also in the core. Once the core heat flux and flow conditions are sufficient to lead to bulk vapor generation in the core, the core negative reactivity feedback becomes stronger compared to just the thermal expansion effect. As a result, the core power-void coupling becomes tighter. Again, this may seem counterintuitive because tighter power-void coupling tends to be destabilizing in BWRs, but in the case of NuScale, the core is at the bottom of the riser region, meaning that fluctuations in core power in response to fluctuations in core flow tend to be in-phase. In other words the core power response to flow fluctuations acts (with negative feedback) to counteract the flow fluctuation and it does this relatively promptly. As a result the core feedback tends to be a stabilizing factor because it acts to quell oscillations as opposed to amplifying them. The stronger reactivity feedback will be stabilizing in NuScale so long as the gravity head of the two-phase level above the core remains more significant than the two-phase friction losses within the core. Because the collapsed level in the riser will remain close to the RRV elevation during postulated LOCA scenarios (even if rods do not insert) and natural circulation flow rates will remain low - the gravity head can reasonably be expected to dominate two-phase friction losses in the core.

For these reasons, once the event evolves to a condition where the RPV is at low pressure, and the RPV level has dropped below the top of the riser, it is not expected that density wave driven instability will occur. Therefore, while other phenomena might contribute to flow fluctuations, the feedback in the core should remain a stabilizing factor and these oscillations should not have a density wave mechanism for rapid growth. Therefore, it is unlikely that density wave oscillations could produce a large flow incursion late in the event.

6.2 RRV Opens at High Containment Level A high level in containment could lead to a rapid increase in core flow if the RRVs are opened with the RPV pressure is below or equal to CNV pressure and the CNV level exceeds the downcomer level. In that case, the gravity head from the CNV level will drive downcomer water into the core. However, this situation is precluded by the redesign of the ECCS setpoints. The setpoints have been changed to ensure that the ECCS valves open when either the CNV level is below the RRV elevation or the RPV pressure is sufficiently high that the flow will be from the RPV to the CNV instead of the inverse. Therefore, the only mechanism for a high containment level to lead to a core flow incursion is if manual operator actions are taken to increase the CNV level, which is discussed separately in Section 6.4.

15

6.3 Level Swell When the RPV pressure decreases rapidly there will be a level swell in the downcomer. As pressure decreases at a rapid rate coolant in the RCS will flash. The flashing will occur preferentially in the core and riser section because of the higher coolant temperature. This flashing causes a void eruption and rapid expansion of the coolant in the core and riser. The void eruption squeezes the liquid downward through the lower plenum and back into the downcomer. The void eruption causes an initial pulse of reverse flow that causes the liquid level in the downcomer to increase. The gravity head difference between the voided core region and the downcomer level (which has swelled up) produces a flushing effect that causes a significant pulse of increased core flow. These processes can be very rapid. Flashing, swell, and flushing can all occur over a period of just a couple seconds. This phenomenon is demonstrated in TRACE calculations for a LOCA scenario with staggered RVV opening in Figure 4 [Ref. 19].

Figure 4: Core Flow Response to Staggered RVV Opening Level swell may occur as a result of rapid depressurization, which could be caused by ECCS valves opening or other means, such as operation of the pressurizer spray system. For the purpose of the current discussion the level swell is presumed to occur as a result of the RVVs opening. Pressurizer spray operation is discussed separately in Section 6.4. The level swell could also occur as a result of a large break LOCA, but it would be pathological to consider potential consequences from a SBLOCA initiated event where a secondary large break occurs later in the event.

The cause of the level swell, therefore, is opening of the RVVs, which occurs when the RPV pressure reaches the ECCS setpoints and allows the opening of the ECCS valves. This may be delayed due to high core power combined with a slow depressurization rate from the break loss, but as pressure is tightly coupled to inventory, it is unlikely that the riser can remain uncovered for a very long time before ECCS actuation. There is a limited window of time available for boron dilution to occur before the level swell. Therefore, the downcomer is unlikely to be fully 16

diluted prior to the swell, rather, the downcomer will be relatively diluted but will still harbor some concentration of boron. Figure 1 shows the results of a TRACE scoping calculation that indicates the mechanism of the boron dilution. In this calculation the staff shows the relative dilution of the downcomer prior to ECCS actuation and the difference in concentration can be approximately 50 percent (i.e. ~(1400-900)/1000 using rough values from Figure 1).

Since the level swell arises due to flashing and an initial period of reverse flow from the core to the downcomer, the bottom of the downcomer will be highly borated during the flushing phase.

The flush will then proceed by first returning the coolant with a high concentration. Since the flashing is rapid there is not enough time for any mixing in the downcomer. Therefore, the reactivity insertion from the flush should start relatively mild as the coolant will have a high boron concentration at first. However, because the pressure is much lower, the water liquid density is higher. This higher density will add some reactivity during the initial part of the flush, but this additional reactivity from the increased density should be relatively small and likely less than one dollar. However, the increased density of liquid means that it takes more liquid to refill the flashed inventory in the core. This will be compensated by additional diluted water from the downcomer. The driving force for the flow surge, however, decreases as the diluted water reaches the core because the system approaches equalized riser/downcomer levels. The reactivity insertion from the diluted water will be much greater than any insertion from the returning liquid.

Using the beginning of cycle (BOC) boron coefficient (~14 pcm/ppm [Ref. 5]) and the BOC boron concentration (~1250 ppm [Ref. 5]) and the BOC effective delayed neutron fraction (0.0059 [Ref. 5]) the total available boron reactivity associated with fully diluting the coolant is

~29$. If we assume that half of this is available due to the more modest dilution of the downcomer relative to the core (~15$) and that the diluted water can only occupy the volume made available by the increased liquid density (~25 percent) the possible reactivity insertion from the flush is probably on the order of 4$. If the reactor starts from a position of being subcritical, which is likely due to the boron concentrating in the core region and, because the level has dropped below the top of the riser, void formation in the core due to low flow.

Additionally, some rods may be inserted due to operator actions to insert rods. In any case, these 4$ of reactivity would likely be inserted into a subcritical core. The insertion would have to overcome the subcritical margin and then add an additional 1$ of reactivity to potentially cause a super prompt reactivity excursion. Based on the staffs simple calculations this is possible, but the super prompt excursion would likely be mild as Doppler reactivity will act to limit the power pulse and would only have to account for perhaps one or two dollars of reactivity.

A Fuchs-Nordheim calculation can be made to estimate the energy deposited in the fuel as a result of the super prompt excursion. This depends on the fuel heat capacity and the Doppler reactivity coefficient. The design value for the Doppler coefficient is -1.4 pcm/F [Ref. 5] and the specific heat is roughly 350 J/kg-K (see Figure 5). Equation (1) shows the formula for computing the energy deposition during a super prompt critical excursion according to Fuchs-Nordheim [Ref. 20].

= (1)

Where E is the energy deposition per unit mass, kp is the reactivity insertion in excess of 1$,

is the Doppler reactivity coefficient, and 17

C is the heat capacity of the fuel.

Figure 5: Urania Specific Heat from FRAPCON [Ref. 13]

If one assumes that the reactor is initially critical the energy deposition from the reactivity insertion can be conservatively estimated as ~120 cal/g. The calculation assumes 3$ of super prompt reactivity, which is conservative because this assumes a 50 percent boron dilution and that the reactor is initially critical. Recall that the TRACE calculation shows a 50 percent difference in boron concentration and a smaller degree of dilution. This energy deposition can be compared to the standard review plan fuel damage criterion of 230 cal/g [Ref. 14] which indicates that there is substantial margin to fuel damage.

Therefore, while level swell is a feasible mechanism that could produce a prompt or super prompt criticality power excursion, the staffs evaluation is that the power excursion will be relatively mild owing to several factors:

(1) the smaller degree of boron dilution that occurs prior to the operation of the ECCS valves compared to the long-term potential for dilution of the downcomer, (2) the relatively high concentration of boron in the bottom of the downcomer that first surges into the core (this fluid had been in the core but was pushed into the downcomer via the flashing expansion), and (3) the amount of margin available based on a conservative estimate of the energy deposition using a Fuchs-Nordheim approximation.

6.4 Manual RPV Level Recovery Core flow may suddenly increase in response to manual operator actions to restore level.

There are two postulated actions that operators may undertake to increase the level: (1) operators may align the chemical and volume control system (CVCS) to inject into the RPV and restore level, or (2) operators may use the containment flooding and drain system (CFDS) to inject water from the reactor pool into the containment vessel (CNV). First, either action to inject would likely be precluded by the plant-specific emergency operating procedures (EOPs). It is 18

common when an ATWS condition is diagnosed by high power following a reactor trip demand for procedures to direct operators to secure any vessel injection systems and preclude further injection. However, such EOPs have not been developed for the NuScale design.

CVCS injection may be advantageous under specific conditions because the system can be aligned in such a manner as to siphon diluted water from the downcomer and inject borated water. Operation of the system in this manner would allow the operators to ensure a subcritical boron concentration throughout the reactor coolant system before allowing sufficient injection to increase level and restore natural circulation. EOPs may direct the operators to undergo such an evolution and to monitor boron concentration before restoring level. Such actions may help to mitigate the ATWS event. However, if the CVCS is used to rapidly increase level above the top of the riser once the downcomer has become diluted, this would have the potential to lead to a rapid incursion of unborated water into the core when the core is critical or nearly critical. The staff notes that the normal alignment for CVCS injection is to the riser, but that the alignment may be changed by operator action.

Assuming some operator error that leads to CVCS injection at the design capacity (22 gpm [Ref.

1]), one can compute the rate of level increase using the cross-section flow areas of the core and downcomer region (~2.5 m2 [Ref. 6]). With these numbers, one can calculate that it would take the CVCS approximately 3600 seconds to raise the level by the core active height (2.0 m

[Ref. 5]). Using the beginning of cycle (BOC) boron coefficient (~14 pcm/ppm [Ref. 5]) and the BOC boron concentration (~1250 ppm [Ref. 5]) and the BOC effective delayed neutron fraction (0.0059 [Ref. 5]) the total available boron reactivity insertion is ~29$. Using the nominal boron coefficient should overestimate the reactivity worth as the presence of void and highly concentrated boron in the core region will tend to harden the spectrum, reduce the boron reactivity worth, and therefore reduce the magnitude of the coefficient. Given the refill time and the available reactivity, the time to add 1$ of reactivity can be calculated (~120 seconds).

CFDS injection could increase CNV level late in the postulated transient. If the operators increase this level, this will produce a cascading flow effect where the increased CNV level cause an influx of liquid from the CNV to the RPV through the RRVs, leading to an increase in flow from the downcomer to the core region to establish a head balance in the RCS. This flow would occur regardless whether the core was critical or subcritical. Even though the CFDS injects water from the reactor pool, which is highly borated to support refueling operations, the flow would probably not mix in the downcomer and this introduces the possibility for the operation to lead to an influx of diluted water. However, one can estimate the rate of the incursion by using the volumetric flow rate of the CFDS and dividing by the cross-sectional flow area of the combined CNV, downcomer, and core.

Assuming some operator error that leads to CFDS injection at the design capacity (100 gpm

[Ref. 7]), one can compute the reactivity insertion rate using a method similar to the method used for the CVCS, the primary difference being that the CNV cross-sectional area must be included (additional ~4.6 m2 [Ref. 6]) and the flow rate is higher. Combining these numbers gives the time to add 1$ of reactivity as ~77 seconds. However, there are two trains of CFDS pumps each 100 percent capacity, which, if combined, could reduce this time from ~77 seconds to ~39 seconds.

The time to add 1$ of reactivity is much longer than the fuel time constant and longer (or comparable to) the mixing time. Therefore, it is unlikely that sufficient reactivity can be added at a high enough rate above the rate where mixing and feedback would remove the added positive 19

reactivity to produce and sustain a super prompt critical reactivity excursion. Therefore, fuel damage and fuel failure are unlikely.

6.5 Geysering or Flashing Instability Because the scenario postulated a LOCA and opening of the ECCS valves, the system pressure will decrease. At low pressure the loop may become susceptible to geysering or flashing instability. Flashing instability may occur due to flashing of liquid at the top of the riser due to the decrease in saturation temperature with decreasing density head at higher riser elevations. Similar to level swell, but to a smaller extent, flashing instability would result first in a flow reversal before a return of the flow back to the core. Therefore, this mechanism would not have significant reactivity consequences and would, in all likelihood, promote mixing between the core and downcomer and contribute to reducing the degree of dilution. Geysering, on the other hand, is like an inverted flashing instability. Geysering can occur when voids formed in the core are condensed at a higher elevation in the riser.

If the reactor becomes unstable, geysering flow oscillations will begin to grow without any specific inciting perturbation. This mode involves the formation of void in the riser section from either flashing or liquid superheating (i.e., eruption phase) leading to a condition where flow increases during the period when the void is in the riser section (i.e., quiet phase) and then a sudden increase in flow as the void in the riser condenses (i.e., refilling phase) [Ref. 16]. In evaluating the flashing or geysering instability mechanism is it essential to understand the time scale of potential oscillation. As with density waves, the oscillation period is related to the delay time to heat the incoming coolant to saturation and then for the void to traverse the unheated riser section [Ref. 17]. Therefore, the period will be tightly coupled with the vapor transit time from the bottom of the core to the top of the collapsed level in the riser section.

In the geysering mode the flow will likely oscillate due to void fluctuations in the riser supplemented by a manometer driven flow feedback. These kinds of oscillations were observed in analyses provided by the applicant in response to request for additional information (RAI) 9444 [Ref. 8]. Figure 5 of the RAI 9444 response shows these oscillations for the specific AOO being analyzed and (( )). This agrees well with TRACE results; Figure 6 shows the vapor velocity in the riser section, assuming the level is around the elevation of the RRVs, the column height from the core inlet is about 4.3 m and with a maximum vapor velocity of ~0.4 m/sec, this corresponds to a transit time of approximately 10 seconds, which agrees well with the applicants result because the transit time and oscillation period should be comparable. These numbers are in the range of periods observed in experimental studies at comparable pressure (0.1 - 0.5 MPa) and column heights (3.3 m) [Ref. 16].

20

Figure 6: Vapor Velocities in Riser during SBLOCA [Ref. 11]

To staff considered several possible conditions in the core during its evaluation of geysering instability:

(1) The core is critical, as may be the case with rods failing to insert (2) The core is marginally subcritical and the coolant is primarily subcooled (3) The core is marginally subcritical and the coolant is at or near saturation (4) The core is deeply subcritical, as may be the case with all or many rods inserted.

Critical Core If the core is critical and a void perturbation occurs, this is unlikely to evolve into an uncontrolled flashing or geysering instability. The core will remain in-phase with the inlet flow and the core power response will remain slightly more rapid than the flow oscillation because the time constant is less than the period. While oscillations may and are expected to occur, the void feedback in a critical core can be expected to dampen any growing oscillations and limit the oscillation amplitude. This is like the phenomenon which limits the possibility for density wave instability.

Additionally, if the core is critical, the core should have a net vapor generation rate which will tend to lead to higher RPV pressures. Even slightly elevated pressures, say 0.5 MPa, should be high enough to preclude geysering instability.

21

Marginally Subcritical Core with Subcooled Liquid Coolant This condition is a candidate for flashing instability. Subcooled voids formed in the core will condense in the riser section, heating the riser fluid to near saturated conditions. The riser may then experience flashing which would cause flow incursion in the core. However, this condition is not realistic if the control rods fail to insert because it postulates that the reactor remains subcritical (without control rods) when the core is primarily cooled with subcooled, liquid water.

With an all-rods-out configuration the thermal-hydraulic condition is much more consistent with a critical as opposed to sub-critical core. Therefore, the staff does not consider the flashing instability to be likely under conditions where the rods fail to insert. This may be an issue for cases where several or most of the rods insert, but this is discussed as a separate scenario.

Marginally Subcritical Core with Saturated Coolant If the core is subcritical and the coolant is near or at saturation, the flow may become unstable.

In this case the mechanism would be geysering and it would appear like oscillations of a manometer with two-phase level in the riser section oscillating. As void formed in the core traverses the riser, the decreased gravity head should promote a flow influx and cause a drop in the downcomer level. As the void in the riser condenses this leads to a refill flow surge. This feedback from lowering the downcomer level limits the magnitude of the possible flow oscillations during the influx. If the core is critical, the void feedback should operate relatively promptly compared to the oscillation period to dampen the magnitude of the oscillations. Much as in the case of the density wave oscillations, reactivity feedback should operate to dampen geysering in most conditions.

However, there could be a possible condition where, perhaps for a fresh core, where the fuel time constant is relatively long owing to a large gap. If the reactor, additionally, is marginally subcritical, the core may return to power only after some lag once the flow oscillation influx period begins. This would delay the feedback. It is possible that long time constant and some degree of subcriticality could delay the feedback in the right proportion relative to the transit time to allow for a growing oscillation in the flow accompanied by a very mild oscillation in the power.

In this case a mild geysering instability could be enhanced by the core, but only under very specific conditions.

Since these oscillations will grow during a phase when the reactor is marginally subcritical, it would likely promote mixing between the core and downcomer water, but it would take detailed analysis to determine the effectiveness of that mixing.

Regardless of the role of the core in the progression of the geysering induced flow oscillation, geysering may have a significant impact on the internal recirculation flows. In other words, even if the core is not enhancing the flow instability, it may occur. Depending on the conduction heat transfer pathway, large void waves typical from geysering may partially condense in the riser section, which would amplify the refilling effect. This implies that analyses of the geysering performed with one-dimensional versus two- or three-dimensional models of the vessel may produce significantly different predictions of the likelihood of oscillation and the oscillation amplitude. Scoping calculations performed with TRACE using a three-dimensional representation of the riser section did not predict any geysering [Ref. 3], but the calculation was merely a scoping calculation and was not specifically intended to investigate the potential for instability during SBLOCA.

22

If the flow is assumed to be one-dimensional in the riser section above the core, then geysering could occur. If oscillations grow, the formation of large void slugs should cause an increase in the two-phase level in the riser and lengthen the oscillation period. As the period lengthens relative to the feedback delay in the core, the oscillations should approach their limit-cycle.

Using results from the staffs TRACE calculation [Ref. 18], the flow surge from geysering (even though it was not predicted) can be conservatively estimated by calculating the potential volume flow rate from void collapse in the riser section. The staffs scoping calculation predicts that the core void fraction varies but 0.25 is a reasonable upper boundary for the average (see Figure 7). Assuming this void propagates into the riser and that the entire inventory of void in the riser above the core but below the RRV collapses, this corresponds to a volume of roughly 5 m3 [Ref.

6]. Assuming this collapse over half the period (roughly 5 seconds), this corresponds to a volumetric surge of approximately 0.25 m3/sec. If this flow is sustained, it would refill the core in about 7 seconds. Since there is a significant positive reactivity insertion available from the diluted downcomer (approximately 29$, see Section 6.4) this may trigger a prompt or super prompt power excursion response.

Figure 7: Core Exit Void Fraction In principle though, internal recirculation should produce an internal core of the riser flow that is primarily saturated in the central region and flowing upward while condensation would be limited 23

to the region near the riser wall where the fluid is cooler due to the passive heat conduction pathway. If one approximates this localized condensation by considering just the volume in Ring 2 of the TRACE VESSEL component then the condensation rate is reduced and the shrinkage caused by the collapse would be smaller - approximately 0.1 m3/sec. This rate is still substantial and could cause a prompt or super prompt excursion, but of a much less severe nature.

To put this in perspective, the estimated time to add 1$ of super prompt reactivity for total void collapse would be approximately 0.5 seconds (assuming the available positive reactivity from completely refilling the core from the diluted downcomer is 29$). If the more limited condensation is considered this time is increased to 1.2 seconds. The total super prompt reactivity inserted in the full riser condensation case would be ~20$ compared to ~7$ in the localized case. Using Fuchs-Nordheim, this corresponds to an energy deposition of 740 cal/g in the former and 240 cal/g in the latter; indicating that there is a substantial sensitivity in the propensity for core damage to occur depending on how localized condensation is in the riser section should geysering instability occur.

In any case, the mechanism of geysering may lead to flow instability and substantial positive swings in core flow depending on the propensity for condensation in the riser. A more thorough and detailed analysis was required to predict this condensation rate. Therefore, the staff considered refining this simplified, and conservative calculation based on systems analysis results and experimental data.

Because heat transfer in the riser will be sensitive to internal recirculation flow patterns, using systems analysis methods to directly simulate geysering may be challenging. If systems analyses predict this mechanism with prompt power excursion, the staff recommends performing sensitivity calculations regarding the multi-dimensional flow in the riser section and disallowing conduction heat transfer to see if these result in a significant dampening of the geysering oscillations. This would give an indication of how sensitive the flow oscillations are to localized condensation in the riser section. If geysering persists, the staff recommends calculating the transit time to the top of the two phase level as well as the fuel time constant to ensure that the predicted limit-cycle oscillations are reasonable - if the oscillations persist even after the reactor becomes critical and transit time begins to exceed the time constant - this may indicate a numerical error in the analysis.

In geysering experiments, flow reversal results from void eruption [Ref. 16 and 17], which is not expected to occur under the power and flow conditions of the reactor - the heat transfer mechanism should produce voids on the cladding surface that depart and heat the bulk fluid to the point of bulk saturation. It is not clear how void eruption could occur across the core because this would require coolant superheating over a wide range of the core. In principle the coolant should remain close to saturation and rather uniform because of internal recirculation within the region bounded by the riser wall. Additionally, the cross-sectional flow area is large, making any coplanar uniformities in something as unstable as coolant superheat unlikely.

Therefore, the staff would not expect significant flow reversal from eruption. If, for some reason, flow reversal were to occur, this would be similar to flashing instability and would likely promote mixing between the core and downcomer and be beneficial overall.

If void eruption in the core leads to significant flow reversals these results should be approached skeptically. With all rods out, feedback should be strong enough to turn power around before leading to void formation rapid enough to expel water from the bottom of the core. If these results are predicted the analyst should examine the reactivity feedback model and examine the 24

internal recirculation flows to see if the void transit through the core makes sense relative to the transient response of the cladding heat flux.

Given these concerns with using systems analysis codes to model geysering directly, staff considered the possibility of using experimental results directly. A reviewer may examine the expected pressure from the systems analysis and determine, based on scaling experimental data, if the pressure remains sufficiently high during the event to preclude this mode. If the reactor remains near critical conditions as would be the case when the rods fail to insert, the system pressure may remain high enough that geysering instability is precluded. Geysering instability has been extensively studied during the development of the simplified boiling water reactor and these experiments show that this mode is suppressed at modest pressures [Ref. 16 and 17]. These existing experimental data might be scalable to the NuScale conditions and could shed light on the potential for this mode based on whether the pressure falls below a certain threshold. However, examination of some LOCA analysis results indicate that the RCS may reach very low pressure and it is unlikely that the staff could reach a conclusion about the likelihood of geysering based solely on the pressure.

TRACE calculations performed for long-term cooling indicate that pressure may get quite low and certainly into the range where geysering would be possible [Ref. 21]. Figure 8 shows the predicted pressurizer pressure during a SBLOCA. By 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br /> the pressure has dropped below 20 psia.

25

Figure 8: TRACE Predicted RCS Pressure during SBLOCA [Ref. 21]

Under these conditions geysering may be possible. However, the driving mechanism for the geysering instability is condensation of void in the riser section. This condensation rate will be limited by the heat removal rate through the riser wall via conduction. The staff used TRACE results to estimate the temperature difference driving the conduction heat transfer through the riser wall. These quasi-steady, long-term temperatures in the riser and downcomer will be a strong function of the heat-balance and the systems analysis results for these quantities are likely reliable even if there are some questions about the specific internal recirculation flow patterns. During the long-term the liquid level stabilizes near the RRV elevation, Figure 9 shows the RPV level in the long-term.

Figure 9: TRACE Predicted Riser Collapsed Liquid Level during SBLOCA [Ref. 21]

Above the liquid level, condensation is not possible because there is steam on both sides of the riser wall, and therefore, no temperature difference to drive the heat removal necessary for condensation. This temperature uniformity above the level constrains the geysering phenomenon to the liquid covered region. Therefore, the staff took the predicted temperature traces of the fluid on the inside and outside of the riser wall at the elevation of the top of active fuel (TAF) and at the RRV elevation. These figures allowed the staff to estimate a reasonable and a bounding temperature difference across the riser wall. These temperatures are depicted 26

in Figure 10. The results show that the temperature difference remains small at both elevations, 10 F appears to be a reasonable value for characterizing the difference over the full range and 20 F would be bounding. These temperature differences are small and imply that any condensation in the riser would be limited based on the small rate of heat transfer such a small temperature difference could drive across the riser wall. Therefore, geysering is very likely to be much less severe than indicated by the staffs initial, conservative estimate.

27

Figure 10: TRACE Predicted Riser/Downcomer Temperature Difference during Long-term SBLOCA [Ref. 21]

28

Using these temperature differences, the staff computed the heat transfer rate from the riser to the downcomer. The heat transfer rate is estimated based on the temperature difference and slab heat conduction through the riser wall. This heat transfer rate is then converted to a condensation rate assuming that all the heat transfer results in vapor condensation. Then, the specific volume difference is used to convert the condensation rate to a shrinkage rate. The shrinkage rate is used, in combination with the cross-sectional flow area of the core, to compute the flow rate in the same manner as described in Section 6.4. The shrinkage rate per unit of axial length is taken from [Ref. 23] shown in Table 2. Results are presented for 10 F difference (reasonable), 20 F difference (bounding), and 135 F difference (limiting). The final difference of 135 F is included because this is the temperature difference between the maximum core exit temperature and the minimum riser temperature in Figure 10, so it represents an absolute upper bound on the temperature difference.

Table 2: Shrinkage Rate from Riser Conduction Driven Condensation per Unit Length T (F) [K]

Riser Shrinkage, s [m3/s/m]

s = q'/(h_fg*(_l-_v))

q' = 2*pi*k*T/ln(r_outer/r_inner) 10 [5.56] 20 [11.11] 135 [75]

5 1.1447E-05 2.2797E-05 1.4805E-04 10 1.2043E-05 2.3987E-05 1.5590E-04 15 1.2453E-05 2.4804E-05 1.6129E-04 Pressure (psia) 20 1.2773E-05 2.5442E-05 1.6550E-04 30 1.3296E-05 2.6486E-05 1.7238E-04 40 1.3726E-05 2.7343E-05 1.7803E-04 50 1.4102E-05 2.8092E-05 1.8297E-04 From the Table 2 results the maximum condensation rate can be estimated. The geysering effect condensation would occur over a small axial span of the riser, but for conservatism the entire height of the riser from the TAF to the collapsed level is considered. Since the level is at the RRV elevation this height is 4.94-2.69 = 2.28 m [Ref. 22]. From these results the maximum shrinkage rate is on the order of 10-4 m3/sec, which is trivial and would produce only a very modest flow increase that would not likely be noticeable. The calculated reactivity insertion rate is ~0.0005 $/sec in the 10 F case, ~0.001 $/sec in the 20 F case, and ~0.007 $/sec in the 135 F case. These reactivity insertion rates are far too low to pose any challenge to fuel thermal limits or challenge core coolability.

Deeply Subcritical Core In a case where many of the control rods insert, the core will be deeply subcritical. This would allow a condition where the core may remain subcritical with primarily liquid inventory. Under these conditions the subcooled voiding in the core may heat the riser to near saturation. This will, of course, depend on the mixing that can be established internally as well as conduction heat transfer through the riser. However, if one conservatively neglects mixing and conduction, the riser section will eventually heat to saturated conditions - at which point the subcooled boiling in the core may contribute to flashing in the riser some distance above the core. This 29

flashing elevation may be near the top of the collapsed level - which can lead to short period flow oscillations from the flashing instability.

If the core is controlled by rods, then there will be little or no effective reactivity feedback mechanism to dampen any ensuing flow oscillations and they may grow. Without a detailed analysis it would be difficult if not impossible to predict the flashing instability potential.

Additionally, these types of analyses may be highly sensitive to assumptions regarding internal mixing as well as radial conduction. Therefore, predictions with a one-dimensional model may be quite different from predictions of a higher dimensional model.

It would not be inconceivable to postulate flashing or geysering instabilities growing for a subcritical core to the point where the flow incursions become so significant that they can add enough positive reactivity to return the core to power. Recall that the boron dilution may build up a reservoir of potential reactivity insertion in the downcomer that could account for many dollars of positive reactivity if that water were to surge into the core.

The staff judges that this would be unlikely to produce a potential core damage consequence from a prompt or super prompt reactivity excursion. Using the hand calculation above assuming just localized condensation the super prompt reactivity insertion is about 7$, which is comparable to the worth of the inserted rods in a deeply subcritical case. Therefore, while the power may experience an excursion, this will be rapidly turned around by Doppler reactivity before reaching energy depositions that would challenge the fuel damage criterion.

Examination of the riser and downcomer temperatures indicate that the geysering effect would be even milder than assumed here and so there are not expected to be any significant super prompt reactivity consequences.

This mechanism, however, could result in reactor power pulsing but it is not clear how the flow oscillations might continue to grow once the reactor experiences periods of criticality and returns to power. However, such oscillations of flow, power, and reactivity may be of concern from a fuel failure perspective; especially if the scenario is a worst-rod-stuck-out condition where local power may be relatively high. In low power conditions with low flow rates the reactor should be in a pool-boiling regime where the margin to CHF is likely to be around 10. The staff does not see any feasible means for geysering to cause a factor of 10 increase in heat flux. The maximum condensation rates projected by the staff are not sufficient to produce this kind of power increase. Further, note that it would take a more substantial increase in the neutron power during a pulse to manifest in a given change in the heat flux because of the fuel thermal inertia and prompt negative feedback.

In terms of the fuel failure from pellet-clad-mechanical interactions, hand calculations show that the energy deposition from a flow incursion caused by geysering would be trivial and well below the fuel failure criteria in the standard review plan [Ref. 14]. Therefore, the staff finds that geysering does not contribute to an increased likelihood of fuel failure or damage.

6.6 Manual Pressurizer Spray The staff considered the possibility that operators might activate pressurizer spray during postulated ATWS events. There are three situations that the staff could identify:

(1) Non-LOCA initiated ATWS / RSV Failure: The operators activate spray to control or lower RPV pressure because of some failure of the reactor safety valves (RSVs) to 30

maintain acceptably low RPV pressure. This may be the case for non-LOCA initiated ATWS events because otherwise the break would presumably contribute to lowering the RPV pressure, negating the need to back-up failed RSVs.

(2) SBLOCA initiated ATWS / Early Operator Intervention: The operators activate spray to lower pressure in an attempt to accelerate ECCS actuation, which requires RPV pressure to drop below the low RCS pressure setpoint.

(3) SBLOCA initiated ATWS / Spray as Make-up: The operators activate spray to provide make-up to the RPV because there has been some failure of the ECCS to properly actuate and the operators could not align CVCS injection to alternative lines.

Admittedly, some of these situations appear far-fetched and may be precluded by the plant-specific EOPs once they are written. Regardless, the staff has considered each of these scenarios.

Non-LOCA initiated ATWS / RSV Failure If there is not a LOCA initiating event, it is highly unlikely that level would drop below the riser.

Add to this failure of the RSVs and there is essentially no flow path from the RPV, so inventory loss would be minimal. If there is no inventory loss the boron dilution mechanism cannot occur because this demands a break in the natural circulation flow loop.

In any case, the flow surge produced by ECCS actuation would bound the surge produced by activation of spray, so if the consequences are acceptable for SBLOCA initiated ATWS, they are likely to be acceptable for non-LOCA initiated ATWS as well.

SBLOCA initiated ATWS / Early Operator Intervention If the operators begin spray this will rapidly drop the RPV pressure. This rapid decrease in pressure will cause a level swell, but it will also cause the RPV pressure to drop below the ECCS low pressure setpoint and cause the RVVs to open. Since the RVVs will drop the pressure much more effectively, the spray itself would be similar to having a slightly larger RVV flow area in terms of the impact on the level swell. This could exacerbate the swell because it would be akin to enhancing the swell that would have otherwise occurred when the RVVs opened later. This process might be complicated though if counter-current flow limitation occurs in the pressurizer. However, in any case, even though the level swell could be amplified, the operation of the spray accelerates the ECCS valves opening. As discussed in Section 2, the limiting event is one that delays the ECCS actuation until late in the event so that there is time for the downcomer water to become dilute before the level swell. Since the spray would accelerate the ECCS actuation, it is likely that this operation would result in a smaller dilution.

Even though the level swell will be worse, it is expected that the reactivity consequences would be milder owing to a smaller discrepancy in the boron concentration between the core and downcomer.

SBLOCA Initiated ATWS / Spray as Make-up Operation of spray after ECCS valve opening can produce a level swell, but the pressure decrease due to the spray is smaller than the pressure decrease caused by ECCS valve opening. Therefore, the level swell resulting from spray operation should be considerably smaller in this scenario compared to the level swell from ECCS actuation.

31

However, this could occur later in the transient, which might mean a more significant boron dilution in the downcomer. However, the rate of boron dilution should slow as conduction becomes a more significant heat removal pathway compared to condensation. Also, as the dilution occurs the reactor becomes more deeply subcritical from the accumulation of concentrated boron inside the riser region. As time progresses the boron concentration difference between the core and downcomer should start leveling off and the magnitude of any swell from spray will continue to decrease as passive heat removal continues to cool the subcritical reactor and lower the RPV pressure. There is a competing effect associated with delaying the activation of spray which makes it difficult to pinpoint the exact time when it would be least advantageous to activate spray, but engineering judgment indicates that the much more substantial flow surge from the ECCS level swell would be bounding. If the reactor is significantly subcritical following ECCS actuation and passive conduction heat removal is high the dilution rate will be slow, meaning that decrease in the swell associated with later spray would likely be the dominant factor compared to the larger dilution associated with later spray.

6.7 Manual CVCS Operation as ECCS Back-up While manual injection is not likely necessary to mitigate the postulated SBLOCA initiated event, there may be some situations where the operators would initiate injection through the CVCS. In particular, if there is a failure or partial failure of the ECCS during the event, the operators might align the CVCS to inject into the riser to maintain RPV level.

According to Section 9.3.4.1 of the Final Safety Analysis Report, any containment isolation signal would isolate the demineralized water from the CVCS [Ref. 4], so if manual CVCS injection were to occur, the water would likely be at a concentration similar to the RCS starting concentration at first before increasing to the concentration of the highly borated emergency water source. Since the CVCS injection will be borated, the injected water itself will not add reactivity. However, it is still possible for the operation of the CVCS to create a condition where reactivity is added to the core.

Operation of CVCS at high flow rate and low pressure can lead to substantial void collapse in the riser section. The shrinkage from the void collapse will create a relative vacuum that will drive a surge in core flow over a short period of time while the CVCS injection is condensing the available inventory of riser void. This void collapse scenario is only likely if the CVCS injection rate is high and the core vapor generation rate is low. The staff performed some hand calculations of the net shrinkage rate above the core for different pressures, power levels, and CVCS flow rates. The results of the hand calculations are presented in Table 3.

Table 3: CVCS Driven Void Collapse Peak Net Shrinkage Rate 32

Reactor Peak Net CVCS Flow Reactor RPV Steam Shrinkage Rate Power Pressure Generation Rate Rate

[gpm] [%RTP] [psia] [kg/sec] [m3/sec]

40 1.0 900 1.03 0.007 40 1.0 50 0.74 -0.109 22 1.0 900 1.03 -0.011 22 1.0 50 0.74 -0.237 40 0.5 900 0.52 0.023 40 0.5 50 0.37 0.088 22 0.5 900 0.52 0.005 22 0.5 50 0.37 -0.040 Pressures up to 900 psi were considered because this is the maximum pressure where there would be a demand for ECCS actuation. It is assumed that CVCS would only be used for injection if the ECCS valves were demanded to open, but subsequently failed to open. The power levels considered are low, about decay heat power levels. If the power level is much higher the steaming rate begins to far exceed the condensing capacity of the CVCS injection and there would not be a significant void collapse. Cases where the steam rate exceeds the condensing capacity are indicated by a negative net shrinkage rate in Table 3. What is clear is that the shrinkage becomes most significant under conditions of low reactor power, low pressure, and high CVCS flow rate.

The event under consideration assumes a failure of the control rods to insert, and therefore, the reactor for much of the transient will be critical. However, the distillation phenomenon once the riser uncovers along with void formation in the core at low flow and low RPV pressure will likely be enough to shut the reactor down. Therefore, decay heat power levels are reasonable for later stages of the event progression.

At high RPV pressure (900 psi) the CVCS condensing rate at normal flows (22 gpm) is not high enough to create a very rapid shrinkage. At low pressure and/or high flow rate the condensing rate exceeds the decay heat vapor generation at 0.5 percent of power, it produces a rapid shrinkage. Taking the worst case net peak shrinkage rate from Table 3 a method similar to that used in Section 6.4 can be used to calculate the time it would take for the flow surge caused by this shrinkage to add 1$ of reactivity, which is 0.8 seconds.

After the beginning of the CVCS injection, if the CVCS can condense more steam than the core can produce, the void collapse should ensue rather quickly and the core flow surge could not be sustained for a long period. However, it is probably reasonable to assume that the void collapse could drive a flow incursion over about a second.

Since 0.8 seconds is shorter than the fuel time constant (5-7 seconds) and the mixing time (40 seconds), the reactivity insertion from the flow surge would be prompt and could lead to a prompt or super prompt criticality. It is important though, to understand the sequence of events and circumstances that produce the conditions where this flow incursion could occur.

(1) The reactor is at decay heat power levels, implying that the reactor is starting from a subcritical condition. If the subcriticality is achieved through rod insertion that negative 33

reactivity will remain inserted during the flow incursion and would likely be sufficient to preclude any power excursion as a result.

(2) The pressure is low (50 psi), it is not clear how the RPV pressure reaches this low level since the CVCS injection is presumed to occur primarily in cases where there is a failure of the ECCS. For the RPV pressure to be so low with ECCS failure, this implies only a partial ECCS failure or that the operators were successful in inserting at least some of the control rods to drop reactor power considerably much earlier in the transient such that DHRS is effective in depressurizing the RPV.

(3) The required injection rate is higher than the nominal injection rate of 22 gpm. This implies that the operators have aligned the system to provide a higher flow rate than the normal capacity. If the core conditions indicated that there might be significant reactivity consequences from flow incursion, it is likely that procedures would direct the operators to inject at a lower rate or to injection into the downcomer as opposed to the riser. If the CVCS injects into the downcomer then there would be no void collapse in the riser to cause the surge.

Therefore to reach the specific set of circumstances where the CVCS injection could lead to a possible flow incursion with severe reactivity consequences:

(1) a SBLOCA must have occurred, (2) the control rods fail to insert and operators are unsuccessful at inserting the rods through other means (e.g., deenergizing the solenoids),

(3) the ECCS valves fail to operate on demand, but somehow the operators are successful through other means in depressurizing the RPV, and (4) noting a large discrepancy in boron concentration in the riser and downcomer, the operators align the CVCS for riser injection at a high flow rate. This may be contra the plant-specific EOPs depending on how these symptoms are factored into the design of those procedures.

The staff has not computed probabilities for these circumstances, but suspects that this sequence would be quite highly unlikely. Furthermore the staff notes that even a partial rod insertion is likely to ensure some net negative reactivity worth at the start of the flow incursion and this would probably be enough to preclude prompt criticality. Therefore, the incidence of super prompt excursion would likely be limited to conditions where most rods fail to insert.

7 Conclusions and Recommendations The staff considered a postulated beyond design basis event initiated by a SBLOCA where the module protection system fails to insert any of the control rods. In the parlance of this white paper this event has been referred to as an ATWS event even though the initiating event is not an anticipated transient. The staff evaluated the sequence of events for the worst case SBLOCA-ATWS to determine which conditions and phenomena could produce the potential for a core flow surge to yield core damage as a result of a super prompt reactivity excursion. The staff conducted a thorough review of the possible phenomena and processes that could lead to rapid flow incursions. The staff then screened those possible incursions to determine which might have the possibility of producing an adverse power excursion. This screening was performed based on the dynamic speed on the incursion relative to two key feedback mechanisms within the core: thermal-hydraulic coupling via rod heat transfer, and mixing.

34

Based on that identification and screening process, the staff identified three processes which could produce a power excursion:

(1) Flushing from ECCS Driven Level Swell. Following actuation of ECCS, the core and riser inventory will flash, causing the downcomer level to rise and the liquid to become more dense. After the flashing period the high downcomer level will cause a rapid flow incursion. This incursion has the potential to insert a limited amount of reactivity which the staff estimates to be on the order of 4$. The staff performed some simple calculations to show that while this may produce a super prompt power excursion, the relatively low reactivity insertion is mitigated by Doppler feedback well before the fuel can be expected to experience any damage from excessive energy deposition.

(2) Level Swell from CVCS Injection into the Riser. Under very specific circumstances, injecting water into the riser through the CVCS may cause rapid condensation of the void in the riser section. This condensation can cause shrinkage and local negative pressure, which in turn causes a flow surge. The staffs hand calculations indicated that this mechanism could possibly cause a prompt reactivity excursion. However, the set of circumstances necessary to produce this outcome are highly unlikely.

Throughout this evaluation, the staff has noted some instances where modeling of the phenomena might be a particular challenge for systems analysis tools. Therefore, the staff recommends that any reviewer or analyst examining this topic, or similar topics, approach those analyses, models, and methods skeptically. One of the phenomena that is difficult to model properly is the reactivity feedback from boron concentration changes under conditions where the coolant voids. The voiding represents a fundamental change relative to the normal density feedback mechanism of thermal expansion. Under these conditions the nuclear calculations that were performed upstream of the systems calculations may bias the reactivity parameters and produce non-physical results. Special care must be made in the analysis to account for tracking of boron concentration in nodes within the core that are partially voided.

A second phenomenon relates to the internal recirculation that is expected to develop within the riser section. Systems analysis tools that use two- or three-dimensional models of the riser and core sections of the RCS will be able to better predict the internal recirculation. That internal recirculation flow can have a significant effect on internal mixing, cold front propagation, diluted coolant from propagation, and various instability mechanisms. Systems analysis methods and results should be carefully reviewed to consider these effects if it appears that flow incursion following dilution can be risk significant.

Lastly, the staff had to make certain assumptions about operator actions in the technical evaluation of different phases of the event and to address possible physical processes that could occur as a result of postulated operator interventions. It is possible to postulate all manner of operator actions, including some that would be adverse. The staff does not recommend considering adverse operator actions as part of the review because it would be a reasonable assumption that clearly adverse maneuvers would be precluded by the final plant-specific EOPs.

8 References

1. Work Request Form NRR-2020-014-IAR (ADAMS Accession No. ML20162A122)

2. Yarsky, P., Confirmatory Analysis of Anticipated Transient without SCRAM for the NuScale Power Module, October 2018.

35

3. Lien, P., email to Yarsky, P., SBLOCA_ATWS calc., June 23, 2020 (ADAMS ML20176A666).

4. NuScale Standard Plant Design Certification Application Part 2 Tier 2 Chapter 9 Auxiliary Systems Rev. 4, January 2020.

5. NuScale Standard Plant Design Certification Application Part 2 Tier 2 Chapter 4 Reactor Rev. 0, December 2016

6. Calculation Files for TRACE NuScale ATWS [Anticipated Transients without SCRAM]

confirmatory analysis (First 10 minutes and First 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />)rerun with Updated base-deck NPM_LOCA_0320_rev Build (ADAMS Accession No. ML19109A233)

7. NuScale Letter (LO-0616-49507) from S. Mirsky to USNRC, NuScale Power, LLC Submittal of Presentation Materials Entitled The NuScale Design, Revision 0, PM-0616-49510 for Use During Closed Meetings on June 9 and 15, 2016 (NRC Project No.

0769), dated June 7, 2016.

8. NuScale Letter (RAIO-0818-61457) from Z. Rad to USNRC, NuScale Power, LLC Response to NRC Request for Additional Information No. 9444 (eRAI No. 9444) on the NuScale Topical Report, Evaluation Methodology for Stability Analysis of the NuScale Power Module, TR-0516-49417, Revision 0, dated August 17, 2018 (ADAMS Accession No. ML18229A336).

9. Thompson, J.; Lien, P.; "TRACE High Pressure Condensation Model Validation Using KAIST Data," NURETH-18, Portland, Oregon, USA, 18-23 August 2019.

10. Elenkov, D., K. Lassmann, A. Schubert, and J. Laar. Dependence of the time-constant of a fuel rod on different design and operational parameters. No. IAEA-TECDOC--1233.

2001.

11. Ireland, A., email to Yarsky, P., RE: NuScale low level internal recirculation flows, June 17, 2020 (ADAMS ML20176A666)

12. Thompson, J., email to Yarsky, P., RE: Still willing to help, June 17, 2020 (ADAMS ML20176A666)

13. NUREG/CR-6534, FRAPCON-3 Updates, Including Mixed-Oxide Fuel Properties May 2005 (ADAMS Accession No. ML051440720)

14. NUREG-0800, Standard Review Plan: Section 4.2 Fuel System Design, Rev. 3, March 2007 (ADAMS Accession No. ML070740002)

15. Thompson, J., email to Yarsky, P., RE: Another Hand Calculation, June 16, 2020 (ADAMS ML20176A666).

16. Tong, Lili, Jinbo Chen, Xuewu Cao, Shengxing Yang, Shiliang Liao, Jian Deng, and Wei Zeng. "Visualization experiments on the geyser boiling-induced instability in vertical circular tube at low-pressures." Annals of Nuclear Energy 77 (2015): 487-497.

17. Chiang, Jing Hsien, Masanori Aritomi, Michitsugu Mori, and Masahisa Higuchi.

"Fundamental Study on Thermo-Hydraulics during Start-Up in Natural Circulation Boiling Water Reactors,(III) Effects of System Pressure on Geysering and Natural Circulation Oscillation." Journal of nuclear science and technology 31, no. 9 (1994): 883-893.

18. Lien, P., email to Yarsky, P., Re: SBLOCA-ATWS TRACE Calc, June 25, 2020 (ADAMS ML20176A666).

19. Ireland, A., email to Yarsky, P., FW: staggered valve opening case, June 25, 2020 (ADAMS ML20176A666).

20. Kinetic Behavior of TRIGA Reactors, March 31, 1967 (ADAMS Accession No. ML082380271).

21. Ireland, A., email to Yarsky, P., RE: Another ask re: NRR-2020-014 Downcomer Temperature Axial Distribution, July 1, 2020 (ADAMS ML20183A469).

22. Ireland, A., email to Yarsky, P., RE: RRV and riser hole elevations, June 17, 2020 (ADAMS ML20183A515) 36

23. Thompson, J., email to Yarsky, P., RE: Riser Conduction Calculation, July 1, 2020 (ADAMS ML20183A515)

Contributors: Jason Thompson, Andrew Ireland, and Peter Lien made substantial contributions to this report in the form of several calculations, plots, and tables.

37