POLICY ISSUE

INFORMATION

April 1, 2002 SECY-02-0059

FOR: The Commissioners

FROM: William D. Travers

Executive Director for Operations

SUBJECT: USE OF DESIGN ACCEPTANCE CRITERIA FOR THE AP1000 STANDARD

PLANT DESIGN

PURPOSE:

To inform the Commission of the staff’s position on the use of design acceptance criteria (DAC)

for the Westinghouse Electric Corporation’s (Westinghouse’s) AP1000 standard plant design.

SUMMARY:

In an August 28, 2000, letter, as supplemented by letter dated February 13, 2002,

Westinghouse requested the staff to review the acceptability of Westinghouse’s proposed use

of DAC to support the development of the design certification application for the AP1000

design. As a result of this pre-application review, the staff concludes that it is acceptable to use

the DAC approach in the instrumentation and control (I&C), control room (human factors

engineering), and piping design areas, contingent upon the ability of Westinghouse and the

staff to agree on adequate DAC during the design certification review. 

BACKGROUND:

In its August 28, 2000, letter, as supplemented by letter dated February 13, 2002,

Westinghouse requested that NRC proceed with Phase 2 of the AP1000 pre-application review

to address the following issues:

1. applicability of the AP600 test program to the AP1000 design

2. applicability of the AP600 analysis codes to the AP1000 design

Contact: Lawrence J. Burkhart, NRR/NRLPO

 301-415-3053
-2-

3. acceptability of the proposed use of DAC for the AP1000 design

4. acceptability of certain exemptions for the AP1000 design that Westinghouse intends to

request.

This correspondence provides the staff’s position regarding the acceptability of the proposed

use of DAC for the AP1000 design certification. The other issues will be addressed in a

separate letter to Westinghouse.

DISCUSSION:

Historical Application of DAC

The certification process for a standard nuclear power plant design is described in Part 52 of

Title 10 of the Code of Federal Regulations (10 CFR Part 52), “Early Site Permits, Standard

Design Certifications, and Combined Licenses for Nuclear Power Plants.” Paragraph 52.47

(a)(2) requires that:

[t]he application must contain a level of design information sufficient to enable

the Commission to judge the applicant’s proposed means of assuring that

construction conforms to the design and to reach a final conclusion on all safety

questions associated with the design before the certification is granted.

The level of design information that is sufficient to allow accomplishment of these two tasks was

addressed in SECY-90-377, “Requirements for Design Certification Under 10 CFR Part 52,”

dated November 8, 1990. Also, the Commission issued guidance in its Staff Requirements

Memorandum (SRM) on SECY-90-377, dated February 15, 1991, which stated that applications

for design certification should:

(1) reflect a design which, for all structures, systems, or components that can

affect safe operation of the plant, is complete, except to the extent that some

further adjustment to the design within established design envelopes may be

necessary -- during what the staff has referred to as the design reconciliation

process -- to accommodate actual, as-procured hardware characteristics;

(2) encompass a depth of detail no less than that in an FSAR [final safety

analysis report] at the operating stage for a recently licensed plant, except for

site-specific, as-procured, as-built information; (3) be sufficient to allow staff to

evaluate the resolution of severe accident issues in the design, as well as to

incorporate the experience from operating events in current designs which we

want to prevent in the future; and (4) provide a sufficient level of detail to

ascertain how the risk insights from the design-specific PRA [probabilistic risk

assessment] are addressed in the design. 

Responding to the Commission's SRM on SECY-90-377, the staff discussed the concept of

DAC and its application in SECY-92-053, “Use of Design Acceptance Criteria During 10 CFR

Part 52 Design Certification Process,” dated February 19, 1992. In this paper, the staff

explained that:
-3-

[t]he concept of DAC would enable the staff to make a final safety determination,

subject only to satisfactory design implementation and verification by the

combined license (COL) licensee, through appropriate use of inspections, tests,

analyses, and acceptance criteria (ITAAC). The staff defined DAC as “a set of

prescribed limits, parameters, procedures, and attributes upon which the NRC

relies, in a limited number of technical areas, in making a final safety

determination to support a design certification.” The DAC are to be objective

(measurable, testable, or subject to analysis using pre-approved methods), and

must be verified as part of the ITAAC performed to demonstrate that the as-built

facility conforms to the certified design. That is, the acceptance criteria for DAC

become the acceptance criteria for ITAAC, which are part of the design

certification. 

In SECY-92-053, the staff documented its observation regarding the level of detail submitted in

support of design certification applications of General Electric’s Advanced Boiling Water

Reactor (ABWR) and the ABB-Combustion Engineering’s System 80+. The staff observed that,

in some technical areas, “the applicants [were] not providing design and engineering

information at a level of detail customarily reviewed by the staff in reaching a design final safety

decision.” Although recognizing the DAC approach as a possible substitute for required design

details, the staff concluded that “the use of DAC, instead of detailed design information, should

be limited. The restrictions should be based upon a consideration of those design areas

affected by rapidly changing technologies, or design areas for which as-built, or as-procured,

information is not available.” 

The DAC approach proposed for the ABWR and the System 80+ included the use of DAC in

the following areas: I&C, control room (i.e., human factors engineering), radiation protection,

and piping. The staff accepted the DAC approach during the certification of the ABWR and

System 80+ designs because detailed information for certain portions of the designs was not

available at the time of the safety review (radiation protection and piping design areas). 

Furthermore, the staff concluded that fixing certain design details was not appropriate due to

the rapidly changing technologies of certain components and systems (I&C and control room

design areas). The staff discussed how the DAC approach was being implemented on the

ABWR in SECY-92-196, “Development of Design Acceptance Criteria for the Advanced Boiling

Water Reactor (ABWR),” dated May 28, 1992, and in SECY-92-299, “Development of Design

Acceptance Criteria for the Advanced Boiling Water Reactor (ABWR) in the Areas of

Instrumentation and Control (I&C) and Control Room Design,” dated August 27, 1992. This

approach was also used during the certification process for System 80+.

In its design certification application for the AP600, Westinghouse requested certification of a

more complete design than the ABWR and System 80+ (evolutionary plants) designs. The staff

applied the DAC process to only two areas: I&C and control room. Piping DAC was not used

for the AP600 design. Although as-built and as-procured information was not available,

Westinghouse performed a significant amount of the piping design calculations by assuming

preliminary vendor information for such items as valves and components. The staff accepted

use of DAC in the I&C and control room areas for the AP600 design certification based on the

rapidly evolving technology aspects of these technical areas. 

Using the DAC approach described in SECY-92-053, SECY-92-196, and SECY-92-299, the

staff established a reasonable level of confidence in the final safety determination for these
-4-

designs. However, as discussed in SECY-92-053, the staff still concludes that although

perhaps justifiable, use of the DAC process is not the preferred way to certify nuclear plants. 

Two situations supporting the use of DAC were originally foreseen in SECY-92-053: (1) when

the design area is in a field characterized by rapidly evolving technology (e.g., digital I&C), a

design solution frozen at the time of certification could be obsolete by the time the plant was

constructed, and (2) when closing the issue at the design certification stage would require a

level of detail that could not be provided until a plant was actually built or its components were

procured. Thus, the design certification application should provide essentially complete design

information to comply with the requirements of 10 CFR 52.47(a)(2), and the use of DAC should

be limited to a few technical areas where an applicant has provided a valid reason(s) for not

providing the required level of design detail. 

When justified for use, the DAC should be sufficiently detailed to provide an adequate basis for

the staff to make a final safety determination prior to granting design certification. The use of

DAC would result in less design detail at the design certification stage, and more detail

regarding how the DAC will be demonstrated by the COL licensee during construction. Analysis

methods, performance tests, and inspections, would be specified in lieu of design detail. All of

the acceptance criteria must be met by the COL holder before loading fuel. The DAC, and any

related interface requirements, need to be sufficient for the staff to conclude that any additional

design detail developed after the design certification, which satisfies those criteria, would not

alter the staff’s safety conclusion.

As noted in SECY-92-053, the limited use of DAC will not affect the staff’s ability to make

necessary safety determinations or the safety benefits of standardization. Although numerous

detailed design configurations may satisfy a given set of DAC, the staff expects that economic

considerations will likely prompt all subsequent COL holders to make their final designs

identical to the first unless major technical advances prompt consideration of a design change.

As noted in SECY-92-053, the use of DAC has the potential to increase the likelihood of

post-construction hearing petitions and to expand the scope of a hearing, if it occurs. While the

staff and a licensee may agree at various points during construction that DAC are met,

compliance with DAC, including those intended to be verified early in the construction process,

can be the subject of a hearing just prior to operation.

Westinghouse Proposal for DAC on the AP1000

Westinghouse states that the AP1000 design is based closely on the AP600 design and that it

maintains the AP600 design configuration, use of proven components, design basis and

licensing basis by limiting the changes to the AP600 design to as few as possible. In seeking

design certification for the AP1000 design, Westinghouse proposed to apply the DAC approach

to the instrumentation and control (I&C) and control room design as it did in the AP600

application. However, it also proposed to apply the DAC approach to the piping and structural

design, and (to some extent), the seismic analysis, citing the precedents set in the use of DAC

during certification of the ABWR and the System 80+ standard plant designs. After discussions

with the staff regarding the requirements of 10 CFR 52.47(a)(2), Westinghouse stated, as

detailed in its letter dated February 13, 2002, that it would (1) limit the design certification to

hard-rock sites and provide a seismic analysis, and (2) perform specified structural design

calculations. This would provide sufficient seismic and structural design information for the staff
-5-

to reach a safety determination prior to granting certification and preclude the need for DAC in

these areas. In the same letter, Westinghouse provided information supporting its proposed

use of DAC in the piping area. Therefore, the staff’s assessment of the AP1000 DAC approach

contained herein is limited to a discussion of the proposed use of DAC in the I&C, control room,

and piping areas.

I&C and Control Room Design Areas

For the I&C and control room (human factors engineering) design areas, the staff agrees that

DAC can be successfully developed during the AP1000 design certification review stage and

implemented after a design is certified. The basis for allowing use of DAC in these areas is the

same as that for the ABWR, System 80+, and AP600; the I&C and control room design areas

are characterized by a rapidly evolving technology and requiring completion of the design in

these areas may result in the design becoming obsolete by the time a plant is constructed. 

Therefore, the staff finds the use of the DAC approach in the I&C and control room areas

acceptable for the AP1000 design certification review.

Piping Design Area

As evidenced by discussions on the level of detail required for a standard plant design

contained in SECY-92-053 and SECY-92-196, the Commission previously allowed the use of

piping DAC because General Electric and ABB-Combustion Engineering claimed that as-built

and as-procured information was necessary but unavailable at the design certification stage to

complete the piping analyses and design details. For the AP600 design, Westinghouse

demonstrated that it did not need as-built or as-procured information to sufficiently complete the

piping analyses and design. This is due, in part, to the fewer number of safety-related piping

subsystems, and the fact that passive plants by nature have few, if any, active piping

components (such as pumps and motor-operated valves with heavy, offset motors) where the

as-procured information is necessary but not yet available to complete the piping analyses and

design. Given the similarities between the AP600 and AP1000 designs, the basis established 

for using DAC for piping design (i.e., lack of as-built and as-procured information) may not

apply to the AP1000 plant. A literal interpretation of the terms “as-built” and “as-procured”

could lead one to argue that the as-built and as-procured information is not available until the

components are purchased or constructed. One could also argue that the as-built and asprocured information is not necessary as demonstrated by Westinghouse’s completion of the

AP600 piping design. Regardless of these arguments, the staff’s position remains consistent in

that, although the DAC approach can be used to close some issues for which design details are

lacking, it should not be used in technical areas where the design can be sufficiently completed. 

Otherwise, the benefits of certifying a standardized plant design are eroded when design

certification applicants seek to achieve finality for significant portions of the design without

providing the design details. 

In the case of AP1000, the staff recognizes that the AP600 standard plant has completed the

piping layout and analyses to a sufficient degree to ensure that there would be minimal, if any,

design changes resulting from interferences or inadequate space for the piping when the plant

is built. Thus, many of the benefits of standardization that are achieved by having completed

the piping layout and analyses for the AP600 standard plant will carry over to the AP1000 plant

design because the piping layout for the AP1000 plant is not expected to significantly change

from that of the AP600 plant. Westinghouse noted in its February 13, 2002, letter that “the
-6-

vendor information required to perform the piping analysis such as valve weights and centers of

gravity is not available until vendors are selected.” Furthermore, Westinghouse contended that

it “gained very little regulatory benefit by performing detailed piping design and analysis during

design certification of AP600.” This conclusion was based on the little difference between the

piping ITAAC for the AP600, ABWR, and System 80+ plants where nearly the same verification

must be performed for any of the applications. The staff acknowledges that the final as-built

piping design for the AP600 is still subject to ITAAC verification as were the as-built piping

design for ABWR and System 80+. However, if there are no design changes (or only minor

design changes) in the final, as-built AP600 piping, then the AP600 piping analysis completed

during design certification would still be valid at the construction phase with no further analyses

required to be completed by the COL holder. This benefit would not apply to the ABWR or

System 80+ certified designs.

The staff finds that the completed AP600 piping layout and design provides a sufficient level of

detail to assure that the benefits of standardization will be achieved for the AP1000 piping. The

completeness of the AP1000 piping design using the AP600 piping design information would be

equivalent to that typically found during the preliminary design stage of a nuclear power plant

design. Based on information provided by Westinghouse, the staff expects that differences

between the AP600 and AP1000 designs will necessitate minimal changes to the completed

AP600 piping design. Any areas where there are changes will be evaluated to ensure the staff

is able to reach a conclusion on all safety questions. Consequently, the staff finds that the use

of DAC in the AP1000 piping design area would be an acceptable approach based on the

completeness of the AP600 piping layout and design and the applicability of the AP600 piping

design information to the AP1000 plant design. The use of DAC would assure that the final, asbuilt piping design and analyses, can be completed with adequate confidence that safety issues

associated with the as-built piping design will not arise when the plant is constructed. This

assessment is contingent upon the ability of Westinghouse and the staff to agree on adequate

piping DAC.

Given the acceptability of using piping DAC for the AP1000 standard plant design, there exist

some details regarding implementation of piping DAC that need to be resolved during the

design certification review. For instance, Westinghouse states that it is proposing to use a DAC

approach that is similar to the approach used for the ABWR and System 80+ standard plant

designs. More specifically for AP1000 piping, Westinghouse proposes to provide the analyses

for piping in which a leak-before-break (LBB) approach is applied as part of the COL

application. The staff acknowledges that in SECY-93-087, “Policy, Technical, and Licensing

Issues Pertaining to Evolutionary and Passive Advanced Light-Water Reactor Designs,” dated

April 2, 1993, it recommended approval of the application of the LBB approach for evolutionary

and passive advanced light-water reactors (ALWRs) seeking design certification. In that same

paper, however, the staff further recommended that this approval be limited to instances in

which appropriate bounding limits are established using preliminary analysis results during the

design certification phase and verified during the COL phase by performing the appropriate

ITAAC. Westinghouse’s proposed approach for the AP1000 is to establish bounding curves at

the design certification phase and to provide analyses for LBB piping at the COL phase rather

than during the design certification phase. This is not consistent with currently-approved ALWR

policy. Postponing the completion of analyses for LBB piping until the COL phase would leave

open the question of whether there is sufficient margin in the piping to demonstrate that the

probability of pipe rupture is extremely low; thus, the finality of design might not be assured

during design certification. The staff will continue to discuss this issue with Westinghouse
-7-

during the design certification review (Phase 3) to assure that the safety question is adequately

resolved prior to granting the certification.

Furthermore, for the AP1000 plant, the piping diameters have changed from those established

in the AP600 standard plant design. The staff’s experience gained during the AP600 review

and the AP1000 pre-application review indicates that the changes in piping diameters affect the

thermal-hydraulic characteristics of the passive safety systems, and therefore, might affect the

validity of the staff’s safety conclusions. The proposed DAC approach only increases the

uncertainties already associated with the current safety analysis codes (although, at this time,

the level of uncertainty appears acceptable given the completeness of the AP600 piping design,

the applicability of the AP600 piping design to the AP1000 piping design area, and the staff’s

experience with implementation of piping DAC). The issue of applicability of the AP600

analysis codes to the AP1000 design will be discussed in separate correspondence. In

addition, other safety issues related to the use of DAC that have been identified in the past

design certification reviews and that will need to be addressed during the AP1000 design

certification review include the assumptions used in consideration of flooding and subcompartment pressurization analyses. The staff will also continue to pursue resolution of these

safety issues during the design certification phase to assure that the safety questions are

adequately addressed by Westinghouse prior to granting the design certification.

Summary of the Staff’s Evaluation of Westinghouse’s Proposed Use of DAC

The staff concludes on the basis of its review of Westinghouse’s pre-application submittals, that

it is acceptable for the AP1000 standard plant design to use the DAC approach in the I&C and

control room design areas. The bases for allowing the use of DAC in these areas are

consistent with those cited for the ABWR, System 80+, and AP600 design certifications. The

use of DAC in the I&C and control room areas is acceptable because these areas are

characterized by a rapidly changing technology. Requiring completion of the design at the

design certification stage may result in the design becoming obsolete by the time a plant is

constructed. 

The use of DAC in the piping design area is also acceptable because it would supplement the

AP600 piping design information that would remain applicable to the AP1000 plant. The use of

DAC will not affect the staff’s ability to make necessary safety determinations nor will it erode

the economic and safety benefits of standardization to the extent that the completeness of the

AP600 piping design can be carried over to the AP1000 plant. This assessment is contingent

upon the ability of Westinghouse and the staff to agree on adequate piping DAC during the

design certification review.

CONCLUSION:

The staff concludes that it is acceptable to use the DAC approach in the I&C, control room, and

piping design areas, contingent upon the ability of Westinghouse and the staff to agree on

adequate DAC during the design certification review.
-8-

COORDINATION:

The staff met with the ACRS to discuss the acceptability of using DAC for the areas mentioned

as well as the status of the Phase 2 review. The Office of the General Counsel has no legal

objections to this paper.

/RA/ William F. Kane

William D. Travers

Executive Director

 for Operations
-8-

COORDINATION:

The staff met with the ACRS to discuss the acceptability of using DAC for the areas mentioned

as well as the status of the Phase 2 review. The Office of the General Counsel has no legal

objections to this paper.

/RA/ William F. Kane

William D. Travers

Executive Director

 for Operations

Accession #ML013310041

OFFICE PM:NRLPO Tech Ed* DD:NRLPO D:NRLPO D:DE

NAME LBurkhart:cn PKleene MGamberoni JLyons JCalvo for

JStrosnider*

DATE 11/16/01 3/5/02

OFFICE D:DIPM* NRR OGC DEDRP EDO

NAME BBoger WBorchardt KCyr WKane WTravers

DATE 1/3/02 03/21/02 03/21/02 04/01/02 04/01/02

*See previous concurrence OFFICIAL RECORD COPY