M

*;

tpjk REC;(,

0

April 8, 1993 POLICY ISSUE SECY-93-092

(Notation Vote)

FOR: The Commissioners

FROM: James M. Taylor

Executive Director for Operations

SUBJECT: ISSUES PERTAINING TO THE ADVANCED REACTOR (PRISM, MHTGR, AND

PIUS) AND CANDU 3 DESIGNS AND THEIR RELATIONSHIP TO CURRENT

REGULATORY REQUIREMENTS

PURPOSE:

To request Commission guidance for those areas where the staff is proposing to

depart from current regulatory requirements in the preapplication review of

the advanced reactor and CANDU 3 designs.

BACKGROUND:

The Advanced Reactor Policy Statement (51 FR 24643) and NUREG-1226, "Development and Utilization of the NRC Policy Statement on the Regulation of Advanced

Nuclear Power Plants," define advanced reactors as those with innovative

designs for which licensing requirements will be significantly different from

the existing light-water reactor (LWR) requirements. These documents also

give guidance for developing new regulatory requirements to support the

advanced designs. Staff reviews of these advanced reactor designs should

utilize existing regulations to the maximum extent practicable. When new

requirements are necessary, the staff should move toward performance standard

regulations and away from prescriptive regulations. Each designer is encouraged to propose new criteria and novel approaches for evaluating the design.

An objective of early designer-staff interaction should be to develop guidance

on licensing criteria for the advanced reactor and CANDU 3 designs and to make

a preliminary assessment of the potential of that design to meet those

criteria.

NOTE: TO BE MADE PUBLICLY AVAILABLE

IN 3 WORKING DAYS FROM THE

Contacts: DATE OF THIS PAPER

R.C. Pierson

504-1111

T.H. Cox

504-1109
The Commissioners - 2 -

The staff is conducting preapplication reviews of the following four designs:

* General Atomics (GA) 350-MWt modular high-temperature gas-cooled reactor

(MHTGR) design sponsored by the U.S. Department of Energy (DOE) Gas-Cooled

Reactor Program

* General Electric (GE) 471-MWt power reactor innovative small module (PRISM)

reactor design sponsored by the DOE Advanced Liquid-Metal Reactor (ALMR)

Program

* Atomic Energy of Canada, Limited, Technologies (AECLT) 1378-MWt Canadian

deuterium-uranium (CANDU 3) reactor design

* ASEA Brown Boveri-Combustion Engineering (ABB-CE) 2000-MWt process inherent

ultimate safety (PIUS) reactor design

The staff has analyzed policy issues and made recommendations in Enclosure 1.

The current designs are summarized in Enclosure 2.

Enclosure 3 lists pertinent Commission papers and reference staff documents

for these preapplication designs. Some information in the original documents

may have been superseded by more recent preapplicant submittals.

Enclosure 4 serves as a guide to the staff's resolution of comments submitted

by the preapplicants and other interested parties, and in Enclosure 5, the

staff responds to the Advisory Committee on Reactor Safeguards (ACRS) review

of Enclosure 1.

In response to a Commission staff requirements memorandum (SRM) (SECY-91-202,

'Departures From Current Regulatory Requirements in Conducting Advanced

Reactor Reviews," July 2, 1991), the staff committed to identify those policy

and technical issues that require Commission guidance or staff resolution for

design certification. The staff committed to do this during the preapplication review and to include situations in which advanced reactor designs

deviate significantly from current regulatory requirements.

Policy issues for evolutionary and passive LWRs have been stated in the

following Commission papers:

* SECY-90-016, 'Evolutionary Light Water Reactor (LWR) Certification Issues

and Their Relationship to Current Regulatory Requirements," January 12,

1990

* Draft SECY paper (distributed for comments on February 27, 1992), "Issues

Pertaining to Evolutionary and Passive Light Water Reactors and Their

Relationship to Current Regulatory Requirements"

* Draft SECY paper (distributed for comments on June 25, 1992), "Design

Certification and Licensing Policy Issues Pertaining to Passive and

Evolutionary Advanced Light-Water Reactor Designs"
The Commissioners - 3 -

DISCUSSION:

In-their submittals, the-preapplicants descrjibed. how their designs complied

with the current LWR licensing requirements. 'Where''they. did not comply, they

gave alternative criteria for evaluating the designs. The" staff has'conducted

a preliminary review of the four preapplication designs using existing LWR

regulations and the evolutionary light-water reactor (ELWR) and advanced

light-water.reactor (ALWR).policy guidance. In this initial review, the staff

described 10 issues-that require policy direction from the 'Commission because

deviations are proposed from-existing regulations. In these issues, either

existing regulations do not apply to the design or preapplicants are proposing

criteria that are significantly different from the current regulations. These

issues, background information on current;LWR requirements, preapplicantproposed approaches, staff considerations, and staff recommendations 'for

Commission approval, appear in Enclosure 1.

The staff developed its recommendations by'considering information from the

preapplicants, the public, and the ACRS. The staff considered the preapplicant proposals in light, of the Commission's pol1icy statemenits and guidance

on severe accidents, advanced reactors, and safety goals in order to develop a

single consistent.policy recommendation for application to all applicable

advanced reactor designs. In some instances, the' staff recommends' that

current regulations continue to be applied to the advanced reactor designs

despite preapplicant proposals to do otherwise. In some cases, the staff

proposes more conservative alternatives .to the'preapplicant 'proposals to,

account for uncertainties associated with the conceptual design, which should

ensure that conclusions.made during ''the preapplication review will serve as a

reasonable basis for a finding at design certification that the detailed

design is acceptable. It is intended that the safety level standards for

these designs will be consistent with Commission guidance at design certification.

Some issues are closely related. 'Accideit evaluation:and source..term provide

a basis for containment performance and emergency plannin'g.- Approaches taken

for residual heat removal and reactivity control are intended to be consistent

with the accident evaluation categories and consequences.

The staff proposes to treat the.MHTGR, PRISM, and PIUS.designs as advanced

reactors in accordance with'the-policy statement.' The CANDU 3 design is . considered to be an evolutionary heavy-water design'fderiving from the larger

CANDU reactor designs operating in Canada and elsewhere. Therefore, the staff

has concluded that a prototype CANDU 3 is not required for design certification. This position is consistent with staff conclusions in SECY-89-350,

'Canadian CANDU 3 Design Certification, November 21, 1989,' and SECY-90-133,

'Prototype Requirement for CANDU-3 Design,' April 6,.1990. The staff has been

informed of Canadian plans.to build a CANDU,3,plant in'the Province of

Saskatchewan. However, AECLT has'stated that its application for a standard

design certification will be independent of any' schedule to build a reference

plant and the NRC review for such a certification should only need the

relevant operating experience of the CANDU plants from which the CANDU 3
The Commissioners - 4 -

design evolved. AECLT makes no claim of passive shutdown or decay heat

removal capabilities. However, because of its unique heavy-water, pressuretube reactor design and evolution under a different regulatory structure, the

CANDU 3 plant. does not conform to some current NRC regulations. The staff

proposes to apply preapplication review criteria to the CANDU 3 reactor that

are consistent with ELWR review requirements.

The staff intends to use the Commission's guidance on these recommendations to

conduct preapplication reviews of the conceptual designs. Guidance for review

of prototype requirements for advanced reactors will follow SECY-91-074,

"Prototype Decisions for Advanced Reactor Designs," March 19, 1991. Consistent with the requirements of Title 10 of the Code of Federal Regulations (CFR) Section 52.47(b)(2), the 'staff will require that novel safety features of the

advanced reactors and CANDU 3 be demonstrated through analysis, test programs,

experience, or a combination of these methods. Feedback from the review

process will be factored into recommended revisions to the policy guidance,

and recommendations for the development of licensing criteria and regulations

will be made after the preapplication safety evaluation reports (PSERs) are

issued. Should additional issues be developed during the preapplication

review process, they will be' identified in Commission papers.

The staff is reassessing the priorities and schedules of preapplication

reviews in light of staff reductions requested by the Clinton administration.

A separate Commission paper is being written by the staff to present the

options available for the preapplication reviews of these designs. If the

Commission's decision is to stop these reviews, the staff still requests the

Commission to review this policy paper, as the Commission's actions on these

policy issues will give reactor designers important information for design

development.

CONCLUSION:

The staff requests approval of, or alternate guidance on, these proposed

positions to be taken in the preapplication review of the advanced reactor and

CANDU 3 designs.

COORDINATION:

The Office of the General Counsel has reviewed this paper and has no legal

objection to its contents.

RECOMMENDATIONS:

That the Commission

* Approve the staff recommendations in Enclosure 1 for conduct of the

preapplication reviews to provide the preapplicants important information

for their design development.
The Commissioners - 5 -

* Approve the staff's conclusion that, based on the position that the CANDU 3

design is an evolutionary heavy-water design deriving from CANDU. designs

operating in Canada and elsewhere, a prototype CANDU 3 is not required for

design certification.

* Note that positions which change as preapplication review experience is

obtained will be communicated to the Commission and that as the staff

identifies new issues it will inform the Commission.

* Note that because of the preliminary nature of the design information on

the advanced reactor and CANDU 3 designs, and the preliminary nature of the

staff's preapplication reviews, the staff does not recommend proceeding

with generic rulemaking on any of the policy issues raised in this paper.

The staff will consider generic rulemakingas appropriate, as the reviews

progress and as the staff gains greater confidence in the final design

information.

esM a

ecutive Director

for Operations

Enclosures:

1. Analysis of Policy Issues

2. Design Summaries

3. List - Reference Documents

4. Comments - Preapplicant/Other

Party w/5 attch.

5. Response to ACRS

Commissioners' comments or consent should be provided directly

to the Office of the Secretary by COB Friday, April 23, 1993.

Commission Staff Office comments, if any, should be submitted

to the Commissioners NLT Friday, April 16, 1993, with an information copy to the Office of the Secretary. If the paper is of

such a nature that it requires additional review and comment,

the Commissioners and the Secretariat should be apprised of

when comments may be expected.

DISTRIBUTION:

Commissioners

OGC

OCAA

OIG

OPP

EDO

ACRS

SECY
IANALYSIS OF POLICY ISSUES

As part of its preliminary review of the PRISM, MHTGR, CANDU 3, and PIUS

designs, the staff has noted 10 instances of the-preapplicants proposing-to

'deviate from current light-water reactor (LWR) guidance for the review of the

designs. Deviation was proposed when the existing regulations were not applicable to the technology or when the preapplicant considered deviation

warranted on the basis of the reactor design and proposed criteria. The staff

has grouped the issues into two categories: (1) those issues for which the

staff agrees that departures from current regulations should be considered and

(2) those issues for which the staff does not believe a departure from current

regulations is warranted at this time. The following is a matrix of the

issues identifying the plant applicability:

CATEGORY ISSUES PRISM MHTGR CANDU 3 PIUS

I A. Accident Evaluation X X X X

B. Source Term X X X X

C. Containment Performance X X X X

D. Emergency Planning X X X

E. Reactivity Control System X

F. Operator Staffing X X X

& Function

G. Residual Heat Removal X X X

H. Positive Void Reactivity X X

Coefficient

2 I. Control Room and Remote X X X X

Shutdown Area Design

J. Safety Classification of X

Structures, Systems,

& Components

Discussions of these issues follow., The staff has given a brief summary of

the issue, current LWR regulations, preapplicant positions, and staff

considerations, and proposes a recommendation for staff action. The staff

considered the preapplicants' proposals in light of applicable Commission

policy statements.

ENCLOSURE 1
At this preliminary review stage, the staff has limited the scope of the

issues to those that could affect the licensability of the proposed design.

Additionally, if a similar issue had already been raised for the LWR designs

and the staff's advanced reactor design recommendation was essentially the

same, it was not repeated in this paper. In those cases where the preapplicants proposed different considerations from the evolutionary or passive LWRs,

the issue is treated in this paper in light of the work done in the advanced

light-water reactor policy papers.

- 2 -
A. ACCIDENT EVALUATION

Issue

Identify appropriate event categories, associated frequency ranges, and

evaluation criteria for events thatwill be used to assess-the safety of the

advanced reactor and CANDU 3 designs. -

Current'LWR Regulations -

General Design Criterion (GDC) 4 requires the 'consideration of accidents in

the 'design basis;' Also, 10 CFR 52.47. requires the consideration of consequences for both severe accidents (through'the required:probabilistic risk

assessment) and'design-basis accidents :(DBAs) for designs that.differ significantly from evolutionary designs or.utilize passive or.other innovative means

to accomplish safety functions.

Preapplicant Position,

All three advanced 'reactor preapplicants proposed to analyze accidents that

are significantly less probable than the.present design-basis range and to

assure through their design that these accidents will have acceptable

consequences limited to specific dose levels to the public. All chose to

utilize the Environmental Protection'Agenty's (EPA's) lower-level Protective

Action Guidelines (PAGs) of I rem-whole body:and 5' rem thyroid as their limits

for 'a significant portion of. their accident spectrum. The MHTGR accident

guidelines invoke the lower-level PAG dose limit for all sequences 'more

probable than 5xlO 'per reactor-year. The -PIUS guidelines invoke.the. PAGs

for accident sequences more probable than 10' per reactor-year. The PRISM,

guidelines invoke the PAGs for accident' sequences more probable than 10-. per

reactor-year. The PRISM accident evaluation guidelines 'also limit

consequences from'any-sequence more probable than 10'6 per-reactor-year to the

'10'CFR`Part 100 dose'limits. 'Guidelines for onsite consequences and-offsite

consequences from operational transients for all vendors-are consistent with,

or more conservative than, present LWR regulations as contained in 10 CFR

Part 100.

The CANDU 3 preapplicant has not submitted detailed analyses of the-consequences of design-basis events and severe accidents for the design. -The.

.documentation given to the NRC staff indicates that the preapplicant ha

"considered" design-basis events with estimated frequencies down to 10' per

year and severe accident end-states with-estimated frequencies down-:to 10s

per year.' However, the potential consequences to the core,- the containment,

and the public for any of these events have not been submitted to the staff,

except for some limited information for a large loss-of-coolant accident

(LOCA) without emergency core cooling,.a design-basis accident used to determine the' containment design pressure. -The preapplicant needs to develop

detailed .ahalyses of consequences~for anticipated transient without scram

(ATWS),' unscrammed LOCA,- and other events that could cause such reactivity

insertions as delayed scram events and control system failures. Because of

- 3 -
the positive void reactivity coefficient associated with the CANDU 3 design,

events involving even a short scram delay could potentially result in a core

disruption accident.

Staff Considerations

The structure proposed by the PRISM, MHTGR, and PIUS preapplicants for

selecting accidents to be evaluated was developed to support their positions

for reducing emergency planning requirements (as described in Section D of

this paper). As discussed in Section 0, the staff is not ready to make a

specific recommendation on whether, or to what extent, the Commission should

consider reducing the emergency planning requirements. The CANDU 3 approach,

which limits the scope of severe accidents examined, appears to be inconsistent with the requirements of 10 CFR 52.47; the preapplicant has not

documented consequence analyses of design-basis events. Also, no consequences

have been analyzed for CANDU 3 severe accidents that would involve substantial

core damage. The accident evaluation scheme envisioned by the staff would

examine challenging events to the designs to provide information for a later

decision on emergency planning requirements and would consider the potential

consequences of severe accidents. Additionally, for the multi-module designs

(PRISM and MHTGR), the impact of specific events on other reactor modules for

the multi-module sites must be assessed.

The staff intends to structure its review conservatively, so that positive

conclusions made on the licensability of the conceptual designs during the

preapplication review will serve as a reasonable basis for finding the design

acceptable at design certification. Some sources of uncertainty regarding the

conceptual designs are limited performance and reliability data for passive

safety features, lack of final design information, unverified analytical tools

used to predict plant response, limited supporting technology and research,

limited construction and operating experience, and incomplete quality control

information on new fuel manufacturing processes. Later, during the design

certification process, some of the conservatism within staff analyses could be

removed should completed research lead to improved understanding of the design

and better analytical tools.

Staff Recommendation

The staff proposes to develop a single approach for accident evaluation to be

applied to all advanced reactor designs and the CANDU 3 design during the

preapplication review. The approach will have the following characteristics:

* Events and sequences will be selected deterministically and will be

supplemented with insights from probabilistic-risk assessments of the

specific designs.

* Categories of events will be established according to expected frequency

of occurrence. One category of events that will be examined is accident

sequences of a lower likelihood than traditional LWR design-basis

accidents. These accident sequences would be analyzed without applying

- 4 -
the conservatisms used for design-basis accidents. Events within a

category equivalent to the current design-basis accident category will

require conservative analyses, as is.presently done for LWRs.

* Consequence acceptance limits for core damage and onsite/offsite releases

will be 'established for each category to be, consistent with Commission

policy guidance.

* Methodologies 'and evaluation assumptions will' be developed for analyzing

each category of events consistent with existing'LWR practices.

* Source terms will -be determined as' approved by'the"Commission in Section.B

of this paper. -'

* A set of events will be selected deterministically to assess the safety

margins of the proposed designs, to determine scenarios to mechanistically

determine a source term, and to identify a containment challenge scenario.

* External events will be chosen deterministically on a basis consistent

with that used for LWRs.

* Evaluations of multi-module reactor designs 'will be considered as to

whether specific events apply to some'or all reactors on site for the

given scenario for-all, operations permitted by-proposed operating

practices.

- 5 -
B. SOURCE TERM

Issue

Should mechanistic source terms be developed in order to evaluate the proposed

designs?

A mechanistic source term is the result of an analysis of fission product

release based on the amount of cladding damage, fuel damage, and core damage

resulting from the specific accident sequences being evaluated. It is

developed using best-estimate phenomenological models of the transport of the

fission products from the fuel through the reactor coolant system, through all

holdup volumes and barriers, taking into account mitigation features, and

finally, into the environs.

Current LWR Regulations

Appendix I to 10 CFR Part 50 (ALARA), 10 CFR Part 100 (Reactor Site Criteria,

which references the Technical Information Document (TID) 14844 source term),

and 10 CFR Part 20 (Standards for Protection Against Radiation) all have

limitations on releases related to power plant source terms.

General Design Criterion (GDC) 60 requires that the design includes means to

control suitably the release of radioactive materials in liquid and gaseous

effluents and to handle waste produced during normal operations and anticipated operational occurrences.

Preaprlicant Position

PRISM designers have proposed calculating a source term different from how the

source term is calculated for LWRs. They have proposed siting source terms to

bound the release from accidents considered in the design; the magnitude of

these source terms is less than the TID-14844 LWR assumed source term. Additionally, at this time, there is insufficient experimental data on the PRISM

fuel to quantify the fission product release fractions or the behavior of

those fission products migrating from the metal fuel through the sodium

coolant.

MHTGR designers have proposed siting source terms for accidents based on the

expected fuel integrity. The preapplicant predicts that the coated microsphere fuel particles in the core will contain all the fission products except

for products released from the small number of failed particles resulting from

in-service particle failures and added particle failures during accidents.

Insufficient data currently exist to determine if the MHTGR fuel performance

will meet these expectations.

The PIUS designer has proposed using a mechanistic LWR source term. Information has been given in the Preliminary Safety Information Document (PSID)

for fission product concentrations in both liquid and gaseous effluents.

- 6 -
The CANDU 3 designer calculates a source term for each scenario. Each

accident is evaluated and-fission product'release-and transport are determined

individually for each scenario. -The staff has not, at this time, evaluated

the CANDU 3 codes and methods.'

Staff Considerations

In order to evaluate the'safety characteristics of-advanced reactor designs

that are significantly different from LWRs, a different method needs to-be

developed for calculating postulated radionuclide releases (source terms). In

a June 26, 1990, staff requirements memorandum (SRM) related to SECY-90-016,

the Commission asked the staff to submit a paper-describing the status of

efforts to'develop an updated source term that takes into account "best "' available estimates" and current knowledge on the subject. In response to

this request, the staff is developing, for LWRs, a revision to the TID-14844

source term (NUREG-1465, "Accident Source Terms for Light-Water Nuclear Power

Plants," draft report for comment, June"1992). -

The differences between the LWR designs and the MHTGR and PRISM designs

warrant a separate evaluation of source terms. The CANDU 3 design will also

differ from LWR designs in certain respects. The CANDU 3 coolant contains

significant amounts of tritium. Following failure of a pressure tube there is

no heavy-walled reactor vessel to contain releases (there are large volumes of

water in two concentric low-pressure tanks: moderator and shield water).

Consequently, the timing of releases is expected to be different from LWRs.

However, the same method being used to develop modified LWR source terms

should apply to the CANDU 3 design.

The NRC staff is currently revising 10 CFR Part 50 and 10 CFR Part 100 to

separate siting from source term dose calculations. The revisions to Part 100

being considered by the staff will replace the present individual dose

criteria with a population density standard. A fixed minimum exclusion area

radius of 0.4 mile is specified. Other criteria regarding population protection and seismic criteria factors are also included in the source term Part

100 revision. The staff intends that its recommendations for the preapplication review will be compatible with the proposed revisions.

The staff's recommendations envision developing a set of scenario-specific

source terms for each of the advanced reactors and CANDU 3 to allow a judgment

as to whether the release from each specific sequence meets the accident

evaluation criteria for sequences of that event category. Also, a source term

may be developed mechanistically for core damage sequences to compare against

applicable safety criteria.

Staff Recommendation

Advanced reactor and CANDU 3 source terms should be based upon a mechanistic

analysis and will be based on the staff's assurance that the provisions of the

following three items are met:

- 7 -
The performance of the reactor and fuel under normal and off-normal

conditions is sufficiently well understood to permit a mechanistic

analysis. Sufficient data should exist on the reactor and fuel

performance through the research, development, and testing programs to

provide adequate confidence in the mechanistic approach.

* The transport of fission products can be adequately modeled for all

barriers and pathways to the environs, including specific consideration of

containment design. The calculations should be as realistic as possible

so that the values and limitations of any mechanism or barrier are not

obscured.

* The events considered in the analyses

for each design are selected to bound

dependent uncertainties.

The design-specific source terms for each

one component for evaluating the acceptabi

to develop the set of source terms

severe accidents and designaccident category would constitute

ility of the design.

- 8 -
C. CONTAINMENT

Issue

Should the proposed advanced and CANDU.3 reactor designs be allowed to employ

alternative approaches to traditional "essentially leak-tight" containment

structures to provide for the control of fission product release to the

environment?

Current LWRReulations

-General Design Criterion (GDC) 16 requires that LWR reactor containments:

provide an essentially leak-tight barrier against the uncontrolled release of

radioactivity to the environment, and that containment-associated systems

ensure that containment design conditions important to safety are not exceeded

for as long as postulated accident conditions require. GDC 38, 39, and 40

state requirements for containment heat removal; GDC 41, 42,- and 43 for

containment atmosphere cleanup; and GDC'50 through 57 for containment design,

testing,-,inspection, and integrity. Requirements for LWR containment leakage

testing are established in 10 CFR'Part.50;Appendix J.

PreaDolicant Position

The MHTGR is not designed with a leak-tight containment barrier. 'The design

relies upon high-integrity fuel particles to minimize radionuclide release,

and on a below-grade,'safety-related concrete reactor building to provide ' retention and holdup of any radioactive- releases. The reactor vessel and the

steam generator vessel are in separate cavities-within the concrete structure.

In the event of a reactor coolant pressure boundary (RCPB) rupture, louvers in

the reactor building are designed-to allow the passage of gases to the

environment, preventing building overpressure. The building design does not

include containment isolation valves for the ventilation line, from the

building and has an open path to the environment via a drain line in the

reactor cavity cooling system (RCCS) panels.' Accident dose calculations

assume a constant 100-percent volume per day building leak rate, and take

credit for plateout on the building walls.

PIUS, above grade, is designed with a low-leakage containment based on a

pressure-suppression scheme that is-integral.with the reactor building,

similar to the ABWR and SBWR. Below grade, the bottom part.of the.containment

structure and the monolithic prestressed concrete reactor vessel (PCRV) (which

contains the reactor pool water and forms the lower portion of the reactor

pressure boundary) are joined together by means of vertical prestressing

tendons that are run up to the top of the PCRV. The-steel liner on the

containment inner surface, which ensures' leak-tightness, is a continuous liner

covering the whole bottom area, the,,cylindrical walls, and the upper parts.

CANDU 3 is designed with a large, dry, steel-lined, concrete containment,

without containment spray. The maximum :leak rate (used-in safety, analyses) is

5-percent volume-per-day at the design..pressure of approximately 30 psig. The

- 9 -
structure is designed for a test-acceptance leak rate of 2 percent per day at

the design pressure. These leak rates are significantly higher than leak

rates for a typical U.S. pressurized-water reactor (PWR) containment.

The PRISM containment design is a high-strength steel, low-leakage, pressureretaining boundary, comprising two components, the upper containment dome and

lower containment vessel. The upper steel containment dome differs from

light-water reactor containments. The containment is specifically designed to

mitigate the radioactive release consequences of severe events. The PRISM

containment volume is markedly smaller than is typical of LWR containments;

there is little separation between the reactor vessel and the containment

boundary, and no safety-grade containment coolers or spray systems are

provided. The entire containment structure is located below grade within the

reactor building.

Staff Considerations

Each of the advanced reactor designs and the CANDU 3 design maintains an

accident mitigation approach, part of which includes containment of fission

products. Two of the advanced reactor designs (PRISM and MHTGR) place the

reactor building below grade, offering protection from external hazards.

Generally, the advanced designs focus more attention than do LWRs on protecting the plant by providing passive means of reactor shutdown and decay

heat removal (DHR). As a result, designers proposed less-stringent

containment requirements.

The staff recognizes that reactor designs without traditional containment

structures or systems represent a significant departure from past practice on

LWRs, and that existing LWR containment structures have proved an effective

component of our defense-in-depth approach to regulation. However, the

Advanced Reactor Policy Statement recognizes that to encourage incorporation

of enhanced safety margins (such as in fuel design) in advanced reactor

designs, the Commission would look favorably on desirable design-related

features or reduced administrative requirements. New reactor designs that

deviate from current practice need to be extensively reviewed to ensure that a

level of safety at least equivalent to that of current-generation LWRs is

provided, and that uncertainties in the design and performance are taken into

account.

The staff believes that new reactor designs with limited operational experience require a containment system that provides a substantial level of

accident mitigation for defense in depth against unforeseen events, including

core damage accidents. This requirement may not necessarily result in a highpressure, low-leakage structure that meets all of the current LWR requirements

for containment, but it should be an independent barrier to fission product

release. The proposed criteria will need to provide an appropriate level of

protection of the public and the environment considering both the safety

advantages of the advanced designs and the lack of an experience base in

evaluating their performance. For evolutionary LWRs, the staff, in

SECY-90-016, proposed to use a conditional containment failure probability

(CCFP) or deterministic containment performance goal to ensure a balance

- 10 -
and consequence mitigation. During the evolutionary LWR reviews, a great deal

of careful review was necessary to assure that a probabilistic CCFP would not

be used in a way that could detract. from;.a;balanced approach of severe

accident prevention and consequence mitigation.. For advanced reactor designs

and the CANDU 3 design, limited experience exists in the analysis and evaluation of severe accidents which would lead to significant difficulty and

uncertainty in assessing a CCFP. For this reason, the staff recommends that

the deterministic containment performance goal be adopted for the advanced

designs and.the CANDU 3 design. -The staff proposes to-requirethe preapplicant to postulate a core damage accident as a containment challenge event

to demonstrate'that containment'integrity is maintained for a period. ofapproximately 24;hours after the onset of core damage. This approach is used

because theipreliminary nature of the advanced designs-precludes a reliable

assessment of the failure probability of accident mitigation systems and,

therefore, of containment failure probability. Further, the CCFP is based on

experience with.LWR safety systems and accident progression. Intrinsic

differences-exist between LWR and advanced reactor technologies-and-their

approaches to the balance between accident prevention and mitigation. A

quantitative level of understanding of new technologies and systems comparable

to that of LWRs is not yet available. Thus, the use 'of a performance-based

criterion rather than a quantitative one appears to be more appropriate for

the advanced reactor and CANDU 3 preapplication review given the current level

of knowledge of advanced reactor and CANDU 3 risk and their prevention and

mitigation elements.

Staff Recommendation

The staff proposes to utilize a standard based upon containment functional

performance to evaluate the acceptability of~proposed designs rather than-to

rely exclusively on prescriptive containment design criteria. The staff

intends to approach-this by comparing containment performance with the

accident evaluation criteria.

-Containment designs must be adequate to meet the onsite and offsite

radionuclide release limits forthe event categories to be developed as

described in Section A to this paper within their design envelope.

* For a-period of approximately 24 hours following the onset of core damage,

the specified containment challenge event results-in nogreater than the

limiting containment leak rate used 'in evaluation of the event categories,

-and structural stresses are maintained within acceptable limits (i.e.,

ASME Level C requirements or equivalent). After this period,.the contain-

-ment must prevent uncontrolled releases of radioactivity.

- 11 -
D. EMERGENCY PLANNING (EP)

Issue

Should advanced reactors with passive design safety features be able to reduce

emergency planning zones and requirements?

Current LWR Regulations

Although emergency plans are not required for the issuance of a design certification under 10 CFR Part 52, they would be necessary for the issuance of a

combined license under Part 52 or a license issued under 10 CFR Part 50.

10 CFR 50.47 requires that no operating license be issued unless the NRC finds

that there is reasonable assurance that adequate protective measures can and

will be taken in the event of a radiological emergency.

Currently, offsite protective actions are recommended when an accident occurs

that could lead to offsite doses in excess of Environmental Protection Agency

(EPA) Protective Action Guidelines (PAGs), which are 1-5 rem whole body and

5-25 rem thyroid. At the lower projected doses, protective actions should be

considered. At the higher projected doses, protective actions are warranted.

Preaoplicant Position

The proposed approach of PRISM designers to emergency planning (EP) is significantly different from that of previous LWR applicants, particularly in the

area of offsite EP. An objective of PRISM designers is to meet the lowerlevel PAG criteria so that formal offsite EP involving early notification,

detailed evacuation planning, and provisions for exercise of the plan would

not be required. In order to attain this objective, the PRISM design

emphasizes accident prevention, long response times (36 hours) between the

initiation of an accident and core damage, and the mitigation of releases if

they should occur.

The MHTGR designers proposed reduced offsite emergency planning for reasons

similar to those proposed for the PRISM design. An emergency plan would be

written for an MHTGR and the plan would include any agency that could become

involved in the response to a radiological emergency (i.e., sheltering and

evacuating the public and controlling the food supply). The differences and

reductions from a typical emergency plan for LWRs are that the MHTGR plan

would have the exclusion area boundary (EAB) of 10 CFR Part 100 as the

boundary of the emergency planning zone (EPZ), as may be allowed by Appendix E

of 10 CFR Part 50 for gas-cooled reactors; and that there would be no rapid

notification or annual drills for offsite agencies. This is based on the

preapplicant's assertion that (1) the predicted dose consequences estimated at

the EAB/EPZ for accidents are below the lower-level EPA sheltering PAGs and

that the public can be excluded from the EAB, (2) there is a significantly

long time expected for the core to return to criticality after being shut down

by the Doppler coefficient without the reactor protection system functioning

(i.e., about 37 hours), and (3) there is a long time for the fuel and reactor

vessel to reach maximum temperatures (i.e., about 100 hours) during accidents.

- 12 -
The preapplicant asserts that the public around the plant would be outside the

area that needs to be sheltered or evacuated and, further, there will be ample

time to notify and move the public during an event.

With regard to the PIUS design, the preapplicant expects that due to its

passive safety features, onsite and offsite emergency planning will be

considerably simplified in comparison with current.day LWRs. The-preapplicant

believes that regulatory relief 'could be considered based on. (1) satisfaction

of the EPA-lower-level PAGs for dose,- (2) the passive features of the PIUS

design which precludes core-damage, and (3) design features that allow

-substantially larger response times before intervention would be required.

The preapplicant'contends that there are no credible accident sequences that

would lead to severe core damage: Offsite dose for the large-break;LOCA'is

claimed to be below the lower-level EPA PAGs .at 500 meters distance from: the

containment.

Staff Considerations

The designers of advanced reactors have objectives of achieving very low

probabilities (<l.Ox10'6 per year) of exceeding the EPA lower-level PAGs. The

designers claim that these advanced reactors, with their passive reactor

shutdown and cooling systems, and with core heatup times much longer than

those of existing LWRs, are sufficiently safe that the EPZ radius can be

reduced to the site boundary, and that detailed planning and exercising of

offsite response capabilities need not be required by NRC regulation. The

preapplicants state that this does not mean that there would be no offsite

emergency plan developed, but rather that such a plan could have fewer details

concerning movement of people, and need not contain provisions for early

notification of the general public or periodic' exercises of the offsite plan

on a scale consistent with present reactors.

A similar policy issue was identified for the passive LWR design, but remains

open. The Electric Power Research Institute (EPRI) is working with the NRC

staff to define a process for addressing simplification of emergency planning.

The results of this effort should be applicable to advanced reactor designs.

Staff Recommendation

The staff proposes no changes to the existing regulations governing EP for

advanced reactor licensees at this time. The staff will provide regulatory

direction at or before the start of the design certification phase so that any

EP implications on design can be addressed. Consistent with the current

regulatory approach, the staff views the inclusion of emergency preparedness

by advanced reactor licensees as an essential element in NRC's "defense in

depth" philosophy. Briefly stated, this philosophy (1) requires high quality

in the design, construction, and operation of nuclear plants to reduce the

likelihood of malfunctions in the first instance; (2) recognizes that

equipment can fail and operators can make mistakes, thus requiring safety

systems to reduce the chances that malfunctions will lead to accidents that

release fission products from the fuel; and (3) recognizes that, in spite of

these precautions, serious fuel damage accidents can happen, thus requiring

- 13 -
containment structures and other safety features to prevent the release of

fission products off site. The added feature of emergency planning to the

defense-in-depth philosophy provides that, even in the unlikely event of an

offsite fission product release, there is reasonable assurance that emergency

protective actions can be taken to protect the population around nuclear power

plants.

Information obtained from accident evaluations conducted as outlined in

Section A of this paper will be factored into to the emergency planning

requirements for advanced reactor designs. Based in part upon these accident

evaluations, the staff will consider whether some relaxation from current

requirements may be appropriate for advanced reactor offsite emergency plans.

The relaxations to be evaluated will include, but will not be limited to,

notification requirements, size of EPZ, and frequency of exercises. This

evaluation will take into account the results of passive LWR emergency

planning policy decisions.

- 14 -
E. REACTIVITY CONTROL SYSTEM

Issues

Should the NRC accept a reactivity control system design that has no control

rods?

Current LWR Regulations

General Design Criterion (GDC) 26 requires that a nuclear plant have two

independent reactivity control systems. One of the systems shall-use control

rods, and shall preferably use a positive means for inserting them.f The other

system shall be capable of controlling planned reactivity-changes to ensure

that fuel limits are not exceeded.

Preanflicant Position

The PIUS design-has no control rods.' However, the preapplicant proposes that

the-deiign complies with the intent of GDC 26 by having two independent liquid

boron reactivity control systems. The normal reactivity control system pumps

boron into the primary coolant loop to control reactor power or effect a

reactor shutdown; this system is only safety grade.within the bounds of the

containment isolation valves. This system recently has been modified by the

inclusion of lines between the reactor pool and the inlet -to the reactor

coolant pump in each loop. These lines contain two "scram" valves, in

parallel, that are normally closed. Upon receipt of a scram signal, the

valves open and the imposed pressure difference induces highly borated water

from the pool to flow to the pump inlet. The pumps continue to operate,

thereby injecting highly borated water into the primary circulation loop. The

fully safety-grade reactivity shutdown control system relies on the ingress of

highly borated water through the density lock from the reactor pressure vessel

to scram the reactor. This ingress occurs when the hydraulic equilibrium

conditions across the density locks are disturbed. Either a trip of as few as

one of the four reactor coolant pumps or a reactor overpower event (with

forced flow) could initiate borated water flow through the lower density lock

and into the core. The scram valve system modification provides a redundant

rapid shutdown mechanism which is not precluded by blockage of the density

lock(s). Other reactivity control features of the design are in-core burnable

poisons for power shaping, and limitations in core size for control of xenon

oscillations for slow, large, and small reactivity changes. For rapid

changes, the design relies on the highly negative moderator temperature

coefficient of reactivity.

The density locks, essentially bundles of open, parallel tubes about

2.25 inches in diameter, have no moving parts. They are of safety-grade

construction and intended to be highly reliable. However, their function must

be demonstrated, and the potential for and the effects of blockage and highcycle thermal fatigue cracking must be evaluated.

- 15 -
-

Staff Considerations

The existing LWR regulations provide prescriptive design guidance for one

reactivity control system to use control rods. Of the three advanced reactor

designs, only PIUS does not have the capability to control reactivity with

control rods. The PIUS design does have, however, three ways to introduce

liquid boron into the core to control and shut down the reactor. Two of the

three rely on a common supply of borated pool water: one through the density

locks and the other through the scram valves. The other system is the normal

reactivity control system which has a separate boron tank and is used for

normal shutdown. The latter system is only safety grade within the bounds of

the containment isolation valves.

Staff Recommendation

The staff concludes that a reactivity control system without control rods

should not necessarily disqualify a reactor design. A design without control

rods may be acceptable, but the preapplicant must provide sufficient information to justify that there is an equivalent level of safety in reactor

control and protection as compared to a traditional system that has rods.

This information must include the areas of

* reliability and efficacy of scram function

* suppression of oscillations

* control of power distribution

* shutdown margin

* operational control

- 16 -
F. OPERATOR STAFFING AND FUNCTION

Issue

Should advanced reactor designs be allowed to operate with a staffing

complement that is less than that'currently required by the LWR regulations'.

Current LWR Regulations

The NRC established the re'quirements'for-control room staffing in

10 CFR 50.54(m)(2)(iii). That'regulation states that a senior operator must

be present in thelcontrol room at all times and a licensed operator or senior

operator must be present at'the' control's of a fueled nuclear power, unit. In

10 CFR 50.34(m)(2)(i) a table lists the minimum staffing requirements for an

operating reactor.

Standard Review Plan Section 13.1.2, Paragraph II.C states that at any time a

licensed nuclear unit is being operated 'in modes other than cold shutdown, the

minimum shift 'crew shall include two licensed senior reactor operators (SROs),

one of whom shall be designated as the shift supervisor, two licensed reactor

operators (ROs), and two unlicensed auxiliary operators (AOs).

Preapplicant Position

The MHTGR plant has four reactor modules, with two modules feeding a single

steam supply system. The design includes a shift staffing level of eight

persons who are dedicated to plant operations: a senior licensed shift

supervisor, two licensed reactor 'operators in'the control room, and five

roving non-licensed operators. This adds'up to three licensed and five nonlicensed operators for four reactor modules.

The PRISM control room would contain the instrumentation and controls for up

to nine reactor modules and their power conversion systems., The minimum

number of operating staff would include one .SRO shift supervisor, one SRO

assistant'supervisor, one RO per power block (three modules) in the control

room, and three plant ROs. This adds up to a minimum of eight licensed

operators for nine reactor modules.

During normal plant operations,'the PIUS main control room would be manned by

two ROs and an SRO shift supervisor.. The shift supervisor would not be

required to be in the control room at all times.

Staff Considerations

Present-day LWRs are required to have a minimum of one shift supervisor, one

SRO, and two operators per reactor. The designers of advanced reactors have

stated that the highly automated operating systems, the passive design of

safety features, and the large heat capacity result in reactor designs that

respond to transients in a manner that demands less of the operator than do

currently operating plants or evolutionary designs. The advanced reactor

preapplicants assert that because of passive safety features and, in some

- 17 -
cases, large coolant inventories, operator actions may not be required for

several days following an accident. These designs also automate systems that

start up, shut down, and control these reactors. The designers of advanced

reactors suggest that they could be operated with fewer licensed operators and

that this would reduce the training and operating costs to licensees significantly. The CANDU 3 preapplicant has not proposed a specific number of

licensed operators, but the staff expects that CANDU 3 will meet the current

LWR staffing requirements.

A similar policy issue, the role of the operator in a passive plant control

room, was discussed in the staff's June 25, 1992, draft policy paper on

passive reactors. In that paper, the staff expressed concern that the manmachine interface for the passive reactors had not been sufficiently addressed

and that actual testing needed to be done on a control room prototype. The

staff believes that position is also applicable to advanced reactors.

Staff Recommendation

The staff believes that operator staffing may be design dependent and intends

to review the justification for a smaller crew size for the advanced reactor

designs by evaluating the function and task analyses for normal operation and

accident management. The function and task analyses must demonstrate and

confirm the following through test and evaluation:

* Smaller operating crews can respond effectively to a worst-case array of

power maneuvers, refueling and maintenance activities, and accident

conditions.

* An accident at a single unit can be mitigated with the proposed number of

licensed operators, less one, while all other units could be taken to a

cold-shutdown condition from a variety of potential operating conditions,

including a fire in one unit.

* The units can be safely shut down with eventual progression to a safe

shutdown condition under each of the following conditions: (1) a complete

loss of computer control capability, (2) a complete station blackout, or

(3) a design-basis seismic event.

* The adequacy of these analyses shall be tested and demonstrated. The

staff is currently recommending that an "actual control room prototype" be

used for test and demonstration purposes.

- 18 -
G. RESIDUAL HEAT REMOVAL

Issue .

Should advanced reactor designs that rely-on a single.completely.passive,

safety-related residual heat removal (RHR) sytstem be-acceptable?

Current LWR ReQulations

General Design Criterion (GDC)-34 requires''the RHR to function using only

safety-grade systems, assuming a loss of either 'onsite or offsite.-power, and,

assuming a single failure within the safety system. Regulatory Guide 1.139

(issued in'.draft forco-mment), augmenting GDC 34, states that the.RHR function

should be capable of bringing the plant-to-a :safe shutdown condition within

36 hours 'of reactor shutdown. Branch Technical Position (BTP) RSB-5-1 states

that the RHRfunction must be performed in a-reasonable period of time .- following'reacto'r shutdown.

Preabolicant Position

The'PRISM design uses'the reactor vessel auxiliary cooling system (RVACS)-as the safety-grade' system rfor removing iresidual heat from the reactor core.

Reactor-generated heat is transferred through the reactor vessel to the outer

surface of the containment vessel. RHR is then accomplished by means of heat

transferring to the atmosphere through natural circulation. Cooler, air flows

downward into the below-grade reactor silo, where it is turned inward a'nd

upward to be heated by'the outer. surface 'of-the' containment.vessel -and a . special collector cylinder. 'This heated 'air -then fl ows out of-the silo and -is

released to the atmosphere. The RVACS-is'completely-passive and always in *

operation. The RVACS is proposed.as'a'backup-to-normal-non-safety-grade Scooling through the intermediate heat,.transport.system,'the steam generator,

and condenser.''' If the condenser-is not available for cooling but the inter-.

mediate sodium loop remains available, then the non-safety-grade auxiliary cooling system-(ACS) supplements the'.RVACS. The ACS oparates through natural

circulation air cooling of: the' steam generator. The RVACS design-basis :'analysis (performed by the designer)- results in high-temperature conditions

(but -within design limits) -for an extended period of time jf, no other system 'is operated.'. However, use of the ACS in conjunction with the RVACS can limit

peak'coolant temperature for decay heat removal to about 15 'C above normal'

operating temperatures..

The MHTGR is-designed with only'one safety-grade system for removing residual

heat from the core, the reactor cavity cooling system (RCCS). The RCCS -

consists of panels within the reactor cavity and ducts connecting the RCCS

panels to four inlet/outlet'-ports. -:Redundancy is provided..by,,these separate

ports and a cross-connected header2that surrounds. the. reactor vessel (i.e.,

any panel can be fed..from any inlet and can discharge.to any. outlet)'. The -

-RCCS operates 'by absorbing.radiant..heat-from the reactor vessel to the panels ''that surround the reactor. vessel and transferring:-the heat by convection to

the air flowing by natural circulation in the panels. As the heated iir -

rises, cooler atmospheric air is drawn to the panels through the inlet ports.

- 19 -
.

-- .

There are no active components in the RCCS. The system is always in operation

and cannot be turned off. Instrumentation can monitor the performance of the

RCCS. The RCCS is relied upon should the non-safety-grade heat transport

system (HTS) and the shutdown cooling subsystem (SCS) be inoperable. The HTS

utilizes the steam generators and non-safety-grade feed system and condensers

and is used during normal ooerations, startup/shutdown, and refueling. The

SCS is a backup to the HTS and uses an alternate helium circulator for core

cooling and an additional heat sink, the shutdown cooling heat exchanger. The

use of the non-safety-grade backup RHR systems reduces the frequency, magnitude, and duration of high-temperature challenges to the reactor vessel, and

the slow time scale (days) of MHTGR core heatup events allows time to bring

the non-safety-grade systems back into service.

The PIUS design uses a safety-grade passive closed cooling system (PCCS) for

removing residual heat from the reactor pool. The system consists of eight

independent parallel loops located in four separate compartments that are

physically separated from each other. Heat is dissipated through four natural

draft cooling towers physically separated from each other and located on the

top of the reactor building. One cooling tower is in each quadrant of the

reactor building. The reactor pool water can be maintained at 95 'C with one

loop out of service. The system is always in operation. Residual heat can be

removed from the reactor by means of the condenser during startup/shutdown and

refueling conditions. If the condenser is not available, a non-safety-grade

diesel-backed pump system can cool the pool water.

Staff Considerations

Similar issues were identified for the RHR system of the passive LWR designs.

In a draft Commission paper issued for comment on February 27, 1992, the staff

discussed issues relating to the (1) ability of passive systems to reach safe

shutdown, (2) definition of a passive failure, and (3) treatment of non-safety

systems that reduce challenges to the passive systems. These issues have not

been resolved and the staff will propose recommendations for resolving them.

In the case of advanced reactors, the safety-grade RHR systems are completely

passive and are in continuous operation. Continuous performance monitoring of

the passive systems is one advantage of the constant operation. The high heat

capacity of the PRISM and MHTGR designs lead to longer time periods before

exceeding temperature limits. PRISM and MHTGR use the natural circulation of

air to remove residual heat. PIUS uses natural circulation of water through

natural draft cooling towers for its RHR system. The lack of check and squib

valves, and the continuous operation and use of a single-phase fluid in the

PIUS system appear to offer increased reliability over the passive LWR

systems.

However, relying solely on passive systems may lead to high-temperature

challenges to the reactor vessel and reactor internal structures, because

higher heat removal rates are needed for passive cooling situations which

require larger temperature differences between the reactor and cooling medium

(air). Elevated temperatures (above normal operating values) may exist in the

- 20 -
vessel and internal structures for long periods of time. In the hightemperature reactors, the PRISM and MHTGR, creep damage may be more likely as

the result of these long-term high-temperature transients.

Staff Recommendation

The unique features of the PRISM, MHTGR, and -PIUS designs, lead the staff to

believe that reliance on a single, completely passive, safety-related RHR

system may be acceptable. In performing its detailed design evaluation,-the

staff will ensure that NRC regulatory treatment of non-safety-related backup

RHR systems is consistent with Commission decisions on passive LWR design

requirements.

- 21 -
H. POSITIVE VOID REACTIVITY COEFFICIENT

Issue

Should a design in which the overall inherent reactivity tends to increase

under specific conditions or accidents be acceptable?

Current LWR Regulations

General Design Criterion (GDC) 11 requires that the reactor core and coolant

system be designed so that in the power operating range the net effect of

prompt inherent nuclear feedback characteristics tend to compensate for rapid

increases in reactivity.

Preapplicant Position

In the PRISM design, the maximum sodium void worth, according to the preapplicant, assuming only driver fuel and internal blanket assemblies void, is

nominally $5.50. If radial blanket assemblies are included, the sodium void

worth is nominally $5.26, which does not include the -70¢ from the gas

expansion modules (GEMs). Should sodium boiling begin on a core-wide basis,

assuming failure to scram conditions with a total loss of flow without

coastdown, the reactor could experience a severe power excursion and core

disruption. The predicted temperature reactivity feedback is approximately

-80¢ preceding the onset of sodium voiding. This mitigates to some extent the

positive reactivity addition. For sodium voiding to occur, redundant and

diverse safety-grade systems would have to experience multiple failures.

Although the preapplicant claims that the overall power coefficient for a

CANDU 3 reactor is slightly negative and very close to zero, the coolant void

reactivity is positive throughout the fuel core lifetime. The total core void

worth is between S1 and $2. The positive void coefficient is not a concern

during normal operation, but, during a large LOCA at specific locations, void

reactivity increases dramatically. If CANDU 3 were to experience a largebreak LOCA (guillotine rupture of an inlet header) with a failure of both

safety-grade shutdown systems, the positive void reactivity insertion could

lead to a power excursion followed by core melting. The CANDU 3 design is

intended to prevent an unscrammed event from occurring through the use of two

separate shutdown systems, each to be independent, redundant, diverse, and

safety grade.

Because of intrinsic design characteristics, both the MHTGR and the PIUS

designs have overall negative void and moderator reactivity coefficients at

operating conditions throughout the burnup cycle. Although the PIUS design

relies on borated water to achieve shutdown, instead of control rods as in

contemporary LWR designs, the displacement of this water during voiding, which

introduces positive reactivity, is offset by negative reactivity, which occurs

because of the attendant decrease in neutron macroscopic scattering cross

section.

- 22 -
Staff Considerations

*The existence of positive coolant void coefficients, or any reactivity effect

that tends to make'a postulated accident more severe, is a significant

concern. As a result of a positive void reactivity coefficient, events.

involving even a relatively short scram delay could lead to a core disruption

accident. The staff intends to require the preapplicant to analyze the

consequences of events (such as ATWS, unscrammed LOCAs, delayed scram events,

and transients that affect reactivity control) that could lead-to core-damage

as a result of the positive void coefficient, taking into account the overall

risk perspective-of the designs. A core disruption accident in either the

PRISM or-CANDU 3 designs may not-necessarily lead to a large-scale release of

the' radionuclide inventory to the atmosphere due to their respective

mitigative designs. In the CANDU 3 reactor, multiple, redundant, diverse,

fast-acting scram systems'address the positive coefficients.

Attempts to modify the designs in order to reduce the effects of these

positive coefficients may result in other-consequences potentially as serious.

For example, in the PRISM-design, the positive void coefficient seems to

result from the design-objectives of maintaining a passive shutdown capability

and of minimizing the reactivity swing over core life. Attempts to reduce the

PRISM void worth might have the effect of increasing the severity of rod

withdrawal accidents or-reducing-the ability to withstand an unscrammed loss

of'heat sink-event without-core damage. -

Staff Recommendation -

The staff concludes that a positive void coefficient should not necessarily

disqualify a reactor design. The staff is proposing to require that the PRISM

and CANDU 3 preapplicants analyze the consequences of events (such as ATWS,

unscrammed LOCAs, delayed scrams, and transients affecting reactivity control)

that could lead to core damage as a result of the positive void 'coefficients.

When 'it'reviews these analyses, the staff will'take into account the overall

risk'perspective of the designs.-'.Whether'the preapplicants will be required

to consider changes in the designs to mitigate the consequences of these

accidents will depend'on the estimated probability of the accidents-as well as

the severity of the consequences.

- 23 -
- - -

I. CONTROL ROOM AND REMOTE SHUTDOWN AREA DESIGN

Issue

Can current requirements for a seismic Category I/Class 1E control room and

alternate shutdown panel be fulfilled by a remote shutdown area, and a nonseismic Category I, non-Class IE control room?

Current LWR Regulations

The current LWR requirements for control room and remote shutdown area design

are given in 10 CFR Part 50, Appendix A, and 10 CFR Part 100. General Design

Criterion (GDC) 19 requires that a control room with adequate radiation

protection be provided to operate the plant safely under normal and accident

conditions and that there be an ability to shut down the plant from outside

the control room. GDC 17 requires that the electrical system for the control

room and remote shutdown equipment meet the requirements for quality and

independence. These requirements are defined as Class 1E in the supporting

IEEE standards. GDC 2 and 10 CFR Part 100 require that structures and systems

important to safety be designed to seismic Category I standards to withstand

the effects of natural phenomena without loss of capability to perform their

safety functions.

The current LWR acceptance criteria and guidelines for the remote shutdown

area(s) are given in Standard Review Plan (SRP) Section 7.4. The SRP states

that the area(s) should be separate from the control room as, for example,

local control panels. These area(s) should be in communication with the

control room, and should have Class 1E monitoring instrumentation and controls

capable of bringing the reactor down to cold shutdown, as well as, be designed

to meet single-failure criteria and seismic Category I.

Preannlicant Position

The control room for the PRISM reactor contains the instrumentation and

controls for all nine reactor modules and their power conversion systems. The

control room structure is not considered safety related and, therefore, the

room is not designed to seismic Category I design requirements. Additionally,

no equipment in the control room is safety grade. A separate alternate

shutdown console is located in the protected area of the reactor service

building. The alternate shutdown console is within a seismic Category I

structure and is equipped with the necessary Class 1E controls and instrumentation to protect the core and has the required habitability system.

The MHTGR design for the four reactor modules has a non-safety-related central

control room to operate the plant and a seismic Category I remote shutdown

area from which to respond to accidents if necessary. Neither the equipment

in the control room nor the remote shutdown area are Class IE. The remote

shutdown area does not contain safety-related equipment, nor does it include a

ventilation system for operator habitability, or a safety-related manual

scram. This is based on the preapplicant's position that accidents do not

require operator response. The only manual scrams are non-safety-related and

- 24 -
are located in the remote shutdown area and the main control room. The plant

also has a separate reactor protection system vault in each reactor module

which has Class 1E instrumentation and controls for the reactor, and is - seismic Category I. The preapplicant has not stated that the vault has a

manual scram.

The CANDU 3'design utilizes a main control room.to perform all monitoring' and

control functions for normal operation and most accident conditions.. The"

preapplicant states that the main -control -room. is not designed to provide

safety-grade functions following a design-basis earthquake, tornado, fire, 'or

loss of.non-essential (i.e., Class IV) Group I electrical power, but the

operator is able to'proceed'to-the-secondary control-area. The secondary

control area duplicates the.:control consoles in the main control room-for.the

control and monitoring of Group 2'systems only. -Safety-related systems-for

the CANDU 3 design are found in both Group 1 and Group:2 designated systems,

which implies that some Group 1 safety-related functions might.not be accomplished from the secondary control area. The secondary control area is ; v

seismically qualified and is electrically isolated :from the main control.room

so that failures occurring in the Group l area will not-interfere with control

and monitoring of safety systems from.-the secondary control area. All

equipment and structures making up the route from the main control room to the

secondary control area are to be qualified to the extent necessary to prevent

route blockage, fire, or flood. CANDU 3 has specified requirements to ensure

habitability during accident conditions.

The central control room for'the PIUS design is a seismic Category I structure'. However, the safety-related systems within this structure are for

monitoring 'only to assure that:the core is protected. Although the operator

could take actions, these actions would be taken-withthe use of non-safety-,

grade controls. The two remote shutdown areas are housed in separate compartments at the bottom of the reactor building in protected seismic Category I

areas. Each remote area contains one-half of the safety-grade control

equipment (the reactor trip and interlock system, control of certain isolation

valves, and safety-grade monitoring systems). The manual reactor trip system

is a push-button control of the scram valves. Both the main control room and

the emergency shutdown areas are serviced by a safety-grade ventilation system

to ensure habitability during accidents.

Staff Considerations

The staff believes that the operators remain a critical element in ensuring

reactor plant safety and that no increased burden should be placed on operators managing off-normal operations. The control room is the space in the

plant where operators are most familiar with the surroundings and normally

manage plant activities. The staff is reluctant to approve any design that

would increase the frequency of evacuation of the control room during designbasis accident conditions or hamper the control or monitoring of upset

conditions as an event sequence progresses. The staff believes human

- 25 -
performance will still play a large role in the safety of the advanced plants

and the CANDU 3 plant and that the quality of support provided by a safetyrelated, seismic Category I and electrical Class lE control room is

appropriate.

The staff also believes that any remote shutdown area should be designed to

complement the main control room. Sufficient Class lE instrumentation and

controls should be available to effectively manage anticipated accidents that

would cause a loss of the control room functions. The location and qualification of the remote shutdown areas should also ensure protection of the

remote shutdown operations to the greatest extent possible.

A related policy issue was identified in the staff's February 27, 1992, draft

paper on policy issues for the passive LWRs. EPRI proposed less-conservative

control room habitability requirements and proposed that analyses of control

room habitability be limited to 72 hours instead of to the accident duration.

The staff disagreed with the proposed EPRI guidance and offered different

criteria. Similarly, the staff, in its June 25, 1992, draft policy paper,

defined positions on common-mode failures in digital systems and on

annunciator reliability. Staff requirements for advanced reactor designs will

be consistent with passive LWR policy guidance for these issues, once the

guidance is finalized.

Staff Recommendation

Until passive LWR policy for design requirements of control rooms and remote

shutdown facilities is determined, the staff will apply current LWR regulations and guidance to the review of advanced reactor designs. This will

ensure that plant controls and the operators will be adequately protected so

that safe shutdown can be assured in accident situations.

- 26 -
J. SAFETY CLASSIFICATION OF STRUCTURES, SYSTEMS, AND COMPONENTS

Issue

What criteria should the NRC apply to the advanced reactor 'designs to identify

the safety-related structlures, systems,, and components?

Current LWR Reculations

Title 10 of the Code of'Federal Regulations Section 50.49(b)(1)' and the

current Appendix A.VI(a)(1) of 10 CFR Part 100 list the following criteria to

identify the safety-related structures, systems, and components (SSCs').

(a) those needed to maintain the integrity of the reactor coolant pressure

boundary,(RCPB)

(b) those needed to shut'down the reactor and maintain it in a safe

condition

(c) those needed to prevent or mitigate the consequences of accidents that

could result in doses comparable to Part'100 guidelines

These criteria require'that a reactor'design protect the public from the'

potential: release of fission'product radioactivity by means of three barriers:

the reactor coolant pressure 'boundary'(item a above), the fuel (item b above),

and the containment (item c above).

Amendments to Parts 50 and 100 have been-proposed'(57 FR 47862) to update'

criteria used in decisions' regarding reactorsiting and-design for future

nuclear power plants, including 'the advanced'LWR designs. These proposed:,

revisions include the temporary relocation`_'of'the dose'considerations -for

reactor siting (i.e., the current'Part 100 guidelines) from Part 100 to'

Part 50 until such time as more specific requirements are developed regarding

accident source terms based on insights into severe accidents.

PreapDlicant Position

The advanced reactor designs rely on a limited number of safety-related

systems :to protect the' core and the public. Some'of'these systems'are

entirely passive,'- have no moving components and do not require operator ;

action. The designers believe that'this reduction in s'afety-related equipment

results in simpler plant 'designs with lower costs. This also'results in many

structures, systems, and 'components, which are considered 'as 'safety related in

LWR designs, 'being classified as non-'sifety-related 'in the advanced reactor

designs.

Of the advanced reactor designs, only the MHTGR design is not using the

current LWR criteria for safety classification. For the MHTGR design, the

only 'criterion for safety-grade classification is those structures, systems,

and components needed to mitigate the dose consequences at the site boundary

- 27
.

from accidents or events to a dose consequence which is below the guidelines

in the current 10 CFR Part 100. The staff described several major issues

concerning safety classification in the draft PSER (NUREG-1338): (1) the RCPB

is not entirely safety-related, (2) no safety-related equipment is used to

pressurize and depressurize the RCPB, (3) the coolant moisture monitor is not

safety related, (4) neither the control room nor remote shutdown area are

safety related, and (5) no safety-related instrumentation providing reactor

protection or monitoring functions are available in the control room or remote

shutdown area. The safety classification criteria proposed by the MHTGR

preapplicant requires, in effect, the protection of only one barrier to the

potential release of fission product radioactivity to the public: the fuel.

Staff Considerations

The NRC LWR safety classification criteria are based on the fundamental

regulatory standard to require defense in depth for a reactor design and to

require safety-related SSCs to separately protect the three barriers to

potential releases of fission product radioactivity to the public: the fuel,

the reactor coolant pressure boundary, and the containment. This approach by

definition requires that safety-related SSCs be identified to protect more

than just one of the traditional barriers, e.g., more than just the fuel

barrier to radionuclide transport.

The advanced reactor designs include high-quality, non-safety-related active

systems to provide defense-in-depth capabilities for reactor coolant makeup

and decay heat removal. These would be the first line of defense should

transients or other plant upsets occur. The non-safety-related systems are,

according to the designers, not required for mitigation of design-basis

events, but do provide alternate mitigation capability. In a recent draft

SECY paper covering the passive ALWRs, the NRC staff stated that it was still

evaluating the issue of treatment of non-safety-related systems for the

passive ALWRs and that the proposed resolution to this issue would be provided

later. The staff plans to treat non-safety-related systems consistent with

the eventual position for passive LWRs.

Staff Recommendations

The staff intends to apply current LWR criteria for the identification of

safety-related SSCs to the MHTGR design. The staff will consider arguments

from the MHTGR preapplicant for reducing the design, installation, and

maintenance requirements of the identified safety-related SSCs for the MHTGR

design. Requirements for non-safety-related systems will be consistent with

the NRC position for passive LWRs. The staff has noted that LWR criteria may

be restructured within Parts 50 and 100, and our expectation is that the

criteria in Part 50 will apply to the standard design certification.

- 28 -
ATTACHMENT 1

AECLT SPECIFIC COMMENTS ON CANDU 3 DESIGN ISSUES

*- - . - ~ANDY- ;

THEIR RELATIONSHIP TO CURRENT REGULATORY REQUIREMENTS

In this attachment, AECLT addresses the six issues which the *draIt Policy Issues Paper

identified as pertaining to the CANDU 3 design; specifically, Accident Evaluation, Source

Term. Containment Performance, Operator Staffing, Positive Void Reactivity and Control

Room Design. Additionally, AECLT comments on the effects-of the proposed Category 2

classification issues.

For each of the six issues. the draft Policy Issues Paper characterizes and discusses AECLTs

approach to the CANDU 3 design. Based on the characterization and discussion. the paper

proposes a recommended resolution of the issue. -AECLT believes that the Staffs current

evaluation does not give credit to the CANDU design approach.

1. The basis for ATWS in the first place was the single line of defense in LWVRs against

some accidents. CANDU chose to address the ATWS question by having redundant

shutdown. The accidents listed by the Staff are not excluded from consideration in

CANDU, but have little consequence because of the redundant shutdown systems.

The whole point of redundant shutdown is to provide real safety, as opposed to

providing analysis of events without shutdown. This recognition is lacking.

2. Events which would lead to core melt in conventional LWRs, namely LOCA/LOECC,

do not do so in CANDU because of the presence of the moderator. To use the

consequences of a severe accident to challenge the design, without examining the

defenses that have to fail before those consequences occur, removes the incentive from

the designer to reduce the frequency of those consequences.

AECLT corrects the characterization and the evaluation in the discussion section, as

necessary. In addition, AECLT comments on the recommended resolution of the issue and,

where AECLT differs with the recommendation, offers an altemative approach for

consideration.

A. -ACCIDENT EVALUATION

ISSUE: Identify appropriate event categories, associated frequency ranges, and evaluation

criteria for events that will be used to assess the safety of the proposed designs.

-I-
AECLT COMNEMEENT: AECLT does not believe that the draft Policy Issues Paper accurately

characterizes AECLTs approach to accident evaluation. The drft paper states:

"The CANDU 3 preapplicant, in their current safety analyses, has excluded analyses of

the consequences of events with frequencies of less than 10'/year from the safety

evaluation. Events which would be excluded from consideration, based on the

CANDU 3 design characteristics and system reliabilities, would include anticipated

transient without scram (ATWS), unscrammed loss-of-coolant-accidents (LOCAs),

delayed scram events, and other events which could affect reactivity insertion (for

example, from control system failures). As a result of the positive void reactivity

coefficient associated with the CANDU design, events involving even a relatively

short scram delav could result in a core disruption accident."

AECLTs approach, which is based on design review guides accepted by the Atomic Energy

Control Board (AECB), is summaized in the points which follow. We request that the draft

paper be revised in accordance with these points.

I1. For the CANDU 3 design evaluation, event sequences and their End States are

determined by systematic review without regard to End State frequencies. The

Conceptual Probabilistic Safety Assessment (CPSA) considers End State frequencies as

lowv as 1(1'/year.

2. Reactivity insertion events are not excluded from consideration. Three systems are

provided for such events:

1) The Group I Regulatory System with Mechanical Control Absorber Rods for

Anticipated Transients.

2) The Group 2 Shutdown System I with rapid shutdown rods for Accidents.

3) The Group 2 Shutdown System 2 with rapid liquid poison injection for

Accidents.

The CPSA gives the end state fiequency for the large LOCA with a failure to

shutdown at 1W0/year.

3. The CANDU 3 Safety Analysis has no absolute frequency cutoff. As stated in the

Conceptual Safety Report, Appendix C, Section 5.2 Category B Events:

"The events in Category B are those for which the frequency of the event can

be calculated using probabilistic tools to obtain a realistic assessment of the

risk involved (public and economic risk)...

- 2 -
"The stepped curves in Fig e 2 will be used as the acceptance criteria for

Category B analyses. These are intended'to be used as event-based criteria. to

provide a measure of tie'ac'c"pt'fi~ilit~y of the consequences of a given event,

which is a funition of its likelihood of occurrence. 'As in the previous

probabilistic assessments, events with frequencies less than 1 events per year

are not considered to be of high -enouh frequency that they generally need to

be considered. In those cases were th are. Figure 2 will be lated as

.necesisar.' . ' . ' ''':''-'-

4. The current CANDU 3 Safety Analysis focuses primarily on identifyiing design

requirements and recommendations for design improvement and assessing the

adequacy of the safety systems. The Safety Analysis establishes categories of events.

along xith evaluation methods and acceptance criteria for each event.

5. The events analyzed are selected because of their impact on the conceptual design,

regardless of their frequency. For example, for the containment design the event

analyzed is a large loss-of-coolant accident with emergency core cooling unavailable

(LOECC).

With respect to the treatment of ATWS, unscrammed LOCAs and delayed scram

events. see the discussion below in the section concerning Positive Void Reactivity.

6. The draft Policy Issues Paper also states:

"The CANDU 3 approach which limits the scope of severe accidents examined

appears to be inconsistent with the provisions of 10 CFR 52.47."

This statement is not accurate.. As discussed above in Point No. 3, limits are not,..

placed on the scope of severe accidents that may be considered in designing the

CANDU 3.

7. In the draft Policy. Issues Paper, the Staff proposes to develop "a single approach to all

advanced reactor designs during the preapplication review." Although omitting

mention of its applicability to the CANDU 3 design, it'appears that the'approach is to

apply to the, CANDU 3 design as well. Assurnig that to be the case, the paper

should be corrected.

8. The first bullet in the Recommendations section states:

"Events will be selected dteirministically and supplemiented with insights from

probabilistic risk; assessments of the specific designs."

AECLT believes that the criteria which will be used inr deterministically selecting the

events should be identified. Also,'we would like to know whether the Staff will'

- 3 -
-

continue the historical requirement for conservative analysis for Design Basis

Accidents (DBAs) and best estimate analyses for beyond DBAs. The NRC Staff

recommendations for "deterministically" selecting events for analysis appears to be

arbitrar and contrary to the spirit of NRCs existing safety goals.

As we discussed in our recent comments on the Advance Notice of Proposed

Rulemaking concerning severe accident requirements, we think that assumptions and

acceptance criteria should be established for severe accidents, including event cutoff

frequencies and consequence acceptance limits. Attachment 2 provides a copy of the

relevant AECLT comments on the ANPR. Comment #4 and Comment #8.

B. SOURCE TERM

ISSUE: Should mechanistic source terms be developed in order to evaluate the advanced

reactor and CANDU 3 designs?

AECLT CO1MMENT: The NRC Staff position, as stated on page 7, is that:

"The CANDU 3 will also be different from LWR designs in certain respects. The

coolant contains significant amounts of tritium. Following failure of a pressure tube,

there is no heavy-walled reactor vessel to contain releases (there are large volumes of

water in two concentric low-pressure tanks; moderator and shield water).

Consequently the timing of releases is expected to be different from LWR's.

Therefore, CANDU 3 also warrants a separate evaluation of source terms."

NRC Staff then recommends that the CANDU 3 source terms used for preapplication review

be based upon mechanistic analyses and recommends specific guidelines for performing these

analyses.

AECLT does not object to the NRC approach to evaluate our proposed source term during the

preapplication review. We have a specific comment on the guidelines which is noted below.

However, we do not agree that a pressurized heavy water reactor such as CANDU 3 is so

fiindamentally different from LWR's that it should require a different methodology for

establishing source terms than that which NRC is now in the process of establishing for

evolutionary LWRs. Specifically, the NRC Staff notes on page 7 of its draft letter that NRC

Staff is now in the process of "...developing for LWR's a revision to the TlD-14844 source

term (NUREG-1465, "Accident Source Terms for Light Water Nuclear Power Plants," draft

report for conmment, June 1992)." AECLT requests that NRC give consideration to applying

the same methodology which is developed for Advanced LWRs to Heavy Water Reactors

during design certification reviews. In this way, the CANDU 3 will be judged on the same

basis as the other water reactor designs currently under licensing reiewv by the NRC.

- 4 -
In support of its position, AECLT notes .thai'differernces in design between PWRs and BWRs

(for example the absence of a steam generator in BWRs) must be accounted for in source

term calculations and the methodology being devcioped by NRC must allow for 'these

differences in design. We believe that the differences in design between CANDUs and

PWRs, insofar as they affect fission product transport affer an accident, are of a similar'

nature. We note that CANDUs use the same type of ircaloy clad uranium oxide fuel as..

LWRs; hence the fuel behavior aspects of source term calculations should be the same. Also.

the fact that tritium levels are higher in CANDU reactors because of the use of heavy water

can be easily accounted for in the source term methodology.

We recognize that NRC has not completed its development and implementation of new source

term standards for LWRs and therefore we agree with the approach recommended by the

Staff for the preapplication review. However, we request that NRC approach the design

certification review using the wne standards now being developed by NRC for application to

evolutionary LWRs.

With respect to the specific guidelines for development of mechanistic CANDU 3 source

terms for the preapplication review,- we believe the meaning of the term "credible severe

accident" is unknown; we request that NRC clarify this tem.

C CONTANMEENT

ISSUE: Should advanced reactor designs be allowed to employ alternative approaches to

traditional "essentially leak-tight" containment strctures to provide for the control of fission

product release to the environment?

AECLT -.COMMENT: The CANDU 3 design utilizes a traditional diy containment very

similar to those in use on licensed LWRs and pTo ed for advanced LWRs.- Therefore,

AECLT does not believe the issue, as stated by NRC, is relevant to CANDU 3.

However, in the discussion section NRC states that "...for evolutionary LWRs, the Staff, in

SECY-90-016, proposed to use a conditional containriient failure probability (CCFP) or

deterministic containment performance goal to ensure a balance between accident prevention

and consequence mitigation. During the evolutionary LWR reviews, a great deal of careful

review was necessary to assure that a probabilistic CCFP would not be used in a way that

could detract from a balanced approach of severe accident prevention and consequence

mitigation. For advanced designs and the CANDU 3, limited experience exists in the analysis

and evaluation of severe accidents Which could lead to'significant difficulty and uncertainty in

assessing a CCFP. For this reason, the Staff recommends that a detministic containment

performance goal be adopted for the CANDU 3."

- 5 -
We are concerned that NRC will evaluate CANDU 3 using different criteria than the criteria

being used to evaluate containment of evolutionary LWR reactor designs. We do not see a

good reason for this, and request that NRC consider instead evaluating the CANDU 3

containment using the same approach and criteria used in evaluating the containment designs

for evolutionary LWRs.

With regard to the specific accidents to be used by NRC to evaluate containment

performance, we have the following comment:

"The Staff proposes to postulate a core damage accident as a containment challenge

event and require that containment integrity is maintained for a period of

approximately 24 hours after the onset of core damage."

We believe that a more specific definition of a "core damage accident" is needed. In this

regarcd we note that three types of events can lead to "core damage accidents": (1) reactivity

events; (2) loss of heat sink events at high pressure; and (3) loss of heat sink events at low

pressure. For the CANDU 3 design, the event frequencies of types (1) and (2) events will be

less than 1(1' - low enough to be able to be considered "incredible." Thus, for the CANDU

3 design events of these types should not have to be considered when evaluating challenges to

containment. Type 3 events comprise the "core damage accident" used as the "containment

challenge" for the CANDU 3 design.

F. OPERATOR STAFFING AND FUNCTION

ISSUE: Should advanced reactor designs be allowed to operate with a staffing complement

that is less than that currently required by LWR regulations?

AECLT COMMEN TS: The draft Policy Issues paper states:

"The CANDU 3 preapplicant has not proposed a specific number of licensed operators.

but the Staffs expectation is that CANDU 3 will meet the current LWR staffing

requirements."

AECLT does not understand why this issue was addressed to the CANDU 3 in the issues

matrix but not in the text.

IL POSITIVE VOI) REACTIVITY COEFFICIENT

ISSUE: Should a design in which the overall inherent reactivity tends to increase under

specific conditions or accidents be acceptable?

- 6 -
AECLT COMMENT: AECLT agrees with the Stafs conclusion that "a positive void

coefficient should not necessarily disqualify a reactor design." All reactors are subject to the

insertion of positive'reactivity under certain transient or accident conditions. The specific

transient or accident varies with the reactor type. For the CANDU 3 the total void worth is

between $2 and $3. While all such insertions raise significant concerns, the kcv question is.

whether the reactivity shutdown systems are reliable enough to reduce the fequency of

reactivity insertions with a failure of all reactivity shutdown systems to an extrely low

value (I, 10' to 10' per year).

In order to evaluate positive reactivity insertion in the CANDU 3 design, the Staff proposes

to:

"[require the analysis of] the consequences of events (such as ATWS, unscrammed

LOCAs, delayed scrams, and transients affecting reactivity control) that could lead to

core damage as a result of the positive void coefficients."

AECLT has several observations regarding this recommendation; including, concerning the

meaning of the terms "AIWS" and "uniscranmed LOCAs" as the terms might be applied to

the CANDU 3. The terms were develoied in the early days of LWR reviews and have

specific meaning and special significance for those rviews.

1. ATWS: If the ATWS definition is retained with respect to the CANDU 3, its

significance is diminished because of CANDU 3's multiple shutdown systems; namely,

the Group 1 Regulating System and the two independent diverse and redundant Group

2 Shutdown Systems.

For a-PWR, Anticipated Transient Without Scram (ATWS) is a faulted response to an

anticipated initiating event requiring control element assemblies (CEA's) insertion for

reactivity control. The initiating event is defined to be the occurrence of a transient

requiring reactor trip for reactivity control coupled with failure of a trip.to occur due

to either mechanical failure of the CEAs to insert or the failure of both the Reactor

Protection System (RPS) and the Alternate Protection System (APS) to generate a trip

signal.

Although 10 CFR 50.62 defined a prescriptive solution for the ATWS scenario in

terms of prevention and mitigation, the success criteria for the event is given in

NUREG-0460, Volume 3.,

For the limiting ATWS scenario, the criteria relating to the pressure boundary integrity

and functionality of the valves required for long term cooling are of primary interest.

The concern is that if the peak pressure in the RCS exceeds Level C stres limits,

(approximately 3200 psia), a breach of the primary coolant pressure boundary will

occur and the Safety Injection System check valves will be jammed closed. This

would result in a LOCA with no RCS makeup available.

- 7-
-

Using the same definition for CANDU 3, an ATWS would be a faulted response to an

anticipated initiating event requiring the Group 1 Mechanical Control Absorber rods

(MCA) to be inserted for reactivity control. If the MCAs fail to insert, either of the

two Group 2 shutdown systems remain poised to shutdown the reactor without a

severe pressure transient.

2. Unscrammed LOCA:

For an "unscrammed LOCA", defined as a large LOCA requiring the insertion of the

shutdown rods of the Group 2 Shutdown System (SDS1) for reactivity control, the

Group 2 Shutdown System (SDS2) will insert poison into the moderator and will

shutdown the reactor without resulting in a severe pressure transient.

3. Severe Accident End State Producing Positive Reactivity Insertion: For the CANDU 3

design. the severe accident End State producing positive reactivity insertion is shown

by the CANDU 3 Accident Analysis to be a Failure to Shutdown when reactor

shutdown by the Group 1 Regulating System and the two Group 2 Shutdown Systems

has failed to occur. Consequences could include a mismatch between power

production and the heat sink, resulting in severe fuel overheating and core damage.

As discussed above in our accident evaluation comments, the CPSA gives an End

State Frequency of a large LOCA with failure to shutdown of 10'° per year.

Acceptance criteria for severe core damage End States have not yet been established. The

Staff proposes to take the frequency of positive reactivity insertion events into account in

analyzing the phenomenon in the CANDU 3. Specifically,

"The Staffs review of these analyses will take into account the overall risk perspective

of the designs. [A requirement to change designs] will depend on the estimated

probability of the accidents as well as the severity of the consequences."

AECLT agrees that consideration of the significance of positive reactivity insertion events

should take into account the overall risk perspective of the designs. AECLT notes that

acceptance criteria for such events have not yet been established. AECLT recommends that

they be established during the preapplication review of the CANDU 3 design. In this regard.

in its recent comments on the Severe Accident ANPR, AECLT provided its vie s on a

selection process for severe accident events. See Attachment 2.

CATEGORY 2 CLASSIFICATION

The draft Policy Issues Paper identifies two issues for which the Staff recommends no

departure from current regulations; namely, the Control Room Design and SSC Safety

Classification issues. AECLT notes with concern that implementation of this recommendation

- 8-
will arbitrarily cut off review of new and innovative design approaches in these areas.

AECLT asks that this recommendation be reconsidered. We believe that safety principles

should govern and that nev designs should be allowed to demonstrate how they meet such

safety principles., Following such examination, the adequacy basis can be developed.

CONTROL ROOM 'AND REMOTE SHUtTDOXN AREA DESIGN:

ISSUE: Can current requirements for a seismic Category 1/Class IE control room and

alternate shutdown panel be fulfilled by a Remote Shutdown Area, and a non-seismic

Category I, non-Class IE control room?

AECLT COMMENT: AECLT does not believe that the draft Policy Issues Paper accurately

characterizes AECLTs approach to control room and Secondary Control Area (SCA) design.

The draft paper states:

"The main control room is not designed to be operable following an earthquake,

tornado, fire, or loss of Group 1 (non-essential) electric power, but the operator must

remain available to proceed to the secondary control area"

This statement is inaccurate. AECLTs approach to control room and SCA design is

summarized in the points xwlich follow. We request that the draft paer be revised in

accordance with these points.

1. A CANDU 3 plant does not employ a "remote shutdown area" of the type connoted in

the present NRC regulations and incorporated in current U.S. reactors.. The CANDU 3

has a secondary control area (SCA) that is, in fact, a second control room. The SCA

duplicates the control consoles available in the MCR for the control and monitoring of

the Group 2 systems. The design basis for the man-machine interface in the SCA is a

duplication to the fullest extent practical of control locations, layouts, and capabilities

present in the MCR The plant design basis requires that plant operators remain in the

MCR if it is -available and functional. The MCR is used to operate the plant safely

under normal conditions and mo accident conditions. Sufficient control and'

instrumentation are provided in both areas to shutdown the plant, achieve cold

shutdown conditions, and maintain it in a safe condition under accident conditions

including Loss-of-Coolant-Accidents. However, the MCR is designed for the effects

of earthquakes and tornadoes to the extent of providing the operating Staff with

protection from physical harm. Should the MCR become uninhabitable, control of the

plant would be shifted to the SCA- The plant is designed such that all actions

-required to be accomplished Whiile the plant operators shift control to the SCA are

accomplished automatically. The route from the MCR to the SCA is qualified to

i allow its use in the event of -earthquakes or tomadoes.

-9-
- - -

2. Regarding operability following a fire, AECLT wants to emphasize that no control

room will remain operable following the control room fire required to be postulated by

NRC fire protection requirements. However, the CANDU 3 design, which separates

the plant into Group I and Group 2 areas, provides a significantly improved capacity

to respond to fires; in that, a fire in any Group 1 area (including the MCR) will not

prevent safe shutdown using Group 2 systems from the SCA and, likewise, a fire in

any Group 2 area will not prevent shutdown from the MCR- using Group 1 systems.

3. It is incorrect to characterize Group 1 systems as "non-essential" because it implies

that Group 1 systems are "non-safety-related". The CANDU 3 design applies a graded

level of design standards commensurate with the safety function to be performed in

contrast to U.S. practice which applies extensive, safety-grade requirements to

structures and systems that are safety-related and few, if any, requirements to those

that are non-safety-related. The NRC Staffs statement in the draft SECY papers

further implies that Group I power would be lost given a loss of offsite power. This

is not correct. There are two redundant Group I diesel generator sets (as well as two

redundant Group 2 diesel generator sets).

4. The separation of the CANDU 3 plant into Group 1 and Group 2 areas provides an

enhanced capability to respond to other hazards that could render any control room

inoperable. These hazards include sabotage, aircraft crashes, externally-generated

missiles, smoke, and toxic gas. The CANDU 3 design also provides enhanced

emergency planning capability by providing a redundant area for monitoring and

control of essential plant parameters throughout all plant conditions from normal

operation to cold shutdown

In the draft Policy Issues Paper, the Staff discusses its reasons for recommending no

departure from current regulations regarding control room design.

AECLT believes that the NRC Staffs evaluation approach to this issue appears to be more

prescriptive regarding control room design than we believe is required by GDC-2 and GDC17. The GDC permit a graded application of standards to stnuctures, systems, and

components commensurate with, as GDC-1 states, the importance of the safety functions to be

performed. The importance of a control room in a plant that has essentially two control

rooms is diminished from that in a plant with only one control room and a remote shutdown

panel. Nevertheless, in either plant, the necessary functions need to be identified and the

appropniate standards applied. The crux of this issue is the control room design envisioned in

GDC-19. The CANDU 3 design vis-a-vis GDC-19 is discussed as follows.

The NRC Staff states that it is reluctant to approve any design that would increase the

frequency of evacuation of the control room during design basis accident conditions or

hamper the control or monitoring of upset conditions as the event progresses. AECLT is in

general agreement with the NRC Staff position and believes that the CANDU 3 design

satisfies the objective except for the low probability seismic and tornado events. As

- 10-
discussed above, AECLT feels the CANDU 3 design adequately addresses the concerns

identified by the Staff regarding this issue and provides benefit to public health and safety.

AECLT requests that the Staff reconsider its no departure recommendation.

- 11 -
A7TACHMIVENT 2

Excerpts from AECLT Comments on

NRC Advance Notice of Proposed Rulemaking

Concerning Acceptability of Plant Performance for Severe Accidents

[ref AECLT letter to NRC dated December 21, 1992]

General Comment No. 4 -

4. Specifically, in the rule and implementing guidance the following matters should be

addressed:

A. Selection Process for Severe Event Sequences Considered in the D esign. The

selection process should be based on event frequency. The process would

establish the frequenccy limits to: (I)define the events requiring design changes

to reduce their frequency, (2) define the events that require features to mitigate

the event's consequences and (3) define events that need not be considered in

the design.

B. Consequence Limits: For each event sequence defined by A(1) and A(2) above

(e.g. reactivity events, loss of heat sink at HighLow Pressure), acceptable

consequences for the event fiequency should be defined on an overall basis

(e.g. containment stress and leakage, radiological consequence limits). In

addition, a phenomenon acceptance criterion should define the acceptable

consequences for each individual phenomenon (e.g. hydrogen, molten fuel, noncondensable gas) associated with the event consistent with the overall

acceptance criteria and the design features that produce the phenomenon.

C. Phenomenon Acceptance Criteria: For each phenomenon acceptance criterion,

systems/features should be identified which provide the means to mitigate the

consequences of the phenomenon.

D. System/F= Design Criteria: For each system/feature, design criteria should

be established for capacity, load combinations, environmental conditions vs

time, and reliability. The reliability criteria should include: redundancy,

diversity, power supply, separation (from each other and from systems/features

whose failures are involved in the severe accident event sequences), and

environmental qualifications.

E. Sy.I /Fl notation &quirements: For each system/feature, the

demonstration analysis/test requirements should be defined. These should

- I -
include assumptions, acceptance criteria, analytical methods, and test

requirements.

General Comment No. 8

8. As discussed in 3 and 4 above, a severe accident rule should specify a cut-off event

frequency such that events below this frequency need not be considered in the design

and for w~hich further analysis is not required.

NUREG/CR-5368, "Reactivity Accidents" reported the'results of analyses of light

water reactor reactivity events performed by Brookhaven National Laboratory. For

that effort, Brookhaven categorized potential event sequences as being worthy of

further analysis, or not. One of the screening criteria used to determine the

importance of a sequence for fuwther analysis was whether the sequence required too

many low probability events to occur in combination. Brookhaven established a

screening methodology with Wvhich low probability events could be eliminated from

further consideration.

Event sequences writh a frequency of less than IE-7 per reactor year were considered

"incredible" and not recommended for further study.

AECLT believes that the generic severe accident rule should codify similar screening

criteria.

- 2 -
A R! 1-

ASEA BROWN BOVERI

January 25, 1993

LD-93-007

Project No. 680 .

Mr. Dennis M. Crutchfield, Associate Director

Advanced Reactors and License Renewal

Office of Nuclear Reactor Regulation

U.S. Nuclear Regulatory Commission

Attn.: Document Control Desk

Washington, D.C. 20555

Subject: Comments on Advanced Reactor Policy Issue

Recommendations

Dear Mr. Crutchfield:

As requested, enclosed are the combined comments of ABB

Combustion Engineering Nuclear Power and ABB Atom (collectively

ABB) on the Nuclear Regulatory Commission's (NRC) draft report

"Issues Pertaining to the Advanced Reactor (PRISM, MHTGR, and

PIUS) and CANDU 3 Designs and Their Relationship to Current

Regulatory Requirements". We are providing comments which we

believe will further clarify the recommendations, more firmly

establish their basis and update quoted PIUS design information.

ABB would also like to take this opportunity to set forth its

position with respect to ultimate pursuit of Design Certification

for advanced reactor designs, in this case PIUS. We undertake

such a program because we believe there is a market for the

advantages which could be derived from an advanced product that

takes a fundamentally different approach to reactor safety in a

decisive manner. Clearly, the primary advantages for potential

licensees lie in reduced operating costs. Those operating cost

reductions would come about primarily through amendment of

existing regulatory requirements, which we believe are

justifiable based on the improved safety performance of advanced

reactor designs.

We are heartened to note that the NRC's proposed policy positions

recognize the need for regulatory flexibility while preserving

their charter to assure the public health and safety. We

believe, however, that the NRC can go further than current

proposals without degrading their role as regulator. The ABB

comments provided in the Enclosure, to this letter are geared

toward the types of actions we believe are necessary and

appropriate for us to continue to justify the expenditure of

corporate resources in pursuit of advanced reactor designs.

ABB Combustion Engineering Nuclear Power

Ccmoustion Engineering Inc 1000 ProsDeci H,11 Road Te4eeonoe (20:

Posi Oflqce Box 500 Fax (203) 255 ATTArtIMF - NT 2 ... ... ., -o
Mr. Dennis M. Crutchfield LD-93-007

January 25, 1993 Page 2

If you have any questions, please do not hesitate to call me or

Chuck Molnar of my staff at (203) 285-5205.

Very truly yours,

COMBUSTION ENGINEERING, INC.

C. B. Brinkman, Acting Director

Nuclear Systems Licensing

CBB:cmm

Enclosures: As stated

xc: T. Cox (NRC)

D. Scaletti (NRC)
Enclosure to LD-93-007

Comments on Draft Policy Issues Analysis and

Recommendations

General Comnents - -

In the 'Recommendations section of the draft policy -report, the

NRC staff recomme'nds th'at':the Commission not proceed with

generic rulemaking on- any of' the identified policy issues, at

this time. ABB believes that-this approach should be - reconsidered. Rulemaking should not be postponed based on the

amount of design detail available for the various advanced

reactor designs and.CANDU 3. The NRC could set appropriate

safety acceptance criteria irrespective of the level of design

detail submitted thus far. Moreover, while advanced designs may

contain increased design and/or ultimate performance uncertainty,

that is a matter for the scrutiny'of the review-process and not

for overly restrictive acceptance criteria.- -- If this is not the..

case, a clear explacation'of the basis for promulgating morerestrictive acceptance criteria should be-provided. Having

definitive''regulations in place-will play-a-large part in a

vendor's-commercial decisions to'move-forward'with Design

Certification and'utility decisions to purchase and apply for an

operating license. If advanced-reactor designs,'with-their

higher safety reliability, lower core'damage risks and off-site

release goals, cannot-obtain'relief from certain existing

regulatory requirements,-the motivation to-move through the

design certification and -operating'licensing processes may not be

strong enough. A clearly defined playing field is of utmost

importance to the continued progression of advanced designs.

ABB acknowledges that the generic rulemaking approach recommended

above differs with the direction being pursued for evolutionary

ALWR designs. We'believe, however, that this is warranted since

the evolutionary ALWR designs are already fully'emersed in the

design certification process and generic rulemaking could-create

schedular-'delays or differences'with the design certification

rulemaking. 'The-advanced designs,-'however, are only at the

preapplication-review stage and thus can more -fully benefit from

rulemaking..

Policy Issue Comments

Accident Evaluation

It is'imperative'that-the'role of severe accidents be clear as

applied to advanced reactor designs; This is an-area where

relief is sought from current:regulatory'requirements. At this

time,- no credible core damage sequences have been Iidentified for

the PIUS design. If' this holds'true'throughout the review

process, would PIUS still be required to consider the effects of

progressively more unlikely'events just-to' arrive at a'

hypothetical severe' accident-scenario and evaluate. consequences?
Enclosure to LD-93-007

What are the implications once those consequences are known?

Even if the consequences turned out to be extremely severe, what

would it mean if the event frequency were determined to be

extremely incredible (including uncertainties)? ABB recommends

that the NRC establish a frequency threshold below which a fault

sequence could be dismissed (i.e., incredible, not meaningful to

consider). Of course it would be up to the vendor to convince

the NRC reviewers of the validity of their frequency evaluations

and the uncertainties applied. In other words, exactly what

constitutes the plant's design basis must be definitive.

Source Term

As mentioned above, at this time no credible core damage ,

sequences have been identified for the PIUS design. As such, a

source term based on some degree of core damage seems to

represent an extreme penalty for PIUS. Currently, the only

Postulated source of radioactive contaminants is leaking fuel

pins (not associated with accident scenarios). We recommend that

the last sentence of the PIUS paragraph in the Preapplicants'

Approach section be deleted. It is premature to indicate that

PIUS will likely utilize the revised source term resulting from

the NRC/industry effort. ABB recommends that The policy

statement should provide for a mechanistically derived source

term commensurate with the degree of justifiable core damage.

Containment

This policy issue is tied to the definition of accidents to be

evaluated as well as the source term to be employed. Here also

the question of the treatment of severe accidents in relation to

design requirements is ambiguous. The statement of the policy

issue seems to assume, a priori, that there will be fission

product release to the environment resulting from core damage.

Since no core damage is predicted for PIUS, no consequential

release is predicted. If an advanced plant can sustain the

validity of such a prediction under the scrutiny of the review

process, relief from selected containment design requirements

currently in the regulations or proposed by the draft policy

paper must be available.

Specifically, design certification should not be contingent upon

meeting on-site and off-site radionuclide release acceptance

criteria that utilize artificially calculated releases based on

an arbitrary core damage assumption. In other words, for this

issue the second recommendation of the staff should not force

unreasonable core damage scenarios. Satisfaction of the first

recommended criteria, concerning on-site and off-site release

acceptance criteria, is all that is necessary coupled with

probabilistically plausible accident scenarios.
Enclosure to LD-93-007

The description of the PIUS.containrment design presented in the

draft policy paper is incomplete. The below grade containment

structure is more accurately described as follows:

"Below grade, the bottom part of the containment'structure

and.the monolithic prestressed concrete vessel (which

contains the reactor pool water and forms the lower portion

of the reactor pressure boundary) are joined together by

means of vertical prestressing tendons that are run up to

the top of the PCRV proper.. The steel liner on the

containment inside, which ensures leak tightness, is''a

*-continuous liner covering the whole bottom area, the

cylindrical walls, as well as the upper parts."

Emercrency Planning

Another area where vendors seek to gain some degree of regulatory

relief by recognition of the improved safety effectiveness

afforded by advanced reactor designs is in the requirement for

Emergency Planning. ABB believes that the opening sentences of

the Recommendation section could be modified to more 'clearly

reflect no need for immediate regulatory action on this issue.

There is no need for a recommendation that '... licensees be

required to develop off-site emergency plans.". As noted in the

paper, this requirement is already established in NRC's

regulations. An alternate opening might indicate that,

"The staff proposes no changes to the existing regulations

governing Emergency Planning at this time. While it'is

desirable to establish the potential for and magnitude of

-off-site releases early on, there is no need to burden the

preapplication review process by over focusing on Emiergency

Planning. Emergency'"Planning issues are-more appropriately

addressed during the Combined Operating License phase, when

a specific utility and plant site would be identified.

Regulatory direction should, however, be available at the

start of the Design Certification phase so that:any

*Emergency.Planning implications on design can be addressed.

Moreover, addressing Emergency Planning later'in the"

licensing timeline allows for consideration of'input' to be

developed by the ongoing NRC/industry dialogue on this

subject, 'as well'as resolution of the related Accident

Evaluation, SourceTerm and Containment' policy issues."

The policy paper.notes that'ABB did not explicitly communicate

it's goals regarding emergency 'planning. ABBIs goals are' in-line

with those cited for the other advanced reacto'r'designs.- -That

is, early notification requirements-could be reduced, detailed

evacuation planning.could be eliminated (or'at'.'least 'reduced),-

EPZ size could.be''reduced'and offsite emergency exercises would

be unnecessary. The'request for -regulatory'relief is'based on;,
Enclosure to LD-93-007

* satisfaction of the Environmental Protection Agency's

lower level Protective Action Guidelines for dose,

* PIUS passive safety features which preclude core

damage, and

* PIUS design features which allow substantially longer

response times before intervention (to protect the

public health and safety) would be required.

By no means does ABB imply that emergency planning can be

disregarded altogether. Rather, ABB believes that emergency

planning can be accomplished without involvement of significant

offsite resources and without the need to implement emergency

plans in the very short term following an incident. Clearly, a --

plan of action to deal with emergencies is a necessary part of

safety and the defense-in-depth philosophy.

Reactivity Control System

Under the section Preapplicant's Position, the description of the

safety grade reactivity control system should be updated to

reflect the recent design change to inject boron via a Scram

Valve System instead of by inflow through the lower density lock

initiated via trip of a reactor coolant pump. By this change,

plant shutdown is not precluded by blockage of the density

lock(s). Boron inflow from the reactor pool via the lower

density lock is the ultimate passive scram mechanism because it

requires no system or operator action to initiate the safety

function.

Additionally, the draft paper quotes the diameter of the density

lock tubes as 3". This value is incorrect, the density lock

tubes are of a nominal 57mm (2.25") diameter.

Operator Staffing and Function

ABB concurs with the staff position that operator staffing in

advanced reactor designs could be reduced but that the

appropriate staffing complement for a given design should be

based on function and task analysis. The ability to shutdown

with eventual progression to a safe shutdown condition following

loss of computer control capability is an ongoing issue for

current ALWR design certification applicants. ABB believes

that the same guidance emerging for I&C diversity could be

applied to PIUS which is also an ALWR.

Further, the recommendation to demonstrate adequacy on an

'K...actual control room prototype" should not be stated in

absolute terms. Allowance should be permitted for consideration
Enclosure to LD-93-007

of applicable operating experience in place of a plant specific

prototype. This modification would accommodate the body of

experience from the new generation of digital computer controls

being developed in conjunction with evolutionary plant designs

and for non-nuclear applications. Such designs will likely see

service before the proposed advanced reactor designs providing, an

experiential data-base precluding the need for an actual advan'ced

plant control room prototype.

Residual Heat Removal

No comment.

Positive Void Reactivity Coefficient

Although a summary table is included in the paper, it would be,

beneficial to indicate the applicability of specific issues to

each of the designs under review in each policy issue write-up.

For this specific issue it should be noted that positive void

reactivity coefficient concerns are not applicable to the PIUS

design.

Control Room and Remote Shutdown Area Desicn

Under the Preapplicant's Position section, the statement

indicating manual scram for PIUS via trip of the main reactor

coolant pumps should be updated to reflect the recent design

change to a Scram Valve System as the primary (automatic) trip

mechanism. Trip of the reactor coolant pumps remains available

to the operator as a manual scram action. Boron inflow from the

reactor pool via the lower density lock is the ultimate passive

scram mechanism because it requires no system or operator action

to initiate the safety function.

Safety Classification of Structures. Systems, and Components

No Comment.
Department of Energy

Washington, DC 20585

Project No. 674

, /

Mr. Stephen P. Sands

Project Manager, ALMR

Advanced Reactors Project Directorate

M/S 11-D-23

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

Dear Mr. Sands:

Subject: Commission Papers On Policy Issues-And Schedules

Concerning The Preapplication Reviews Of Advanced

Reactor And CANDU 3, Designs- '

We received the subject documents, namely (1) a draft paper

providing the staff's positions on ten policy issues and (2) afinal paper, SECY-92-393, "Updated-Plans and Schedules for

Preapplication Reviewsof.Advanced Reactor (MHTGR, PRISM, and

PIUS) and CANDU 3 Designs,"..and the staff's proposed schedules for

the preapplication reviews. We appreciate the opportunity to

comment on these'documents and trust-that our comments will be

taken into consideration as the U.S. Nuclear Regulatory Commission

(NRC) postulates its final position. The following comments

pertain tothe Advanced Liquid Metal Reactor (ALMR)-Power Reactor"

Innovative Safe Module (PRISM) design.--

Policy Issues

The draft policy issues paper identifies ten issues-as follows:

A. Accident Evaluation

B. Source Term -

C. Containment Performance ^.

D. Emergency Planning -

E. Reactivity Control

F. Operator Staffing

G. Residual HeatRemovalH. Positive Void Reactivity . I. Control Room-Design ' ;

J. Safety Classification

The staff states that eight of these issues apply to PRISM/ALMR.

They further state that they believe departure from current

regulations should be considered for seven of these issues while

ATTACHMENT 3
2

departure from current regulations is not warranted at this time

for one issue. This categorization is presented below, with

comments.

a. PRISM/ALMR issues for which departure from current

regulations should be considered

A. Accident Evaluation

B. Source Term

C. Containment Performance

0. Emergency Planning

E. Operator Staffing

F. Residual Heat Removal

G. Positive Void Reactivity

The staff positions concerning these seven issues largely parallel

positions taken previously by the PRISM/ALMR design team. A

general characterization of these positions is that where

deviations from current regulations are necessary, they should be

performance based rather than prescription based, and that -

additional work is required to generate the data required to make

final judgements. We agree with this approach.

However, the staff goes on to propose that "...where deviations

are recommended, the staff proposes more conservative alternatives

to the preapplicants' proposals to account for uncertainties

associated with the conceptual design, which should ensure that

conclusions made during the preapplication review will provide a

reasonable basis for the detailed design being found acceptable at

design certification.'

Our concern with excessive conservatism in the preapplication

review is that it will be difficult to reduce such conservatism as

additional data are developed to support detail design, and that

the end result may be alternative regulations serving as

surrogates which create defacto new policy more conservative than

the NRC safety goals.

To avoid this problem, we suggest that performance criteria should

be developed which must be met regardless of uncertainties and

design details. These performance criteria should be comparable

to those of Light Water Reactors (LWR) and consistent with the

safety goals. Allowance for uncertainties, commensurate with the

level of knowledge and detail, should then be made in the

evaluation process. As new information and details are developed,

reevaluations should be made against the original performance

criteria, using revised uncertainties appropriate for the level of

new information and details.
3

b. PRISM/ALMR issues for which departure from current

regulations is not warranted at this time

Control Room Design

The staff position for this issue differs from that taken by the

PRISM/ALMR design team. Specifically, the staff recommends that

until passive LWR policy for design requirements of control rooms

and remote shutdown facilities is finalized, current LWR

regulations and guidance should be applied to the preapplication

review of advanced reactor designs. This would mean that

safety-related equipment would have to be available to the

operator in the control room, and that the control room/building

would have to be designed and built to seismic Category I

standards.

The PRISM/ALMR design team has presented the technical basis for

the reference plant control system, reactor protection system,

control room, and RSF design. This approach is performance based,

and is believed to meet the general design criteria. It takes

into account the passive and inherent safety features of the

PRIMSM/ALMR design that go beyond those being considered in the

passive LWR designs. We believe the staff should treat this issue

similarly to the other seven issues by using a performance-based

approach and allowing the PRISM/ALMR design team to develop the

additional information required to demonstrate this performance.

We are ready to continue our discussions to resolve the

outstanding issues without compromising the innovative design

concept or impacting on the scheduled release of the Final Safety

Evaluation Report.

S n erely,

Nicho as ossman

Directo , Division f LMRs and Breeders

Office of Advanced Reactor Programs

Office of Nuclear Energy

cc:

James E. Quinn, GE

Richard Hardy, GE
Project N

Department of Energy

Washington, DC 20585

January 27, 1993

o. 672

Dr. Thomas Murley, Director

Office of Nuclear Reactor Regulation

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555-0001

Dear Dr. Murley:

We have reviewed the advanced reactor review schedule information

as presented in the Nuclear Regulatory Commission (NRC) document

SECY-92-393 "Updated Plans and Schedules for the Preapplication

Reviews of the Advanced Reactors Designs (MHTGR, PRISM, PIUS and

CANDU 3)." We believe the Modular High Temperature Gas-Cooled

Reactor (MHTGR) Preapplicatlon Safety Evaluation Report (PSER)

completion in December 1995 will not support the Department of

Energy achieving the congressional intent contained in the Energy

Policy Act of 1992 because the Department would need to submit

the MHTGR preliminary design 9 months after receipt of the PSER.

As per our discussions, we believe a date of June 1994 for

completion of the MHTGR PSER would be more appropriate. This

date would be more in line with projections of SECY-91-161

'Schedules for the Advanced Reactor Reviews and Regulatory

Guidance Revisions, May 31, 1991,' and would mean that the MHTGR

program could continue preliminary design and prepare the

Preliminary Design Approval application with a clearer

understanding of the NRC's view of MHTGR design issues.

Therefore, we request the NRC review'resource allocations and

consider a prioritization for the MHTGR preapplication review

completion that will support a June 1994 final PSER.

Additionally, to ensure the NRC is fully aware of the

Department's plan to implement the advanced reactor requirements

of the Energy Policy Act of 1992, the Department will forward to

the NRC a draft copy of the Advanced Reactor 5-year plan for

their review and comment.

Sincerely,

E. C. Brolin

Deputy Assistant Secretary

for Civilian Reactor Development

Office of Nuclear Energy

ATTACHMENT 4
consumers

Power Davd P Hoffman

t~~~~~~~~~~~~~~~~~~~~~~~~~k A'id .i- Ptenu

; P.OWERIN0 .- c;:i Operaenso

MICHIGA N'S PROGRESS

Genoral Oflieus: 1945 Wect Parnalt Road. Jackson. Mt 49201 * (5171 788.0453

January 28, 1993--

Mr. Dennis M. Crutchfield, 'Associate Director.

Advanced Reactors and License Renewal

Office of Nuclear'Reactor-Regulation ' U.S. Nuclear Regulatory Commis'sion'

Washington, D.C. 20555 '

Subject: COMMISSION PAPERS ON POLICY -ISSUES CONCERNING THE

PREAPPLICATION REVIEWS OF ADVANCED REACTORS

Dear Mr.

As you'know, for the past few years Consumers Power Company has actively.

participated in Modular High Temperature''Gas-Cooled Reactor (MHTGR)

development. We, 'and the -other meimbers of Gas-Cooled Reactor Associates

(GCRA), provide the perspective of utilities.that own and.. operate current

nuclear plants. 'This utility role is unique among -advanced reactor programs.

A few weeks ago, -the GCRA Management Committee received a briefing on 'the

subject Commission papers. While we appreciate the diligent work of NRC staff

in drafting those papers, we are concerned that they do not convey the higher

vision of what is needed, and what might be 'achieved, from innovative reactor

concepts, post Advanced Light Water Reactor (ALWR) deployment. We believe NRC

policy guidance should be framed within benchmarks already established by the

Commiission, the realities of industry n'eeds, and the' related opportunities

offered.by. advanced reactors; i.e.:'

The Advanced Reactor Policy Statement; sets forth the general

characteristics of advanced reactor design, which the Commission believes

advanced reactors should 'exhibit, to increase assurance of safety, to

improve public understanding, 'and to promote more' effective regulation.

While -current regulatory'philosophyhas been effective in.protecting the

public, there is mountinglevidence that current regulatory. processes failto make efficient use of'both iridustry and NRC resources. NRC policy

guidance must recognize the need'to&'make'effective and efficient use.of

the Nation's resources, including those of the NRC, and foster'the

development of regulatory criteria and processes appropriate to advanced

reactor technologies.

PALISADES BIG noCH PoinT

fnuclnc Plant

LiI;I~ ATTACHMENT
a -

NRC Safety Goals provide a framework for the consideration of risks from

nuclear power plants. The nuclear industry has thus been provided with a

threshold of acceptable risks to society based on several decades of

experience with operating facilities. NRC policy guidance should build

on this basis to delineate the risk-significance of plant features and

personnel actions and, thereby, clarify the interface between the

regulator and industry so that each may make productive use of resources.

An Industrywide Initiative to reduce nuclear generation costs while

assuring high levels of safety has been launched under the auspices of

NUMARC. This effort grew out of Chairman Selin's acknowledgement that

NRC may have contributed to O&M cost increases at nuclear plants by

imposing regulations that do not necessarily increase safety, and his

request for the industry to assist the Commission in identifying such

regulations. It has been suggested by NUMARC president Joe Colvin that

the current regulatory environment, the cultures of both the NRC and

industry, have been molded by the accident at TMI. NRC policy guidance

on advanced reactors must look beyond the current industry crises and be

receptive to constructive changes in the regulatory environment and/or

reactor technologies.

The Energy Policy Act of 1992, Subtitle C, Advanced Nuclear Reactors,

contains provisions for the ALWR and "...other advanced nuclear reactor

technologies that may require prototype demonstration prior to commercial

availability..." These provisions include, but are not limited to, high

temperature gas-cooled reactors and liquid metal reactors. Provisions of

the Act, offer the prospects of standardized, NRC certified commercial

nuclear power plant designs, based on prototype tests. NRC policy

guidance on advanced reactors should be receptive to the development of

the appropriate regulatory framework for the reactor technology and

should allow for the use of results from development programs, including

prototype tests.

Given the Nation's investment in LWR technology, it follows that the LWR

licensing framework is the starting point. However, the MHTGR (and possibly

other advanced reactors) offers a diverse and contingent path to the

resolution of technical issues underlying the business risks of owning a

nuclear power plant. From the perspective of operating utility management, it

may be inappropriate for NRC to strive for consistency with ALWR regulations

as was frequently indicated in the subject Commission papers. Rather, policy

guidance should provide for systematically Identifying the systems, structures

and components significant to public safety and the regulatory processes that

should be applied to them, according to the attributes of the technology. In

this regard, an Attachment to this letter elaborates our views on key policy

issues for the MHTGR.
In summary, the NRC Advanced Reactor Policy Statement and Safety Goals should

provide the framework for departure from current regulatory philosophy. Certainly the need for improved regulatory environment exists, as evidenced by

the Industrywide Initiative directed at current plants. Finally, provisions of the Energy Policy Act provide a route for regulatory development in concert

with reactor design and technology development. NRC policy guidance should be

responsive to industry needs and receptive to the opportunities afforded by

advanced reactors.

We look forward to providing continued support to this crucial area of MHTGR

development.

Sincerely,

David P. Hoffman

Vice President of Nuclear Operations Chairman, GCRA Management Committee

Copies with attachment:

Advisory Committee on Reactor Safeguards GCRA Management Committee

GCRA Operations Working Group MHTGR Program Participants
F-1-CO-Eki-T FFCCI-EIU~ :3-CII ~ ~~~~~T -l C I- J a nZ:3 I '!. : 4 3 N' N co .:~''2 . 0 C-1 _'- P . 0 5.

ATTACHMENT

GCRA PERSPECTIVE ON KEY WhT`R POLICY ISSUES

Containment Performance

The essence of the HHTCR safety concept is the capability to retain

essentially all fission products within ceramic-coated fuol particles for the

full range of licensing basis events. In this regard the HHTCR is

fundamentally different than the ALWR. The MHITR's capability derives from

the attributes embodied in the design and manufacture of the fuel end reactor

module. By simplifying reactor safety in this way, the MHTCR concept can

potentially enhance the efficiency and tffectivenes. of nuclear safety

regulation. Since the means to accomplish safety functions are embodied in

the design, regulations may center on design verification and manufacture of

the fuel and reactor modules, with a substantially reduced reogulatory effort

applied to site act'vities. In this regard. XHTcR demonstration tests will be

of benefit to regulators, as well an to industry. This approach is inherently

more efficient than a regulatory focus on site activities, sincs each plant involves a unique combination of owner, project organization, plant staff and

public interest groups.

We are h-artoned by NRC staff's recognition of the potential to license a

design with a containment concept tailored to the overall performance of the

design. However, this position appears to be linked to an as yet undefined,

arbitrary corn dazzage assumption. rrom probabilistic risk assessments

conducted to date, tge7~GR Program estimate that an event of sufficient

severity so as to aso co a damage would have a predicted frequency of

occurrence les thyn lD r plant year. Thu ACRS letter of October 13, 1998,

noted that, -Nelth srth-igners, the NRC staff, nor the members of the ACRS

have been able to xsu&h'te accident scenarios of reasonable credibility, for

which an additional physical barrier to release of fssion products La

rsquired in order to provide adequate protection to the public. " The TOR

safety concept would essentially eliminate the potential for severe core

damage and core disarray like the accident at THM, an important consideration

in gaining enhanced public acceptance of nuclear power.

Bevidual-Reat Removal

The MHTGR accomplishes residual heat removal with systems, structiree and

components that are continuously functioning and do not require Lnitiating signals, external power sources or moving parts. We note that KRC staff

recognized the potential for relying on a single, completely passive, safetyrelated residual heat removal system. In addition, the KBITR approach to

residual heat removal in readily demonstrated and does not entail the

potential for the interaction of passive end active system.. In this regard,

the MHTGR is fundamentally different than the ALWR and, coupled with the

approach to fission product retention described above, the KHTOR may allow a

different approach to the regulatory treatment of non-safety related systms.

Safety Classification, Control Room 11poian. !meroency Plannlno

These issues are far too important to the cocmerciel potential of the HBHTR

concept (or any nuclear option) to be decided on the basis of judgment and

existing precedent. It is here that the provisions of the Advanced Reactor

Policy Statement (see especially the Commission Response to Question 1

regarding the use of loss prescriptive licensing cxitmria) and the NRC Safety Goals must be confirmed by disciplined design and technology development

programs. For the MHTOR to become commercially viable, regulations must be

consistent with the risk-sLgnificance of plant equipment, peroonnel actions.

and the provisions of emergency plane.
STAFF RESPONSE TO THE ADVISORY COMMITTEE ON REACTOR

SAFEGUARDS (ACRS) REVIEW OF POLICY ISSUES ANALYSIS

AND RECOMMENDATIONS CONCERNING ADVANCED REACTORS

ENCLOSURE 5
UNITED STATES

NUCLEAR REGULATORY COMMISSION

_ K WASHINGTON, D. C. 20555

March 24, 1993

Mr. Paul G. Shewmon, Chairman

Advisory Committee on Reactor Safeguards

U.S. Nuclear Regulatory Commission

Washington, D.C. 20555

Dear Mr. Shewmon:

I am responding to the Advisory Committee on Reactor Safeguards (ACRS) letter

of February 19, 1993, to the Chairman concerning the issues pertaining to the

advanced reactor (PRISM, MHTGR, and PIUS) and CANDU 3 designs and their

relationship to current regulatory requirements. The responses in the

enclosure are organized into General and Specific categories, as are the

comments in the ACRS letter. I have commented upon those issues where the

staff's position is questioned or where I felt our position needed some

clarification.

The staff will continue to keep

preapplicant positions, as well

implementation of the policies.

the ACRS informed of any changes in staff or

as any significant developments in the

Sincerely,

Original signed by

James M. Taylor

James M. Taylor

Executive Director

for Operations

Enclosure:

Staff Response to ACRS Comments

cc w/enclosure:

The Chairman

Commissioner Rogers

Commissioner Curtiss

Commissioner Remick

Commissioner de Planque

SECY
STAFF RESPONSE.TO ACRS COMMENTS

GENERAL COMMENTS

Comment

. , -r,

Respons

Comment

Respons

1:' We find'that the identified issues are important and that the

-staff should receive guidance'from-the Commission. (There are

other policy issues affecting these reactor designs.:that are being

addressed in connection with the evolutionary and passive LWR

designs.) There may well be additional policy issues that appear

-during the preapplication review-process. The staff has committed

to identify any such issues in-subsequent Commission-papers.

;e: The staff will identify-any.policy issues that arise subsequently.

2: The staff has grouped these ten issues into the two categories

described-above. We note that all-of the affected preapplicants

who-appeared-before.us-would treat Issue I (Control-Room and

Remote Shutdown Area.Design):as a Category I: issue, whereas the

staff proposes-it as-a Category 2 issue. We will discuss this

difference of opinion below in our-opinion on Issue I.

e: No response to-this-comment. :

Comment 3:- For Category 1 issues, the staffproposes more conservative

alternatives than-the preapplicants propose, in order to account

for uncertainties associated with the conceptual design. We are

concerned that such an approach-might well-freeze an unnecessarily

large -degree of conservatism'into the designs, and the preap-

-: ..plicants would-have great difficulty persuading the staff to relax

this conservatism on the basis of more precise information

available in'the final design.' '

Response: The staff's-positions on Category.-i.issues, with the exception of - containment and emergencyaplanning (EP), are not more conservative

than positions proposed by.'preapplicants.- The containment recommendation is based on, and will be-further, developed from, the

* : current Advanced Notice of Proposed Rulemaking issued by the - Commission,- and the staff's EP recommendation notes that further

evaluation of-the advanced reactor designs may permit some

relaxation from current requirements. -

The staff is not prepared to, nor does it -intend to, specify firm

standard design certification requirements at the preapplication - review stage.- The preapplication review approach is to examine a

range :of postulated operational -events and accidents, including - some accident -sequences postulated to 'result-in either substantial

-,core damage alone:or.core'damage witha large release from con-

. tainment..; Such examinations -are consistent -with the direction of

the Commission's-Severe Accident~Policy Statement, and with the

ENCLOSURE
- -

10 CFR Part 52 requirement to confirm, through a full-plant,

design-specific probabilistic risk assessment (PRA), the margins

available in the design to accommodate events of low probability.

These examinations will assist in specifying which accident

sequences should be assigned to the frequency categories identified as anticipated operational events, anticipated transients and

accidents, and severe accidents. It is intended that licensing

basis consequence limits for accident sequences will be entirely

consistent with the Commission's safety goal and severe accident

policies.

For the preapplication review, the staff intends to develop a set

of event categories for accident selection. These categories

would be used for defining acceptable analyses criteria and

consequences (dose limits) based on the likelihood and potential

significance of an event.

These categories would both encompass traditional events at lightwater reactors (LWRs) and would extend to severe accidents. For

anticipated operational transients, analyses assumptions would be

conservative. For anticipated or design base accidents, the

single-failure criterion would be used in conjunction with such

conservative analyses assumptions as no operator credit and no use

of non-safety-related equipment to mitigate the outcome of an

event. For severe accidents, a best-estimate analyses assumption

would be acceptable as would justifiable operator actions and

credit for non-safety-related equipment.

The analyses would, therefore, prescribe the event scenario,

identifying the amount, timing, and magnitude of fuel and core

damage, and the status of the integrity of the primary coolant

boundary. This fuel and core damage would then be used to

evaluate the amount and type of radionuclide releases from the

fuel into the primary coolant. Uncertainties in the specific

amount of radionuclide species released from the fuel would be

assessed for the scenario but would not be further increased to

provide some measure of additional conservatism. The status of

the primary coolant boundary would then determine the releases

from the primary coolant boundary into the containment (or

confinement) region, and the containment performance would then

determine the releases to the environment. With regard to

conservatism, the effectiveness of systems and barriers to

mitigate releases would be treated consistent with the appropriate

event category.

In addition to using PRA results to identify an appropriate event

category for some scenarios, the staff may, based on engineering

judgment, require the preapplicant to evaluate some event

sequences applying appropriate conservatism to, for example, the

anticipated accident category rather than the severe accident

category. The staff would need this assessment in order to assess

margins in the design, to account for uncertainties in the PRA

- 2 -
Commenl

Respono

Comment

Respon!

Commeni

Respo=n

Comment

Respons

Comment

t 4:

se:

se:

data base, and to ensure that thee importance of systems needed to

mitigate accidents is understood. ... 2-^<:'f ''.~ r ;'-I

We support the staff recommendation that "a prototype CANDU 3 is

not required for design certification."

The staff and ACRS agree on' the 'staff recommendation.

We support the staff intention to'notify the Commission if its

position on any of these ten issues should change, or if new

issues are identified.

The staff and ACRS agree on the staff-recommendation.

:6: We have no'objection to the staff recommendation'that the highest

priority be given to issues that-are applicable to the PRISM

design.

;e: The staff and ACRS agree on'the staff recommendation.

7: We understand and sympathize with the staff recommendation to

defer decisions on generic rulemaking on these ten issues.

Nevertheless, we urge the'Commission to address these decisions in

the near future. (The generic rulemaking question may arise in

connection with passive LWR designs.)

;e: The staff and ACRS agree on the staff recommendation.

8: In-several places in the'draft Commission paper', there occurs

qualitative language, e.g., appropriate conservatismsw or

"credible severe accidents."'"This language must ultimately be

translated into quantitative guidance. We believe that the

quantitative guidance is, to a large measure', policymaking, and

should not be relegated to low-level reviewers.

Response: The staff work on the advanced designs has not progressed to where

it can quantitatively define-'appropriate conservatism or

'credible severe accidents."-- We agree that such definitions

should be approved at appropriate -agency management levels, and

will not-be relegated to:."low-level reviewers." The staff will

delete the words "appropriate"-and-7crediblel from the policy -' issues'paper,-as-suggested-by:the'ACRS.-

SPECIFIC COMMENTS

Category 1 Issues

Comment: A.; Accident Evaluation' -

The staff proposal to develop a..single approach with certain

specified characteristics appears reasonable. We would like to

review that approach when it is ready. We believe, however, that

- 3 -
the staff should identify at an early stage quantitative guidelines and criteria for accident selection and evaluation. We note

that AECLT has taken exception to some of the statements in the

draft Commission paper that relate to its approach to this issue.

We believe that this disagreement can be resolved by AECLT and the

staff.

Response: The staff plans to propose, as soon as possible, quantitative

guidelines for design certification accident selection and

evaluation. This will include definitions of frequency categories

and associated acceptable consequence limitations assigned to

categories and specified accident sequences.

Comment: B. Source Term

The staff proposal to base the source terms on mechanistic

analyses appears reasonable, although it is clear that the present

data base will need to be expanded. We note that the staff is now

developing for LWRs a revision to the TID-14844 source term. It

will be appropriate for the staff to consider using the newer

approach when it develops source terms, and to take specific

account of the unique features of each of the reactor types.

Response: The staff and ACRS agree on the staff recommendation.

Comment: C. Containment

The staff proposal "to postulate a core damage accident as a

containment challenge..." appears-reasonable. We would like to

review the list of postulated accidents when it is ready.

Response: The staff and ACRS agree on the staff recommendation.

Comment: D. Emergency Planning

The staff proposes that advanced reactor licensees be required to

develop offsite emergency plans which will include a requirement

for onsite and offsite exercises. This proposal appears reasonable under the present circumstances, except that we would follow

existing LWR guidance that permits the omission of offsite

exercises when it can be shown that the design would preclude any

accidental release exceeding the EPA Protective Action Guides.

The staff has agreed to consider, after a review of Accident

Evaluation (Issue A, above), whether some relaxation from current

requirements may be appropriate. We urge that work on Issue D be

closely correlated with work on Issues A and B, in order to avoid

unnecessary conservatism.

Response: The staff and ACRS agree on the staff recommendation.

- 4 -
Comment: E. Reactivity Control System

The staff proposal-that' thiee absbnce of control rods need not

disqualify a reactor design, provided that an applicant can show a

level of safety in reactor control equivalent to that of a

traditional rodded system, appears reasonable. We note that this

issue is applicable'only to the PIUS concept,.and that we have not

yet had the benefit of presentations by the PIUS designers.

Response: The staff and ACRS agree on the staff recommendation.

Comment: F. 'Operator Staffing and Function

The staff intends to review the justification for a smaller crew

size by evaluating the function and task analyses for normal

operation and accident-management. This intention appears reasonable; although we believe'that particular attention needs to be

'given to multiple module designs. 'We note that-this issue is

related to a similar issue for passive reactors. We believe that

theCommission policy should be the same, for the advanced reactors

and CANDU 3 as it is for the passive reactors.

Response: The staff and ACRS.agree;-on the staff'recommendation.

Comment: G.. Residual Heat Removal

The staff belief that reliance on a single, completely passive,

safety-related residual heat removal (RHR) system may be acceptable appears 'reasonable, although we would have liked to see the

criteria'to be used by the'staff in deciding acceptability. We

agree with the staff that'NRC regulatory treatment of non-safetyrelated backup RHR systems for these reactors should be consistent

with design requirements (not' yet identified) for passive LWRs.

Response: The staff and ACRS agree on the staff recommendation.

Comment: H.- Positive Void Reactivity Coefficient

We agree with the staff that the existence of a positive void

reactivity coefficient is a significant concern, but that it

should not necessarily disqualify a reactor-design. The burden of

showing that the consequences of those accidents that would be

aggravated by a positive void.reactivity coefficient are either

acceptable or could'be'satisfactorily mitigated by-other design

features surely'falls on the preapplicant; On the 'other hand, the

'staff should state the criteria it will use~to-judge 'acceptable'

or 'satisfactorily."

Response: The staff and ACRS agree on the staff. recommendation. The staff

will define the criteria to judge 'acceptable' and

"satisfactorily' as it performs the preapplication review and

during this review will develop an understanding of the behavior

- 5 -
of the particular design during positive reactivity insertion

transients and accidents.

Category 2 Issues

Comment: I. Control Room and Remote Shutdown Area Design

We do not agree with the staff decision to treat this issue as a

Category 2 issue, and the concomitant recommendation to apply

current LWR regulations and guidance until passive LWR policy in

this area is finalized. We believe that this issue should be a

Category 1 issue, and that the preapplicants should accept the

burden of convincing the staff that a proposed design is satisfactory, according to some criteria that should be specified by

the staff.

Response: The staff is recommending a policy position to be utilized at the

preapplication review stage. As stated in response 3 (above), the

staff does not intend to shut off further dialogue with preapplicants, but to state that, at this time, justification for

recommending departure from current requirements is not established. As noted in the policy paper recommendation, this issue

also is dependent on further development within the context of

advanced passive plant design reviews. The staff believes that

preapplication design review should be completed by identifying

and evaluating differences between preapplicant proposals and

current LWR requirements, before recommending design certification

requirements.

The staff believes that its current recommendation in the policy

paper remains appropriate, that is, to evaluate preapplication

designs by comparison to current LWR requirements/guidance for the

immediate future. As advanced passive LWR policy for design

requirements of control rooms and remote shutdown facilities is

developed, and as further evaluation of the completely passive

shutdown and decay heat removal functions in the Department of

Energy designs are further evaluated, additional changes to relax

requirements on main control rooms may be justified for the

designs treated in this paper.

Comment: J. Safety Classification of Systems, Structures, and Components

(SSCs)

This issue is relevant only to the MHTGR concept. GA makes a

persuasive case that the MHTGR is sufficiently different that the

LWR criteria for identification of safety-related structures,

systems, and components should not arbitrarily be applied to the

MHTGR. We concur with this view and believe that Issue J should

also be classified as a Category 1 issue. This would not preclude

coordination of the policy for passive reactors with the policy

for the MHTGR.

- 6 -
Response: The staff believes that this issue is fundamental to the maintenance of the "defense in depth" philosophy and policy held by

the Commission over many years of LWR regulation. The Nuclear

Regulatory Commission (NRC) has long held it important to protect

the integrity of the reactor coolant pressure boundary, to protect

the SSCs necessary to shut down the reactor and maintain decay

heat removal, and to protect the SSCs needed to prevent or

mitigate accidents and minimize releases.

This policy is believed sound and necessary to the partitioning of

the risk of radioactive releases among several independent

barriers to radionuclide transport. The approach taken by the

preapplicant for the modular high-temperature gas-cooled reactor

(MHTGR) would limit NRC regulation to requiring safety-grade

classification only on SSCs needed for preventing or mitigating

offsite releases. The staff feels that this approach could result

in placing reliance on too few SSCs, therefore, not assuring

multiple, highly reliable barriers to radionuclide release.

This issue deals only with determining which SSCs should be

classified as safety related, making it equivalent to the

specification of SSCs as "safety grade." For advanced reactor

designs, the classification as safety grade may not necessarily

mean that such SSC should be designed, built, tested, and

maintained to a single set of standards that includes seismic

Category I, electrical Class IE, and other traditional 'safety

grade' attributes. That is, having specified which SSCs should

carry the safety-grade classification, consideration should be

given, in the language of General Design Criterion 1, to design,

fabrication, erection, and testing to quality standards

commensurate with the importance of the safety functions to be

performed.

- 7 -
AECLTechnologief A.D. Hink

9210 Corporate Boulevar Vice-Presiderrtand

General Manager Suite 410

Rockville. Maryland

20850 USA

,4AECLT 93016 AECLT 93016 ~~~~~~~~~~~~~~~~~

; (301)417.0047

Fax(3011417-0746

Project 679 Telex403-442

January:25, 1993

Mr. Dennis M Crutchfield

-Associate Director for Advanced

Reactors and License Renewal

Office of Nuclear Reactor Regulation -.

U.S. Nuclear Regulatory Commission

Washington. DC 20555

Re: Commission Papers on Policy Issues and Schedules Concerning the

Preapplication Reviews of Advanced Reactors and CANDU 3 Designs.

Dear Mr. Crutchfield:

This letter is in response to your letter of December 16, 1992, wviich provided AECL.

Technologies (AECLT) with two NRC Staff papers concerning the preapplication review of

the CANDU 3 design. One paper was SECY-92-393 concerning "Updated Plans and

Schedules for the Preapplication Reviews of the Advanced Reactor (AMTGR. PRISM, and

PIUS) and CANDU 3 Designs." The other was a draft SECY paper entitled "Issues

Pertaining to the Advanced Reactor (PRISM? MHGR and PIUS) and CANDU 3 Designs

and Their Relationship to Crnt Regulatory Requirements." We have reviewed the two

papers and address each in turn.

SECY-92-393 establishes a revised schedule for completion of the preapplication review of

the 'CANDU 3 design: Accoding to SECY-92-393 the draft'Preapplication Safety Evaluation

Report (PSER) is to be issued in June.1994 and a final PSER in December 1994. This

represents a significant change of twelve months over the earlier scheduled completion of

June 1993 for the draft PSER. The June 1993 date provided time for AECLT to address any

issues raised in the PSER and to submit its application for certification of the CANDU 3

design in the early' part of the 1995-96 thneframe. AECLT has chosen the 1995-96 timeframe

because'it would 'allow a certified CANDU 3 design to be available to U.S.- uilities in the

expected timefre for the'placemnent of new orders for nuclear power plants.- The new

schedule of December 1994 pushes submission of the CANDU 3 design certification

.. 9 

9301280246 930125 ATTACHMENT I PDR PROJ

& -YE3A
Mr. Dennis M. Crutchfield

Page - 2 -

January 25, 1993

application to the end of the 1995-96 timeframe, with little to no allowance for contingency

or slippage. Therefore, it is critically important that the new schedule in SECY-92-393 be

faithlbllv adhered to and not extended.

In providing the Commission with relevant background on the CANDU 3 design. SECY-92-

393 indicates that Atomic Energv of Canada Limited (AECL) is "negotiating to start

construction in a Canadian province which could serve as a prototype for the CANDU 3

design in the U.S." and that AECL "would re-evaluate its design certification plans in the

U.S. if Canadian construction plans did not materialize." Similarlv the draft issues paper

states that "a CANDU 3 reference plant is a key element in [AECLTs] plan for standard

design certification." These statements require clarification in two aspects.

First, as the drft issues paper makes clear, and AECLT fully endorses, the CANDU 3 design

is an evolutionary heavy-water design deriving from CANDU designs operating in Canada

and elsewhere. for which there is over 200 reactor years of full power operating experience.

Consequently, a prototype CANDU 3 is not required for design certification. Also, as the

draft issues paper makes clear, while a reference plant built in Canada would greatly benefit

the Staffs reviev of the CANDU 3 design, building such a plant is not necessary for

certification of the CANDU 3 design. Rather. what is of importance is the relevant operating

experience of the CANDU plants from which the CANDU 3 design evolved.

Second, as to potential availability of a reference plant in Canada, AECLT is pleased to

inform the NRC that on December 21, 1992, the Government of Saskatchewan and AECL

signed a Memorandum of Understanding (MOU). The MOU provides, among other things.

for completion of the design and enineering for the CANDU 3, including the contribution of

$20 million in matching funds by the Government of Saskatchewan to those being contributed

by AECL. These finds are in addition to the approximately $100 million already spent by

AECL over the past 5 years. In this and other respects, the relationship between the

Government of Saskatchewan and AECL is similar to that between the Department of Energy

and the Advanced Reactor Corporation in the U.S. First-of-a-Kind-Engineering effort. The

MOU represents further progress in the advancement of CANDU technology as embodied in

the CANDU 3. This progress notwithstanding, it is important to understand that our intent to

go forward in the 1995-96 timeframe with an application for certification of the CANDU 3

design in the United States is independent of any schedule for building a CANDU 3 reference

plant in Canada.

The draft Policy Issues Paper discusses the present scope of the CANDU 3 pre-application

review, indicating that the Staff has revised the scope of the issues considered at the

preapplication review stage, limiting them "to those which could affect the licensability of the

proposed design." AECLT is looking to the pre-application review to resolve all issues

identified during the review, in the sense that the PSER identifies the information which
Mr. Dennis M. Crutchfield

Page - 3 -

January 25, 1993

AECLT must provide in the CANDU 3 design certification application in order for the Staff

to successfully complete its review of that application.

AECLT is especially pleased to have the opportunity to comment on the draft Policy Issues

Paper prior to its being finalized for submission to the Comnumission. AECLT would like to

address the six substantive issues identified in the drft paper as relating to the CANDU 3

design; specifically, Accident Evaluation, Source Term, Containment Performance, Operator

Staffimp Positive Void Reactivity and Control Room Design. In formulating these comments,

AECLT has followed the Staffs distinction between Advanced Reactor issues and CANDU 3

issues and, consequently, addressed only those comments specifically applying to the

CANDU 3 desigm These issues are discussed in detail in Attichment I to this letter.

If you have any questions regarding this letter or the attachment, please do not hesitate to

call.

Very truly yours,

A. D. Hink;

Vice President/General Manager

AECL Technologies

Attachments: As stated

cc: Janet Kennedy, NRC

CANDU 3 Project Manager
STAFF RESOLUTION'OF 'COMMENTS ON DRAFT-POLICY PAPER

NRC RESPONSE TO ATOMIC ENERGY OF.CANADA,-LIMITED, TECHNOLOGIES (AECLT)

(See Attachment 1)

Policy Issue'A - Accident'Selection

,(I) The staff did not intend to imply that the frequency of events" - "considered" was' cut off at, 10' per year, but.that the information given

states' [ohn-page' 1-14 ;of-the. 1989 'part of' the, conceptual safety report

(CSR) Part' 3, "Safety Analysis"], "As'in.previous CANDU p6rob'abilistic

'safety asse'sments,'events-with frequencies less than 106 per year are

not conside'red'to be of high enough- frequency.to require a consequence

analysis."-' AECLT pointed out that for at least one case a consequence

evaluation is performed. -This-is the large loss-of-coolant accident

without emergency core'cooling design basis eventused to determine the

containment"'desi n pressure. -AECLT-estimates the frequency of this

event is 7.6x10' per year. The acceptance criteria used by AECLT, for

this dual-failure event, are similar to NRC 10 CFR Part 100 guidelines

as applicable to'design-basis accidents. The staff added this .point to

the text in the policy p'aper.' - .-

In the CANDU 3 CSR submitted to the staff, AECLT identifies four event

categories in Part 3, "Safety Analysis," for consideration in accident

analysis. The first category,'A, is'-used Jin the initial design phase to

'establish 'design requirements for safety systems.- The acceptance

'criteria'for category A events'-include consequence limits similar to

current limits in 10 CFR Part 100... 'The 'second category, B, is based on

probabilistic safetyrassessment and the-'consequences analyses;.will use

realistic:assumptions" [on page 1-11 'of the CSR Part.3], -The',frequency

of 'events in category-B appear to range from 10-1 to 10 -per year based

on the page'1-14Wof the CSR reference tojFigurej-1, "Acceptance

Criteria'for -Probabilistic Safety Assessment Studies." In Section 6.2

of the'April:1988"part of the CSRj in a document titled "CANDU 300 - Systematic.Review. of the' Plant Design, Revision O,".AECLT'states'that

the assessment of events in category B "requires that the risu'lting

event sequence be developed in a realistic fashion, and that the

analysis assumptions be best-estimate'or.design centre." Two additional

categories,'iC and D,-'are described for which an.assessment of the design

is performed."' Category C events-are evaluated to assess the.plaint's

capability to safely shut down,..remove-decay heat, and isolate

containment. Among category D events is the assessment of'catastrophic

failures of large components to assure -that they can be-excluded from

*"the design and analysis basis of the plant. AECLTIhas cnly'submitted

limited information for category A analyses in the CANDU 3 safety.-. --'analysis section.-of .the CSR.: AECLT lists '37 category B events, and notes

that'23 of these,'have not been'assessed as part of -the CPSA'(conceptual

probabilistic safety assessment."'

ENCLOSURE 4
(2) The staff did not intend to imply that reactivity insertion events are

excluded from "consideration" by AECLT, but that consequence analyses

will be necessary for selected event sequences that lead to severe core

damage, even though the estimated frequencies may be less than 10 .6 per

year. The staff revised the text in the policy paper to clarify this

point.

(3) The second reported quotation on page 3 of AECLT's comments does not

appear in Section 5.2 of Appendix C of the CSR but is found in Section

6.2 of the April 1988 document titled "CANDU 300 - Systematic Review of

the Plant Design, Revision 0." Similar words do exist in the 1989 part

of the CSR, as noted in item 1 (above), but the underlined text ("In

those cases where they are, Figure 2 will be extrapolated as

necessary.") does not appear there. Nor does AECLT describe how such a

determination to consider events below 10.6 per year would be made or

what evaluation would be performed. The NRC preliminary review to

identify policy issues has focused on the actual safety analyses

performed for the CANDU 3 design in the 1989 part of the document. The

staff will resolve the inconsistencies in the preapplicant's

documentation as the review proceeds.

(4) The staff agrees that the primary focus of the AECLT analyses is on

design requirements and acceptance criteria for the design of safety

systems. Therefore, the staff believes that the concerns regarding

severe accident assessment, consistent with 10 CFR 52.47, are valid.

(5) The staff agrees that design-basis accidents need to be evaluated in

order to design safety systems, regardless of the perceived frequency of

their occurrence. These are deterministically based scenarios selected

by the designer to establish performance requirements for safety

systems. However, the staff is also concerned that there may be other

events of similar, or perhaps higher, frequency than some of these

events that might lead to unacceptable consequences. This results from

AECLT's proposal to use best-estimate analyses for all events not

grouped into category A as compared to our current practice of using

conservative analysis assumptions for all design basis accidents which

would fall within the category B range. These category B events appear

to fall in the frequency range of 10 1 to 10.6 per year.

(6) As pointed out in the staff's response to comments 1 through 5 (above),

the staff concludes that the AECLT approach seems inconsistent with the

provisions of 10 CFR 52.47 with respect to performing detailed

consequence analyses of severe accidents.

(7) The staff agrees to include CANDU 3 specifically by name in the overall

approach. The staff revised the text in the policy paper accordingly.

(8) In the "recommendation" section of the policy paper, the staff states

that "Methodologies and evaluation assumptions will be developed for

analyzing each category of events consistent with existing LWR

practices." The staff intends to apply "the historical requirement for

- 2 -
conservative analysis for design-basis accidents (DBAs) and best- -

estimate analyses for beyond DBAs." The staff notes that the AECLT

assumption used for categbry-B -events'-may*-be' inconsistent with this

,traditional approach. The staff's intent to use this traditional

approach has been clarified in thete'xt of'the policy iss~ue paper.

Policy Issue B -Source Term

The staff intends to'apply the methodology 'currently being developed in NUREG1465, "Accident'Source Terms for. Light Water Nuclear Power Plants" (a'draft

report issued for comment), to the CANDU'3 'design to the extent possible. The

staff did not intend to imply that a unique method of'assessment was required

for a pressurized heavy-water reactor design, but that direct use of current

LWR source terms might not be appropriate considering the differences in the

designs. The staff revised the text in the policy paper to clarify this

point. - ' -

Policy Issue' C- Containment''

The staff believes this issue applies to CANDU because of the high leakage

allowable, 2 percent per day by test, 'as compared 'to the current criterion of

0.5 percent per day for current-generation'LWRs. - AECLT agrees that this issue

does apply to the CANDU 3 design.

Policy Issue F - Operator Staffing and Function

The staff agrees with the AECLT position and has removed CANDU 3 from the

applicability matrix.

Policy Issue H -Positive Void Reactivity Coefficient

.The issue is whether or not the staff should accept a design in which the

"positive void reactiv'ity'increases dramatically during certain events. The

staff intends to require that AECLT analyze the consequences of events which

could lead to large reactivity insertions. This will include events involving

failure to shut down. -

Policy Issue I - Control Room and Rem'ote Shutdown Area Design

The staff acknowledges AECLT concern-with the issue, but at this time the

staff's recommendation, as presented to the'Commission for guidance, is to

require a seismically and electrically qualified main control room.

- 3 -
NRC RESPONSE TO ASEA BROWN BOVERI-COMBUSTION ENGINEERING

(See Attachment 2)

Policy Issue A - Accident Evaluation

The staff believes that it is necessary to address severe accidents consistent

with the provisions of 10 CFR 52.47 with respect to performing detailed

consequence analyses of severe accidents. The staff has not established a

frequency below which a fault sequence could be dismissed without further

evaluation. As the preapplication review progresses, the staff plans to work

with ASEA Brown Boveri-Combustion Engineering (ABB-CE) to ensure that the

severe accident issue is addressed and that the likelihood and consequences of

these accidents are understood.

Policy Issue B - Source Term

It is the staff's intent to apply the methodology currently being developed in

NUREG-1465, "Accident Source Terms for Light Water Nuclear Power Plants" (a

draft report issued for comment), to the PIUS design to the extent possible.

The staff did not intend to imply that the LWR source terms developed for

pressurized-water reactor designs would be used for PIUS, but that methodology

to evaluate release of radionuclides from the fuel and the subsequent

transport to the environment would be used to assess the design during the

preapplication review. The staff revised the text in the policy paper to

clarify this point.

Policy Issue C - Containment Performance

The staff has revised the technical description of the PIUS containment design

in the text of the policy paper.

Policy Issue D - Emergency Planning

The staff has revised the text in the policy paper to describe the conditions

under which ABB-CE would seek regulatory relief.

Policy Issue E - Reactivity Control System

The staff has revised the technical description of the PIUS scram system

design in the text of the policy paper.

Policy Issue F - ODerator Staffing and Function

The staff is currently recommending that an 'actual control room prototype" be

used for test and demonstration purposes. The staff, as part of its

consideration for design certification, would consider any information

provided by an applicant to determine if such information adequately addresses

staff concerns.

- 4 -
Policy Issue H - Positive Void Reactivity Coefficient

The staff has revised the text.-of the policy paper to indicate that this issue

does not pertain to the PIUS design.

Policy Issue I - Control Room and Remote Shutdown Area Design

The staff has revised the technical description of.the PIUS scram system

design in the text of the policy paper.

- 5 -
NRC RESPONSE TO THE UNITED STATES DEPARTMENT OF ENERGY (DOE)/PRISM DESIGN

(See Attachment 3)

Policy Issue I - Control Room and Remote Shutdown Area Design

The staff acknowledges the U.S. DOE's concern with this issue for the PRISM

design but, at this time, the staff's recommendation, as presented to the

Commission for guidance, is to require a seismically and electrically

qualified main control room.

- 6 -
NRC RESPONSE TO THE UNITED STATES DEPARTMENT OF ENERGY (DOE)/MHTGR DESIGN

(See Attachment 4)

Policy Issue G - Residual Heat Removal

The staff did not intend to imply that the resolution of the treatment of nonsafety-grade equipment resulting from efforts~on the passive light-water

reactor designs would be directly applied to MHTGR. Rather, the-staff notes

that these are ongoing activities-and the staff intends to factor thesestudies into any recommendations concerning the advanced reactor design; also,

as stated in the paper, the.staff "'will assure that NRC regulatory treatment

of non-safety-related backup RHR systems is consistent with Commission

decisions on passive light-water reactor design requirements."

Policy Issue I - Control Room and Remote Shutdown Area DesiWn

The staff acknowledges DOE's concern-with this issue for the MHTGR; but, at

this time, the staff's recommendation' as-presented to the Commission for

guidance, is to require a seismically and electrically qualified main control

room.

Policy Issue J- Safety Classification of Structures. Systems. and Components

The staff acknowledges DOE/MHTGR's concerns on safety classification however

at this time the staff's recommendation, as presented to-the Commission for

guidance, is to maintain the current defense-in-depth philosophy in defining

those structures, systems, and components important to safety.

- 7 -
NRC RESPONSE TO THE GAS-COOLED REACTOR ASSOCIATES (GCRA)

(See Attachment 5)

Policy Issue C - Containment Performance

The staff believes that it is necessary to address severe accidents consistent

with the provisions of 10 CFR 52.47 with respect to performing detailed

analysis of the consequences of severe accidents. The staff has not

established a frequency below which a fault sequence could be dismissed from

further evaluation. As the preapplication review progresses, the staff plans

to work with the preapplicant to ensure that the severe accident issue is

addressed and that the likelihood and consequences of these accidents are

understood.

Policy Issue G - Residual Heat Removal

The staff did not intend to imply that the resolution of the treatment of nonsafety-grade equipment resulting from efforts on the passive light-water

reactor designs would be directly applied to the MHTGR. Rather, the staff

notes that these are ongoing activities and the staff intends to factor these

studies into any recommendations concerning the advanced reactor design. As

stated in the paper, the staff "will assure that NRC regulatory treatment of

non-safety-related backup RHR systems is consistent with Commission decisions

on passive light-water reactor design requirements."

Policy issue I - Control Room Design and Remote Shutdown Area

The staff acknowledges GCRA's concern with the issue; but, at this time, the

staff's recommendation, as presented to the Commission for guidance, is to

require a seismically and electrically qualified main control room.

Policy Issue J-Safety Classification of Structures. Systems, and Components

The staff acknowledges GCRA's concerns about safety classification; however,

at this time, the staff's recommendation, as presented to the Commission for

guidance, is to maintain the current defense-in-depth philosophy in defining

those structures, systems, and components important to safety.

- 8 -
A SUMMARY OF CURRENT'DESIGNSJFOR-THREE

ADVANCED REACTORS AND CANDU 3

. . . . --. ! r ' . .

A. CANDU.3 (CANADIAN DEUTERIUM URANIUM'3) REACTOR.

Develobment History ;

The CANDU 3 is the latest version of'the'pressurized heavy-water reactor

(PHWR) system developed in Canada. The CANDU 3 design evolved from other

CANDU PHWRs, most notably the CANDU, 6design. -The CANDU 3 is a generic

standard design that has retained'many'key components (e.g.',. steam generators,

coolant pumps, pressure tubes', fuel, on-line refueling machines, and

instrumentation) that have been proven in'service on operating CANDU power

reactors. Currently, there are 25 CANDUireactors in operation in 6 different

countries and 19 under construction. -The first CANDU reactor was placed 'in

service in 1968. CANDU'Lexperience to date amounts to more than 175 'years of

effective .ful 1-pow'er'operation.

On May 25, 1989, Atomic Energy of Canada, Limited, Technologies (AECLT)

inform'ed the NRC of its intent to submit the'CANDU 3 reactor design for

standard design certification iniaccordance'with'10 CFR Part 52. AECLT of

Rockville, Maryland, is a wholly owned subsidiary of Atomic Energy of Canada,

Limited (AECL) (a crown corporation of Canada), and is the preapplicant for

the CANDU 3 design. AECL in Canada is also'pursuing standard design

certification of the CANDU 3 with the NRC's'Canadian' counterpart, the Atomic

Energy Control Board of Canada.' AECLT plans to submit a standard design

certification application for CANDU'3 sometime in 1995 or 1996.''

Design Descriction

*The;CANDU'3 -is a 450-MWe, heavy-water-cooled and -moderated,'horizontal

pressure' tube reactor that evolved from the CANDU.'6'design. 'The CANDU 3 uses

deuterium'oxide (heavy water) as a moderator bec'ause-its small 'thermal neutron

capture cross-section allows the use of natural uranium as fuel.' However,

because the'moderation properties'of heavy water'are'not'as good'as light -

water;'the volume ratio of moderator to fuel Is five to eight times-that of an

LWR. Thus, the CANDU core is larger than a light-water reactor .(LWR) core

generating.the same power. _This results in a lower core power density for

CANDU 3. Ir'addition, the'CANDU-3 core is neutronically loosely coupled,

which results'-in xenon-induced flux'tilt'that require's a relatively

complicated computer-6perated spatial flux control' system.

As in LWRs, CANDUL 3 fuel elements consist of pressed and sintered uranium

dioxide pellets enclosed in 'a'zirconiumr'cladding.- Each-'CANDU 3 fuel bundle is

about 20 inches'long,, consists 'of 37 'fuel c'bmpacts, and 'is loaded into each of

the 232 horizontal fuel -chinnels. Each of the 232 horizontal fuel channels

consist's of a pressure tube concentrically placed-inside a-"calandria" tube.

The pressure tubes form part of the reactor'coolant'system'pressure boundary.

Because of the low excess reactivity associated with a natural uranium core,

ENCLOSURE 2
-

the CANDU design must be fueled on a continuous basis during power operation

by an automatic fueling machine. On-line fueling is the primary means of

changing reactivity in the CANDU 3.

For the CANDU 3 design, heavy-water coolant flow through the core is unidirectional, thereby facilitating on-line fueling from one enu of the reactor

with a single fueling machine. The primary system operating pressure

(nominally 9995 kPa/1435 psig) is maintained by a pressurizer connected to one

of the outlet headers. The CANDU 3 light-water secondary system is similar to

that of a pressurized-water reactor (PWR).

The fuel channel assemblies are enclosed in a horizontal, cylindrical vessel

called a calandria that contains the low-temperature (60 CC/140 OF), lowpressure, heavy-water moderator. The calandria vessel, in conjunction with

the integral end shields, supports the horizontal fuel channel assemblies and

the vertical and horizontal reactivity control unit components. The CANDU 3

utilizes four reactivity control systems for reactor control and shutdown

during normal operation, and two redundant and diverse safety-grade shutdown

systems are used for reactor shutdown following a transient. A separate

moderator heat removal system ensures that the moderator remains subcooled.

All systems in the CANDU 3 design are assigned to one of two groups - either

Group 1 or Group 2. The systems of each group are capable of shutting down

the reactor, maintaining cooling of the fuel, and providing plant monitoring

capability in the event that the other group of systems is unavailable.

Group I systems are those primarily dedicated to normal power production. The

Group 2 systems include four special safety systems and other safety-related

systems. These maintain plant safety in the event of a loss, or partial loss,

of Group 1 systems, and mitigate the effects of accidents, including the

design-basis earthquake. The Group 1 and Group 2 systems are, to the greatest

extent possible, located in separate areas of the plant. CANDU 3 employs two

fast-acting, redundant, and diverse Group 2 shutdown systems, separate from

the Group 1 reactor regulating system. Shutdown System No. 1 (SDS1) consists

of 24 vertically inserted control rods. Shutdown System No. 2 (SDS2) consists

of six horizontal nozzles through which a gadolinium nitrate solution is

injected. Both shutdown systems inject into the low-pressure moderator,

precluding a rod ejection accident. In addition to the two shutdown systems,

the remaining special safety systems are a containment and an emergency core

cooling system (ECCS).

The CANDU 3 containment system includes a reinforced-concrete containment

structure with a reinforced-concrete dome and an internal steel liner. The

containment is designed with a test acceptance leakage rate of 2 percent per

day. The ECCS supplies light-water coolant to the reactor in the event of a

loss-of-coolant accident. Each of the four safety systems is required to

demonstrate during operation, a dormant unavailability of less than 10 3 or

about 8 hours per year, and be physically and functionally separate from the

normal process systems and from one another. The CANDU 3 shutdown cooling

system is designed to remove heat from the heat transfer system at nominal

operating temperature and pressure.

- 2 -
B. MHTGR (MODULAR HIGH-TEMPERATURE., GAS-COOLED REACTOR)

Development History.

The modular'high-temperature gas-cooled reactor IMHTGR) was proposed to NRC by

the U.S.- Department of Energy (DOE) in 1986 injresponse to' the Commission's.

Advanced Reactor. Policy Statement (51 FR 24643). A preliminary safety information document (PSID) and 12 amendments were submitted between October 1986

and March 1992. The PSID and 10 of the amendments were reviewed by the Office

of.Nuclear Regulatory Research-and a'draft.preapplication safety evaluation

report (PSER) was issued by NRC in.March 1989. -The Energy-Policy Act of;1992

requires DOE to. submit a preliminary design approval application-by:

September 30, 1996.

The first-commrercial gas-cooled reactors were the graphite-moderated, carbon

dioxide-cooled Magnox reactors developed in-the early 1950s in the United

Kingdom and France. In the United States, gas reactor development resulted in

the-40-MWe Peach Bottom Unit 1, which operated'from=1967 to 1974, and the

330-MWe Fort St. Vrain plant, which' operated from 1976 to 1989. There have

been about 50 gas-cooled reactors in the world totaling about 1000 reactoryears of operation. In this total, there are about 50 reactor-years of

experience with high-temperature gas-cooled reactors (HTGRs).

The BISO and:TRISO (trade'names) multilaye'red microsphere fuel form is used in

HTGRs.: -The BISO fuel form,. a fuel !kernel with two major layers, was used in

Peach Bottom Unit 1; and the TRISO fuel 'form, na fuel kernel with four major

layers (including.a silicon carbide layer), was used at Fort St..Vrain. The

TRISO fuel form provides higher fuel integrity requirements-than'the'BISO fuel

and is the reference fuel for the MHTGR. DOE maintains agreements with

Germany and France for the .exchange of technical information concerning the

integrity of the'reference'MHTGR fuel, and experiments will be -conducted in

France. As part of DOE's Technology Development Program :for the MHTGR, post-

*irradiation testing of development fuel 'at Oak Ridge National Laboratory is

being:performed, and a technical information.exchange agreement-was established withiJapan, which Ais building 'an experimental HTGR.

Major trends in recent HTGR designs, including the MHTGR, are the following:

(1) increased-system pressure, (2) steel'ipressure vessels for the smaller :

HTGRs,- including the MHTGR,; and prestressed'concrete reactor vessels for

larger. HTGR-designs; as Fort St. Vrain;. (3) proposed greater fuel integrity,

with a 6x1O' 5 fraction of failed fuel assumed.'for the MHTGR, and (4) lower

enriched uranium fuel.

Design Description

The standard:MHTGR plant comprises four reactor-steam-generator. modules and

two steam-turbine-generator sets-.. Each module is'designed-for a thermal output of 350 MWt. .The standard 'plant configuration is designed.to produce a.

total'plant electrical output of.540 MWe.;-The'low-power.density (5.9 watts/cc) reactor core is helium cooled and graphite moderated, and uses

ceramic-coated (four major layers) microspheres in an organic-bonded

- 3 -
cylindrical compact as the fuel. The core design is intended to provide a

large negative Doppler coefficient to shut down the reactor with heatup. The

microsphere fuel design is stated to allow fuel temperatures as high as

1593 *C/2900 OF without significant fission product release. The compacts are

placed in small vertical holes in the hexagonal graphite block fuel

assemblies. The fuel assemblies are cooled through passages in the blocks.

There are about 660 graphite blocks in the 66-column, annular core region

between the inner and outer reflector regions. The helium is a single-phase

coolant that is chemically and neutronically inert.

The MHTGR has a below-grade, safety-related reactor building, containing the

reactor and steam generator vessels. The core is in a steel vessel located,

with the steam generator, in the reactor building below ground to reduce

seismic loads. The reactor vessel is above the steam generator vessel to

prevent natural circulation and is connected to this vessel by a horizontal

crossduct vessel. The reactor and steam generator vessels are in separate

cavities. The secondary-side water is superheated in the steam generator.

The core outlet helium temperature is about 704 *C/1300 'F and the steam

outlet temperature is about 540 °C/1005 'F. The secondary-side pressure is

higher (about 17,338 kPa/2500 psig) than that on the primary side (about

6479 kPa/925 psig), so water would leak into the helium coolant should a steam

generator tube leak or fail.

Reactor protection is provided by two safety-related reactor protection

systems (control rods and boron carbide balls), which are diverse and

redundant, and one non-safety-related system (control rods). The non-safetyrelated system is independent from and redundant to the safety-grade systems.

The equilibrium shutdown core temperature would be approximately

121 'C/250 'F, the design temperature for refueling.

The safety-related reactor cavity cooling system (RCCS) is a set of panels

surrounding the reactor vessel with a header connection to four inlet and

exhaust ports above ground. This allows hot air to rise, thus removing heat

transferred from the reactor vessel while cold air is drawn from outside into

the panels. The system (1) is entirely passive with no moving components,

(2) is always operating, (3) automatically responds to rising temperatures

through thermal radiation and natural circulation, and (4) has flow path

redundancy to the cooling panels through a cross-connected header. In

addition, there are two other non-safety-related, active heat removal systems:

(1) the shutdown cooling system in the bottom of the reactor vessel and

(2) the main circulator/steam generator in the primary cooling loop. The nonsafety-related systems are not relied upon for accident safety analyses.

The multiple barriers to fission product release are the coated fuel

microspheres, the graphite blocks, the ASME Code reactor coolant pressure

boundary (RCPB), and the containment. The containment is the reactor building

below ground and has containment isolation valves on the steam generator main

steam and feedwater inlet piping. It will not retain the gases from a rapid

RCPB depressurization, but is designed to have a leak rate of less than

100 percent per day after initial depressurization.

- 4 -
C. PIUS (PROCESS INHERENT ULTIMATE -SAFETY) REACTOR

DeveloDment History

The process inherent ultimate'safety (PIUS) reactor is being designed by ASEA

Brown!Boveri Atom_(ABB-Atom). ' The concept evolved in the early 1980s'from-an

extension-of then ABB-Atom's low-temperature district heating design. In:

October 1989, ASEA'Brown Boveri/Combustion Engineering (ABB-CE) requested a

licensability review of the' PIUS design in accordance with'NUREG-1226, and 'in

May,1990, ABB-CE 'submitted the PIUS preliminary safety information document

(PSID) for staff'review. 'ABB-CE'plans to apply 'for design certificationofthe PIUS design sometime in 1994 or 1995, Assuming 'a favorable preapplication

review.

The'PIUS design concept has already undergone tests 'relatedt'o the design

principles. ABB-Atom has completed testing using the'MAGNE Test Rig to

simulate'such PIUS parameters as diffusion and mixing across the primary

loop/pool boundary'with consideration for'effects of turbulence, stratif-:

ication, and migration of boron, amon'g other effects. Large-scale tests of

such PIUS design'principles as flow and-density lock operation were:done at

the ATLE Test Rig. These tests were used to validate the RIGEL code to

calculate the design's safety and transient performance. ATLE was a fullheight simulation of the PIUS pool. Other tests of the PIUS design principles

have been carried out at MIT and TVA, and additional large-scale tests and a

larger test rig are planned to be started this year for the purpose of design

optimization, as well as special component testing. It is planned that this

larger test rig will serve as the basic test facility for developing data for

the detailed design and verification.

Design Description

PIUS is a 640-MWe advanced pressurized-water reactor (PWR) design with four

loops. It relies on thermal-hydraulic effects to accomplish the control and

safety functions that are usually performed by mechanical means. The safetygrade reactor heat removal system for the PIUS design is completely passive

and is always in operation. The PIUS design consists of a vertical hollow

cylinder, the reactor module, which contains the reactor core. The reactor

module is submerged in a large concrete reactor vessel containing 3,300 m /

870,000 gallons of highly borated water. The reactor module is open to the

borated pool at the bottom and at the top of the reactor module. At these two

openings, density locks keep the borated pool water from the reactor module

during normal operation. Under normal operations, the primary loop reactor

water flows up through the core, out of the top of the reactor module to the

steam generators, and is pumped back into the bottom of the reactor module,

bypassing both the top and bottom density locks. There is no physical flow

barrier in the density locks between the primary loop and the borated pool;

however, the difference in density between the primary loop reactor water and

the cooler borated pool water provides a relatively stationary interface.

When sufficiently upset during transient conditions, such as loss of flow or a

power mismatch, the density difference is overcome and the borated water flows

into the core and shuts down the reactor. A natural circulation flow path is

-5-
then established from the borated pool through the lower density lock, up

through the core, and back into the borated pool through the upper density

lock for long-term shutdown cooling. Borated water can also be injected into

the core through a redundant and diverse scram system consisting of lines

which have been added between the reactor pool and the inlet to the reactor

coolant pumps in each loop. These lines contain two "scram" /alves, in

parallel, that are normally closed. Upon receipt of a scram signal, the

valves open and the imposed pressure difference induces highly borated water

from the pool to flow to the pump inlet. The pumps continue to operate,

thereby injecting highly borated water into the primary circulation loop.

Unlike most reactors, PIUS does not employ mechanical control rods for

regulating reactivity. Reactivity is controlled by the boron concentration

and temperature of the primary loop reactor water.

Other aspects of the PIUS design are similar to the passive LWRs being

considered by the staff (AP-600 and the SBWR). Although PIUS is a PWR, its

operating pressure (8997.6 kPa/1,305 psi) is close to that of a BWR. The

proposed containment for the PIUS design is integral with the reactor

building, similar to the ABWR and SBWR. Leak rate has been defined as not to

exceed 1 volume percent per day at a design pressure of 280.6 kPa/26 psig.

The acceptance leakage value is expected to be 0.5 percent at design pressure.

- 6 -
D. PRISM (POWER REACTOR'INNOVATIVE SMALL MODULE)

Development Hi story

The United States-Department of Energy (DOE)-selected the power reactor

innovative small module (PRISM) design as theadvanced liquid-metal reactor

(ALMR) design to sponsor for.NRC design certification. The conceptual'design

for PRISM was developed by General Electric (GE) Company in conjunction with

an industrial teae of commercial engineering -firms. Research and development

support'is being supplied by'the Argonne National-Laboratory, Energy.

Technology Engineering Center, Hanford Engineering.Development Laboratory, and

Oak'Ridge National Laboratory. ' In addition, a steering group of utility

representatives was involved in the PRISM design effort.

DOE chose to sponsor the PRISM'design ias part of. its National Energy Strategy

because of the design's potential, for enhanced safety through the use of

passive safety systems and greater safety margins, reduced cost through

modular design and construction, and possible future development of an

actinide-recycling capability.' Although this' last alternative has not yet

been proposed in the current application; DOE has supported studies evaluating

the use 'of actinides separated from spent fuel in an advanced 'liquid-metal

reactor (ALMR) fast-flux core.

The PRISM design has considered liquid-metal reactor (LMR) experience to date

developed both nationally and internationally in terms of systems and

components design, reliability-data,-and safety assessments. This experience

consists of operation of a'number of facilities such as, EBR-II, Phenix, the

Fast Flux Test Facility (FFTF), the Joyo reactor in Japan, and others..

The PRISM Preliminary Safety Information Document (PSID) was submitted to the

NRC for review in November 1986, and the results of. an early NRC staff review

was'the 'draft PSER (NUREG-1368) issued in September 1989. In order to' obtain

NRC 'approval of its prototype, DOE plans to apply for preliminary design

approval in 1995.-- DOE also plans -to apply for standard design certification

in 2003 after a prototype demonstration. ;These plans are -based on the current

'DOE goals to-demonstrate the commercial potential for the ALMR by'20110, as

called'for'in the Energy-Policy Act of 1992.

Design Descrivtion :

The PRISM plantadesign consists of threetseparate power blocks each made up of

three reactor modules. -Each module has a thermal-output of 471 MWt and an

electric output of 155 MWe for a total ;(plant) output of 1395 MWe' The PRISM

design contains three turbines, each supplied from a power block. Options for

one'or two power blocks are possible.- PRISM operates at much higher

temperatures than .current LWRs'.which will require a rigorous evaluation of the

effects of creep' and creep rupture -on reactor vessel and systems.- The PRISM

'design also relies on a highly automated-and complex control system utilizing

digital processing. 'The reactor module consists, of the containment system,

'therreactor vessel, the core, and the reactor's internal components.. The

reactor vessel encloses and supports the core, the 'primary"'sodium coolant

- 7 -
system, the intermediate coolant system heat exchangers (IHXs), and other

internal components. The vessel is' located just inside the containment

vessel, which is located below grade in the reactor silo. The reactor vessel

is penetrated only in the closure head. The head is supported by the floor

structure, and the floor structure is supported by seismic isolator bearings

to reduce horizontal movement during seismic events. The upper head of the

reactor vessel is the closure head. The closure head also supports the

intermediate heat exchangers (IHXs) and the electromagnetic (EM) pumps.

The'main components of the nuclear steam supply system (NSSS) in PRISM are the

reactor module, primary sodium loop, EM pumps, IHX, intermediate sodium loop

and steam generators (SGs). The primary sodium loop is contained completely

within the reactor vessel, which is hermetically sealed'to prevent leakage of

the primary coolant. The EM pumps provide the primary sodium circulation.

Synchronous machines provide flow coastdown capability to the EM pumps. Flow

coastdown is very important for preventing sodium boiling during a loss of EM

pump power without reactor- scram. Reactor-generated heat in the primary loop

is transferred through the IHX to the intermediate heat transfer system.

(IHTS). IHTS sodium is circulated by a centrifugal pump. The IHTS operates

at a higher pressure than. the primary loop so that, in case of a tube rupture

in'the IHX, the sodium would not flow;out of the reactor vessel. A pressure

of approximately 204.7 kPa/15 psig is used to'ensure a minimum 69.5 kPa/10-psi

positive pressure differential across the IHX from the IHTS to the PHTS is

maintained. A sodium-water reaction protection system mitigates the effects

of reactions between IHTS sodium and water in the SG.

The reference fuel for the ALMR is a uranium-plutonium-zirconium (U-Pu-Zr)

alloy. The ferritic alloy-HT9 is used for cladding and channels to minimize

swelling caused by high burnups. The PRISM-core is a heterogeneous

arrangement of driver fuel and blankets.

The PRISM core is designed so that the net power reactivity feedback is

negative in all ranges of operation, in all transients, and in all accidents

not involving voiding. For certain very-low-probability accident scenarios

involving sodium boiling, a positive void coefficient dominates and a net

positive feedback can occur. In all other situations without-extensive

voiding, an increase in temperatures produces negative feedbacks from Doppler

and thermal expansion of the core and related structures that dominates the

positive moderator density coefficient. The net negative temperature

coefficient is so large that analyses predict all non-boiling transients and

accidents to be terminated by the temperature feedback reactivity at

temperatures'low enough to not threaten fuel or vessel integrity. This

passive shutdown function allows the reactor to sustain all non-boiling

transient scenarios without damage, even with a failure to scram.

There are six control rods in the main reactivity control and shutdown system.

Inserting any one of the six will shut the core down. The control rods can be

inserted using (1) the plant control system (PCS) for normal insertion,

(2) the safety-grade reactor protection system (RPS) for rapid insertion, and

(3) gravity drop into the core. If both the normal and safety-grade systems

fail, the operator can activate the ultimate shutdown system (USS) which sends

- 8 -
boron balls into the central location of the core causing shutdown independently of the control rods. The PRISM design also includes passive mechanisms

for controlling reactivity: three gas expansion modules (GEMs) consisting of

tubes, closed at the top and open at the bottom, and filled with helium. If

the pumps are running, the static pressure is high, causing the sodium level

to rise to a high point in the GEM. However, .with the pumps off, the static

pressure and sodium level drop, which increases neutron leakage. The reactivity change provided by the GEMs between these two states is about -70¢.

Normal shutdown cooling is achieved with the non-safety-grade condenser. If

the condenser becomes unavailable, the safety-grade reactor vessel auxiliary

cooling system (RYACS) is used for RHR. The RYACS cools the containment

vessel by means of natural air circulation. The design-basis RVACS event

assumes that the normal and auxiliary heat removal systems, as well as the

intermediate heat transport system (IHTS) sodium, are lost immediately

following reactor and primary EM pump trips. The preapplicant's analysis

shows that the RVACS heat removal rate is sufficient to maintain fuel

temperatures within acceptable limits, and temperatures of the internal

structures within the reactor vessel under American Society of Mechanical

Engineers (ASME) Level C conditions. The PRISM design also contains the nonsafety-grade auxiliary cooling system (ACS) to assist the RVACS. The ACS uses

natural circulation within the steam generator (SG) to remove heat indirectly

from the reactor vessel, and the natural circulation of air to cool the SG,

with heat rejected directly to the atmosphere. The ACS can be used in

combination with the RVACS to reduce the cooldown time. Some of the inherent

safety characteristics of the PRISM design with respect to RHR are (1) the

favorable combination of viscosity, thermal conductivity, and vapor pressure

associated with the use of sodium to remove heat, (2) the ability to operate

at essentially ambient pressure, thus reducing the pressure exerted on the

coolant system boundaries, and (3) operation far below the sodium boiling

temperature, thus obtaining the operational and analytical simplicity

associated with a single-phase coolant.

- 9 -
COMMISSION PAPERS AND OTHER NRC DOCUMENTS PERTINENT TO TREATMENT

OF ADVANCED REACTOR AND CANDU 3 POLICY ISSUES

* SECY-86-368, "NRC Activities Related to the Commission's Policy on

the Regulation of Advanced Nuclear Power Plants," December 10, 1986

* SECY-89-350, "Canadian CANDU 3 Design Certification," November 21,

1989

* SECY-90-016, "Evolutionary LWR Certification Issues and their

Relationship to Current Regulatory Requirements," January 12, 1990

* Draft Commission paper, "Issues Pertaining to Evolutionary and

Passive Light Water Reactors and Their Relationship to Current

Regulatory Requirements," February 27, 1992

* Draft Commission paper, "Design Certification and Licensing Policy

Issues Pertaining to Passive and Evolutionary Advanced Light Water

Reactor Designs," July 6, 1992

* SECY-90-055, "PIUS Design Review," February 20, 1990

* SECY-91-074, "Prototype Decisions for Advanced Reactor Design,"

March 19, 1991

* SECY-91-161, "Schedules for the Advanced Reactor Reviews and

Regulatory Guidance Revisions," May 31, 1991

* SECY-91-202, 'Departures From Current Regulatory Requirements in

Conducting Advanced Reactor Reviews," July 2, 1991

* SECY-92-393, 'Updated Plans and Schedules for the Preapplication

Reviews of the Advanced Reactor (MHTGR, PRISM, and PIUS) and CANDU 3

Designs," November 23, 1992

* NUREG-1338, "Draft Preapplication SER for the MHTGR," March 1989

* NUREG-1368, "Draft Preapplication SER for PRISM,' September 1989

* NUREG/CR-5261, "Safety Evaluation of MHTGR Licensing Basis Accident

Scenarios," April 1989

* NUREG/CR-5364, Summary of Advanced LMR Evaluations-PRISM and SAFR,"

October 1989

* NUREG/CR-5514, 'Modeling and Performance of the MHTGR Reactor Cavity

Cooling System," April 1990

* NUREG/CR-5647, "Fission Product Plateout in the MHTGR Primary

System,' April 1991

ENCLOSURE 3
* NUREG/CR-5815, "Evaluation of 1990 PRISM Design Revisions," March

1992

* NUREG-1226, "Development and Utilization of the NRC Policy Statement

on the Regulation of Advanced Nuclear Power Plants," June 1988

* NUREG-0444, "BEIRMOD, a Computer Program for Calculating the Effects

of Exposure to Ionizing Radiation," May 1978

- 2 -