7U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

Briefing on DesignAcceptance Criteria

R.W. Borchardt

Executive Director for Operations

November 5, 2010

<?•U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

Design AcceptanceCriteria

Thomas A. Bergman

Director, Division of Engineering

Office of New Reactors

November 5, 20 10

Agenda

* Recent developments

* Background on design acceptancecriteria (DAC)

" DAC and digital instrumentation andcontrols (l&C)

" DAC closure process

" Conclusions

3

ACRS Letter August 9, 2010

• Underlying concerns with DAC- Leaving DAC open until post-Combined

License (COL)- Relationship between level of design

detail and safety- DAC lack specificity and over-used

- Digital I&C systems have changed sinceDAC conceived

- Require expertise and judgment to close

4

ACRS Letter (cont'd)

* Recommendation 1- Expertise required for DAC inspections

- Independent assessment by A CRS

* Recommendation 2Limit DAC resolved post-COL issuance

Consistent scope and depth of evaluationregardless of when DAC closed

5

Staff Response- October 7, 2010

" Recommendation 1Agree technical expertise requiredPropose role for A CRS in DA C closureconsistent with past practice

* Recommendation 2- Agree preferable to close DAC early- Agree to consistent scope and depth of

evaluation

6

Staff Response (cont'd)

* Assessment of other issues:- Safety finding made on entire

application, not just DAC- Continue to allow use of DAC where

appropriate

- Use technical expertise and soundprocedures to verify DAC implementation

7

DAC Policy

• Consistent over past 20 years- DAC should be objective- Design certification, including one that

relies on DAC, is final safetydetermination

- Additional design detail developed tosatisfy DAC will not alter safetyconclusion

- Limited to a few areas* DAC policy periodically reaffirmed

8

Use of DAC for Digital I& C

" Used in all four certified designs

* Used in all but one designcertification under review

* Design flexibility is desirable

" Use appears to be declining

" Newer designs may not be amenableto DAC

9

DAC Closure VerificationProcess

* Verify completion of the licensee'sactivities to meet DAC

* Resultant design must meet both:- Acceptance criteria in DAC- Licensing basis

10

DAC Inspections

• All DAC are inspected

* Use inspection procedures developedspecifically for DAC

" Use subject matter experts for DACinspections

* Digital I&C inspection proceduresbeing tested with South TexasProject (STP) applicant

11

Staff Proposal to A CRS

* ACRS involvement in inspectionprogram for DAC- Similar to approach for Reactor

Oversight Process (ROP)

- Discuss strategy for program

- Review inspection procedures- Review first implementation of STP

12

Conclusion

* Safety finding made on entireapplication, not just DAC

" Continue to allow use of DAC whereappropriate

" Use technical expertise and soundprocedures to verify DACimplementation

13

Acronyms

* ACRS - Advisory Committee onReactor Safeguards

" COL - Combined License" DAC - Design Acceptance Criteria" I&C - Digital Instrumentations and

Con trots* ROP- Reactor Oversight Process" STP- South Texas Project

14

U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

ACRS MEETING WITHTHE U.S. NUCLEAR

REGULATORYCOMMISSION

November 5, 2010

I U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

Overview

&ad•rMKhahk

Accomplishments• Since our last meeting with the

Commission on June 9, 2010, weissued 15 Reports:

* Topics:- Closure of DAC for New Reactors

- Draft Final Rule for Risk-Informed Changes toLOCA Technical Requirements (10 CFR50.46a)

- Mixed Oxide Fuel Fabrication Facility

- Application to Amend the Certified ABWRDesign to Incorporate the AIA Rule

- Long-term Core Cooling for the ESBWR3

* Topics (cont.):- Closure Options for GSI-191- Final SER Associated with the

ESBWR Design CertificationApplication

- SER Related to the South TexaProject COLA Referencing theCertified ABWR Design

- Risk-informed Regulatory Guidfor New Reactors

- Digital I&C Interim Staff GuidiLicensing Process (ISG-6)

IS

vance

mnce on

4

* Topics (Cont.):Final SERs Associated with the LicenseRenewal Applications for:" Cooper Nuclear Station" Duane Arnold Energy Center

Regulatory Guides* RG1.216, Containment Structural

Integrity Evaluation for InternalPressure Loadings Above Design-Basis Pressure

* RG 3 74, Guidance for Fuel CycleFacility Change Processes

Standard Review Plan, NUREG 1520,Fuel Cycle Facility License Applications

5

License Renewal

• Completed review of Cooper andDuane Arnold

* Completed interim reviews and willperform final review of Kewaunee,Palo Verde, and Hope Creek

* Will perform interim and final reviewsof Crystal River, Salem, DiabloCanyon and Columbia in CY 2011

* Will review updates to the GALLReport and associated SRP

7

Power Uprates

• Will review the Nine Mile Point andPoint Beach Extended Power UprateApplications

* Will review associated topicalreports such as:

- RAMONA5-FA, "'A Computer Program forBWR Transient Analysis in the TimeDomain"Supplements to NEDC-33173P-A,"Applicability of GE Methods toExtended Operating Domains"

8

IU.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

ABWR Aircraft ImpactAssessment

Said Abdel-Khalik

Aircraft Impact Assessment

* New nuclear power plantapplicants must perform an aircraftimpact assessment (AIA - 10 CFR50m150)

* AIA does not need to be submittedto NRC, but will be subject toinspection by the NRC

11

* Realistic analyses to identify andincorporate design features andfunctional capabilities needed toshow that, with reduced use ofoperator action:- Reactor core remains cooled or

containment remains intact

- Spent fuel cooling or spent fuel poolintegrity is maintained

12

ABWR Amendment

* STP Application to amend ABWRdesign to address AIA submitted onJune 30, 2009

* Future COL applicants can addressthe requirements of 10 CFR 50-150by referencing amended ABWRstandard design

13

* ACRS Reviewed:- AIA made available by the applicant- Associated safety evaluation and

inspection report

* Review process to be followed forother design centers

14

September 20, 2010 ACRS Report" Staff inspection of the applicant's

AIA was thorough - maintainingsame personnel with high-levelskill in reviewing the applicationand performing the inspectionsignificantly enhanced quality

* The application and SER areacceptable subject to satisfactoryclosure of the issues identified inthe Notice of Violation & ourRecommendation

15

September 20, 2010 ACRS Reporti The staff should ensure that the

applicant demonstrates that thetemperature within the fire-protectedarea where the AFI system instrumentrack is to be located will not exceed theinstruments' environmental qualificationconditions

* The staff should ensure that theassumptions and initial conditionscredited in the applicant's AIA areproperly incorporated into the amendedDCD

16

September 20, 2010 ACRS Reporti The staff should ensure that COL

applicants referencing thisamendment have an appropriateprocess to assure the reliability ofthe AFI system

• The staff should complete thelessons-learned review to identifyany deficiencies in the AIAInspection Procedure and theindustry AIA methodology

17

$~US.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

Risk-Informed Changesto Loss-of-Coolant

Accident TechnicalRequirements (§ 50.46a)

William J. Shack

Bacakground* In March 2003, the Commission

approved the staff's recommendationsrelated to possible changes to LOCArequirements and directed the staff toprepare a proposed rule (§ 50.46a) thatwould provide a risk-informedalternative maximum break size

" ACRS Nov. 16, 2006, letterrecommended that the 2006 version ofthe proposed rule not be issued

" The staff further met with ACRS in May2009 and SeptemberlOctober 2010

19

Overview of the - 50.46a Rule" ECCS Analysis Requirements

" Breaks < Transition break size(TBS)-No change from current §50.46

* Breaks > TBS- No single failure assumption

- Credit for offsite power

- Credit for non-safety equipment

- Alternative metrics for "coolablegeometry" may be used, if justified

20

Overview of the § 50.46a - Cont.Risk-Informed Acceptance Criteria

* For changes submitted for NRCreview-,"very small" cumulative risk increase

* For self-approved changes- "minimal" risk increase

- §50.59 is satisfied

* For all changes- defense-in-depth

- safety margins

- monitoring program21

ACRS Letter November 16, 2006, onNeeded Revisions to Proposed Rule

* Needed to strengthen theassurance of defense in depth forbreaks beyond the transition breaksize (TBS)

* Magnitude of the increases in riskthat could occur due to changesthat did not require prior NRCapproval inconsistent with usualRG 1.174 guidance

22

ACRS Letter November 16, 2006,on Needed Revisions to ProposedRule

" Needed to address revised 50.46(b)guidance for cladding failure

* Needed to perform plant-specificanalyses to assure applicability ofNUREG-1829 and NUREG-1903results on transition break size

23

Resolution of ACRS Commentsin Draft Final Rule

" Requires licensees submit thecodes used for the analyses ofbreaks beyond the TBS to the NRCfor review and approval

* Process for changes that can bemade without prior NRC approvalhas been revised and is nowacceptable

24

Resolution of ACRS Commentsin Draft Final Rule (cont)

* Rule still reflects current 50.46(b)cladding failure criteria. However,additional research has increasedour understanding and a Notice ofAdvanced Rulemaking has beenpublished and staff acknowledgesrule will have to be revised if50.46(b) is updated. We now find itacceptable to proceed

25

Resolution of ACRS Comments inDraft Final RuleRequires plant specific demonstrationthat results of NUREG-1829 andNUREG-1903 for transition break sizeare applicable

- August 23, 2010, version required onlydemonstration that results on direct breaksizes are applicable

- In response to ACRS comments theSeptember 27, 2010, version was revised toalso require a demonstration that results onindirect break sizes are applicable

26

Resolution of ACRS Commentsin Draft Final Rule (cont)

* With these changes we find DraftFinal Rule 50.46a an acceptablerisk-informed alternative to thecurrent 10 CFR 50.46(a) foroperating reactors

27

Application of Risk-Informed 50.46ato New Reactors" Current version of Draft Proposed Rule is

applicable to new reactors

- TBS determined on a plant-specific basis

" ACRS agrees that improved material selection,water chemistry, and design practices willfurther reduce the likelihood of large LOCAs

* Premature to extend the proposed 10 CFR50.46a to new reactors at this time- Risk profiles are significantly different from

current reactors

- Appropriate risk metrics and riskacceptance criteria are still being developed

28

Application of Risk-Informed 50.46ato New Reactors (Cont)* Risk informed changes should notresult in a significant decrease inthe level of safety otherwiseprovided by the certified design

- Language is consistent with Option 2of recent SECY, but even if approvedby Commission specific guidancewould need to be developed

- Rule should be based on specificguidance rather than a concept notyet clearly defined

29

Application of Risk-Informed50.46a to New Reactors (Cont)* If new reactors are included in thescope of the rule, then therequirement that the adoption ofthe rule should not result in asignificant decrease in the level ofsafety should apply to all risk-informed elements includingdetermination of allowable timewithout capability to mitigate abeyond-transition break size LOCA

30

U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

MOX Fuel Fabrication

Facility

Dana Powers

Background" Mixed oxide (MOX) .facility beingbuilt for the U.S. DOE by MOXServices, LLC at Savannah RiverSite

* Will convert weapons-grade PuG2

to MOX fuel for use in commercialnuclear power plants

32

Backqround (Cont)" Strategy for processing plutoniumand fabricating fuel is patternedafter system used in France

" Builds upon substantial U.S.experience with use of PUREXprocess

* MOX process is simpler, no largeinventory of fission and neutroncapture products

33

Background (Cont).* NRC review process involves twostages:

-Construction Authorization Request

-License to possess and use specialnuclear materials

34

ACRS Report, February 24, 2005ACRS previously reported onSafety Evaluation of ConstructionAuthorization Request

highlighted the need for the licenseapplication to address criticality,hydroxylamine nitrate, the "red off'phenomena, and glove box fires

35

ACRS Report, September 27, 2010• Recent review of safety strategies

revealed no deficiencies- Adequate shielding and filtration to

protect the public

Uses practices that have been provedeffective

Had gone beyond Defense NuclearFacilities Safety Board recommendations

36

ACRS Report, September 27, 2010(Cont)* The Staff has prepared an adequate

Safety Evaluation Report for theMixed Oxide Fuel Fabrication Facilityand the report should be issued

* The proposed facility can beconstructed, operated, andmaintained with no undue risk to thepublic health and safety

37

Path Forward* Construction of the facility will

be verified by inspection prior togranting a license to possess anduse special nuclear material

* The ACRS will revisit the safetyevaluation of the MOX facility asconstruction approachescompletion

.38

U.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

ESBWR Long-Term CoreCooling

Michael L. Corradini

- On May 8, 2008, the Commissionrequested the ACRS to advisethe staff and Commission on theadequacy of the design basislong-term core cooling approachfor each new reactor designbased, on either its review ofthe design certification or thefirst license applicationreferencing that reactor design

40

• The ESBWR is an advancedlight water reactor design thatuses a direct-cycle powerconversion system driven bynatural circulation in thereactor vessel

41

* A passive ECCS is designed toperform its intended functionwithout the need of emergency ACpower systems for core coolingduring the first 3 days following areactor transient or accident. Thedesign employs IsolationCondensers and a PassiveContainment Cooling System (PCCS)to transport heat to the ultimateheat sink for all accident scenarios.

42

e The ESBWR design has a long-term core cooling mode that isqualitatively different fromcurrent reactors, since itspassive safety systems canrespond to a design basisaccident without recirculationthrough the suppression pool.

43

Schematic of ESBWR Containment

[L NOE)- -:,. .,-GDCS Pool

Ii I- - -- Spillover Pipes

44

* The generic issues that havenormally raised concerns forlong-term core cooling in arecirculation mode for theECCS are not present in thisdesign because of thefollowing:

45

-No fibrous insulation is used inthe plant design, allcontainment surface coatingsare qualified, and no complexwater chemistry is presents

46

- The debris which reaches thesuppression pool is not transportedto the PCCS. The recirculationcooling path for long-term corecooling is wet steam into thePCCS, condensate from there tothe Gravity-Driven Cooling System,and then back to the reactorvessel.

47

Conclusion* ACRS concurs with the staff's

assessment that the regulatoryrequirements for long-term corecooling for design basisconditions have been adequatelymet and this issue can be closedfor ESBWR

48

iU.S.NRCUnited States Nuclear Regulatory Commission

Protecting People and the Environment

Closure of DesignAcceptance Criteria for

New Reactors

Dennis C. Bley

ACRS Report, August 9, 20101. DAC closure requires expertise,

judgment, and interpretation. Itshould be performed by NRC staffexperts with an independentassessment by the ACRS

2. It is preferable that all DAC beresolved no later than the COLstage. However, whether resolvedas part of the COL process or post-COL, proper closure of DAC requiresa consistent scope and depth ofevaluation in accord with our firstrecommendation

50

Background" Statements of Consideration (SOC)

for 10 CFR Part 52 state that EarlySite Permit, Design Certification, andCOL processes do not eliminate anymaterial safety issue fromconsideration, they just move -theirresolutions to earlier review stages

* In essence, NRC cannot allowoperation of a nuclear power reactorunless all material safety issues areresolved

51

Statements of Consideration"The Commission does not believethat it is prudent to decide now, beforethe Commission has even once gonethrough the process of judgingwhether a plant built under acombined license is ready to operate.,that every finding the Commission willhave to make at that point will be cut-and-dried-proceeding according tohighly detailed "objective criteria"entailing little judgment and discretionin their application, and not involvingquestions of 'credibility, conflicts, andsufficiency"'

52

Background" Part 52: conformance with

certified design verified throughITAAC

• Practicalities led staff to developconcept of special kind of ITAACcalled DAC

" DAC, as presently constituted, areclearly among those issues forwhich judgment will be required inorder to reach a finding that theacceptance criteria have beensatisfied

53

History of DAC* SRM on SECY-90-377

"Requirements for DesignCertification under 10 CFR Part52"- Applications for design certification

reflect a design that is completeexcept to accommodate as-procuredhardware characteristics

* 1990 ACRS Report on SECY-90-377-Agreed with process and

recommended that the staff focus thescope on that needed for safety

54

History of DAC* The concept of DAC was

introduced in SECY-92-053, "Use ofDAC During 10 CFR Part 52 DesignCertification Reviews," datedFebruary 19, 1992, and written inresponse to the Commission's SRMon SEC Y-90-3 77, datedNovember 7, 1991- identified need- identified potential pitfalls

55

History of DAC - SECY-92-053" Defined DAC as a set of prescribed

limits, parameters, procedures, andattributes in a limited number oftechnical areas

" DAC were to be objective(measurable, testable, or subject toanalysis using pre-approvedmethods) and were to be sufficientlydetailed to provide an adequate basisfor the staff to make a final safetydetermination regarding the design

56

History of DAC - SECY-92-053

* Recognized that "...although thereis nothing in Part 52 which wouldnecessarily limit the use of DAC,the staff believes that the use ofDAC should be limited"

o "restrictions should be based upona consideration of those designareas affected by rapidly changingtechnologies"

57

ACRS Feb 14, 1992, Report" Supported limited DAC approach

* Carefully defined limits relating toscope and extent of designcoverage should be placed on theuse of DAC

" Use of DAC should be limited tothat portion of each given designfeature where either thetechnology is still evolving or therequired information is unavailablefor good reason

58

ACRS Feb 14, 1992, Report• In any case, DAC should be used

only when it is possible to specifypractical and technicallyunambiguous criteria

" DAC can hide unforeseen systemsinteractions that might beuncovered if an actual design wereavailable

59

ACRS Feb 14, 1992, Report"If DAC are employed extensivelyin lieu of design detail, this wouldplace an additional design burdenon the COL holder and create apossible discontinuity in thedesign and review process thatmay be adverse to safety"

60

History of DAC* Later in the same year ACRS formed

an Ad Hoc Subcommittee on DAC inresponse to a Commission SRMissued on April 1, 1992. Staff andthe ACRS appear to have come toquick agreement on RadiationProtection, Piping Design, andControl Room Design (now part ofHuman Factors Engineering) forABWR DAC. I&C DAC were moretroublesome and never appear tohave been completely resolved

61

ACRS Oct 16, 1992, Report"Finally, we are concerned about thesignificant number of post-designcertification activities associated withthese two DACs - control room design,and I&C. The COL applicant or holderwill be responsible for carrying outthese activities. This will involveextensive future negotiations with thestaff. It will also have the effect ofdiminishing the value of certifieddesigns and seems to us to becontrary to the spirit of 10 CFR Part52" 62

ACRS Oct 16, 1992, Report"We believe that the argument thatthese DACs represent areas ofrapidly changing technology isbeing overplayed by both the staffand GE in justifying the extent towhich the DAC process is beingused"

63

ACRS Expectations" DAC would be limited to the extent

possible and generally closed bythe time of the COL issuance

" For DAC to be closed after COL andbefore fuel load, Staff evaluationof ITAAC used to close DAC wouldbe thorough

" ACRS would be involved in Staffevaluation of DAC closure, at leastfor the first applications

64

Observations for DI&C DAC" DI&C systems for new designs are

highly integrated and pervasive,affecting nearly all plantequipment

* Unanticipated failure modes couldcreate very confusing situationsthat could place the plant or leadoperators to place the plant inunexpected or unanalyzedconfigurations

65

Observations for DI&C DAC" Five keys to reliability of DI&C

-Essential objective design principles:redundancy, independence,determinant data processing &communication, defense-in-depth &diversity

-Subjective attribute, simplicity

* DI&C design can be functionallyspecified and shown to meet theessential criteria regardless of theparts technology

66

Observations for DI&C DAC" Some essential design principles

(e.g., redundancy & defense-in-depth) can be specified infunctional block diagrams in DCDand verified by objective ITAAC

" Some (e.g., determinant dataprocessing) must be confirmed asimplemented in the final design ofthe DI&C systems

67

Observations for DI&C DAC" Despite ability to eliminate many

DI&C DAC from designcertifications or COL applications,most are not planned to beresolved until after COL issuance

" More DAC than necessary

68

Observations for DI&C DAC" Many current DI&C DAC are not

technically unambiguous" Many DI&C DAC are process

oriented, but only an evaluation ofthe complete design can reveal theintricacies of possible interactionsand failures, especially commoncause and other dependent failuremechanisms

69

ACRS Report, August 9, 20101. DAC closure requires expertise,

judgment, and interpretation. Itshould be performed by NRC staffexperts with an independentassessment by the ACRS

2. It is preferable that all DAC beresolved no later than the CombinedLicense (COL) stage. However,whether resolved as part of the COLprocess or post-COL, proper closureof DAC requires a consistent scopeand depth of evaluation in accordwith our first recommendation

70

ACRS Report, October 20, 2010* If applicant provides additional

descriptive information--integratedsystem logic diagrams and detailedfunctional descriptions--reviews wouldbe simpler and safety judgments morerobust

* Lack of sufficient ESBWR DI&Cdesign information led to commitmentto revise DCD with sufficientexpanded functional descriptions andDACIITAAC to support safety finding

71

Path Forward" Several subcommittees are

struggling with DI&C DAC" We are following the work of staff's

Task Working Group on DACClosure

P Subcommittee meeting October 21,2010, staff presented examplesand discussed state of plans forDAC closure

72

Abbreviations

ABWR Advanced Boiling Water ReactorAC Alternating CurrentACRS Advisory Committee on Reactor

SafeguardsAFI Alternate Feedwater InjectionAIA Aircraft Impact AssessmentAPWR Advanced Pressurized-water ReactorAPIO00 Advanced Passive 1000BWR Boiling Water ReactorCAP Containment Accident PressureCFR Code of Federal RegulationsCOL Combined LicenseCOLA Combined License ApplicationCY Calendar YearDAC Design Acceptance CriteriaDC Design CertificationDCD Design Control DocumentDI&C Digital Instrumentation & ControlDOE Department of EnergyECCS Emergency Core Cooling SystemEPR Evolutionary Power ReactorESBWR Economic Simplified Boiling Water

ReactorGALL Generic Aging Lessons LearnedGE General Electric

GSIISAI&CISGITAAC

LOCALTRMOXNRCPCCS

PRAPU02PUREXRGSECYSERSOARCA

SOCSRM

SRPSTPTBS

Generic Safety IssueIntegrated Safety AnalysisInstrumentation & ControlInterim Staff GuidanceInspection, Test, Analysis, AndAcceptance CriteriaLoss of Coolant AccidentLicensing Topical ReportMixed OxideNuclear Regulatory CommissionPassive Containment CoolingSystemProbabilistic Risk AssessmentPlutonium DioxidePlutonium - Uranium ExtractionRegulatory GuideSecretary of CommissionSafety Evaluation ReportState-of-the-Art ReactorConsequence AnalysesStatements of ConsiderationStaff RequirementsMemorandumiMemorandaStandard Review PlanSouth Texas ProjectTransition Break Size

73