September 14, 2000
The Honorable Richard A. Meserve
U.S. Nuclear Regulatory Commission
Washington, DC 20555-0001
Dear Chairman Meserve:
|SUBJECT:||PRE-APPLICATION REVIEW OF THE AP1000 STANDARD PLANT DESIGN - PHASE I|
During the 475th meeting of the Advisory Committee on Reactor Safeguards, August 29-September 1, 2000, we discussed the results of the staff's pre-application (Phase I) review of the Westinghouse Electric Company's proposed AP1000 Standard Plant Design. During this meeting, we had the benefit of discussions with representatives of the staff and of the documents referenced. A list of our issues that need to be addressed during the AP1000 pre-application review was sent to the NRC Executive Director for Operations on June 21, 2000.
Westinghouse plans to seek certification of a 1000 MWe nuclear plant similar to the certified AP600 design, and seeks NRC feedback on the scope and cost for review and certification of the AP1000 design. The NRC and Westinghouse have agreed to a three-phase review approach. Phase I is to: identify the review assumptions and issues that need to be evaluated; identify the information necessary to evaluate the assumptions and issues; estimate the resources required to perform the Phase II review; and provide a schedule for the certification review.
In a letter dated May 31, 2000, Westinghouse identified five "fundamental assumptions" for evaluation by the staff during Phase II review:
|1.||The AP1000 Design Certification Application will reference sections of the AP600 Design Control Document that do not change for AP1000.|
|2.||The AP1000 Design Certification Application will not require additional tests to be performed by the applicant.|
|3.||The AP1000 Design Certification Application can utilize the AP600 analysis codes with limited modifications.|
|4.||The AP1000 Design Certification Application can utilize the AP600 probabilistic risk assessment (PRA) supplemented with a sensitivity study to meet the requirements for a plant-specific PRA.|
|5.||The AP1000 Design Certification Application can defer selected design activities to the Combined License (COL) applicant.|
In its Phase I assessment, the staff addressed these assumptions and provided Westinghouse with expectations on information that must be provided to the staff to assess the validity of these assumptions.
|1.||The PRA should include uncertainty distributions on core damage frequency, conditional containment failure probability (CCFP), and large, early release frequency (LERF).|
|2.||The seismic analysis should not be left solely to the COL applicant and should be included in the PRA using a representative site.|
|3.||The applicant's results from the codes NOTRUMP, WCOBRA/TRAC, LOFTRAN, and WGOTHIC for the design basis accidents should be accompanied by uncertainty assessments.|
|4.||The staff should obtain and exercise the above codes to assist its independent evaluation and validation of these codes.|
The staff has done a commendable job of determining the information it will need to assess the five assumptions proposed by Westinghouse, and we generally agree with the staff's initial positions on these assumptions. We are concerned, however, that the staff may not be requesting sufficient information to conduct the certification review without undue reliance on judgment. Because the applicant does not plan to perform additional tests, certification of the AP1000 will be more dependent on the results of analyses than was the case for the AP600.
In a Staff Requirements Memorandum of July 21, 1993, the Commission approved the use of a CCFP goal of 0.1 along with a containment performance goal for advanced light-water reactor designs. Westinghouse, for points of reference in development of the AP600 PRA, used a LERF goal of 10-6 per year as well as the CCFP goal of 0.1.
The AP600 PRA reported an overall LERF of about 10-8 per year and a CCFP of about 0.1. While this low value of LERF was comforting, it was based on new systems and components [passive emergency core cooling system (ECCS) combined with active systems, reactor vessel external flooding, etc.] for which there was little experience. Thus, the CCFP and LERF results for the AP1000 are likely to be subject to much greater uncertainty than that associated with current operating plant PRA results. With "reasonable" variation of parameters, the staff estimated that the AP600 CCFP could have easily been 0.5 at a reasonable confidence level. The design changes along with the increased plant size and power rating of the magnitude proposed will negatively impact both the LERF and the CCFP as well as increase the uncertainties associated with these acceptance parameters.
Increasing the height of the containment and the quantity of water in the tank on top may well increase the vulnerability of the AP1000 containment to seismic events. Both selections of site characteristics and seismicity are challenges to the conduct of a PRA for the AP1000 that includes external event initiators. It is most important that artificial uncertainty not be injected into the PRA results by including bounding ranges of site characteristics and seismicities. A representative site and representative seismicity for the recommended PRA would be satisfactory.
We are concerned that the AP1000 defense in depth associated with a CCFP goal of 0.1 might be unduly compromised by the increase in plant size and the uncertainties could be much greater than those for the AP600. If the staff is to properly assess the AP1000 design with respect to acceptance values of risk metrics and its compliance with the defense-in-depth philosophy, the PRA will need to include an uncertainty analysis. Without such a PRA, we will be faced with insufficient information on which to base our judgment on the defense-in-depth acceptability of the AP1000 containment.
Our second concern relates to the deterministic part of the design certification. The acceptability of the AP600 for certification with respect to the design basis deterministic aspects was partially based on the use of computer codes with validation based on data from separate effects and integral tests.
The AP600 certification was also partially approved on the basis that the scaled integral experiments demonstrated the robustness of the AP600 ECCS for keeping the core covered over the entire period of the design basis accident sequences. It is likely that this level of comfort will be eroded for the AP1000 because of scaling issues that could make the integral tests no longer directly applicable to the full-scale design. Thus, for the AP1000 there will be much greater reliance on the code results. The concern involves, then, the use of codes that have not been validated for the AP1000 conditions to determine margins.
In past licensing reviews, the staff has been content to use a process in which conservative analyses were used to demonstrate that acceptance criteria (e.g., peak clad temperature) could be met. This process could be used because extensive experience and experimental data were available to substantiate the judgment that the analyses were indeed conservative. Extensive experience and data are not available for passive plants. For the AP600, correctly scaled experiments were performed that demonstrated the robustness of the emergency core cooling. If the scaling of these experiments proves to be less satisfactory for the AP1000, greater reliance on thermal-hydraulic codes will be required.
The use of the predictive codes NOTRUMP, WCOBRA/TRAC, LOFTRAN, and WGOTHIC has been approved only for the AP600, and the validity of these codes for application to the AP1000 must be determined. The available experimental data relevant to passive flow conditions may not be sufficient to validate the use of these codes for the AP1000 geometry and conditions. The applicant intends to conduct a detailed scaling analysis to demonstrate the sufficiency of these experimental data for the AP1000.
If the scaling analysis is less than satisfactory, it will be necessary to determine the uncertainties of the predictions of the codes NOTRUMP, WCOBRA/TRAC, LOFTRAN, and WGOTHIC in a technically defensible manner. This could even necessitate additional, properly scaled experiments to provide confidence that the calculated figures of merit are conservative.
In any case, it will be necessary to assess the uncertainty and validation analysis of the codes provided by Westinghouse. The staff should acquire and exercise these codes so that it can independently evaluate the sensitivity of their predictions to assumptions, model idealizations, and choices of parameters in the correlations.
|Dana A. Powers|
|1.||Memorandum dated July 27, 2000, from Samuel J. Collins, Director, Office of Nuclear Reactor Regulation, U. S. Nuclear Regulatory Commission, to W. E. Cummins, Westinghouse Electric Company, Subject: AP1000 Pre-Application Review - Phase One.|
|2.||Memorandum dated May 31, 2000, from M. M. Corletti, Westinghouse Electric Company, to Document Control Desk, U. S. Nuclear Regulatory Commission, Subject: AP1000 Pre-Application Review Items.|
|3.||Memorandum dated June 21, 2000, from John T. Larkins, Executive Director, Advisory Committee on Reactor Safeguards, to William D. Travers, Executive Director for Operations, NRC, Subject: AP1000 Pre-Application Review.|
|4.||Memorandum dated July 21, 1993, from Samuel J. Chilk, Secretary of the Commission, for James M. Taylor, Executive Director for Operations, NRC, Subject: SECY-93-087 - Policy, Technical, and Licensing Issues Pertaining to Evolutionary and Advanced Light-Water Reactor (ALWR) Designs.|
|5.||U. S. Nuclear Regulatory Commission, Final Safety Evaluation Report Related to Certification of the AP600 Design, Vol. 2, September 1998.|