ML12040A076

From kanterella
Jump to navigation Jump to search

NEDO-33694, Revision 1, Columbia Generating Station Power Range Neutron Monitoring System Diversity and Defense-in-Depth (D3) Analysis
ML12040A076
Person / Time
Site: Columbia Energy Northwest icon.png
Issue date: 01/31/2012
From:
GE-Hitachi Nuclear Energy Americas
To:
Office of Nuclear Reactor Regulation
References
DRF Section 0000-0137-5918-R3 NEDO-33694, Rev. 1
Download: ML12040A076 (43)
v • d • e


Text

LICENSE AMENDMENT REQUEST TO CHANGE TECHNICAL SPECIFICATIONS IN SUPPORT OF PRNM AND ARTS / MELLLA IMPLEMENTATION - Attachment 11 NEDO-33694, Revision 1 Columbia Generating Station Power Range Neutron Monitoring System Diversity and Defense-in-Depth (D3) Analysis January 2012 (non-proprietary version)

nP14 HITACHI GE Hitachi Nuclear Energy NEDO-33694 Revision 1 DRF Section 0000-0137-5918-R3 January 2012 Non-Proprietary Information-Class I (Public)

Columbia Generating Station Power Range Neutron Monitoring System Diversity and Defense-in-Depth (D3) Analysis Copyright 2012 GE-Hitachi Nuclear Energy Americas LLC All Rights Reserved

NEDO-33694 - Revision 1 INFORMATION NOTICE This is the non-proprietary version of the document NEDC-33694, Revision 1, which has the proprietary information removed. Portions of the document that have been removed are indicated by an open and closed bracket as shown here ((

IMPORTANT NOTICE REGARDING CONTENTS OF THIS REPORT Please Read Carefully The design, engineering, and other information contained in this document is furnished for the purpose of supporting the Columbia Generating Station license amendment request for a power range neutron monitor system upgrade in proceedings before the U.S. Nuclear Regulatory Commission. The only undertakings of GEH with respect to information in this document are contained in the contracts between GEH and its customers or participating utilities, and nothing contained in this document shall be construed as changing that contract.

The use of this information by anyone for any purpose other than that for which it is intended is not authorized; and with respect to any unauthorized use, GEH makes no representation or warranty, and assumes no liability as to the completeness, accuracy, or usefulness of the information contained in this document.

ii

NEDO-33694 - Revision I Revision Summary Revision Change Summary 0

Initial Revision 1

Note 2 under Table 4-1 reworded to remove the discussion of the Rod Sequencing Control System, since it is not credited in Chapter 15 of FSAR for CGS. The paragraph is reworded to portray the description of FSAR Section 15.4.9.2.1. RSCS was removed from the acronym listing, since it is no longer used. Updated revision number in the reference of NEDC-33685P.

iii

NEDO-33694 - Revision 1 TABLE OF CONTENTS Page EXECUTIVE SUM M ARY.........................................................................................................

viii

1.

INTRODUCTION.............................................................................................................

1

2.

ASSESSM ENT USING LICENSING TOPICAL REPORT.............................................

2 2.1 Licensing Topical Report Information....................................................................

2 2.2 NRC Safety Evaluation Report.................................................................................

5 2.3 Conclusion............................................................................................................

8

3.

DESCRIPTION OF POSTULATED WORST-CASE CCF FOR DETAILED (BTP 7-19)

D3 ANALYSIS..............................................................................................................

9

4.

BTP 7-19 DIVERSITY ANALYSIS..............................................................................

11 4.1 Analysis Approach.................................................................................................

11 4.2 E v alu atio n...................................................................................................................

1 1 4.3 Additional Diversity Analysis - Undetected Power Oscillations...........................

28

5.

BTP 7-19 DEFENSE IN DEPTH ANALYSIS................................................................

29 5.1 Analysis Approach.................................................................................................

29 5.2 E v alu atio n...................................................................................................................

3 0

6.

SUM M ARY & CONCLUSIONS...................................................................................

32

7.

REFERENCES.....................................................................................................................

33 iv

NEDO-33694 - Revision 1 TABLES Table 2-1 Sensor Diversity for Initiating Events...................................................

3 Table 2-2 Cross-Reference of NEDC-30851P-A Events to CGS FSAR......................... 6 Table 4-1 Analysis of CGS AOOs and DBAs for Diversity....................................... 12 FIGURES Figure 4-1: Power Response for Realistic CRDA Analysis (from Reference 11)................... 24 Figure 4-2: Dynamic Reactivity Responses for Realistic CRDA Analysis (from Reference 11).... 25 Figure 4-3: Total Enthalpy Responses for Realistic CRDA Analysis (from Reference 11).......... 26 v

NEDO-33694 - Revision 1 ACRONYMS AND ABBREVIATIONS Term Definition AOO Anticipated Operational Occurrence APRM Average Power Range Monitor ATWS Anticipated Transient Without Scram BPWS Banked Position Withdrawal Sequence BTP Branch Technical Position BWR Boiling Water Reactor CCF Common Cause Failure CGS Columbia Generating Station CRDA Control Rod Drop Accident D3 Diversity and Defense-in-Depth DBA Design Basis Accident DEH Digital Electro-Hydraulic ENW Energy Northwest ESF Engineered Safety Features ESFAS Engineered Safety Features Actuation System FSAR Final Safety Analysis Report GEH GE-Hitachi Nuclear Energy Americas LLC GGNS Grand Gulf Nuclear Station HFE Human Factors Engineering HPCI High Pressure Core Injection HPCS High Pressure Core Spray IRM Intermediate Range Monitor IEEE Institute of Electrical and Electronics Engineers MSIV Main Steam Isolation Valve NBR Nuclear Boiler Rating NPP Nuclear Power Plant NRC Nuclear Regulatory Commission OPRM Oscillation Power Range Monitor PLD Programmable Logic Device vi

NEDO-33694 - Revision 1 Term Definition PRNM Power Range Neutron Monitoring PRNMS Power Range Neutron Monitoring System PWR Pressurized Water Reactor RBM Rod Block Monitor RHR Residual Heat Removal RMCS Reactor Manual Control System RPS Reactor Protection System RTS Reactor Trip System RWE Rod Withdrawal Error RWM Rod Worth Minimizer SER Safety Evaluation Report SLO Single Loop Operations TCV Turbine Control Valve TLO Two Loop Operations V&V Verification & Validation vii

NEDO-33694 - Revision 1 EXECUTIVE

SUMMARY

The Power Range Neutron Monitoring (PRNM) system upgrade was evaluated using the Acceptance Criteria identified in NRC Branch Technical Position (BTP) 7-19, Revision 6, Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems.

This report provides an assessment of diversity and defense-in-depth, using the original Licensing Topical Report (LTR) (NEDC-32410P-A).

Additionally, this report provides a detailed Diversity and Defense-in-Depth (D3) analysis based on a postulated worst-case common-cause failure in the PRNMS programmable entities, and directly addresses all criteria of BTP 7-19. The evaluations demonstrate that the plant has the diversity and defense-in-depth to cope with any potential common cause failure (CCF) in the programmable entities in the upgrade system.

viii

NEDO-33694 - Revision 1

1.

INTRODUCTION This report documents the Diversity and Defense-in-Depth (D3) analysis which has been performed for the Power Range Neutron Monitoring (PRNM) system upgrade at Columbia Generating Station (CGS). This report provides an assessment of D3 in Section 2, using the original Licensing Topical Report (LTR) (Reference 1). Additionally, within Sections 3 through 5, this report provides a worst-case D3 analysis, similar to the one previously presented to the U.S. Nuclear Regulatory Commission (NRC) for the Grand Gulf Nuclear Station (GGNS)

PRNMS project, via responses to RAIs 8, 9 and 10 within Reference 2.

For the worst-case D3 analysis, the PRNMS is evaluated using the Acceptance Criteria identified in NRC Branch Technical Position (BTP) 7-19, Revision 6, Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems (Reference 3). The evaluation demonstrates that the plant has the ability to cope with any potential common cause failure (CCF) in the programmable entities in the upgrade system.

Section 3 provides a description of the CCF to be used in the worst-case D3 analysis.

Acceptance Criteria 1, 2, 6, 7, 8 and 9 relate to diversity and are discussed in Section 4; while Criteria 3, 4 and 5 relate to defense-in-depth and are discussed in Section 5.

I

NEDO-33694 - Revision 1

2.

ASSESSMENT USING LICENSING TOPICAL REPORT The existing average power range monitor (APRM) subsystem provides a single-sensor input to the reactor protection system (RPS). Replacing the APRM subsystem with the PRNM system does not change or alter the diversity between RPS and the other plant systems that provide inputs to it. Other diverse sensors (e.g., reactor pressure) and manual RPS actuation provide adequate defense in depth to mitigate a CCF of the APRM subsystem. The PRNM system is the only Nuclear Measurement Analysis and Control (NUMAC) input into the RPS at CGS. The oscillation power range monitor (OPRM) is a single sensor input to RPS; the APRM and manual RPS actuation provide backup. GEH's approved design process and comprehensive Verification

& Validation (V&V) program for the PRNM provide adequate reliability, including effects of possible software CCFs. This methodology, coupled with APRM and OPRM diverse functions and operator actions, provides an effective defense against potential CCFs in the PRNM system software.

2.1 Licensing Topical Report Information An analysis of common cause software-related failures for the PRNM, which includes both APRM and OPRM functions, was previously performed by GEH (Reference 1) and approved by the NRC in their safety evaluation report (SER) (Reference 4). Relevant information from each document is presented below.

The conclusions of Section 6.5 of the PRNM LTR are applicable and CGS remains within its design bases. The design basis accidents and anticipated operational occurrences reported in the CGS Final Safety Analysis Report (FSAR) have been compared to those evaluated in the PRNM LTR. Events evaluated for the PRNM LTR encompass the events analyzed for CGS and the configuration of the PRNM is within the limits of the PRNM LTR.

CCF and Defense in Depth are covered for APRM and OPRM in Sections 6.4 and 6.5 of the PRNM LTR.

Regarding the APRM's function, Section 6.4.1, of Reference 1, references the analysis documented in GEH NEDC-30851P-A (Reference 5), which employs Electric Power Research Institute (EPRI) Report No. NP-2230, Part 3, Anticipated Transient Without Scram (ATWS): A Reappraisal: Frequency of Anticipated Transients. (Note: The NRC approved NEDC-30851P-A in a letter to the Boiling Water Reactor (BWR) Owners' Group dated January 24, 1988.)

Section 6.4.1 of the PRNM LTR states in part:

2

NEDO-33694 - Revision 1 Table F-1 is reproduced below as Table 2-1. Notes added to the table identify and resolve differences in the CGS design. The overall conclusions are that adequate diversity and defense in depth are provided, and that CGS's design is consistent with the PRNM LTR Section 6.4.1.

Table 2-1 Sensor Diversity for Initiating Events

'It 3

NEDO-33694 - Revision 1 The CGS design does not include a scram on MSIV High Radiation. However, this design does not adversely affect the conclusions of NEDC-3085 1 P-A as applied to CGS because other diverse RPS functions exist for the event that utilizes this scram as identified in the table.

2 CGS is also analyzed for these events without bypass capability. The scram sensors for the turbine and generator trip events are applicable regardless of bypass availability. Therefore, the diverse sensors identified for the "with bypass" events also apply to the "without bypass" events.

Regarding the OPRM function, Section 6.4.2 of the PRNM LTR states:

((

Section 6.5 of the PRNM LTR documented the following conclusions:

4

NEDO-33694 - Revision 1 2.2 NRC Safety Evaluation Report Section 6.6 of the PRNM LTR states the licensee must confirm applicability of these conclusions by:

(1) Confirming the events, defined in EPRI Report No. NP-2230 or Appendices F and G of NEDC-30851P-A, encompass the events that are analyzed for the plant; (2)

Confirming the configuration implemented by the plant is within the limits described in the PRNM LTR; and (3) Preparing a plant-specific 10 CFR 50.59 evaluation of the modification per applicable plant procedures.

Energy Northwest (ENW) confirms Items (1) and (2) as follows:

(1)

Table 2-2 demonstrates that the events defined in Appendices F and G of NEDC-30851P-A encompasses the events that are analyzed for CGS. Table 2-2 lists the events identified in Appendices F and G of NEDC-30851P-A and identifies the applicable section in Chapter 15, Accident Analyses, of the CGS FSAR in which the event is discussed.

(2)

The CGS-specific PRNM System configuration is described in NEDC-33685P (Reference 6) System Description to the Block Diagram Level, which shows it is within the limits described in the PRNM LTR.

(3)

The requirements of 10CFR50.59 have been applied to the PRNM modification in accordance with applicable plant procedures.

The NRC evaluated the PRNM System for common-cause software-related failures documented in the PRNM LTR and agreed with GEH's conclusions, as documented in its safety evaluation report (SER) approving the PRNM LTR. Specifically, Section 3.4.6 of the SER states:

"GE performed equipment failure analyses to evaluate the effects of module level failures on critical system functions, and to assess qualitatively the defense-in-depth of the PRNMS.

Common cause software related failures, which can result in PRNMS malfunctions were evaluated in the GE analyses. Defense-in-depth design features in the existing RPS, including the diverse anticipated transient without scram mitigation system and manual reactor trip capability, provide an acceptable means to address common mode failures in the APRM and OPRM software functions. Additionally, as mentioned above

{Section 3.2 of the SER}, the APRM and OPRM software development process involves a comprehensive quality assurance methodology to detect and correct software errors. This 5

NEDO-33694 - Revision I methodology, coupled with APRM diverse functions and operator actions, provides an effective defense against CCFs in the software.

The staff finds the above features to address malfunctions to be acceptable."

Table 2-2 Cross-Reference of NEDC-30851P-A Events to CGS FSAR Identified Event FSAR Section Appendix F - Transient/Accidents Analyses MSIV Closure 15.2.4 Turbine Trip (with bypass) (See Note 1) 15.2.3 Generator Trip (with bypass) (See Note 1) 15.2.2 Pressure Regulator Failure (Primary Pressure Decrease) (MSIV 15.1.3 Closure)

Pressure Regulator Failure (Primary Pressure Decrease) (Level 8 15.1.3 Trip)

Pressure Regulator Failure (Primary Pressure Increase) 15.2.1 Feedwater Control Failure (High Reactor Water Level) 15.1.2 Feedwater Flow Control Failure (Low Reactor Water Level) 15.2.7 Loss of Condenser Vacuum 15.2.5 Loss of AC Power (Loss of Grid Connections) 15.2.6 Loss of AC Power (Loss of Transformer) 15.2.6 Appendix G - Other Events Loss Of One Feedwater Heater 15.1.1 Start of Idle Recirculation Pump between 60% and 65% CTP 15.4.4 Rod Withdrawal Error from 0% to 100% CTP 15.4.1, 15.4.2 Recirculation Pump Trip (One or Two Pumps) 15.3.1 6

NEDO-33694 - Revision 1 Identified Event FSAR Section Loss of Instrument Air 7.3.2 7.4.2 Note 2 Recirculation Flow Control Failure (Increase Flow) 15.4.5 Recirculation Flow Control Failure (Decreasing Flow) 15.3.2 Inadvertent Opening of One Safety/Relief Valve 15.1.4 Inadvertent Residual Heat Removal (RHR) Shutdown Cooling 15.1.6 Operations Inadvertent Closure of One MSIV 15.2.4 Partial MSIV Closure 15.2.4 Recirculation Pump Seizure 15.3.3 Rod Withdrawal at Power 15.4.2, 15.4.9 High Flux due to Rod Withdrawal at Startup 15.4.1, 15.4.9 Inadvertent Insertion of Control Rods Note 2 Detected Fault in RPS Note 2 Inadvertent startup of High Pressure Core Injection (HPCI)/High 15.5.1 Pressure Core Spray (HPCS)

Scram due to Plant Occurrences (Manual Scram)

Note 2 Spurious Trip via Instrumentation, RPS Fault Note 2 Manual Scram - No Out-of-Tolerance Condition Note 2 Note 1: CGS is also analyzed for this event without bypass capability, which is discussed in the referenced FSAR section.

7

NEDO-33694 - Revision 1 Note 2: This event does not encroach upon any safety limit and as such is not specifically identified in the FSAR. The design and licensing basis for CGS continues to be met for this event as it is bounded by more limiting anticipated operational occurrences (AOOs) described in the FSAR.

2.3 Conclusion The PRNM System replaces a single-sensor input to the RPS, but does not change or alter the plant-level diversity between RPS and other plant systems. Other sensor inputs within RPS (e.g., reactor dome pressure) are diverse from the PRNM System because these (other) sensor inputs do not utilize the NUMAC platform.

Therefore, they are not subject to the same common-cause failures.

The APRM is a single sensor input to RPS; other diverse sensors (e.g., reactor pressure) and manual RPS actuation provide adequate defense in depth to mitigate a CCF of the APRM. The OPRM is a single sensor input to RPS; the APRM and manual RPS actuation provide backup.

GEH's approved design process and comprehensive V&V program for the PRNM, provide adequate reliability including effects of possible software CCFs. This methodology, coupled with APRM and OPRM diverse functions and operator actions, provides an effective defense against potential CCFs in the PRNMS software.

8

NEDO-33694 - Revision 1

3.

DESCRIPTION OF POSTULATED WORST-CASE CCF FOR DETAILED (BTP 7-19) D3 ANALYSIS A worst-case CCF in the PRNMS is postulated in order to perform the D3 assessment. Rather than postulating individual CCFs in each of the programmable entities (((

fl), a single CCF that completely impairs the PRNM system is assumed.

The postulated CCF in the PRNM system is assumed to remain latent and non-detectable until the system is stressed by an event or accident, at which time all PRNM system outputs from all four channels are absent or incorrect. In other words, the system is assumed to provide no advanced notice of trouble, fail to provide the correct responses such as rod blocks and trips during a transient, and also to provide misleading indications of plant parameters during the transient.

Different CCFs could have been postulated to occur in the 2-Out-Of-4 Logic Modules, or in the APRM instruments. Each of these scenarios is less severe than the worst-case CCF assumed. If a CCF occurs in the 2-Out-Of-4 Logic Modules, ((

If a CCF in only the APRM instrument occurs, ((

Additionally, CCFs in either the 2-Out-Of-4 Logic Modules or the APRM instruments ((

9

NEDO-33694 - Revision 1 Based on this reasoning, GEH maintains that the postulated CCF is a very remote scenario.

Additionally, the NUMAC PRNMS has over 200 plant years of operation to its credit, and GEH is not aware of a single instance of a system that failed in this manner. Nevertheless, the single worst-case CCF in the PRNMS as described above is assumed in PRNMS.

10

NEDO-33694 - Revision I

4.

BTP 7-19 DIVERSITY ANALYSIS 4.1 Analysis Approach NUREG/CR-6303, Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems (Reference 7) Section 3.2, identifies and describes six types of diversity:

design diversity, equipment diversity, functional diversity, human diversity, signal diversity, and software diversity. In cases where a diverse system is identified to respond in the absence of a response from PRNM system, the justification for evaluating the system as diverse is provided.

4.2 Evaluation BTP 7-19 Acceptance Criteria (1) and (2)

(1)

For each anticipated operational occurrence in the design basis occurring in conjunction with each single postulated CCF, the plant response calculated using realistic assumptions (e.g., plant operating at normal power levels, temperatures, pressures, flows, normal alignments of equipment, etc.) analyses should not result in radiation release exceeding 10 percent of the applicable siting dose guideline values or violation of the integrity of the primary coolant pressure boundary. The applicant/licensee should (1) demonstrate that sufficient diversity exists to achieve these goals, (2) identify the vulnerabilities discovered and the corrective actions taken, or (3) identify the vulnerabilities discovered and provide a documented basis thatjustifies taking no action.

(2)

For each postulated accident in the design basis occurring in conjunction with each single postulated CCF, the plant response calculated using realistic assumptions analyses should not result in radiation release exceeding the applicable siting dose guideline values, violation of the integrity of the primary coolant pressure boundary, or violation of the integrity of the containment (i.e., exceeding coolant system or containment design limits). The applicant/licensee should (1) demonstrate that sufficient diversity exists to achieve these goals, (2) identify the vulnerabilities discovered and the corrective actions taken, or (3) identify the vulnerabilities discovered and provide a documented basis that justifies taking no action.

These first two criteria require an evaluation of each AOO and design basis accident (DBA),

assuming the CCF in PRNM system occurs. The purpose of the evaluation is to ensure that sufficient diversity exists to allow the plant to cope with the events if they occur in conjunction with the postulated CCF. Table 4-1 lists each scenario from Chapter 15 of the CGS FSAR (Reference 8) and the credited trip response, if any.

The right-most colunn contains the discussion or evaluation of the effect of the postulated CCF in the PRNMS. The conclusion is that there are no events that lead to any threat to the specified limits.

11

NEDO-33694 - Revision I Table 4-1 Analysis of CGS AOOs and DBAs for Diversity FSAR Credited Title Evaluation / Discussion Section Trip Signals No effect from postulated CCF because the Loss of analysis does not take credit for any PRNMS 15.1.1 Feedwater None response.

Heating The current analysis does not take credit for any reactor trip.

During normal operations -

Reactor High Water Level (L8) for Turbine Trip; Turbine Control Valve (TCV)

Feedwater Fast Closure for Controller Failure Reactor Trip; No effect from postulated CCF because the

_ Maximum Danalysis does not take credit for any PRNM Demand loop operations (SLO) -

Reactor High Water Level (L8) for Turbine Trip; Turbine Stop Valve Closure for Reactor Trip Reactor High Water Level Pressure (L8) for No effect from postulated CCF because the 15.1.3 Regulator Failure Turbine Trip; analysis does not take credit for any PRNM

- Open Turbine Stop system response.

Valve Closure for Reactor Trip 12

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals Inadvertent No effect from postulated CCF because the 15.1.4 Safety/Relief None analysis does not take credit for any PRNM Valve Opening system response.

Spectrum of Steam System Piping Failures 1515 Inside and 15.1.5 Outside of None The event is not applicable to BWR plants.

Containment in a Pressurized Water Reactor (PWR)

No effect from a PRNM system CCF.

The PRNM system is not credited in the analysis, but rather mentioned as the back-up to the Inadvertent RHR primary protection, which is operator action. The 15.1.6 Shutdown None event is applicable only during Startup or cool Cooling down operation, when Intermediate Range Operation Monitor (IRM) also is in operation. The IRM is an analog system. Therefore, it is diverse from the digital PRNMS and not vulnerable to the postulated CCF.

13

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals 15.2.1 Pressure Regulator Failure None This event is classified as a moderate frequency event.

FSAR 15.2.1.1 identifies that the moderate frequency event considered for this transient analysis is that of a single failure which occurs on the controlling pressure transmitter which erroneously causes the Digital Electro Hydraulic (DEH) control system to close the turbine control (governor) valves and thereby increases reactor pressure.

FSAR section 15.2.1.2.1 specifies in the sequence of events that failure of a DEH control system component that causes the turbine control (governor) valves or turbine bypass valves to move towards the closed position will momentarily result in an initial pressure increase because the reactor is still generating the initial steam flow. The DEH control system is self-diagnostic and will detect the faulty component and disable it. The redundant control system will continue to perform its functions, and will restore steady state operations.

The plant does not trip, and therefore there is no effect from a postulated CCF in PRNMS on this event.

Power > 30%

Generator Load NBR - Turbine Rejection Control Valve No effect from postulated CCF because the 15.2.2 (TCV) Fast analysis does not take credit for any PRNM System

Closure, system response.

operational)

Power < 30%

NBR - None 14

NEDO-33694 -Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals Power > 30%

NBR - Turbine Generator Load Control Valve Rejection (TCV) Fast No effect from postulated CCF because the 15.2.2 analysis does not take credit for any PRNM (with Bypass

Closure, sse epne System failure)

Powersystem response.

NBR - None Power > 30%

NBR - Turbine Turbine Trip (with Stop Valve No effect from postulated CCF because the 15.2.3 Bypass System Closure analysis does not take credit for any PRNM operational) system response.

Power < 30%

NBR - None Power > 30%

NBR - Turbine Turbine Trip Stop Valve No effect from postulated CCF because the 15.2.3 (with Bypass Closure analysis does not take credit for any PRNM System failure)

Power < 30%

system response.

NBR - Hi Vessel Pressure No effect from postulated CCF because the 15.2.4 all valves MSIV Closure analysis does not take credit for any PRNM system response.

An automated response from a diverse safety-related system exists if PRNM system fails to Neutron Flux, respond.

15.2.4 MSIV Closure -

one valve Vessel Dome The Vessel Dome Pressure scram signal is issued Pressure by an analog system. Therefore, it is diverse from the digital PRNM system and not vulnerable to the postulated CCF.

15

NEDO-33694 - Revision 1

FSAR, Credited.

Title Evaluation / Discussion Section Trip Signals Loss of Turbine Stop No effect from postulated CCF because the 15.2.5 Condenser Valve Closure analysis does not take credit for any PRNM Vacuum system response.

Loss of Power to scram and Loss of AC MSIV No effect from postulated CCF because the 15.2.6 oSolenoids, analysis does not take credit for any PRNM Turbine Control system response.

Valve (TCV)

Fast Closure Loss of Low Water No effect from postulated CCF because the 15.2.7 Feedwater Flow Level (L3) analysis does not take credit for any PRNM system response.

Feedwater Line 15.2.8 Break NA NA - refer to 15.6.6.

Break Failure of RHR No effect from postulated CCF because the 15.2.9 Shutdown None analysis does not take credit for any PRNM Cooling system response.

1 pump - None 2 pumps -

Reactor High Recirculation Water Level No effect from postulated CCF because the 15.3.1 Pump Trip (L8) for analysis does not take credit for any PRNM Turbine Trip; system response.

Turbine Stop Valve Closure for Reactor Trip 16

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals 1 pump - None 2 pumps-Recirculation Reactor High 15.3.2 Flow Control Water Level No effect from postulated CCF because the Failure -

(L8) for analysis does not take credit for any PRNM Decreasing Flow Turbine Trip; system response.

Turbine Stop Valve Closure for Reactor Trip During two loop operations (TLO) - Reactor High Water Level (L8) for 15.3.3 Recirculation Turbine Trip; No effect from postulated CCF because the Pump Seizure Turbine Stop analysis does not take credit for any PRNM Valve Closure system response.

for Reactor Trip During SLO -

None Reactor High Water Level 15.3.4 Recirculation (L8) for No effect from postulated CCF because the Pump Shaft Break Turbine Trip; analysis does not take credit for any PRNM Turbine Stop system response.

Valve Closure for Reactor Trip Rod Withdrawal No effect from postulated CCF because the 15.4.1 Error - Low None analysis does not take credit for any PRNM Power system response.

17

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals A PRNM system CCF would result in an unblocked Rod Withdrawal Error (RWE) event.

The radiological consequence of this event is bounded by the radiological consequence of the Control Rod Drop Accident (CRDA).

The CRDA is a rapid, uncontrolled control rod 15.4.2 Rod Withdrawal None withdrawal that occurs at low power and has very Error at Power little void feedback. It assumes fuel melt occurs for determination of the source term. The unblocked RWE is a slower event with significant void feedback and no fuel melting. The radiological consequence of the unblocked RWE is bounded by the CRDA and is within Acceptance Criteria (1) of BTP 7-19.

Control Rod Maloperation 15.4.3 (System NA NA - refer to 15.4.1 and 15.4.2.

Malfunction or Operator Error)

No threat to applicable limits is posed by PRNM system CCF.

No protection systems' response is anticipated because the intent is to start the pump without a scram. Normal procedures prohibit starting the Startup of Idle pump at a power level that would lead to 15.4.4 Recirculation None automatic actions. Even if it were supposed that Pump an operator error occurs and the pump is started when power is high enough for a neutron flux scram to occur during the flux spike, the analysis shows that the thermal power would rise more slowly and steady out at an acceptable higher level.

18

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals No threat to applicable limits is posed by PRNM system CCF.

The slow opening of one recirculation flow control valve establishes the thermal limits basis for this event because the analysis process, which does not take credit for a scram during slow flow Recirculation S

ow en run-up, is designed to maximize the heat flux 15.4.5 Flow Control None change.

Failure with Fast opening -

During a fast run-up event, a neutron flux scram Increasing Flow Neutron Flux may occur during the flux spike. If the scram is postulated to not occur, the heat flux after the event stabilizes would be similar to the slow run-up analysis, which imposes larger heat flux changes with no scram.

This result is within Acceptance Criteria (1) of BTP 7-19.

Chemical and 15.4.6 Volume Control NA The event is not applicable to BWR plants.

System Malfunctions 15.4.7 Misplaced Bundle No effect from postulated CCF because the Accident None analysis does not take credit for any PRNM system response.

Spectrum of Rod 15.4.8 Ejection NA The event is not applicable to BWR plants.

Assemblies 19

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals An automated response from a diverse safety-related system exists if PRNM system fails to respond.

The CRDA analysis ignored IRM for Control Rod Drop conservatism, but in reality, the IRM would 15.4.9 Accident (CRDA)

Neutron Flux terminate the event. The IRM is an analog system. Therefore it is diverse from the digital PRNM system, and not vulnerable to the postulated CCF. (Note 2)

This result is within Acceptance Criteria (2) of BTP 7-19.

None, but Reactor Water Level (L3) is considered a backup for Inadvertent HPCS decreasing No effect from postulated CCF because the 15.5.1 level. Reactor analysis does not take credit for any PRNM Startup Water Level system response.

(L8) for Turbine Trip is considered a backup for increasing level.

Chemical Volume 15.5.2 Control System NA The event is not applicable to BWR plants.

Malfunction (or Operator Error)

BWR Transients 15.5.3 Which Increase Reactor Coolant NA Refer to 15.1 and 15.2.

Inventory 20

NEDO-33694 - Revision 1 FSAR Credited Title Evaluation / Discussion Section Trip Signals Inadvertent 15.6.1 Safety/Relief NA Refer to 15.1.4.

Valve Opening Instrument Line Manual Scram No effect from postulated CCF because the 15.6.2 Pipe Break after 20 Min analysis does not take credit for any PRNMS response.

15.6.3 Steam Generator NA The event is not applicable to BWR plants.

1563 Tube Failure Steam System Piping Break No effect from postulated CCF because the 15.6.4 Outside MSIV Closure analysis does not take credit for any PRNMS Containment response.

Loss-of-Coolant Accidents (Resulting from Spectrum ofLoWae Spstrult P

g Level (L3) or No effect from postulated CCF because the 15.6.5 PostulatedHigh Drywell analysis does not take credit for any PRNM Breaks within the Reactor Coolant Pressure system response.

Pressure (Note 1)

Boundary - Inside Containment)

Feedwater Line Low Water No effect from postulated CCF because the 15.6.6 Break-Outside Level (L3) analysis does not take credit for any PRNM Containment system response.

Radioactive Gas 15.7.1 System Leak or NA This event is not applicable to CGS.

Failure Liquid 15.7.2 Radioactive NA This event is not applicable to CGS.

System Failure 21

NEDO-33694 - Revision 1 FSAR Credited Title.

Evaluation Discussion Section Trip Signals Postulated Radioactive No effect from postulated CCF because the 15.7.3 Releases Due to None analysis does not take credit for any PRNM Liquid Radwaste system response.

Tank Failure Fuel Handling No effect from postulated CCF because the 15.7.4 Accident None analysis does not take credit for any PRNM system response.

15.7.5 Spent Fuel Cask None No effect from postulated CCF because the Drop Accidents analysis does not take credit for any PRNM system response.

Capabilities of Per Section 15.8.0, "Anticipated Transients 15.8.0 -

Present Design to Without Scram (ATWS) events described in this 15.8.11 Accommodate None section are not design basis events for CGS."

ATWS This excludes ATWS from consideration for BTP 7-19 Acceptance Criteria (1) and (2).

Notes:

1.

Obtained credited trips from Section 7.2.1.1.3 of the CGS FSAR (Reference 8).

2.

The CRDA as analyzed and reported in Chapter 15 of the CGS FSAR takes a conservative approach that the event is terminated with an APRM High Neutron Flux Scram. The purpose of this approach is to provide a bounding analysis for the CRDA with the assumption that the reactor is past STARTUP mode (in RUN mode), with no credit for moderator feedback and minimal credit for the Doppler feedback and scram with the APRM High Neutron Flux Scram.

The consequences of a CRDA are most severe in terms of fuel enthalpy increases during lower power STARTUP mode conditions. The APRM High Neutron Flux Scram would not be operational but rather the APRM Setdown Scram. The IRM scram would be the most likely scram signal. ((

)) Therefore, for a realistic CRDA scenario, a postulated CCF in the software of the PRNM preventing the scram from the APRM High Neutron Flux (or the APRM Setdown) would not affect the scram from IRM, the primary initiation signal for reactor trip.

22

NEDO-33694 - Revision 1 Per Section 15.4.9.2.1 of the FSAR (Reference 8), the event is further mitigated by an initial control rod configuration that complies with the Banked Position Withdrawal Sequence (BPWS).

The withdrawal (or insertion) sequence is implemented by the operator and enforced by the Rod Worth Minimizer (RWM). An operator error in control rod movement will be detected and stopped by the RWM. If the RWM system is not operable, rod movement can only continue with a backup for the operator verifying compliance with the BPWS sequence. Failure of the RWM concurrent with an operator error of moving an out-of-sequence rod, contrary to procedures would be required to result in a potentially more limiting event.

In realistic 3D evaluations for the limiting CRDA scenarios (Reference 11), the presence or absence of a scram is irrelevant because the effect of the scram occurs too late to have an effect on the calculated peak fuel enthalpy that is dominated by Doppler feedback and Moderator feedback (non-adiabatic calculation).

CRDA scenarios starting at higher temperatures and higher powers, where IRM or APRM Setdown scrams are not present, are less limiting with respect to the calculated peak fuel enthalpy. For these scenarios, in addition to Doppler feedback, the increased generation of voids provides an additional, more significant, negative feedback mechanism; so that it is not necessary to credit the scram. See Figures 4-1, 4-2, and 4-3. The moderator feedback is effective where IRM is active and is more effective in reducing the reactivity increase during high power conditions.

Figures 4-1, 4-2 and 4-3 were obtained from BWR Best-Estimate Calculations, as summarized in Reference 11, with the following inputs:

" Realistic feedback due to Doppler, fluid temperature, and voids

" Realistic control blade worths at different exposures Covered static blade worths to limits set by BPWS limits (-1.1%AK

-$1.87)

Some conservative out-of-sequence cases were included Core loading and shutdown margin limits possible worths

" Different initial fluid temperatures used because feedback mechanisms are different One of the conclusions derived from Reference 11 is that "responses for calculations in the operating range above -5% are bounded by startup cases and do not indicate boiling transition."

In summary, the postulated PRNM failure would not adversely affect the plant protection during a CRDA.

23

NEDO-33694 - Revision 1 Power Responses (- 1.1% delta-K static worth) 14,000

-20 C adiabatic 20 C BOC 1 0,0 0 0.-................................

1 0 0 C B O C

-160 C BOC 8,000---------------------------

o 6,000 --------------------------- --

4,000 -a 2,000 0

0.0 1.0 2.0 3.0 4.0 5.0 N-OIIN[O Workshop oNDenber,0A NRC"orfsh,3pcnRA!RDA Figure 4-1: Power Response for Realistic CRDA Analysis (from Reference 11) 24

NEDO-33694 - Revision I Dynamic Reactivity Responses

(~ 1.1% delta-K static worth - $1.87 static - $1.33 dynamic) 5'1

.3 g

gi~

0 4/)

-5 20 CI ad~t labatiA 0

-15

-20 0

1 2

Time (sec)

Nonp~oprmtary In aomtion 3

4 5

Nonembr 9~, -i)0 NRC. Wohp.nR:A/RC-A Figure 4-2: Dynamic Reactivity Responses for Realistic CRDA Analysis (from Reference 11) 25

NEDO-33694 - Revision 1 Total Enthalpy Responses

(- 1.1% delta-K static worth) 120 "

100

'Peak enhap fo veyol case ocus lae after--

Cu 80 60 40 20 0

0 12 3

4 5

Time (sec)

~o~me itn1 0

t f

y C t

'o, en kNRC Workshop on RI~

f t*l

[*.206 W"~ /

Figure 4-3: Total Enthalpy Responses for Realistic CRDA Analysis (from Reference 11)

In conclusion, based on the evaluation presented in Table 4-1, the proposed upgrade satisfies Reference 3 Acceptance Criteria (1) and (2).

Acceptance Criterion (6)

(6)

For safety systems to satisfy IEEE Std. 603-1991 Clauses 6.2 and 7.2, which are incorporated by reference in 10 CFR 50.55a(h), a safety-related means shall be provided in the control room to implement manual initiation at the division level of the RTS and ESFAS functions. The means provided shall minimize the number of discrete operator manual manipulations and shall depend on operation of a minimum of equipment. If the means is independent and diverse from the safety-related automatically initiated RTS and ESFAS functions, the design meets the system-level actuation criterion in Point 4 of this BTP. If credit is taken for a manual actuation method that meets both the IEEE Std. 603-1991, Clauses 6.2 and 7.2 requirements and a need for a diverse manual backup, then the applicant/licensee should demonstrate that the criteria are satisfied and sufficient diversity exists.

26

NEDO-33694 - Revision 1 This criterion requires a safety-related means for manual initiation of the reactor trip system (RTS) and engineered safety features actuation system (ESFAS) functions.

This criterion is not applicable to the PRNM system upgrade. The evaluation performed for Acceptance Criteria (1) and (2) demonstrates that if a CCF occurs in the PRNM system, the plant is able to cope without relying on a manual scram or engineered safety features (ESF) actuation.

It is noted that the manual scram and ESF actuation are retained, if needed for other reasons, because they are totally separate from the PRNM system and not affected by the proposed upgrade in any way.

Acceptance Criteria (7) through (9)

(7)

If the D3 assessment reveals a potential for a CCF, then the method for accomplishing the independent and diverse means of actuating the protective safety finctions can be accomplished via either an automated system (see Section 3.4, "Use of Automation in Diverse Backup Safety Functions" below), or manual operator actions that meet HFE acceptability criteria (see Section 3.5, "Use of Manual Action in Diverse Backup Safety Functions" below).

(8)

If the D3 assessment reveals a potential for a CCF, then the method for accomplishing the independent and diverse means of actuating the protective safet functions should meet the following criteria: The independent and diverse means should be:

a) at the division level; b) initiated from the control room; c) capable of responding with sufficient time available for the operators to determine the need for protective actions even with malfunctioning indicators, if credited in the D3 coping analysis; d) appropriate for the event; e) supported by sufficient instrumentation that indicates:

1. the protective function is needed,
2. the safety-related automated system did not perform the protective function, and
3. the automated backup or manual action is successful in performing the safety finction.

(9)

If the D3 assessment reveals a potential for a CCF, then, in accordance with the augmented quality guidance for the independent and diverse backup system used to cope 27

NEDO-33694 - Revision 1 with a CCF, the design of a diverse automated or diverse manual backup actuation system should address how to minimize the potential for a spurious actuation of the protective system caused by the diverse system. Use of design techniques (for example.

redundancy, conservative setpoint selection, and use of quality components) to mitigate these concerns is recommended.

These criteria require evaluations of the methods for accomplishing the independent and diverse means of actuating the protective safety function when the D3 analysis reveals the potential for a CCF.

The NUMAC platform is not present in any part of RTS except the PRNMS, and is not present in the ESFAS. Their designs are not affected by the proposed upgrade, and these systems are not vulnerable to the postulated CCF in the PRNMS.

4.3 Additional Diversity Analysis - Undetected Power Oscillations The OPRM plays an important role in the detection and suppression of power oscillations. The postulated CCF, assumed to result in comprehensive loss of PRNM system functionality, would also disable the OPRM. Although Reference 8 does not include power oscillations among the AOO or DBA, it is appropriate to discuss them. As discussed above, the postulated CCF in the PRNM system results in the system providing valid indications of plant conditions until the transient, at which time they become anomalous. In the case of power oscillations, therefore, PRNM system indications of power and flow must track consistently with other plant indicators as they change to a state point where the potential exists for high growth-rate power oscillations (i.e., the upper left comer of the power/flow map), but somehow fail to provide any protection if large amplitude oscillations begin to occur. Nevertheless, even while maintaining the severity of the postulated CCF, the plant has the ability to cope with it in conjunction with power oscillations.

CGS procedures require immediate action to reduce reactor power or increase core flow in order to mitigate possible high growth rate power oscillations following unanticipated core flow reduction events, such as a two-recirculation pump trip. The operators will know the state point because the status of recirculation pumps is provided independent of PRNM system, flow information is available from the recirculation flow system, and power level information is available from either the electrical power output or a core thermal power calculation.

Furthermore, the Recirculation Flow control system, RMCS, and manual scram are unaffected by the CCF. Thus, the plant is able to cope with the CCF because they can determine that defensive steps are necessary and execute those steps.

28

NEDO-33694 - Revision 1

5.

BTP 7-19 DEFENSE IN DEPTH ANALYSIS 5.1 Analysis Approach Reference 3 Section 1. 1 and NUREG/CR-6303, Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems (Reference 7) Section 2.2 identify and describe four "echelons of defense," which are "specific applications of the principle of defense-in-depth to the arrangement of instrumentation and control systems attached to a nuclear reactor for the purpose of operating the reactor or shutting it down and cooling it."

The four echelons of defense that are identified, and their applicability to CGS, are as follows.

(1) Control System - consists of (usually) non-safety equipment that is used in the normal operation of a nuclear power plant (NPP) and routinely prevents operations in unsafe regimes of NPP operations. The CGS control system fits this definition. Part of this echelon is the PRNMS, which provides inputs to the RMCS.

(2) Reactor Trip System (RTS) - consists of safety equipment designed to reduce reactivity rapidly in response to an uncontrolled excursion. The CGS safety equipment collectively referred to as the RPS fits this definition. The PRNMS is one of the sensor systems in this echelon. The other equipment, as well as the actuation system, are not affected by the upgrade.

(3) Engineered Safety Features Actuation System (ESFAS) - consists of safety equipment that removes heat or otherwise assists in maintaining the integrity of the three physical barriers to radioactive release.

The CGS ESFAS complies with this definition.

The PRNMS does not interface with this echelon.

(4) Monitoring and Indicators - consists of sensors, displays, data communication systems, and manual controls required by operators to respond to NPP operating events. The CGS display and other instrumentation systems fit this definition. The PRNM system provides inputs to this echelon (e.g., annunciators) but does not receive any signals from this echelon.

It is of particular importance to ensure that no single CCF will disable more than one echelon.

29

NEDO-33694 - Revision 1 5.2 Evaluation Acceptance Criterion (3)

(3)

When a failure of a common element or signal source shared by the control system and RTS is postulated and the CCF results in a plant response that requires reactor trip and also impairs the trip function, then diverse means that are not subject to or failed by the postulated failtre should be provided to perform the RTS function. The diverse means should assure that the plant response calculated using realistic assumptions analyses does not result in radiation release exceeding 10 percent of the applicable siting dose guideline values or violation of the integrity of the primary coolant pressure boundary.

This criterion requires an evaluation of potential interaction between the Control System and RTS echelons when a postulated CCF results in a plant response that requires a reactor trip and also impairs the trip function. The PRNM system is not used for automatic control of plant operations, except for providing rod block signals. Therefore, if the postulated CCF occurs, it will not result in a plant response that requires a reactor trip.

Therefore, the type of CCF described in this criterion cannot occur in the upgrade system.

Acceptance Criterion (3) is satisfied.

Acceptance Criterion (4)

(4)

When a failure of a common element or signal source shared by the control system and ESFAS is postulated and the CCF results in a plant response that requires engineered safety features (ESF) and also impairs the ESF finction, then diverse means that are not subject to or failed by the postulated failure should be provided to perform the ESF function. The diverse means should assure that the plant response calculated using realistic assumptions analyses does not result in radiation release exceeding 10 percent of the applicable siting dose guideline values or violation of the integrity of the primary coolant pressure boundary This criterion requires an evaluation of potential interactions between the Control System and ESFAS echelons when a postulated CCF results in a plant response that requires an ESF response and also impairs ESF function. The PRNM system is not used for automatic control of plant operations, so if the postulated CCF occurs, it will not result in a plant response that requires an ESF response. Furthermore, neither the existing nor replacement PRNMS interface with the ESFAS. Therefore, the type of CCF described in this criterion cannot occur in the upgrade system. Acceptance Criterion (4) is satisfied.

30

NEDO-33694 - Revision 1 Acceptance Criterion (5)

(5)

No failure of monitoring or display systems should influence the functioning of the RTS or ESFAS. If a plant monitoring system failure induces operators to attempt to operate the plant outside safety limits or in violation of the limiting conditions of operation, the analysis should demonstrate that such operator-induced transients will be compensated by protection system function.

This criterion requires that a failure in the monitoring and display echelon will not adversely affect the RTS or ESFAS echelons. The PRNM system does not rely on or receive any input from the monitoring and display echelon, and therefore, a failure in the monitoring and display systems will not propagate to PRNMS. If the failure in the monitoring and display system results in an operator-induced transient, the automatic protective functions of PRNM system are available for compensation. Acceptance Criterion (5) is satisfied.

31

NEDO-33694 - Revision 1

6.

SUMMARY

& CONCLUSIONS The PRNM system upgrade was evaluated using the Acceptance Criteria identified in NRC BTP 7-19, Revision 6. This report provides an assessment of diversity and defense-in-depth, using the original LTR (Reference 1). Additionally, this report provides a detailed D3 analysis based on a postulated worst-case common-cause failure in the PRNM system programmable entities, and directly addresses all criteria of BTP 7-19. The evaluations demonstrate that the plant has the diversity and defense-in-depth to cope with any potential CCF in the programmable entities in the upgrade system.

32

NEDO-33694 - Revision 1

7.

REFERENCES

1. GE Nuclear Energy LTR NEDC-3241OP-A Volumes 1 and 2, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, dated October 1995 (ADAMS Accession No. ML9605290009);

and GE Nuclear Energy LTR NEDC-3241OP-A Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC PRNM) Retrofit Plus Option III Stability Trip Function, dated November 1997.

2. Correspondence GNRO-2011/00039 from Michael Krupa (Entergy Operations, Inc.), to U.S.

Nuclear Regulatory Commission, Dated 5/26/2011, MLI 11460590.

3. NRC Branch Technical Position (BTP) 7-19, Revision 6, Guidance for Evaluation of Diversity and Defense-In-Depth in Digital Computer-Based Instrumentation and Control Systems, (ADAMS Accession No. ML093490771).
4. NRC letter to Mr. David W. Reigel, NUMAC Project Manager, Acceptance of Licensing Topical Report NEDC-32410-P, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function (TAC No. M90616), September 5, 1995; and NRC letter to Mr. David W. Reigel, NUMAC Project Manager, Licensing Topical Report NEDC-32410-P, Supplement 1, Nuclear Measurement Analysis and Control Power Range Neutron Monitor (NUMAC-PRNM) Retrofit Plus Option III Stability Trip Function (TAC No. M95746), August 15, 1997.
5. GE Nuclear Energy NEDC-30851P-A, Technical Specification Improvement Analysis for BWR Reactor Protection System, March 1988.
6. GEH Nuclear Energy, "Digital I&C-ISG-06 Compliance for Columbia Generation Station NUMAC Power Range Neutron Monitoring Retrofit Plus Option III Stability Trip Function,"

NEDC-33685P, Revision 1, January 2012.

7. NUREG/CR-6303, "Method for Performing Diversity and Defense-in-Depth Analyses of Reactor Protection Systems," (ADAMS Accession No. ML071790509).
8. CGS Final Safety Analysis Report.
9. General Electric Standard Application for Reactor Fuel (GESTAR II), NEDE-2401 1-P-A-17-US, September 2010.
10. C. J. Paone, Banked Position Withdrawal Sequence, January 1977 (NEDO-21231) and Letter from OD Parr (USNRC) to GG Sherwood (GE), Topical Report - NEDO-21231, "Banked Position Withdrawal Sequence," January 18, 1978.

33

NEDO-33694 - Revision I

11. GE November 9, 2006 Presentation Slides, ADAMS Accession Number ML063190108, provided at NRC Public Workshop on Interim Reactivity-initiated Accidents Criteria (NRC Meeting Summary filed under ADAMS Accession Number ML063260310), November 9, 2006.

34

Retrieved from "https://kanterella.com/w/index.php?title=ML12040A076&oldid=5265077"