ML20034H060
| ML20034H060 | |
| Person / Time | |
|---|---|
| Site: | National Bureau of Standards Reactor |
| Issue date: | 03/05/1993 |
| From: | Rowe J NATIONAL INSTITUTE OF STANDARDS & TECHNOLOGY (FORMERL |
| To: | Michaels T Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 9303150190 | |
| Download: ML20034H060 (10) | |
Text
{{#Wiki_filter:. .~ i UNITED OTATED DEPARTMENT OF COMMERf;E ,./, e o'e\\(t - 4 / National Institute of Ctandards and Technology c*uwuwa Mwwwueoana m s.1 ..., f March 5, 1993 t 4 Docket No. 50-184 Mr. Theodore S. Michaels Project Manager PDNP Office of Nuclear Reactor Regulation U.S. Nuclear Regulatory Commission Washington, D.C. 20555
Subject:
Liquid Hydrogen Cold Source for the NIST Reactor-
Dear Mr. Michaels:
i Enclosed is the additional information you requested in your letter regarding the above subject. For your convenience the-response is organized so that each question is repeated prior to the answer. Thank you for your assistance. Sincerely
- ours, 7
. Michael Rowe Chief,-Reactor Radiation Division -{ Enclosure cc: T. F. Dragoun Project Scientist i U.S. Nuclear Regulatory Commission I Region I 475 Allendale Road King of Prussia, PA 19406 i ? i 15C019 9303150190 930305 ^ yDR ADOCK 05000184 ( {- PDR i
l RESPONSES TO REVIEW QUESTIONS ON NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY LIQUID HYDROGEN COLD NEUTRON SOURCE PROPOSAL QUESTION 1. The current Technical Specifications do not include any Limiting Conditions For Operation (LCOs) associated with the D O Cold Neutron Source. E a to the 2 hazards associated with the new Liquid Hydrogen System, explain any plans for LCOs and surveillance or justify why they are not needed for the following: Operability and Surveillance of the Ballast tank solenoid and check i valve. Operability and Surveillance of Hydrogen Monitor automatic actuation signals and alarms. Restrictions on preventive and corrective maintenance activities when hydrogen inventory is not removed from confinement building.
RESPONSE
There are no plans for LCOs associated with the new Liquid Hydrogen Source. The solenoid and check valves are intended only as additional protection against extremely improbable scenarios in which maintenance on non-source systems (source maintenance activities in the response to question 3) near the reactor face are undertaken. All hydrogen-containing systems are protected from accidental rupture by steel protective barriers which are attached to the face of the biological shield or are run in recessed trenches in the first floor of the confinement building. These barriers by themselves are designed to protect the system from accidental damage. However, the necessary radiation shielding normally acts as an additional barrier, and when this shielding is removed, the solenoid and check valves provide additional protection. Operability of the solenoid valve is required to cool the source, so will be automatically tested at each startup. Failure to operate will prevent filling of the source with liquid, but will have no impact on reactor safety. The check valve i may also be checked for leak tightness at each reactor startup, by commencing i cooldown with the solenoid closed, but again, failure to operate will have no i safety consequences for reactor operation. Failure of the check valve to open is not credible, given the nature of such devices. Even if it does not open when the l system has liquid in the moderator chamber, and the chamber warms due to a refrigeration failure, there are no recctor safety consequences. The moderator vessel would rupture, releasing the hydrogen into the cryostat assembly, which 1 L l t
is designed to contain the entire inventory without rupturing. There would be no significant hydrogen release to the confinement building. Since neither valve is required to operate to protect the reactor or confinement building, no LCOs are planned. In fact, in view of the above analysis, neither the check valve nor the isolation valve is required, and they could be omitted with no impact on reactor safety. The local area hydrogen monitors are also additional backup systems which are present to alert personnel to any significant hydrogen concentrations, such as a small leak during filling or removal of the hydrogen. The system is designed for passive safety, with at least double confinement of all hydrogen containing components. As discussed in the response to question 2 below, even the instrumentation systems have been designed to prevent the release of hydrogen in quantities sufficient to create a reactor safety haza". However, the monitors are installed in order to detect even a small leak immediately, so that it can be repaired. The entire hydrogen system is designed to be passively safe, has no essential moving parts, and requires no preventive maintenance. The only active components are the auxiliary loop for assuring high ortho concentration and the pressure monitoring devices. The former system is not essential for system operat;on, and is designed for extremely reliable performance. There is no preventive maintenance required. Corrective maintenance will necessitate removal of the protective shroud around the condenser and opening of the helium blanket. The hydrogen will be removed from that portion of the system external to the ballast tank before removal of any of these components. It is not credible that anyone would undertake such a procedure without securing the hydrogen system. While the reactor is operating, the radiation shielding will be in place, and this could not be removed without creating a high radiation field, and so is not credible. Removal of the entire hydrogen inventory from the confinement building would be required only for maintenance of the ballast tank itself. This is a totally passive system, and so will not require maintenance. The pressure transducers will be attached to the hydrogen system by means of capillary tubing (see question 2 below) which will restrict the flow of hydrogen even if the gauge is totally removed to a rate at which there is no hazard to the reactor or confinement building. OUESTION 2. The design description provided discusses control and monitoring of the hydrogen vapor absolute pressure. How is the absolute pressure controlled? What control and monitoring equipment is installed?
RESPONSE
2 l
is designed to contain the entire inventory without rupturing. There would be no significant hydrogen release to the confinement building. Since neither valve is required to operate to protect the reactor or confinement building, no LCOs are planned. In fact, in view of the above analysis, neither the check valve nor the i isolation valve is required, and they could be ornitted with no impact on reactor safety. The local area hydrogen monitors are also additional backup systems which are present to alert personnel to any significant hydrogen concentrations, such i as a small leak during filling or removal of the hydrogen. The system is designed for passive safety, with at least double confinement of all hydrogen containing components. As discussed in the response to question 2 below, even the instrumentation systems have been designed to prevent the release of hydrogen in quantities sufficient to create a reactor safety hazard. However, the monitors are installed in order to detect even a small leak immediately, so that it can be repaired. The entire hydrogen system is designed to be passively safe, has no essential i moving parts, and requires no preventive maintenance. The only active components are the auxiliary loop for assuring high ortho concentration and the pressure monitoring devices. The former system is not essential for system ( operation, and is designed for extremely reliable performance. There is no l' preventive maintenance required. Corrective maintenance will necessitate removal of the protecuve shroud around the condenser and opening of the he'ium blanket. The hydrogen will be removed from that portion of the system external to the ballast tank before removal of any of these components. It is not credible that anyone would undertake such a procedure without securing the hydrogen system. Whi!e the reactor is operating, the radiation shielding will be in place, and this could not be removed without creating a high radiation field, and so is not credible. Removal of the entire hydrogen inventory from the i confinement building would be required only for maintenance of the ballast tank j itself. This is a totally passive system, and so will not require maintenance. The i pressure transducers wili be attached to the hydrogen system by means of capillary tubing (see question 2 below) which will restrict the flow of hydrogen even if the gauge is totally removed to a rate at which there is no hazard to the reactor or confinement building. i OUESTION l t 2. The design description provided discusses control and monitoring of the hydrogen <apor absolute pressure. How is the absolute pressure controlled? What control and monitoring equipment is installed?
RESPONSE
2
The pressure monitoring equipment consists of two absolute pressure transducers which are attached to the ballast tank and to the line to the source on either side of the valves in this line (see Fig.1). The transducers are located in the helium containment space, and connection is made by means of capillary tubing with an internal diameter of 0.25 mm (.010 in.) so that if left open, the maximum flow rate of hydrogen with 5 atmospheres driving pressure is less than 6.0 x10-s STP m3/s or 5 mg/s. Under operating conditions, this leak would be into the helium blanket, and so would have no consequences. Evan if the helium blanket were open to air for maintenance, and the leak were into the confinement building, hydrogen diffusion and building ventilation are sufficient to prevent accumulation of a significant volume of a hydrogen-air mixture within the flammable concentration limits. At the same time, the connecting tubing will not significantly slow the response of the transducers to pressure changes in the hydrogen vapor. These pressure monitors are the only instrumentation in the. hydrogen loop, and permit testing of all system valves as discussed above. The outputs from the transducers are monitored by visual readouts and electronic systems. The pressure is controlled during source operation by use of the monitored signal as an input to the refrigerator control system. In responses to changes in the hydrogen pressure, the control system positions a proportioning valve in the line supplying helium to the condenser. This loop allows the system to adjust to changes in heating rate during reactor power changes, which is the only mechanism that exists to perturb the steady state operation at constant pressure (and therefore constant temperature of the liquid hydrogen). This system is needed to assure the proper operation of the liquid hydrogen as a cold source, but is not required for reactor protection. In the event of a refrigeration failure, this pressure will rise as the hydrogen boils off, and at a preset level, an alarm will alert the reactor operators to the problem. They would then shut down the reactor, in order to protect the expedment, rather than for the safety of the reactor. If the reactor were not shut down, the moderator chamber would warm up to temperatures in excess af 600 K. At this temperature, the moderator vessel yield strength would be reduced somewhat, but even if it ruptured, the vacuum and helium containment vessels would contain the hydrogen released. There are therefore no reactor related safety issues arising from this system. QUESTION 3. There are two areas whero credible accidents may not have been considered, and were not addressed in.he submittal: a) When all of the hydrogen inventory is contained in the Ballast Tank l during shutdown, the only barrier between this contained volume and the remainder, is a check valve and a solenoid valve, which the reviewer j assumes are in a parallel configuration. In the event of a failure of either valve to close, all 500 g of hydrogen could be released into the system. In the event of a failure of the check valve to open, the hydrogen could be 3 I i
trapped in the cold system with no expansion volume. The following are questions the reviewer considered relevant to this failure. Please describe any analyses which address the consequences of either valve's failure to open. Discuss any analyses which address the consequences of hydrogen leakage around the check valve and/or solenoid valve, resulting in more than 10 g of hydrogen in the system during shutdown. Discuss any features in the design which mitigate the consequences of this failure (i.e., manual isolation). Is there a possibility of the hydrogen system bcundaries being opened to the confinement atmosphere for maintenance when the Ballast Tank valves are the only isolation boundary? b) Detailed description of the process and equipment used during absorption of the Ballast Tank inventory into a metal hydride, and final i removal from the confinement was not included in the submittal. Please provide a detailed description of the equipment and features involved which would prevent a release of the ballast tank inventory into confinement during this activity. Please provide the following information: 1 Are manual connections made, or manual valves manipulated during the activity? L Are the hydrogen monitors required to be operable during hydrogen removal? What driving force removes the hydrogen gas from the Ballast Tank? What measures are taken to assure that the total charge is removed from l the Ballast Tank?
RESPONSE
a) The consequences of either valve's failure to open or close are i discussed in the response to question 1 above, but repeated here in more detail. There are three cases to be considered: i) -The solenoid valve is opened when the source is first cooled down. If it does not open, liquid cannot be condensed into the moderator. This has no consequences for the. reactor, but would 4 l
be corrected so as to have the source operational. li) If the check valve does not open when the pressure on the source side rises, either the solenoid valve is open, in which case the failure is inconsequential, or the solenoid valve is closed, in which case the hydrogen could be trapped in the cold system with no expansion volume, as noted by the reviewer. However, in the latter case, the moderator tank would rupture, releasing the charge into the cryostat (section 2.2 of submittal). This volume is large enough (0.12 m3) to contain the hydrogen at a pressure of 4.5 MPa (660 psi), well below the rupture strength of the helium containment jacket. Therefore, there would be no hydrogen release, and no reactor consequences. However, the moderator assembly would have to be replaced, so that operating procedures for the source willinclude routine checks of operability. iii) If either or both valves allow hydrogen to leak by, more than 10 g of hydrogen would be available for release. However, these valves are backup for the primary, passive safety feature - the protection of all lines from accidental damage, and at least double boundaries for all hydrogen-containing components. Thus, there are no consequences unless there are at least two failures in completely independent systems, one of which is completely passive. It should be noted that small leak rates (equivalent to 0.010 in, dia.) are of no consequence under any conditions, as they do not provide enough hydrogen to yield large volumes within the flammable limits (see response to question 2). There will be two manual isolation valves in series at the ballast tank (see Fig.1 and discussion in response to part b of this question below). With these valves installed, the check and solenoid valves could be deleted from the system, with no safety impact. Cold source procedures will require the closure of both manualisolation valves before any maintenance work is performed (note that the initial cool down would immediately reveal a failure to open these valves following any such activity). In addition, cold source procedures will require removal of all hydrogen external to the ballast tank prior to any maintenance on hydrogen-containing components, which would immediately identify leakage around any valve. These procedures will protect against the possibility of having the solenoid and check valves as the only barrier between the hydrogen in the ballast tank and the confinement. As noted earlier, the passive design features reduce the need for preventive or corrective maintenance to a minimum, b) The connections and valves which comprise the hydrogen fill and 5 1
removal system for the source are shown in Fig.1. The design philosophy is to maintain at least two barriers between the large volume i of hydrogen in the ballast tank and the confinement building at all times. Thus, there are two manualisolation valves in series between the ballast tank and the remainder of the system (V1 and V2). The line which connects to the hydrogen fill and removal manifold has a valve V3, followed by a tee tunning to valves V4 & V5. As indicated, all of these valves are enclosed in the helium blanket to provide double barriers. In normal operation, V1 and V2 are open, and V3-VS are closed, with the connecting lines either evacuated or filled with helium. The metal hydride system would be connected to V5, and the line between V5 and the hydride system valves filled with helium. In order to remove the hydrogen from the portion of the system external to the ballast tank, V1 and V2 would be closed, the solenoid valve would be opened, then V3 and V5 would be opened, and finally the valve on the storage system would be opened. Emptying would be verified by observing the pressure gauge on the appropriate side of V1 and V2, which also tests the leak tightness of V1, V2. If the whole system were being emptied, V1 and V2 would be opened afterobservation of proper action of the metal hydride system in evacuating the volume external to the ballast tank. 4 The local hydrogen monitors will be tested to ensure operability before beginning any hydrogen fill or removal operation. The driving force for hydrogen removal from the system is the exothermic reaction of the hydrogen with the metal, which will absorb hydrogen until the pressure is reduced to less than 10kPa (1.5 psi). The amount of metal required is determined by the total hydrogen capacity required, and is made up of commercially available preassembled and tested packages. Once the hydrogen is absorbed, as verified by the observed pressure in the system, the valve on the hydride system is closed, then V3 and V5 are closed. The hydride system can be removed from its connection and wheeled from the buildN The units are manufactured by Ergenics, Inc. and consist of stainless stesi (non-embrittling) cylinders filled with lanthanum-nickel-aluminura powder (HY-STOR alloy 210), which can reversibly absorb and desorb up to 0.1 STP liters of hydrogen /g of metal. The units are helium leak tested for leak rates of less than 10-8 STP cc/s, and are pressure tested to 6 MPa (900 psi). Once in the hydride form, the hydrogen is completely safe -if the materialis exposed to air and an ignition source, the hydrogen will" burn gently at the surface" (Materials Safety Data Sheet). Metal-hydride storage is the safest known method for hydrogen transport. When the hydrogen pressure has been reduced to less than 10 kPa, the 6
4 i ballast tank can then be filled with helium to a pressure of greater than 0.2 MPa (30 psia), at which pressure the ratio of helium to hydrogen is greater than 20:1. At this dilution, the hydrogen and helium mixture is not flammable in any ratio with air, and can be evacuated by a conventional pump. The storage units can be re-used by heating to 150 degrees C, which will drive off the hydrogen, and then evacuating the units. This operation could be performed in the open air, at a location well removed from the reactor. Alternatively, the hydrogen could be restored to the system by heating the units while they are still connected to the system - the hydrogen evolved is very pure, and essentially free of oxygen contamination. QUESTION 4. During maintenance activity on the cold system, is the inventory of hydrogen contained in the Ballast Tank behind the check valve and solenoid valve, or is all but 10 g of the total charge removed to the metal hydride container outside the confinement building?
RESPONSE
As a result of the passive design of the entire cold source system, there is little maintenance required or possible. If maintenance is required, the double manual isolation valves in the line from the ballast tank provide two barriers to release of the hydrogen in the ballast tank, which maintains the overall design requirements. In addition, the 10 g external to the ballast tank would be removed from the system prior to any maintenance activities on the hydrogen containing components. The process of evacuation of the volume external to the ba!!ast tank would test the tightness of the isolation valves. The ballast tank itself is a simple container,' subjected to modest, infrequent pressure changes and no temperature cycling. Therefore, the ballast tank should require no maintenance for the life of the reactor. If maintenance were required, the charge would be removed from the entire system to the hydride storage system. Once in the hydride form, there is no further hazard associated with the hydrogen, which could be removed from the confinement building or not, with no impact on safety. QUESTION 5. Please provide a detailed discussion of any safety features included in the new system that automatically manipulate equipment other than the local hydrogen monitor trip of the refrigeration unit on high hydrogen concentration. For example, does the instrumentation which monitors oxygen levels in the helium Jacket initiate a control function on high oxygen concentration? 7 4 4
RESPONSE
The only other system which initiates any automatic control function is the vacuum gauge on the cryostat vacuum chamber, if the pressure in the vacuum chamber increases to more than 0.1 Pa (10-3 torr), the valve connecting the vacuum pump to the chamber will automatically close, and the refrigerator will be shut down. This action is taken since the most likely cause would be failure of the pump, and subsequent venting, which would impose a large thermal load on the moderator chamber. Note that this pump operates in a helium environment, so that only helium would enter the vacuum space. This action is taken to protect the source, but has no impact on reactor safety. All other systems, such as the oxygen monitor on the helium jacket, would initiate alarms to which the cold source personnel would be alerted so that they could take appropriate action. As another example,if the pressure levelin the hydrogen system increases to more than 80 % of the normal warm value (indicative of a refrigeration failure) an alarm will be activated. Upon receipt of this alarm, the reactor would be shut down in order to assure the future utility of the source. However, failure to shut down would not present a hazard to the reactor. l 4 1 2 4 3 6
s F------'--~~-~~~--~~---~~~' i l L.._.._..__..._.., Nssn l TRMGJUCER L.._ j BALLAST TANK X X v1 v2 F'----"----~~-------~~---'----7 I i. l I I L.._...._..._.._..._.._..J l I r--------------------J l l c.. _. _.. _.. _.., i mg, y HELIUM BLAT 4KET I 'l I. l l I, p.. _..J L..q I i I i !5 b l c.. _.._.. _.. l I assK I i TO l
- inArcouccR X
l l l HYDROGEN FILL & V4 HELIUM MANIFOLD l I L...., ,..J j v5X j, j j i i L.._.._.._...._.. .J TO COLD SYSTEM TO COMMERCIAL HYDRUGEN STORAGE UNITS Figure 1. SchemoIic of fiII and removal connecIions Io the proposed NIST hydrogen cold source'. j u j i !}}