ML20043H163
| ML20043H163 | |
| Person / Time | |
|---|---|
| Site: | Armed Forces Radiobiology Research Institute |
| Issue date: | 06/19/1990 |
| From: | Irving G ARMED FORCES RADIOBIOLOGICAL RESEARCH INSTITUTE |
| To: | Weiss S Office of Nuclear Reactor Regulation |
| References | |
| NUDOCS 9006220107 | |
| Download: ML20043H163 (1) | |
Text
{{#Wiki_filter:W L
~
(Gcfk'50 96 p' . -
~
DOC KST ' S'O-176
.. -c DEFENSE NUCLEAR AGENCY u%w 4 r './
p ARMED FORCES RADIOBIOLOGY REsEARCH INsitTuTE BETHEsDA, M ARYLAND 20814-5145 ' e u . RSDR- 19 Jim 1990
, Document Control Desk
,, United States Nuclear Regulatory Commission l
' Office'of Nuclear Power Regulation
- Non-power Reactor, Decommissioning, and Env.ironmental Project Directorate Washington D.C. 20555 ;
'Att: Mr Seymour Weiss
Reference:
a) NRC Letter to AFRRI 11 June 1990 b) AFRRI letter to NRC 30 April 1990 c) AFRRI 10 CFR 50.59 submitted 5 July 1988 '
Dear Sir,
-This' letter is to request a change to the 100FR 50.90 (ref b) submitted which-requested .several. amendments. to the AFRRI license _and Technical' Specifications. Time and contractual obligations in one of the amendment-i .,
areas dictate an urgent need to-complete the action as soon as possible._This action, the installation of the computerized control system is based upon the safety analysis which was completed and submitted in reference c. To facilitate the changes to our technical specifications which are necessary to-
' complete the installation the following is requested:- _
a) The portion of the 10CFR50.90 submitted in reference b which deals with the addition.of " Watchdog" scrams to the console and the addition'of the requirement for a_" Watchdog" scram in the technical specifications be removed from that request and be treated as a separate 10CFR50.90 request.
;b) The document. submitted as a 10CFR 50.59 Safety Analysis (additional copy attached)^be resubmitted es a 10CFR 50.90 request to support our finding that this unit will meet or exceed. the safety concerns of the current console in 3
use at AFRRI. Your; support in accomplishing this action is appreciated,'if you have any_ questions the contact' person for this matter.-is Mr.' Mark Moore the Reactor Facility Director. He may be reached at 295-1290. m Sincerely, , . g Col Geor . Irving III Directo AFRRI CF Mr.-Al Adams j Mail stop 11B20 hkhhohd[O ed . I l bn _&_
-i l
ll ..
.vn-
- =
n A '1 l
- l I
; h J g,es . q# (
.s
^
i: I~ . ~ j g % _n y p -)<,, , ul
- m. .y . ,
L 1: t, M. _ C3 3 6< v ...'
~
s - u . s s. x- i. .:
- w. ;' t !! -l:
== > ;
a , , . . . .
'g_ ..
t- .,
. l-
. :. i. j L
- .: :i: : .
- i: ;;r, i.:.::i;;;:::l.:',:.:.ii.i.,i; :.:::j;:. !!l.?.
58 g:
- i. : . .
Mo . . . : :. .:. im;
- . .: .:.. :: .: .: . ::r.:i.::.(. :::
- .: . ..;;: :. i :.: . .: ..:
i::.:::;.:.::
- .:.i: i . .::::::.i .
AFRRI S:.: R..ii:i:.i::::l
- .: - , .;g::. :. :
- .: ;; ;i. ::. .. . : ::l ,:
- i:::::: :::,:i::::::: .::
i:: :.: ..::
- i::i. .:
- i
- i::i. .:
- .: i.:i. .::i.:ii. . :
. .i::i.,'i.i::5::.:i:.:.. ::: ...i.:i::: ..
'. H:.ec.:::..:t.!. . si88666w
~ ~
6EFENSE NUCLEAR' AGENCY ~ ARMED FORCES RADIOBIOLDGY RESEARCH'lNsTiTOTE g BETHESDA, MARYLAND 20814-5145 i Approved for Public Release; Distribution Unlimited DQls_ _ VU 'O[U QV 3 f
I I I u g I 10 CFR-50.59' SAFETY EVALUATION REPORT OF THE NEW REACTOR
- INSTRUMENTATION AND CONTROL SYSTEM AT THE ARMED FORCES- LI RADIOBIOLOGY RESEARCH INSTITUTE I '
lI : 11 MAY 1988 I Mark Moore Ken Hodadon Angela Munno
.E I I
I
.g ,
I I
l 1 ABSTRACT l This report-describes changes to the reactor facility at the Armed Forces l, Radiobiology Research Institute (AFRRI) in Bethesda, Maryland. This W Safety Evaluation Report (SER) meets the requirements of Title 10, Code of Federal Regulations, part 50.59 (10 CFR 50.59), and provides the basis for a 4 the conclusion that the changes to the facility involve no unreviewed safety questions and, in fact, are improvements in the facility design at g i AFRRI. In order to accomplish these changes, the Facility Safety Analysis ! Report (SAR) must be modified. The body of this report contains a description and safety analysis of the SAR changes. Excerpts from the SAR .l and the proposed changes are included as appendices. j Note: Under 10 CFR 50.59, a licensee may make changes to its facility provided that no changes are made to the Technical Specifications, and ! that there are no unreviewed safety questions. The conditions-for ! unreviewed safety questions are outlined in 10 CFR 10.59.a.2, and are summarized below: ,
-l If the affected equipment is related to safety:
- 1. The probability of occurrence or the consequences of an accident or equipment malfunction shall not be increased, ii. The possibility.for an accident or malfunction of a different type than previously evaluated in the SAR shall not exist.
111. The margin of safety-as defined in the Basis for any Technical Specification shall not be reduced. Ii ' I l I . E. I: I ao 1
5 TABLE QE CONTENTS
- 1. Abstract II. Table of Contents III. Introduction ,
IV. Facility Modifications Safety Evaluation A. Overview B. Reactor Safety System Descriptions I 1. High Flux Safety Channels One and Two
- 2. Fuel Temperature Safety Channels One and Two
- 3. SCRAM Systems I C.
- 4. Single Failure Criterin Analysis
- 5. TRIGA Reactor Safety System Failure Analysis Reactor Operational Instrumentation System Descriptions
- 1. Reactor Operational Channels
-I a. Multirange Linear Channel
- b. Wide Range Log Channel
- 2. Reactor Interlocks (Rod Withdrawal Prevents)
I 3. Servo Controller
- 4. Rod Drives D. Reactor Modes of Operation I E. Comparison of the current and Systems
- 1. Reactor Safety Systems the New Reactor Safety and Control
- 2. Reactor Operational Control and Monitoring Systems I 3. Standard Control Rod Drives F. Safety Evaluation Conclusion I APPENDICES: A. Listing of Corrections to be made to the.SAR B. Proposed SAR Changes for the Previously Discussed Facility Modification Safety Analyses
(' C. AFRRI TRIGA Console (Safety) Scram System Single Failure Criteria Analysis D. Scram Circuit Safety Analysis for the University of Texas TRIGA Reactor I R. Analysis of 5 Dollar' Ramp Intertion Over a 2 Second Interval in AFRRI TRIGA Reactor I : 4 I '
I INTRODUCTION present conditions at the Armed Forces Radiobiology Research Ins titute (AFRRI) require that modifications be made to upgrade the reactor facility. The changen being made to the Facility Saf1ty Analysis Report (SAR) include: The installation of a new Reactor Instrumentation and control System and the installation of three new stepping-motor standard control rod drives. AFRRI's current reactor instrumentation system is a 1972 vintage unit (hereafter, refered to as the current (present), old, or 1972 console) salvaged from the 1977 decommissioning of the Diamond Ordnance Radiation Facility and was installed at AFRRI in 1978. The design life of this unit is 10 years. Because this console is now 16 years old, maintenance down 5 time has increased and is expected to continue to increase over the next g five years. The console's functional utility is now continuously di:sinishing due to the progressive obsolescence of many of its electronio components. Although the obsolescence of these components does net effect the nuclear safety of the system, it is a problem operationally. Many of these electronic components are no longer manufactured; consequently, direct replacements are unobtainable. Redesign of selaoted circuits to use currently available electronic components would require, in each case, a g safety review by the reactor safety committee and possible review and g approval by the NRC. Estimated hardware costs to entirely redesign, replace, and upgrade AFRRl's existing console exceed the cost of buying a new instrumentation system. Failure analyses of current console components indicate that, undernormall circumstances, AFRRI has sufficient spare parts to sustain its present u onerational capabi'di y for less than 2 years. Then it is expected that AFRRI would become c.avolved in serious down time problems. AFRRI's control rod drive system also suffers from the same progressive obsolescence, increasing maintenance down time, and spare parts unavailability as the control console. Acquiring a new state-of-the-art console and control rod drive system using integrated circuits and microprocessor technology vill resolve these B ' problems and provide for reliable operation of the AFRR1 Reactor Facility 5 through the year 2000. . This new state-of-the-art microprocessor-based instrumentation and control e system will replace the current control console shile improving the existing operational. capabilities and safety characteristics. The new .i system will increase reactor operational performance through incressed productivity, improved efficiency, increased rel32bility, impeoved I ; I 1-
experiment reproducibility, and increased maintainability. productivity will be improved through increased reactor operating time due to the system performing automatic self-checks of daily instrumentation checkouts, and through decreased operator training time - operators will become proficient in a much shorter length of time. The new system will increase efficiency in reactor operators' time by automatically logging I reactor data or allowing keyboard entry of nonoperational but essential information pertinent to reactor operations. Experiment reproducibility will be improved through increased pulse accuracy and repeatability and . through improved Auto Mode capabilities. In Pulse Mode, the system will provide prompt waveform analysis: peak power, energy, half power width, reactivity insertion, minimum period, and Feak fuel temperature are measured and calculated automatically and reported promptly to the I operator in either graphic or nongraphic mode. In Automatic Mode, the operator will select the desired power level, run duration (SCRAM time), and which rods will be servoed, then position the banked rods, select the Automatic Mode nad let the Reactor Control System perform the run. The I new system will increase maintainability through state-of-the-art system maintenance design and layout, line replaceable units and on-line system diagnostics. System safety will also be improved through the performance E of periodic self-diagnostics that determine if the unit is in a safe B operational status. These diagnostics will display error messages reporting failures to the operator and will automatically place the I reactor in a safe neutronic configuration. Additionally, the system will have improved Electromagnetic Interference (EMI) protection through shielding, optical isolation, and digitizing data at near core locations, and will reduce cabling requirements by collecting data in the reactor I room and then routing that data to the control Console computer via serial data trunks. I The Code of Federal Regulations (Title 10 Part 50.59) requires that modification of a portion of a licensed facility an described in the facility SAR be documented with a written safety evaluation. Such I documentation provides the basis for determining that the change does not involve an unreviewed safety question. An unreviewed safety question according to 10 CFR 50.59 involves (1) the increase of probability of occurrence or the increase of consequences of an accident or malfunction i of equipment important to safety compared to that situation previously . evaluated in the SAR, or (2) the possibility for an accident or malfunction of a different type than previously analyzed in the SAR, or i I (3) the reduction in margin of safety as defined in the SAR. Based on the analyses in this Technical Report, it has been determined that the proposed changes to the Reactor Facility do not involve any i I unreviewed safety questions and will actually improve the facility design at AFRRI. This technical report describes changes and modifications made to the AFRRI reactor facility as depicted in the facility's SAR. These changes have been reviewed by the Reactor Facility Director and found to contain no unreviewed safety questions. This report is submitted to the Reactor I I
r and Radiation Facility Safety Committee (RRFSC) for their concurrence that E , conditions of 10 CFR 50.59 are met. These conditions are that no 3' unreviewed safety questions are present and that the changes made do not increase the probability of occurrence or the consequences of an accident , or malfunction. ! The proposed modifications require minor changes to the SAR. The body of this report contains a description and safety analysis of the 10 CFR 50.59 SAR changes. Appendix A contains a specific page/section index of all of the SAR changes. Appendix B contains excerpts from the SAR, for each of these 10 CFR 50.59 modifications. The new Digital Reactor Instrumentation and Control System has been 1 denigr.ed to be safer than the present AFRRI control system which has been : evaluated in the AFRRI TRIGA Mark F Reactor SAR. This has been accomplished by continuing to hardwire all safety circuits in a redundant, fail safe configuration. These safety circuits are completely independent l ' of the data acquisition computer (DAC) and the control system computer 5 (CSC). This means that if either or both computers were to fail, the failure cannot prevent the reactor from scramming. On the other hand, critical functions of the computers are mon'tored by " watch-dog-timers". If the computers fail to update the timers in a predetermined fashion, the redundant, hardwired watch-dog-timers will scram the reactor. As a result, the new Digital Reactor Instrumentation and Osntrol System has equal or greater safety built-in than the present AFRRI control system, which has SAR approval. 4 I. I I
I l FACILITY MODIFICATIONS SAFETY EVALUATION
'a The installation'of the new Reactor Instrumentation and Control System at g the AFRRI TRIGA Mark F reactor facility will provide equal or greater operational and safety capabilities with a higher degree of reliability than the current instrumentation. f OVERVIEW ;
I The basic elements of the new Reactor Instrumentation and Control System (see Figure 1) will consist of a Control Console, a Data Acquisition and Control Unit (DAC), two independent Power Monitor and Safety Systems, an l I Operational Channel, and a Pulse Channel. This system was design and I built in accordance with ANSI /ANS-15.15-1978 " Criteria For The Reactor Safety Systems of Research Reactors". The Control Console will be a desk-type unit located in the AFRRI Reactor Control Room. Operators will conduct reactor operations using a set of control switches and a keyboard located on the console, and the operators will receive feedback information through a high-resolution color monitor, a status monitor, indicators, and annunciators. ;
.The heart of the control console will be the Control System Computer (CSC). Operators will adjust the rod positions by issuing commands to the ,
CSC, which will transmit these commands to the DAC. The DAC will reissue the commands to the drive mechanisms. During reactor operations, the CSC will receive raw data from the DAC, process this data, and present the data in meaningful engineering units and graphic displays on a number of peripheral systems. The CSC will operate two color CRT monitors. A high-resolution color
~
graphics CRT (Reactor Control CRT) will provide the operator with a real-time graphic display of the reactor status. This CRT will display the important operational parameters using bar graphs and digital readouts and will alert the operator to any abnortml or dangerous conditions. A Reactor Status CRT will display pertinent diagnostic messages, reactor status, and-facility status information. The CSC will also interface with a near-letter-quality printer, allowing the logging of reactor information as required by the reactor operator. ' Historical data will be saved in the CSC's internal memory and on command from the operator be replayed, printed, or transferred to removable disks for permanent storage. This will provide the capability to maintain records of pertinent reactor statistics and to replay reactor operational records for training and analysis. In addition, the CSC will operate a color graphien printer capable of printing steady-state and pulse mode data as well as producing point-line plots. Finally, the CSC will ,I I
80 erd wered ~ ,l- IDE ACTOct NALL l COcetIDOL 200e0 *
- n . -e.r e - . i 00000000 Canesee, u ----e ! . . e. _ . .
.m - ~ ,
., , ewer Cebeamet I p ,es % susus,Ommasseen. s i
j= 1 spee,)Steve ** ene I l sted lI I + caeus i easeaseme amen " ! Fuel Temp #1 sept ' gg, 3semmenen set (- Ammutuamm i ruel Tesmp 32 _. l High Flux 51 - Food Teamgy. (Two) _ anodemme l C"**8 High riux s2, * ' m m WSmen _ F "'" ,O -
~
88'88 3*am, m a~ acan, e em
- ,,,c, , v weeen remo. _ -
ammy l _ Reactor ,,,,,, a !
- i safety '
a
- l
- 8temer
]
" " " " l FedTaugL W (husussmm,2 t
! *"' l s muss, a mmisssem a . cammen, n - i a sert j " - **** i I es,seen ewee ----, '*"*'"'*"88"""' = i - ---- g si e, an.e l , a.mm. 4 }
.m e
. I l
r ames
,=,,m=
,,, , i, it ses- seen j amme- - en* ,,sse t I semos asas i
l { h l a.mmr r #
'l temSumer i r Pumme W
I i I JI T seen esas 8845 lI i ! g an i l L j ll i I I
' stimme l C"** I
.}
w I FIGURE #1 l ca , = w I g cumme l , AFRRt TRIGA MARK F l c.e CONTROt. SYSTEM meses. i C==* 84_OCK DfAGRAM 4 g g g g g m m M M M W O E E E y w- , .,, , . ww; - -p_ ..- , - . . , , . , . ,-e, -,-.,_......._,.,w- -
, . - . . + _ , , . . _ . . , , - , .
interface to real-time recorders of reactor power and fuel temperature. ! The DAC will be located in the AFRRI Reactor Room adjacent to the reactor and will provide high-speed data acquisition and control capability. The DAC will monitor the two independent Power Monitor and Safety Systems, the Operational Channel, the Pulse Channel, the fuel temperature, water level and temperature, and control rod positions. The DAC will, on command from I 1 the CSC, reissue the commands to raise and lower the control rods or scram the reactor. The DAC will communicate with the CSC via serial data The secondary trunk will serve as a backup should the primary trunks. ' I trunk fail. These serial data trunks will drastically reduce the wiring requirements between the Reactor Room and the Control Console. The Power Monitor and Safety S< stems will monitor the power from 1% to 120% of full power (1.0 megavatts) and shut the reactor down (SCRAM) in the event of an overpower erndition. The Operational Channel will monitor the power from source level to full power and the rate of power change ( from -30 to +3 second per!.od) in the steady state modes. The Pulse Channel will monitor the power level up to 5000 megawatts in the
-3 pulse mode. This channel will use an ion chamber, a photo diode detector,
' 3 or some other acceptable pulse monitoring detector. The DAC will collect information from the pulse channel and transmit the data to the CSC for processing. The control console will have 8 Hardwired (Analog) LED Bargraph indientors which are located on the left side of the console. These hardwired channels include the two High Flux Safety Channels, the two Puel Temperature Safety Channels, the Operational Wide-Range Los Channel, the , period Channel, and the Pulse NV and NVT Channels. Located below these ! analog bargraphs are the Operational Multirange Linear Channel and Fuel Temperature Channel strip chart recorders. These items are all hardwired and are completely independent of the CSC and DAC computers, and 3 therefore, will provide information to the reactor operator at all times, 1 even should the CSC and DAC computers fail. AFRRI is also replacing its three 1960 vintage Standard Control Rod 1 I Drives with three new Standard Control Rod Drives using pulsed motor drive systems. These stepping motors operate on phase-switched do power. motors drive a pinion gear (connected to the Magnet Draw Tube) and a These ' i I 10-turn positive feedback potentiometer via a chain and pulley gear mechanism. Except for the drive motors, the new control rod drive assemblies will be the same as the current control rod drive assemblies. { I REACTOR SAFETY SYSTEM DESCRIPTIONS HIGH FLUX SAFETY CHANNELS ONE AND TWO I t e , - - - - - - - - - . % .- _,,,. -- - . - - - _ _ _ m _ _, ____.___.__y- - __________m_
I High flux safety channels one and two report the reactor power level as measured by two ion chambers and a pulse detector placed above the core in the neutron field. Each safety channel is a part of one multifunction NP-1000 neutron power channel. For safety reasons (simple redundancy) two independent NP-1000's are used and they operate identically during steady state operation. Each channel consists of an ion chamber placed above the core and the associated NP-1000 electronics. The steady state power level E is displayed on two separate LED bargraph indicators and on the reactor g control CRT. During pulse operation, high flux safety channel one is shunted and the sensor for high flux safety channel two is switched to a third, independent pulse detector placed above the core. High flux safety channel two measures the peak power level achieved during the pulse (NV) E and the total integrated power produced by the pulse (NVT) and is B therefore specified as an NPP-1000 instead of an NP-1000. However, it should be noted that both safety channels operate with identical NP-1000 circuitry. Calibration of the NP-1000's is done automatically during the ' Daily Startup Checklist when the operator initiates the " pre-checks" by activation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operator via the reactor status CRT. The high flux safety channels (NP-1000's) form part of the scram logic circuitry. When the steady state reactor power level, as measured by g a either high flux safety channel, reaches the maximum power level specified in the technical specifications, a bistable trip circuit is activated a which breaks the scram logic circuit, causing an immediate reactor scram. Similarly, when the reactor power level during pulse operation, as g measured by high flux safety channel two, reaches the maximum pulse power _ level specified in the technical specifications, a bistable trip circuit , is activated which causes an immediate reactor scram. L FUEL TEMPERATURE SAFETY CHANNELS ONE AND TWO Fuel temperature safety channels one and two are independent of one another but operate in identical manners (simple redundancy). One thermocouple from each of the two instrumented fuel elements, one in the ' B-ring and one in the C-ring, provide inputs to fuel temperature safety channels one and two, respectively. The two fuel temperature signals are amplified and displayed on two separate bargraph indicators located on the reactor console and on the reactor control CRT. The fuel temperature safety channels have internal compensation for the chronel-alumel g thermocouples and high noise rejection. Calibration of the Fuel g ! Temperature Channels is done automatically during the Daily Startup Checklist when the reactor operator initiates the " pre-checks" by I activation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operator via the reactor status CRT. I _B
.- ...-- .. -- - . . - _~ - _ _ __ - -
I In addition to providing information to the reactor operator on fuel temperature, the fuel temperature safety channels also form part of the scram logic circuitry. When the fuel temperature, as measured by either fuel temperature safety channel, reaches the maximum allowable fuel temperature specified in the technical specifications, a bistable trip circuit is activated which breaks the scram logic circuit, causing an immediate reactor scram. The operational fuel temperature limit is I usually set below the technical specifications limit to assure an adequate degree of reactor protection. i The combination of the two independent High Flux Safety Channels and the l two indspendent Fuel Temperature Safety Channels provides both simple i redundancy and functional redundancy in terms of insuring that the Reactor l I Safety Limit as specified in the Technical Specifications is never reached. I 1 l SCRAM SYSTEMS l l The scram logic circuitry (see Figure 2) assures that a set of reactor ; I core and operational conditions must be satisfied for reactor operation to occur or continue in accordance with the technical specifications. scram logic circuitry involves a set of open-on-failure logic relay The I switches in series: any scram signal or component failure in the scram logic, therefore, results in a loss of standard control rod magnet current and a loss of air to the transient rod cylinder, resulting in a reactor j scram. The time between activation of the scram logic and the total ; insertion of the control rods is limited by the technical specifications 1 to assure the safety of the reactor and the fuel elements for the range of anticipated transients for the AFRRI TRIGA reactor. The scram logic I circuitry causes an automatic reactor scram under the following circumstances:
- The steady state timer causes a reactor scram after a given elapsed I time, as set on the timer, when utilized during-steady state power operations.
I - The pulse timer causes a reactor scram after a given elapsed time, as set on the-timer (in accordance with the limit specified in the technical specifications), during pulse power operations.
- The manual scram button located on the reactor console, allows the Reactor Operator to manually scram the reactor. - Movement of the console key to the OFF position causes a reactor scram. - The reactor tank shielding doors in any position other than fully open I or fully closed will cause a reactor scram (this is part of the facility interlock system).
, I I I
e s e m s s m m s e e a r r r s a e e e e m r r e r s s e c c 8lt 7 e a t
,e o w e dd e p S S l
e B da P t e ra n eo g g e f n h g Bel as o o t a e C y t e ve t r A e Sd d d s sC ' yme t d e h h S e s s e t f s r c c B d s 's ed e t t y t 6 e o l on Ba m. a a d e e w g e e3 W W a e m a t s o g= e l o m d e s e so e e= C t a a C S P t p o o b p e= S A M{e s l B c= C D (L {8 S M A R C - S . R O T m fl C _ A - E g R m , t r a t e e i y I r , n e A l - R c , g r p s , e t d p R g 0 s k n e - F - 8 E a s A ~ 2 ,- ,- l * ; E R U G I F 1
~ R J 7J 2 7I 33 R
. 1
=
l e
'1 a ] f 2
r ==
=
ye s s m 2 s p p 8 m # l u m e m e% 8 g$ n g( ygF y1F e r te t0 T *0 T *0 ey , y el fl@ f1@ a 8 e9 a i0 e6 e l0 e6 eet ef
,te s 8 e ma 5 s N P F sS mfSa N
ll llll ,
.- - . . ~ . - - - . - - - - - - - - - - - - .-
I
- Activation of any of the emergency stop buttons in either exposure room or on the console causes a reactor scram.
- A loss of AC power to the reactor causes a reactor scram.
- High flux safety channel one causes a reactor scram at a reactor power level specified in the technical specifications for steady state modes I of operation. This may be operationally set more conservetive than the technical specifications limit.
- High flux safety channel two causes a reactor scram at a reactor power level specified in the technical specifications for steady state modes of operation. This may be operationall, set more conservative than the i technical specifications limit. ,
- A loss of high voltage to either of the detectors for high flux safety channels one and two causes a reactor scram.
- Fuel temperature safety channels one and two will each initiate a l reactor scram if the fuel temperature, as measured independently by either channel, reaches 600*C (technical specification limit). This assures that the AFRRI safety limit (core temperature) of 1,000* C for AFRRI stainless steel clad cylindrical TRIGA fuel elements, as stated in the AFRRI technical specifications, is never approached or exceeded.
The actual operational limit for the fuel temperature safety channels may be set lower than the technical specifications limit of 600* C.
- A loss of reactor pool water which leaves less than or equal to 14 feet of pool water above the core (technical specifications limit) causes a reactor scram. The actual operational limits for the pool water level may be set more conservatively than the technical specifications limit.
- one watchdog timer on the data acquisition computer and another one on the control system computer are required to be reset periodically by a I program routine as a safeguard against computer component failures either in hardware or software. If the required response is not l received within a definite time period, redundant normally open (fail l -safe) contacts interrupt the scram loop dropping the rods and shutting down the reactor. These watchdog timers are additional safety devices.
SINGLE FAILURE CRITERIA ANAbYSIS ANSI /ANS STD 15.15-1978 " Criteria for Reactor Safety Systems of Research Reactors" specifies that a Single Failure Criteria Analysis be performed on all non-redundant reactor safety systems. This analysis was performed by General Atomics for the new AFRRI TRIGA Reactor Instrumentation and Control System and is enclosed as Appendix C "AFRRI TRIGt Console (Safety) I. Scram System Single Failure Criteria Analysis." This analysis 1
t
'i demonstrates that, except for the Reactor Key Switch (which does not perform a safety function except to prevent unauthorized startup), the Mean Time Between Failure of any single element of the new instrumentation scram system greatly exceeds (the MTBF's range from 23 years to 125 years) the design life of the new console (15 years). This analysis was performed for any single failure of the reactor safety system. ,
TRICA REACTOR SAFETY SYSTEM FAILURE ANALYSIS Although not required, a Failuro Analysis was performed by the University I of Texas and General Atomics of the new Reactor Instrumentation and Control System. This analysis is enclosed as Appendix D "TRIGA - ICS Reactor Safety System Fallare Analysis". This analysis looked at the 3 probability of the Reactor Safety System failing to perform its intended g function: no scram occurs during a scram situation. In order for this to occur there would need to be simultaneous failures of two or more components of the Reactor :lafety System. This analysis demonstrates that the probability of Failure of the new Reactor Safety System is 2X10-8 8 failures / hour, or a mean time between failures of SX108 years. I-REACTOR OPERATIONAL INSTRUMENTATION SYSTEM DESCRIPTIONS : REACTOR OPERATIONAL CHANNELS Multirange Linear Channel l The mu11trange linear channel is one of three channels included in the E l NM-1000. Et The multirange linear channel reports reactor power from source level n [-10-8 Wt (thermal watts)] to full steady state power (1 MWt). Theoutputg of a principle fission detector serves as the channel input. The channel consists of two circuit sections: the count rate circuit, and the campbelling circuit. At power levels less than 1 kilowatt (t) the count rate circuit is utilized. The count rate circuit generates an output voltage proportional to the number of nee. tron genrated pulses or counts received from the fission detector. Hence, the output is proportional to the neutron population and the reactor power level. For steady state power levels at or above 1 kilowatt (t) the campbelling circuit is . utilized. The campbelling circuit generates an output voltage i proportional to the reactor power level by a verified technique of noise envelope amplitude detection and measurement known as campbelling. The NM-1000's micro-processor converts the signal from these circuits into 10 linear power ranges. This feature provides for a more precise reading et linear power level over the entire range of reactor power. I I i
I ' ' The NM-1000's multirange linear channel output is displayed in two formats. These are a bargraph indicator on the Reactor Control CRT . display and a strip chart recorder located on the left-hand vertical panel on the control console. As a performance check, the microprocessor automatically tests the channel for campbell circuit operability while the reactor is operating in the count rate range and vice verse when the reactor is in the campbelling range. The multirange ranging function is auto-ranged via the NM-1000 control system computer.
- Wide Range Log Channel The wide-range log channel like the multirange linear measures reactor power from source level ( 10 8 Wt) to full steady state power (1MWt). It is a digital version of-the General Atomics 10-decade los power system to I cover the reactor power range and provide a period signal. For the log power function, the chamber signal from startup (pulse counting) range through the campbelling [ root mean square (RMS) signal processing] range I covers in excess of 10-decades of power level. The self-contained microprocessor combines these signals and derives the power rate of change (period) through the full range of power.
The wide-range log channel forms part of the rod withdrawal prevent (RWp) interlock system. The channel activates variable set point bistable trips in the rod withdrawal prevent interlock system if source level neutrona I ( 10-8 Wt) are not present, i f the reactor power level is above 1 KWt when switched to pulse mode, i f a steady state power increase has a period of 3 seconds or faster during certain steady state modes, or if high < voltage is not supplied to the fission detector. The wide-rantn log and period output are displayed on bargraph indicators ! which are both hardwired and on the Reactor Control CRT. The NM-1000's I microprocessor, similar to the multirange linear channel, automatically tests the wide-range log channel for upper and lower decade operability. I REACTOR INTERLOCKS (ROD WITHDRAWAL PREVENTS) I A Rod Withdrawal prevent (RWp) interlock stops any upward motion of the standard control rods and prevents air from being supplied to the transient control rod unless specified operating conditions are met. An RWP interlock, however, does not prevent a control rod from being lowered 1 or scrammed. Therefore, any RWp interlock prevents any further positive l reactivity from being inserted into the core until specific conditions are satisfied. j The system of RWp interlocks prevents control rod withdrawals under the following circumstances:
- RWp prevents air froe being applied to the tran=ient rod unless the reactor power level is under 1 KWt.
l l u li lI
I
- RWP prevents any control rod withdrawal unless, as a minimum, source level neutrons ( 10-8 Wt) are present.
- RWP prevents any further control rod withdrawal unless the power level is changing on a 3-second or longer period as measured by the wide-range log channel during certain steady state operations.
- RWP prevents any control rod withdrawal unless high voltage is being supplied to the fission detector for the multirange linear and wide-range log channels.
- RWP prevents any control rod withdrawal unless the bulk pool water temperature is less than 60*C (Technical Specification Limit).
SERVO CONTROLLER The Servo Controller, in the Automatic and Square Wave Modes, controls the reactor power automatically to within +/-1% of the demand power level selected by the operator. Thumbwheel switches are provided on the Mode a control panel for the desired power selection. The Servo controller will track and stabilize reactor power through the utilization of a PID g, algorithm (Proportional, Integral, Derivative). The console will be capable of servoing any combination of the three standard control rods ! (REO, SAFE, or SHIM). It will not, however, servo the Transient Rod in. any mode. The operator will be able to select which combination of rods l will be servoed via a Servoed Rod Selector Switch located on the Mode Control Panel of the new control console. The Servo controller system utilizes the latest. digital computer technology coupled with extensively developed software. The current console uses an analog computer to servo the rods while the new console uses a digital computer to servo the rods. Reactor flux level and change is accurately and rapidly measured by an analog / digital input from the Operational (fission) Channel. The PID algorithm in the DAC then responds to this input as compared to the l operator set Demand Power Level Settina through the servoed control rods 3 ! which are powered by precise translator / stepping motor drives. The n (operator selected) drive (s) will be driven up or down automatically to ;' control the power level to within +/-1% of the Demand Power Level Setting. g-The new console Servo Controller can drive all three standard control rods simultaneously (- 8 5. 50) in the Automatic and Square Wave Modes versus the s old console which can servo the Transient and the REG rods ( 85.50) simultaneously in the Square Wave Mode and which servoed the REO rod in E the Automatic Mode; by technical specifications the maximum excess E reactivity above cold critical is 85.00. A Ramp Accident Analysis was performed to insure that a runaway drive situation involving a two second g full-insertion (this is faster than the maximum drive rate of the new g drives) of all tnree standard control rod drives would not lead to an . t u
a I event. This analysis was performed by General Atomics under contract to AFRRI and is enclosed as Appendix E " Analysis of a Five Dollar Ramp Insertion Over a Two Second Interval in AFRRI TRIGA Reactor". This I analysis demonstrates that the consequences of this accident scenario are trivial. The peak power level attained is 530MW and the maximum fuel temperature attained is 330*C. The AFRRI TR/GA Reactor routinelp pulses to peak powers of up to 3300MW and the normal 1 MW steady state fuel ; temperature is approximately 420* C. This analysis demonstrates that there ; are no unreviewed safety questions. ' ROD DRIVES The rod drive mechanisms for each of the new Standard Control Rod Drives : is an electric stepping-motor-actuated linear drive equipped with a magnetic coupler and a positive feedback potentiometer. The purpose of each of the rod drive mechanisms is to position the reactor control rod elements. General Operational Description l A stepping motor drives a pinion gear and a 10-turn potentiometer via a chain and pulley gear mechanism. The potentiometer is used to provide rod position information. The pinion gear engages a rack attached to the I magnet draw tube. An electromagnet, attached to the lower end of the draw tube, engages an iron armature. The armature is screwed and pinned into the upper end of a connecting rod that terminates at its lower end in the I j l control rod. ; When the stepping motor is energized (vir the rod control Up/DOWN switch I on the operator's console), the pinion sear shaft rotates, thus raising the magnet draw ibe . If the electromagnet is energized, the armature and the connecting . d will raise with the draw tube so that the control rod is withdrawn from the reactor core. In the event of a reactor scram, the magnet is de-energized and the armature will be released. The connecting rod, the piston, and the control rod will then drop, thus reinserting the < control rod into the core. l I Stepping motors operate on phase-switched de power. The motor shaft advances 200 steps per revolution (1.8 des per step). Since current.is 1
)
maintained on the motor windings when the motor is not being stepped, a i high holding torque is maintained. !
. \
The torque vs speed characteristic of a stepping motor is greatly I . dependent on the drive circuit used to step the motor. torque characteristic vs motor frame size, a Translator Module was selected to drive the stepping motor. To optimize the This combination of stepping motor and translator module produces the optimum torque at the operating speeds of the control rod drives. S 0 ! I
1 Il REACTOR MODES OF OPERATION There are four standard operating modes: manual, automatic, square wave, cnd pulse. The manual and automatic modes apply to the steady-state reactor j condition; the square-wave and pulse modes are the conditions implied by ' their names and require a transient (pulse) rod drive. The manual and automatic reactor control modes are used for reactor f operation from source level to 100% power. These two modes are used for j manual reactor start up, change in power level, and steady-state j operation. The square-wave operation allows the power level to be raised quickly to a desired power level. The pulse mode generates high-power i levels for very short periods of time. Manual rod control is accomplished through the use of push-buttons on the , rod control panel. The top row of push-buttons (magnet) is used to interrupt the curreat to the rod drive magnets. If the rod is scrammed and the drive is above the down limit, the rod will fall back into the core and the magnet will automatically drive to the down limit, where it again contacts the armature. The middle row of push-buttons (up) and the bottom row (down) are used to 3 position the control rods. Depressing these push-buttons causes the g control rods to move in the direction indicaced. Several interlocks prevent the movement of the rods in the up direction under conditions such as the following:
- 1. Scrams not reset.
- 2. Magnet not coupled to armature. l
- 3. Source level below minimum count. W
- 4. Two UP switches depressed at the same time. '
- 5. Mode switch in the pulse position.
- 6. Mode switch in automatic position (servoed rods only). ,
- 7. Period less than 3 seconds.
There is no inte: lock inhibiting the DOWN direction of the control rods except in the case of the servoed rods while in the AUTOMATIC mode. In all cases, however, the manual scram of any rod will result in the full insertion of the rod into the core. Automatic (servo) power control can be obtained by switching from manual operation to automatic operation via operator activation of the Auto Mode g Switch on tuc control console's Mode Control Panel. All the instrumentation, esfety, and interlock circuitry described above applies 5 and is in operation in this mode. However, the selected servoed rods are now controlled automatically in response to a power level and period signal. The reactor power level is compared with the demand level set by I . I I
the operator and is used to bring the reactor power to the demand level on a fixed preset period. The purpose of this feature is to automatically maintain the preset p;act level during long-term power runs. Options are I available to the operator to maintain power by movement of a single rod or by bank operation of selected rods. The rods to be servoed are selected by the operator via the Servoed Rod Selector Switch an the control console's Mode Control Panel. In a square-wave opera tion, the reactor is first brought to a critical I condition below 1 KW, leaving the transient rod partially in the core. All of the steady-state instrumentation is in operation. The transient rod is ejected from the core by means of the transient rod FIRE push-button. When the power level reaches the demand level, it is maintained I in the same manner as in the automatic mode. Reactor control in the pulsing mude cor.sists of establishing criticality I at a flux level below 1 KW in the steady-state mode. This is accomplished by the use of the motor-driven control rods, leaving the transient rod either fully or partially inserted. The mode selector switch is then depressed. The Transient Rod Fire switch automatically connects the pulsing chamber to monitor and record peak flux (nv) and energy release (nyt). Pulsing can be initiated from either the critica.'. or suboritical reactor state. COMPARISON O_f_ THE QSRRENY AND IHE tLEW REACTOR SAFETY 6FN) CE TROL SYSTEMS l,
)
REACTOR SAFETY SYSTEMS I The current console, which was designed and built in the early 1970's, has ) as its Reactor Safety' Systems (See Table I) two hardwired independent analog High Flux Safety Channels, two hardwired independent analog Fuel I Temperature Safety Channels, and a hardwired relay logic SCRAM circuitry. The High Flux safety Channels derive their signals from two Boron (neutron sensitive) Ion Chambers mounted above the core, and these l channels have readouts located on the vertical panel of the control console in the form of analog meters. The Fuel Temperature Safety Channels derive their signals from two instrumented fuel elements, one located in the B-ring and one located in the C-ring. The Fuel Temperature Safety Channels also have readouts located on the vertical panel of the control console in the form of analog meters. The Scram circuitry has two independent relay contacts for each safety enannel, one located in the I supply side and one located in the return side of the magnet and solenoid powe, circuitry. Dropping any one of these numerous relays would cut power to the magnets and the air solenoid. l I The new console, as with the old console, also has as its Reactor Safety Systems two independent hardwired analog High Flux Safety Channels, two , independent hardwired analog Fuel Temperature Safety Channels, and a ! I I
CONSOLE REACTOR SAFETY SYSTEM COMPARISON Ii ' OLD NEW Ii i SAFETY CHANNELS SAFETY CHANNELS l :
- 2 Percent Power - 2 Percent Power !
- 2 Fuel Temperature - 2 Fuel Temperature SCRAMS SCRAMS g
-TECH SPEC High Level Safety
-TECH SPEC
- 4 High Level Sofety l'
- Manual Trips Trips l '
- Manual
- 2 HV Loss % Power - 2 HV Loss % Power .
- Pulse Timer
- Emergency Stop
- Pulse 11mer g'
- Emergency Stop
- Water Level - Water Level
.l
-SAR-
- Key Switch
. SAR l
- Key Switch
- Steady State Timer - Stoody State-Timor
- Loss of AC - Loss of AC
- Facility Interlocks - Focility Interlocks
- Sofety Channel Colibrate
- Watchdog l>
- 2 Relays in both the
- Individual Rod SCRAM DAC and the CSC
- Individual Rod SCRAM l
l. g.
I I ' I hardwired relay logic SCRAM circuitry. The High Flux Safety Channels, just like the old console, derive their signals from two Ion Chambers mounted above the core and have readouts located on the vertical panel of I the control console. However, for the new console, these readouts take the form of LED bargraphs instead of meters. These new channels were designed to be the same as the old channels, only updated with current technology electronics. The Fuel Temperature Safety Channels will still I derive their signals from the same two instrumented fuel elements located in the B-ring and in the C-ring. As with the High Flux Channels, the Fuel Temperature Channels have their readouts on the control console in the I form of LED bargraphs instead of meters. It should be emphasized again, that these safety systems on the now consoles are independent hardwired anelog channels Just as those are on the old console. These systems are ' completely independent of the system's computers and will continue to function irregardless of the state these computers are in. This will insure safety system monitoring ani control at all times. The Scrum circuitry, again as with the old console, has two independent relays for each safety channel, one located ir the supply side and one located in the return side of the magnet and solenoid power circuitry. Similar to the four safety channels, the Scram circuitry was designed to be the same as the old Scram circuitry only replaced with current technology electronics. Table I shows a comparison between the SCRAMS on the new and old consoles. The SCRAM circuitry on both systems is the same except for the Safety channel Calibrate Scram on the old console and the Watchdog Scrans on the I new console. The old console used to shunt the inputs to the safety channels while putting in calibration signals to the safety channels. This created the possibility of operating with a safety channel in the calibrate mode. To prevent this condition from occurring the old console had a relay which would scram the reactor if any of the safety channels were switched to the calibrate mode. In the new system, the calibration signals are additive to the normal safety channel signals (e.g. the safety channels are not shunted in the calibration mode). A calibration signal added to the normal safety channel signal is more conservative (will always provide a higher channel reading) and therefore does not require a I calibrate scram. However, watchdog scrams, as described earlier, have been added to the new console scram circuitry. These watchdogs monitor the status of the DAC and CSC computers and should any of the four i I I watchdogs (two in the DAC and two in the CSC) fail to be reset by the software, then the system would scram the reactor. This ensures that failure of either of these computers or of their software will cause a I l l I system scram. l l REACTOR OPERATIONAL CONTROL AND MONITORING SYSTEMS i I The 1972 console has an operational channel which derives its signal from a fission chamber and generates the Wide-Range Log and Multirange Linear 1 I monitoring channels. The operational channel combines the standard techniques of Count Rate and Campbelling in an analog computer to provide the capability to monitor 10 decades of power. The new console uses an l l
operational channel which was designed to be a digital version of the old > system it still combines the standard techniques of Count Rate and Campbelling to provide the capability to monitor 10 decades of power. The difference is that this function is now performed with a digital computer instead of a analog computer and uses current technology , electronics. These two systems were demonstrated to be essentially equivalent during the manufactures test program when both the old and the E L l new systems were operated in parallel. 3 The interlocks or Rod Withdrawal Prevents (RWPs) for both the new and old systems are shown in Table 2. Again, these interlocks are the same for > both systems except for the Operational Channel Calibrate RWP on the old console. On the old console, the input signal to the operational channel i would be shunted when the channel was placed in the calibrate mode. In order to prevent operation of the reactor in this configuration, an RWP was added to the system to prevent rod withdrawal with the operational channel in the calibrate mode. On the new console, the calibration signal is additive to the normal operational signal, and again is therefore more conservative and requires no RWP. The interlocks on the old console'were all analog logic using relays. The interlocks on the new console use Digital Logic (Firmware). STANDARD CONTROL ROD DRIVES The three standard control rod drives will be replaced. The old drives used phase-interrupt (analog) motors while the new drives will use otepping (digital) motors (See Table 3). Only the drive motors are being , changed, the remainder of the control rod drive assemblies will stay tne came. SAFETY EVALUATION CONCLUSION I l l The AFRRI TRIGA Reactor, NRC Facility License No. R-84, is classified as a I i " Negligible Risk Research Reactor (Pulsing)" in accordance with the NRC l cpproved AFRRI TRIGA Reactor Facility Safety Analysis and as defined in . l ANSI /ANS 15.15-1978 " Criteria for the Reactor Safety Systems of Research j Reactors". A " Negligible Risk Research Reactor (Pulsing)", as defined in ANSI /ANS 15.15-1978, is "a research reactor for which, in the postulated l ovent of the complete failure of the reactor safety system coincident with a L the occurrence of the most adverse Design Basis Event, the radiological consequences would be negligible." Pulsing is defined as "a reactor that 3 has been specially designed with an inherent shutdown mechanism sufficient E to allow the reactor to accept large reactivity insertions without exceeding any safety limit." l In analyzing the safety of the AFRRI TRIGA Reactor, it is important to otart with the inherent safety of the TRIGA Fuel, which is designed to I ' l l l
l ! l : i l l CONSOLE INTERLOCKS COMPARISON n l OLD- NEW : l
-TECH SPEC -TECH SPEC I
-l
- 1 kw - 1 kw '
I- - Source-Level Neutrons - Source Level Neutrons g - Mode I (no two rods) - Mode I (no two rods)
- Mode Ill - Mode Ill :
(no rod except TRANS) (no rod except TRANS) . l > l -SAR -SAR - l - 3 second period - 3 second period l g - Ops Channel HV loss - Ops Channel HV loss
- Bulk Water 60 0 - Bulk Water 60 C
,II
- Ops Channel Calibrate * (calibrate signal additive) l I '
1 1 L l. i
Ii i ANALOS (1972) vs DIGITAL (1988) CONTROL CONSOLES Il I OLD l SAFETY INTERLOCKS CONTROL DRIVES I ! SYSTEMS (OPS CHANNEL) I' Hardwired Relay Analog Phase l; Amp-BT Logic Computer Interrupt g circuit I' I-NN g SAFETY INTERLOCKS CONTROL DRIVES SYSTEMS (OPS- CHANNEL) , I I Hardwired Firmware- Digital Stepping g Amp-BT NM-1000 Computer Motor : circuit Relays & (Digital)
, O EPROM ,I '
i ll
I operate with large positive step reactivity insertions. The inherent safety of the fuel element stems from its large prompt negative temperature coefficient of reactivity, which causes the automatic I termination of a power excursion before any core damage results. Prompt Negative Coefficient of Reactivity of the AFRRI TRIGA Reactor is
- 0.0126 %deltaK/K per
- C (-1.7 cents /*C), while the Steady State Negative The coefficient of Reactivity is - 0.0051 %deltaK/K per *C ( .7 cents /*C).
I Fuel elements with 8.45 wt.%U have been pulsed repeatedly in General Atomics' Advanced TRIGA Prototype Reactor (ATPR) to peak power levels of over 8,000 MW, and have been pulsed thousands of times to peak power I levels' greater than 2,000 MW. The AFRRI TRIGA Reactor is limited to a
$4.00 step positive reactivity insertion (technical specification limit) which would yield a peak power level of approximately 4,700 MW.
The AFRRI Facility Safety Analysis Report has analyzed two Design Basis Accidents. The first Design Basis Accident, called the " Fuel Element Drop Accident," involved the postulated occurrence of a cladding failure of a fuel element after a 2-week period where the saturated fission product inventory of a 1 MW steady state operation has been allowed to decay after being taken out of the operating core and pisced in storage; the saturated fission product inventory is obtained after 100 hours of continuous reactor operation at full power (1 MW). The cladding failure could occur when the fuel element is withdrawn from the reactor pool. While the fuel element 10 exposed to air, a cladding failure cou.a occur coincidentally, I or due to a drop. As the AFRRI FSAR explains, the probability of such an accident is considered to be extremely remote. The second Design Basis Accident, called the Fuel Element Cladding Failure Accident, involved the postulated occurrence of a cladding failure of a fuel element during a pulse operation or inadvertent transient following a steady state operation of 1 MW. Again, it was assumed a saturated fission product inventory which occurs after 100 hours of continuous reactor operation at I full power (1 MW), and a pulse operation with an integrated energy of 40 MW-sec. A 40 MW-sec pulse operation is roughly equivalent to a step positive reactivity insertion of approximately $4.50. The maximum worth I of the AFRRI TRIGA Pulse Rod (Transient Rod) is approximately $3.75, and as such a 40 MW-sec pulse operation is an extremely conservative assumption. The AFRRI FSAR again explains that the probability of such an accident is considered to be extremely remote. . The analysis in the AFRRI FSAR shows that "... the consequences from the I Design Basis Accident of a fuel element drop accident or a fuel element clad failure accident were insignificant." Therefore, it was
"... concluded that the operation of the AFRRI reactor in the manner authorized by Facility License No. R-84 does not represent an undue risk I to the health and safety of the operational personnel or the general public."
i l I Both of these Design Basis Accidents (DBAs) were postulated on the occurrence of one or two predetermined, deliberate man-made events. the first DBA, the scenario required that the reactor be operated In , I I I
i i continuoualy for 100 hours at full power to build up a saturated fission product inventory. In the second DBA, the scenario again requires a i saturated fission product inventory followed by a step positive insertion of reactivity that produces 40 MW-see of integrated energy. AFRRI has never operated at full powerunder for 100 hours continuously, EIi nor will probablyE ever operate in this manner normal operating conditions. Both of these DBAs require fuel cladding failures following a set of specific man- { made conditions and are not a result of any failures on the part of the ( Reactor Safety Systems. It was shown previously that the new console has a MTBF of the Reactor Safety System of 5 X 108 years. Failure of the Reactor Safety System would not initiate a Design Basis Accident. Even should the Reactor Safety System suffer a complete failure at the same Bi moment as a DBA, the consequences would be negligible. 5i I It was determined during the design of the new Reactor Instrumentation and Control System that no technical specification changes would be required. l There are no technical specification changes associated with the I installation or operation of AFFRI'm new Reactor Instrumentation and Control System. The new Reactor Instrumentation and Control System will offer a dramatic 3! l improvement in operational productivity, system reliability, and system maintainability. 3 l1 The new Digital Reactor Instrumentation and Control System has been designed to be safer than the present AFRRI control system. This has been ' accomplished by continuing to hardwire all safety circuits in a redundant, fail safe configuration. ; These safety circuits are completely independent of the data acquisition computer-(DAC) (CSC). This means that if either or both and the control system computer computers were to fail, the ! l failure cannot prevent the reactor from scramming. On the other hand, g critical functions of the computers are monitored by " watch-dog-timers". If the computers f ail to update the timers in a predetermined fashion, the 5 redundant, hardwired watch-dog-timers will scram the reactor. As a result, the new Digital Reactor Instrumentation and Control System has equal has which or greater safety built-in than the present AFRRI control system, SAR approval. Based on the analyses in this technical report, i has been determineds that the proposed changes to the Reactor Facilit3 do~not involve unreviewed design safety questions and, in fact, are improvements in the facility a at AFRRI. g I1 1 I' I l l 1 i
t. I This technical report describes changes and modifications made to the
'AFRRI reactor facility as depicted in the facility's SAR.
.have been reviewed by the Reactor Facility Director and found to contain These changes no unreviewed safety questions. This report.is submitted.to the Reactor and Radiation Facility Safety Committee (RRFSC) for their-concurrence that conditions of 10 CFR 50.59 are met. These conditions are that no
, unreviewed safety questions are present and that the changes made do not , increase the probability of occurrence or the consequences of an accident , or malfunction. l I ; I ! i I h 1 i i 1' i I: i
I l l i I l 1 I ; s APPENDIX & Listina gf, Corrections _ h hg ande h tha S.AR j
\. '
l l I l l l 4 i l e
. I-..
1
. I '
1
. l 1
l.I l l l I __ . . _ _ ._ _ _ . . _ _ _ . _ . . _ . . _ _ _ . _ _ _ _ _ _ _ . . . _ , , _ . . . . - . . _ . , _ _ . _ . . _ . . . _ . _ . _ . . _ . = , _ . . , . _ . _ _ _ _ . _ , , , . - . . _ _ . .
4 i l i l Eggg Section Change 4-16 \ j 4.10 This change will clarify j L the difference in the type L of drive used for the j I standard and transient l rods. 4-16,17 4.10.2 The paragraph is modified to reflect the new step- ! ping motors used in the L' control rod drives, i
\
4-16b Figure 4-8 The figure has been up- , dated to depict the new l control rod drives on the standard control rods. j l'- l ! 4-22 Section 4.11 The phrase "three ion l l' chambers" has been changed to "two ion chambers and a pulse detecto.?" to allow a-L Cherenkov detector or an ion chamber to be used for-pulse OperatJon.a. 4-22 Section 4.11 A paragraph describing the NM-1000 has been added to the SAR. I J i 4-22 Section 4.11.1 The sectavn describing the Multirange Linear Channel t
)
l has been updated to re- ; flect changes incurred by 3j l the new console. 3' 4-23 Section 4.11.2 The section describing the l- Wide-Range Log Channel has - i been updated to reflect changes incurred by the i new console. < 4-24 Section 4.11.3 Portions of the section describing High Flux Safety Channels One and . Two have been modified to reflect changes incurred by the new console. L I,
l lI 1
, hit Lection Channe 4-29 Section 4.11.4 Portions of the section I describing Fuel Tempera-ture Safety Channels have been modified to reflect changes incurred by the new console.
4-27 Section 4.12 The RWP associated.with I the wide-range los channel in any. mode other than OPERATE is no longer i I I required. See 10 CFR 50.59 writeup. 4-27 Section 4.12 The SCRAM associated with any of the safety channels in any position other than OPERATE is no longer i required. See 10 CFR 50.59 writeup. I I ; l _.l I , l 1 I
. :l L
1 I : I- 3
- i. APPENDIX R Specific iMR word chanstes f_qr. 1.ht. creviously discussed Facility Modification Safety Analyses
-i
^1 q
m. I i e 1 1 (
\ ,
.p i
.(
e
$k I
- l
. y :
1
? % .x- c \
U : l - , _1. REACTOR CONTROL COMPONENTS (Section 4.10) CURRENT SAR WORDING: * '
" Control rod movement within the core is accomplished using rack and pinion electromechanical drive for the transient control rod."
PROPOSED SAR WORDING:
" Control rod movement within the core is accomplished ,
using rack and pinion electromechanical drives for the standard control rods. and pneumatic-electromechanical drive for the transient control rod."
-l 2.. STANDARD CONTROL ROD DRIVES (Section 4.10.2)
- a. CURRENT SAR FIGURE:
Figure 4-8 y PROPQ'lQ S AR FIGI.'REi Figure-4-8_ (modified to reflect new control rod drives) ?
- b. CURRENT Eid_ WORDING: g!
"The standard drive consists of a two-phase motor, a 3, magnetic coupler, a rack and pinion gear system, and a f potentiometer used to provide an indication of rod '
d position, which is displayed on.the reactor console."
-)
PROPOSED SAR WORDING: L!
"The standard drive consists of a stepping motor, a .i magnetic coupler, a rack and pinion gear system,_and a .
4 _ potentiometer'used to. provide an indication of rod
- position, which is displayedion:the reactor console CRT."
-3 c.- CURRENT SAR WORDING:-
" Clockwise rotation of the motor shaft raises the draw -
tube assembly." PROPOSED SAR WORDING: E "When the stepping motor is energized, the pinion gear B' ! shaft rotates, thus raising the-magnet draw tube." i s. I 49
j, CURPINT SAR FIGUPI 4-3 l : g ye.'g g 9 178 es., I
; l PULL.
N,8m, mast,s. T; I I . e > ,- . ,... l ry . g i itse ,.et ., 7,,,, g . I ' 3 1 l-
!g' , r '.o'
= ". = ,.
.o .,,,
.DLI. ALWhetaques POLL.eu.R i
g . B
.E FIGURE 44
.5 STANDARD CONTROL R00 DRIVE POR SAFETY AND SHIM ROOS
- I ~ ~ - . - . - -
4-16b
PROPOSED'SAR FIGURE4-8' PLEXIBLE
~ POTENTIO!1ETER I ~
wlRE oylpg '. DRIVE MOTOR MICRO $ WITCHES SPRINGLOADED . PULL A00 -
- O o r r
, =
( l ARMATURE - ORAW t'1[ TURE TIP 0F PUSH R00 pg ELECTROMAGNET 'i SARREL PilTON 4 I 1 CONNECTING ROD bn S- . l,, ' Q;)- >> ALUMINUM CLAD ; p) j. BORATED GRAPHITE CMTROL ROD ' WITH SOLID i ALUMINUli FOLLOWEB I OR AIR. FOLLOWER g i E b FIGURE 4-0 I Standard Control Rod Drives . e - ._ _ _ _ . . _ _ . . . . . _ . . - . . . . . _ . _ . . .
r . 1
- A 3.- REACTOR INSTRUMENTATION (Section 4.11)
CURRENT SAR-WORDING:
- g "A fission detector and three ion chambers comprise the 3 .- remaining detectors."'
' PROPOSED SAR WORDINOi, I "A fission-detector, two ion chambers, and a. pulse detector comprise the remaining detectors."
.l 4 '
4 NM-1000 .- l.. j
=? O Tjig S AR : (at Section 4.11)
ADD T_O "The NM-1000 system, which includes the Multirange Linear s Channel and the Wide-Range Log Channel, is contained in i two National Electrical Manufactures Association (NEMA) ' enclosuras, one for the amplifier and one for the proces- i sor assemblies. The amplifier assembly contains modular plug-in subassemblies for pulse preamplifier electronics,
.; g bandpass filter and RMS electronics, signal conditioning ~j g circuits, low voltage power supplies, detector.high-vol- L tage power supply, and digital diagnostics and communi- !
cation electronics. The processor assembly is'made up of
-; modular plug-in subassemblies for communication-elec-tronics (between amplifier.and processor), the micro . j processor, a control / display module,-low-voltage power 1 supplies, isolated 4 te 20 mA outputs, and isolated alarm outputs. Communication between the amplifier and pro-cessor assemblies is via two twisted-shielded-pair ;
cables." l
- 15. MULTIRANGE LINEAR CHANNEL (Section 4.11.1)
CURRENT SAR WORDING: m - The multirange linear channel reports-. reactor power'from I source level ( 8 thermal watts) to full ~ steady state
- I1' power (1 MWt).- The output of.the fission detector fed through a preamplifier, serves as the channel input. The multirange linear channel consists of.two circuits: the s count rate circuit, and the campbelling circuit. For-power levels less than 1 kilowatt (t),,as selected on the '
power range select switch, the count rate circuit is
', . utilized. The count rate circuit generates an output voltage proportional to the number of pulses or counts received from the fission detector. Hence, the output is '
! : proportional to-the neutron population and the reactor
; power level. For steady state power levels at or above 1 i
1 I g
, 's kilowatt (t), as selected on the power range select switch, .
the campbelling circuit.is utilized. The-campbelling y circuit generates an output voltage proportional to the ,' reactor power level by a verified technique of; noise E envelope amplitude detection and measurement known as 'E
- campbelling. The output from the appropriate circuit is fed to'an amplifier which supplies a signal to the strip E chart recorder located on the reactor. console. The power g-level is scaled on the strip chart recorder between 0 and -
100 percent of the power indicated by the power range select switch on the console. The strip chart records this output for all steady state modes of-operation but not during pulse operation. PROPOSED SAR WORDING:
"T5e multirange linear channel reports. reactor power from anarce level (-10 8 thermal watts) to full steady st6te power (1 MWt). The output of.the fission detector, fed ',
through a preamplifier, serves as the channel input. The J multirange linear channel consists of two circuits: the j count rate circuit, and the campbelling circuit. For E power levels less than 1 kilowatt (t), the count rate WI circuit-is utilized. The count rate circuit generates an u F
' output. voltage proportional to the number of pulses or gl counts received from the fission detector. Hence, the- gJ output-is proportional to the neutron population and the l reactor power level. For steady state power levels at or i above 1 kilowatt (t), the campbelling circuit is utilized. .l
[ The campbelling circuit generates an output voltage proportional to the reactor' power level by a verified technique of noise envelope amplitude detection and g measurement known as campbelling. The NM-1000's micro- 3; processor converts the signal from these circuits into 10- 1 linear power ranges. The multirange' linear channel output a!
! is displayed in two formats. These are a bargraph g=l Indicator on the Reactor Control CRT display and a strip chart recorder located on the left-hand vertical panel on the control console. The power level as displayed on the : ", CRT bargraph and the strip chart recorder is scaled between.0 and 100 percent for each of the 10 linear power H ranges. The multirange function is auto-ranged via the l NM-1000 control system computer. The multirange linear j y output on the CRT bargraph is displayed for-all steady .
state modes of operation, but not during pulse operation. : l ll l l I E;
a ' 4 j l
- 6. WIDE-RANGE LOG CHANNEL (Section 4.11.2)- I CURRENT SAR WORDING: !
3, "The outputs of these two circuits are los amplified and g' - then summed in a summing amplifier. The summing amplifier l supplieu a signal to the strip chart recorder located on l v
" the reactor console. .The power level is indicated on a 10 l decade-log scale.'(10 8 watts (t)-to.1 MW(t)). The atrip chart records this output for all steady' state modes of operation but not during pulse operation.
' 1
'E. Durins certain steadr = tate modes, the wide-ranse los
! g' , channel also measures the rate of change of the power-I g level, which is displayed on the period / log meter located on the reactor console."
- I PROPOSED SAR WORDING
; "The outputs of these two circuits are digitally combined and processed to provide the power rate of change (pe'.iod) 1 i
and the power level indicated on a 10 decade los scale
;g (10 8 watts (t) to 1 MW(t)). The wide-range los and period g outputs are both displayed on bargraph indicators-on:the ,
Reactor Control CRT and on hardwired vertical LED'bar- ' graphs on.the left-hand side of the Reactor Control Con-sole. 'The outputs on the CRT bargraphs are displayed for-l _all steady state modes of operation but not during pulse operation."' ,
- 7. HIGH FLUX SAFETY CHANNELS O_NE AN_Q N TWO (Section 4.11.3)
L3 a. CURRENT SAR WORDING: ig "High flux safety channels'one and two report the reactor power level as measured by three ion chambers placed above o the core in the neutron field." ( ' , ,t PROPOSED-S_AR WORDING:
"High flux. safety channels.one and.two report,the reactor t .g( power level as measured by two ion chambers and a pulse 3- detector placed above the core."
lf '
- b. . CURRENT SAR WORDING:
i; "The steady state power level, as measured by the two-high flux safety channels, is displayed on two separate meters located on the reactor console." ( o [. LI 1 l t - ... .
.6 PROPOSED SAR' WORDING:--
"The steady state. power level, as measured by.the two=high -
~ flux safety channels, is displayed-on two separate bar-graphs located on the reactor console." -
- c. CURRENT SAR WORDING:
3 "During. pulse operation, high flux safety channel one is_ gl shunted and the sensor for high flux safety channel two is- i switched-to a third, independent _ ion chamber placed above- == -l the core." ' PROPCSED SAR WORDING:
During pulse operation, high flux safety channel one is-gi -
shunted and the sensor for high flux safety channel two is switched to a third, independent pulse de,tector placed 5ll L above the core."
- d. CURRENT _ SAR WORDING: -
R "The NV channel output is. displayed on-the strip chart - recorder located on the reactor console. ' The NVT channel - output is-displayed on the reactor console NVT meter." j PROPOSED HAR WORDING:
"The NV and NVT channel outputs are displayed on two l separate bargraph indicators located on the left-hand .
side of the console."
- e. CURRENT SAR WORDING
- g
" Knobs-for each channel, located on the reactor console, p1 allow the channels to be checked for calibration. !
Switching these knobs to any mode from operate (i.e., to a the zero or calibrate positions) causes an immediate-reactor scram." g' ' PROPOSED SAR WORDING:
" Calibration of each safety channel is done automatically
- t l
when the operator initiates the " pre-checks" by activation of the Prestart Check Switch on-the control console's Mode B Control-Panel. Any failures detected during the prechecks 5 will be automatically reported to the operator via the reactor status CRT. This calibration can only be per- .g formed while the reactor is-in the SCRAMMED mode." g . i l I I B1
w> ,
-f.. CURRENT SAR WORDING: '
I, "A trip test knob-for each safety channel ..." PROPOSED SAR WORDING:
"A tripItest switch for each safety channel ..." 5
-8. FUEL TEMPERATURE SAFETY CHANNELS (Section 4.11.4),
- a. CURRENT SAR WORDING:
Jg "The two fuel temperature signr.ls are amplified and i
;g: displayed on two separate metc.rs located on the reactor console. During pulse operation, the output of fuel temperature safety channel one is also recorded on the.
; reactor console strip chart recorder."
. PROPOSED SAR WORDINO:' I oj "The two fuel temperatu"e signals are amplified and g g-' displayed.on two separace bargraphs indicators located on the reactor console and on the reactor control CRT." r I- b. CURRENT SAR WORDING:
_. > "A trip' test. knob for each fuel temperature safety I channel, located on the reactor console, provides a means. of testing the scram capability of each channel without having .to actually reach or exceed the technical. specifications-limit on allowable fuel temperatures." i PROPOSED SAR WORDING:
" Calibration of the Fuel Temperature Channels is done-automatically when~the reactor operator initiates the
" pre-checks" by activation of the Prestart Check Switch on .
. the~ control console's Mode' Control Panel. Any failures- '
~
detected-during the prechecks will be automatically reported'to the operator via the reactor status CRT . "
- 9. ROD WITHDRAWAL PREVENT (RWP) INTERLOCKS (Section 4.12)
CURRENT HAB. WORDING: I "RWP prevents any control rod withdrawal if the wide range los channel'is in any mode (i.e. position) other than OPERATE."
! : PROPOSED SAR WORDING:
L
-This requirement is. deleted (See document for analysis).
I I :
- 1. I l' . _ . . . _ _ . , _ _ _ , ,
it
.3 ,
s 4
=10.: SCRAM LOGIC' CIRCUITRY'(Section'4.14)-
, 'QJIRRENT SAR WORDINO:
"Any of.the safety _ channels _(fuel temperature safety'. gi
' channels and-high-flux safety channels) in'any position B, other than OPERATE (i.e., CALIBRATE or ZERO)-causes a reactor scram." _
PROPOSED SAR WORDING: '
-This requirement is deleted (See document for-analysis). ;
( , I . s l '< I: I I n: E g.i. , t
- I i IT 3
I I I
. ~ . . - , . . .. . . . . . . - -- . . _ - . - - . - _ - - . - . . . . ..
4 , s i
?
! ?
t
+ 1 '.
'. ,7 , s.
i
't .. . ) >
APPENDIX C AFRRI TRIGA Console.1Xafety) Scras System ' Single Failure C_nteria Analysis L f m I : il: - " l' 1 1 I .
L AFRRI TRIGA Console (Safety) Scram System . Single Failure Criteria Analysis'
REFERENCES:
- 1. IEEE 279-1971 Criteria for Protection Systems: for Nuclear Power Generating Stations. W l
- 2. IEEE .379-1977 Application of the Single Failure Criteria to' Nuclear
\
Power Generating Station Class IE Systems. The following analysis is postulated upon the principle (explained in Reference 2, Section 6.1(4)] that redundancy. of protection devices provides complete assurance of safety in operation with regard to the parameter monitored b'y the. device. For example, the_ failure of a fuse to blow when subjected to its 1 designed rating of overload current is a credible possibility, but the failure of two identical fuses in series to blow simultaneously is not a credible 'l possibility. 1, The steady steady-state timer scrams the reactor after an elapsed time' and no redundancy is provided. The probability of the failure of this - device is estimated as follows: Mean Time Between Failure- (MTBF) of the electronic circuitry is about 200,000 hours- based upon parts -count and stress - factor per : MIL-HDBK-217B. At 200' hours per month this is one failure in 83 years. The electronic timing circuits operate relay contacts whose failure rate is ' expressed in operation cycles-rather than MTBF. A conservative estimate based on manufacturers specifications is. 25,000' operating cycles. Atitwo
.[
cycles per day and 5 days per week, this is one failure in 48 years. The unt - likely ' failure is increased contact resistance rather than welded ' g contacts so that an unsafe condition probably is not credible in less than = 100 years of operation. The steady state timer is not a required safety system component. - I B
4 I ~. ' ' , '
-s ,
d m 1 s ,L ,
' 2. : h pulse: timer ~ scrams ths racetor after cargletion of a power pulse and - t 3g no reency is .provided. The ' rated ' life of this device is - 25'),000:
5 electrical operations which exceeds the ~ probable number ;of. pulses Ho be produced. , 1
, . .. The- probability of random failure calculated as MIBF per MIL-HDBK-217B based upon parts count and stress- factor is greater than 300,000 hours. At 200 hours per month, this is equivalent to one failure ! in '125 years.
- 3. The manual scram button is used to shut down the reactor manually. The specified- life is 100,000 cycles of operation. At 15 manual scrams per day this would be one failure in 25.6 years. However, thIs;is a normally closed switch with a direct acting operator. The most likely, failure mode is a broken switch structure which would result in failure- to reset after a scram.\ Welded contacts would be separated'by mechanical force of the 1
. direct action operator. Redundancy for a manual _ scram' exists in the console operator key switch and power on switch.
- 14. - The console. key' switch de-energises the magnet supply as well as other circuitry.' The estimated life is 10,000 operations. At 15 operations per j L
day, this is a failure rate of one every 2.6 years.. However, the key l switch is not depended upon to perform a safety function' except to , s prevent unauthorized startup. The manual scram button provides shutdown
'h redundancy so.that an unsafe failure is not credible. : '
)
( 5. L All reactor = tank .sh'elding door interlock switches and emergency stop ibuttons remain from tb; existing system and are unaffected by. the new J hardware.; The : emergency stop switch and all other switches on.the new l _
; ( console use the same actuator and switching elsment .as are used on the .
- \- .
OE I eye O - l} Lg 3l5 ,
-2
. 4 f
n. l:.\
'6. The less of AC. power causes the magnet -supply to be de-energized which in tun produces the same response an a manual scram, dropped rods.
- 7. . The high . level trips in the two power safety channels are- redundant' and ;
therefore do not present a ' credible mode for failure. ' All non-safety -
- outputs' are physically separated and isolated to ' prevent' cannon mode g; failures which may otherwise invalidate the . single failure criterion. A~ E.'
separation of six ' inches, or a - metallic flame barrier exists , between all safety and non-safety circuits. A ..* .' ... isolation voltwe - L' of 1500 volts ' RMS -or DC applies to both optical and transformee isolation. , The MI'BF of the two NP1000 safety modules is greater than 20,000 i . hours based upon conpanent failure rate data taken fren MIL-HDBK-217B. The bistable trip portion of the NP1000-has an MGF greater than. 200,000 hours. Because the NP1000's operate independently,. i
'each with -its own detector from' the existing system couplete radi=A=Ny .,
exists, m if
- 18. ; ' The~ detector high voltage is interlocked by trip circuits- in the power and safety channels andi the redundant - circuitry makes unsafe failures not
- s credible. : Separation and isolation criteria of item 6 above apply.
1
- 9. ,The two - fuel- temperature safety channels - are high reliability modular-signal conditioner / limit alarm devices each with calculated MIBF figures -
~
exceeding 200,000 hours. The < channels are radi=Annt with separation criteria' applied to the wire harness therefore an unsafe failure is not g, 5a credible. j 10. The magnet supply' ground fault detector uses a high. reliability modular
; signal conditioner / limit alarm. The signal conditioner module L has an f; r
MTBF of greater than 200,000 hours. 'Ibe Ihnit alarm uses a relay rated for more than 25,000 operations. There is a pushbutton switch which is used to test the. operability of the ground fault detector on a daily { l
-2 .
E-1 - L a. 1 8 - , .
g .
- 7. - . -____ - - . - . . - . , - . - - . - - - - - . -. . . - .
VL u l basis. Because the relay - only _ operates during testing; and fault ) l conditions the and of life cannot be reached. ' Therefore the . probability j
. of an undetected ground fault-is the probability of- randan failure in the: ;
signal conditioner which is less than one in 23 years. 11.- Pool Level Monitor ' Pool water level is monitored with redundant float ' i
. operated switches and redundant relays with contacts in the scram -
1 circuits. - 'l The switches and relays have failure rates of less than one in 106 hours J but redundancy makes a water level monitor failure not a credible failure 1 7 i i
- 12. Watchdor Scrams - A watchdog timer on the data, acquisition couputer - /
.and another on the control system computer -are required' to be reset I periodically by a program routine sa - a' safeguard against computer !
component. failures either In hardware or software. -If the required R 0l response is not received within a definite time period, W=at normally open (fall safe) contacts interrupt' the scram loop dropping the rods and j ( ' shutting down the reactor. - The watchdog timer is an. additional safety
- devic e. ,
1 g , u o
~
1 1 l 3 4
'y Q, ;
q/ ' : g!, : 1,- ci '
. !~ t 1.\ ';
' ,yLes
.q p , '.
g -l c s
- - e,
(
' ,o
',i
. ilu *)
t a,H . t i
- 3
,i f '
55.. Is lf 4 $1
;t:
i h e b > L APPENDIX R
'. n
-i, I 8 Scram Circuit Safety Analysis -[
ior ths.
~
.y I' University oJ. Texas T_BIGA Reactor i
t- . y - vl. 1 I I i [g LN TE: The original subnission of the. Safety Analysis in Juno 1986' contained ' l; g a preliminary version of Appendix-D dated April 1988. That has been replaced in this . resubnission - (June 1990) with the final version dated ;
- , 1
" July 1988. .-
l , "i t l' Sh l 'L i . l $5' 3 Ib. ,
~
'k ^
1s ;
, l
- . +;
> ,h \ hN , G - 1~ 1
, 1 w, .e .%e t T fP f'
~~
p;
~ ~
;;hrM . CdLLEGE OF ' ENGINEERING q \C
- &'.}6 r w THE UNIVERSITY OF TEXAS AT AUSTIN. g_'
b ./ , g l p DepartmentofbtnhanicalEngineering NuclearEngineeringProgram Austin, Texas 78712'(312)4713136 o . September li 1988'- M' ark Moore AFRI-
' Defense. Nuclear Agency- ,
. Bethesda, Maryland- 20814-5145 Dear Markt I
- Enclosed is the final version of the scram circuit report. -
s This version has'several-technical corrections and has been reviewed by General _ Atomics. A question was raised regarding the treatment of-certain types of-' shorts, but we did not feel the present treatment misrepresents the conditions.' A later question regarding common . mode failures.(within two-NP1000's) has not been considered, since. 5
'the failure mode and rate are' undetermined. Ilowever..provided the
' mode or a? probable rate-is postulated, the appropriate impact should i Ibe readily predictable.from.the enclosed analysis.
~
I hope this version will help complete your 10CFR 50.59 docu-
- mentation. Please feel free to contact me if youlhave any questions =
7 or comments.. Sincerely, !
$cd L. 5" ThomasIL. Bauer
Assistant Director NETL j LTB/1s Enclosure
'1
. 1 1 l l I' 1 s.
. l g:-
- q
'I "
The University-of Texas at Austiri g; lf , Scram Circuit Safety Analysis for The University of TeHas TRIGA Reactor. l [g Prepared by: Dr. Thomas Bauer Assistant Director Nuclear Engineering Teaching Latwratory. i( , -
,o David Goff 7 y y Engineering Science Student -
=
July 19,1988 e,- m - 15;
/
7[ qis
g-TRIGA-ICS Reactor Safety System g Protective actions of the Reactor Safety System (RSS) are provided by 1
- several parameter :nessurement channels and a control-rod power circuit (scram circuit). Each measurement channel controls operation of the scram l
- I circuit' by means of a relay in the circuit. When any one of these relays is tripped,'it cuts power to the control rods.
' The scram circuit design is comprised of four functional sections. These, represent the physical circuit , including the ground fault and power supply
- monitors, a manual section including the key switch and manual scrams, the .
(' protective action monitoring of the system, and monitors of the system's , operability. These sections are shown in the diagram below.
~
Protective Action Signals f,0 Loop key $ witch
/
l-Fro 9rsm
+ h Control Religs 20 V DC Circuit w rce status
=- g.,g Control
. g I __
Protective Action
~
Ildhual Scram Signn13 (-) Loop Switch RSS Functional Diagram
.l The following analysis first looks at the basics of the system in -l l
steady-state operation. After a general failure modelis developed, the .l analysis expands to look at the calibration checks, the bypass relay used in pulse mode, and monitor channel failures that provide protective action 1 2
4 1 hl Ll L signals to the scram circuit. ll RSS Failure Analysis g The RSS scram circuit supplies power to the control rods and hence is the'
]
l point at which all scrams occur, or fail to occur, its proper function is ' f therefore imperative to safe operation of the reactor. In analyzing the scram 1 circuit, as many potential failure modes as possible were examined to I 1 1 estimate the probability of a circuit failure. The ultimate failure consequence was that the control rods were not inserted and no scram ) j: occurred during a scram situation. In order to examine the way in which individual failures in the circuit might lead to a non-scram condition, a fault
~l tree was constructed based on an analysis of the scram circuit.
The first step in the RSS failure analysis involved identifying the various
. ways in which the RSS could fall. These include:
I !) Physical System Failure
- 2) Limiting Safety System Setting (LSSS) Failure
- 3) System Operable Failure j
{ 4) Computer / Manual Control Failure 1
~( The Physical System failures include wire breaks, shorts, and failure of the ground fault detect and voltage detect circuits. The LSSS failures are those which would cause loss of the ability to detect an unsafe condition.
These elements include:the Fuel Temperature monitors and the Percent Power monitors in the NM-1000, NP-1000 and NPP-1000. System Operable failures are those which cause loss of the ability to monitor the operable condition of other systems, for instance the high voltage monitors. Finally, j Computer / Manual Control failures are those associated with the program l relays or the manual scram and key switch. 3 5: 1
\
- 1 H
- l 1 L <
The failure analysis is based.on a fault tree approach in which the' l; probability of a particular failure is broken down into component parts which. L - are either added 'or. multiplied together depending on whether the j components function in an "or" or an "and"' manner respectively. The general I equatlan for the fault' tree is:
;gy L
Pp,n,, - Paysys + PLsss + Psysop + Pcomoman (I) Where Pp ,g,, _is the overall probability of the circuit falling to scram in a . scram situation and,the P's j are tiie probability of each of the failure modes g described above. This analysis assumes that combinatorial failures between - the four types of failures are rare events and thus are excluded. Unless a . specific common mode failure exists, combinations of single failures between
-l different. types; should not cause a condition that prevents the protective action of the RSS circuit.- Multiple failure scenarios are significantly less probable.;
l-l
.lq l
.l-I?
Il , 4 Il :
r .
?
.)
j l FAUL TREC OVCWfW j i , l
- v. -
I i Control Rod Relene
, 1 Fi Are th I'
1 Control physic 31/ i sl I: Circutt input-finnual F tilure Fillure
'l
[ l 1 _. II
.\
Z >
- n. ,
< l
\; l [., I o- LS5$ Event System Computer / Phyrical I Detection
- Opernble Operator System
-! Failure Failure Fiilure Fails s
x P =P +P$gs0p +PComp / Man + PPhg5gs (1) I' failure Lits l's - k l' l I I:
I, 1 Physical Systemt hhere are many potential failures in the physical system. Fortunately, most result in loss of power to the control rods and hence, a scram situation. The possible failure modes are: Power loss.
.l l Short to line (supply to return)
Short to power Power fluctuation Voltage detect circuit failure Short to ground l i
. Ground detect circuit failure Short to line (supply _to supply or return to return) g The first two failure types, power loss and short from the supply to return trains, inherently scram the system by cutting off power to the l control rods. Shorts to power are also safe failures as they do not prevent .
operation of the circuit and in any event are subject to detection by the l ground fault detection circuit.- Therefore, these three failure modes are not
.of concern for this analysis. l The fault tree shows the probabilities associated with the five remaining l failure modes. Failures are broken into two categories for the fault tree.
analysis: failures which represent faults in the ground detect and voltage - detect circuits coupled with physical failures in the system and failures that
! involve shorts along the supply and return trains which are undetectable by j the ground and voltage detect circuits. ,
I The first failure considered is a power fluctuation which damages the
? circuit coupled with a failure of the voltage detect circuit. .It is assumed that
{' such a voltage fault could cause relays to fuse or otherwise malfunction in a
'l 1 manner that would prevent them from operating properly so that in the event that the voltage detect circuit failed, an unsafe situation would arise.
In reality, a voltage fluctuation significant enough to cause such damage g
, I'
y would probably cause other da' mage which might result la a scram situation; ' Nevertheless, the probability is included for the sake of conservatism. ' In considering the next failure mode, ground failures, it is important to q note that the entire scram circuit is isolated at least 15 KA from ground. In order for a ground failure to hurt the system then, two ground failures must occur on the same line to provide a short around one or several relays, the i I . ground detect circuit must fall to notice the i; mund condition, and a line short occur on the other line (or a circuit relay also fall). This gives a fourth-
" i l power failure term and is several orders of magnitude smaller than the' other possible failures in the system. '
Finally, a short along either the supply or return train would not be detected by the scram circuit. Such a short would negate the safety relays
~
between the two points on the line at which the short occurred. However, g for this to lead to an unsafe failure, such shorts would have to occur on both
- the supply and return trains because all safety monitors are duplicated oni l both trains: This redundancy structure is shown in the fault tree and makes-tnis a non-single failure mode. An alternative failure mode of the safety system with the same result of a short on both lines as mentioned above,is a short to line on one line and a relay failure on the other line. .
There are two approaches to dea' with the possible combinations of line short and relay failures. One approach is to consider the circuit as a whole and assume the probability is simply the sum of a line short or a relay failure occurring on both lines.- The other approach is to consider the number of segments across which a short could occur and the possible relay failures which could occur in conjunction with that particular short to cause ( an unsafe situation. This approach depends strongly on the geometry of the system as to which failures are credible and which are impossible. This I 6
-, gp ,.,u
g analysis will therefore approach the line-relay failure combination from the-overall picture standpoint, Note that these two models should give about the same probability of failure since the one model considers large cable length and few combinations of failures while the other considers short cable lengths and many combinations of failures. l I The equation for this segment of the fault tree, then,is:
\
;PPhysys - (Pyf,,it *Py o,t,ct) + l(P3 ,f,,g)2 . per. Detect ' @shlinep + P ,i,y)).+
.g [
l(Pshune + Pp ,i,y) * (Pshune + pP ,i,y)l (2) Where the squared term indicates that a ground fault must occur twice ' on the same line, P can be substituted into Equation 1 as part of the physys g overall failure probability. I I
.V
.I , .
I 7 I
p;y . 4 PFYS': CAL SYS EM AULT ~REE .E jg
'4c
~
9 'ic ii System -
! -;"1
- Fails
[gi g 1
; I ]
l:I l
, Ground Ytring F tult $horts L
- o. Circuit to Line i
F uis Power Oround Short Snort Monttor Monitor onin g In Fallure F tilure unOut Line Lme. Power Power ' Ground Uns afe Short p,g, Short Detector Detector to '* Ed39 Supply Ground
' FMis FMis F ails fails Fails Short- Line Line l
i'
'P.6(Pr,,it+P 3 o uoeteet I .
P3 =((Pshtine + + P,,,,, ) * ( Pshtia. P,,,,, )) t
- j. : ,
l l % Same 01her
. Lin' Line l- ( Fiults F ailure f;
J [ l'-- Ground Ground
# '"9 chort Short [
- Short l Failure t
4 '
= [(PerFault) + Pernetect * (Pshtine +Paelay U 2
P PilYSYS
=P+P+PI 2 3 (2) 1
- j. .
t u
r l Limit'as t Safety Systesa Setting The LSSS consists of the fuel temperature monitors and the percent g power monitors. For either high fuel temperature or percent power to cause a non-scram situation, relays on both the supply and return trains must fail. This is because there are two independent fuel temperature monitors, one connected to each line of the scram circuit. Similarly, there are 2 percent power monitors independently connected to each side of the scram circuit so { that in order for a failure to occur, both would have to fall. This is clearly a ! non-single failure mode.' External scrams may be inserted at two points in the scram circuit. If the ! external scram is a safety system setting these scrams should be installed as separate circuits at'ench of the two points to maintain the non single failure / criteria. An additional square term representing the circuit failure is necessary to complete the failure probability for the limiting safety system l'; setting.
- The. equation for the probability of LSSS failure as shown in the fault tree -
is: - i Ptsss - (Pp ,7,,,)2. (pgpg )2 (3)
.Ptsss may be plugged into Equation 1 as part of the overall failure probability equation.
I I 8 l
~
g x l ! L%%5 AU_" TC - l 1
.] ,I LS$$
System F ails I
~
.y g n 1
f u+1 Temp. B- C'etection TPower Detection
-{
f411s Fiits I s .
, fu+1 Fu+1 WPwr "I RPyr . '
Temp. .T emP- Fnils - Fails
. g .. #1 Fntis e2 F6ils
- g -i i
2 1 P =(P.mp tsss n 1 .gptrior)2 01 -i I: I. f
.?
I: I 1 I!
~
l z System Operable Failure i The system oper2ble components are the high voltage, software watchdog, low-water level, and external scram relays. Each system operable l component has independent sensors wired into both the supply and return lines and so is a non-single failuce mode. A high voltage scram checks the voltage on each of the percent power monitors. There are two pairs of watchdog relays, one for the CSC and one for the DAC that monitor loss of program execution. Low-water level monitors check for extreme low water l ; level in the tank. The external seram insures that all enternal conditions are met,if applicable. External scrams should be installed in pairs, one circuit in both the positive and negative sections of the scram bus otherwise the failure probabilities of this analysis may be substentially altered, g Monitoring of computer program execution with software ressettable timers provide time out switches with two relays for each computer. Each l, pair of relays for each computer are set by program software control of four separate timers. These timers cause a scram if not reset within a five second time period. The four timers can be set by the same or separate software g er.odules and may be connected to the relays in different combinations. The equation governing the probability associated with the system operable segment of the fault tree is: l Psysop - (Pg y,)2. (p )2. (p q)2. (pese)2. (poAc I* (4)
. P3y Where the squared terms are due to the redundancy in the system.
o, can be plugged into Equation 1 as part of the overall failure l l probability. I
. I .
q I g.
I I Camputer/ Manual Control g This section describes the probability of failure of the program relays and an operator scram. Since the program relays are identical, the possible l failures are that one relay falls to open on command, or that two, three or all four iall, if only one relay falla, insertion of the three remaining rods will shut down the reactor so this is not an unsafe failure mode, if any two, g three or all four relays fall to open, the reactor will not shut down. It is easily demonstrated with a probability tree analysis that the probability of l 2 failure of 2,3,or 4 of the relays is 6Pg . 4p g3. p 4g where Pris the proonbility of a single relay failure. This expression will clearly be dominated by the first term for small P rso the cube and fourth power terms will be disregarded in further analysis. The operator scram is normally initiated with the manual scram switch. In the case of a switch failure, however, the operator has other means to g shut down the reactor. These include the key switch and the individual rod controls. The expression for rod control failure is based on the same three-out-of-four logic as the program relays as again, only three rods must I be inserted to shut the reactor down. The cipression, then, for the probability of failure of these subsystemt is: l Pcomomen - 6Ppe,p i,y2 . (pn,n c, . p9y 6Pagetri 2) (5) Note that the operator has three independent methods to scram the g system, all of which must fall for a non-scram situation to arise. This is highly unlikely as the switches themselves are redundant. The manual I scram switch, for example is wired directly into the rod control circuit at two places, one on the sur ply lina and one on the return line, Mth of which 10 I-V h '
Il SYSTCM OPCRABLC FAULT TRCC I, i I System Operable Vailur 5 l Softvare Operable i Function SVstem j Try Fails Detect d Fails i l i External System Ia CSC DAC Detector Detector yg ydog Fails fails { Falls Fails ils il I Ils Sr 1 Sc 2 Lov Vater 1 H6gh > Fails Fails Level Trip ' Voltage l Fails Trio f ails I: S @ I 2 p$gsty . pC $C2pBAC2 peat pLept2pper2 (4) tow Low g,y, si g,v, e Vater Vater Falls fails a j ragg, a2 Fails g, , l I. I- - l
i I l must fail for the manual scram to fail. A third contact pair provides a status signal to the computer and is also capable of causing a scram by software I commands within a 5 second delay period. Similarly, the key switch is wired l i directly into the scram circuit at one point and also will send a power off l signal to the computer software. These software signals stop the CSC from l l updating the watchdog timers and after five seconds, they will time out, l scramming the circuit if the other switch contacts failed to do so. Finally, j I there are the individual rod controls. These are run through the CSC and so g demand that the software be operating properly; however, the watchdog relays are designed to scram the circuit in the event of a software failure. : Assuming then that the software is running, only three of the four rod j controls must function properly to shut down the reactor,l.a. here again I there must be two failures for the system not to scram. Overall, then there j must be several catastrophic failures all occurring simultaneously, none of g which is caused by an event which would teisser other safety systems, for 1 the operator not to be able to scram the system.
]
Clearly, the expression is dominated by the chance of a program relay j
- failure and the probability of the operator being unable to scram the system i l
!s venishingly small.
l g-I l I I i1 L
( ; -t , I COMRRCR / t'lANUAL FAU_T TREE I I I I Cornp/ Mar. Failure I Software Operator Scram Scram Fatis Falls
$ A B6ckups Mermal I*II 1 RelaV 2,3 or4 Scram Fails to Relays Fails l Op+n rasi ,
W i l K'V Rod Does Not Not a Swit h Controls Prevent Single I*il Shut Down Failure
' I 1 Reity . 2,3 or 4 Fails to p,g ,
i %" Fall - Does Not Prevent g, l 3 5-Shut Down 7,gg, P, g fg,, = 6Per.netav + g(P ,,,,,* P g , ,,* 6P .ectri ) I a (5) I { I a1 h .__
I Failure Analysis l jg Many of the relays in the scram circuit are of the same type and hence have identical failure probabilities. The fuel temperature, percent power, l 1 high voltage, watchdog, low water, external scram, and program relays are I all similar. An expression for the estimated failure rate for relays is found in Military Handbook 217 Revision E. It is based on the environment, cycles per hour that the relay is expected to operate and of course, relay type. The Handbook gives the expression for failure as: 1 6 A r* A IbP . t' p
- pc
- peye ' p g* p,) failures /10 hrs (6) g Assuming a double pole, single throw, solenoid relay operating at less than one cycle per hour, carrying less than five amps, the literature specifies !
l' the modification factors as: l p,- 4.6 : Environmental Factor i p, - 1.5 : Contact Type Factor i
- p,y,-1
- Cycle Rate Factor pg 12 : Family Construction / Application Factor p, 1.5 : Quality Rating Factor -
.I' pg 1.28 : Load Factor N .006 : Base Relay Failure Rate .
I 6 ' Equation 6 then gives rA - i failure /10 hrs, if P,is the probability of a I relay failure per hour, then P, - 1 x 10-6 failures /hr. Note that in order to l keep the failure estimates conservative, all failures are considered unsafe in the analysis. In reality, there are several safe failure modes, e.g. a relay opening without cause is a safe failure as it causes a system scram. For the manual scram, control rod and key switches, a similar expression i applies: I ' 12 ) l l
_y I i A , = A , (p, ' p, ' p,y, ' pt) f ailures/106 hrs (7) Il j Where: p,- 2.9 : Environmental Factor 3 p, - 2.0 : Contact Type Factor p,y, - 1.0 : Cycle Rate Factor l ) pt - 4.77 : Load Factor A, .034 : Base Switch Failure Rate l! 6 Then A , .3 failures /10 hrs and P,- 3 x 10-7 failures /hr. Note that this is only the probability of a physical failure of the switch itself. However, because of the redundancy in the operation of the switches, as described in l ' the section on operator scrams, this probability is much larger than that of the switch operating properly, but failing to scram the system due to internal ; i system failure. For the conductors in the circuit, data is given by the IREE Guide to the , Collection and Presentation of Electrical. Electronic. Sensine Comoonent and Mechanical Eaulement Reliability Data for Nuclear power Generatine Statkum. i l The Guide suggests from empirical data that for a short to ground, the probability is Pg- 1 x 10-6 failures / hour /100 circuit feet. The probability of I. > a short to power is Ppwr - 6 x 10-7 failures / hour /100 circuit feet, it is l , assumed that a short to line is similar in probability to a short to power.
~
g{ Although many line shorts may require two breaks (failures) in the line to
- get a short, the possibility that a single event could create a short must also be considered, e.g. a wire falling across two terminals, or that overlapping l
cables could allow a single point line short. Therefore,in the interest of conservatism,line shorts will be considered as single point failures, g The ground and voltage detect circuits were assumed to have the same I 13 I, I _ ,. _- _ . . _ _ _ _ - _ _ _ _ - . _ _ - - . - - - - - - - - - -
I ! i overall failure rate as a sensing instrument. This failure rate number is rather conservative since the detect circuits are much simpler than most sensing instruments and have fewer failure modes. Reliability and Risk l Analysis suggests a failure rate for a sensing instrument as: Pinst - 1 x 10-6 failures / hour. The probability calculation for each of the four sections of the fault tree l are as follows: Pp ,y3y, - l(P,)2 . in p t . (p , . p a)j . (ph, . p ,t) . [ (p , . p a) * 'I (P3, + P,)] - 3 x 10-12 n
]
g Pt .sss - 2 ' P,2 - 2 x 10-12 Psy ,o, - 5 ' P,2 3 g g y 12 l Pc ,% - 6P,2, 4p,4 - 6 x 10'12 1 I Using these numbers in Equation 1, we see that: l l Prahre - 2x 10-11 failures /hr, or a mean time between failures of 7:106 years for the failures considered. It is important to note that this is not the expected time for the circuit to go without failure, the long lifetime is rather -
-l indicative of the inherent design of the system in that all single failures will cause a scram condition, therefore, only two or more failures occurring simultaneously can lead to a potentially unsafe failure. The improbability of ,
this happening is reflected in the low failure probability. I I I g
I i Explanation of Equations The equations given for switch and relay failure are of similar form. I They include a base failure rate for the given component type ( Ag) and several modifications (pi's) based on the individual component and the g system in which it operates. The modification factors used are explained below. p, : Environmental Factor p, : Contact Type Factor g p,y, : Cycle Rate Factor a pg : Family Construction / Application Factor pq : Quality Rating Factor pt : Load Factor I Numerical values for the p,'s are given in Military Handbook 217-Rev. E and have been transcribed in part. Most of the modification factors depend on whether the component meets MilSpec standards or is considered " lower l quality". In the interest of keeping failure estimates conservative, it is assumed that components are not MilSpec quality. I; P,is based on the environment and installation type. For a fired ground l installation, p,is 2.9 for switches and 4.6 for relays. Pc is the same for relays and switches and depends on the form and I number of contacts. Values for Pcare shown in Table 1 below. I:
. I I
i I Table i ' Table 2 Table 3 1901 f.c 1 ft BAUR9 f, i
$Pli 1.5 .95 f.82 R .I BPli 1.5 .I 1.86 P .3 !
- I' 5 POT SPli 1.75 2.0
.2
.3 l.28 l.74 M
L 1.0 1.0 4Pli 2.5 .4 2.72 hlReled 1.5 BPti 3.0 .5 4.??
-I 3PST 4 POT 4.25 5.5
.6
.?
9.49 21.4 6 Psi s.e I For pg , the load factor, values are determined by S, which is the ratio of
~I the load current to the rated resistive load. P tvalues for an inductance based j l solenoid relay are shown in Table 2 above. The relays are assumed to be rated for 120V which gives an S .2.
'I - For a switch p,y, is equal to the number of cycles per hour that the switch is operated (p,y, -l if less than icycle/hr). For relays, p,y, is 1.0 if the relay operates at less than 10 cycles per hour. I The quality factor, p, ,is shown in Table 3. The relay quality ratings are unknown and hence the relays are assumed not to be rated. Finally, pgis shown for several relay construction types in Table 4 below. Table 4 l Eg Contact Current Construction Igna l I 0'
.I- 18
$6geel cortest tem muell med Armeture try Reed 3 mAmps lig lifelted O Megastle Letch
- I 14 le6esold 6 0-5 Amps Armeture I le 12 telected Armature 5elseeld I 16
'I:
III These factors can be plugged into Equations 6 and 7 in the failure j analysis to get: g A r* A IbP
- LPe
- pc
- peye ' pg
- p,) failures /106 hrs (6)
A r= .006 (l .28 ' 4.'6 ' 1.5
- l .0
- 12 ' 1.5)
I i A r= 1 Failure /106 hrs A , = Ag (p, ' p, ' p,y, ' pt) Failures /106 hrs (7) A ,'= .034 (2.9 ' 2.0
- 1.0 ' l.48) g A, = .3 Failures /106 hrs Finally,it should be noted that these numbers assume that all failures are I-unsafe. In fact, failures to an open state cause a scram and.hence these numberp are inherently conservative.
l { II I ga IL I g I 17 g
I Bypass Relay The bypass relay is used to cut the NP-1000 out of the scram circuit upon entering pulse mode. When this occurs, only one monitor for percent power l remains able to scram the system. The preceeding analysis on failure modes shows that one of the reasons for the extreme safety of the system is the redundancy inherent in all monitoring systems. This redundancy is ; compromised when the reactor goes into pulse mode. Fortunately, the reactor. normally stays in pulse mode for a very short time so the chance of a failure g at that instant is very small. A potential problem could arise, however,if the bypass relay itself failed ,
-l and the system did not return from puise mode. In that event, the system l could operate for an extended period without the NP-1000 to provide the extra safety factor. If the bypass relay does fall, this failure will not be g apparent on the operator's display. The percent power indicator for the NP-1000 will remain functional because the CSC will still be receiving !
information from it. It is, therefore, necessary that the operator check the NP-1000 safety limit scram each time the reactor is pulsed to confirm that 5 the bypass relay has returned the system to steady-state operation. ; Note that even if the bypass relay falls, the NPP-1000 is still monitocing
- the system and would be able to scram the system should the percent biwer
'l exceed its limits. For the circuit to remain in operation and totally
-unmonitored, the NPP-1000 would also have to fail. This again creates a situation in which two failures must occur for an unsafe situation to arise.
The new probability equation for the LSSS due to the bypass relay is: Ptsss - (P p ,%)2 (pgp p )2. (p gp ,r . Pey,,) - 3(P, 2) - 3: 1 0-12 Instead of Ptsss - 2(Pa ) - 2x10-12 as before. I 18
~
I .
l y i I' Calibration Checks At system startup, the calibration of several systems is checked l automatically. These systems are: fuel tempereture monitors. percent power monitors, high voltage monitors, and the watchdog timers. The manual scram switch, magnet key switch, low water level, and external scram settings are g , not tested by the auto pretest function and should be checked manually, g' The fuel temperature, percent power, and high voltage n.onitors are checked by means of relays which switch from their normal positions to cut the monitors out of the system and allow a test current to be run through the sense section of the system. The CSC monitors when the system tfips to assure that it is at the gecified point. This process effectively compares a preset trip point to a software generated signal. The relays then return the system to normal operating mode. To check the watchdog timers, the CSC sets l' each timer and to compare it to the clock make sure that it times out within
. the appropriate time. An optional calibration signal'in some LSSS signal i circuits is a function that adds the test signal to the sensor signals. Failure to g,
remove this additive signal are conservative and will not lessen the protective function of any channel. L 1 -l l For the fuel temperature systems, percent power, and high voltage if any relay falls to return to normal operating mode, no current from the detectors u would reach the monitor circuits and this would result in a loss of signal I g condition. A loss of signalindication can be verified by the observation of the zero state of the signal display. If, however, an entire system falls to return l to normal mode e.g. the fue!' temperature monitors, and the calibration current remained on, the monitors would not scram but the detectors themselves would be completely cut out of the system. This is obviously an L L 19 J.,
\'
l undesirable situation. Note that the only way for such a failure to occur is for the CSC to leave the calibration signal active and fall to return the calibration relays to tht:lr normal operating positions. Merely leaving the relays in the g wrong positiens will cause a loss of signal condition when the calibration current is turned off. l There are basically two failure modes associated with the watchdog timers: failure to reset and fr.ilure to time out. Both of these modes are tested i in the pre-start calibration checks by simply setting the timer and letting it i time out. Even if the CSC gets stuck in the calibration mode it is a safe failure as in this niode the CSC waits for a time out after setting the timer. If the l system was in operation, the first such time out would cause a scram. The watchdog timers could also be reset by a random signal, but this is unlikely as two pairs of timers would require a reset. There are, then, no unsafe failures associated with the watchdog timers' calibration. The additional failure probabilities for each subsystem due to calibration l of the system are assumed to be those of the each subsystem falling all at once. Therefore, there are two terms to be added to the overall failure equation, one for the fuel temperature and one for the percent power /hlgh' ; voltage monitors. The temperature system has three relays which must fall simultaneously and each NP unit has two relays which must fall g simultaneously. Pg g ,- P ,igi o *Punit2 - P,2 . p,2 . p,4. I x 10-24 Failures /hr I' Pr.T. - P,3 - lx 10 18 Failures /hr l Clearly both of these failure rates are orders of magnitude smaller than those for the system as a whole. They do not significantly affect the overall. failure probability I u 20 f
N I! Monitor Channels g In addition to the scram circuit, safety system failures could occur in the i monitor. The monitor channels of importance are the fuel temperature - monitors and the NP-1000 and NPP-1000 percent power monitors as these - are critical to the safe operation of the system. For this analysis, the channels are all assumed to have the instrument failure rate shown in the above g ! .- analysis and all failures are assumed to be unsafe. This is a conservative ll estimate as some common failure modes, e.g. loss of signal from the detector. would cause a scram. The instrument failure rate is given as Pinst - i : !0'6 failures / hour. Note that this failure rate is the same as the failure rate used for the relays in l-; the circuit. For an unsafe fuel temperature failure to occur, the analysis is , identical to that for the scram loop i.e. both must fall for the system to be unsafe. This leads to several permutations of failures which are unsafe. I However, all require at least two failures. The original express'on was n P ,,, ,
- 1x1012. Now either the monitor or the relay can fall, but one cust fall on I each channel. Therefore: >
I' Pn,,,- (P, + Pj)2 - 4 I 10-12 failures /hr. Similarly, for the NP-1000 and NPP-1000, the added failure modes increase the number of possible failures, but the system redundancy still l protects the system. For the NPP-1000, in addition to the monitor failure, a I, gain failure is considered. The NPP operates in a separate gain mode for g pulse operation and were it to switch to pulse mode during steady state i operation the NPP would essentially be useless as the trip point in pulse mode is much higher than for steady state. Since the percent power and high 21 I
I i
. )
voltage failure rates are incorporated into different parts of the overall j i failure model and the percent power failure rates are also affected by the bypass relay, it is easiest to look here simply at the increase in failures l caused by considering the tonitor channel failures. A detailed analysic is presented in the following example. The additional failure probability, considering the interaction of the bypass relay and NPP gain turns out to be: PNP /NPPreli - 8 x 10 i2 failures /hr. This is essentially an increase of 1.1 x 10'88 failures /hr and brings the l overall failure rate, incorporating the bypass relay and instrument failures, to 3x10 88 failures /hr. Thy given a mean time between failures of 4x106 years, m Note that this number is essentially double that for the basic system (though this is not as apparent due tothe rounding done on the numbers, the original failure rate was about 1.6 x 10'll failures /hr), which is to be expected as the ! l instrument channels considered had similar failure rates to the relays in the circuit. y-5 Please note that there are other cross interactions possible in the system, i.e. failures of two or more components related to each other but not directly interacting. In order for these failures to cause an unmonitored situation. l- - though, three or more failures must occur. This puts the probability of such failures several orders of magnitude below the other failures in the system , and they hence have been disregarded in the analysis. I I 1 I ' I 22 I
i I Analysis Example The following is an example of the analysis used in this failure model. g in lookins at the percent power system, there are s;t failures which can cause an ut.3di i'tuation. These are failure of: the NP-1100 monitor, the NPP-1000 monitor, the NP-1000 percent power scram relay, the NPP 1000 l percent power scram reicy, the NPP-1000 gain mcde relay, and the pulse mode bypass relay. In all coes, failure of two components is necessary to cause an Ltnmaitored situation but not all failure pairs will result in such a situation. Since the NP and NPL are on different lines, one component must fall in each 1.e. an NP monitor and NP scram relay failure is a safe combination as the NPP-1000 is still fully functional. The table below . Illustrates the possible failure combinations. te.:M Ift .R tEt:.E lE21 12dl tutant NPP M - 3 $ U U U l NPP R 5 - 5 g U U NPP-E .5 5 - U U U g NP M N N N -
$ $ W NP R U U U $ -
s Ogpees U U U $ $ - NPP-M: NPP-1000 Mealler NPP-R: NPP-1000 screm Releg NPP G: NPP 1500 Sein g'i NP-M: NP-1000 Monitor NP R: NP l880 scram Releg Ogpass: Ogposs Releg g' s:lafe feHore i.e. system still monitored 5: Unsafe feuers, system not monitored 1 The table clearly shows the increase in failures from' the original model, which had a percent power failure rate of 1 I 10-12 (NP-R'and NPP-R in the
- table). There are nine unique failure modes shown above for the increase of L 8 x 10-12 discussed in the monitor channel section.
I 23 I
I l Conclusion As stated before, this analysis gives an overall failure probability of 3 x 10-11 failures per hour. This gives an approximate mean time between failures of 4 x 106 years. Despite the seeming extremity of this number,it was attempted throughout the analysis to make all assumptions as l conservative as reasonably possible. For instance the lifetime would be extended by a factor of three if the reactor were assumed to operate only eight hours a day instead of the continuous operation assumed in the analysis. The inherent redundancy of the system simply makes it highly improbable that any failure would destroy the integrity of the safety system. ' ( At this point, a comparison of the safety system's reliability to that of the physical system might be of interest. Reliabilliv and Risk Analysis gives the failure rate of an individual control rod physically sticking as 1 x 10" per day,i.e. 4 x 10 6 fal ures per hour. Using the three out of four logic that only three control rods must function in order to cause a scram, the probability of failure equation is identical to that shown for the program relays in the ; Computer / Manual section and is dominated by the term 6'P,2. This gives a failure rate for just the control rods as 1 x 10-30 failures per hour. Granted that this number still provides a reassuringly long mean time between failures (1 x 106 years), the point is that this small section of the physical plant alone has a failure rate which is almost an entire order of magnitude greater than the scram failure rate for the Reactor Safety System. Clearly, the Reactor Safety System is one of the more reliable parts of the reactor design and is not likely to be responsible for a system failure to scram. 'I I 24
I Bibliography , 1 General Atomic. G.A. Trina Hardware Reference Manual. General Atomic, preliminary issue,1987. General Atomic. G.A. Trina Ooerator's Manual. General Atomic,1987. General Atomic. Microorocessor Based Research Reactor Instrumentation I and Control System INS-24. General Atomic,1986. Hodadon, Ken. Safety Evaluation Reoort of the New Nuclear Reactor Instrumentation and Control System for the AFRRI TRIGA Mark F Reactor Facilltv.1986. - lI IEEE inc. IEEE Guide to Collection and Presentation of Electrical. -! Electronic. Sensinn comoonent. and Mechanical Eauloment Reliability Data for Nuclear Power Generatine Stations. New York: IEEE,1983. l Kurstedt, Harold A. Nuclear Safety Module. NSM-1: Reliability Analysis
. for Reactor Safety.
McCormick, N.J. Reliability and Risk Analysis. New York: New York i Academy Press,1984. gll 5 United States Atomic Energy- Comission. Reactor Safety Studv: An Assessment of Risks in U.S. Commercial Nuclear Power Plants Anoendix Ill Failure Data. Washington DC: U.S. Government,1974. g{ I United States Department of Defense. Military Handbook 217 Revision E: Reliability Prediction of Electronic Eauloment. Washington DC: U.S. Government,1986. g ANS 15.15-1978, Criteria for the Reactor Safety Systems of Research Reactors. American Nuclear Society,1978. l-I
, II E
l
i i I i i P I ! t I i i l l l.
=
APPENDIX E l N W~ Analysis af Five Dollar Rann Insertion Over a Two Second Interval E i n 1.llt r 3 AFRRI TRIGA Reactor L I ' i
+
I . LI LI ' I: - I g
[ , i L Revlsed l 4/26/88 ANALYSIS OF 5 DOLLAR RAMP INSIGtTION I OVER 2 SECOND INIEKVAL IN AFERI TRIGA RFACIOR L I I: I' , I Work Performed for ! ARMED FORCES RADIOBIOLOGICAL RESEARCH INSTIIUIE Bethesda, Maryland L by , GENERAL ATOMICS under Contract DNA004-86-C-0011 Amendment P00005 l' I April 14,1988 m g.
i 1 A_T_RRI RAMP ACCIDENT l Sununary - With the computer controlled TRIGA Mark F reactor the control rods can be operated in a bank which makes it possible to add large amounts of reactivity in one action. The speed at which the rods can be withdrawn is a variable parameter. An accident scenario is", postulated such that during a startup, the following sequence of events occurs: I 1. The transient rod is fully withdrawn preparatory to going to a steady state power;
- 2. The shim, safety and regulating rods are then withdrawn to establish criticality
- 3. This withdrawal occurs at a speed which would withdraw the total rod i bank in two seconds from a sub. critical condition; and
- 4. The safety systems terminate the excursion by scransning the reactor at 310% power, i.e., 1.1 MW.
The consequences of this accident are trivial. The maximum fuel temperature is about 330*C. I Although the excursion results in a peak power of 340 MW,-the reactor power is below 1 MW in less than 1 see after the initiating event, i.e., the beginning of the rod withdrawal. In Fig. 1 there are shown the results of this accident. Analysis - Use was made of the computer program BLOOST3, a lumped Parameter neutron kinetics, thermal-hydraulic program. This program has - been used autensively in the analyses of reactor transierts in which reactivity changes are rapid and the event is of short duration. i i In Table 1 there are listed the reactor parameters used in the analysis. I I ' I :
f V i . i TABLE 1 Reactor Parameters i Initial Conditions: No. of Fuel Elements 87 Core / Coolant Temperature 25'c g' Initial Power 0.01 watts E' Cold, clean excess 3.5% 64/s ($5.00) Rod Worths Transient 2.56% 6s/s ($3.66) Shim 1.30 ( 1.85) Safety l. Regulating 1.30 1.27 ( 1.86) ml ( 1.82) i Prompt neutron lifetime 39 psee Fuel element specific heat (C+77) ; C 821.7 joule /'C - 7 1.67 joule /('C)8 , Core water specific heat (per element) C, 860 joule /'C -l Delayed Neutron Data 1 s , es.m c 1 2.310 x 10-4 1.244 x 10-8 2 1.528 x 10-8 3.051 x 10-s 3 1.372 x 10-s 1.114 x 10-1 . 4 2.765 x 10-s 3.013 .x 10-8 5 8.049 x 10-4 1.1362 x los - 6 2.940 x 10-4 3.0135 x 10' ' The integral fuel temperature coefficient is shown in Fig. 2. The I! coefficient itself is approximately 1 x 10-4 As/s*C. The coolant temperature coefficient was assumed to be sero since it is relatively small and, also, because in the excursion little heat is transferred to the water. t With only the transient rod withdrawn the reactor is suberitical by 0.37% 6s/s ($0.53). The withdrawal of approximately 10% of the rod bank occurs before criticality is achieved (based on a normalized s-curve for worth , 2
- .. - - . - - . .~. . - .- - . - - - .- - . - - - _ _ - - ,
vs length withdrawn) so the 3.5% ds/s ($5.00) insertion occurs in 1.8 I sees instead of 2 seca. In Fig. 3 the reactivity inserted as a function of time from the point at which s = 1.0 is shown. I Since the transient is terminated when the reactor power is 1.1 MW (110% 1 l full power) only a portion of the 3.5% ds/s is inserted at the time of the scram. A problem was run to determine how far the rod bank was ; withdrawn when the scram occurred. The reactivity inserted in the ramp l was 1.305% ds/s ($1.86). This represents about 34% of the rod length. I To this must be added the 10% withdrawn before criticality was achieved. Thus 44% of the rod bank length is out of the core and now participates ' in the scram. This portion of the length represents 40% of the worth of I the bank, or 1.55% ds/s ($2.21). The total scram activity ic, then 1.55%
+ 2.56% ds/s, or 4.11% ds/s ($5.87) total with the pulse rod worth added to the banked rods. The rods fall under the influence of gravity in 1 see from full out to full in, following a delay time of .015 secs to
{ allow the magnetic field to decay. Since the rods are also influenced by the resistance implied by the passage through the water, the rate of ' insertion is not as the second power of time. If there was no resistance l l the reds would fall from full out to full in in less than 0.3 sec. By I assuming a resistance term that is proportional to velocity and that the drop time from full out is 1 sec, the reactivity inserted as a function of time from first motion is shown in Fig. 4. Conclusions. The postulated accident scenario in which a bank of rode worth 3.117% of ds/s is withdrawn from the AFRRI TRIGA Mark F in 2 secs, with the safety system functioning, will cause no damage to the reactor or harm to any person .
- I-L3 LI L
.l
. . . . . .. . .. g
.e (,,.
. . . . . . . . . . . . . . . . . . . . . n AA+4 e 84.Y. .
. ~ . - . . . . . . . . . .- .... . .. . . . .
- . _ . . 4' . . . . . . . . . . . . . . . . . . . . . . . . . .
. . a
. . . ~ . ..
..?
. ,l .. . . . .. .
..}... . . . . . . .
i .,
...e.. .. . . . . .
. a .6 .
600 = . . ._ . _. . . . . .
. . - . . . . .% - .i . . . . . . . . . . , e. .
.. - L ,: _ . :, - .L. .
'.. .,.g
. . . . . . i.. - . . . .. - .q 3. a t I_ .. ... .. ~
_-,.-.......jy.....,,e. i .-
. a -
,s J l . .
- . . . ,..y~.-,..,_. ..o
}.
*1.m. IM Lr .
- t. .
3 . 1
- .:. 4
. .... . . . '- l i .
. ' .! !. '.' 43 ".
L .. J ' '
.l./.. .'.m I-e . 4 h .- ,
(.
.4
..~i... L .j t .,..... , < .. ..
..e, e.
. .s.
.J .
.. -.- p . . . .tj. cr4. .*'.*. .'. W; .. ._ -, .e. - , ..
6.i.: .i- f". . . .t {
.i
.. IL.;.
i
' . . {. . . .;
,. ] . T .
- i , .. .s 4 .. ;. I~... .. .f
. . , . j . . .. 1
*. l f. ., j 5
- w
.. ..i .. . . . . . .
. i C
l,..... - ,
.e..._...,.
+...l..i..*
4
......i._....
. p.,. .
9 . . .
- . . . . . ......4.......,.
pypq
.y . ...
. .e . .
e . . . . ..
.e,,,
u r.p. s' -. , c .L .n . g
,Ie66 s
g
' ' 4 '
.. a .; ,i. . . _ -
. , . . ..rL. ; . ' ..,
.i.
3.. . _.. o - e.J-m.. , t..., s' !,g. ,.
.g i .s. : :r ..
-M . 1. , .i .~ ; .
,,l- s i. - [ ,. c . ; j . ' ' ,.
.l......-.....
IU . , _- .
. . . . . .i... A.
- a. : s ' . . . .... .. t . . - 3 .. ,!. .i.' ....; .j.
g q
.. . .l .g. ~ .
. . .,. . . . ..t g%
. . . . . . .t...i.
. ,.,. _.,. ..t 'J i..,. n
- .- -.. _ _. s
, %. = = = ,
.,,g ..t.. . _ . . . ,.. . .. _.t,
. 4 . . .
-t . ~
..4 . .. .t (, w _
J.. c
- . w,,,,, . N .
.. . . .. .e.. 1 4
.. s . , . .
s. N o4. .. . 4,
. - g. .g s . 4Pg
.. ...m..
.., y g
. T i-
. . ). .. .
i 4 [ .
'. (.T-i 1' *. e 9.
.. _ . ' _ . . .. . . .L. . . . . . . - . _. ..
t 6 j [. - !. ' .L. I. A \ s.. .."' . * ' . . . 'Q,
. ... . . , . . ,. * ?
. . . .. .. .. . . .; . s . .. . ... v i
-.,,..I 4 ,
. , . . .. .. .. .L
'l 7, .
a I ' 'i
/ )7. Tad. dode p.t o .6.1.
r
. .. #/u, - .....
. ...,..... .., l 10 .-
.._..,....,,o..
. .... . . . . . ..-..............6
, t. . . . . . . . ..
. . . _ . ~ . . . . . . . . .. _ .
- m. . .
. . . . . . . . . . . . . . ._...4.... -- ..
/ ud . . . .I . _ . . .. ..... . . . .. .. . .
.......,......-.f., .
4
~... .p u. g, +... ; .e.
~.........-.w
.. . . g. . . . . . .
. . , . . .n, a I i I
p.plf
- Od
). o 10. In 1
Me @M bU h
- l ! ! , i 1 1 !
! I I l 4 l l l l l- I i i l i i ! I i 1 4 i !
I I I i - l l l 1 i 'j i I t i 1 i l i l I ; I I - f I I i l- E I t ;. i1, j ; -l , I i I l i j j l ; j i l l q: 1.._ . .; [ i;. , q i !g .1 t j i iy l .l l t i j - l u l ~.:- . _N 3_ g = \( :t ., D I. .l. . ; . l ; i .i -l t r
>$ md=& :#=l==:iEM=M-A-Mi -m- - .P cl = i .L- l = cel-i. i .L1 , i -
L.
- s=- %=i-5:"l==' rEEE4E's5EfEEEE.==W!=l 1:19 i; :l -L -- - r, :.ba.F i- a ja 4 -i. :
M -l = _a
. . . . ;=_2t- = t :. . ._ _ __ .-. __ .__
m_ r. =.: =.=.__-;_. :-- m .- .
. == . = P.=-t 2- -i. . . . _ . _ . ._ . 3.:.= . .. b. =: i :- _.d.-.. -f m . .l . 4. .. - -
I g d:-fEHE= f J.ii=Eb- TEi.._ . L C.__ =:===_EiMEi"=i== WEE!E 1Emik:i:=45-M *-{ l Ti: :ji : i; _ _.-l
-m y_f . . . .} ,,._;__7._
_- , . .__:==-~_..___ z_ _ L _._ _._.__.7 J__. _,_,=- 3 _- t_
. .._ 3 y .g, r _.r :=rj ;._
__:=__=.._....=.._...b...__f=~y._4,.,,__4,__._ u= ._; r = .
- .=f-.:
e _ h,__L - l ,_ = -l p ts __~=1--== __; ., _
, - . _ . - . _ _ . . _ . , m . t r' f=_:--
_;_. _ .g -f _, . y ___. . . . _ _ . _ _ . .
; _ g g=_ __ . ..._=. p 4, - : : -+
___t_._.._ _ ;----,-.==q ./ c e z.:.:.4._____a_=.=g
=m = : _;- _. _._ _ _= -- - ----
_._+:=. __
= r=. - :
v....... .l . /,u. .
..q.._.;_ y.. :.= __ L:==.v, f =. ,z
. _ . _ . ._-..._.=:-_=
I, p1 #.3 _= =r _ r
-- 7_r=t-t .b.__ .. . _ .
_.._,__=__.._._..=..t---1.._;_=.-::==- =z --
. 2:.--f
=, =..=
_a ___m .4 _ - _ . ~ ~ '- --__..=&_..,*7T.. . _ :. =,___ =y _ =_ . ~l _. m_f'~-i ,f :l ._. . _.!.=._g... .- _ _ i . _ _a;___y
;.1._ . .
., " M* - I . _ ..__ .__. . 5_ 1 .= 1_ _ e.- T _a .-~1= T**:! : c! p. . . .; a -
V _- __-=_ ... . ,.[i ._. . _ . . , _ _ . ;____ f r
. +. _ (.-.. . ._-l =_.=.
= . . . . . .=. =2 . . p. _ ._. . . ..."_ p.
~ =. n. . ..=. . p _.:=_. .. .._._.
.._ . . . . _ ._=r.=_=_2..__=...__- =___.=.
-m.
u- ,. . ~.m
.,..__l=..=.=_.l===_ ;.- -
. = ~ -
= 1
= _ _ : ._ = r..-- ._ ~._ ,___.=__.
- =._=.__-- =_*.:=_ t--
l=_~.:a:_:\=_.:= _-t=.=a.u= t au- . l=:_: l...w.=\ .r : . .
..___.,._.__i=... : _ 1. =. .= = ..=_.t_-- E.:_=]=_a.=_. _ . t. . =. . l=.
. .. =.l =..
,. . .. a.
- + -t- -= _,. ._. ._,:_ _. 4 ._ ._ _ . .. . . . ..:. .
- =. . . . . =. . . _ - .t.. ,=. -1 *. .)... : '
. . ta. . .m.
U WE!!.: M 91== - . =LEEE =M=; E-li P= t:.=4==i== r=::# M:4 eM=wle2+3 IMi=_1mb.. I R = =i=tm H 4*:#.? FIE= K=E~= : =E:- ;EE :+ M iWEM
- 1 =b.:f=b=5fi =F- ei-i1=p m ErL= E ii=4alu== W.- Ff =i:- baa.nt " -p u1 -is H P =l f =b 4 ='l--t 'l~:i W ii Ij Jp n _. p ..t..e.
m:i = F. += h_pl.=:p .- =.J =. p+.iEE a j.7 = W yl :=l: g ri t .-0!E= fh
.. . p_.. . f_
n..__ . _ . i :.
._....l.
.. : .1. . _ ._ l . ;I . . . a ...}.=:.j...... ..g . , . ,
. ..i=;W j -! I-.
i 2
. l . s. . l
. .t. . . . . 1. - - _. .f f ..
. ! I
.l..r :_ii:4 = :m..-i=-er;.5-pi:4.- w -- '=bc l Ji:f . .
g.:-y :4 I i b
- l. r_ t;-i= Fm:.-; .+f-l-r._y == p=-i= is ::+ =n == .ujrlg.y =;= i+41. - W :1 ,. . !. j g i ! "f+=fli=i--P"ht;=i .T
- . i. -:!:al=1== b_n=lu.iu=.fraF.st:ji--(la =i 54 f!5Vr=i: p' =.: i l- :i .I l f
,?
f g -l. ..i =..=.1.
. . . _=.f_.. : - ..
_=h./_:. Q .._.. :=. .t . :_
.. h.
a:rl=4 .e _!- .[_=.f ......=._S
=_ f =........
i[...= =tf =.st=m=te?]r.D _ _ . . . . ':._-.j=.._- _ . . . . h.
; . .y r.c . a ...
b-li -:'. ..;
. l P : :. .
41 I:".!?:
.l:
. l::: L.. ..
I y p .i.= [=. :5+ 3. .E E .. :P. .=.=}_ r_
. _.r-+]: P.
._i.if. =. i:=. 5. :-f::EjE_ _ H. .=_a.E_. ..E_ =. j=.- ~::!. .'.p =. _q. ig_'i-i= m c m:
, -t- .=c::+ u mp$ge_=p.=qh:q =@ij: -yC .#ET=F. - ~ .-552 ^=Et="i=P"m'tei.-l- :5+
[ c. 4:.=. _- fl;- ;=--j:Mi= .:}T.:"".'{.' :;f :di=>=}i :1i 'f.--@5}h.:.- SihCl : 2l :; ..l : 1 -l t1 g i i;mt er j7cp+pe i :q:;. "t f.:j . : p;:liFj p.ph:.:m_t i. = ; p i t l
. i. -
i.. .. .
- 7. ;.
..q _. p. a! . a j.w. o l...._. . . .
, .t .
t ; , e , ; j **l *l'. ;'/1
~
} .i l. ,l l[. p_- j 'i.1-*. f- j : . ]:,. ' ':l- .l- .f l !. l
-- to _
i 4 z n.1 y p+ . .y 4.: j= -r i cpp i_. r J. m l- p .t l i
.l . 1. y p . - g q y qrl_.;- . i -- -tc 4+g=- . p. :rit-i F- L- i j -
l
-l ._ . I , .=p a_ -.: p:A 31. 4z t .-! =!= #- h .. 4- ' 4.e i !. v l! l. P ,
I r4:5 !
/ p p.t .I l .; Imjizl'a + -p 4 .j i 4 i
gM l l
- p. .t l t A
fj:
.t ,
e
-i. '
t_1 l
- l. !
i:
- i :'
ar lT 1- g.t
- =: .p =p i j j -l l ;
I i l ! V; i. ;I ! l .1 1 1. I i l -i 11 -i i I : i l I i I-VI i- ! I i l i i 1i l 1 l l t i I I I I I i l i V; i i i i I l i ! I i I . Il ! l- i ! I i . iE I /I I I I' ! I I I ' Il I ! l I i I ! I I I ' iE /, l ! ! I i i! l .i ! I ! l- i i i I i I ! i fiii*j i l i i i .I i t i i l i j e l l i l W I o 2.o. See
%%^wrbs 4ao Eo*
- c_
Goo "He 860 10D l l 1
- - - - - . - .- _ . - .- ~
_1
! l i l l I i i , l '
! l l 4
' l l i l 1 l I l t l 1 l i i '
! ! l i 8 l i l . "!
- l l i l l .. I i i -
1 t. 4 l . . i. l l 6j l' l i l .i - I ; j i l t I i i i t - i i I , j ' l1 .
. l .
I I l I ; -! .
- l i l li ! l l r i I (
- I i i- i W. S % #Vann.4An TL M g ! I iil i hl
. ; .. - < p. . L. gqj :.:.n. m .t . u._t .v.hL y '
; .I .l .! i , j; . gi
. ~ % . --l :
--i .. a.1: - -5 .1; . .:lic. gli :.h ..i .J l .) 12 i 1 4- i .g g;:. l l
- 4i : : rp 2..i.L. : =j -
-~
~ M4a.}i.i. is4[--i. T :- :.2he; . git .! .e4c.:_ fi. : ...ij.vy i 4
;.j J
=..
. ._ J. .. ::. :- _. ; i e
.. c:
t =. . . r. =_u =. _= =._- . ____._. . . . _. .s. :_. . . =. . t._=.
. . . _ =_t_=.=..=__
.:. z - . . : - -. t. . .; . r. .. . r . . 1. :__: ..: :-.
n : u..n =_r__ = =. =_ _, . _ . . . .=-_ ._-. ~_. .-_. _- . _ _1._ :
. : J.. - .r_... r.e.:nce. . . a- ;-
. . .. . . . .- t-.- .._ - -
__r.._-.-. .ra. n_.. c.: =r. _ a: = =- m ny. v:== - -:.-: . ::. . =l
=s=
. - - - u. .- t _ . . =_=.: . . . .i .= l==~ : : . =- . . ;~=.= =_=1=_.=t_--r=r.== i. ::1 -- =+ .- -=T. -":p::. : .:n. =4 =
_. =.-_.._ ;;.y._._g -
,~7 1 g_ ;;, ;.,, ',.m . . g , ; -,, , .L, .,
=t = . _.4
..". _ , _ _.,.-. - r.-m =tri n= ~.
. . 'l : t ;.r: .: t =- : :: :-.-
._.. . J_ =l _ _=_ . . -_ --f_ . . = _ _ . . t =:::- =. _t =_ .2--r _r_
- ~ ,t R-~_= t=t=L: --__ -*.E C .C _... . _ _, ._ L_ _ _ . :2)_=t _ . . . _=I_ ::: = . I :. :': e_. ...
=n n .i :- = 1.n in ri:. . . ._. .c. . I:n=14. _ i :. . -
. _ _ . _ _ - _ . . - . _ . _ . _ _ _ . ,m_..
2,_ ,, .; u O == ,._ ._:d ___ . . . . _ . _ _ .y_~. t ___ _ _ . .__ ;_, .,,,
.__.-._=:= =__ _--
_ . _ - - . . - + - . . - t=,,.- ._. .,.t __; ,; .;.;_.; ..
$ 1..~i_-._a__. ; - :=
. w _ .,3 - _..- y , gi = X f l g . r- gg;g n; = y _- ---- -----
--y_2:9:_g:_3.;g_g,g [2.g._ p..;,g .
m=; ;
- - p. -f.s
-...-u---.---..-- - -
.: -, =
~= = : : L....._. _ - . . _ _ . __1_ _ ::__ _ 4 ---' " L_ . _ .-4.*1
.; _ ':ct- : ? - r-- u-. a J ._ ;?: _ .-.. . .E.-_-
=;.=-- . . _ .. . - . _ - - m .=.
Wati:-~1;;;;;d".~i;.
-==-
v .= ;. ._.. .=. f = . . - . . . = - =. .__. - . -i . - - - === 1= =t== :: = a-
-v ~e
.~= .- .2t.. i_ -
,-,=:__
= _ = - - .a., _ . _ _r_ _ . . _ =r. = ._ - +. = = p=_=,u.-
.- - c-- --r-- :
- ._:p:=- ..
- q. . r. ;.- - : . .v..._..._.._
p._ y_ : u.;_;
.b
_=. . 2, 1 I J
.....-l....._.. ..;._---t:=
.;:..._- _ . _ .__t=:.-:- 3:.r=- ::1 =. - u- l ,_-.. . :_: _/-, ,. ,;.;=- .::
;,4.,= = : -- , . ... u A:_
4 4 ;iE il'icii;-:dhii:;- : jis : =,=r "455-{EMp 2.EE psgEn {@:.4~1:{ f "ij f.:fi ft pf:r . . ,.Li[- 7.::- , Ni #ii t ~ H ":iEri -- Ei 5 "? 4li
~
i' E5EI5 Uf " 13i@4- ;J:if-E *[ 0 l: '* !' -"i: T i.+T.- ::.:F* j v:if 9iii: $h. P.E.i;~{E.E." ~.% .:,:f_.y.:" F _l.l:'1j;; .3:#c-/. t rip %: V 4: . -a:- . :.: p.r . y:. m
- f 4-. "15h# 5: PM *! #:E-?Md*:r M TM '}
f iC: ""5 h - "!f l alf -$
* .!;lrqp *
.!:: .[';'.i ' f.i
- . i.a. il:. #i." : fi: /.ici- "#
-iF4 : . .a l. .. l . . . l . - l :t;;.l d m .
l 3p.nl r;p- n.i . olj j.:jhi.[ini ert .::-j:n p .4 i-l.;i f g; t iI ,, :7. p. .1 . , j' h .j pl .;
? l : 1. _r. .
--l :
m: 2 ij - it W R.I.' / r: P - "it. f I" - I F.l; [ + '4 :: ; - tii-l ;i i. "j j' 5:'.j r.y,:ji. l:.:4 :{:46f . ' - [:, j '. , J
, . - . i ; . .-~ up- ;M:::
; [',.l g$5 l . i$.a r 9. . .i'i 'i--!!:; R- EilE g.9 i d/4rC#_lEi;'h : 0?l..:l.1 .
pl . ' i.n j . ] . . l .] .
- i *'"
"#2: lei : f "~ E!'J-ri!riEri iisU EI" @Il3' ~8rs [:l-M5d 5i:li 5 ~.lT * ""! . : t ~ - -: -l "! i
, , . ".'l.. , ;;. 3. .g - (q Iy t
.r :- f. . . . . .h . . _ ..:::: _ ;;=.:.- _.._.h_.....__
..,=... ::- . _ r:_. . r_j=. ,,;
r _- _. ... .._4.j _gn.__:. .-...m,_... . . . . . .g g. , j;. .. ,,,.
. .. ., _,.p. .
y . t=i ;: 4 =.. i. =M.. . E. . . "E!.E. ".. i.r. "_ ~_~.._C. _ 9._ . :Ef5_ ~ ^ . .'.-i E._ il '_Z- ti._=-i_ " " . ' .0. =. h =10. . :. u -
- 0.
.. =. . P. i.n! n. ' ""
* '4 4bi Cl~a R=; frJ!:b
+ 1 = = F:"' nE '4M":F: E~:i.;71='_.1E; i Er/M #:!=i=h~", '. ; .Tff:=/:i5lW-
-). - ( w.g>:a:.:- . 3.n;..s ::!=h=. .= =- .2 1 . .:.y
. _ =;= b .ar::l.::p=a :=32 . .- .t._p.
. . . ...ra.F e: .! n-l. 4..
L. . i . pr.::j. - p .a g..it g :Eig-l"f. n:.i.#j;. n qimq m;:g_a. *..h r i . i l : 1 . g ~' i 4: .f .y; &....... __ ./ w . h.= i=q: T: 1.Liri ists; n 4 W :i .P . .l .. : i ,,, j :q i: ^ M-i;. =c.;Egf.p.';r _ci.e 1.w :t--iprpigii. :-Jp;.p ; p. i.e r .l .i 1 e,
;9 :t :F; n n>- -
-7 :r4 0 i - :l ! i ~i-i-F 1:- =ir:1-2:r -
ti .I Li
=. =...sp..i.n
. :t .n . _ ..p._: h_. .v.
p'
. e. j. = p - . . = . . . ._. p. . . . ._. r.s=_ . . . ; . . ; . . - . . J- . l . l r. 4 a
.= 4. . u_ . ~4+ .f . =p .Lp::4 ni: . P. t@pr.:i= =:! = l . . k tot . !-l 4 yupy a.. -
- : :l -f: : ;:tg4.:4- : _.j . j .JEE ::;4a4Tj= [ .t.:. 4 .t. .i j . j-
- j. "l l . ; l- j/ -
' f- .[ J! l ;
.J" ... i.i;44 4 3J. . [: ["i 1;j9 f; ..'i. :L :i j i ltm 4 1 .F ti ,
!1 l
- 1. I i y !
..pq:q. l t j l. .I r-l t 1 l1 I i g l l i. f: l. . !: Fi 1 l l T l. 1 -1 ! i l l i i 1 5 i If :
I Li ii ! I i F l 1 l !1 -! Ii I/! . I i 11 i i ! ! I 'l l1 I i i i ;
<l i .
1l ; Ii ! I i i i i i i I : I - 1 I d i l ! j ! ! i i i ! l
- l 1l -
o* .t 4 4 .9 ko vs. H % 15
% e, - eus =
l l l I l l } I k i h ! ! (2 2 l i i l l
- I I I i i I i ! I l i l 1 i i I.i ! F
-t 1 i 11 ; I ! I -
I i i ! 4 l l ! I ! I h ili
'~
i
! 4H i f- ! I' f '
. - } . :f j ' - f. l_ f .
*f i i l l }
i i l I I i i h'l i I
- i i ! i
! I 1 .
i l I l I I i j ' I ' ' . :l .
- f. 1 hh-
.l l l'h l i l I -l I~'l f l l l .i I
~ . l ' Y-f ## b I ['
I. i 5.h -I = ..N* I*! -'*
*I b ~ f '* : I
'f'-* k
.g ' d;5.}.*"'.k.k r' f._:[ J **_b[.; ,
*.~,5_d*f;~ . Si '!j U.f.,.Y**..,,*
*h
, .J l . l '.
j *: . l.. - }: . . f. 3 l .*._:l l *' l *7 . . [ ,. [* ) w- ==W:i1=0 ==M.=_1G ME =._ a=~Fra.-f!M=sl=M =:@ i rP-Oit =F. a a ew MNW1 I
- I. _T.T a.t*"*t = a'r. _.O 20. . :._1.
..._.s_ _. . .
. _.., . . . .*:.; .. * .* *. r. . L 7.: _
. - . . _i
"*?
1*_ . ...t. '* *v..;.. . _p: : ."i _"'.. . ;; . :'-.'*, . !. : ; . .; * -** -*"
.. .. .r.".t. *. :_ '
.. v _.__
_.. . -_.+ _ _ _.._.y.
.g.. . _ .
- .t. r
. .. . - -* . P . ._-,4.....-__ . _ _ _.; _, -
.=_=,.,=.fn_}-...- __..-... 7..:_
. __. . . -i.. :_. ._ :.;*: :d. -_ _._;-
. :. .l
~ -5k i- : ._ _~? '!: ?. - . .:
..._-_. ._~.~_~.
. - _ . ..J._t. ..*lj*..; - .:.i".".U
- ; M.._- .
__..._...O.*.:=~ . !%_..;.;_::_.:._:_:.:::..: .
. _.. _ ' . _6___ . _ . - _ - ~ _2 32. . .- ;. . .;.t. . ; ~. -
=]O..*_:t. *___
_ . .'":. *,.* :: =. . .q*.*
- .1 : .-
g_ 4_ - -t - ;;. =:= ;;=- - ~;:,
. _:M .*T"'
. ::._ r.; n .
e
. . - -"1T._ .-- =._;2 - P---t r ---==* l* -*C- 4. ==;.=p1: ' " ' . . ;=_ g:. 9
- 2 1.-1 **
__ ..__-i _ i ... 3 f*- O
; _, ,_;;; ...__q_____ ,_ _ , . _ _ ._
...._-g__ _,;.,"-- -_ ""-*;,,. g; .; ;. ,. . . _
2 sm :}~-
._____.\- :_-_ _
g i t- + i ._ ; w_ _ . . __4__.__.i *---* . tp ..:*C7; 07;. ' - - * ~' l~20.L C- -- ' :7 - ..'.4/:. 1_ ..,_"; d r. 10 :y-- ~ - -
' ;,. ;t
- C.4.~.
- .I. .;.g . ; - -
qqr ' -- t* . i_ _ \* 1; _4 -t *:.!T. W "- C.* :="N'-"20=.*"* .l ;;4 ;., ;;. . .?;.4. ;. * **
.__r.=._._..
I 1 __._-;-.m_.-
;,-- .-._ * ,;_ .,.p. __ _ .,.,.;.p _ . g..
. . _. ._--m - - \_ , ,l =. _ --.n* =-.;; =:
- t ._, ___ -
_..._- ; ;;;--_ .- , , _= . _ . = :. . . .__ ,'
. : = :2. .- :.-- u .a====--u r_ .: __r....__a_-= .=_=;g:-[~-- - - ~ -- -=:-- . :: : -
=: ;. = ; _: .2 =
.-. ;=.: . - . - .'l=_-=...g = :--- - r:r
--?- * - - -
=_
- .. . .a= ,;
- __u._ . _. ... r ---"--r_- n !
- - 1- - -
- I = n --- " - -t - rz,n;* : - -- -- *: := . :
_. J -]-- ---- -]r7 ---- " El =-- =.1C= 4__. t.=L.;.;;_.
--- m .U.:; ; .._-
_E: p~-=l .\;*C:."-____ _ _ _ _ ._.4_. .
- . .__ n . . _ .___._- .. tre- = n =. :2- ;= 4,--- . ;- }
I
. 4:; . .. C;; .;:: 17 .; ;;p .{; 7 - - ' nt..;;r : C :.1 :. 0. %= ::=.1 ;='.*.;. . ; . {?'"': ;; a..--
- "__ f-'-t- r;= r_*. -t :;;g. .;
* " . ' ' . - ' *. **_. . J : ...._r._-+._ : ." T . .;,rp_;b. .- . . . . r ,_1
_4.__.b*_.2.'_-* .1.--l
. :::C.::..:T
. = , .. ". ... .*j ; r ' .-.. _ _= . . .
...=.....___.-1=.__...=.,......=..v.._q..
- ; r .9 . . . . ..
- =.-.=.=_._=..._.:.:. . . _ _ . _ -
. . . _ .:: =_. .a: .r . _ . .= a._._: ; .: L._.: ..:.
=._ =_; __ ..
. . _=. ; =. .. .
. .:t3_. .- _ . . =.-
, k
. A - "5 F ".- F5 .._
':Mab:il--laf:siE.f: ele; -#WriiEh.~ci5 . . . _
15ii:b:::ip=. .E=.Id_T 'M ind:)- r!M _-iM_,.
. c.::._ . 2 .-l- . . .. _ . . . - %. . ,. _ . . . . . ..1a...=-...._=...=.=._ L.:- _ _ : -- . .: . _J.r.. ..:.= =._ :-- . . _a:y. . .r. : --. . _ _ _ . . . , . - . _..: :::..=. . . ._... 6. .- . . . ._ ..1. . :
.:Ji. [ . ... .. .
- 3 ' :*i N .is }iC3 Mli--M-irrErl.0.l5_' Iii NlrN.-- 0:~_Id: N@DE. : Rii " ' NU.s 7 !!' dlN ' 2%.- ~:
'1 .l j:M:W.J.jih ,i:l.~.h .i_Ei:[Eiij di,-j-- f fi.:l:.5}=; JCje=, plp:M :2:H- . 4 ' . j :.m.-j:. .-R 3 I -
I,
----4
' 2 MilfT J[l=i*i- "l:.2 r_Y4.i.!TjM}: -l" 5.Ifi-l2 l- ~l 7_ N 5II:Piib; Mn C
d " -- -- c::
. . }?C-F-k u ..:
": JEC . ._.M . d.. _ NF l*2h_=I_"..'
2
.M.~.
. . . . . . l E l*:
i
' @ 9'l --4. d
- :l ;
l - !H Jl ~
- 9 .! I
!*W I G "+W E- eli? Hi=i _ii.=tNEM=_.;_Mc=lE=W#E3M ;3!=EIMIE= E:ist:0 01: -
di: '149:
. I:R* -
- .. :. . _: =_ : .___ .::.:_..2.
. . _ . .t . . _-4_=n_
L:.:.: c__=.__ . -- F-~;. .m_ . .
- =_. l:. _ u.._nr -
=. u_ .
.:::. _2::. .:.l r: r__..:
- . . .-...m-
. n. !. _. _.. ..::
. u. . . . 1
;:}_,_ _._. _ . .-- ..b___= 4
. _._. ._ . . .: n . . :g=j. . . . , _.. _ !_.._._q=._.=_1_=_; ..__.4.__ _- . . . .:.. _:}:
,i . . _- _- -
. , .__ _ . . . . . _ . . ._2=. _ .:. _. .::.._v. ._;- . - . : =_ ,
I mn . 30 -*- ~: ap_ . . : t=.. '-t--- ::::. = : P . . .a : u. [ : . -- &r: ..c a;r : ;. _ ; .: t
. . . . :1 mr_- ---
t- =_- : . - - - - - ..:.___.___._ - _ _ . . ._ a-u- ::. :.- : --- : .- : r ::: :- r . --
, _a. 'ya====-c----------- --m-,--.; -
.----4---- .- ; . :._ :: - .
- :. - . g 1.:- : ---! =t= 1,2 . !. __. - =}=: .:;_c - . .ca.u
. r.-- I: 'l .
_r._.._4..__ - ::
._:... . __- L:; =._-
i
.. r. L 3ra. a _, 2., . _ . . _ . , _._ _:._=- g=.
,; .X _.
_. ;,=. ,.e.-. _ _. __ :_ 4 _.: f _ .._._
. , A. _ .__ _ ._... x{ . (.._,..__._t:_..___
,_.___ M_ ._u; -:.=7. . . . .
a _; : . _ . .. . _:_ =. , n g.: :. =.:.: .::,. ... rb . . _ . . . . I;.,
-. _ - ._ ._. ... .I, . __ t _: ::: =l _. =.. ,h_.=_u.
, (p r =_t =_ _.::._- .p. =_ k=._ f ___.. - l.- ._._.- _. , _ . . ._ __
_-._._ g=. r. . _. ;u: l h. ;.r:.f ^ .=. _ .. . =._ -l . ut. . _. r.ui .: , . . g* : . dh.__5.2..M_ E_ .R_b_*[.N.,kE. ~ f__b' .*' E.. _M_ .-. h. * ' b l '. ._. f E*h _. 7"h_. 2_ _. 3.. h.* . ..*. E';' . ' l *'*: ; :- : ~i : ;-U:
,, r . _ ..
.. .. .I Y' 1; trr=t=2 -J== E15 '=M EM:!==M J:!=H =iM=_ %:
N';iW:':!=%=!9=! -:- .I -i .1 -i!" to
". li- li.L ..-N: -i=9 iT n!M -
-i' - l1 ni;! P _G=tE:E _- ..=i}:
_ . .1 . . . . ..71 :r:-- .-d:. . _ . :- . A_~;"
=,
.- i . P . Mi:: *
-i 4. W.a*= Ma- : == i=-P.: #= - i=i# ..iwl MMM _3= .E-A1 - l *ir " q. ..tv U M =i9:1@@.: := #. :si=r :-s_ 3i+ 2-H tiP4J-1M M VIE =in N .s = =lW g i
a+h-2lm v r=p- =f=p y - 4: =a.:i=[= q w g.c i .N 1 : v +_ rp .
+
. L- t p. .i2 -
.9-. .a .i.t- 4 i j f.-FN.i pr! EF N q -1.
3 i_. i as -p 4: .j - . a i.p-.1 q .. p . M .y 1 1 a:a l N l p.j.4 I
- 11l j. .. ! . xl- :g .p F i. 1 q . -- d :lE 1 - .; i -
l .- K i : l . P .
~.. . . . * * * ~
~ '
f - . . .
. i .. : . .
i 1 l j j. ; -4 [ j- [ j t -! j. j - iKC I
.! ! l t i l- I i .I i ; { l i : .; I i l i l l IN
; i F ; i i i i i i i i i ; i ! l N
=
g q I o Y p w
$ p e , . L.w.~- a wns
.}}