ML20125D545
| ML20125D545 | |
| Person / Time | |
|---|---|
| Site: | 05000130 |
| Issue date: | 09/29/1965 |
| From: | Boyd R US ATOMIC ENERGY COMMISSION (AEC) |
| To: | |
| Shared Package | |
| ML20125A538 | List:
|
| References | |
| FOIA-85-54 NUDOCS 8506120396 | |
| Download: ML20125D545 (10) | |
Text
'
I LICENSE'..JTHORITY PR.E COPE
( SAFETY EVALUATION BY THE RESEARCH AND POWER REACTOR SAFETY EEANCR DIVISIM 0F REACIQR_ LICENSING in the mattar of
. NORTHERN STATES POWER C0ffANY h PATMPIN MR ATOMIC POWER PLANT
\ -
DOCKET N0. 50-130 -
gg REACTOR OPRRATIM AT RATED P R *
-D
/)tn e n W f 'N -
li Intraduation b Northern States Power Ceapmy (NSP) has requested a liessee te operate the Pathfinder Atomic Power Plant loested near Sious Falle, South Dekets at a maximum power level of 190 W(t). The facility includes a heterogeneeue, direet eyela, formed streulatie boiling water resetor with internal steam separation and an integral suelear superheater. The boiler regian of the sore le water seeled and the swerheater resten is steam seeled with esturated steam generated in the beller. h design power of the rosator is 190 h(t).
( '
h plant was designed and canetructed by Allie-Chalmare Manufacturing Company (A-C). h Pioneer Service and Ensincering Company provided the architect and espineering services for the Pathfinder project.
A previous "Nasards Analysis," dated January 31, 1964, by the Ceamission's Regulatory Staf f seasidered law power operation and testing of the reactor.
Although this analysis involved operation at I h(t), the evaluation of plant espability and of the potential sensequences of major assidents within the fact 11ty were based upon operation at design power. This Safety Evaluation seneiders the plant modifications that have been made eines the eristeal analysis, and complates the staff evaluation of full power operatim. Sines the major features of the plant have not chanted eines the Masards Analyste of January 31, 1964, this evaluation will not include a general description of the plant 6 features as presented before, but will discuss the plant modiftsations and their i cffsets en plant safety. ;
- 11. Raakaraumd on March 27, 1959, Northern States Power Company submitted an' application requesting a construction permit and operating license for the proposed :
Pathfinder Atomic Power Plant. N Safeguardo Report and amendments therete l were reviewed by the Regulatory Staff and the Advisory Committee en Roseter Safeguards (ACRS) to determine whether a facility of the proposed type seuld ,
be sonstrusted and operated at the propeeed site without undue risk to the health and safety of the public. A public hearing to eeneider the issuanes i cf a construction permit was held on February 15, 1960, and Construction !
(' Permit No. CPPR-8 to construct the reactor was feeued on May 12, 1940.
g el g 6 950214 PAYSS-94 PDM
/ t
(
Amendment No.10 to the application submitted on June 12, 1962 contained the Final Safeguards Report for the Pathfinder Plant. This report along with other information contained in Amendment No.10 through Amendment No.18 was considered by the AEC Regulatory Staf f as well s's by the ACRS. A "Hasards Analysis" by the Regulatory Staff was issued on January 31, 1964 This analysis contained an evaluation of routine plant operations and potential accidents with the reactor at full design power. It was concluded, however, that certain aspects of the plant should be again reviewed prior to power ascension above 1 Mt(t). These areas were: (1) safety valve discharge, (2) control room shielding, (3) use of technically qualified review committees, and (4) plant instrumentation design.
Since the issuance of the Hasards Analysis, additional information has been received from the Northern States Power Company in regard to the areas identified above as well as information in other areas. A brief chronological list of
' amendments to the application, together with the corresponding staff actions (as appropriate) which have occurred since the previous Hasards Analysis was issued are presented as follows:
Nature of Amendment Amendment Musbar Date of Amendment and/or Staff Action 19 10/18/63 Additional information on superheater control rod assesblies, poison shims and superheater fuel assemblies.
20 10/25/63 Description of the instrumentation relay backup system.
21 30/29/63 Control room shielding information.
22 12/18/63 Requested extension of Construction Permit.
(Issued on 12/30/63)
A Provisional Operating 1.icense for operation at power levels not to exceed 1 ht(t) was issued on March 13, 1964 24 7/10/64 Request for use of a second 6 curie Pu-le source.
(Issued on 7/24/64) 25 1/26/65 Request for the use of 4 antimony-baryllium sources with total activity of 32,000 curies.
(Issued on 3/4/65, 26 2/4/65 Request for reacheduling of containment integrated leak
_ { q
(
Nature of Amendment Ammadmant Number Date of Amendment and/or Staff Action rate test.
(Issued on 3/4/65) 27 2 /12 /65 ' .
Submitted information on: .
(a) Safety instrumentation review, ud modifications to the instrumentation. ,
i (b) Raattor safety valve I discherse system. ,
- (c) Radiation shielding is ,
control room.
(d) Superheater oorrosion !
and other items. I I
28 3/5/65 Information on the program i
- ad ersetsatten for pre- i operational and nuelaar t..tia.. ,l!
, 29 4/28/65 Supplied addittomal infer =
( mation on modified instruman- !
tation system. ,
30 5/24/65 Request for Chasse No. S to increase the reactivity insertion rate for Phase I
, and 11 testins.
(leeued on 5/27/65)
This Safety Evaluation considers those areas pertinent to full power operation that were not completely evaluated prior to low power reseter testing. The information se submitted has also been reviewed by the ACR5 and its views, capressed in a report dated May 20, 1965, have been seneidsred in our ,
evaluation. A copy of the ACR8 report en the Pathfinder Plant is att.sehad to .
this evalkaties.
11L Plant Danima Madificatians and Review Frataduras the items discussed in this eseties. were either in the design stama or deferred for further review prior to geration above 1 Mt(t). Most of the items in the sategory of design chang,es have now been installed and functionally ,
tes ted. The AEC Regulatory Staf f considers that all these arose are now satisf actorily resolved as discussed below. ,
w
/ (
(
(1) Reactor Safety Valve Discharge System In the original design, the pressure relief system for the reactor vessel rejected steam to the main condenser which is located outside the containment. The AEC Regulatory Staff considered that this_ design, in effect, extended the boundary of the containment to include the main condenser, which was not designed to withstand containment design pres-sures. To resolve this problem, the applicant has redesigned the pressure relief system as follows. A stop valve has been installed on the vent piping to the condenser and a rupture disc was installed in the piping to vent to the containment if the stop valve were closed. The stop valve was designed (with a time delay of 2-1/2 minutes) to close upon a reactor isolation signal. Thus, if pressure relief but not building isolation should be required, the stop valves would be open to vent steam directly to the main condenser. If, however, isolation should be required, the stop valve would close and any pressure surge, caused by opening the relief valve, would rupture the discs, thereby venting the primary steam inside the containment building. The time delay is included on this valve to permit evacuation of personnel from the containment before venting to the containment would occur.
Based upon our review of the design modification, we have concluded'that this method of maintaining containment isolation whenever required, and yet not unduly subjecting plant personnel to the dangers of live steam discharge within the containment, is acceptable.
(2) Control Room Shielding The applicant described, in Amendment No.18, a proposed solution to the problem of the high radiation intensities in the unshielded control room following a severe reactor accident such as the maximum credible accident.
This solution was to erect shadow shielding, from 6 to 18 inches thick,
. between the centrol room and the containment building. Analyses by the applicant as tuvised in Amendment No. 27 indicate that the expected maximum dose rates in the control room in the event of a major fission product release cccident would be between 4 and 14 roentgens per hour 30 minutes after the accident. This analysis uses a direct radiation model which considers 100% noble gas release, 50% halogen release and 1% solids release from the fuel to the containment volume. In addition, the calculation included the effect of air scattering of gamma radiation into the control room which also tended to increase the dose rates. It should be noted that the dose rate declines from the maximum value.
presented as a function of increasing time.
The staff has concluded that the additional shielding offers a considerable improvement; and that with acceptable emergency plans, and the now-installed gamma dose rate detector in the control room an operator is adequately protected and could remain in the control room to perform essential tasks under emergency conditions.
l
.' (3) Personnel Qualifications t
As was described in previous amendments and reaffirmed in Amendment No. 28, the Northern States Power Company has line responsibility for I
( (
5-4
( safe operation of the Pathfinder Plant. All procedures for the operation have originated with the prime contractor, Allis-Chalmers, and have been executed by Northern States Power Company personnel. The Allis-Chalmers Company has provided technical support for the analyses of tests and
- experiments with the reactor.
i -
In addition to the technical advice as provided in the contractual i relation between the Northern States Power Company and Allis-Chalmers
- there are two committees, the Pathfinder Operations Committee and the j Safety Conunittee which audit operations of the plant. As described, the
- Operations Consnittee is comprised of members from Northern States Power
- Coupany and Allis-Chalmers. This organization meets as required (at present about once per week) to review operating procedures for new
, experiments and tests as well as standard operating procedures. The j Safety Committee is compriced of members from Northern States Power, 1
Allis-Chalmers and outside organizations (at prese.nt one representative i from Nuclear Utilities Services, Battelle Northwest Laboratories, i University of Minnesota, and an independent consultant). The Safety Consmittee also has access to other consultants as needed. The Safety i Committee plans to meet about once every three months (during the initial
, startup program it has met about once per month). This Committee evaluates proposals referred to it by the Operations Committee and l advises Northern States Power Company management of the safety aspects of plant operation.
The Staff believes that the plant organization together with outside 4 technical support as described in the amendments constitute an acceptable operating organization.
(4) Plant Instrumentation System
[
Amendment No. 27 contained the design criteria and design information on
- the modified safety instrumentation. Substantial changes have been made "
) in the system so that it is redundant in important components and designed to be invulnerable to single f aults. Because of the large number of modifications, a description and evaluation is given below on the modified
, system without reference to the original design.
Safety systems are provided to protect the public, plant personnel, and plant equipment from hazards associated with off-standard conditions.
Instrumentation is provided to detect off-standard conditions and
- initiate appropriate safety actions. Basic protection systems are
- i provided to initiate the following major safety functions:
(a) Scram: The simultaneous insertion, by gravity, of all
- boiler rods into the core.
! (b) Reactor Isolation Scram: The simultaneous closing of all steam lines leading from the reactor to areas external to the containment. Reactor isolation is always accompanied i - by scram as defined above.
^
'(c) Reactor Building Isolation Scram: The single, collective
!i k action comprising the following: reactor isolation scram, i I
activation of building spray, and closure of all reactor building penetrations.
, . - - , , , . = , ,--y.-- - - - .,m..- -,--v,--
. i
' ~
(
.: q
. ( (d) Reactor Building Ventilation Closure: The simultaneous closing of valves in the reactor building inlet and exhaust ventilation lines.
(e) Runback The simultaneous insertion of all boiler control rods at normal speed. Runback is terminated when the off-normal I condition has been corrected.
~
All of the above safety functions can be initiated automatically by proper combinations of signals originating within the nuclear and/or process system instrumentation. In addition, all of the individual functions can be induced manually. The design approach that has been
~
5 applied with our evaluation is presented below.
A. Nuclear Instrumentation System Three startup range (BF3) Log Count Rate Period channels #1, #2, and
- 3 are provided which will be sensitive from source level to approxi-mately 10-3% full power. The counters will be withdrawn, as flux is increased, to achieve this range of operation. These channels will produce runback and scram in response to short period signals.
There will be one intermediate range (CIC) Log N-Period channel' #4, sensitive from 10-4% to 300% full power, which will initiate runback in response to short period signals. This channel does not have scram
~
capability.
Two intermediate range (CIC) linear flux channels, #5 and #6, sensitive from 10-4% to 300% full power, utilize variable range picommmeters to provide scram and runback in the event reactor power exceeds certain percentages of full scale reading of any selected range.
Two power range linear flux channels, #7 and #8, sensitive from 10% ;
to 150% full power, will provide scram and runback if reactor power exceeds certain preset levels. Fission chambers supply the signals to these channels.
The eight nuclear channels are independent of each other, with each having its own separate power supply. Should a chamber power supply in channels #4, #5, #6, #7, or #8 fail, a monitor will inject the ,
maximum trip signal of that channel into the safety logic system. A '
power supply failure within channels #1, #2, or #3 will be sensed by the existing low count rate (rod withdrawal prohibit) circuit.
In addition, a power supply f ailure within any chassis, placing a channel in the test mode, or an absence of continuity will also cause that channel to inject a trip signal. Further, the inherent redundancy of the 2/3 and 2/4 scram logic is such that the complate failure of an entire channel without producing a trip will not deprive the safety system of full scram capability.
Scram signals originating in the nuclear instrumentation are fed to
! redundant solid state logic chassis which are backed up by independent i relay logic circuits. Specifically, the bistable (trip) chassis of I channels #1, #2, and #3 are connected to a pair of 2/3 solid state logic madules, and also to three backup relays wired as a 2/3 system.
/ I i
. (
- Ideally, the logic modules and relays all operate simultaneously.
In addition, the redundancy is such that the tripping of either logic module or the relay system is sufficient to scram the reactor.
Similarly, the bistable chassis of channels #5, #6, #7 and #8 are fed into two logic modules and a relay system. These circuits are wired on a 2/4 basis. Again, tripping either logic module or the relay !
system will scram the reactor. ;
I When operating in the startup and intermediate ranges a synthetic l' trip signal is automatically injected.into the 2/4 logic circuit thereby changing it to 1/3. . (This signal is initiated by a down- _
f '
scale trip circuit in channel #7. The logic circuit reverts to 2/4 when channel #7 comes on scale.) This has the effect of making the two on-scale intermediate range scram channels (#5 and #6) ,
mutually redundant, i.e. , should either channel now trip, a scram
~
will result. , ,
The outputs of the four solid state modules are fed via two j (redundant) matching chassis, known as Rectifier Control Units, to j the gate circuits of two (redundant) silicon controlled rectifier !
(SCR) bridge circuits. The bridge circuits are energized by 120 i volts (A.C.). The outputs of the bridges are connected through isolation diodes to a common point, and, when conducting, deliver 90 volts (D.C.) to the boiler rod clutches. The solid state modules, g when tripped, drive the SCR gates to cutoff, thereby interrupting s current to the clutches. The contacts of all backup relay systems are wired in series with the 120 volt A.C. supply and, when !
actuated, interrup clutch current by opening the 120 volt A.,C. j supply itself.
Should either SCR bridge fail in the conducting mode, the other j '
bridge can initiate a scram by action .of an auxiliary relay, the contacts of which are in series with the 120 volt A.C. supply. If both bridges should fail conducting, the backup relay logie system will still retain full scram capability.
The nuclear instrumentation will produce runback when (a) may two I of channels #5, #6, #7, and #8 exceed 110% full scale indication, or ,
(b) any two of channels fl. #2 and #3 are off-scale at the high s end, i and less than two of channels #4, #5, and #6 are on-scale. Provision '
(b) ensures that the BF3 counters are properly withdrawn during start- i up.3 Channel #4 is on-scale when it indicates a level greater than !
10 % full power. Channels #5 and #6 are respectively "on-scale", in the sense intended here, when their range switches are set at positions such that an indicated scale reading of 5% corresponds to a reactor power level greater than 10-3% full power.
Runback is accomplished by de-energising the coils of two parallel-connected relay coils controlled by a single (non-redundant) logic chain of switches and other relay contacts which respond to conditions
- calling for runback. Inasmuch as in our review, runback is not
( considered a primary safety function but rather an operating con-venience which serves to check the various scram-producing parameters before a scram actually results, we believe that this non-redundant scheme is adequate.
1
(
(
. (\
There is no period-scram protection beyond the startup range. The single, intermediate range Log N-Period Channel (#4) has only runback capability. The Pathfinder safety system relies on scram-producing variable range picoansneters to terminate excursions while they are still well below destructive levels. Source range excursions will be terminated by the scram (period) circuits of
~
channels #1, #2, #3. At low levels it is necessary to rely on these channels since the variable range picosameters are off-scale at the low end and may well be unable, under these conditions, to terminate
. ramp-induced excursions.
In Amendment No. 29 the applicant analyzed reactor excursions using as a basis a reactivity insertion rate of 10c/sec. The excursions were assumed to begin with a ramp insertion beginning at the lowest power in a given range and terminated by a scram at 115% of full scale indication. ;
The Staff has also evaluated excursions using 10c/sec ramp insertions ;
(assumes a single short could cause two "Sc/sec" rods to be with-
- drawn). The applicant's and the Staff's analyses show that the !
safety instrumentation would safely terminate such excursions with !
no predicted fuel damage. For Phase II testing (maximum authorized i power of 5 Mw(t)) the applicant analyzed power excursions caused by ramp insertions of 50c/sec beginning at the lowest power in a given range and terminated by a scram at 115% of power in thac same range. i b With the assumptions used, the applicant showed that fuel element failures would not be expected in these excursions. The Staff I
agrees that power excursions initiated with higher reactivity '
insertion rates under the conditions assumed for Phase II testing could be safely terminated with the safety instrumentation; however, for power operation only the 5c/sec reactivity insertion rates were specified in the Technical Specifications.
B. Process Instrumentation System The process safety system instrumentation is now alsc, redtsidant.
Direct redundancy, i.e. , the use of not less than two non-coincident channels of instrumentation to monitor each scram-producing parameter has, with few exceptions, been employed throughout. The channel described in the application as the "High Steam Temperature," "High Reactor Pressure," and "High Reactor Power to Recirculation Flow Ratio," are some examples of directly redundant channels. There are three indirectly redundant channels, i.e. , channels which, o though not duplicated, are backed up by at least one other interdependent, scram-producing channel. These channels are the ,
" Turbine Stop Valves Trip," " Water Accumulation in Steam Line,"
and " Main Steam Isolation Valve Closure."
The final contacts of the scram channels are arranged as follows:
The contacts of the redundant channels are arranged in two
- independent logic chains (1/2 logic), each chain controlling the
( coil of a scram relay. The indirectly redundant contacts are wired as a single logic chain in series with both redundant chains. One I l
- - - - - - , - - - m s ,--.m-m-- , - - e- - . , ,w---n ,--- - - - - -,------~g, , - , - - -- ,------,--n ---wr~mnmaw- , - , - - - , , - - w-~
. l l
(- contact of each scram relay is in series with the A.C. line feeding the SCR bridges (as are all other relay logic circuit contacts).
De-energizing either relay coil is sufficient to. scram the. reactor.
Contacts on the manual scram and manual reactor isolation scram switches are duplicated. Thus, it appears that no single electrical .
fault can disable either of these switches.
The circuits of the Reactor Building Ventilation Closure system were . designed using the same criteria as for the process scram instrumentation. Each of the ventilation ducts have two ventilation
+
valves each of which are solenoid actuated. The system design criteria is that a single fault should not prevent valve closure. ;
C. Safety System Testinn !
The nuclear channels are tested, and appropriate interlocks are temporarily inserted, by means of function switches. Testing while ,
in the startup or intermediate range with the scram logic in the 1/3 mode and channel #4 not bypassed is accomplished by removing the synthetic trip signal being fed to the scram logic circuits from channel #7, and then injecting the test (trip) signals into the selected channel (#4, #5, #6, #7, or #8). In the startup or i intermediate range, with channel #4 bypassed and/or under test,' the l
, , testing of channels #5 or #6 cannot be accomplished without scramming ~
( the reactor.
The startup channels feed into a 2/3 logic system and can be individually tested at any time without the use of external switching circuits. Similarly, when the reactor is operating in the power range, the 1/3 logic is returned to the 2/4 mode, allowing individual testing of these channels without external switching.
Testing of the process system channels is accomplished in two steps.
First, each channel is tripped by a simulated signal, and operation of that channel's relay contact in the logic chain (to the scram relays) is determined by means of direct annunciator action, i.e., ,
each contact is wired SPDT with respect to its logic chain and its .
own annunciator, and, when tripped, breaks the chain and activates the annunciator. Those portions of the chain which are brokan during these tests must be individually bypassed to prevent scram.
Second, the scram relays are tested one at a time with test switches provided for that purpose and their respective annunciators are observed. Each scram relay contact is wired SPDT within the final logic chain feeding the SCR bridges and must be bypassed during test.
Based upon our review of the nuclear instrumentation, process instrumentation, and the testing provisions for each system, we have concluded these systems are adequate to initiate safety actions that may be required during operation.
,t i
e l
. f. .
( ,
f IV. Technical Specifications Although the Technical Specifications which were issued for reactor operation up to power levels of 1 W(t) are in most respects applicable for full power )
operation, amendiaents have been made where necessary. Certain amendments in ;
Technical Specifications are required to reflect the modified systems as i described previously. Other amendments are proposed to (1) Specify the containment leak rate testing criteria. This section was applicable in the original specifications only for 1 W(t)
$ operation, and as now written specifies leakage limits (and testing criteria to ensure compliance with the limits) in con-formance with analyzed accidents.
(2) Limit the maximum rod worth when the reactor is pressurized to a value which upon couplete withdrawal of the rod would ~cause the k excess of the reactor to be less than 1.025. This maximum rod worth limitation is in our opinion an appropriate reactivity limit to ensure that sudden reactor excursions can be terminated by Doppler coefficients prior to extensive destruction.
(3) Eliminate the calculated physics parameters for the first core loading. The actual measured values have been measured and the specification is no longer considered necessary.
- (4) Clarify or amplify existing specifications. Certain changes are proposed to correct errors or omissions of a typographical nature or to more clearly give the intent of a particular.
specification. i V. Conclusions i
' In our opinion, based upon the foregoing evaluation of the Pathfinder !
cpplication and the recommendations of the Advisory Conmiittee on Reactor Safeguards, there is reasonable assurance that the Pathfinder Atomic Power Plant can be operated as proposed at power levels up to 190 Mw(t) without endangering the health and safety of the public.
s.$d dgned br.
Ko;,ct S. Boyd l
Roger S. Boyd, Chief Research & Power Reactor Safety Branch ;
Division of Reactor Licensing D* **
- SEP 2 9 1965 i <
l I
e I
-- ---- - - -,-.,,n. _ - , - - . . . ,,,, ,,---.-- _ ,._ n . -r--,--,