ML20154R430

Position on NRC Reg Guide 1.97,Rev 3,Requirements for Post- Accident Neutron Monitoring Sys

ML20154R430
Person / Time
Site:	River Bend
Issue date:	03/31/1988
From:	GENERAL ELECTRIC CO.
To:
Shared Package
ML20154R408	List: ML20154R430 RBG-27979, Application for Amend to License NPF-47,revising License Condition 2.C.14 Re Reg Guide 1.97 Mods.Proposed Revs & Justifications Encl.Fee Paid
References
RTR-REGGD-01.097, RTR-REGGD-1.097 NEDO-31558, NUDOCS 8806070303
Download: ML20154R430 (58)

Text

_

M0031558 l Class I I

March 1988 Position on NRC Regulatory Guide 1.97, Revision 3, Requirements for Post Accident Neutron Monitoring System e

GE Nuclear Energy

$$2'58382808SSiss P DCD

-~g I;

I NEDO-31558 Class !

March 1988

.i l

'. l 1

.i POSITION ON NRC REGULATORY GUIDE 1.97, REVIS!0N 3 l, REQUIREMENTS FOR POST-ACCIDENT NEUTRON MONITORING SYSTEM l

i ll f

O GENucleerEnergy

. 17S Cww Amn l SuJm. CA 9925

NEDO-31558 DISCLAIMER OF RESPONSIBILITY i

This document was prepared by or for the General Electric Company. )

Neither the General Electric Company nor any of the contributors to this document:

A. Makes any warranty or representation, express or implied, with respect to the accuracy, completeness, or usefulness of the information contained in this document, or that the use of any information disclosed in this document may not infringe privately owned rights; or B. Assumes any responsibility for liability or damage of any kind which may result from the use of any information disclosed in this document.

t t

I e

i.

i i

i t

' ' NEDO-31558 i

o t

Table of Contents i Page iv ABSTRACT i

1

1.0 INTRODUCTION

1.1 Purpose of Licensing Topical Report 1 1.2 Sponsoring Utilities 2 3

2.0 NHS DESCRIPTION AND DESIGN BASIS 3

2.1 General 2.2 Use of Source Range Monitoring System (SRM) 5 2.3 Use of Intermediate Range Monitoring System (IRM) 6 l 2.4 Use of Power Range Instrument System 7 l

l '

2.5 BWR Potential for Returning to Criticality 8 2.6 Reliability of NMS 10 3.0 APPLICAIION OF REGULATORY GUIDE 1.97 FOR 11 NEUTRON FLUX MONITORING

) 3.1 General 11 l

3.2 RG 1.97 Requirements for Reactivity Control 11 l . Instrumentation 4.0 EVENT ANALYSIS TO DETERMINE REQUIRED NMS POST-ACCIDEhi 13 MONITORING FUNCTION 4.1 Introduction 13 4.2 Selection of Events 14 4.3 Events Analyzed 16 4.4 Conclusion 36 5.0 FUNCTIONAL DESIGN CRITERIA FOR POST-ACCIDENT 39 NEUTRON MONITORING 5.1 Scope 39 5.2 Requirements, Bases, and Existing Capabilities 39 5.3 Conclusion 47 I 6.0 ALTERNATE OR SUPPORTING INSTRUMEh7ATION 48 l 6.1 Rod Position Information System (RPIS) 48 6.2 Traversing Incore Probe (TIP) 49 6.3 Other Plant Parameters 49 6.4 Summary 50 7.0 BWROG CONCLUSIONS 51

[

8.0 P.17ERENCES 52 l

I 9.0 LIST OF ACRONYMS AND ABBREVIATIONS 53 6

I, i

i RG197.rgm - iii -

4/11/88 __ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

! i i .

NEDO-31558 I j

i l

ABSTRACT I

t i

i Regulatory Guide 1.97 sets functional design requirements for post-accident f

i neutron monitoring instrumentation. These requirements are generic to both LWRs and PWRs. The installed systems at many BWRs do not meet the current Reg. Guide 1.97 requirements.

This report provides a BWR event analysis methodology that establishes the importance of the NMS for post-accident mitigation. A wide range of events are considered in keeping with the intent of Reg. Guide 1.97. The results of the event analysis are used to set appropriate neutron monitoring post-accident functional design criteria. Deviations from Reg. Guide 1.97 requirements are justified.

i i

!' - iv -

i

F L

, , ..~u V 158

1.0 INTRODUCTION

1.1 Purpose of Licensing Topical Report j The Regulatory Guide 1.97 (RG 1.97) requirements which deal with design

} and qualification of the Neutron Monitoring System (NMS) have remained an issue with BWR plants. In order to resolve this issue, the BWROG RG 1.97/ Neutron Monitoring System Comittee was formed in 1986 to carefully study BWR events and determine the post-accident monitoring function of the BWR Neutron Monitoring System (NMS).

Regulatory Guide 1.97 :lassifies neutron flux as a key variable for monitoring reactivity control. As such, it is required to meet Cate-

-6 gory 1 design requirerants for a specified range of 10 percent to 100 percent full power. Category 1 imposes the most stringent design and

qualificati,on criteria censisting of redundant channels qualified in accordance with Regulatory Guide 1.89, "Qualification of Class 1E Equipment for Nuclear Power Plants," and the methodology described in I NUREG-0588 "Interim Staff Position on Environmental Qualification of

.- Safety-Related Electrical Equipment". These requirements reflect a

, significant departure from the original BWR plant design and licensing basis. The BWROG believes that the post-accident system requirements

. should be evaluated against the increase in overall plant safety and the

} benefits to plant operation.

k f{i The Comittee has examined the NMS requirements considering the operator actions specified by the BWR generic Emergency Procedure Guidelines t

(EPGs). This approach is in conformance with NUREG-0737 Supplement 1

}t a requirements for an integrated emergency response program. This inte-

! grated program has led to reconsidering the category classification of jE the NMS. The goal of this report is to establish post-accident design l J requirements for the NMS which are acceptable alternates to those speci-

a fled in RG 1.97.

i l

h  !

b P

I 1 l

. .. NEDO-51558 This Licensing Topical Report is generally applicable for all BWR/2-6s even though some plant-specific differences exist in system and component

[ design.

t 2

1.2 Sponsorina Utilities t

5 The sponsoring utilities of the RG 1.97/ Neutron Monitoring System

Cossoittee are identified below

Boston Edison Company Cleveland Electric Illuminating Company Commonwealth Edison Company Detroit Edison Company Georgia Power Company GPU-Nuclear Corporation Gulf States Utilities Co.

Iowa Electric Light and Power Company Long Island Lighting Company Systems Energy Resources Incorporated Nebraska Public Power District New York Power Authority Niagara Mohawk Power Company Northeast Utilities l Northern States Power Company Tennessee Valley Authority l

h

'i b

4

'j h

a l*

I 3

h

. o NEDO-31558 2.0 NEITTRON HONITORING SYS*'EM DESCRIPTION AND DESIGN BASIS i

-} 2.1 General The purpose of the NHS is to detect neutron flux in the reactor core over I a wide span ranging from shutdown conditions to high power conditions requiring reactor scram. In addition to the wide range needed, the spatial distribution of the neutron flux is needed to assure that operat-ing limits are not exceeded at any location within the reactor core. As BWR designs have increased core size, the neutron flux pattern has become more complex such that monitoring local flux conditions becomes necessary to avoid uneven fuel burnup or fuel damage.

To respond to these needs, General Electric developed the neutroa moni-toring system (NMS) using detectors located inside the core. These in-core flux monitors provide detailed spatial flux indication which improves both reactor plant safety and fuel utilization. The NMS design basis for BWRs never required a post-accident neutron monitoring function since there are no design basis accidents that rely on operator action to control reactor power.

'! To assure that all flux levels expected throughout the range of reactor i operation are monitored, three basic types of neutron detectors and 6 signal conditioning equipment are used. The approximate power level

[ ranges for the three neutron monitoring subsystems which overlap to g provide neutron flux information from fully shutdown to greater than

) rated power te given in Table 2-1. A brief description of each sub-rystem is given below.

?

l a) The Source Range Monitoring (SRM) Subsystem is used for monitoring l ,

the neutron flux from the fully shutdown condition through criti-8 2 cality to a neutron flux of approximately 5 x 10 n/cm /sec (approx-f

'! imately 0.0005% power). This system uses retractable detectors and pulse counting electronics coupled with logarithmic readout.

1 1

NEDO-31598 Table 2-1 APPROXIMATE POWER LEVEL RANGES FOR NEUTRON MONITORING SUBSYSTEMS s

l

REACTOR POWER i (% RATED) NEUTRON MONITOR SUBSYSTEMS 6

t =

• 125

• 100 --

? LPRMs/APRMs I = a 15 I*

' =

1

! IRHs I 0.0005 ---

0.0001 SRMs =

0.0 --

4 l

NEDO-31558 b) The Intermediate Range Monitoring (IRM) Subsystem overlaps the SRM system f rom about 1 x 10 8 n/cm /sec (approximately 0.0001% power) and extends well into the power range (>15% of full power). The IRM uses retractable detectors and voltage variance electronics. The i

subsystem consists of ten ranges of one half decade linear steps of output proportional to neutron flux.

i r

k c) The power range (1% to full power) is monitored by fixed fission chambers, the Local Power Range Monitoring (LPRM) Subsystem, is amplified and used for several purposes. The output of neutron I detectors near a control rod selected for motion are displayed immediately above the reactor control switches, and are used in the

. Rod Block Monitor (RBM) Subsystem to automatically prevent centrol

' In addition, rod withdrawal if the local flux change is too great.

the output of each LPRM is routed to the process computer for use in

{

E power distribution and local limit determinations, fuel burn-up L calculation, etc. The outputs of selected sets of the chambets are averaged to provide four to eight channels of core average neutron flux and is referred to as the Average Power Range Monitor (APRM)

Subsystem. The output of this subsystem is displayed to the opera-tor, provides an input to the reactor protection system and provides rod blocks based on power and flow relationships.

L

i' 2.2 Use of Source Range Monitoring System (SRM)

The SRM subsystem is primarily used for monitoring the neutron flux when I the plant is fully shutdown (approximately 10 percent power) and during

> startups. In the source range, the neutron flux is monitored by four independent fission counters which are inserted to about the midplane of

! the core by the drive mechanisms.

I t

In "STARTUP" mode, the SRM subsystem provides the information needed for reactor startup and low power operations. It is used to monitor suberi-l tical multiplication in order to observe the approach to criticality and I

determine when the reactor is about to go critical. When the reactor is l critical, the SRM is used to monitor the reactor period to allow the 1

^ v r 5-

, , NEDO-31558  ;

i operator to maintain it within specified limits. As startup progresses, the SRM provides the necessary range to achieve criticality and provides overlap with the intermediate range monitors.

When the reactor reaches the power range, the detectors are moved to a position approximately 2 feet below the core. This places the detectors in a low neutron flux so that burnup and activation of the detectors are minimized. However, even when fully withdrawn they do remain on scale i

j with the reactor at moderate or high power. Therefore, if a significant I reactivity control event were to occur with the SRMs withdrawn, they

would provide some trend indication to the operator.

During controlled plant shutdowns, the SRM detectors are inserted by the f Such monitoring is not

( operator to mont or the complete shutdown.

essential if all control rods are inserted by a reactor scram, in which l  ; case the operator inserts the detectors as soon as practical.

f lI In the "REFUEL" mode the SRM subsystem is used to monitor ncutron count rates during core alteration; the operator monitors the SRM suMritical l

count rate to verify that the reactcr is not approaching critical. The SRM indication at low count rates verifies system operability. In

"RERTEL" the SRMs are used to provide a scram signal in the non-coincidance mode at some plants if desired, but normally the SRMs cannot cause a plant scram.

The SRM subsystem was not designed by GE to be Class lE. since its design I use is to monitor flux during controlled plant startups or shutdowns and it does not provide any automatic plant trips during power operation.

i l

2.3 Use of Intermediate Range Monitor System (IRM)

L o

The IRM subsystem overlaps the source range and extends into the power range to at least 15% of full power. It normally employs eight (8)

}

! individual fission chambers which are withdrawn like the SRM detectors l

during full power operation to maintain their expected life and to reduce i r o <

l

'; i 6-

g-NEDO-31558

\

activation. The IRM drive mechanisms are similar to those used for the SRMs. j During reactor startup, the IRMs provide the required automatic safety j protection and operator information required for power ascension through the intermediate range. In order to control the reactor period during control rod withdrawal in the intermediate power range, the operator keeps the IRMs on scale by changing the IRM range switches, theaby avoiding short reactor periods and maintaining a prescribed startup rate.

I If the reactor period is too high or the operator is unable to keep the IRMs on scale, an automatic plant scram results.

IF Following plant shutdown or scram, the IRMs are again driven into the E reactor core to monitor neutron flux and verify a complete shutdown. The 1

i operator must keep the IRMs on scale by changing the IRM selector

, , switches.

I i ,

The IRM subsystem has been designed by CE to be a Class 1E system (except for the drive mechanism). This subsystem provides automatic plant trip i !

j

!, inputs to the reactor protection system (RPS) circuitry during startups.

l

- 2.4 Use of Power Range Instr 2 ment System f

The Local Power Range Monitors (LPRMs) overlap the SRMs and measure neutron flux over a range from approximately 1% to 125% of rated power on

! a linear scale. LPRM assemblies each contain four fission chsmbers which j

are at fixed locations and a calibration guide tube. The chambers are

!, uniformly spaced throughout the core in an exial direction and lie in l ,

four horizontal planes. Each fission chamber is connected to a d-c amplifier with a linear output. Internal controls permit adjustment of the amplifier gain to compensate for the reduction of chamber sensitivity caused by burnup of its fissionable material.

The LPRMs are used when a control rod or group of control rods is select-ed for movement. The readinge from the detectors adjacent to the rods being moved are displayed un the operator's control benchboard together I

L

. . NEDO-31558 1

with a display of the position of the rod or group of rods. This allows for careful ascensions in power and controlled burnup during power operation. After reactor scram, the LPRMs read off-scale low.

The average power level is measured by four to eight avera;;e power range monitors (APRM). Each monitor measures bulk power in the core by averag-ing signals from as many as 25 LPRM detectors distributed throughout the i

core. Actual APRM control room readout is in percent of rated powa .

I i

The reactor operator uses the APRMs to observe changes in reactor power and to determine the need for rod control or recirculation flow adjust-ment. The output signals from these monitors are also used to initiate scrams or rod blocks. If protective actions are taken, the system is used in combination with control rod position indication and other vessel parameters to verify the reactor has been scrammed or shutdown. After m

scram, the APRM goes downscale.

Most LPRM and APRM equipment has been designed by GE to be Class lE since it provides automatic plant trip inputs to the reactor protection system (RPS) circuitry. Power is usually supplied from the RPS buses so that a power failure to the LPRMs or APRMs would result in a RPS initiated scram.

I 2.5 BWR Potential for Returning to Criticality When the scram system automatically inserts all control rods, a BWR is immediately placed in the shutdown condition. Without deliberate opera-tor action the control rods cannot withdraw after the scram and no chemi-cal (liquid boron) control is required. Full control tod insertion results in reactor shutdown with margin for all reactor conditions. In fact, other rod patterns with less than full rod insertion also result in a shutdown reactor for all conditions. Some BWRs have experienced rod bounce following scram, where a number of rods lock at Notch 02 instead of all the way in (at Notch 00). However, the plants who have experi-enced this problem have determined that they are shutdown with margin even if all control rods insert and lock at Notch 02.

I

- - - _ - _ _ _ _ _ _ _ _ _ _ _ _ - _ _ _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ D

I NEDO 31558 Other plants have experienced rod drift, where a single rod which is being withdrawn will fail to lock and is therefore, withdrawn further than intended. However, this has never happened to rods that were locked. It has only happened where an operator has taken deliberate action to unlatch a control rod and move it to a new position (for instance in a plant startup).

Liquid poison (boron injection) is only relied upon under the very rare circumstance of inability to insert a sufficient number of control rods to achieve cold shutdown. No BWR worldwide has ever resorted to liquid boron injection to facilitate plant shutdown and the implementation of the ATWS rule (10 CFR 50.62) has further reduced the probability of this l type of ev3nt. For these reasons, BWRs have been designed and licensed I using neutron flux indication as a requirement only for nomal operation.

l l The NMS can, however, be used as an operator enhancement for abnormal or accident situations.

l Pressurized Water Reactors (PWRs), on the other hand, are routinely shut down by a combination of control rods and liquid boron in the primary coolant. For PWRs, even with full control rod insertion, there are conditions where the plant can be critical if there is insufficient l liquid poison (boron) in the core. Post-accident neutron monitoring is, l therefore, more important for PWRs.

l I

The inherent design of the BWR is very forgiving in hypothetical accident circumstances as demonstrated in Reference 5. Many passive and active design features contribute to the capability of BWRs to withstand reac-tivity-type events. Under normal operating conditions, the reactor is in an energized state in termt of system pressure and recirculation flows.

Events which lead to a lowering of the energy state of the system, such as pressure reduction or loss of forced coolant flow, automatically lead to a reduction in the plant fission power level. The basic design of a BWR is such that natural circulation of the coolant is sufficient to provide required cooling to the core in the event that power to recircu-lation pumps is lost providing that adequate reactor water level is maintained. The negative power coefficient and Doppler absorption

. 9

u -

NEDO-31558 automatically and promptly truncate power transients which might result from operator error or equipment malfunction.

2.6 Reliability of NHS The reliability of the existing BWR Neutron Monitoring System was deter-mined by analyzing the GE "COMPASS" data base over the period of 1975 through 1985. The percent in unavailability of the subsystems of the NHS are shown below:

Percent Subsystems Unavailable LPRMs 0.26 APRM 0 01 IRMs 0.07 SRMs 0.05 Note that Percent Unavailability is the average plant unavailability due to forced plant shutdown or critical path maintenance associated with t this equipment.

In addition to the GE "COMPASS" data base, the INPO Licensing Event Report Data Bcse was researched to determine whether any events had been reported which resulted in the loss of neutron monitoring capability. No events which cause the total loss of monitoring capability have been reported. From the operating experience during normal, startup and trip (scram) conditions the existing neutron monitoring instrumentation pro"ides highly reliable monitoring and trip functions.

t

_. L . - _ _ _ - _ - . _ - _ _ . __ - .

. . NEDO-31558 3.0 APPLICATION OF REGULATORY GUIDE 1.97 FOR NEUTRON FLUX MONITORING 3.1 ' General Regulatory Guide 1.97 describes design requirements for monitoring instrumentation used during and following accidents in terms of "cate-gory" and "type". Type designation is based upon requirements for directing operator actions for which no automatic action is provided under design basis accident events (type A), verifying accomplishment of safety functions (type B), verifyf ng fission product barrier integrity (type C), verifying system operation (type D) and assessing radioactivity release (type E). Category designation is determined by importance of function. Key variables for monitoring safety functions are assigned to the most stringent category (category 1); system operating status is assigned to a less stringent category, though they must have a highly reliable power source (category 2); backup and diagnostic instruments or instruments where the state of the art will not support a higher class are assigned to the lowest category (category 3).

The determination of design requirements for accident monitoring instru-mentation considers a spectrum of events such as loss-of-coolant acci-dents, anticipated operational occurrences that include Anticipated Transient Without Scram (ATWS), and reactivity excursions that result in l

release of radioactive materials. Key variable instrumentation must be capable of surviving the most severe accident environment in which it is required to operate for the length of time its function is required.

3.2 RG 1.97 Requirements for Reactivity Control Instrumentation Regulatory Guide 1.97 requires that instrumentation be provided to monitor reactivity control following an accident. It identifies neutron l flux over control rod position and boron concentration as the key vari-able for determining the accomplishment of reactivity control.

The guide has specified neutron flux monitoring as Category 1 which

( represents the highest design requirement. Category 1 design requires

. . NEDO-31558 redundant, seismically and environmentally qualified channels powered by Class 1E power sources. The monitors must provide unambiguous indication which is recorded and displayed in a manner consistent with good human factors practices.

RG 1.97 specifies neutron flux monitoring as a Type B variable for determining whether plant safety functions are being accomplished for reactivity control. To assure that safety functions are being performed for key Type B variables, the instrumentation must be qualified for its expected accident environment in which it is located and over a suf fi-cient time period into the accident.

RG 1.97 does not classify neutron flux as any other variable type.

l Reactivity is controlled automatically in design basis events by the RPS scram system. No reactivity control actions must be taken by reactor operators for design basis events, thus neutron flux is not a type A variable. Neutron flux gives no indication of fuel clad integrity; thus, l it is not a type C variable. Similarly, since neutron flux does not verify system operation or measure radioactive releases, it is neither a I type D or E variable. Therefore, the classification of neutron flux as a type B variable is appropriate and neutron flux monitoring instrumenta-tion to meet PG 1.97 requirements must be available to ensure that safety functions are being performed.

1 12 -

t

NEDO-31558 4.0 EVENT ANALYSIS TO DETERMINE REQUIRED NMS POST-ACCIDENT MONITORING FUNCTION i

4.1 Introduction The purpose of the event analysis is to assess the importance of neutron flux indication by examining the consequences of post-accident NMS failures in order to specify appropriate design require =cnte for post accident NMS operation. This section evaluates a range of postulated events where the operator may be required to use the NHS for post-accident monitoring and determines the effect of NHS failure on the outcome.

The top-level instructions for the operator's response to significant transient and accident events are contained in each plant's emergency operating procedures (EOPs). Supplemental plant procedures provide more detailed system operating instructions, but these instructions must not conflict with the top-level EOP instructions. Each plant has based their plant-unique E0Ps upon the generic BWR Owners' Group Emergency Procedure Guidelines (EPGs). The EPGs contain the fundamental actions based upon symptomatic conditions that plant operators must take in response to postulated events. The latest EPG, Revision 4, was submitted to the NRC for approval in early 1987. However, the analysis is not affected by l

differences in the operator actions using NMS indication since Revision 2

! of the EPGs. Therefore, EPG Revision 4 is used as the basis for operator actions in this study.

l The EPGs address conditions both less severe and more severe than design j basis accident conditions. For example, the scope of EPG development included instructions to mitigate events when the reactor is not shut-l down, when power is still high, and when the operator cannot determine shutdown status or power level.

l The EPGs do not specify the methods or instrumentation that the operator is to use to determine values and trends of specific parameters. If the reactor is not shutdown, the operator would prefer to use the APRMs, if NEDO-31558 l

available, te determine reactor power level. IRMs could also be used to determine power level if they had been inserted into the core. SRMs and IRMs could also indicate current shutdown status when they are driven into the core. NMS instrumentation will not, however, guarantee that the reactor will remain shutdown as it is cooled down and reactor conditions change. For example, the HMS may shoe that the reactor is shutdown now, but as the reactor is cooled down, moderator reactivity coefficients change and, if control rods are not suf ficiently inserted, the reactor can return to power. Therefore, current shutdown information from the NMS does not mean that the reactor cannot return to power later.

Other information may be used by the operator to determine reactor shutdown status or power level. This is discussed in more detail in Section 6 of this report. The scope of EPG development includes the ability to safely mitigate events when the NMS is not available.

s 4.2 Selection of Events A broad spectrum of events has been considered in establishing the events which are to be analyzed. These include all FSAR transient and accident events as well as NWS and other events beyond the plant design basis to l be consistent with the intent of RG 1.97. The evaluated event categories include:

1 e Transients with scram o Accidents with scram l e Transients without scram e Other occurrences without scram l

In general, these are events which occur with the reactor operating at 1

full power. "Transients without scram" includes both events where no control rods are ever driven into the core and those with some or delayed control rod insertion. "Other occurrences without scram" assume that the operator is eventually able to insert control rods. Reactivity events such as rod withdrawal errors and control rod drop accidents have been considered in the "Accidents with Scram" category. Other events such as

_i

. o NEDO-31558 a LOCA with a scram failure have not been considered credible events for this analysis, since they are of very low probability and are outside the scope of NWS requirements. Leaks or other occurrences with scram are within the scope of events considered, but they are bounded by the other event categories.

Events within eac'. category have been selected for analysis. The events selected are Founding for the post-accident NMS evaluation in that, together, they meet the following criteria:

1. The neutron flux information provided by NMS would be most ueful to the operator.

l

2. The spectrum of operator actions related to post-accident neutron flux monitoring are exercised.

l

3. The spectrum of conditions the operator must evaluate to determine appropriate actions if the NMS were to fail are exercised.

l 4. The impact on plant parameters u d operator actions if the NMS were to fail are maximized.

l For these evaluations, the postulated post-accident NMS failure is defined as a failure of all APRM, LPRM, IRM and SRM indication. Since the failure is postulated to occur after the accident has initiated, automatic trip functions which occur prior to the presence of a hostile environment are not effected by the failure. Similarly, a NMS failure during normal plant conditions would be governed by technical specifica-tion requirements. In addition, automatic trip functions are outside the scope of a post-accident instrumentation requirements specification.

Consequently, event initiation after a NMS failure is not considered.

. , NEDO 31558 4.3 Events Analyzed The events analyzed are sununarized in Table 4-1. A detailed description of each event, including operator actions, the environmental conditions various NMS components would experience, and impact of a NMS failure, is provided below.

l 4.3.1 Transients with Scram l

1) Event: Feedwater controller failure - maximum demand.

Description:

A feedwater controller failure increases feedwater flow to the maximum the system can deliver. With excess feedwater flow, core inlet temperature decreases and water level rises to the high level main turbine and turbine-driven feedwater pump trip setpoint. The turbine trip causes a reactor scram signal. The high water level trip occurs l

before the temperature decrease causes an increase in neutron flux to i reach the high flux scram setpoint.

l Operator Actions: The operator enters the EPGs for RPV control (level, pressure, and power) following turbine trip on the high RPV pressure signal (above the high RPV pressure scram setpoint). The EPG actions are: confirm automatic actions, establish high pressure injection j

systems for long-term maintenance of RPV water level, control reactor pressure with the turbine bypass valves, and monitor and control reactor power. The EPG specified operator actions related to power control are l complete as soon as ft is determined that the reactor is shutdown.

Control rods "all in" indication would imunedintely confirm reactor j

shutdown. The APRMs would trip downscale and the operator could not use l

the NMS to confirm reactor shutdown until the SRMs or IRMs had been l driven into the core region.

Environmental Impact: The environment near NMS equipment in the reactor, drywell, and reactor building would not be affected by this event because the reactor is not isolated from the main condenser and normal heat 1

3 Table 4-1

SUMMARY

OF EVENT ANALYSIS Operator Use of NHS Impact of NHS Failure Event Clc.ssification Event o No impact from a NHS 4.3.1 Transients With Scram o Feedwater controller o Monitor shutdown failure alone failure - maximum after initial event j

demand has been mitigated o With additional RPIS l

(no isolation from and SRMs or IRMs failure some routine main condenser) have been inserted actions required, but no boron injection o Turbine trip with o Monitor shutdown o No impact from a NHS bypass failure after initial event failure alone (isolation from has been mitigated o With additional RPIS

• main condenser) and SRMs or IRMs failure some routine have been inserted actions required, but 4 q no boron injection g e

Large Break IDCA o Not used by the c No adverse impact from 4.3.2 Accidents With Scram o a NMS failure (rapid blowdown operator and ECCS injection) o Small Break LOCA o Monitor shutdown o No impact from a NMS (operator control after initial event failure alone of RPV pressure and has been mitigated o With additional RPIS and SRMs or IRMs have failure, some NIVS water level) actions including boron been inserted.

injection are possible o Control Rod Drop o Monitor shutdown o No impact from a NMS Accident following scram failure alone (reactivity insertion) (IRMs or SRMs are o With additional RPIS already Inserted as failure some routine event initiates at actions possible, but low power) no boron injection l

l L ---- --- --

7 Table 4-1

SUMMARY

OF EVENT ANALYSIS (Continued)

Event Classification Event Operator Use of NMS Impact of NHS Failure 4.3.3 Transients Without o MSIV closure o Determine power level o No impact from a NHS Scram with complete o Monitor power during failure; obvious that scram failure boron injection all ATWS mitigation (isolation from actions are required main condenser) o Long tern boron concentration monitored by sampling o Stuck open relief o Determine power level o Boron injection and valve with partial o Monitor power level other AWS mitigating  %

i scram failure during water level actions more likely; g g (no isolation reduction and control could lead to same d, from main condenser) rod insertion to actions as taken for G potentially avoid boron MSIV closure with $

injection complete scram failure.

4.3.4 Other Occurrences o Recirculation pump o Monitor power as o No adverse impact from Without Scram seal leak control rods are a NHS failure (leak inside incerted, containment) o Monitor shutdown when power is reduced sufficiently for SRMs and IRMs to be inserted.

o Scram discharRe o Monitor power as o No adverse impact from volume leak control rods are a NHS failure (outside containment inserted except for Mark III o Monitor shutdown when plants) power is reduced sufficiently for SRMs and IRMs to be inserted.

1

Table 4-1

SUMMARY

OF EVENT ANALYSIS (Continued)

Event Classification Event Operator Use of NHS Impact of NHS Failure 4.3.4 Other Occurrences o Loss of drywell o Monitor power as o No impact from a NHS Without Scram coolers control rods are failure (continued) inserted o Monitor shutdown when power is reduced sufficiently for SRMs and IRMs to be inserted

- B.

W

- =

=

NEDO-31558 removal systems continue to function. Therefore, the environment is not expected to degrade significantly from normal operation conditions.

Impact of NHS Failure: The Rod Position Indication System (RPIS) is used to confirm control rod position and reactor shutdown as discussed in Section 6.0. Without the NMS, the operator cannot use neutron flux information to confirm reactor shutdown. If RPIS is also not available to confim reactor shutdown, the operator would follow EPG inctructions to place the reactor mode switch in "SHUTDOWN" (which provides an auto-matic reactor scram signal) and run back recirculation pumps if they had not already been runback or tripped. These are routine actions for turbine trip type events which would occur even if NHS and RPIS were working. The operator would also initiate the alternate rod insertion (ARI) system and enter the Level / Power control contingency. The operator would use alternate indications to detemine reactor power as also dis-cussed in Section 6.0. If, however, the operator could not use alternate information to determine that reactor power is below approximately 3%

power, then the EPG specified actions are to trip the recirculation pumps. An instruction to inject liquid boron or lower RPV water level to reduce reactor power would not be generated because the suppression pool would not heat up sufficiently to cause these actions. Therefore, the Level / Power control contingency would not specify any actions different than nomal level control for this event. Thus, the actions the operator would take for this event with a loss of the NMS even coupled with a loss of RPIS and inability to detemine power is below approximately 3% power do not significantly affect the plant response.

2) Event: Turbine trip with bypass failure.

Description:

A variety of malfunctions will cause a turbine trip. This trip will cause the turbine stop valves to close and initiate a reactor scram. With a turbine bypass failure, the reactor will pressurize until the SRVs open to relieve pressure and discharge energy to the suppression pool.

NEDO-31558 Operator Actions: The operator enters the EPGs for RPV control on the J

f high RPV pressure signal. The EPG specified actions are: confirm auto-matic actions, manually open SRVs to terminate SRV cycling (or confirm low-low set SRV operation), establish reactor high pressure injection for long-tere .c_.intenance of RPV water level, and monitor and control reactor i

power. As discussed above, the operator completes EPG specified power control actions as soon as it is determined that the reactor is shut down (control rods are sufficiently inserted or neutron flux indication).

Environmental Impact: The environment near NMS equipment in the drywell and reactor building would not be effected by this event because the minimal heat addition is confined to the suppression pool and not signi-Therefore, ficantly propogated to the areas that contain hMS equipment.

the environment is not expected to degrade significantly from normal operation conditions.

Impact of NHS Failure: If RPIS can confirm reactor shutdown, the operator enters the scram procedure and there is no impact from the hhS f ailure.

If RPIS fails and the operator cannot use hMS to confirm reactor shut-down, the operator would continue to follow the routine EPG instructions for turbine trip type events as outlined above. Instructions to initiate boron injection or to lower RPV water level would not be generated for this case due to the very small suppression pool heatup. Thus, the actions the operator would take for this event with a loss of NHS, even coupled with a loss of RPIS and inability to determine power is below approximately 3% power, do not significantly affect the plant response.

4.3.2 Accidents with Scram

1) Event: Large Break LOCA with Failure of One Division of Low Pressure ECCS

Description:

The break causes it:endiate high dryvell pressure and low RPV water level LOCA signals. The plant scrams and begins a rapid depressur-ization through the break. The low pressure ECCS injection restores RPV

NEDO-31558 l

water level. However, the initial water level drop may cause a signifi-cant core uncovery. Core reflood will be with a highly voided mixture inside the shroud which swells water level above the top-of-active fuel.

As the core is subcooled by the large amount of water injected, water level will settle out at just above the top of the jet pumps with the injection rate equal to the rate at which water is pouring out the break (BWRs without jet pumps rely on core spray to maintain core cooling).

Operator Actions: The initial operator actions for this event are rela-tively limited. The event occurs rapidly and the automatic systems are designed such that the operator does not have to take manual actions until the reactor is depressurized and reflooded with the low pressure ECCS.

The operator cannot restore water level above top-of-active fuel for this event. Therefore, when he confirms that the reactor is shutdown, the actions in the primary containment flooding contingency are taken to flood cent'ainment until water level can be restored above the top-of-active fuel.

Environmental Impact: This event will product a harsh environment for equipment in the reactor and drywell. NMS equipment in those locations would not be expected to survive this event long enough to either verify the APRM downscale trip or to drive SRMs or IRMs into the core.

Impact of NMS Failure: If RPIS can confirm reactor shutdown, the operator continues with the containment flooding actions and there is no impact from n NMS failure. If RPIS and NHS both fail, it is likely that the operator will know the plant is shutdown by virtue of the excessive automatic lou pressure injection into the core and the absence of any resulting power excursion. If the operator cannot determine that the reactor is shutdown, then level control actions are transferred to the level / power control contingency. However, for this event the outcome would be nearly identical, since the same systems specified in the containment flooding contingency would be utilized in the level / power control contingency in an effort to restore reactor water level.

l

3 NEDO-31558 l For this event, the operator does not need to use the NMS to assess reactor power to determine if recirculation pumps should be tripped (they l already are), boron should be injected (it would quickly be diluted in the suppression pool), or water level should be lowered (it already is low). Therefore, a NMS indication failure does not significantly affect plant response or plant safety for this event.

2) Event: Small Break LOCA with Failure of High Pressure Make-up in Conjunction with Loss of Offsite Power at Time of Scram

Description:

The small break causes a containment pressurization above the scram setpoint. The loss of offsite power is assumed to cause a loss of feedwater and MSIV closure. RPV water level decreases due to decay heat boiloff and steaming through the break and the SRVs. With ft.ilure cf the high pressure systems, the RPV is depressurized by the automatic depressurization system (ADS) and low pressure systems restore RPV water level.

Operator Actions: The operator enters the EPGs for RPV controA and con-tainment control on the high drywell pressure scram signal. The EPG specified actions for RPV control are: confirm scram and isolation,

( attempt to restore high pressure systems, and manually open SRVs to

! terminate SRV cycling (or confirm low-low set SRV operation). When the operator deturmines that high pressure systems cannot be restored and low j pressure systems are available, the operator will open SRVs to depressur-ize the RPV and restore RPV water level. The operator completes EPG l

l specified actions related to power control as soon as it is determined that the reactor is shut down or RPIS indicates that control rods are sufficiently inserted. The APRMs will have tripped downscale, but the operator cannot use NHS to confirm reactor shutdown until the SF.Ms or IRMs can be driven into the core.

Environmental Impact: This event has an automatic scram signal when drywell pressure reaches the high drywell pressure scram setpoint.

Typical drywell temperatures and the time-after-break occurrence are presented in Table 4-2 for a spectrum of break sizes for different type

NEDO-31558 Table 4-2 TYPICAL TIME AND DRYWE11 TEMPERATURE WHEN DRYWE11 PRESSURE REACHES THE SCRAM SETPOINT Break Size (ft2) Time (sec) Drywell Temperature ( F)

Mark I 0.1 4 170 0.01 58 141 0.002 775 146 Mark II 0.1 3 167 0.01 60 140 0.001 970 136 Mark III 0.1 5 168 0.01 65 148 0.005 144 144 Assumptions:

1. Drywell coolers are operating.

2. Maximum technical specification allowable drywell-to-wetwell bypass leakage area.

3. Initial drywell temperature is 135 F.

4. Scram is assumed to occur when the drywell has pressurized 2 psig above normal operating drywell pressure.

NEDO-31558 1

containments. These are representative results that do not supersede plant-specific evaluations. The environment prior to scram is m'.1d and a NMS failure would not be expected prior to scram. The environment would be expected to gradually degrade following scram as the break continues to discharge energy to the drywell. The extent of NMS equipment surviva-bility depends upon the capability of the installed components.

Impact of NHS railure: If RPIS can confirm reactor shutdown, the operator enters the scram procedure and there is no impact from the NMS failure.

This determination is made early in the event, requires RPIS operability for very short durations, and does not need to be repeated later in the event. If the RPIS f ails and the operator cannot use NMS to confirm reactor shutdown, then the operator would be led to the EPG instructions to enter the Level / Power control contingency. Other NNS mitigating actions (trip recirculation pu=ps, initiate ARI, etc.) would have already occu'rred or have no effect on event outcome. However, if the small break causes the suppression pool to heat up sufficiently, the operator may have to lower water level and inject boron.

The action level which requires a RPV water level reduction in the Level / Power Control Contingency is power above approximately 3 percent power (or cannot be determined), along with high suppression pool tempera-ture, and either a SRV open or high dryvell pressure. These are indica-tions that power is high, there has previously been a significant heat input to the containment, and the heat input is continuing. With enough heat input to the containment to heat up the suppression pool, the pre-sence of the break would make it difficult for the operator to use other plant data such as steam flow and SRV position to determine that power was below approximately 3 percent power and avoid the water level reduction.

If the operator could not detemine that reactor was below approximately 3%, then the operator would be required to reduce water level. If the operator were to reduce water level, the lower water level would be maintained until the requisite amount of boron had been injected or until it could be determined that sufficient control rods had been inserted.

This water level reduction does not jeopardize adequate core cooling.

Thus, initial failure of both the RPIS and the NMS could result in

_. . . _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _..._._____________._____._J

NEDO-31558 I

unnecessary water level reduction and boron injection, but would not  !

threaten plant safety.

3) Event: Control Rod Drop Accident

Description:

The 3ost limiting response to this event is when the reactor in, at low power. During the normal process of withdrawing control rods, a high worth control rod sticks in the fully inserted position and becomes decoupled from its drive mechanism. After the drive is with-drawn, the rod frees and drops out of the core. The rapid rod withdrawal causes a reactor power increase. A high power signal scrams the reactor, which terminates the accident. The plant has been designed to accommo- <

date this event without experiencing significant fuel failures or a radioactivity release.

Operator Actions: The operator will be monitoring neutron flux with IRMs or APRMs while pulling control rods. Following scram, the operator enters the scram procedure and uses the NMS to ranitor neutron flux and confirm reactor shutdown. The event does not generate any EPG entry condition, since it does not significantly affect RPV water level, RPV pre.ssure, or drywell pressure.

Environmental Impact: The environ:nent near hMS equipment in the reactor, drywell and reactor building would not be affected by this event.

Impact of NMS Failure: Following scram, if the operator cannot determine 1 reactor power because of a NMS failure, then the operator enters the EPGs.

The operator would then rely on RPIS to determine the reactor is shut down and again enter the scram procedure. If RPIS and NMS were both to fail, then the operator would take actions to initiate ARI. However, other i

l indications would show that power is below approximately 3% power and the action to trip recirculation pumps would not be required. Furthermore.

l l

with no pool heatup and all SRVs closed even without RPIS r.nd NMS, boron injection and other A'WS mitigation actions would not be required. There-fore, there is no adverse consequence from a hHS failure for this l accident.

NED0-31558 4.3.3 Transients Without Scram

1) Event: MSIV Closure with Complete Scram Failure

Description:

During full power operation, all MSIVs close. MSIV closure generates a scram signal. The scram is not successful; the reactor pres-surizes until several SRVs open and discharge steam to the suppression pool. Plants with safety valves that discharge directly to the drywell may have these valves open briefly, depending upon plant capacity and specific plant incorporated automatic AWS mitigation features to runback feedwater and trip recirculation pumps.

Operator Actions: The scram failure with MSIVs closed will give an EPG entry condition. The operator will place the reactor mode switch in "SHUTDOWN". If automatic AWS features have not activated, he will I initiate ARI and trip recirculation pumps. Without control rods inserted sufficiently to assure shutdown, water level control will be transferred to the Level / Power control contingency. The rapid and continued pool heatup (along with the reactor not shutdown) will quickly generata an l :nstruction to inject liquid boron. With reactor power well above the approximately 3% power actfon level, the operator will lower RPV water to reduce reactor power. The operator will also try to drive control rods into the core, though for this event no rod insertion is assumed.

When liquid boron has been injected sufficiently to assure hot shutdown, RPV water level is restored to its normal range. Three-dimensional sub-scale tests have shown that, if boron has collected in the lower plenum, it is mixed in the RPV volume and shuts down the reactor when the water level is restored. After liquid boron sufficient to assure cold shutdown has been injected, a 100 F/hr cooldown is begun. The hot and cold shutdown boron amounts are pre-determined based on conservative concentrations and volumes and are not based on neutron flux measurements.

The Level / Power control contingency also establishes a priority on injec-tion systems. Outside the shroud injection systems are used in preference to inside the shroud injection systems to promote thermal mixing and avoid

NEDO-31SS8 a potential power excursion that could result from injecting subcooled water into a core that is not shutdown. In addition, if emergency RPV depressurization is required when a sufficient number of control rods are not inserted, the EPG specifies actions to assure that excessive amounts of subcooled water are not inserted into the RPV.

During this event, the operator would use the NMS to determine reactor power level and trends. The indicated power immediately following the scram failure would be approximately 40% to 60% of rated power. This is well above the approximately 3 percent power used as an action level to determine if the recirculation pumps should be tripped and if RPV water level should be lowered. The NMS would show a power reduction during the water level reduction and it would provide verification that liquid boron was in fact reaching the core and shutting down the reactor. However, once boron injection has begun, it is not terminated until the required amount has been injected or until control rods arc inserted. Neutron flux indication is not used to terminate boron injection.

Environmental Impact: Though this event has a dramatic pool temperature increase, the temperature increase r. ear drywell equipment (cables, connec-tors, SRM/IRM drive motors) and near equipment in a Mark III containment (electronic equipment, cables) would experience a slowly degrading envi-ronment as heat was transferred from the suppression pool to the surround-ing spaces. With a peak suppression pool temperature of 180 F to 200 F for this event, the NMS equipment will only be exposed to a mildly degrad-ed environment. The extent of NHS equipment survivability depends upon the capability of the installed components.

Some BWRs are designed with unpiped safety valves which discharge directly to the dryvell. This event may cause multiple safety valve discharge for those plants over a sufficient time period to severely degrade the dryvell environment in which NMS equipment is located.

Impact of NMS Failure: If RPIS is available, the absence of all-control-rods-in indication will quickly alert the operator to the scram failure even if NMS indications of high power were not available. If NMS and RPIS

l NEDO-31558 both fail, then with reactor pressure at or above normal operating pres-sure and several SRVs discharging steam to the suppression pool, it will be very obvious to the operator that the reactor is not shutdown and that power is well above the approximately 3% power action level. SRV dis-charge line indication (acoustic monitors or pressure sensors) will give positive verification that several SRVs are open. Therefore, the operator would take the same actions to inject boron and lower RPV water level as would be taken were NMS and/or RPIS indications available.

As the event progresses, the NMS is an enhancement to the operator for monitoring neutrm flus during boron injection and when the vs.ter level is raised as thi- aixes tne boron in the reactor volume. However, the dramatic redm rion in taam discharge through the SRVs will be adequate verification that ceActor power is being reduced.

NMS c'ould be used as a backup to boron concentration measurements when control rods are not inserted but af ter the BWR has been shut down with liquid boron to reonitor the suberitical flux as an indication of boron ,

dilution. The quantity of boron injected includes provisions for recircu-l lation piping, RWCU, shutdown cooling system volume, etc. Since boron carryover with steam is negligible, boron dilution can only occur as the

! result of liquid leakage or vessel flooding through the SRVs. This dilu- ,

tion could require the makeup and injection of additional boron into the reactor pressure vessel if the control rods cannot be inserted.

l

2) Event: Inadvertent SRV Opening with Partial Scram Failure

Description:

During full power operation, a SRV opens and fails to close. When the cuppression pool has heated up to the pool temperature at which reactor scram is required, the operator manually initiates the scram. With a partial scram failure some of the control rods are inserted on the initial scram signal and/or the operator has success with manual attempts to drive control rods. The operator still follows the actions specified in the EPGs, but the plant consequences are less extensive than for the previous case with no control rod insertion.

NEDO-31558 Operator Actions: Suppression pool temperature above the limiting condi-tion for operation (LCO) causes the operator to enter the containment control procedure. Actions to initiate pool cooling will not be suffi-cient to terminate the temperature rise and the operator will quickly enter the RPV control procedure where the instruction is to initiate reactor scram. With a scram failure as indicated by control rod position and neutron flux indication, the operator will follow EPG power control instructions to place the mode swirch in SHUTDOWN, initiate ARI, run back and trip recirculation pumps, inject boron with the standby liquid control system (SLCS) and attempt to drive control rods. Without control rod insertion sufficient to assure shutdown, water level control will be transferred to the Level / Power control contingency. The operator will use the main turbine bypass valves to control RPV pressure.

With a SRV open, reactor power still above approximately 3 percent power, and elevated suppression pool temperature, the operator will lower RPV water level per the Level / Power control contingency instructions to reduce natural circulation and reduce generated power. When a sufficient pre-determined amount of boron has been inserted. RPV water level will be restored to its normal range and the operntor will proceed to take the plan. to cold shutdown. This restoration occurs when a sufficient number of control rods to assure shutdown are inserted or when a specific amount of boren has been pumped into the reactor. The level restoration action is not based on neutron flux information.

The actual response would depend upon how many control rods went in and how soon in the event they were inserted. If the initial insertion was sufficiant to reduce power below approximately 3 percent power, then the recirculation pumps would be run back but not tripped, and the reactor water level would not be lowered to reduce reactor power. Furthermore, liquid boron injection could be delayed or even avoided if the subsequent heat addition rate to the suppression pool did not exceed the pool cooling capability.

a If the initial control rod insertion was not sufficient to prevent boren I

injection, tl.e RPV water level reduction and additional rod insertion 30 -

NEDO-31558 could reduce power belos approximately 3 percent power. This would allow i'or a less extensive water level reduction than for a complete scram failure. The hMS would be used by the operator to monitor neutron flux reductions as control rods are inserted and/or as water level is lowered, and to verify that boron is reaching the core rt.gion. It would be used to confirm that the reactor power has dropped below approximately 3 percent power and, therefore, determine which less extensive actions are warranted.

Environmental Impact: The Nh3 equipment will experience an environment that is degraded even less than for the MSIV closure with complete scram failure event, since the steam production is reduced and most of it goes to the main condenser instead of to the containment. The BWRs which are designed with unpiped safety valves may have their high setpoint valves open for a short duration. The resulting environment and extent of hMS equi'pment survivability would require plant-specific review. However, part of the plant's design basis is to assure that the unpiped safety valves do not open for events with scram when relief valves function properly. Any safety valve opening would be further evidence to the operator that a scram failure has occurred and assure that appropriate ATWS mitigation actions are taken even if the degraded environment causes a NMS failure.

Impact of hMS Failure: If RPIS is available, absence of all-control-rods-in indication will quickly alert the operator to the scram failure even if NMS indications of high power are not available. If NMS and RPIS both fail, the positive control room indication of the open SRV in addition to steaming through the turbine bypass valves, etc. will be obvious indica-tions that the reactor is not shutdown and that power is above the approximately 3% power action level. However, as control rods are inserted, the steaming rate will decrease. The turbine bypass valves will close and the RPV will begin to depressurize through the stuck open SRV. For these conditions, a NMS indication f ailure will make it more

, difficult for the operator to determine if power is above or below the approximately 3 percent power action level. However, the inability to j determine reactor power nas been incorporated conservatively into the

, , NEDO-31558 EPGs; if the actual event has reduced power below approximately 3 percent

, power, but all indications are inadequate (including a NMS failure), then the operator must take the actions as though power were above approxi-mately 3 pr.rcent power. These actions which trip reci rculation pumps, initia'.e liquid boron injection, and maximize the RPU wa ter level reduc-tion are more extensive than would need to be taken, but do not threaten plant safety.

If liquid boron is unnecessarily injected, it would ha e to be cleaned up, but the actions do not threaten adequate core cooli.22 Furthermore, if the control rod insertion (as monitored by the RPIS) is sufficient to assure reactor shutdown under all conditions without liquid boron, then the more extensive AWS control operator actions can still be terminated or avoided.

In summary, with a NMS failure the partial rod insertion for this event may make it more difficult for the operator to determine if power is above or below the approximately 3% power action level. The EPGs assure that, whether the operator can determine this or not, plant safety is main-tained.

4.3.4 Other occurrences Without Scram

1) Event: Recirculation pump seal leakage, failure to scram when in-itiated by the operator

Description:

During nomal full power operatior. a recirculation pump seal begins to leak excessively. The operator runs back recirculation pumps to minimum speed and manually initiates reactor scram. The scram does not occur.

Operator Actions: The operator enters the EPGs for RPV control when the scram does not occur. The operator uses feedwater to control reactor water levol, trips the turbine and uses turbine bypass to control reactor pressure, initiates the alternate rod insertion system (ARI), trips

• ecirculation pumps, and if ARI has not inserted them, attempts to manually drive control rods. The containment heatup for this event would

~

1 I

NEDO-31558 be small because the reactor is not isolated from the main condenser and the drywell coolers prevent the leak from causing a substantial dry.tell temperature increase. Therefore, other AWS mitigation actions such as boron injection and water level reduction would rot be required. The operator would use RPIS to monitor rod position and hMS to monitor power / neutron flux as control rods are inserted. As power was reduced, the operator would insart IRMs and SRMs to continue monitoring neutron flux until the reactor was fully shutdown. The EPG actions ralaf.ed to power control are completed as soon as it is determined that the plant is shutdown or RPIS indicates that control rods are sufficiently inserted.

Environmental Impact: Pump seal leakage will increase temperature and humidity in the bottom of the drywell in the vicinity of the NMS under-vessel cabling, connectors, and SRM/IRM drive motors. The actual response would be less severe than the results presented for the smallest ,

break in Table 4-2 for the small break LOCA. The extent of HMS equipment survivability depends upon the capability of the installed components.

Impact of NMS Failure: With a NMS failure the operator must use other means to monitor reactor power reductions such as turbine bypass flow as discussed in Section 6.0 of this report. Due to little containment

heatup, most AWS mitigating actions would not be required even if RPIS and NHS were both to fail. Therefore, plant response is not adversely affected by a NMS failure for this event.

2) Event: Partial scram followed by acram discharge volume leakage Descript. ion turing normal full power operation, a spurious scraa signal is generated. The plant only partially scrams. Following the partial scrar, a leak develops in the scram discharge volume which adds heat to th react.or building (primary containment for Mark III designs). Since this event requires multiple failures of safety-related equipmant, it is

. not considered to be of significant concern; the analysis of this event

' was suggested by the NRC.

I 1

L:

NED0-31558 Operator Actions: The operator enters the RPV control procedure when the scram does not occur. The actions taken to contrel reactor pressure, water level and power are essentially the same as for the leak inside containment discussed above. Other AWS mitigation actions such as boron injection and RPV water level reduction would still not be required, since the reactor does not isolate from the main condenser and the suppression pool does not heat up for this event.

The oporator also enters the secc,ndary containment control procedure on high temperature or high water level in a sump or area of the secondary containment. If the leak propagates the high temperature or water level to more than one area of the secondary containment, emergency RPV depres-surization would be required. This is to assure that, if equipment in the secondary containment begins to be affected by the leak, the RPV will be in a low energy condition with the maximum number of systems available to piovide core cooling. Special level control actions would be required for a blowdown with the reactor not shutdown as specified in the level /

power control contingency to assure that a cold water induced reactivity excursion does not occur.

)

i Environmental Impact: The scram discharge volume is in the vicinity of i

NMS electronic equipment for some plant designs. Thus, the leak could f

j cause NMS electronic equipment failure under these conditions. Each plant would have to evaluate the location of HMS equipment relative to compon-I ents that could leak water on them to determine the potential for this

! failure.

i Impact of NMS Failure: A NMS failure would have little impact on the i

operator or plant response to this event. The operator would continue to monitor rod position with RPIS as control rods are inserted. This event has essentially no conti,inment heatup (a small heatup for Mark III con-tainments) and most AWS mitigating actions would not be required even if RPIS and NMS were both to fail. Therefore, plant response is not adversely affected by a NHS failure for this event.

l

l * '

l NEDO-31558 i

3) Event: Loss of drywell coolers, failure to scram I

l

Description:

During normal full power operation, all drywell coolers simultaneously fail. The drywell heats up and pressurizes until it reaches the scram setpoint, where a scram is initiated. The scram does t

not occur.

Operator Actions: The oparator anters the EPGs for primary containment control on high drywell temperature and for RPV control when the high drywall pressure scram signal occurs. If drywell temperature approached the qualification temperature for ADS solenoids (typically 340 F), dryvell spray would be initiated and/or the RPV would be blown down. But these temperatures are not expected for this event. The operator uses feedwater to control reactor water level, turbine bypass to control reactor pres-sure, initiates the ARI system, trips recirculation pumps and if ARI has not inserted them, attempts to manually drive control rods. The operator would use RPIS to monitor rod position and NMS to monitor power /neutror flux as control rods are inserted. As power was reduced, the operator would insert IRMs v.nd SRMs to continue monitoring neutron flux until the reactor was fully shutdown. The EPG actions related to power centrol are completed as soon as it is determined that the plant is shutdown or RPIS indicat3s that control rods are sufficiently inserted. High drywell pressure is one of the conjunctive criteria for lowering RPV water level, but there is no suppression pool heatup for this event, so neither water level reduction nor boron injection would be required.

Environmental Impact: The drywell would heatup with a relatively low humidity for this event. This heatup could cause a slow degradation of NMS equipment in the drywell, but is not expected to cause a rapid NMS failure. The extent of NMS equipment survivability depends upon the capability of installed components and actual dryvell temperature response to this event.

Impact of NMS Failure: With a NMS failure the operatt.cc must use other l

means to monitor reactor power reductions such as turbine bypass flow as discussed in Section 6.0 of this report. If the operator could not use

= - .-

NED0-31558 NMS to confirm reactor shutdown, then the operator must continue current actions until RPIS indicates that control rods sufficient for shutdown are inserted. If RPIS also fails, the operator would have to wait to cool down, etc. until some means can be employed (see Section 6.0) to determine reactor shutdown. However, with all steam going to the main condenser, no other A'1VS mitigating actions would be required. Therefore, plant response is not adversely affected by a NMS failure for this event.

, 4.4 Conclusions The events analysis considered the operator's use of the NMS for tran-sients with scram, accidents with scram transients without scram, and other occurrences without scram. The analysis details how the operator uses the NMS if available, and the impact on event outcome if the NAS were to fail. The events selected provide a spectrum of impacts, but they bound the NMS importance for all events that are within the scope of the Reg. Guide 1.97 criteria.

Per Trans'ents With Scram, the long-term post-accident function for neutron flux monitoring is not necessary after reactor shutdown is confirmed. These events have very little environmental impact on NMS equipment and operator actions are not significantly affected by the loss of neutron monitoring capabilities. For the bounding transient with scram events, the operator normally uses the NMS to confirn low power, but upon NHS failure there are other clear indications which will show that power is low. Boron injection or other abnormal operator actions are not expected to be required as a result of the NMS failure.

Therefore, these events do not set design requirements for the NMS.

For Accidents With Scram, the long-term post-accident function for neutron flux monitoring is not necessary after reactor shutdown is confirmed. These events impose severe environmental conditions for large pipe breaks, but the automatic plant response makes NMS indication of low importance to the operator. Note that under these conditions the plant automatically scrams, the water level drops to the top of jet pump l

l elevation (approximately 2/3 of core height), and low pressure injection i

1 l

36 -

I I

s a ,

. . NEDO-31558 systems automatically provide for required core cooling. For non-jet pumps plants, the core is completely uncovered for large recirculat. ion line breaks and cooling is provided by core spray. Note also that for this event boron injection would be of little value, since the boron would very rapidly be diluted in the suppression pool.

For smaller breaks, the NHS can be used along with the RPIS to varify the plant has been shutdown. Analyses of these events have shown that the operatcr actions are not. affected by the loss of NMS as long as the RPIS remains operable. Furthermore, the initial environment ic not harsh and under these conditions neither NMS or RPIS equipment would be expected to fail prior to verification of plant shutdown. Therefore, accident with scram events do not establish design requirements for the NMS.

For Other Occurrences Without Scram, the NMS would be used to monitor e reactor power while control rods are being inserted. These events may cause local environmental conditions that could potentially fail or degrade NMS equipment, but the bulk suppression pool temperature is not significantly impacted, since these events do not isolate from the main condenser. Therefore, most AW S mitigation actions would not be required for these events even if the NMS were to fail and these events do not set design requirements for the NMS.

• For Transients Without Scram, the NMS provides the primary means of neutron flux monitoring and power level indication as AWS mitigation actions required by the EPGs are taken. Other indicatione, are available c to verify NMS indications or to be the primary source of reactivity information if the NMS fails. The importance of the NMS to the operator is dependant upon the severity of the AWS. Once control rods are suf-ficiently inserted, this monitoring is not required. If the plant is required to remain shutdown on liquid boron over long periods, boron sampling and laboratory analysis becomes the primatr reans for reactivity monitoring, with the NHS serving as backup. This i in measurement is a more reliable reactivity variable, since the NMS would not datect dilu-tion when the boron concentration is well below the concentration at which recriticality would occur.

I

- - NEDO-31558 Transients Without Scram do not impose a harsh environment except for plants with unpiped safety valves during high power AWS events which isolate from the main condenser. However, for large AWS events, the lack of all-rods-in indication and the containment response will assure that the operator takes appropriate AWS mitigation actions even if the NMS fails.

For lesser AWS events (when partial control rod insertion occurs or the

^

plant is not isolated from the main condenser) the high setpoint safety valves would open for only a very short duration if at all and the result-ing environmental impact is not harsh. There is, of course, no impact on the environment for the majority of BWRs which have only piped safety /

relief valves.

For these lesser AWS events, the NMS enhances the operator actions, since successful verification that power is below approximately 3% power can avoid various non-routine actions. The lesser AWS events, there-fore, establish design requirements for the NMS. Note, however, that even if the operator takes the most extensive AW S mitigating actions for these less severe AWS events, plant safety would be maintained.

1

N NEDO-31558 5.0 FUNCTIONAL DESIGN CRITERIA FOR POST-ACCIDENT NEUTRON MONITOR _ING 5.1 Scope The purpose of this section is to define and justify altarnate post-accident requirements for the NHS and to compare these requirerantu to the Category I requirements in R.G. 1.97. These criteria are developed as a result of the post-accident operational uses of NMS instrumentation dis-cussed in the previous section. A general evaluation of existing NMS instrumentation to meet this criteria is also included. Note that this is not a complete NMS design criteria specification, since it does not address criteria for startup, normal operation, artociatic trips, or shutdown. The scope of the criteria is limited to post-accident condi-tions.

5.2 Requirements, Bases and Existing Capabilities 5.2.1 Range Alternate Requirement: 1 to 100%

RC 1.97 Requirement: 10 % to 100%

Basis: If successful scram occurs, post-accident neutron monitoring is not meaningful and reactivity control is assured by the control red latching design. The alternate requirement covers the possible AWS conditions from immediately after the scram failure until power has been reduced to below the APRM downscale trip of approximately 3% power. This will allow the monitoring of reactor power as AWS mitigating actions are taken as instructed by the EPGs.

An indication range below 1% is not justified, since neutron flux infor-mation would only confirm that the plant is shutdown currently; it would not ensure reactivity control as reactor temperature decreases. Monitor-ing neutron flux under such a partial shutdewn situation is of relatively low significance to plant safety due to the inherent safety of the BWR design which establishes negative reactivity feedback for control of the

m _ = , _ -

NED0-31558 fission reaction. Furthermore, if the plant is shutdown with liquid bo: con , it is more important to measure boron concentration directly by samplinF reactor water than to measure it indirectly with neutron flux I

indicatica.

Existing Capability: All BWRs meet the alternate criteria with existing APRM equipment.

5.2.2 Accuracy Alternate Requirement: 12% of rated power RG 1.97 Requirement: None Specified Basis: It is not necessary to know the post-accident power with a high degree of accuracy until power has been reduced to around 10% or less.

EPGs'.specify a specific power level (approximately 3%) as an action level in several places and also base boron injection requirements on suppres-sion pool temperature as a function of power in the 2 to 10% range.

During events without a complete scram, an exact value would help the operator in assessing the status of reactivity control. However, the reactivity ef fects of changing RPV pressure, core voids, core injection flow, etc. complicate the operator's ability to accurately determine reactor power by neutron flux measurements. Partial rod insertion events place the greatest demand on NMS accuracy. To support these events, an instrument accuracy of 12% of rated power is judged to be sufficient to allow the operator to make appropriate action decisions.

Although no accuracy requirement is specified by RG 1.97 directly, reference is made to ANS Standard 4.5 which establishes performance requirements Existing Capability: Instrument loop accuracies are highly plant speci-fic. By proper and frequent calibration of the LPRMs. the power range

accuracy level can be met. Calculations at one BWR/6 indicated that the

! APRM loop accuracy is about 2% of scale based on a 1% power supply accuracy. (A plant-specific evaluation would have to be conducted.)

w .c -- _

NEDO-31558 5.2.3 Response Characteristic A'2 ternate Requirement: 5 sec/10% change RG 1.97 Requirement: None specified Basis: The power range monitors should respond within a few seconds of the actual change in fission rate. The alternate requirement is judged to provide operators with sufficiently current information to verify the accomplishment of reactivity control. Although RG 1.97 does not directly specify response characteristics, this requirement has been added to be consistent with the ANS Standard 4.5 performance requirements.

Existing Capabilities: Power range monitors are designed with a response time of I second for a 100% change in flux. This is more than adequate to meet the response characteristic requirement.

5.2.4 Equipment Qualification Alternate Requirement: Operate in AWS Environment RG 1.97 Requirement: RG 1.89 and RG 1.100 Basis: The event analysis in Section 4.0 of this report identifies the limiting events for NMS operation and describes the equipment envircnment for those events where the NHS is important to the operator. AWS events are determined to result in the most limiting environmental conditions dur bg which the NMS operation is needed.

Qualification to design basis environmental standsrds required by RG 1.89 j is not necessary, since the NMS does not need to function to mitigate design basis accident events. Because of its importance to operator actions, the lesser AWS events therefore define an appropriate level of qualification to assure system performance when needed. Qualification standards for the NMS are consequently established on the qualification standards established by the AWS Rule (10CFR50.62). This rule specifies AWS environmental conditions and does not require seismic qualification.

RG 1.100 compliance is therefore not justified for the NHS.

l NEDO-31558 Existing Capability: NMS equipment is typically designed for abnormal environments shown in Table 5-1. These environmental conditions are not expected to be exceeded in the vicinity of NMS equipment for the majority of A' INS events. (A plant-specific evaluation of A'IVS environments in comparison with design specifications is needed to assure system perfor-mance.]

Table 5-1 TYPICAL DESIGN CONDITIONS (Abnormal Operation)

Temp Press Humidity Duration Drywell 135-185 F 0-2 psig 90% 2 hrs Undervessel Reactor Building 104 F 0 .25" vg 90% 100 days Control Room 75 F 0-1" vg 60% Unlimited 5.2.5 Function Time Alternate Requirement: I hour RG 1.97 Requirement: None specified Basis: The function time is tied to the event in which the equipment must survive. Since the lesser ATWS events set the environmental requirements for the NMS, those events also set function time requirements. The key operator actions for those events which relate to power level monitoring are water level reduction and boron injection. These actions are no longer required when the cold shutdown boron weight has been injected to the RPV or control rods sufficient for shutdown are inserted. One hour is judged to be sufficient time for the operator to have successfully com-pleted these actions.

l Existing Capability: NMS equipment has generally been designed for function times in abnormal operating environments which exceed this specification (see Table 5-1). [ A plant-specific evaluation of design I

1

NEDO-31558 specifications and AWS environments is needed to confirm that this specification is set.)

5.2.6 Seismic Qualification Alternate Requirements: Seismic qualification not required RG 1.97 Requirement: Seismically qualify Cat. 1 equipment as important to safety per RG 1.100 and IZEE-344 Basis: The events analysis in Section 4.0 identifies the limiting events for post-accident neutron monitoring. AWS events are determined to set this requirement. The NMS qualification standards are consequently established to be consistent with the AWS Rule (10CFR50.62). This rule specifies AWS environmental conditions and does not require seismic qualification. RG 1.100 compliance is therefore not justified for the NMS.'

Existing Capability: The NMS equipment which provides automatic trip functions have been seismically qualified to assure that the seismic event does not prevent the automatic trip function. The remainder of the NMS equipment has generally not been seismically qualified. Therefore, existing NMS equipment meets or exceeds the alternate criteria.

5.2.7 Redundancy and Separation Alternate Requirement: Redundancy to Assure Reliability RG 1.97 Requirement: Redundant in Division Meeting RG 1.75 Basis Redundant indication of the power range monitors should be provided to assure the operator that the scram function or alternate shutdown measures have been achieved. This criterion is to provide a greater monitoring reliability to the control room operator in the event l one channel is lost. F.e to the capacity to achieve reactivity control without the NMS, and the brief function time when indication is required, separation of these signals is considered desirable, but not essential.

p = -^-= =

NEDO-31558 Existing Capability: The existing NHS meets the alternate criteria.

5.2.8 Power Sources Alternate Requirement: Uninterruptable and Reliable Power Sources RG 1.97 Requirement: Standby Power Source (RG 1.32)

Basis: Power supplies should be reliable and available during most events in order to avoid unnecessary actions in some events such as are described in Section 4.0. They should be from uninterruptable sources in order to monitor neutron flux continuously during any automatic load shed events, but because of the many alternate methods to establish reactor power (see Section 6.0), it is not necessary that Class 1E power be provided.

Existing Capability: The power supplies for NMS equipment :.my vary among i plants. Most utilities power the sensors and displays from the RPS instrument bus. (A plant-specific evaluation it, required to review the power dist:ibution to the NMS including the recorders to verify that the instrument power is not lost during events by load shedding logics or similar schemes.)

1 l

5.2.9 Channel Availability Requirement: Available Prior to Accident RG 1.97 Requirement: Available Prior to Accident Basis: The NMS should be fully available during power operation, to ,

inform the operator of a high flux level when the scram did not occur. No deviation from the RG 1.97 requirement is intended.

\

l Existing Capability: Since power range instrumentation is available while l the plant is at power, existing NHS designs meet this criteria. Addition-l ally, Section 2.6 indicates that the NMS availability is extremely high.

l l

. . . - . , . - - . - _ _ . - - . . - _ _ _ _ . _ _ - _ _--___m-,_ __ _ _ _ .____,---, --

NEDO-31558 5.2.10 Quality Assurance Alternate Requirement: Limited QA Requirements Based on Generic Letter 85-06 RG 1.97 Requirement: Application at Specified Reg. Guides Basis: The NMS should have QA requirements applied consistent with the importance of this instrumentation to verify a safety function. NRC generic letter 85-06, "Quality Assurance Guidance for AWS equipment that is not Safety Related", should be applied to NMS monitoring equipment, since it is consistent with the use of the NMS to support AWS events.

Existing Capability: Much of the NMS equipment is Class 1E, since it provides trip functions to the reactor protection system. The remainder of the equipment is designed, procured, and installed as non-safety related. (Compliance with , Generic Letter 85-06 should be verified on a plant-specific basis.]

5.2.11 Display and Recordina Requirement: Continuous Recording RG 1.97 Requirement: Continuous Recording j Basis: Recording of the NMS signals should be provided for post-accident diagnostic review. No deviation from the RG 1.97 requirement is intended.

I i Existing Capability: Every NHS channel is recorded in existing designs.

Therefore, this requirement is satisfied.

5.2.12 Equipment Identification Requirement: Identify in Accordance with CRDR RG 1.97 Requirement: Identify as Post-Accident Monitors Basis: NMS recorders should be clearly marked to be consistent with results of the detailed control room design review (CRDR). This does not l

l l i

y v-.- ..m-- __._. , _ _ , . _ . , , - , __,m.. _ _ , _ _ - -

NEDO-31558 l

)

deviate from the RG 1.97 intent except to add that integration with the l

CRDR be accomplished to be consistent with NUREG 0737, Supplement I requirements.

Existing Capability: Recorders are normally clearly marked. (This item should be verified on a plant-specific basis.]

5.2.13 Interfaces Alternate Requirement: No Interference with RPS trip functions RG 1.97 Requirement: Isolators to be used for alternate functions Basis: Non-1E portions of the NMS should be separated from the Class 1E portions of the NMS in acco; dance with plant licensing requirements so that they do not interfere with reactor protection system (RPS) functions.

This' alternate requirement is intended to be consistent with the AIVS Rule (10CFR50.62).

Existing Capability: Existing designs fulfill the alternate requirement.

5.2.14 Service, Test and Calibration Requirement: Establish In-Plant Procedures RG 1.97 Requirement: Establish In-Plant Procedures Basis: The NHS should be included in normal maintenance programs estab-lished by the plant staff. The capability to demonstrate recorder operability should be provided in addition to out-of-service alarms if channels fail. The power range accuracy is dependent on calibration of the LPRM signals and heat balances to provide an accurate measurement of average core-wide power. The calibration schedule should be such that the overall loop accuracy requirements are met.

Existing Capability: (This item is to be verified on a plant-specific basis.)

m_ _ . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ . _ . . _ _ _ _ . _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

~

NED0-31558 5.2.15 Human Factors Requirement: Incorporate HFE Principles RG 1.97 Requirement: Incorporate EFE Principles Basis: The NMS should be consistent with good human factors engineering (HFE) practices as established by the plant's control room design review.

No deviation from the RG 1.97 requirement is intended.

Existing Capability: (This item is to be verified on a plant-specific basis.]

5.2.16 Direct Measurement Requirement: Direct measurement of neutron flux RG 1.'97 Requirement: Direct measurement of neutron flux Basis: To accurately monitor power trends the NHS should directly measure neutron flux. No deviation from the RG 1.97 requirement is intended.

Existing Capability: Fission type detectors meet the requirement that detectors should directly monitor the neutron flux.

5.3 Conclusion In general, BWR Neutron Monitoring Systems meet appropriate post-accident design requirements defined by the alternate requirements. Some plant-unique assessment will be required to confirm cocpliance with specific alternate requirements.

l 1

l

~ ___ _

o NEDO-31558 6.0 ALTERNATE OR SUPPORTING INSTRUMENTATION The most direct method of detemining reactor power is through the use of the NMS. NMS can also indicate if the reactor is currently shutdown, though it does not guarantee that the reactor will stay shutdown as conditions change. If the rod position information system (RPIS) indi-cates "all-rods-in" (or some other positions with less than all-rods-in),

then the plant design shutdown margin requirement assures that the reactor is shutdown for all conditions. If RPIS is not available or does not indicate sufficient control rod insertion to assure shutdown, and should direct indication from the HMS become unavailable, alternate indications are employed to ascertain reactor power levels. Inferences can be drawn with respect to reactor power by monitoring other indica-l tions, including the reactor coolant boron concentrations, flux levels from the Traversing In-core Probe (TIP) System, or the status of plant parameters or components which are in someway linked to reactor power. A summary of each of these alternate or supporting methods follows.

6.1 Rod Position Information System (RPIS)

The RPIS is a highly reliable monitoring system which provides individual l rod position information in addition to "full in" and "full out" indica +.-

ing lights. RPIS provides isanediate indication of successful core reac-

{ tivity control. When all control rods can be determined to be inserted to l the "maximum suberitical banked withdrawal position" (MSBWP as defined by the EPCs), the reactor will remain shutdown under all conditions and all l coolant temperatures without liquid boron injection.

l l

If control rod position indication is available, but all rods are not l

inserted to the MSBWP, then other criteria may be used to determine core 1

reactivity such as the existence of the core design basis shutdown margin with the single strongest control rod full-out and all other control rods l full-in, or compliance with the Technical Specification rcquirements governing control rod position and the allowable number of inoperable control rods.

I NEDO-31558

?

If direct control rod position indication is not available, signals from RFIS may nevertheless be providing infomation to the control rod with-drawal/ insert circuitry, to the plant process computer, to various annunciators or status indicating lights, and other logic systems. These signals can be queried to determine if the reactivity function has been achieved.

6.2 Traversing In-Core Probe (TIP) 1 4

1 Although time consuming, neutron flux could be determined with the Tra-versing In-core Probe (TIP) System. The TIP System is normally used to calibrate the LPRMs at power and, when inserted into the reactor, is capable of sensing flux in the imediate vicinity of the permanently installed LPRM fission chambers. From a lack of positive reading a shut-down condition could be inferred.

6.3 Other Plant Parameter Indications of Reactor Power There are many other plant parameters which are linked to reactor power.

Observing their values and trends will give valuable indication of reactor power to the operator.

SRMs and IRMs which are withdrawn will provide ex-core monitor informa-tion. They will not be calibrated to provide an accurate measurement. for those conditions but will indicate reactivity trends of increasing, stable, or decreasing neutron flux.

l l

The main steam safety / relief valve positions can be used to determine the approximate power level. Each valve passes a known steam flow as a frac-tion of rated steam flow. SRVs typically discharge steam at a rate of 6 to 7% of rated steam flow. Thus, if three SRVs are open and reactor pressure is stable, then the reactor is approximately 20% of rated power.

Turbine bypass valve flow and other steam-driven equipment such as HPCI and RCIC would give the operator similar information. SRV position is

[

l redundantly and diversely sensed, including open/close indicators which have been installed in the tailpipes of these valves. (R.G. 1.97

MEDO-31558 requires these position monitors to be Category 2.) Observing RPV water level and pressure (both of which are mo::itored by R.G. 1.97 Category 1 inctrunnents) values and trends as we.ll as the effect of mitigating sctions upon chair control will also indicate power level. For instance, if there ic no indication of a break, RPV pressure is stable. HPCI is opsrating properly, and water level is still decreasing, then it is quite obvious that powSr is well above 3%.

There are various o'.her indicators that are useful for determining whether a reactivit control action as been successful. CLCS status indications, including bortm t.ank level, will indicate that boron injec-tion actions are being accocplished. Sampling RFV water will confirm that bcron has, in fact, reached the vessel. Suppression pool tempera-ture (Category 1) trends and the effectiveness of RHR operation will indicate the rate at which energy is being discharged to the containment.

Similarly, containment pressure (Category 1), and containment tempara-ture, including trends or oscillations of these parameters, are indirect but potentially useful indications for determining whether a reactivity control action has been successful.

These indications of plant parameters prcvide useful information by them-selses or they may be used in conjunction with related plant parameters, l

such as in the performance of a heat balance around the RPV or the primary containment.

i 6.4 Sunsnary In sunsnary, failure of the most direct indication of reactor power does not preclude the ability of the reactor operato- to deterwine reactor power levols. Many alternate indications derived from both component i

status and parameter status are available from which reactor power may be inferred. Some alternate indications may require more than one input to determine reactor power. However, based on the multiple inputs available to the cperator, sufficient information should be availabla upon wh uh to j base operational decisions ard to conclude that reactivity control hau been accoerplished.

l

[

y NEDO-31558 7.0 BWROG CONCLUSIONS The BWROG recognizes the need to identify post-accident r.,onitoring re-quirements for BWR reactivity control instrumentation. It was determined that post-accident neutron monitoring, while useful to the operator, is not essential for any event to assure post-accident plant safety is main-tained. It was also concluded that for BWRs the Rod Position Indication System (RPIS) provides the primary verification for determining plant shutdown. However, based on the intent of R.G. 1.97 to provide effective control room monitoring of post-accident plant conditions, specific design criteria for post-accident neutron monitoring capability have been estab-lished. The proposed criteria have been compared to the RG 1.97 requirements and deviations are justified.

Af ter evaluating the existing NMS equipment against the proposed criteria, j it was' concluded (subject to certain plant-unique confirmations) that the existing NMS design is generally adequate for every postulated event.

Same plant-specific evaluations may be required to confirm adherence with certain requirements. The BWROG NMS Committee believes that the proposed functionel criteria represent an acceptable alternate to the Category 1 requirement specified in RG 1.97. While the NMS would be useful to the f opuator under certain scenarios, a fully qualified 1E NMS for post-accident monitoring is not appropriate or justified.

1 i

l i

l l

1 l

• NEDO-31558 1

8.0 REFERENCES

(1) APED 5706, "In-core Neutron Monitoring System for General Electric '

Boiling Water Reactors", APED-5706, April 1969, General Electric Company.

(2) "Technical Specification Improvement Analyses for BWR Reactor Protec-tion System". NEDC-30815P, May 1985. General Electric Company.

Revision 4", NEDO-31331, March (3) "Emergency Procedure Guidelines, 1987, General Electric Company (4) Letter, C. T. Young to J. S. Post, "Dryvell Pressure and Temperature "

Response to a LOCA", CTY8727, December 8, 1987.

(5) "Lessons from the Chernobyl Accident for the BWR", GE, September 25, 1986.

l

~

l NEDO-31558  ;

1 l

l 9.0 LIST OF ACRONYMS AND ABBREVIATIONS 1 ADS Automatic Depressurization System ARI Alternate Rod Insertion APRM Average Power Range Monitor ATWS Anticipated Transient Without Scram -

BWR Boiling Water Reactor BWROG Boiling Water Ranctor Owners' Group CRD Control Rod Drive CRDR Control Room Design Review ECCS Emergency Core Cooling System EOP Emergency Operating Procedure EPG Emergency Procedure Guidelines GE General Elsctric HFE Human Factors Engineering INPO Institute of Nuclear Power Operation IRM Intermediate Range Monitor LCO Limiting Condition for Operation LER Licensing Event Report LTR Licensing Topical Report LOCA Loss of Coolant Accident LPRM ,

Local Power Range Monitor MSBWP Maximum Subcritical Banked Withdrawal Position MSIV Main Steam Isolation Valve NMS Neutron Monitoring Systam NRC Nuclear Regulatory Commission PWR Pressurized Water Reactor QA Quality Assurance RWCU Reactor Water Cleanup RG Regulatory Guide REM Rod Block Monitor Reactor Pressure Vessel RPV RPIS Rod Position Indication System RPS Reactor Protection System SRM Sourcs Rangs Monitor SRV Safety Relief Valve SLCS Standby Liquid Control Systan TIP Traversing In-Core Probe

.