ML20196D253

10CFR50.59 SER of New Reactor Instrumentation & Control Sys at Armed Forces Radiobiology Research Inst

ML20196D253
Person / Time
Site:	Armed Forces Radiobiology Research Institute
Issue date:	05/11/1988
From:	Hodgdon K, Maria Moore, Munno A ARMED FORCES RADIOBIOLOGICAL RESEARCH INSTITUTE
To:
Shared Package
ML20196D251	List: ML20196D244 ML20196D253 ML20196D262 ML20196D273 ML20196D282
References
NUDOCS 8812090008
Download: ML20196D253 (84)

Text

m.

1, N 10 CFR 50.59 SAFETY EVALUATION REPORT OF THE NEW REACTOR INSTRUMENTATION AND CONTROL SYSTEM AT THE ARMED FORCES RADIOBIOLOGY RESEARCH INSTITUTE 11 MAY 1988

/

Mark Moore Ken Hodadon Angela Munno es1209000s 880705 '

PDR ADOCK 03000170 FDC p

T s ABSTRACT

)

This report describes changes to the reactor facility at the Armed Forces Radiobiology Research Institute (AFRRI) in Bethesda, Maryland. This Safety Evaluation Report (SER) meets the requiremonts of Title 10, Code of Federal Regulations, Part 50.59 (10 CFR 50.59), and provides the basis for the conclusion that the changes to the facility involve no unreviewed safety questions and, in fact, are improvements in the facility design at AFRRI. In order to accomplish these changes, the Facility Safety Analysis Report (SAR) must be modified. The body of this report contains a description and safety analysis of the SAR changes. Excerpts from the SAR and the proposed changes are included as appendices.

Note: Under 10 CFR 50.59, a licensee may make changes to its facility provided that no changes are made to the Technical Specifications, and that there are no unreviewed safety questions. The conditions for unreviewed safety questions are outlined in 10 CFR 10.59.a.2, and are summarized below:

If the affected equipment is related to safety:

1. The probability of occurrence or the consequences of an accident or equipment malfunction shall not be increased.

ii. The possibility for an accident or malfunction of a different type than previously evaluated in the SAR shall not exist.

111. The margin of safety as defined in the Basis for any Technical Specification shall not be reduced.

l 1

R

f 5 TABLE OF CONTENTS l

I. Abstract It. Table of Contents III. Introduction IV. Facility Modifications Safety Evaluation A. Overview B. Reactor Safety System Descriptions

1. High Flux Safety Channels One and Two

2. Fuel Temperature Safety Channels One and Two

3. SCRAM Systems

4. Single Failure Criteria Analysis

5. TRIGA Reactor Safety System Failure Analyr C. Peactor Operational Instrumentation System P .,

1. Reactor Operational Channels

a. Multirange Linear Channel

b. Wide Range Log Channel

2. Reactor Interlocks (Rod Withdrawal Prevents)

3. Servo Controller

4. Rod Drives D. Reactor Modes of Operation E. Comparison cf the Current and the New Reactor Safety and Control Systems

1. Reactor Safety Systems

2. Reactor Operational Control and Monitoring Systems

3. Standard Control Rod Drives F. Safety Evaluation Conclusion APPENDICES: A. Listing of Corrections to be made to the SAR B. Proposed SAR Changes for the Previously Discussea Facility Modification Safety Analyses C. AFRRI TRIGA Console (Safety) Scram System Single Failure Criteria Analysis D. Scram Circuit Safety Analysis for the University of Texas TRIGA Reactor E. Analysis of 5 Doller Ramp Insertion Over a 2 Second Interval in AFRRI TRIGA Reactor

f .

INTRODUCTION Prasent conditionn at 'he Armed Forces Radiobiology Research Institute (AFRRI) require that modifications be made to upgrade the reactor fce'lity. The changes being made to the Facility Safety Analysis Report (SAh, include:

The installation of a new Reactor Instrumentation and Control System and the installation of three new stepping-motor standard control rod drives.

AFRRI's current reactor instrumentation system is a 1972 vintage unit (horeafter, refered to as the current (present), old, or 1972 console) ocivaged from the 1977 decommissioning of the Diamond Ordnance Radiation Faciliev and was installed at AFRRI in 1978. The design life of this unit '

in 10 > ears. Because this console is now 16 years old, maintenance down tire has increased and is expected to continue to increase over the next five years.

The console's functional utility is now continuously diminishing due to the progressive obsolescence of many of its electronic components.

Although the obsolescence of these components does not effect the nuclear cafety of the system, it is a problem operationally. Many of these olectronic components are no longer manufactured; consequently, direct roplacements are unobtainable. Redesign of selected circuits to use currently available electronic components would require, in each case, a safety revieu by the reactor safety committee and possible review and approval by the NRC.

Estimated hardware costs to entirely redesign, replace, and upgrade AFRRI's existing console exceed the cost of buying a new instrumentation sistem.

Failure analyses of current console components indicate that, under normal circumstances, AFRRI has sufficient spare parts to sustain its present operational capability for less than 2 years. Then it is expected that AFRRI would become involved in serious down time problems.

AFRRI's control rod drive system also suffers from the same progressive obsolescence, increasing maintenance down time, and spare parts unavailability as the control console.

Acquiring a new state-of-the-art console and control rod drive system using integrated circuits and microprocessor technology will resolve these i

problems and provide for reliable operation of the AFRRI Reactor Facility through the year 2000.

r This new state-of-the-art microprocessor-based instrumentation and control cystem will replace the current control console while improving the existing operational capabilities and safety characteristics. The new syctem will increase reactor operational performance through increased productivity, improved efficiency, increased relisbility, improved

. 1 experiment reproducibility, and increased maintainability. productivity will be improved through increased reactor operating time due to the system performing automatic self-checks of daily instrumentation checkouts, and through decreased operntor training time - operators will become proficient in a much shorter length of time. The new system will increase efficiency in reactor operators' time by automatically lcaging reactor data or allowing keyboard entry of nonoperational but essential information pertinent to reactor operations. Experiment reproducibility will be improved through increased pulse accuracy and repeatability and through improved Auto Mode capabilities. In pulse Mode, the system will provide prompt waveform analysis: peak power, energy, half power width, reactivity insertion, minimum period, and peak fuel temperature are measured and calculated automatically and reported promptly to the operator in either graphic or nongraphic mode. In Automatic Mode, the operator will select the desired power level, run duration (SCHAM time),

and which rods will be servoed, then position the banked rods, select the Automatic Mode and let the Reactor Control System perform the run. The new system will increase maintainability through state-of-the-art system maintenance design and layout, line replaceable units and on-line system diagnostics. System safety will also be improved through the performance of periodic self-diagnostics that determine if the unit is in a safe operational status. These diagnostics will display error messages reporting failures to the operator and will automatically place the reactor in a safe neutronic configuration. Additionally, the system will have improved Electromagnetic Interference (EMI) protection through shielding, optical isolation, and digitizing data at near core locations, and will reduce cabling requirements by collecting data in the reactor room and then routing that data to the Control Console Computer via serial data trunks.

The Code of Federal Regulations (Title 10, part 50.59) requires that modification of a portion of a licensed facility as described in the facility SAR be documented with a written safety evaluation. Such documentation provides the basis for determining that the change does not involve an unreviewed safety question. An unreviewed safety question according to 10 CFR 50.59 involves (1) the increase of probability of occurrence or the increase of consequences of an accident or malfunction of equipment important to safety compared to that situation previously evaluated in the SAR, or (2) the possibility for an accident or malfunction of a different type than previously analyzed in the SAR, or (3) the reduction in margin of safety as defined in the SAR.

Based on the analyses in this Technical Report, it has been determined that the proposed changes to the Reactor Facility do not involve any unreviewed saf?ty questions and will actually improve the facility design Lt AFRRI.

This technical report describes changes and modifications made to th; AFRRI reactor facility as depicted in the facility's SAR. These changes have been reviewed by the Reactor Facility Director and found to contain no unreviewed safety questions. This report is submitted to the Reactor <

1 .s

\T  % ^

l cnd.Radin' .cility Safety Committee (RRFSC) for their concurrence that cor.ditir of J CFR 50.59 are met. These conditions are that no ur.re v i e - cd sa 3ty questions are present and that the changes made do not incren .e the robability of occurrence or the consequences of an accident or 1s ifunctica.

The proposed modifications require minor changes to the SAR. The body of thjs report contains a description and safety analysis of the 10 CFR 50.59 SAR changes. Appendix A contains a specific page/section index of all of tho SAR changes. Appendix B contains excerpts from the SAR, for each of these 10 CFR 50.59 modifications.

The new Digital Reactor Instrumentation and Control System has been daoigned to be safer than the present AFRRI control system which has been ovaluated in the AFRRI TRIGA Mark F Reactor SAR. This has been accomplished by continuing to hardwire all safety circuits in a redundant, fail safe configuration. These safety circuits are completely independent of the data acquisition computer (DAC) and the control system computer (CSC). This means that if either or both computers were to fail, the failure cannot prevent the reactor from scramming. On the other hand, critical functions of the computers are monitored by "watch-dog-timers".

If the computers fail to update the timers in a predetermined fashion, the redundant, hardwired watch-dog-timers will scram the reactor.

An a result, the new Digital Reactor Instrumentation and Control System hao equal or greater safety built-in than the present AFRRI control system, which has SAR approval.

. 1 FACILIll MODIFICATIONS SAFETY EVALUATION The installation of the new Reactor Instrumentation and Control System at the AFRRI 'RIGA Mark'F reactor facility.will provide equal or greater operational and safety capabilities with a higher degree of reliability thsn the current instrumentation.

OVERVIEW The basic elements of the new Reactor Instrumentation and Control System (see Figure 1) will consist of a Control Console, a Data Acquisition and Control Unit (DAC), two independert Power Monitor and Safety Systems, an Operational Channel, and a Pulse Channel. This system was design and built in accordance with ANSI /ANS-15.15-1978 "Criteria For The Reactor Safety Systemo of Research Reactors".

The Control Console will be a desk-type unit located in the AFRRI Reactor Control Room. Operators will conduct reactor operations using a set of control switches and a keyboard located on the console, and the operators will receive feedback information through a high-resolution color monitor, a status monitor, indicators, and annunciators.

The heart of the control console will be the Control System Computer (CSC). Operators will adjust the rod positions by issuing commands to the ,

CSC, which will transmit these commands to the DAC. The DAC will reissue the commands to the drive mechanisms. During reactor operations, the CSC will receive raw data from the DAC, process this data, and present the data in meaningful engineering units and graphic displays on a number of peripheral systems.

The CSC will operate two color CRT monitors. A high-resolution color graphics CRT (Reactor Control CRT) will provide the operator with a real-time graphic display of the reactor status. This CRT will display the {

important operational parameters using bar graphs and digital readouts and will alert the operator to any abnormal or dangerous conditions. A Reactor Status CRT will display pertinent diagnostic messages, reactor status, and facility status information.

The CSC will also interface with a near-letter-quality printer, allowing the logging of reactor information as required by the reactor operator.

Historical data will be saved in the CSC's internal memory and on command from the operator be replayed, printed, or transferred to removable disks for permanent storage. This will provide the capability to maintain records of pertinent reactor statistics and to replay reactor operational records for training and analysis. In addition, the CSC will operate a color graphicu printer capable of printing steady-state and pulse mode data as well as producing point-line plots. Finally, the CSC will

CE ACTC3 HALL l CONICOt. COOne 8"d'C8'*

......c........ i

! . ..... c . 00000000 c....... .

.........c.... i

. < , e ~ o

_ t '

,,. . i Fue1 Tesnp 8I tech Sp d C.s._ semen h Is mse.r sea f Fue1 Tesap 32 _. ft hde Ases.hs l wi 9:n rtux s1 - F **8 T***. t T.. )

Higla Flux BJ  %

y ce tans a ao _ c, ._ ,,,,,

wo e., r.

1s e m 2 m hE

_ , , . *==r

.,,, -r _

- [ c re. actor __,

m i I -

S.afety sy:. tem l e. }

• h Sc r.ams #

f I ,u.5 T.m S.I.sy G.s ss go.6 2 m l  % P s.r Chu.s.u.I 88 6 2 ch ,n -

e sur

.i ,

, , - P cm s , I

- . - - - _ _ I I a.a , o-.* == 2 I 7,- n*.*","

• I2 4 ac aos-saae ' eas . l " 9

""*" ~ m ms ae Y '**

% 7 Th="r i A O c , ,,,, w t n=., e ,

f I t.a re er

.r ee

_ E=='s I T. 80'un se i h ei, o , ,

• D===

g c.=d u w I FIGUllE #1

c. = w g c AFRRI TRIGA MARK F l c..

l ro.s== CONTROL SYSTEM l Ca***

BLOCK DIAGRAM i

um

.  ?

interface to real-time recorders of reactor power and fuel temperature.

The DAC will be located in the AFRRI Reactor Room adjacent to the reactor and will provide high-speed data acquisition and control capability. The DAC will monitor the two independent Power Monitor and Safety Systems, the Operational Channel, the Pulse Channel, the fuel temperature, water level and temperature, and control rod positions. The DAC will, on command from the CSC, reissue the commands to raise and lower the control rods or scram the reactor. The DAC will communicate with the CSC via serial data trunks. The secondary trunk will serve as a backup should the primary trunk fail. These serial data trunks will drastically reduce the wiring requirements between the Reactor Room and the Control Console.

The Power Monitor and Safety Systems will monitor the power from 1% to 120% of full power (1.0 megawatts) and shut the reactor down (SCRAM) in the event of an overpower condition. The Operational Channel will monitor the power from source level to full power and the rate of power change (from -30 to +3 second period) in the steady state modes.

The Pulse Channel will monitor the power level up to 5000 megawatts in the pulse mode. This channel will use an ion chamber, a photo diode detector, or some other acceptable pulse monitoring detector. The DAC will collect information from the pulse channel and transmit the data to the CSC for processing.

The control console will have 8 Hardwired (Analog) LED Bargraph indicators which are located on the left side of the console. These hardwired channels include the two High Flux Safety Channels, the two Fuel Temperature Safety Channels, the Operational Wide-Range Log Channel, the Period Channel, and the Pulse NV and NVT Channels. Located below these analog bargraphs are the Operational Multirange Linear Channel and Fuel Temperature Channel strip chart recorders. These items are all hardwired ,

and are completely independent of the CSC and DAC computers, and therefore, will provide informati

• to the reactor operator at all times, even should the CSC and DAC computers fail.

AFRRI is also replacing its three 1960 vintage Standard Control Rod Drives with three new Standard Control Rod Drives using pulsed motor drive systems. These stepping motors operate on phase-switched de power. These motors drive a pinion gear (connected to the Magnet Draw Tube) and a 10-turn positive feedback potentiometer via a chain and pulley gear mechanism. Except for the drive motors, the new control ro1 drive  ;

assemblies will be the same as the current control rod drive assemblies.

REACTOR SAFETY SYSTEM DESCRIPTIONS l

HIGH FLUX SAFETY CHANNELS ONE AND TWO i

% s

f 4 High flux safety channels one and two report the reactor power level as cocsured by two ion chambers and a pulse detector placed above the core in tho neutron field. Each safet) channel is a part of one multifunction NP-1000 neutron power channel. For safety reasons (simple redundancy) two independent NP-1000's are used e.nd they operate identically during steady otste operation. Each channel consists of an ion chamber placed above the core and the associated NP-1000 electronics. The steady state power level 10 displayed on two separate LED bargraph indicators and on the reactor control CRT.

During pulse operation, high flux safety channel one is shunted and the consor for high flux safety channel two is switched to a third, independent pulse detector placed above the core. High flux safety chonnel two measures the peak power level achieved during the pulse (NV) and the total integrated power produced by the pulse (NVT) and is therefore specified as an NPP-1000 instead of an NP-1000. However, it ohould be noted that both safety channels operate with identical NP-1000 circuitry. Calibration of the NP-1000's is done automatically during the Daily Startup Checklist when the operator initiates the "pre-checks" by motivation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operator via the reactor status CRT.

The high flux safety channels (NP-1000's) form part of the scram logic circuitry. When the steady state reactor power level, as measured by either high flux safety channel, reaches the maximum power level specified in the technical specifications, a bistable trip circuit is activated which breaks the scram logic circuit, causing an immediate reactor scram.

Similarly, when the reactor power level during pulse operation, as measured by high flux safety channel two, reaches the maximum pulse power level specified in the technical specifications, a bistable trip circuit in activated which cauoes an immediate reactor scram.

FUEL TEMPERATURE SAFETY CHANNELS ONE AND TWO I Fuel temperature safety channels one and two are independent of one another but operate in identical manners (simple redundancy). One thermocouple from each of the two instrumented fuel elements, one in the B-ring and one in the C-ring, provide inputs to fuel temperature safety channels one and two, respectively. The two fuel temperature signals are amplified and displayed on two separate bargraph indicators located on the (

recctor console and on the reactor control CRT. The fuel temperature safety channels have internal compensation for the chromel-alumel thermocouples and high noise rejection. Calibration of the Fuel  :

Temperature Channels i s done automatically during the Daily Startup Chocklist ehen the reactor operator initiates the "pre-checks" by activation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operatar via the reactor status CRT.

I 4 . - - - - - . - - - - -, - - - - --

. 1 In addition to providing information to the reactor operator on fuel temperature, the fuel temperature safety channels also form part of the scram logic circuitry. When the fuel temperature, as measured by either fuel temperature safety channel, reaches the maximum allowable fuel temperature specified in the technical specifications, a bistable trip circuit is activated which breaks the scram logic circuit, causing an immediate reactor scram. The operational fuel temperature limit is usually set below the technical specifications limit to assure an adequate degree of reactor protection.

The combination of the two independent High Flux Safety Channels and the two independent Fuel Temperature Safety Channels provides both simple redundancy and functional redundancy in terms of insuring that the Reactor Safety Limit as specified in the Technical Specifications is never reached.

SCRAM SYSTEMS The scram logic circuitry (see Figure 2) assures that a set of reactor core and operational conditions must be satisfied for reactor operation to occur or continue in accordance with the technical specifications. The scram logic circuitry involves a set of open-on-failure logic relay switches in series: any scram signal or component failure in the scram logie, therefore, results in a loss of standard control rod magnet current and a loss of air to the transient rod cylinder, resulting in a reactor scram. The time between activation of the scram logic and the total insertion of the control rods is limited by the technical specifications to assure the safety of the reactor and the fuel elements for the range of anticipated transients for the AFRRI TRIGA reactor. The scram logic circuitry causes an automatic reactor scram under the following circumstances:

- The steady state timer causes a reactor scram after a given elapsed time, as set on the timer, when utilized during steady state power operations.

- The pulse timer causes a reactor scram after a given elapsed time, as set on the timer (in accordance with the limit specified in the technical specifications), during pulse power operations.

- The manual scram button located on the reactor console, allows the Reactor Operator to manually scram the reactor.

- Movement of the console key to the OFF position causes a reactor scram.

- The reactor tank shielding doors in any position other than fully open or fully closed will cause a reactor scram (this is part of the facility interlock system).

I

I d

FIGURE #2: AFRRI REACTOR SCRAMS l

Steady State Timer l

l l

Pvt.. md. Ts r Safety #1 110I ,' Meaual Scram Ser i

Migli Flux .

- 88Y*" -

ndividual Rod Scram Safety #2l 1101 ' Imse of Fool Water I4wel Higli Flux _

gaat j

Fuel Temp #1 l s N

-((ossofACPower

) 600* J marent e

{c g. 4,7 Fuel Temy #2 ] 8 AIY {

600* '

, Ned Doors Bettfeen J .

{0penandClosed

. 88PPly

! Imes of NV , Emergency Stop Safety Giannel 1_ Console and Exposure Room Iess of HV 7 s

J l safety diennel 2] .' CSC Watchdog Scrams DAC Watchdog Scrams e

t )

1 Activation of any of the emergency stop buttons in either exposure room or on the console causes a reactor scram.

- A loss of AC power to the reactor causes a reactor scram.

- High flox safety channel one causes a reactor scram at a reactor power level specified in the technical specifications for steady state modes of operation. This may be operationally set more conservative thar. the technical specifications limit.

- High flux safety channel two causes a reactor scram at a reactor power level specified in the technical specifications for steady state modes of operation. This may be operationally set more conservative than the technical specifications limit.

- A loss of high voltage to either of the detectors for high flux safety channels one and two causes a reactor scram.

- Fuel temperature safety channels one and two will each initiate a reactor scram if the fuel temperature, as measured independently by either channel, reaches 600*C (technical specification limit). This assures that the AFRRI safety limit (core temperature) of 1,000* C for AFRRI stainless steel clad cylindrical TRIGA fuel elements, as stated in the AFRRI technical specifications, is never approached or exceeded.

The actual operational limit for the fuel temperature safety channels may be set lower than the technical specifications limit of 600* C.

- A loss of reactor pool water which leaves less than or equal to 14 feet of pool water above the core (technical specifications limit) causes a reactor scram. The actual operational limits for the pool water level may be set more conservatively than the technical specifications limit.

- One watchdog timer on the data acquisition computer and another one on the control system computer are required to be reset periodically by a program routine as a safeguard against computer component failures either in hardware or software. If the required response is not received within a definite time period, redundant normally open (fail safe) contacts interrupt the scram loop dropping the rods and shutting down the reactor. These watchdog timers are additional safety devices.

SINGLE FAILURE CRITERIA ANALYSIS ANSI /ANS STD 15.15-1978 "Criteria for Reactor Safety Systems of Research Reactors" specifies that a Single Failure Criteria Analysis be performed on all non-redundant reactor safety systems. This analysis was performed by General Atomics for the new AFRRI TRIGA Reactor Instrumentation and Control System and is enclosed as Appendix C "AFRRI TRIGA Console (Safety)

Scram System Single Failure Criteria Analysis." This analysia

f .

dsmonstrates that, except for the Reactor Key Switch (t*ich does not parform a safety function except to prevent unauthorized startup), the Maan Time Between Failure of any single element of the new instrumentation i ceram system greatly exceeds (the MTBF's range from 23 years to 125 yearas .

the design life of the new console (15 years). This analysin was l parformed for'any single failure of the reactor safety system.

TRIGA REACTOR SAFETY SYSTEM FAILURE ANALYSIS Although not required, a Failure Analyaxs was performed by the University of Texas and General Atomics of the ;w Reactor Instrumentation and Control System. This analysis is enclosed as Appendix D "TRIGA - ICS Rsactor Safety System Failure Analysis". This analysis looked at the probability of the Reactor Safety System failing to perform its intended function: no scram occurs during a scram situation. In order for this to occur there would need to be simultaneous failures of '.wo or more components of the Reactor Safety System. This analysis demonetrates that the Probability of Failure of the new Reactor Safety System is 2X10- 81 failures / hour, or a mean time between failures of SX10* years.

REACTOR OPERATIONAL INSTRUMENTATION SYSTEM DESCRIPTIONS REACTOR OPERATIONAL CHANNELS Multirange Linear Channel The mulitrange linear channel is one of three channels included in the NM-1000.

The multirange linear channel reports reactor power from source level

(-10 8 Wt (thermal watts)] to full steady state power (1 MWt). The output of a principle fission detector serves as the channel input. The channel consists of two circuit sections: the count rate circuit, and the ccmpbelling circuit. At power levels less than i kilowatt (t) the count rate circuit is utilized. The count rate circuit generates an output voltage proportional to the number of neutron genrated pulses or counts received from the fission detector. Hence, the output is proportional to the neutron population and the reactor power level. For steady state power levels at or above 1 kilowatt (t) the campbelling circuit is utilized. The campbelling circuit generates an output voltage proportional to the reactor power level by a verified technique of noise envelope amplitude detection and measurement known as campbelling. The NM-1000's micro-processor converts the signal from these circuits into 10 linear power ranges. This feature provides for a more precise reading of linear power level over the entire range of reactor power.

. t The NM-1000's multirange linear channel output is displayed in two formats. These are a bargraph indicator on the Reactor Control CRT display and a stelp chart recorder located on the left-hand vertical panel on the control console. As a performance check, the microprocessor automatically tests the channel for campbell circuit operability while the reactor is operating in the count rate range and vice verse when the reactor is in the campbelling range. The multirange ranging function is auto-ranged via the NM-1000 control system computer.

Wide Range Log Channel The wide-range log channel like the multirange linear measures reactor power from source level ( 8 Wt) to full steady state power (1MWt). It is a digital version of the General Atomics 10-decade log power system to cover the reactor power range and provide a period signal. For the log power function, the chamber signal from startup (pulse counting) range through the campbelling (root mean square (RMS) signal processing] range covers in excess of 10-decades of power level. The self-contained microprocessor combines these signals and derives the power rate of change (period) through the full range of power.

The wide-range log channel forms part of the rod withdrawal prevent (RWp) interlock system. The channel activates variable set point bistable trips in the rod withdrawal prevent interlock system if source level neutrons

( 10-8 Wt) are not present, if the reactor power level is above 1 KWt when switched to pulse mode, if a steady state power increase has a period of 3 seconds or faster during certain steady state modes, or if high voltage is not supplied to the fission detector.

The wide-range log and period output are displayed on bargraph indicators which are both hardwired and on the Reactor Control CRT. The NM-1000's microprocessor, similar to the multirange linear channel, automatically tests the wide-range log channel for upper and lower decade operability.

REACTOR INTERLOCKS (ROD WITHDRAWAL PREVENTS)

A Rod Uithdrawal Prevent (RWp) interlock stops any upward motion of the standard control rods and prevents air from being supplied to the transient control rod unless specified operating conditions are met. An RWP interlock, however, does not prevent a control rod from being lowered or scrammed. Therefore, any RWP interlock prevents any further positive reactivity from being inserted into the core until specific conditions are satisfied.

The system of RWP interlocks prevents c",ntrol rod withdrawals under the following circumstances:

- RWP prevents air from being applied to the transient rod unless the reactor power level is under i KWt.

f n RWP prevents an," control rod wi.hdrawal unless, as a minimum, source level neutrons t 8 Wt) are present.

- RWP prevents any further control rod withdrawal unless the power level is changing on a 3-second or longer period as measured by the wide-range log channel during certain steady state cperations.

- RWP prevents any control rod withdrawal unless high voltage is being cupplied to the fission detector for the multirange linear and wide-range log channels.

- RWP prevents any control rod withdrawal unless the bulk pool v. t e r temperature is less than 60*C (Technical Specification Limist.

SERVO CONTROLLER The Servo Controller, in the Automatic and Square Wave ?todes, controls the roactor power automatically to within +/-1% of the demand power level colected by the operator. Thumbuheel switches are provided on the Mode Control panel for the desired power selection. The Servo Controller will track and stabilize reactor power through the utilization of a PID

, algorithm (Proportional, Integral, Derivative). The console will be capable of servoing any combination of the three standard control rods (REG, SAFE, or SHIM). It will not, however, servo the Transient Rod in any mode. The operator will be able f.o select which-combination of rods will be servoed via a Seavoed Rod Selector Switch located on the Mode Control Panel of the new control console. The Servo Controller system utilizes the latest digital computer technology coupled with extensively developed software. The current console uses an analog computer to servo the rods while the new console uses a digital computer to servo the rods.

Reactor flux level and change is accurately and rapidly measured by an analog / digital input from the Operational (fission) Channel. The PID algorithm in the DAC then responds to this input as compared to the operator set Demand Power Level Setting through the servoed control rods which are powered by precise translator / stepping motor drives. The (operator selected) drive (s) will be driven up or down automatically to control the power level to within +/-1% of the Demand Power Level Setting.

The new console Servo Controller can drive all three standard control rods simultaneously (- $ 5. 50 ) in the Automatic and Square Wave Modes versus the old console which can servo the Transient and the REG rods ( $5.50) sleultaneously in the Square Wave Mode and which servoed the REG rod in the AutoOatic Mode; by technical specifications the maximum excess recctivity above cold critical is $5.00. A Ramp Accident Analysis was performed to insure that a runaway drive situation involving a two second full-insertion (this is faster than the maximum drive rate of the new drives) of all three standard control rod drives would not lead to an

. i event. This analysis was performed by General Atomics under contract ^to AFRRI and is enclosed as Appendix E "Analysis of a Five Dollar Ramp Insertion Over a Two Second Interval in AFRRI TRIGA Peactor". This analysis demonstrates that the consequences of this accident scenario are trivial. The peak power level attained is 330MW and the maximum fuel temperature attained is 330'C. The AFRRI TRIGA Reactor routinely pulses to peak powers of up to 3300MW and the normal 1 MW steady state fuel temperature is approximately 420'C. This analysis demonstrates that there are no unreviewed safety questions.

ROD DRIVES The rod drive mechanisms for each of the new Standard Control Rod Drives is an electric stepping-motor-actuated linear drive equipped with a magnetic coupler and a positive feedback potentiometer. The purpose of each of the rod drive mechanisms is to position the reactor control rod elements.

General Ope,ra tional Description A stepping motor drives a pinion gear and a 10-turn potentiometer via a chain and pulley gear mechanism. The potentiometer is used to provide rod position information. The pinion gear engages a rack attached to the magnet draw tube. An electromagnet, attached to the lower end of the draw tube, engages an iron armature. The armature is screwed and pinned into the upper end of a connecting rod that terminates at its lower end in the control rod.

i When the stepping motor is energized (via the rod control Up/DOWN switch on the operator's console), the pinion gear shaft rotates, thus raising the magnet draw tube.

> If the electromagnet is energized, the armature and i

the connecting rod will raise with the draw tube so that the control rod -

is withdrawn from the reactor core. In the event of a reactor scram, the magnet is de-energized and the armature will be released. The connecting rod, the piston, and the control rod will then drop, thus reinserting the

) control rod into the core.

Stepping motors operate on phase-switched de power. The motor shaft advances 200 steps per revolution (1.8 des per step). Since current is maintained on the motor windings when the motor is not being stepped, a high holding torque is maintained.

The torque vs speed characteristic of a stepping motor ir. greatly dependent on the drive circuit used to step the motor. To optimize the j

torque characteristic vs motor frame size, a Translator Module was I celected to drive the stepping motor. This combination of stepping motor cnd translator module produces the optimum torque at the operating speeds  !

of the control rod drives. '

(

1

I t . \

l 4

i REACTOR MODES OF OPERATION i l

There are four standard operating modes: manual, automatic, square wave, cnd pulse,  ;

j The manual and automatic modes apply to the steady-state reactor condition; the square-wave and pulse modes are the conditions implied by their names and require a transient (pulse) rod drive.  ;

The manual and automatic reactor control modes are used for reactor I oparation from source level to 100% power. These two modes are used for nanual reactor start up, change in power level, and steady-state operation. The square-wave operation allows the power level to be raised quickly to a desired power level. The pulse acdc generates high-power lovels for very short periods of time.

Manual rod control is accomplished through the use of push-buttons on the rod control panel. The top row of push-buttons (magnet) is used to Jnterrupt the current to the rod drive magnets. If the rod is scrammed and the drive is above the down limit, the rod will fall back into the core and the magnet will automatically drive to the down limit, where it cgoin cor .c t s the armature.

The middle row of push-buttons (up) and the bottom row (down) are used to pocition the control rods. Depressing these push-buttons causes the control rods to move in the direction indicated. Several interlocks prevent the movement of the rods in the up direction under conditions such ac the following:

1. Scrams not reset.

2. Magnet not coupled to armature.

3. Source level below minimum count.

4. Two UP switches depressed at the same time.

5. Mode switch in the pulse position.

6. Mode switch in automatic position (servoed rods only).

7. Period less than 3 seconds.

There is no interlock inhibiting the DOWN direction of the cor. trol rods except in the case of the servoed rods while in the AUTOMATIC mode. In all cases, however, the manual so am of any rod will result in the full incertion of the rod into the core.

Automatic (servo) power control caa be obtained by switching from manual oparation to automatic operation via operstor activation of the Auto Mode Switch on the control console's Mode Control Paael. All the inotrumentation, safety, and interlock circuitry described above applies and is in operation in this mode. However, the telected servoed rods are now controlled automatically in response to a power level and period cignal. The reactor power level is compared with the demand level set by

.) i i

the operator and is used to bring the reactor power to the demand level onl a fixed preset period. The purpose of this feature is to automatically maintain the preset power level during long-term power runs. Options are available to the operator to maintain power by movement of a single rod or by bank operation of selected rods. The rods to be servoed are selected by the operator via the Servoed Rod Selector Switch on the control console's Mode Control panel.

In a square-wave operation, the reactor is first brought to a critical condition below 1 KW, leaving the transient rod partially in the core.

All of the steady-state instrumentation is in operation. The transient rod is ejected from the core by means of the transient rod FIRE push-button. When the power level reaches the demand level, it is maintained in the same manner as in the automatic mode.

Reactor control in the pulsing mode consists of establishing criticality at a "ux level below 1 KW in the steady-state mode. This is accomplished by tL. ase of the motor-driven control rods, leaving *he transient rod either fully or partially inserted. The mode selector switch is then depressed. The Transient Rod Fire switch automatically connects the pulsing chamber to monitor and record peak flux (nv) and energy release (nyt). pulsing can be initiated from either the critical or suboritical reactor state.

COMPARISON OF THE CURRENT AND THE NEW REACTOR SAFETY AND CONTROL SYSTEMS REACTOR SAFETY SYSTEMS The current console, which was designed and built '.n the early 1970's, has as its Reactor Safety Systems (See Table I) two hardwired independent analog High Flux Safety Channels, two hardwired independent analog Fuel Temperature Safety Channels, and a hardwired relay logic SCRAM circuitry.

The High Flux safety Channels derive their signals from two Boron (neutrou sensitive) Ion Chambers mounted above the core, and these channels have readouts located on the vertical panel of the control  ;

console in the form of analog meters. The Fuel Temperature Safety Channels derive their signals from two instrumented fuel elements, one located in the B-ring and one located in the C-ring. The Fuci Temperature Safety Channels also havo readouts located on the vertical panel of the control console in the form of analog meters. The Scram circuitry has two independent relay contacts for each safety channel, one located in the supply side and one located in the return side of the magnet and solenoid power circuitry. Dropping any one of these numerous relays would cut power to the magnets and the air solenoid.

The new console, as with the old console, also has as its Reactor Safety Systems two independent hardwired analog High Flux Safety Channels, two 4

independent hardwired analog Fuel Temperature Safety Channels, and a

i i a CONSOLE REACTOR SAFETY SYSTEM COMPARISON-OLD NEW SAFETY CHANNELS SAFETY CHANNELS l

l

- 2 Percent Power - 2 Fercent Power

! - 2 Fuel Temperature - 2 Fuel Temperature SCRAMS SCRAMS i

-TECH SPEC -TECH SFEC l - 4 High Level Safety - 4 High Level Safety Trips Trips

! - Manual - Manual

- 2 HV Loss P. Power - 2 HV Loss /. Power

- Pulse Timer - Pulse Timer

- Emergency Stop - Emergency Stop

- Water Level - Water level 1

-SAR -SAR

- Key Switch - Key Switch

- Steady State Timer - Steady State limer

- Loss of AC - Loss of AC

- Favility Interfocks - Facility Interlocks e Safety Channel Calibrate

• Watchdog

{ - 2 Relays in both the OAC and the CSC

- Individuo' Rod SCRAM - Individual Rod SCRAM i

hardwired relay logic SCRAM circuitry. The High Flux Safety Channels, just like the old console, derive their signals from two Ion Chambers mounted above the core and have readouts located on the vertical panel of the control console. However, for the new console, these readouts take the form of LED bargraphs instead of meters. These new channels were designed to be the same as the old channels, only updated with current technology electronics. The Fuel Temperature Safety Channels will still derive their signals from the same two instrumented fuel elements located in the B-ring and in the C-ring. As with the High Flux Channels, the Fuel' Temperature Channels have their readouts on the control console in the form of LED bargraphs instead of meters. It should be emphasized again, that these safety systems on the new consoles are independent hardwired analog channels Just as those are on the old console. These systems are completely independent of the system's computers and will continue to I

function irregardless of the state these computers are in. This will '

insure safety system monitoring and control at all times. The Scram circuitry, again as with the old console, has two independent relays for each safety channel, one located in the supply side and one located in the l return side of the magnet and solenoid power circuitry. Similar to the four sarbty channels, the Scram circuitry was designed to be the same as the old Sc.am circuitry only replaced with current technology electronics.

Table 1 shova a comparison between the SCRAMS on the new and old consoles.

The SCRAM circuitry on both systems is the same except for the Safety Channel Calinrate Scram on the old console and the Watchdog Scrans on the new console. The old console used to shunt the inputs to the safety channels while putting in calibration signals to the safety channels.

This created the possibility of operating with a safety channel in the calibrate mode. To prevent this condition from occurring the old console had a relay which would scram the reactor if any of the safety channels were switched to the calibrate mode. In the new system, the calibration signals are additive to the normal safety channel signals (e.g. the safety channels are not shunted in the calibration mode). A calibration signal added to the normal safety channel signal is more conservative (will always provide a higher channel reading) and therefore does not require a calibrate scram. However, watchdog scrams, as described earlier, have been added to the new console scram circuitry. These watchdogs monitor the status of the DAC and CSC computers and should any of the four watchdoJs (two in the DAC and two in the CSC) fail to be reset by the software, then the system would scram the reactor. This ensures that failure of either of these computers or of their software will cause a system scram.

REACTOR OPERATIONAL CONTROL AND MONITORING SYSTEMS The 1972 console has an operational channel which derives its signal from a fission chamber and generates the Wide-Range Los and Multirange Linear monitoring channels. The operational channel combines the standard techniques of Count Rate and Campbelling in an analog c 1puter to provide the capability to monitor 10 decades of power. The new console uses an

n .

opsrational raannel which was designed to be a digital version of the old oyotem; it still combines the standard techniques of Count Rate and Cccpbelling to provide the capability to monitor 10 decades of power.

The difference is that this function is now performed with a digital co puter instend of a analog computer and uses current technology electronics. These two systems were demonstrated to be essentially equivalent during the manufactures test program when both the old and the new systems were operated in parallel.

The interlocks or Rod Withdrawal Prevents (RWPs) for both the new and old oyotems are shown in Table 2. Again, these interlocks are the same for both systems except for the Operational Channel Calibrate RWP on the old console. On the old console, the input signal to the operational channel would be shunted when the channel was placed in the calibrate mode. In order to prevent operation of the reactor in this configuration, an RWP was added to the system to prevent rod withdrawal with the operational chonnel in the calitrate mode. On the new console, the calibration signal in additive to the 'ormal operational signal, and again is therefore more conservative and re guires no RWP. The interlocks on the old console were all analog logic uring relays. The interlocks on the new console use Digital Logic ( Fi r. aware ) .

STANDARD CONTROL ROD DRIVES The three standard control rod drives will be replaced. The old drives used phase-interrupt (analog) motors while the new drives will use stopping (diaital) motors (See Table 3). Only the drive motors are being changed, the romainder of the control rod drive assemblies will stay the same.

t SAFETY EVALUATION CONCLUSION The AFRRI TRIGA Reactor, NRC Facility License No. R-84, is classified as a "Negligible Risk Research Reactor (Pulsing)" in accordance with the NRC approved AFRRI TRIGA Reactor Facility Safety Analysis and as defined in ANSI /ANS 15.15-1978 "Criteria for the Reactor Safety Systems of Research Reactors". A "Negligible Risk Research Reactor (Pulsing)", as defined in ANSI /ANS 15.15-1978, is "a research reactor for which, in the postulated event of the complete failure of the reactor safety system coincident with the occurrence of the most adverse Design Basis Event, the radiological consequences would be negligible." Pulsing is defined as "a reactor that has been specially designed with an inherent shutdown mechanism sufticient to allow the reactor to accept large reactivity insertions without exceeding any safety limit."

In analyzing the ssfety of the AFRRI TRIGA Reactor, it is important to )

start with the inherent safety of the TRIGA Fuel, which is designed to

CONSOLE INTERLOCKS COMPARIS0N OLD NEW

-TECH SPEC -TECH SPEC

- 1 kw - 1 kw i - Source Level Neutrons - Source Level Neutrons

- Mode I (no two rods) - Mode I (no two rods)

- Mode lli - Mode 111 (no rod except TRANS) (no rod except TRANS)

-SAR -SAR

- 3 second period - 3 second period

- Ops Channel HV losa - Ops Channel HV loss t

- Bulk Water 60 C - Bulk Water 60 C

• Ops Channel Calibrate * (calibrate signal additive)

Y

I D ANALOS (1972) vs DIGITAL (1988) CONTROL CONSOLES OLD SAFETY INTERLOCKS CONTROL DRIVES SYSTEMS (OPS CHANNEL) l Hardwired Relay Analog Phase Amp-BT Logic Computer Interrupt circuit NEW SAFETf INTERLOCKS CONTROL DRIVES SYSTEMS (OPS CHANNEL)

I Hardwired Firmware Digital Stepping

( Amp-BT NM-1000 Computer Motor I circuit Relays & (Digital) <

1 EPROM I - - - - - - - - -

.l operate with large positive step reactivity insertions. The inherent I safety of the fuel element stems from its large prompt negative temperature coefficient of reactivity, which causes the automatic termination of a power excursion before any core damage results. The prompt Negative Coefficient of Reactivity of the AFRRI TRIGA Reactor is

- 0.0126 %deltaK/K per

• C (-1. 7 cents /* C ) , while the Steady State Negative Coefficient of Reactivity is -

0.0051 %delcaK/K per *C ( .7 cents /* C) .

Fuel elements with 8.45 wt.%U have been pulsed repeatedly in General Atomics' Advanced TRIGA prototype Reactor (ATpR) to peak power levels of over 8,000 MW, and bove been pulsed thousands of times to peak power levels greater than 2,000 MW. The AFRRI TRIGA Reactor is limited to a 14.00 step positive reactivity insertion (technical specification limit) which would yield a peak power level of approximately 4,700 MW. ,

The AFRRI Facility Safety Analysis Report has analyzed two Design Basis Accidents. The first Design Basis Accident, called the "Funt Element Drop Accident," involved the postulated occurrence of a claddirs failure of a fuel element after a 2-week period where the saturated finaion product inventory of a 1 MW steady state operation has been allowed to decay after being taken out of the operating core and pisced in storage; the saturated fission product inventory is obtairad after 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of continuous reactor operation at full power (1 MW). The cladding failure could occur when the fuel element is withdrawn from the reactor pool.

While the fuel element is exposed to air, a cladling failure could occur coincidentally, or due to a drop. As the AFRRI FSAR explains, the probability of such an

'; accident is considered to be extremely remote. The second Design Basis Accident, called the Fuel Element ;1 adding Failure Accident, involved the postulated occurrence of a cladding failure of a fuel element during a pulse operation or inadvertent transient following a steady state operation of 1 MW. Again, it was assumed a saturated fission product I inventory which occurs after 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> of continuous reactor operation at  ;

full power (1 MW), and a pulse operation with an integrated energy of '

10 MW-sec. A 40 MW-sec pulse operation is roughly equivalent to a step positive reactivity insertion of approximately $4.50. The maximum worth of the AFRRI TRIGA pulse Rod (Transient Rod) is approximately $3.75, and as such a 40 MW-see pulse operation is an extremely conservative assumption. The AFRRI FSAR again explains that the probability of such an accident is considered to be extremely remote.

The analysis in the AFRRI FSAR shows that "... the consequences from the Design Basis Accident of a fuel element drop socident or a fuel element clad failure accident were insignificant." Therefore, it was

"... concluded that the operatior, of the AFRRI reactor in the manner authorized by Facility License No. R-84 does not represent an undue risk I

to the health and safety of the operational personnel or the general public."

Both of these Design Basis iccidents (DBAs) were pottulated on the occurrence of one or two predetermined, deliberate man-made events. In tho first DBA, the scenario required that the reactor be operated ll

f n continuously for 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at full power to build up a saturated fission product inventory. In the second DBA, the scenario again requires a I coturated fission product inventory followed by a step positive insertion l of reactivity that produces 40 MW-sec of integrated energy. AFRRI has never operated at full power for 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> continuously, nor will probably ever operate in this manner under normal operating conditions. Both of these DBAs require fuel cladding failures following a set of specific man-made conditions and are not a result of any failures on the part of the Reactor Safety Systems. It was shown previously that the naw console has a MTBF of the Reactor Safety System of 5 X 10' years. Failure of the l Recctor Safety System would not initiate a Design Basis Accident. Even should the Reactor Safety System suffer a complete failure at the same moment as a DBA, the consequences would be negligible. i i It was determined during the design of the new Reactor Instrumentation and Control System that no technical specification changes would be required.

There are no technical specification changas ausociated with the installation or operation of AFFRI's new Reactor Instrumentation and Control System.

The new Reactor Instrumentation and Control System will offer a dramatic inprovement in operational productivity, system reliability, and system usintainability.

The new Digital Reactor Instrumentation and Control System has been designed to be safer than the present AFRRI control system. This has been accomplished by continuing to hardwire all safety circuits in a redundant, fail safe configuration. These safety circuits are completely independent of the data acquisition computer (DAC) and the control system computer (CSC). This means that if either or both computers were to fall, the l failure cannot prevent the reactor from scramming. On the other hand, l critical functions of the computers are monitored by "watch-dog-timers".

If the computers fail to update the timers in a predetermined fashion, the redundant, hardwired catch-dog-timers will scram the reactor. As a result, the new Digital Reactor Instrumentation and Control System has

! equal or greater safety built-in than the present AFRRI control system, which has SAR approval.

Based on the analyses in this technical report, it has been determined that the proposed changes to the Reactor Facility do not involve unreviewed safety questions and, in fact, are improvements in the facility design at AFRRI.

l l

I

{

l

s I l

This technicel report describes changes and modifications made to-the AFRRI reactor facility as depicted in the facility's SAR. These changes have been reviewed by the Reactor Facility Director and found to contain no unreviewed safety questions. This report is submitted to the Reactor and Radiation Facility Safety Committee (RRFSC) for their concurrence that.

conditions of 10 CFR 50.59 are met. These conditions are that no unreviewed safety questions are present and that the changes made do not '

increase the probability of occurrence or the consequences of an accident or malfunction.

(

1 a

I i [

.I j

l

[

t P

\

r

• e h

r 4

1 k

t e l

l l

AFPlfNDIX &

I I Listing af Corrections M b_q made }_q the SAR l

l l

I l .

I

ll ' '

i ES13. U.133 p.n Qhanae 4-16 4.10 This change will clarify the difference in the type of drive used for the standard and transient rods.

4-16,17 4.10.2 ine paragraph is modified to reflect the new step-m,, pit.s motors used in the control rod drives.

t' 4-16b Figure 4-8 The figure has been up-dated to depiut iht utw control rod drP ac $ the p-standard control rods.

, 4-22 Section 4.11 The phrase "thrt* ion chambers" has boon changad to "two ion chambers and a pulse detector" to allow a Cherenkov detector or an ion .. amber to be used for l puise operations.

j 4-22 Sectian 4.)$ A paragraph describing the NM-1000 ' ,s been added to the SAR. ,

4 4-22 Section 4.11.1 The section describing the Multirange Linear Channel has been updated to re- i flect changes incurred by the new snsole.

4-23 Sect. ton *. 11.2 The section describing the i

Wide-Range Lo* Channel has been updated *o reflect

, changes incurred by the new console.

4-24 Faction 4.11.3 Portions of the section r

l describing High Flux Safety Channels One and .

Two have been modified to reflect changes incurred by the new console.

f 1

I

. -- - - . . . - - - - . - - -,-_,_n . - - - - - - . - . . - - - . - - , , , . - - . - - - - - - - - - - , , , - - - - - - - . . . - . . - -

x

' ncQ:' )lp i .

s.. ,

4 h ,

I ^. p ' Pese S3 ctiort < Channe W y ,, . '

4-29 Sec'gion 4.fl.4 Portions of the section describing Fuel Tempera-

~

ture,. Safety Channels have been^ modified to reflect

, changes incurred .by the l new console.

~

a. .-27 Section 4.12 TN4 RWP associated with l thq vide-range los channel in uny mode other thnn OPEI: ATE is no longer

~:

I i required.

Set 10 CFR 50.59 writeup.

I f 4 '- 0. ? ', 9ection 4.12 The SCRAM associated with j , any of the safety channels

. in any position other than

, OPERATE is no longer

, required.

1 See 10 CFR 50.59 writeup.

I l

l 4

1

' ,,f.

( .

. 1

.t

s. S s  !

l-f f

i 4 ,

i 1

a i t

I r

4 t L

t.

lI APPINDIX R Snecifio RAR wM channes 191,thg. nrevious1Y discussed l

l Facility Modificatl&R SafttY Analyses  ;

4 l 5 I t D

Y

, I

)

l  !

f

.i.  ;

i I r>

4 6

I b _

3 h

t l' l

, t i

t i ,r a ..

l 1

t

(

3 l

, i l 1

1. REACTOR CONTROL COMPONENTS (Section 4.10)

CURRENT SAR WORDING:

"Control rod movement within the core is accomplished using rack and pinion electromechanical driva for the transient control rod."

PROPOSED SAR WORDING:

"Control rod movement within the core is accomplished using rack and pinion electromechanical drives for the standard control rods, and pneumatic-electromechanical drive for the transient control rod."

2. STANDARD CONTROL ROD DRIVES (Section 4.10.2)

a. CURRENT SAR EIGURE:

Figure 4-8 PROPOSED SAR FIGURE:

Figure 4-8 (modified to reflect new control rod drives)

b. CURRENT SAR WORDING:

"The standerd drive consists of a two-phase motor, a magnetic coupler, a rack and pinion gear system, and a potentiometer used to provide an indication of rod positi.on, which is displayed on the reactor console."

PROPOSED SAR WORDINGi "The standard drive consists of a stepping motor, a magnetic coupler, a rack and pinion gear system, and a potentiometer used to provide an indication of rod position, which is displayed on the reactor console CRT."

c. CURRENT SAR WORDINQ1 "Clockwise rotation of the motor shaft raises the draw tube assembly."

PROPOSEQ SAR WORDING:

"When the stepping motor is energized, the pinion gear shaft rotates, thus raising the magnet draw tube."

l I

l l

CURPINT SAR TICUPI 4-3 t

~!

l l

j RE E v DeWE es0 Tot 1 WCDolvlTCMES nettwcLOADED i PULL E00 i

\

PCTEMTlhETEt Tl

e \ l 6  % ,b - AnasATURE DRAW k! '

TUBE i

l TIP OP PUSM B00 F007 ELECThom&6 MET SARREL PilTON f CONNECTWG 200 t

I >

g ALUhttigUh8CLA0 F SOAAf te GRAPM4ft Co8eTROL A00 unTM i-

, sous Atuhamuhe

, Pottowem j ,

I l

1 i

FIGURE 44 STANDARD CONTROL ROD DRIVE FOR SAFETY AND SHtM ROOS *

]

!l  % Red Om 8mador E sasse Orw thesar Carsenew Tassensee lj 4-16b

'

• I PROPOSED SAR FIGURE 4-8

\

\

~

POTENTIC:1ETER FLEXISLE WIRE GUIDE DRlYE MOTOR 1

MICRO $WITCHE5 SPRINGLOADED

,., PULL R00 1P 6 71 bk) ARMATURE e

gDRAW fl TUBE l k

l TIP OF PUSH RCD

, FMT .

ELECTROMAGNIT i i

BARREL l PISTON l

l '

9 - CONNECTING ROD l

\

, l w.

I

. ALUMINUM CLAD l 80 RATED GRAPHITE CONTROL RCD WInt SCLID S i ALU:tI!!U:: FOLLCWE!1 OR AIR FOLLCWER

.I 3

l l

l f

?!C"F2 4-3 Standard Control Rod Orives I

l___.._______._.r _ _ _ _ . _ _ . . - . , _ _ _ _ _ _ _ , . . _ . _ _ . _ _ _ . _ . _ . _ _ _ _ _ _ _ . _ _ _ _ _ _ , _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

3. REACTOR INSTRUMENTATION (Section 4.11)

CURRENT SAR WORDING:

"A fission detector and three ion chambers comprise the remaining detectors."

pROPSSED Sag WORDING: I "A fission detector, two ion chambers, and a pulse '

detector comprise the remaining detectors."

l

4. NM-1000 ,

ADD IQ IRE SAR: (at Section 4.11)

"The NM-1000 system, which includes the Multirange Linear '

Channel and the Wide-Range Los Channel, is contained in two National Electrieml Manufactures Association (NEMA) enclosures, one for the amplifier and one for the proces-sor assemblies. The amplifier assembly contaAns modular plug-in subassemblies for pulse preamplifier electronics, bandpass filter and RMS electronics, signal conditioning circuits, low voltage power supplies, detector high-vol-tage power supply, and digital diagnostics and communi-cation electronics. The processor assembly is made up of modular plug-in subassemblies for communica. ion elec-tronics (between amplifier and processor), the micro-processor, a control / display module, low-voltage power supplies, isolated 4 to 20 mA outputs, and isolated alarm outputs. Communication between the amplifier and pro-cessor assemblies is via two twisted-shielded-pair cables."

5. MULTIRANGE LINEAR CHANNEL (Section 4.11.1)

CURRENT EAR WORDING:

"The multirange linear channel reports reactor power from source level ( 10-8 thermal watts) to full steady state power (1 MWt). The output of the fission detector, fed through a preamplifier, serves as the channel input. The multirange linear channel consists of two circuits: the count rate circuit, and the campbelling circuit. For power levels less than 1 kilowatt (t), as selected on the power range select switch, the count rate circuit is utilized. The count rate circuit generates an output voltage proportional to the number of pulses or counts received from the fission detector. Hence, the output is proportional to the neutron population and the reactor power level. For steady state power levels at or above 1 s

1

j l

kilowatt (t), as selected on the power range select switch.  !

the campbelling circuit is utilized. The campbelling circuit generates an output voltage proportional to the reactor power level by a verified technique of noise envelope amplitude detection and measurement known as campbelling. The output from the appropriate circuit is fed to an amplifier which supplies a signal to the strip chart recorder located on the reactor console. The power level is scaled on the strip chart recorder between 0 and 100 percent of the power indicated by the power range select switch on the console. The strip chart records this output for all steady state moaes of operation but not during pulse operation.

pR0 POSED SAR WORDING.

"The multirange linear channel reports reactor power from source level ( 10-8 thermal watts) to full steady state power (1 MWt). The output of the fission detector, fed through a preamplifier, serves as the channel input. The multirange linear channel consists of two circuits: the count rate circuit, and the campbelling circuit. For power levels less than 1 kilowatt (t), the count rate circuit is utilized. The count rate cirauit generates an output voltage proportional to the number of pulses or counts received from the fission detector. Hence, the output is proportional to the neutron population and the reactor power level. For steady state power levels at or above 1 kilowatt (t), the campbelling circuit is utilized.

The campbelling circuit generates an output voltage proportional to the reactor power level by a verified technique of noise envelope amplitude detection and measurement known as campbelling. The NM-1000's micro-processor converts the signal from these circuits into 10 linear power ranges. The multirange linear channel output is displayed in two formats. These are a bargraph indicator on the Reactor Control CRT display and a strip chart recorder located on the left-hand vertical panel on the control console. The power level as displayed on the CRT bargraph and the strip chart recorder is scaled between 0 and 100 percent for each of the 10 linear power ranges. The multirange function is auto-ranged via the NM-1000 control system computer. The multirange linear

{ output on the CRT bargraph is displayed for all steady state modes of operation, but not during pulse operation.

{

l l

I

1

6. WIDE-RANGE LOG,CEAEEEk (Section 4.11.2)

QURRENT SAR WORDING:

"The outputs of these two circuits are log amplified and then summed in a summing amplifier. The summing amplifier supplies a signal to the strip chart recordet- located on the reactor console. The power level is indicated on a 10 decade log scale (10 8 watts (t) to 1 MW(t)). The strip chart records this output for all steady state modes of operation but not during pulse operation.

During certain steady state modes, the wide-range log channel also measures the rate of change of the power level, which is displayed on the period / log meter located on the reactor console."

PROPOSED SAR WORDING "The outputs of these two circuits are digitally combined and processed to provide the power rate of change (period) and the power level indicated on a 10 decado los scale ,

(10 9 watts (t) to 1 MW(t)). The wide-range log and period outputs are both displayed on bargraph indicators on the Reactor Control CRT and on hardwired vertical LED bar-graphs on the left-hand side of the Reactor Control Con-sole. The outputs on the CRT bargraphs are displayed for all steady state modes of operation but not during pulse operation."

7. H[QH FLUX SAFETY CHANNELS ONE AND IWQ (Section 4.11.3)

a. CURRENT SAR WORDING:

"High flux safety channels one and two report the reactor power level as measured by three ion chambers placed above the core in the neutron field."

PROPOSED SAR WORDINQ1 "High flux safety channels one and two report the reactor power level as measured by two ion chambers and a pulse detector placed above the core."

b. CURRENT SAR WORDING:

"The steady state power level, as measured by the two high )

flux safety channels, is displayed on two separate meters located on the reactor console."

1 I

1 ERQE9EID. SAR WORDING:

"The steady state power level, as measured by the two high flux safety channuls, is displayed on two separate bar-graphs located on the reactor console."

c. CURRENT SAR WORDING "During pulse operation, high flux safety channel one is shunted and the sensor for high flux safety channel two is switched to a third, independent ion chamber placed above the core."

PROPOSED 1&R WORDING:

"During pulse operation, high flux safety channel one is i shunted and the sensor for high flux safety channel two in

, switched to a third, independent pulse detector placed above the core."

d. CURRENT EAR WORDING:

"The NV channel output is displayed on the strip chart recorder located on the reactor console. The NVT channel output is dispisyed on the reactor console HVT meter."

i PROPOSED HAR WORDING:

"The NV and NVT channel outputs are displayed on two separate bargraph indicators located on the left-hand

side of the console."

i e. GURRFE. SAR WORDING:

"Knobs for each channel, located on the reactor console, i allow the channels to be checked fer calibration.

i Switching these knobs to any mode from operate (i.e., to

} the zero or calibrate positions) causes an immediate reactor scram."

PROPOSED SAR WORDING:

"Calibration of each safety channel is done automatically l when the operator initiates the "pre-checks" by activation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operator via the

{ reactor status CRT. This calibration can only be per-formed while the reactor is in the SCRAMMED mode."

I i

t

f. CURRENT 1AR WORDING:

"A trip test knob for each safety channel ..." '

EROPOSED EAR WORDING:

"A trip test switch for each safety channel ..."

8. EMEk TEMPERATURE SAFETX CHANNEL.1 (Section 4.11.4)

a. CURRENT 1AR WORDING:

"The two fuel temperature signals are amplified and displayed on two separate meters located on the reactor console. During pulse operation, the output of fuel temperature safety channel one is also recorded on the reactor console strip chart recorder."

PROPOSED SAR WORDING:

"The two fuel temperature signals are amplified and l displayed on two separate bargraphs indicators located on the reactor console and on the reactor control CRT."

b. QURRENT 1AR WORDING:

"A trip test knob for each fuel temperature safety channel, located on the reactor console, provides a means of testing the scram capability of each channel without having to actually reach or exceed the technical specifications limit on allowable fuel temperatures."

PROPOSED 1AR WORDING:

"Calibration of the Fuel Temp;rature Channels is done automatically when the reactor operator initiates the "pre-checks" by activation of the Prestart Check Switch on the control console's Mode Control Panel. Any failures detected during the prechecks will be automatically reported to the operator via the reactor status CRT."

9. ROD WITHDRAWAL PREVENT LBWP) INIERLOCKS (Section 4.12)

CURRENT EAR WORDING:

"RWP prrvents any control rod withdrawal if the wide range j los channel is in any mode (i.e. position) other than j OPERATE."

PROPOSED HAR WORDING:

-This requirement is deleted (See document for analysis).

l l

i .

10. SCRAM LOGIC CIRCUITRY (Section 4.14) 9URRENT SAR WORDING:

"Any of the safety channelm (fuel temperature safety channels and high flux safety channels) in any position other than OPERATE (i.e., CALIBRATE or ZERO) causes a reactor scram."

PEOPOSED HAR WORDINQi,

-This requirement is deleted (See document for analysis;.

I

(

{

{

l I

APPENDIX q AFHRI TRIGA Consolt (Safety) Scram Systen Single Failure Criteria Analysis l

l l

)

)

)

]

J

l AFRRI TRIGA Console (Safety) Scram System Single Failure Criteria Analysis

REFERENCES:

1. IEEE 279-1971 Criteria for Protection Systems for Nuclear Power Generating Stations.

2. IEEE 379-1977 Application of the Single-Failure Criteria to Nuclear Power Generating Station Class IE Systems, ne following analy:Is is postulated upon the principle (explained in Reference 2, Section 6.1(4)] that redundancy of protection devices provides complete assurance of safety in operation with regard to the parameter monitored by the device. For example, the failure of a fuse to blow when subjected to its designed rating of overload current is a credible possibility, but the fallute of two identical fuses la series to blow simultaneous *y is not a credible possibility.

1. 'II.e steady steady state timer scrams the reactor after an elapsed time and no redundancy is provided. De probability of the failure of this device is estimated as follon:

Mean Time Between Failure (MIBF) of the electronic circuitry is about  !

200,000 hours based upon parts cat and stress factor per i MIL-HDBK-217B. At 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> per month this is one failure in 83 years.

De electronic timing circuits 9perate relay contacts whose failure rate is expressed in operation cycles raser than MIBF. A conservative estimate

(

based on manufacturers specifics.tions is 25,000 operating cycles. At two cycles per day and 5 days per week, this is one failure in 48 years. He most likely failure is increased comaet resistance rather than welded contacta so that an unsafe condition probably is not credible in less than 100 years of operation. The steady state timer is not a required safety system component.

-1

(

[ - _

l

2. He pulse timer scrams the reactor after ccrupletion of a power pulse and no redundancy is provided. He rated life of this device is 250,000 electrical operat!ons which exceeds the probable number of pulses to be l produced. J De probability of randnen failure calculated as MIBF per hDL-HDBK-217B based upon parts count and stress factor is greater than j 300,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />. At 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> per month, this is equivalent to one failure I in 125 years, j 3. He manual scram button is used to shut down the reactor manually. The i specified life is 100,000 cycles of operation. At 15 manual scrams per day this would be one failure in 25.6 years. However, this is a ammally j closed switch with a direct acting operator. De most likely failure mode is a broken switch structure which would result in failure to reset after a scram. Welded contacts would be separated by mechanical force of the j direct action operator. Redundancy for a manual scram exists in the

console operator key switch and power os switch.

4. %e console key switch de-energines 'he magnet supply as well as other circuitry. He estimated lifs is 10h00 operations. At 15 operations per i

day, this is a failure rate of one every 2.6 years. However, the ke/

switch is not depended upon to perform a safety function except to l prevent unauthorized startup. He manual scram button provides shutdown i redundancy so that an unsafe failure is not credible.

1

5. All reactor tank shielding door interlock switches and emergency stop l buttons remain frtun the existing systerr. and are unaffected by the new ]

l hardware. He emergency stop switch and all other rwitches on the new

] console uae the same actuator and switching element as are used on the l

l existing system.

I )

i

)

-2 l

6. Le loss of AC power causes the magnet supply to be de-energized which in turn produces the same response as a manual scram, dropped rods.

7. De high level trips in the two power safety channels are redundant and therefore do not present a credible mode for failure. All non safety outputs are physically separated and Isolated to prevent conxnon trode failures which may otherwise invalidate the single failure criterion. A minben separation of six ' inches, or a metallic flame barrier exists between all safety and non-safety circuits. A rninbm1 Isolation voltage of 1500 volts RMS or DC epplies to both optical and transformer

, Isolation.

4 De hfrBF of the two NP1000 safety modules is greater than 20,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> based upon ecznponent failure rate data taken from hiII,-HDBK-217B. The bistable tr:p portion of the NP1000 has an MTBF  ;

greater than 200,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />. Because the NP1000's operate Independently, each with its own detector from the existing system vunplete redundancy exists.

8. De detector high voltage is interlocked by trip circuits in the power and safety channels and the redundant circuitry makes unsafe failures not credible. Secaration and Isolation criteria of itan 6 above apply.

9. Le two fuel tenperature safety channels are high reliability modular signal conditioner / limit alarm der'ces each with calculated MIBF figures exceedits 200,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, ne channels are reA'mA=t with separation criteria applied to the wire harness therefore an unsafe failure is not credible.

( 10. ne msgnet supply ground fault detector uses a high reliability modular signal conditioner / limit alarm. De signal conditioner module has an

( .NirBF of greater than 200,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, ne limit alarm uses a telay rated for more than 25,000 operations. Here is a pushbutton switch which is used L test the operability of the ground fault detector on a daily

(

(

( >

{

basis. Because the relay only operates during testius and fault conditions the end of life cannot be reached. brefore the probability of an undetected ground fault is the probability of randcm failure in the signal conditioner which is less than one in 23 years.

11. Pool Level Monitor - Pool water level la monitored with redundant float operated switches and redundant relays with contacts in the scram circuits.

m switches and relays have failure rates of less than one in 106 hours0.00123 days <br />0.0294 hours <br />1.752645e-4 weeks <br />4.0333e-5 months <br /> but redundancy makes a water level monitor failure not a credible failure mode.

12. Watchdor Scrazza - A watchdog timer on the data acquisition corzputer l and another on the control system cmxputer are required to be roset periodically by a program routine as a enfeguard spiut courputer component failures either in hardware or software. If the required response is not received within a definite time period, redundant normally open (fall safe) contacts interrupt the scram loop dropping the rods tad l shutting down the reactor. The watchdog timer is an additlocSI safety

! device. .

l 1

)

f J

)

4 1

)

l

l

• 6PPENDIX Q 1

$_ cyan Circuit Safety Analysis faE lili l

University f Ter:no TRIGA o Reactor s l

l l

l

( .

l l

( _ - -----

!' j COLLEGE OF ENGINEERLNG l ,

/ THE UNIVERSITY OF TEXAS AT AUSTIN i

DefatnentofMechanicaEnginorring NsdonEngineeringPrograns* Austin,Toxs 78712 ()!2)47I.3136

. April 22, 1988 1

Mr. Junaid F.arvi General Atomics P.O. Box 85608. Ms/21 San Diego. CA 92138

Dear Junaid:

As per our discussion at the TRIGA meeting. I have enclosed a copy of the complete safety circuit evaluation we developed from the available GA information. I hope that this analysis might provide valuable support for your analysis of the new console installation. A review by knowledgeable persons should be made to ascertain that our understanding and evaluation of the documents is correct. I believe that although the system has -

evolved from some of the documentation we had available, r.he changes to the analysis are not likely to be significant. An effort was made in the method of presentation to der.cnstrate various conditions.

Please review and return ceneents. Other persons have also expressed an interest in the analysis but I'd prefer to have General Atomics consents to nake available on final document.

Thank you for your help in this catter.

Sincerely.

7. /hA~

Thomas L. Bauer Assistant Director Nuclear Engineering Teaching Laboratory TLB:div

, Enclosure

\

~

\

s m_ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ -

1 Elje Etnibersit)! of Ecxas at %ustin .

Scram Circuit Safety Analysis for The Unluersity of TeHas TRIGA Reactor Prepared by:

l Dr. Thomas Bauer Professor of Mechanical Engineering j

David Goff Engineering 5".ience Student April 22,1998

)

)

)

&2 N 3

_ _ __ - 1

TRIG A-ICS Reactor Safety System Frot+.:tiv+ 3. rte nt Sf th E-3cf0r fat +ry .'y!t+m (RC') 3r+ [r.."11+d by

$+v+r31 param+t+r m+3!urtrr.+nt .:hann+1! and 3 cvntr:.1 rc-1 rew+r :tr< ult

($ :r3m (tr.: Ult! E3';h tii+3iur+ni+nt Ch3 lli+1 (Ontrc li Opet Ott? n Of th+ i<r3m Circuit by In+3ni Of 3 rel37 in th+ <tr< Ult Wh n Sny On+ Of th+i+ relay 5 !!

tr1((Fl it <ut.! PM ? r t0 th 0:ntr01 r N!;

Th+ teram <treutt .1+!!in a <0mpt n+.1 cf (Our functional $+<tt.:nt. Th+2e T+[r+! nt th+ pr?t4<tt'? 3.:tt.* n In0!itt.:Tttig Of th+ Sy$t+m, montt0!! 0! the ly!t+rn't op+ratiltty,3 toltV3r+ Dnd m3nu31 s+<t!On,in<luding th-, Ley $ witch

&nd mhnU31 !<rblui, and th+ physic 31';tr< ult iti+1f, including the gr0Un i f3 Ult and [el+r !upply in:nitors. Th+1e i+<ttOns are thewn in th+ di33r3 n t.+10w Fratn ti,+ Ac tiai lip 1s m Le<p q 3,,9,,

l T .

Fr:;rkm

, O h Ca.trs) 10 Y N cron af 1 r.

F s \tp Isase <tstus ' # V' Cdritrol wa.a t

1 -

Fratutive A.:ti:n sipals (-J Le+p R$$ Funttional Diagram '

Th+ (0110Ving analyii; fir 5t 100k5 et th+ t,45tc5 Of th+ syit+m in 5teady t.it+ cp+ ration. Af t+r a i+n+ral failure m0ddl is div+10p+d. the l analyli3 +::pand; to 100h at th+ <3hbration ch+<1'3 th+ byp313 r+13y used in s

l r

pul5+ mod +, and mantter chann+1 failur+5 cutM+ th+ scram circuit iti+1f.

s L

L I

MSS Failure Analysis ,

Th+ E00 !< rom <tr.:utt supplt+1 pow +r to th+ control r013 and h+nc+ 15 th+

punt St Yht'.h 0111Crann 'X(Ur, er f 0il to M<ur, its prOptr lunctlen is th+r+ fort imp +r3ttue 10 ISt+ vper3tt0n Of th+ re3<ur in analy;;;ng th+ !..:r3m

<tr<utt,31 m3ny p?tentthi f 311Vr+ mod +5 35 IM!!!bl+ wtr+ +::3minti to

+1ttrn.it+ the pr:labthty ci a <!r utt !3tlur+ The ultimat+ failur+ u n!+qu+n?+

Ubi tli3t th+. :utr?l TXII. k'+r+ nOf Ini rt&1 and nO !.: rim 6.'<urrvi durant 3 i:rDrn intitStt?n in Orde. to +;:)rnin+ th+ V)y in whi',h individuS! !)t101elin i tr.+ <tT<utt mtjht ltid t0 S n:.n !<r3m,3 f 3 ult tr+i w35 c0nitruct+1 t 3ci+d On .

an Sn31yits et thi 1:r)m <tr<uit. '

't Th+ first st+p in th+ ESS f ettur+ analysti myolv+d identifyini th+ ver Ou3 I trays in whi<h th+ ESS could fail. Th+i+ includ+:

1) Phy ical Oyit+m Failur+

2) Limiting Saf+ty Syst+m !+tting (LSSS)Fattur+

3) Syst+m 0p+ rat,1+ Failur+

s) Comput+r/tdanust Centrol Fattur+

Th+ Physical Iyst+m failur+$ in:lud, mre b shs, sh0rta, and f)ilur+ of th+ ir?und f 3 ult d+r+<t and vcitti+ d+t+<t <u ~ :a Th+ L;;I feitor+1 ar+ )

tv i+ vht'h w'.ul-t <6ui+ l ,5$ Of th+ at iltry d+t+< t an uni nf+ :?r. litt.'.n.

Th+i+ +1+ments includ+ th+ Fu+1 T+mp+rature monitors and th+ F+r.:+nt )

Power montt:riin th+ lilI-1000. IIP 1000 end NFP 1000. 3yit+m Op+ rat'l+

]

f atlur+5 art the!+ which caui+ 1015 cf th+ abihty to monitor th+ <,ip+ rat,1+

(0ndition cf oth+r tyit+ms,iOr instanc+ th+ hiih veltai+ mentt0ri Finally, Comput+r/l!!nual Gntrol failur+5 ar+ tho!+ afic:iat+d with th+ pr0 gram r+1ay! or th+ manual scram and h+y switch Th+ 1allur+ analyiliis ra!+d :n a fault tr++ appr03.:h in wlitch th+

}

p retat>ility of a ptrtt:ular f ailur+ is t.rct+n d<:.wn into ccmp :n+nt parta which

t 9

8 4 3r '

1th t 3dd&d i.r 01Ulttpli d (0j+til+r d [+11 ding .',n t.:./116 thyr t!i+

C001f<n Ot3 (Un<t10!! in en ~0r"iY Sn 'Snd'Inin!1+r r+i[Et!Vely Tii+ i+n+r31 qu3t!'11 IOr (11+ ISult tr++ 15 l Irwi

• I st ,;,3 ' stt I : ' f r ,.e-. ' Iw./n.. - I I l Wlie!+ F,,u, li tlit OV+r)ll [roldbiltty 0f tlie Circutt (3tl!!aj t0 i<r3tn on 3 t

i:T3ni iltuiti;n Slid th+ f 'i 3r+

g tlit [10t.St111ty 0f +3':h Of th+ f311Ur+ In0d+1

)

l 4+1:11I +d St :.V4 l

l l

l L

L

(

FAULT TRCC OVCRVICW c s,er.,i n+a i 5 41+ 6;+ I r esse

• l l

k'

' u 'rel F rap u .n,-

N'bd i t nr.4 bl

$t p,ggg, rv>xe

\

L 553 Et tr.t I e g t,r,g .

C ++ t es tly. o ,pgy L W44ttr/ Fry sic al r itt.r* 08 *# # I '" ' ''

r und ' r

, ube+ ruis P =Ptsu +Psysop -P i' l )

rahre comp /wan . Pekysy,

O -

Physical Systeru Th+r+ er+ meny p:>t+nti)1 f >tlur+i in til+ phyitol syst+m F?rtun3t+1y.

I m:it r+! Ult in l':! .([0w+r to rL+ :;ntr01 r As Ond h+n<+, a ter)tn attVDt:0n Th+ [0!!!t.1+ f 311Ur+ In:4+1 St,

.'h:! t (J !!n+ 'IV[ ply !? ! + tut ln.*

P0t?+r 10i!

Illort t:, p0V+r (20V N Snd + t0 + cr - t0 -)

Chc!t t0110+ tiU((ly to iUpply Or r+ turn t0 r+ turn)

!h' cit to jr00nd Gr0und d+t+<t etr<uit failur+

'!h0rt to pow +r (+ tu - cr not 20V D3 F0w+r fluctuation V0ltage d+t+ct <treuit f 3tivr+

Th+ firit tw0 tellur+ typ+1 inh +r+ntly i:r3m th+ syit+m by cutting off l pow +r to th+ contr01 rods. Th+r+f0r+, th+y 3r+ not 0f conc +rn f0r tht$

Snily!!s. A thcrt 010ng +tth+r th+ tupply cr r+ turn train or to a ps'+'+r

( iupply which !$ ilmlinr to th3t iuppliAl to th+ i<r3m circuit would not t+

1 d+t+.:tM by th+ irr)m circutt. Such a ih',rt WOUld n+gSt+ th+ faf+ty r+13ys l

b+10r+ the ih0rt if it w+r+ in th+ (Upply train or tho!+ af t+r a ih0rt in th+

r+ turn train. How+7+r, for tuli to 1+3d to an Uni 3f+ f ailur+, $U<h incrti

(

t'mli h3v+ to occur cn t.:th th+ supply 3nd r+ turn trains b+caut+ 311 i?f+ty

( racr.lt0!i er+ dupitcat+d on t4th trains. This redundancy structur+ 15 ih0wn in th+ fault tr++ and mal:65 this a not1-tingl+ failur+ mod +.

k The other t; ranch of th+ f ault tr++ ihows the pr0babiliti+s ass 0<thted with f 3ults in th+ ground d+t+<t and v0ltag+ d+t+<t cir<Utts For th+i+ tc caui+ 3

(

[Ot+nt!D1 n0n icr3:n 11tu3tt?n, h0W+V+r,3 ihert to grcund rnVit N<ur ai w+11

( 35 th+ ircund d+t+<t f attur+. ftrntlarly f0r th+ vcita?+ d+t+:t circutt, only 1 i n500 m0ntt0r failur+ Coupl+d with irr+gul3r VOltajt can caUi a [St+ntial

( L0n-5 Cram 11tV 3t!: n

( _

Th+ +qudtton f:r tht5 i+trnent of th+ fault tr++, th+n,i!..

E,6,;ii

• P.,,ae

• P.,e,,.:,* ve E . . ' Evs .,n,* (P;o .. ' P;o...,N C')

Wh+r+ tr.+ Iqu3r+d t+rra indicot+5 th)t +1th+r 3 thcrt to tow +r Oc al:rg ths 11r.4 Inuit c; cur cn t4th th+ iuppt/ 3r d r+tura. lir.41 II E. Py3,,,11th+

pr0bObility Of 1 ih01t th [.4W+T 14nt?h is differ +1st fr0!n th+ [4W+r $Upply Olid h !K+. d6t+ct3ble by th+ V0lf33+ In0 nit 0rtnj CircutO Whilt P.g,,,,, it th+

prob 3bility Of & ihi:rt to [4W+r !!bliitinjuilh3bl+ fr0ni th+ p0W r $Up[ly.

P,t,;,, <30 b+ $Ubititut d int 0 Igu)ticIl 135 p3rt Of th+ CV+T311 (31101-pr:t ability.

I l

)

)

)

)

]

Rt(SICAL SYSTEM FAULT Tree

, ,..y u i ., , , . ,...

F MI!

fl I

I g Grue i tt w v,4

) F Wit i vs. s1t it.s t

r4 L v.,

F uly ,

f, l F o *.er 0* M.4 I it*#t II'W t l t i?r.itcc i ter.itu on Oyt eri in i ni. , r ut, . t v., Lv.e j (~ 1 0 if I I l 'p o .. or p u .a.

Gew.a t r.ut t r.ws sr.s t tru e sea , >

% ,, .s c. . . .< ,, ..

3. ,.

F uit f ag): F 6 tis Orwr1 I s'+ iv.+

h F 3 ,,.

l

(

2

( P,,, g , = P ,.g. I asil,

• P ,. , g , .,

• P, , ,,,,

• P p,, g + ( Pg , , g i,, + Pg, , ,,,.1 {n l

l l

( - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

)

l Limiting Safety System Setting Th+ LS;S consists cf th& fu+1 t+mp+ratur+ montt0ri and th+ p+r.:+nt re/+r monitori F:.r +1th+r htiti f u+1 t+rnperatur+ 0r p+r(+nt pw+r to oute s non tersra titustt:.n rels'/t on t >th the turity end teturn trains must f un. T!us is t +cau!+ tuer+ are two in.t+r +natnt 10+1 temp +rature n10ni%r5 on+ CQntw.t+d to +Xh lint < f th+ !:r3111(11(Ult. !!mt!&rly ti1+r+

are 2 p+rc+nt [:4 '+r ni?nttori tud-p +nd+ntly .:0nn+et+d to th+ i<r)n) .:trcutt 10 thLt in crd+r fcr L f Bilur+ CO N.:ur. t-:th t i. Uld la','+ t: fatl. Tht! !! .'l+)rly 3 ncn-itutiv f nint- me i+.

\ {

Th+ +qu3 tion f:r th+ r r.:t.]!.!!:ty of L :: I)t!'.ir+ )! ihwn in th+ f ault tr++ 15 - . l 1

P,;;; = (P, ,,j - ( P ,,,1 2 0.1 F

u raay b+ plugi+d into EquitRn 1 A5 part cf th+ ov+rall fi Tr prCb3btitty +quiten.

l l

l l

l l

]

)

)

_ - - - - - - - - 1

p_ v '

.. 'z 1 '

p'

. LSSS FAULT TRCE A 6 \

,i' b; e .

- . . --. ~

ing t tiin

4. .

. Inil l 4 .'t .

I...

1Q ,

• ~~

I'4s1 I4re'.$. :Tf 4 e +t*

g 0+ t+ 4 tish D+t+ctl46 F nils F n;1:

1 h * .

~

fu+1 fu+1 ;TFvr *I YPsr 82 T+ tap. T+mp. F tils F nils a ai rini =2 reir 2 2 isst =(Ptremp 1 ,gparme 3 P

f)

O e 4, 6

9

,_ n .. _. _________ _______ ______ _______

. \

/

e a f' [ / System Opere.ble Failure Th+ syitem op+rabl+ comp:n+nts ar+ th+ 10w-wat+r 1+V+1, high voltag+,

o wati:hdog, and +::t+rnal scram r+1ays. Ea.:n cf th+s+ has ind+p+nd+nt i+niors wir+d irito t :,th in+ supply anc! return'lin+s and so fi. a non-iingl+ failur+

m0.:1+. Th+ low-wat+r 1+v+1 monitors wat+r +v+1 in th+ tank High vcitag+

i:h+cl:s ',M voltag+ On th+ p+r.:+nt pow +r m0nttct 5 bnd th+ +::t+rnil 1.: ram in!UT s Chat all :: tarnal . Un/ lit 10r.5 af m t,II applicabl . Th+r+ r+ tv,7.atri Of watc'.tdOg r+1ayi,.cn+ for th+ '.'E and on+ f0r th+ DM. Th+y m?nitor ti +

)

~

!?f twar+ and w!!!i: ram if n0t r+i+t +v+ry #.v+ s+:?ndt by th+ir e0mput+r Th+ +quation gov +rning th+ pr0battltty ai40ciat+d with th+ syst+m l cp+rabl+ s+gment of th+ fault tr++ 15:

[

E soo,

" (bv.v.) + kk) ' Ibreiser) + (bc c ' Ib .<i ) b) l Wh+r+ th+ cquar+d terms ar+ due to tue redundancy in th+ syitem. P,,g, l can b+ plug?+d into Equation 1 as part of the ov+rall failure probability. ,

7, l

I e

l e.';. *

/ s

,,'j h .*

6

'r,

( .

'$t ,~

s.

v =v nm 4.- ,

j 3 I 5- L -

Ort)n3_t n3 U L-. _. < t. c _

s.u,,m Of crit It -

f ourt l '.

Ik l

l l w e,a,+ q +r m,

[ E,s +c u t +1 but+m Tng. F uit t,+ ,ct 1 F tis t1 l l

- II l5) l l _ __

E4 tert.1 '  :! ., g #r,.,

C$C OAC {'ef+CICT (s+ t + C tor Vdo.) Fills F gj];

i V,j; F itif;l F nils

) -

) ,- fi q h If Exterr a1 Ext +rnni C5C *1 Cic =2 NC *1 DM "2 i## # l r ul N I L0w Vater Fiili --

F ult F nils Fuls H14;h F atir Lwd Trip Volt np

'F nili Teit. F sfis ai m i

2 2 P

59 ,o, =

gC 2,pctlc

• Pr + Pg,2 p

) ,

t, g c, ,,

gy ,, g, .

. , Fa > F ui,

( ,

4 L

r L

r

Computer / Manual Control This s+ction d+scrit+s th+ probability 0f failure Of th+ pr.: gram r+13yi 3.nd l an op+rator screm. Sine + th+ program r: lays are id+ntical, th+ p?ssibl+

fattur+s ar+ thet on+ r+ lay falls to op+n on c0mmand, or that two, thr++ cr 311 f0ur f 3il. If cnly on+ r+1ay falls,ini+1 tion of th+ thr++ r+mbining r0di. Will shut dOwn th+ r+a.:tcr 50 this i5 n0t an Uniaf+ failur+ In0d+. If any tw0, thr++

cr all f0ur r+ lays fall t0 Op+n th+ r+ actor will n0t shut down. It is +3sily d+m0nstrat+d with a pr0bability tr++ analyiti that th+ probabihty of failur+

cf 2. 3, or 4 Of th+ r+1ays is 6P f 3+4P3+Pt t 4wh+r+ P tis th+ probability of a l

l sinil+ 1+1ay failur+. Ints +::pr+5sion will cl+arly be dominat+d by th+ first term for small P t50 th+ cub + and (curth p0w+r t+rms will b+ disr+garded in furth+r analysis.

Th+ Op+rator scram is normally initiat+d with th+ manual scram switch In )

( th+ ca!+ Of a switch failurs, how+V+r, th+ cp+rator has 0ther m+3ns of

(

i shutting down th+ react 0r. Thes+ ir.:,lud4 the 1:4y switch and the individual r0d <0ntr015. The 3::pr+ss10n f0r r0d contr01lallur+ is bai+d on th+ sam +

l thr++-0ut-of-four logic as th+ program r+1ays as again, only thr++ reds must b+ in!+rttd t0 shut th+ r+Mtcr down.

Th+ +:.Tr+:iten, th+n, f0r th+ pr0bability Of failur+ cf th+s+ subsyst+mi15.

Ec . ,/,m 6Py n,y 2 + (Pnu m ' P,% ' 6Pu,,, 2 ) (?,)

Il0te that the 0p+ rat 0r has thrc+ Independent m+thG.15 t0 scram th+

syst+m, all 0f which must fail (Or a non-scram situation to aris+. This is highly unlik+1y as th+ switches thems+1v4s 3.re redundant. The manual scram Switch,(Or 6::3mpl+,is wir+d directly into the r0d contr01 circuit at two plac+s.

Both Of which must f Bil for th+ manual scrim to fail. ':imilarly, th+ h+y swit:h it wir+d dir+ctly into the s: ram circuit and als0 will s+nd a pow +r Off

. l

V g

c:

l'

[ ,

iignit to-....

th G., This-signal itop; th+ G from Updating th+ watch log g, - ;c,tifil rs and. aft r.f.!yi,U-:Qudi, tif, y,p/1.1,1 (!m Out, ?< rimming th Circuit if th+

dire:t relDy f ailni,to,dQ to Finally, th+r+ Or+ th+ andivleival rkt entrols

+

- - Th i+ dr+ run through tu G and 10 d-rn5n'.:1 cnat th+ inftwar+ b6 0p+r3 ting f prop, fly; hot.'l+V r, th+ wat:htlOg rtlay!'Or d+!iin d to scram th+ i;itguit in th V nt Of a i'.f tw3r IntlUr+ .a.ilutning th n (n3C th SOf tW3r+ il running,

[

.cnly thr++ of th+ (Out: rodentrols muit. function prop +rly to ihut d?Wn th r+0< tor, itch +rt3glin th+r+.mt)i.t b+ CWO f 9ilur+1 for th+ syst+m not to $< ram.

. 0V+r311, th+n th+r+ must t+ i+V+ral catastr0phic failur+i all 0<<urring -

.simultan+ously, none of wht<h is caut+d by an +v+nt which would trigg+r oth+r saf+ty syst+ms, for th+ op+rator not to b+ abl+ to scram th+ syst+m.

k Clearly, th+ +::pr+ssion is dominated by th+ chanc+ cf a pr0 gram r+1ay -

failur+ and th+ probabilitp of th+ cp+rator b+111g unabl+ to scram th+ syst+m is vanishingly small.

{

l l

{

{

e f

)

_ _ _ _ _ _ _ _ _ . _ m--__ --- -- ----- -------- --- - - - ---'--- - ---'-- - - - - - - - - - - - -

l I

COMPUTER / MAN.JAL I FAULT. TRCC..

m  :

1 C at.'.g. /

f Inte ia11ute I , }

Ihl I  ;

Op+eatce-Mitwar+ 1 Scr nr.1 $Ct*nra F niis f aili j $

~

S acL1;ps f t hr.tJ nl IIII scren. 1 R+1ty F nits 434,.4 Fntisto R,139 i t.+ + n

• F nil Et'J R4.j g

' ',jf' C*^If'I#

Does tJot flot n Ps**v+nt $it.qle II.ut 00'wrs F nil.se l

IE i

l F+1v) 2,5 44 Fulsto p ,i pj ,

C$+n f 3ji

(

i Dc+s fiet. , ,c , ,

Pr*+v ent 1 ggj, J

'5 h'J t bCWn p ggj,g,

)

l P 2

• l c ,,f m,= 6 Pp ,., ,,,3, + (P nge, Pg ,, ,* 6 Pnedctri) (51 )

i

)

j i

Failure Analysis 3:rmt,= .Many,of the. relays-in ti1+Erarn.(ircuit ar+ of th+ sarn+ typ+ and h+nce 7t .. mehave. identical f atiure:probabtitti+s:/ -Th+ high voltag+, p+rc+nt pow +r, low

h. ,~ --Wyer Wa.tchdog. fu.+1 t+ nip +rdtur4;+:2+rnal scrani, and prograrn r+13ys ars I

all sitnitar. An +::pr+ision for th+ +itunat+d failur+ rat + for r+ lays is found in lefilitaru Hindt v4: 217 E+vimn E It is bai+d on the +nvironin+nt, cycl +i. p+r l

hour that th+ r+1ay 15 +:.p+ct+d t0 op+ rat + and of cours+, r+1ay typ+.

Th+ Handtm<!: giv+s th+ +::pr+ssion for f ailur+ as

( ..

j ~ k "r 4 ( Pr.

• P, ' Pc ' Peye ' P

• Pq) f 3i!Ur+5/100 hrs (6) l

?.ssurntn2 a double pol +,:iingl+ throw, sol +ncid r+13y operating at 1+5s -

than 0n+ cycl + p+r hour, carrying 1+ss than fiV+ A!nps, th+ litsratur giV s th+

rnodification factor! as: .

p, = i.6 : Enviro 1:n+ntal Factor p,=1.5 C0ntact Typ+ Factor pay, = 1 Cycl + Rat + Factor pg = 12 . Faintly Construction / Application Factor pq= 1.5 Quality Rating Factor pt,=1.28: 1.oad Factor b=.006: Eas+ R+1ay Failur+ Rat +

Equation 6 th+n giv+s Ar = 1 failur+/100hrs. If Pgis the probab111ty cf a r+13y failure p+r hour, then Pg = 1 :s 10-0f ailurss/hr.

For th+ rn>nual s.: rara, control rod and 1:+y switch +s, a itnillar +:.Tr+11 ton appljs:

9 Wh+re:

[ p, = 2.9 . Environrn+ntal Factor p,=2.0 Contact Typ+ Factor

_______ - __-_-_-__- - - - - - - - - - - - - - - - - ' - ^

p,.,, = 1.0 : Cycl + Rats Factor pg, = 1.7 7 : Load Factor

=.- -

" ~ * ~ ~ '~

Tgthfd3F9BasFSwitch'FIlliitV Rat + '- ".~'

, ~

+ i- ~- . .g g. ~ ~

,. -p.fiMy[66'ja3 anct P;= 3 n 16-7iabur+s/hr. Ilot+ t that 'his

~ a -: = .

. . . . - . - . . . . .y . -- :-- -

is only th+ protabiliry of 3 phyitcal f ailur+ of th+ suttch its+1f. Hosi+v+r, b6caus+ of th+ r+dund3ncy in th+ op+ratt.>n of th+ Switch +s, as d+!cribed in th+ 3+ction on op+rator scrams, this probability is much larger than that of th+ switch op+r3 ting; prop +rly, but failing to scram th+ syst+m du+ to int +rnal syst+m fattur+.

For the conductors in th+ circutt, data is given by the IEEE 0U14 to the Celt +ction and Pr+tentation of El+ctrical El+ctronic S+nstne Comron+nt and t f+ch3nic91 Equir,m+nt R+1i3btlitv Data for flucl+ar Pow'r 0+ner3 tine Startens

{

Th+ Guid+ sug2+1ts from empirical data that for a short to ground, the probability is Pg = 1 x 10-7 (31!ur+s/ hour /10 circuit f++t. The probability of a short to pow +r is Ppwr = 6 10-0failurss/ hour /10 circutt f++t. It is

]

( ailum+d that a short to lin+ is similar in probability to a short to pvw+r. '

Th+ ground and voltage d+t+ct circuits w+r+ assum+d to hav+ the same failur+ rath as a s+nsing instrum+at ov+rall. This is a rath+r cons +rvativ+

numb +r th+n, as th+ d+t+ct circuits ar+ much simpl+r than most s+nsing iratrum+nts and have f+wer failure mod +s. R+ liability and Riik An:ilviis sugg+sts a failur+ rate for a s+nsing instrum+nt as: Pinst " I % IO' failur+s/ hour.

The probabiliti+s calculat4d in the fault tr++ analysis th+n, giv+: -

Psy,op=5'P3 2=5 10-12 Pg;3 26Pg2=2 : 10-12 Pe m p/t h

• 6 En + '$ P s4 "0% 10'I

l, 4

Pn,),;p = P,

• P,,,, + Pp,,,

• P i,;i + (2 P p,,,.)2 = 2 :: 10- I

lis _'.q.,,dU$ing bl+1EDUr.1b+r3 in Equation 1, w+ 3++ that:;_. ,_ _

~

"-- Phy.:.1"LO1_1)a1111ra/11r 1 cr_6+an tim + b+tVs n failur+s cf 1::10 7 y+ arse For thefa!!urts o:tisid+r+d: Itis.important to not+ that thii is not th+

.T.* Ct+d tiinY for th+ Circuit t0 go W1(hout fa!!ur+, th+ long lifstim 15 rath+r indlCat!V+ of thy inh 9r+nt.delign if th+ Syst+m in that all Single (411ur+; will Cauf a 3Cr3m Conditio11, thtr+f01'+,0111y (Wo or mor+ 1 A!!ur+S C< cur!ing simultaneously can 1+ad to a pot +ntially unsaf+ failure. Th+ tmprobability of this h3pp+ning is r+fl+ct+d in th+ low f 3tlure probabt!!ty.

L e

I L

f L ,

[

( .

4

I Appendix: Explanation of Equations

• l

.. . . . Thtf.qu,aggiiyjn/K.sy1tch

,. . , and r+13y f a!!ur+ ar+ of similar form. .

i

.7 ......_ .,

.c ..

. ._.. _ : :.Tn+y

_ , includ+.a. _tas+

. . . fattur+ rate for th+ giv+n component typ+ 0.f.) and -

l 5+v+ral-modifications 47's) be!+d on th+ individual compon+nt and th+

{ sytt+m in which it op+ rat +5 Th+ modification factors us+d ar+ +:. plain +d l

b+10w.

l l

p. Environm+ntal Factor p, Contact Typ+ Factor

}

py,, . Cycl + P.at+ Factor '

p, . Family Gnstruction/Appli:ation Factor  :

p q - Quality F.atmg Factor }

pg, . Load Factor j

t lium+rical valu+$ for th+ p(3 ar+ given in Military Hindtst 217 P.4v. E and hav+ b++n transcrib+d in part. Most of the modificatton factors d+p+nd on wh+th+r the component m++ta Mi10p+c standards or is considered "lower

]

quality' In the interest of 1:6+ ping failure +stimat+5 conservativ+, it is

{ aisum+d that components ar+ not MilSp+c quality.

f P, is based on the environm+nt and installation type. For a fi::+d ground installation, p,is 2.9 for swit.:h+s and 4.6 for r+1ays.

(

Pcis the s3m+ for relays and switches and depends on the form and

{ numb +r of contacts. Values for Pc are shown in Tabl+ 1.

Table 1 Table 2 Table 3 I!1D1 fc 1 h Rating 4

5Pli 1.0 .05 1.02 A .1 DPST l.5 .1 1.06 P .1

$ POI 1.75 .2 1.28 M 1.0 3Pli 2. 0 .3 1.76 L 1.0 J 4P5I 2. 5 .4 2.72 Not Aated 1.5 DPDI 1.0 .5 4.77 1 POI 4.25 .6 9.49 1

)

4P01 5.5 .i 21.4 6PDI 8. 0

o .

For pg, , tli+ load f actor, v31u+5 3r+ d+t+rrnined t>y f, which is th+ ratio of

.., th+ load.curg+nt.tt. th+ rat +d r451stivG load. P.r valu+5 for an inductance based

. _ _ . .. ._ +. . . u . a.._ e -- we. ... .: ..

=;;Zir.EM!in~old ~rasy; arf:stioWn.in-Teble 2 above. The r+1ays ar+ assum+d to t+ - --

~ '

9 !? ~ 7.~rst+:1 fo7 00V WlilIhiriv'+i an S = .2.

h For a switch, peyo is +qu'al to th+ nurnt+r of cy.:1+s p+r hour tt3t th+

t switch is op+ rat +d (pey, = 1 if 1+ie than Icycl+/hr). Fcr r+13yi. pey, is 1.0 if th+

r+1ay cp+ rat +5 St 1+15 than 10.:y.:1+s p+r hour.

Th+ quality f 3 :t:r, p.; .1t ihown in TStl+ 3 Tu r r+137 ratings ar+

unl:nown and h+nc+ ar+ assurned to t + ur. rat +d.

Finally, p,7,is ihown for s+v+ral relay construction typ+5 in Titl+ 4 t,+10w.

Contact Construction Pr Cilrreni Iggg.

8 $lgnal current Armature 18 Low mUvit and De y Re ed 3 mHmps Hg Wetted

( 3 Magnetic Latch 14 Solenoid f 6 0-5 Amps Arinature 10 Balanced Armature 12 Soknoid Th+i+ factor 4 can t+ plugg+d into Equations 6 and 7 in th+ failur+

Sn31ylis to g+t:

Ar "4 ( Pt.

• Pe

• Pe

• Peye

• P ' Pq) f3:!ur+1/100 hrs (6)

Ar .006 I1.26

• 4 6 ' l.5 61.0

• 12 ' l.5)

Ar = 1 Failur+/106 hr3

( A3 4 (p,

• p, ' p,y, ' pt.) Iailur+s/10 hrs (7)

A 3. 034 (2.9

• 2 0

• 1.0 ' 148)

[

A3= .3 Failur+s/100hr3

( _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - - - -

f .

Bypass Relay

. :-' Th+ bypass r+1ay is ui+d to cut the IG- 1000.out of.the scram circuit upon

_=.:.h:~,-r+'nt+r'(ng-puls+'inc3

. T +7,V!rdd thisJoccurs,' only3n+ m6dit5r fot-[+r'c+nt powdr'?'

~

,r+rnains abl+ t0 i.<rirsth system Tlv pr+ces: ling analysis on failure m 3d+5 shows that on+ of the r+asons for tP +::trem+ sal +ty of th+ syst+m is tn+

r+dundancy inh +r+nt in 011 monly ring syst+ms. This r+dundancy is compr0mli+d wh+n th+ r+actc<. p into puls+ mod + F0rtunat+17 th+

r+ actor normally stays in puli+ m' + for 3 v+ry short tim + so th+ chanc+ of a failur+ at that instant is v+ry imall.

l A pot +ntial problem could arii+, hc, wever,if th+ bypass r+1ay its+1f fall +d and the syst+m did not r+ turn from puls+ niods. In that +vont, the syst+m )

could op+ rate for an e::t+nd+d period without th+ NP-1000 to provide the j

+xtra saf+ty factor. If the bypass r+1ay do+s fall, how+ver, this failure will b+ apparent on th+ optrator's display. The porc+nt pow +r indicator for the

)

!!P-1000 will r+ main olant b+cause th+ CSC will not b+ r+ceiving any l Information from it. It is, th+r+for+,important that the op+rator check the }

HP-li>i>0 displ3y each tim + th+ reactor is puls+d to insure that th+ bypass r+1Sy has r+ turn +d the system to steady-stat + operation.

Not+ that +v+n if the bypass r+13y fails, th+ NPP-1000 is still monit6 ring th+ syit+m and would b+ abl+ to scram th+ system should th+ p+r<+nt pow +r

) +::c++d sta limits. For th+ circuit to r+ main in operation and totally unmonitored, the llPP-1000 would also hav+ to fail. This again cr+3t+s a situation in which two failures must occur for an unsaf+ situation to arise.

I Th+ new probability equation for th+ LSSS du+ to th+ bypass r+1ay is:

Pa,, = (P, ,,_,)2 , (p,,,,)2 . (p,,,j p, ,) , 3(p,, 2) , 3::i o-t 2 I

Inst +ad of Puu = 2(Pn 2) = 2::10-12 as b+for+.

l This itill giv+$ an ov+rall Prium lx10-1 I f allur+s/hr, or a m+3n tim +

)

t+tw++n failur+s of 1::107v+3rs.

l

Calibration Checks "swiw.u / At4yst4ntstar.thp?thiMahbratiorfof=s+v+ral syst+ms is 'ch+<h+d- -

~

, _ -n . ~ =.-:.:.. + ,. . -, .-- . . . . . . --

GC64.automhttcpily.. Ih'+M systsin ar+ high voltag+ monitors: p+rc+nt pow +r

. ~ "~ monitRs, TORT +mp#5tiffstiidnit4ti,'andTh+ Gitchdog tim +rs Th+ 10t!

~

.wat+r 1+ vel, +::t+rnal scram s+ttings, rnanU31 Scram switch and t'y 1 witch Br+

not t+tted by the auto pr+t+it and should t+ <h+<h+d manually.

[ Th+ p+rc+nt pow +r, fuel t+mp+ratur+-. and high voltag+ monitors ar+

<h+<t+d by m+ans 0f r+1ayi tvhich switch from th+tr normal poitttons to cut the monitor 3 out of th+ syst+m and allow a (+it curr+nt to b+ run through th+

trip 3+ction of th+ syit+m. Th+ CCC monitor 3 wh+n th+ syst+m trips to insure that it is at the sp+<ifi+d point. The relays th+n r+ turn the syst+m to normal

[ operating mode. To check the watchdog timers, the CSC sets +ach timer and mah+5 sur+ that it tim +s out at the appropriat+ time.

( For th+ high voltag+, perc+nt pow +r, and fu+1 temp +rature syst+ms, if ony r+1Sy fails to r+ turn to normal op+ rating mode, no current from th+ d+t+< tors k

would r+ach th+ monitor cir<uits and this would resultin a scram. II, howev+r, an entir+ syst+m + g. the fu+1 temp +rature monitors, falls to r+ turn

[

to normal m xt+ and the calibration current remained on, the monitors would not scram but the det+ctors themi+1ves would be corr.pl+ttly cut out of the system. This is obviously'an und+sirat81+ situation. liot+ that th+ only way for iuch a failur+ to occur is for th+ CSC to 1+3v+ th+ calibration signal active

[ end fail to r+ turn th+ calibration r+ lays to th+1r normal op+ rating [ctitions.

M+r+1y 1+aving th+ r+ lays in th+ wrong 1;otitions will cause a scram when th+

( calibratton curr+nt is turn +d off.

If both of thes+ failur+5 occur in one of the high voltag+/p+rc+nt power k

monitors, th+ calibration voltag+ will b+ pr+s+nt and show up as variations in

{ p+rc+nt pow +r and high voltag+ on the operator's display on th+ CEC

1 (assummg that th+ calibration curr+nt do+s not +::c++d th+ syst+m timits and

. . _ q_'sals+1)for.oitie0._.Albxsintv.ths calibtation of +ach monitdr unit is J ' " x

~l )

. . . [ k hhk PYO Ill N I TO.U.S I35I I ' tl 57 I s Who + to OphratY in

~

Sn unmonitor+d mod . If, th+ failur+$ occur on the fu+1 (+mp+ratur+

monitors, th+ CSC diiplay ih0uld Sg3in iho' 'ortations du to th calibration curr ut. How V+r. the!+ unit 5 ar ch ck+d all St Onc+ so if th syst+m (Sils, th+r+ is no backup syst+m and th+ fu+1 temp +ratur+ r+ mains unmonitor+d. If ths voltage continu+s to ramp as it do+5 during the calibration che:t, though, it should quichly trigg+r a scram on itr., own. )

Th+r+ ers bastcally two failur+ mod +5 associat+d with th+ watchdog .

}

tim +rs: failur+ te r+5+t and failur+ to tim + out. Both cf th+iG movi+s ar+ t+st+d in th+ pr+-start cahbration ch+ cts by simply s+tting th+ tim +r and 1+tting it )

tim + cut. Ev+n if the CSC g+ts stuct in th+ calibration mod + lt is a saf+ f allur+

as in this mod + th+ CSC waits for a tim + out a'f t+r s+tting the tim +r. W+r+ th+ )

I syst+m in op+ ration, the first such time out would caus+ a scram. Th+

wart.hdog timers could also t+ r+ set by a random signal, but this is unlitsly as two pairs of tim +rs would r+ quire a r+sst. Th+r+ ar+, th+n, no unsaf+

failur+s ai!0clat+d with th+ watchdog timers' calibration.

Th+ additional failure probabiliti+s for each subsyst+m du+ to calibration of th+ syst+m ar* assumed to b+ thos+ of th+ +ach subsystem falling all at onc+. Ther+for+, th+r+ are two t+rms to b+ added to th+ ov+rall failure

+quation, one for th+ fuG1 t+mp+rature and one for the p+rc+nt pow +r/high )

voltage monitors. Th+ t+mp+rature system has thr++ relays which must fail simultan+ously and +ach IIP unit has two r+ lays which must fait )

simultaneously.

Pqwn, = P yai: *Pugi2 = P 2n

• Pg 2 = Pn4 = 1::10'24 Failures /hr

g P p ,7, = Pg3 = 1::10-18 Failur+s/hr l .-

Z__-."._-*- ,Wi,'.fTe,.iW,~tZW,._5Et1Tiikff._Midirsti,f,its --

.' 6. rd,+r1..t..f..r.n. .igh.i.tu. .l?. im.all+

'*:'..~-'.:-...

,, ; n. .. ,,,- -... .., -

ir-71+ thc3a.for tu+ sylt+ta:a3 a whclE Th+}&du3 tot significantly affEt th+ cy+rall-

+- -

b nrh-f'[h b / f: --

1

/

4 l

s v

(

(

t

j Monitor Channels in addition to th+ scram circuit its+1f, safety system failur+s could occur

=:.

-~ --"- 9 n ):.zz =.x; ; : c: --- c- _ 3 . . , m- u m- .= m --% =: __- ' ' - -

ZMyiri,tri(hjFriftotTttr+ iris 41FFyffmonitor chann+1s'of slei!Ic tmport ars trr+~ " ~ ~

" ' ~ ~ ~

i$Niim[5aturs modiSrsand the lip E IO0btE5 !!NP-10'00 perc+nt power / - -

- high voltal+ monitors as th+s+ ar+ critical to th+ safe op+rati0n 0f th+ syst+m.

For this analysis, th+ <hann+1s ar+ all assum+d to hav+ th+ instrument failure rat + shown in th+ abov+ analysis and all failur+$ ar+ assumed to b+ unsaf+.

j This is a cons +rvative estimat+ as som+ common failure mod +s, + g loss of signal from th+ d+t+ctor, would caui+ a scram.

)

Th+ instrument failur+ rate is giv+n by Pinst = 1 :: 10-6 failur+s/ hour.

l IR.t+ that this failur+ rat + is th+ same as the failur+ rate us&d for the r+ lays in

)

the circuit ita+1f. For an unsafe fuel temp +rature failur+ to occur, th+ analysis i3 id+ntical to that for the scram loop itself 1.+. both must fall for th+ system to b+ unsaf+. This 1+ ads to s+v+ral p+rmutations of failures which are unsafe.

j How+ver, all r+ quire at least two failures. The original expression was rT P +mp

= 1::1012. Now either the monitor or the relay can fall, but one must fail on

+ach chann+1. Th+refore:

)

P 77 ,mp= (Pg + Pi )2 ,4 7, io t 2 f ailur+s/hr.

! l fimilarly, fcr th+ NP-1000 and NFP-1000, the added failure reJ+s increase th+ numb +r of possibl+ failures, but th+ syst+m redundancy still J

l prot + cts th+ system. For the NFP-1000,in addition to the monitor failure, a l

1 gain failur+ ts consider +d. Th+ NFP op+ rat +s in a s+parate gain mod + for '

pulse op+ ration and w+r+ it to switch to puls+ mode during steady stat +

operation the NFP would essentially b+ useless as the trip pointin pulse #

l mcde is much higher than for st+ady state. Since the percent power and high

]

voltage failure rat +5 are incorporat+d into diff+ rent parts cl the ov+rall 3

fattur+ mod +1 and th+ p+rc+nt pow +r failur+ rat +s are also aff+ct+d by the j

bypass relay,it is +asi+1t to loch h+r+ simply at the incr+as+ in failur+s - ,

caus+d by consid+ ring th+ rnonitor channel f 911ur+s. A d+talled analysis is

...m...-.p.r+1+nt+d in th+.f0110 _ _.- . Wing.+::ampl+.

- Th+ additional fa. ilur+ probability,

. ;N ~ ~ .. = . - - - ~

• N w gw .m.: .i ~.,3;;. % .*;;*'A fw n* ':* d^. ' . . . -

• i 2 ^ ' -- ~ ~ * ' ' = * ' " - * * ==*- *^ - '? '

"~' ' " ' * * * '

. ,; . . conaidsringdhe.ints,12ctic.nof t))+ byp,a,ssar,+1ay,a"nd)1PP gein turns out to t+: -

- i---

n.... .

., ....; v ;_-. -- _ . _ , _ _ _

l ir ' N :.::.Pri?/mma = $ = 1012 failur+s/hr.

1 c . .. ^r Thiiis Os+titially a'n incr+3s+ of 1;l'x lb Il failur+s/hr and trings the ov+rall failur+ rat +, incorporatmg th+ bypass r+127 and instrum+nt failures, to 2:1011 fattur+s/hr. This givts a rn+3n tirn+ b+tw++n failur+s of ?,ul06 y+ars.

l'ot+ that this nurnt+r is +1;+ntially doubl+ that f0r th+ bailc syst+m, which is t0 b+ +2p+:(+d as th+ instrum+nt <hann li coniid+r+d had ilmilar failur+ 1 rat +5 to the r+1ays m tt > circuit iti+1f. -

(

[

r L

(

(

(

(

Analysis Example

...= The followine

-wg- %*M'=is an +::agg+7:

^i2 ._. 0f.th+-analysis-us+drin thTs.ia. __  : ....~- : :~.-- =~=~

.?(C1-;1,.;1ricg[lpsatWpirMt~ pow +i syst+m the j_ . . ~* . ;, -

~W

' . ~ ;.v . - : _

~*

-- ..'. _.a . ca.u. i.+ att unsaf+-5ituation.

. r+ ar+ six failur+s whi:h can .

ljPP- 1000 monitor, th+ llP- 1000 perc+.. -Th+s+ ar+'failu nt power scram r+1ay, the !!PP-1000 p+rc+nt pow +r scram r+1ay, th+ UPP-1000 ,

puli+

gain mod + r+

mod + bypass r+1ay. In all cai+i. fallur+ of ry to two .:ompon+n caui+ an unmvntr0r+d situation, but nct illinfailur+ such pairs will r+iu a situation. Sinc + the NP and liPP ar+ nton diff+r+nt lin+s ,

must fail in +ach i.+. an NP monitor and flP+ scram r+1ayl fail combination as th+ IIPP-1000 is still fully 0w . functional Th+ tabl+ >

illustrat+s the possibl+ failur+ combinations .

1. ~M hff % hffr.s NPP-M -

h! .B hr.:_g suas, s g J g

her-a u u s -

s u ,

hee- o s ,

5 _

)

AP-M y y y ,

} hY-R U y y , }

Bypass U y g

g g g ,,

/

APP-M: hPP- 1000 Monitor hPP-R: hPP- 1000 $ cram Aelay s hP-M: hP- 1000 Manitor hPP-6: hPP- 1000 $ala NP- A: hP- 1000 $ cram Relay ,

$1 tafe f ailure i.e. system stiH monitored typass: Bypass Aelag U: Unsafe failure, system not neenitored Th+ tabl+ cl+arly shows the increa;+nalin failur+s from the or mod +1, Which had a p+rc+nt pow +r failur+ rat + of I :: lo 12 (NP R -

and !!PP-R in the tabl+).

f, :: 10*12 Th+r+ ar+ nin+ unique failurs mod +s shown abov f s

+ or th+ incr+as+ of

• discuss +d in the monitor chann+1 s+ction .

1

4 i

L

( Conclusion

, . . ... .m .. AsStathth.+fprAthis_analy.11s,.giy+.s,.a.n

- . ":n

- - oy+rall.failurs probabi.lity of 2 %. . .

p-

-_ .. . _ . .. x

..!M.g:fiilu.:.=ac.u-n -u--- a < .

--. .  :=a

y. g... 2 r.est pet)1ou.tr;m lus gives.an appro:amate mean tim + b+tw++n - .

-~ --

< =_ , _ .

-iG_ - -d. ailur+5.0.f. 5.:;,10'.4.y+ars.-k+ spit + th+;s++ ming +xtr+mity of this dumb +r, it N :-!c.wascatt+mpt+)1 throughout.th+ analysis to mal:'+ 311 assumptions as cons +rvativ+ as r+350nably poliibl+. Th+ inher+nt r+dundancy cf tn+

sy5t+m simply mDhes it highly improbabl+ that an failur+ would dystroy i rep's V.y.o k #-----

I

,s'f5tA d ep"* L/e r * [43 *!

-- i e

the mt+grity for WAT U Tr u of th+ saf+ty/7 &mq/ o.,ulus c.

-[ 8

( gKt~ mis point, a cothparison of'thiTa~fety systam$s rMtIbtfit'y t6that e ~

A

{

th+ physical syst+m its+1f might b+ of int +r+st. P+1tability and Risk Analvsis l giv+s th+ failur+ rate of an individual control rod physically sticking as 1 x 10 4 p+r day, t e. 4 x 10 6 failures per hour >T!t / :c.t .i ., wha ;,, ;Mr.g

{ C. . J.tcl . .J ". . ;.s .. . ..t vi !!. u , o R e n eri. . . th . : . '. : * : r :; 2" W -

> !.suie m 5 f. LA r: tus ;.nta m.rei.e.1tv e pisk..ch u3id avei; a .

b a:,,+1k "r;7 l ,;;gcz ,3w ,,,g.; 6 ;;,, m t ccm ;i,;;d. Using the thr++

{ cut of four le>gic that only thr++ control r0d5 must function in ord+r to cause a scram, the probability of failur+ +quation is identical to that shown for the

[ program r+ lays in the Computer / Manual section and is dominat+d by the '

3 t+rm 6'P/ This gives a failure rate for just the control rods as 1 x 10'10

(

failur+5 p+r hour.

( Grant +d that this numb +r still provid+s a r+assuringly long m+3n tim +

b+tw++n f ailur+5 (1 x 106 years), th+ point is that this small s+ction of th+

physical plant alon+ has a failur+ rate which is almost an +ntir+ crd+r of magnitud+ gr+at+r than th+ failur+ rat + for th+ +ntiro R+ actor Saf+ty Syst+m. Cl+arly, the R+ actor Safety Syst+m is on+ cf the more r+11atl+ parts

( of th+ r+ actor d+ugn and is not lil:+1y to be r+5ponsibl+ for any syst+m failur+h ie sc.n.ws.

(

e

1 I

l

)

1 APPENDIX R Analysis af Ely_g, Dollar Rama Insertion )

Qygr a Iy.g.Second Interval I in 1hi AFRRI TRIGA Reactor 1

i I

I l

)

l J

l l

s

]

r Revised

4/26/88

( ANALYSIS OF 5 DOLLAR RAMP INSERTION OVER 2 SECOND INIERVAL IN AFERI TRIGA REACIOR

(

(

l l

1 l

( Work Performed for ARMED FORCES RADIODIOLOGICAL RFRMRCH INFIIIUIE Bethesda, Maryland

[

{

57 l

cEnERAI. moMICs

[

under

[ Contract DNA004-86-C-0011 A - Amant P00005 April 14,1988

(

r

AFRRI RAMP ACCIDENT Sunmary - With the computer controlled TRIGA Mark F reactor the control rods can be operated in a bank which makes it possible to add large l amounts of reactivity in one action. The speed at which the rods can be withdrawn is a variable parameter. An accident scenario is' postulated such that during a startup, the following sequence of events occurs:

1.

The transient rod is fully withdrawn preparatory to going to a steady state power;

2. The shim, safety and regulating rods are then withdrawn to establish criticalityp l 3. This withdrawal occurs at a speed which would withdraw the total rod- ]

ban',i in two seconds from a sub-critical condition; aco

4. The safety systems terminate the excursion by scramming the reactor at 110% power, i.e., 1.1 MW.

]

The consequences of this accident are trivial. The maximum fuel temperature is about 3300C. Although the excursion results in a peak power of 340 MW, the reactor power is below 1 MW in less than 1 sec after the initiating event, i.e., the beginning of the rod withdrawal. In Fig.

1 there are shown the results of this accident.

Analysis -

Use was made of the computer program BLOOST3, a lumped parameter neutron kinetics, thermal-hydraulic program. This program has been used extensively in the analyses of reactor transients in which

)

reactivity changes are rapid and the event is of short duration.

]

In Table 1 there are listed the reactor parameters used in the enalysis.

. ]

-1

I L'

TABI.E 1 Reactor Parameters Initial Conditions:

No. of Tuel Elements 87

{ Core / Coolant Temperature 25'c Initial Power 0.01 watts Cold, clean excess 3.5% 64/4 ($5.00)

Rod Worths f Transient 2.56% 6s/s ($3.66)

Shim 1.30 ( 1.85)

Safety 1.30 ( 1.86)

Regulating 1.27 ( 1.82)

{ Prompt neutron lifetime 39 psee Fuel einment specific heat (C+7T)

C 821.7 joule /'C 7 1.67 joule /('C)8 f Core water specific heat (per element)

Q 860 joule /'C Delayed Neutron Data I o A (seeQ),

1 2.310 x 10-4 1.244 x 10-8 2 1.528 x 10-s 3.051 x 10-s 3 1.372 x lo-a 1.114 x 10-1 4 2.765 x 10-8 3.013 x 10-1 5 8.049 x 10-4 1.1362 x 108 6 2.940 x 10-4 3.0135 x 10e The integrel fuel temperature coefficient is shown in Fig. 2. The coefficient itself is approximat.ely 1 x 10-4 As/4*C. The coolant temperatute coefficient was assumed to be zero since it is relatively small and, also, because in the excursion little heat is transferred to the water.

With only the transient rod withdrawn the reactor is suberitical by 0.37%

ds/s (30.53). The withdrawal of approximately 10% of the rod bank occurs before criticality is achieved (based on a normalized s-curve for worth

vs t angth withdrawn) so the 3.5% d4/4 (S5.00) insertien occurs in 1.8 secs instead of 2 sees. In Fig. 3 the reactivity inserted as a function of time from the point at which A = 1.0 is shown.

Since the transient is terminated when the reactor power is 1.1 MW (110%

full power) only a portion of the 3.5% ds/A is inserted at the time of the scram. A problem was run to determine how far the rod bank was withdrawn when the scram occurred. The reactivity inserted in the ramp was 1.305% ds/A ($1.86). This represents 'about 34% of the rod length. l To this must be added the 10% withdrawn b> fore criticality was achieved.

Thus 44% of the rod bank length is out of the core and now participates l in the scram. This portion of the lensch represents 40% of the worth of the bank, or 1.55% d4/4 (32.21). The total scram activity is, then 1.55%

+ 2.56% d4/4, or 4.11% ds/s ($5.87) total with the pulse rod worth added to the banked rods. The rods fall under the influnnee of gravity in 1.

see from full out to full in, following a delay time of .015 secs to-allow the magnetic field to decay. Since the rods are also influenced by the resistance implied by the passage through the water, the rate of insertion is not as the second power of time. If there was no resistance l

the rods would fall from full out to full in in less than 0.3 sec. By

' assuming a resistance term that is proportional to velocity and that the

)

l drop time from full out is 1 sec, the reactivity inserted as a function

{

i of time from first motion is shown in Fig. 4.

l Conclusions. The postulated accident scenario in which a bank of rods worth 3.87% of d4/4 is withdrawn from the ATRM TRIGA Mark F in 2 secs, with the safety system functioning, will cause no damage to the reactor or harm to any person .

1 3

l

i l

• T J

__ e . __ . _ . . . . . . . ..

r . . . . . .. .. .. - . . . . . . . . . .. . . . . .

l- . . . _ . .:. .. . . . . ._.. .. . . ..

( _ _ _ . .

i

. . . . . . . .% h. . .I $ $ N. . .

- - . . . . . . ~ . _ . . - . . . . . . . . . . . . . .. .s. . .. .... .. .. ..

' . . . ,l

_ ... ..... a. _ . . . . . . . . . . . . _ .... __.. .. .;-

. . .. . . t. ..

( _

f ,

e I .

( .

. 4.

.4.1_.._..

....4

_...... ......i._ .... . . . .

.- a. . . , . . .. . . .

,.... .s.. 1. 4.i.,,... . . .

. , . g . .. . . ... .. .

1

.o..

.. 4

oo 6 . ,

~

l , ....t

6. 6 .

. - . _ , . _ - ,L. ......m._.. ..og

_ i _ _ ,. .t . . .. t - J _ .t._, .. ., y,. .,

i. i .

3 .

j..

...L

.t.'.L--- ! p 1.- g- . : .

t. . . . .s..  !  ; . .1  !

- .m .-

--. . :- 1 s . t e. ..

O.u u. .. . r -. t-.: :.. ,,. ... ..., . ... s. : .:..: . . ,;. t , l.,.:.;. m. t 1 t .

,.4 . - ...i .2.n .

i

. . 1 w * .w ._. .. .. . _ . . t u. s q . a ..t.J. i . . .

.- . ..,.y:

. ..n..

. . . ..l.. . : %

- ~ - . ..; . .1  ; .

.  ; ~.-; .

. y. f. .,  % -. -

. - u. . n. . . .; y 3.- :.. .u . ,

1

- u , r, .

. . , . ;,. .,, j w.r..<

. . t. . . .. r. . .x

. . . .. ,, .  ; p,..; _. --

iv. ... 1 ,y. ; . .; . 2,, . ; ..,; ... ... .... . ja \

t. .: ..-. . + .,4

.... . . .. . . . ... . . . . w . . t t. ,

. . . . .._. ... ... )... .... ......, .. .. .... . . . .....i. , . . , , . .%. .

. . . . . . . ,.. . . .g .t . ... .. .

{ go 4 ... . ,

_. . .6 .a. b l.

3. l ee t e n . . %'

.t *_' -

" .3 . '

• .4,.

r.'

t

, -, 1!e 4

s

• I *

.-I- _E. . L. .g

k. " . J . ~ ..t. $)A . .

f . .. .s s.. J.,.. -- 8

..g . _.. ;-

, . g q .; .-)

i

. _.3 ,

• g , ..II ap re . ( .. i ., l 3 c.

Iy

s 9.: , .6- . 'i . .

e. l

. ;. 1 - f C..* i . f 1. '

--.. .'t . . -

_ _a . . i

}._ . .. .;. .. . . _ 4 4

. ; a . . ._ ... t . . . . . . .. .p.: 3

[ .,

)

_f, . .c u - . _ . . -

. , ,y

_..,. 4. 4 y M f . - . 2.

z

. y -.L_

......i I

..t, --~

m

- ..l. W . Ih.h. , -

n

, _3e =

.: i

!.l: }. ,

. .. .; . . . . .iI .a g

,, .g....

m._

a. .._._..

.m N l_____ . ..

p 3 @.

. ,,. b,. . .p.ny . N. . .. . .

_ . . _.. . . .g ,t . <. . .,...;. ;

4 . .

L, ().L 4..... faa , .

,, .N vm l g N. . I......

-- e . 6 . ,M

( ._~.w,.

_ . -J_ -

..g_ . . .... .. ._ .. . . . . ._. g

.._. 5., s__x; . _.,

g, r,,

-. .. . . L. . . . _ . - -

i ,

. . g.; i . . e.d J i v 3

-__.- _i. f

, _ .T. g A. _ .

4. . ..

. . , . U

. . . ..?. . .. .s. . . . . . . . . . . .

. s

_ - . _ _--_t. ,

5

. ._.._l . . . ...... . ...

.. .a .. .!

7. .

~ .. - - _ . , . .. ... _ _ . _ . . _ _ . . . . . . . . 4.,

~l

[ i O * *

• g.) 0 01, ./ .k . . TcoW. Mde ,

4 g/g, . . . . . _ _ . .

. _l IO

. _ - .._. .. ,3 . . ... ...+ . _ _ _ - . _ . . . . . . . .

- .. . _ . ,L

. m. . . . ... . . . . . _ . . . . . .

- ./. . . . ,

. _ _ . . . -.s.- s g .d g. '

-/%mesp. _. 4. . . . . .

-. . . ... .__...........4......_4-. .. .. 3, . J

( -..

. . A ". 4 . .. .. . . . _

l. g

. . . . ...j.

_.. .....-.....tr.

- .. /. . ... . .. . . ,

e t

( /

l n s, ya * ~

I

[

o.n p lo. i n.

% tevf1 W (2oo #4M M

( _ t?av 4/n /se Y W

1 l ! l .

l i

l .

l

_.' i l i : -

1  ! l I - is a

' l '

l l l l l -

l l l li i i i i l 8 l I l l l l I l l l 'l  ! l 1 '! l l ' l I i i  ! l i i

.I . l. l l l 1 l

l l.j. c i. -L h .i . i 4 l 1; l- l l ; i.l l l l i

l 1 l j j i I - l. t -- : ri:-- uis .=Wi:;.', 4 i l it t I I i 1 i i 1 -

! 4 i ;

i l- l ~i : .::u 4 - l-- L- d  :: \ (1 -h: M i-l- -!. I ci .I 11 _ ; I ' : iF l

-- F. .b z:= =l:-*_j=?53 } iS'Eli::f=- =lZM MS-r-k=i=-l: 4r:: cil_ t fe"! ~iJi "= l : :-- - -

1 I !'J

.. =: h_LI5"-M M r -hi~_= f- ?- - 52-N.-iEEl~=i -lEiE15 M ;===i'- ci0-f fii h 4 :4-i!:

l 5_::

=i='d_- '" ~ Z__CC_1EC__5 ED5455f'=0== l=$=Y:5 N 5!_- L = h:=! = .

i-" - a JE - ..;i--d

-i =-: =d =d C_-*-i---_--i-~-

- = -

i

~Z .":E!~.-'_-f allEi=E_=lsti_=iti:M-f4. =r '-i # -

i =id 4  : =c=n=:__.____e_-_._

+

==t

_.__. ____g_,._..

u _-r -f = - _ . . - r- r : = -- f ;;: ,_ : . , ,, , . 4 __ ,= : - l , . :, . -

% ==. 4 - - - :==

+

i,~i- ~ i -_. h. :-- -h- -- =., . n .- _ a. I-~--

w _-- r--=-- V . . .-

_=:: 2 -A.

.,S 9,6 u_ =_;.=_. g _ __.m _._ t ._ __ . _

._.=-._a+_.__.=g=g__=__3,_,__.=_w.___;_.___

c% .

-.__ . g:.- ___._x r- - _- =- : = --- 4 _:-- ; . t-- u - . .__ .

__a_ +- -_

_i :- . 0 -._2 L._. . __. w.w _ _ _. . .._k---*

._.__,_m___.___

.e y ,

_.. _. _ ._ ._,__.__gm=_y_.=_-.._..__._. g g .. ,____ g. . . . .

h ..._

l $.0

'E= 1E- .- ~~ .a

_.__-_._

==: _r_:&

~W _. ~~T T _ t- eel == K=E_M=h:1E=

g ..=.t.=_a. ._ _=_=r .______. _ _ . _ _ _ _ . _

. ..____ __ t__ 2 .___b_ t _7___: . =. _:g=. .=__w_ _=g_

.._ _ . .. . _.=.g.i_  ;

. _ . ss_=.a. /._. . A :. _

sJE= R = = b ._ f..___- a-E 1_.- , :.Jg Z-4=E=l~!'

_ "~I= 1:EfEF" - f =f-Mel*F-h El. n 3 s. . _y_.:=_ _ ; _m.____ ___ __ _ _ _ _-- 7__

_ p.- - ; - q__=._w=g.-.=_._._

y_ . . _ _ . _ .__ .__ .__ .;=. ,_i. =f3_

. . . . . _. .s. _ l _g n_ l__. .F :_

d ,# -" d " =f==Ff U~:Et;E:6- -C.LW= FEiEE!aEi _T=I=ii=i"-MMi==aiV;-F_is=-iu.h F :M

. r 11. - "-P it=A- =tWEiEM-E=f_ EWi!:~~T=F= tiff =iW=4EE vf F.~= :-M:i5 m Mi=lDu=.

i =l=i=< lee'4i:-# i:=Eif= =5tE=i:="F=EE :+W2lE:R:EPE;l - 3EEE /=-FJ. i= --; : E:19i =

-t:!E:4 ="=L =MKe=_;"t's ii#r-i-@dfl =4=U=hlM:=VEQNA 1- 19.=f jy g~~~ ~-Fsd-i-P : =l=-ii :la-7=t-idE Wa:!PL r1:+i: E-i=Elzein=l+:iE=l/i: &: -i : ; !

et= .=;i.==f_ + =t ci=-l= 9 =t el.miE; l+F J t- I -! "H I- I m

-t : :=lii- IT/ mI d..I I I I

i y l . .w I: .r=: ==. J.[_ x.= ni.; h v :5.-y!.p..-p :+,pmai l.;r_;_ f:- 3: q I l i t. -l 1 1

~.-

J :=_ r J-4=P '-Ji +-!+i 9:= F-E-i= W: ~ = l :!si / ndi :-P 2- N !h 1 l-  ! i l

-' l Hi--i-E Ji= :-t+=i =i K+#iv w " EB FM=-V:=

i 29

,, _=O:l= i r E l- J-! :i .! i  !

4 i-al= e =- 9= l +i=ii f:a.cM XE1 =M M =NVi r-MiF=n ~=. k=1 .h - l = :- i-: 1i

.i:~i g

.!;i- 1I L

--1Ei. E!!!=?=Pd=_ Ele =f =h =i-Eii=F. :i@Ei.=9%= EWE"FE P'E -l!N l - - l M- -  ??il # fl 5: H t :-fM.f2 ih9 ') cf-9:sMf-#.=:li/M@-MEE4.Ehh 1:= # = f !J = t-F :~:- -! -l -- r 4 NI"i.u l E r j=;iEEjI+ .']i E=:.=up -M i.j .i=JEE!:_ =l.._.i._ -- :.= t'-( r.l 9_T 7 ji / :l -

yh g, 'a - . - F kf_~'-I i zc i1=. ,j - . } n--y::::p:"g:--y 3.=y=- !L:y-tis s - q . :- p .:- J .j q. _ j h , p q e- t.t.Ti; 4; t / .i. 4;.i;el* u. k -t a .; ; ::-- - j j i l

'1 '

t. .l /- ; 1- i. + p ! - p ; ..; i i i t q  : .- ._:lF- U [ / j. jf. 'i_ i n.L . f p. l-n 9.6 I .

l 1 l_ l l  !. l

e. .t c n. g j ..j f / ;p=- p . l _c p j . j .r. l e l l ,

l ej. l .-J_ l 24--j Tf  :

J_ . u- - Q4 + .r- aj.- . w-- [ j- l l l

} . - l 2.t l ::_ -d.::p/ i ;l._4 -l .: qu. [. ;c .t .p- eg. : l . ; .I ,

l. ] l 4

) ,.)_, . j _:. , A _: pt j l l a. . jr a t.0 r 1: +.r : l i l l I

I p. , f . l J- -ls i l : l -; _ l .=;- iq p .T.r - l . = . j. l l l l l l '

I fj . l - [ i l l 1 l .

l _ l -l -

l l.i , I i i i i j l .

I r /. I i-  : I  ! 1 l I I I .

I I i l i i f i e I i l /l l l' '

l 1 l I l ; ! i l ! l l b0 l l l  !  ! l l /e l I I i I it l l r l l t I l >  ! l  !

l /i i I i i l l l l I i i i! t l I l t I  ! l

/ I i l i I i r i I i

'i l i i l l I o/'

O

'I nod i i I i j  ! '

t i i i i i i I i i too Sea 400 Ed o &co "Do Soo joD I@Mf @ % h a h

. l l ! l ! l . l l ! I i l i l l i  ; t l t l l . l ;

i l l I l l l l '

l } l l l l f! l l l l l l I ' l 4 l1 I l l!  ! l- -

l  ! l I  ! l I l ! I il l l l l 1 l- I -i I I  ; Ii l I i I i i ii i i ! I I .I i i  :

IFl -

l-l- F l- 1 I i i i i! ! t

- !" :L b$ W F Veter M L -ard.#

I i l -

i l I I

, ,; -l:..jr:- . .j.l. ==}[: Qin.1=. ,". y.. - l.._{r. ngl: .hl .. . l ; :l .

.h . . [, :l . .l ..l l ;' .l- . :l i., N--j. W : -= i . . n K'- =j =; b:_~i.i-l ; jit: p hf @rj * .

a ' . _J l :, il .:l E.l. :: '; [ . . l .:f, u.$. . l .: . "

T N N[E _Mi!+ =k~Ehk. 5 7. NN .NN ii.dp*'if d ;

=fN ',55 '

4 - IIf--[$f!.C n r.

p ; =.

._---t -

. r_=<

._m_ -- -_~ f_E -- E-b'.~ 7 - _ ~~.

._a =- - - - -

e = =-

.: -- =t-

--a a _.- _-

.~.~ i~} :. . . .m- a. . :- - -- . : r ; m ;,: :-

40 ,, _.

. - = b -----t  ; ,; _ , . - _ g .__. . --__.,__m_ . _. . _ q - --.

=.7  :- - -

--t

ZI=; _.f_._ , cq. . i. " ; ; . ,

...-t_

_4 __ . _ _ . _ _ _ . __2:._ . _ . . . _. _. J""E

_s. __ .___;__.

jy - __u__.__4 _ r-r.= -

g __

_ _ + _ _ - . . _ .

e_= .=3; - ;_e.

. _ , =.rr.. =. r.p 2.. p. e-a. _ . __

. . 3. . q.r .._:2. _

.a.  :

. . .j. - : __J -- _____,;==_---- --~ -

--L._,_. 3=.. :.=:

w ; =_t-_ ;_ ._.  :: :-_d. . :.l: :,:2

.a$ g _ _r'i

-  :

=_:_-+ ,_.

--- +

-:= --

- u--t ---. : i ~ __ _ _ . _ ____- ._. . _ __.  :-1:=.1. : .l=-- 2.;ir::ir:,e=

r r .:--I-: a 2 _-.P.=. . 3...-

= r. _ g 2

.gg :.4;. - 7 := .=_- --

2 .- __ _. __ _

. _ _ .A e, _- - - - - - _ . -,--

=,_  : .=w = g_ ,_

m _.__ __- -

. .. .___c -

_t. :_ v w--- _=T:_ _=;f_. , ._, . .t._;. r-: g .:_-

-~ =v

- :=- = ::s : , .=.

===_

u.;_ ,_.g

_ ~ f+.1_=E- r=:3= :_

_ 7c-b = i =-- _:-/.-t .,

=r _

2__. .._ ._ _ _ . _ f __ =:= --

_._. _ 1_- .:r-_ _- _ _-.=

=,1 - .-

per:s . --

- - . - - := = - - -

g - L. . - . m= __ . .. _ - - _ .

e - = - -= . . 2= _ _ _ . -

u:- _=-w_==2: ==x; cap:p=f_.:r-= _.

- =

. =--e.-

==~-

=r -l Er3it--M=i==U --

~-- -

. ~~~~-l = E i: 2 = 5!"' "-!~=l-/-d"15'-4===Mf_.t-Es

% . r=-e:re=,= . sj:= -=]=sc =ssaErgets m ete Et=t=:.=r /:t.5tMgN==i; =5[gr :f4 3i u j =.e =; 3 =4g= =;.-%.e-i=_t-g!+ gt:y.

i.p.ps3:4.L-fp1 -/ g=-r_sp ! - .c-g= t-;4=;jr.m.c 1- 8 sc+ : -g::g=Tsa . :_.. _-l E:u-: L ;= -=M4== p=1.ey_-t==P= h-j.:4 .._u .f =q .::

(

l ..j . . F l va. .: -qiF:j :.:~--- Ed. .dif= 4.=.:L m ;.l ";f-- @i.;_:l:~.*/.@P.[~U- -[ p.,)j.F,'.y :

T .-p q .!, :.:. 7p::.Fm: g_: =l d.2.p=i:=aj: .s = . ==jr:l/.i A .:ij = J 4

-l  !. l = . l -1. .j .g ;

y i ei t : .: i . j wtgg..jpr s.6.p;-i.: g p :.y.il ji :! c -l- 1 i . l 5 t : ;j _l  ;

! j i _: .l -t -l . 1. a .cj ., eq 1 r.y i . !l f.:l.5! .= q.. ! .e : [ l-- l-! l t- -i ; - -m -r = /-y+, =L. s ,.=- p.= :. - l =+.i =.y ;;_ l =g.q=- t : i r ) + t._ V l 1

. .I : r .j. ._ . 4. . . .- ,..! . j tua j af.L r_. .:-. _g=. i_ r!..: j .. q . e

.u.  ::::l . g..;

g i . e._;..L. .

v v$v Q

- V= = #i =t- =n f ==1 up=s =-tE=t=n=i = '==

u L - , filen-y.=2=i ~=..E:f. --_M=TEf= === /:'=TE=5= 3%E E=JL.:W= r=-Mi 1 t;r . : . { . j = F . p--

V = f i = --Ws -2 r h= N I m A = l a - -l : =

h l = -N =E- L =-E- TEEF=- =_ K= HEhef=W:2iFEIMME =f= Ei: W1N

• ' .-1 = = =i=_= = \ "_ =.== . _ . t-.1- . . . _ . h =. _. , .y -- ....--e p

a == r -4 = = - :L=. -- =-f==- ._k .I= . _= =:.-,.._d. #.,. -

4 =+

..l=.'_- = = -v= K Vsr :=.+-(l u=-

. ,, .. w

,3 P

i te::. .1a:<-j:p-s =p2:.: t =a= m.r/ =i.=- D ;g.:-p-:-sq:+;:=P 4==l __. . L w .c -- .! -.L_u

~:J :.:b. ;- w . u = t...E-..P a- . 4 - 1 J=_=_. l . .

g- i :1. . .. - . t _. ...- . F. ..:.j r: . =

_.-  : 1 l 1 o  : <.i . .

. . . + ::.r

=. i .

Im.._ .-.. M. -. . : . i .M. . .,.

.. ,- .I , l .;

], . ,

i t w m.qs:;/3=c h i.d .- l -g. g  : g - b.ti e .L r j ., i. i e,

~

p- .:_ t / - a , .

.- I : I - i.+; A.- =fa t r . . 4 , i : ;

l. = p- + . v. . :..,: l .- . . . .

p" l . .

2.:1 . p. . ,_t r l. .l [.r.- . . = _a. -t . r.s:-. . , . ; . .- .. [ l .

l ..L

r. l . .t . t a.- - .i 7 p=L .p ?p  :.pi .n  ;+- g_j = <. rJ = L q .. . y i l ,

.l  ! 4y .

1 f.. .:t 4 4 . _: ) . l W. :. f l .. < _;j:_ < t.. .L.t.rr .; l l i l  :

/ 'e r- .l l  ; 4 -- .l- q. h i tF ,  ; I i 1! m. l l fi F.M. . . ~ .

l t I -l }

l l l : I i Li.- i i

I I fi  ! I i i- .I t t l l l l / l i i l1 l I i l ! l t  ! I I I i I l

__! l !/  : 1 I ; ! 1 ! I 1 e i i I I ! l I I I I i

/' i i l I ! j i i

! I I i t I i l i I j i l  !

I i l I I I ,

I . I , I i i I '

l I I  !  !  !

I i j ii i l

t i >

j i i i .: l i t i j i i O$

.t 4 .i. .5 1.o 1.% H M L8

% t. * %"

m uummuummmmmmmuu r F

g iI ; I ; i i t 1 .! I i ! I i I .

! i ! i i i i ! i I i i i l i i l i kl. t. F l ; I ,

i i l i l l I i i i i l , I i i-

._ ! l ; t .t 1 1- j.- . l -

.i i i I i j i l l i l ! l __ l  ; j i j ;_

' ' * .~~ '. . k ' ._ *' . . . _ . _ I .

6 - . <

.l .

H .I si==iEN.:E- t=- 7 0=H 2-L:=-i=.h= k::.. 4

• i L:. h - i 1- a = I ,, - l :h ;1 4-

=*:'l:f = '-I =Mt ' I- =-.E"E~5 53 . i. "!5 UiWZi Hf  : .

-l 'Il l -F 4 I - -l M - L *L - l - . l . . -*

-@MC5 =f'4M.-55*5G=#E=T lf.:~=~}-3 r Y *J" ".**=;b"*'I-H-Ml'!*-IJ-i*-iM-13"$~';_: Medii-5

=.- - =l - .- -.m- er .r.:-Fs ,.u =- - -_.: m.

t2=: .;: == =- - - -

o n._ . . . _n. _ . u _ m. m. __ ,- 3= l .=r=b=9 cor: r,_ m . T:._.._af_r_._.h --

-- - -s - . I ___; 4_. . __e, __ . _, - - __. . -_ - -_. - : - - . =. =w_;.__-. ___ _.x_._..-_- __ . _ _ ., _ _ w"1_

c.

4- P r;;;r . ;;_-

7;_.

=-- _~: i - : u. , . _ .i _: . . =.--

l5* ~17  : r-jT=-~*l\ 1 ^'- 1 __ i 1-- - --

, ._. _c __.1- t .-~ r - i* -

_;c:---\7.~,6-r_ .1 ;_ ;;14;; -x T ?*c r :? r .L .;r.* .?j-- .; 4, ; :;;_=r.;;c -

L

• _1 s_. .__.i* -

1; .-

s

.-~~= * - -

......_-___-_.__.__._,.'_.._.__._-..d---"

E --"*'

~__i__.__._.

~~ ~

- _* _1 2 ?_

.T *-d, .'N

_ _- 2R ~ Ib. +~_- * . __ - - _ . _- .

~ . - _ . . . _

~5: -7 ~[3*M " '~M~~_li==42 k_ - ~

j.___;---u\___

.:_4'

=_. j== = - ._:

.c-*-- r. 2; _ _ _..-L t__ u.=_.

t:- : = -

_ ! =r-a: ;d==z -

---1 = r ._._.a. C _ - . _ . . ___ _ _ _ __ _ t __._. _

=__. ;c r . _- . . m_;,q _ l=- _r__  : . r l=;-

r .-

y.__;; _ w - _ _ . _-___

_ .__._ - _ __r_.__,

C -t=;r ___- . _ . . m ;. ___ . _ _ _ -

,___.__.\-  : .__; __.. = ; _ . __.

- - - _t .:.- __ .

e,,. _a_ .._-g-

\

y _7. - .; p~ _ ;;_ ;; 4 - -~ 7 -- --- *-- ? - *--  ; --. _ _ . _ - _ - - - - - __ ~ ; ._

,-+ . _ - * :g_;.,.  ;, , y_,p . ,

g L;.-~ +  ;- -- -

- * --.\ c=t-- *-~-t.---. c= ;,;= ;- ;=.;1 :n:- !

__: w. '--

g '_ :: ----: ._..--i.V"- 1 .

_.4___-*.__ =aC--._.-__._l .'- .P- C *; F_*'1 --* , 1T -' ;-- _ _ - .J'.E-""-_;n- i-~~;;l-.=

y __g.;q .ac._r. r. _. - -.._g---- ;u ggp- _.- . -_j- _ ;r_ --- E

.. _-- r. cr_::=_.. _ _ . _ .__

cc.

. . . _ agg.. _; 3. ._. . _.gy. 4_ . .ujgn.g,2 t _;;.-

= -

=.' = -- . _ ._ _y._z . .ei =r- =. =-t. n =' :[. 7.d;'*.'""l_=_., =

. E; . E

--- t = M* . . _.a-r e_

4 .-

=

, . -E_ .5- .

-_w _ _. _: _J --2

- .- d5N_'-5N-NU.D5 ._C5A-is' ~-II-N:If ' #}_N_ '5f 5 nil ~CI@f[=_~='MI'[-- ~$-EN_:=35

=

l 5 ZE- iEE" EJ Wb ==JEf=] -' lEW=i=EMi -FEi:EsI5ffEJE 2.T= t EMEF=iUM3: d5- E !=" .

i. 1 =W 1 51 ruA =i :E-i-EM=f- = sEiEt =-WstW=iGL=EmR Ei=WdW:IN ; =i==# Hi lj ,f =!:E"R34"=iNEWi=EPE"= iE" =-t =! 1T =b=P-MEi=$EF*=T.=G!=t :"iN Ei il;E=P~

l. r- "i M _= C W " E stE+#=lf b:M: l = i =-l . =_Ml = M. tM:!t :t + P i .l = ! 4 "r:-

g .

~.* " *

<--g m . -l== 2 t @i=N :i W - i : l t il. : i l =M

- .l  : =F=. MI 1 :l l .

F ik e 2=k~ ~ 5l ' I ~= l #~h:-5~= i UM - l 7-i=N;D Ii.5 dl} {!- EI : Y -E

~

I y l LL + ==:5-jiH.j :=l, . i n--1=.c.eW._ =a.=::.e.A, A. peu. _a.. E_EE. -t __u. =. r.I. E._4.::.a.: r : 1- . n.

. - - . . . i. . n. _

l~

d k 2 ND.b~=E2[.~.~bbNfb\

--- . . k Il-N '~Nb=h b'b N'NN -hN-.IEN. l ! '* ' .'- ' ' ':E b ~- y~

l i, j =_ BEE!.__~.1_i=. -yt__y _ - ~JJ]=_==4. _ F_E H mJ _ b. j=f_=,i :=__" _5_4:_:__n " f_ _=._=_;=_ .=.r _E_2.c.f. f .= J :. ;9 i .; i r

] ,.

-;1.- E

.Z.C . : {.~ =t=: =tr-g( . . : 4 - .1: ~r= - # ; 4u _ r-E =t, r(. . - - = .--- -LC;r--** CC.s!-

_ f=C r j.~~ _ .' '- - 0 =_ r. . - c.. -- . . : :- :_ 1_. i.;;

4 g . :. -

\' hs a; :---::.- I ' . _. . -

3: i b ~-5 s l"-I=5Ed. M -5 5 E. Z N Y - @ E " d ~'":F--WC#t2= 5 -it'.*z-- '":

~ *

,1 i_ts r.. . 3.=5=. . y _ ; .- =_4 .q. ==-.15 =. == q = estu;:L1 -----u= r 7 . j . . - .4 - . - 'q . m_ .a. .

I_ fI j ;il Mcrj. -ju.'if.. j.M.'=f "- f_ iy j 9.-j =j k=.f ~.i Lif{_ _i,.'__-Y-'l[... . .l . ....c:.f;-.:_ { . . !c .=

b.

(

7.i. += =P+Et =Ei==#:h r==rE I : b-21 d M-@==W i = li - h i _.___.L - '+-

. 'b *l*' "

', *l'*.

• l iY " *~= e= 5-==yE p : v= . = h3 Rn=2;;Z V. t =:- :.::=L. .G _R=k =T+i .-y 4.:. F u = , - l -H __.c O

e I .

Nii_. , *f;55 =T '

• h-~~Q .ri -- (. ' ' . l ' : - h r* fra ,_. bl .'*- . h . 1 .[.-, l

' l .. ' . .{

~

iM; I - j i' =w.3 -~J =: =m .b ==_.; :T i+===

{=.E.F;- V _. w_. i - t - -- p y -E g-N == p-+.i:l . ' _1 -

-ln: ...

~.' JJ . E, .* _I _ e' - ~. ~~. . '

'

• I II .de j_

j j % : p :.t t  : j _ ci"y. :.+=p- t ,

. [14 ,p- =-qs. g l N ! j : r -l _

i '

l 4 -i. .l 1 p-p_t:-lc.rrlcg--l -

1 n:Lci. 1 -j. i -- l - :. - ,N; -l p-i l .- l e- p l.-; n i . .: c.i j i .j i}.-a;ia -

N l y

, i -

. . t-j i c2 1 !  ; - ! er y e !Ni  !  ;

J l  ! t l l l l il i 1 i i  ; .I l 1 l ! l ! l  ! NI

i 3

I i

l i l l i i j

i  ! i l 1 I I I 1 I . I

( i \i l i l . i i l I I  ! I i ' l l \ "

s y l l '

I ! l l 5  ! l l I l ! f

! \

$ I L'

l i I j j '

i I

( i

'  ! I i I C

$: 5 $ h 0 I

3ypf.L.%werawu5

.. . - -