ML24346A177
Text
Response to SDAA Audit Question Question Number: A-4.3-32 Receipt Date: 06/24/2024 Question:
Neither FSAR Section 4.3, 4.6, nor 3.9.4 contain the design requirement for the maximum control rod withdrawal speed. The maximum speed only remains in Chapter 15, however that is an analytical maximum value and not a specification for a system design requirement. Please propose markups to either SDA section 3.9.4 or 4.6 to include this design requirement, and markup SDA section 4.3 to reference the section where the design requirement is located.
Response
Final Safety Analysis Report (FSAR) Section 4.3, Nuclear Design, identifies that the design maximum rod withdrawal rate is described in FSAR Section 15.4, Reactivity and Power Distribution Anomalies. FSAR Section 15.4 identifies the maximum allowed withdrawal rate of a control rod assembly. As identified in the question, the design requirement for the maximum control rod withdrawal speed is identified in the FSAR; therefore, changes are not necessary.
Updated Response FSAR Section 4.3 is revised to include the design maximum CRA travel speed of 15 in/min and a pointer to FSAR Section 3.9.4 for CRA step size. FSAR Section 15.4 is revised to remove the maximum allowed withdrawal rate and to point to FSAR Section 4.3. FSAR Table 14.2-73 is revised to point to FSAR Section 4.3 for the CRA insertion and withdrawal speed design limits.
FSAR Section 4.6 is revised to point to Section 4.3 for the design maximum CRA travel speed.
Markups of the affected changes, as described in the response, are provided below:
NuScale Nonproprietary NuScale Nonproprietary
NuScale Final Safety Analysis Report Nuclear Design NuScale US460 SDAA 4.3-3 Draft Revision 2 4.3.1.3 Power Distribution The power distribution and the reactor protection system are designed to ensure the following SAFDLs are met at a 95 percent probability at a 95 percent confidence level.
Fuel must not exceed the critical heat flux (CHF) limits under normal operating conditions and AOOs as described in Section 4.4.
Peak fuel power under abnormal conditions, including the maximum overpower condition, must not result in fuel melting as discussed in Section 4.4.
Fuel management is such that the values of fuel rod power and burnup meet the fuel rod mechanical integrity requirements in Section 4.2.
Fuel is not operated at a linear power density greater than the design limit for the fuel.
These restrictions along with the burnup restriction in Section 4.3.1.1 satisfy GDC 10. The power distribution limits are discussed in more detail in Section 4.3.2.2.
4.3.1.4 Maximum Controlled Reactivity Insertion The design places limits on the worth of the CRAs, CRA insertion depth, and maximum CRA withdrawal rate. The maximum controlled reactivity addition rate is limited, such that the SAFDLs are not violated during normal operation, AOOs, or postulated accidents.
Audit Question A-4.3-32 For an accidental withdrawal of a bank of CRAs or a single CRA, the maximum withdrawal rate is established such that CHF limits are not exceeded, in accordance with GDC 25. The design maximum rod travel speed is 15 in/min. The CRA step size is described in Section 3.9.4.withdrawal rate is described in Section 15.4.
The maximum worth of the CRAs and the limits on CRA insertion preclude rupture of the reactor coolant pressure boundary due to a rod withdrawal or rod ejection accident (Section 15.4). The design basis presented in this section satisfies GDC 28. Control rod worth is discussed in more detail in Section 4.3.2.5.
4.3.1.5 Shutdown Margin and Subcriticality During Long-Term Cooldown The design employs two independent means for reactivity control: CRAs and soluble boron. These two reactivity control systems satisfy the portion of GDC 26 that requires two independent reactivity control systems of different design principles. Each of the two independent means of reactivity control is capable of controlling the reactivity changes resulting from planned, normal operation.
Shutdown margin (SDM) is defined as the instantaneous amount of reactivity by which the reactor is subcritical, or would be subcritical from its present condition,
NuScale Final Safety Analysis Report Functional Design of Control Rod Drive System NuScale US460 SDAA 4.6-3 Draft Revision 2 and components are located inside the Reactor Building, which provides protection from events and conditions outside the plant. The ability of the CRDS to perform the required safety-related functions is not compromised by adverse environmental conditions. The control rod drive shafts are immersed in 540 degrees F water during normal full power operation. The upper portion of the control rod drive shafts penetrate the pressurizer steam space and are exposed to a steam environment at approximately 636 degrees F. The control rod drive shafts and latch mechanisms are designed to 650 degrees F.
The CRDS complies with GDC 23. The CRDS provides positive core reactivity control through the use of movable CRAs. The movable CRAs provide reactivity control for modes of operation when the NuScale Power Module is installed in its operating location. The CRDS, in conjunction with the module protection system, actuates the control rods to perform safety-related functions when necessary to provide core protection during normal operation, AOOs, and accidents. The CRDS is designed to fail in a safe condition under adverse conditions, preventing damage to the fuel cladding and excessive reactivity changes during failure. Loss of electrical power to the reactor trip breaker initiates a reactor trip, causing the control rods to drop into the core and shut down the reactor.
Audit Question A-4.3-32 The CRDS complies with GDC 25. Section 4.3 provides the design requirements for CRA withdrawal speed. Chapter 15 safety analyses demonstrate the CRDS is capable of performing a reactor trip when plant parameters exceed the reactor trip setpoint, given a credible failure of a single active component.
The CRDS complies with GDC 26 and GDC 27 as described in Section 4.3.
The CRDS complies with GDC 28. A postulated failure of the CRDS causing a rod ejection has the potential to result in a relatively high rate of positive reactivity insertion, which could challenge specified acceptable fuel design limits. The rod ejection accident is not analyzed as a loss-of-coolant accident event. To prevent a mechanical failure of the CRDM housings, the CRDM is made as a single-piece housing, with a top plug. The rod ejection analysis presented in Section 15.4 demonstrates GDC 28 is met.
GDC 29 is applicable to the CRDS design. The CRDS accomplishes safe shutdown (i.e., reactor trip) via gravity-dropping of the CRAs on a reactor trip signal or loss of electrical power. The CRDM pressure housing is an ASME Class 1 pressure boundary and maintains the reactor coolant pressure boundary during all ASME service levels.
The safety-related reactor trip function of the CRDS is initiated by the module protection system through the reactor trip system, which isolates the CRDS power converter and controller assembly from its motive power supply. Failures of the CRDS are evaluated in failure modes and effects analyses. Effectiveness of the CRDS, despite possible single failures, is demonstrated in Chapter 15, which shows the CRDS performs a reactor trip when plant parameters exceed the reactor trip setpoint.
NuScale Final Safety Analysis Report Initial Plant Test Program NuScale US460 SDAA 14.2-150 Draft Revision 2 Audit Question A-4.3-32 Table 14.2-73: Test # 73 Control Rod Drive System - Manual Operation, Rod Speed, and Rod Position Indication Startup test is required to be performed for each NPM.
This test is performed after initial fuel loading but before initial criticality.
Test Objectives
- 1. Verify the ability to manually fully insert and fully withdraw individual CRAs from the MCR.
- 2. Verify CRA rod position indications provide indication of rod movement.
- 3. Verify individual CRA position indications are within the required number of steps of their associated group position.
- 4. Verify the rod insertion and withdrawal speeds are within design limits.
73.00.XX Prerequisites
- 01. The core is installed.
- 02. The NPM is fully assembled.
- 03. The RCS is at HZP (RCS at normal operating pressure and RCS temperature at the maximum temperature obtainable when heated only by the MHS).
- 04. All RCS temperatures satisfy the minimum TS temperature for criticality.
- 05. The nuclear instrumentation system is calibrated and operable.
- 06. The shutdown margin is within the limits specified in the core operating limits report.
73.03.01 Test Method
- 1. Individually withdraw and insert each shutdown bank and regulating bank from the MCR a sufficient number of steps to verify that the individual CRA positions are within the required number of steps of their group position as required by TS. Only the tested bank is withdrawn. All other banks are fully inserted. Repeat the test until all shutdown banks and regulating banks are tested.
- 2. With all shutdown and regulating banks fully inserted, fully withdraw and then fully insert one CRA. Repeat these steps until all CRAs are tested.
Acceptance Criteria
- 1. All CRAs can be individually fully withdrawn and fully inserted from the MCR.
- 2. Individual CRA position indications are within the number of steps of their associated group position as required by TS.
- 3. The CRA insertion and withdrawal speeds are within the design limits identified in Section 4.3.1Section 3.9.4.
NuScale Final Safety Analysis Report Reactivity and Power Distribution Anomalies NuScale US460 SDAA 15.4-1 Draft Revision 2 15.4 Reactivity and Power Distribution Anomalies 15.4.1 Uncontrolled Control Rod Assembly Withdrawal from a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and Accident Description An uncontrolled control rod assembly (CRA) withdrawal from a subcritical or low power startup condition event could result in a rapid insertion of reactivity into the reactor core. There is an increase in reactor power due to the unexpected addition of reactivity as the CRA bank is withdrawn from the core. The core power increases at a faster rate than heat can be removed, resulting in an increase in reactor coolant system (RCS) temperature and a decrease in minimum critical heat flux ratio (MCHFR).
An uncontrolled CRA withdrawal from a subcritical or low power startup condition is classified as an anticipated operational occurrence (AOO) as indicated in Table 15.0-1.
15.4.1.2 Sequence of Events and Systems Operation Audit Question A-15.4.1-1 The sequence of events for an uncontrolled CRA withdrawal from a subcritical or low power startup condition is provided in Table 15.4-1 for the limiting MCHFR and fuel centerline temperaturelinear heat generation rate (LHGR) case. The RCS pressure and secondary pressure are not acceptance criteria for this event. The RCS and secondary pressure are bounded by other AOO events.
Unless specified below, the analysis of an uncontrolled CRA withdrawal from a subcritical or low power startup condition event assumes the control systems and engineered safety features perform as designed, with allowances for instrument inaccuracy. No operator action is credited to mitigate the effects of the CRA withdrawal.
The rod control function of the control rod drive system (CRDS) provides reactivity control to compensate for rapid, short-term variations in the reactivity of the core.
The rod control function is also used to maintain the measured RCS temperature at or near the programmed average coolant temperature. The CRDS rod control operational modes include manual mode, automatic mode, and insertion-only automatic mode. The CRDS rod control function could be in manual mode during startup conditions. An operator error or malfunction in the CRDS would have to occur to initiate a uncontrolled CRA withdrawal from a subcritical or low power startup condition.
Audit Question A-4.3-32 The expected normal travel rate of the CRAs is 6 in/min. However, tThe maximum allowed withdrawal rate of a CRA is in Section 4.3.1.15 in/min, with a step size no greater than three-eighths inch. A spectrum of constant reactivity insertion rates
NuScale Final Safety Analysis Report Reactivity and Power Distribution Anomalies NuScale US460 SDAA 15.4-2 Draft Revision 2 that bounds thisthe maximum rate and also bounds possible boron dilution scenarios is included in the analysis.
The module protection system (MPS) is credited to protect the NuScale Power Module (NPM) in the event of an uncontrolled CRA withdrawal from a subcritical or low power startup condition. The following MPS signals protect the NPM in the event of an uncontrolled CRA withdrawal from a subcritical or low power startup condition:
high power (at 25 percent of full power for startup conditions) source range (SR) and intermediate range (IR) log power rate high SR count rate The RCS pressure control with heaters and spray is assumed to function normally to delay the trip on high pressurizer pressure. Pressurizer level control is disabled.
No single failure could occur during an uncontrolled CRA withdrawal from a subcritical or low power startup condition event that would result in more severe conditions for the limiting case.
15.4.1.3 Thermal Hydraulic and Subchannel Analyses 15.4.1.3.1 Evaluation Models The thermal hydraulic analysis of the NPM response to an uncontrolled CRA withdrawal from a subcritical or low power startup condition is performed using NRELAP5. The NRELAP5 model is based on the design features of the NPM.
The non-loss-of-coolant accident (non-LOCA) NRELAP5 model is discussed in Section 15.0.2. The relevant boundary conditions from the NRELAP5 analyses are provided to the downstream subchannel critical heat flux (CHF) analysis.
The subchannel core CHF analysis is performed using VIPRE-01. VIPRE-01 is a subchannel analysis tool designed for general-purpose thermal-hydraulic analysis under normal operating conditions, operational transients, and events of moderate severity. Limiting axial and radial power shapes are used in the subchannel analysis to ensure a conservative MCHFR result, in accordance with the methodology described in the Subchannel Analysis Methodology Topical Report (Reference 15.4-1) and the Statistical Subchannel Analysis Methodology Topical Report (Reference 15.4-2). Section 15.0.2 includes a discussion of the VIPRE-01 code and evaluation model.
15.4.1.3.2 Input Parameters and Initial Conditions Audit Question A-15.4.1-1 A spectrum of initial conditions is analyzed to find the limiting reactivity insertion due to an uncontrolled CRA withdrawal from a subcritical or low power startup condition. The initial conditions of the transient evaluation result in a conservative calculation. Table 15.4-2 provides key inputs and associated
NuScale Final Safety Analysis Report Reactivity and Power Distribution Anomalies NuScale US460 SDAA 15.4-5 Draft Revision 2 protection. These MPS limits are analyzed for a spectrum of uncontrolled CRA withdrawal conditions to ensure protection functions are actuated to prevent the violation of the design safety limits.
An uncontrolled CRA withdrawal is classified as an AOO as indicated in Table 15.0-1.
15.4.2.2 Sequence of Events and Systems Operation The sequence of events for a representative uncontrolled CRA withdrawal at power is provided in Table 15.4-4 for the limiting MCHFR case.
Unless specified below, the analysis of an uncontrolled CRA withdrawal event assumes the control systems and engineered safety features perform as designed, with allowances for instrument inaccuracy. No operator action is credited to mitigate the effects of an uncontrolled CRA withdrawal event.
Audit Question A-4.3-32 The regulating CRA banks contain the only CRAs that are not fully withdrawn during power operation. The power dependent insertion limit (PDIL), plus uncertainty, restricts the amount of insertion steps the regulating banks can achieve during power operation. The PDIL-imposed restrictions are not modeled in the uncontrolled CRA withdrawal analysis in order to bound possible boron dilution scenarios. The expected normal travel rate of the CRAs is 6 in/min.
However, tThe maximum allowed withdrawal rate of a CRA is in Section 4.3.115 in/min, with a step size no greater than three-eighths inch. Theis maximum withdrawal rate corresponds to the maximum possible reactivity insertion rate. A spectrum of constant reactivity insertion rates that bounds theis maximum rate and also bounds possible boron dilution scenarios is included in the uncontrolled CRA withdrawal analysis.
The effect of a reactivity insertion event on the RCS is an increase in temperature, which decreases density and causes flow into the pressurizer, increasing RCS pressure. As a result, the normal module control system response would be to decrease pressurizer heater power and increase pressurizer spray. In some uncontrolled CRA withdrawal cases, the pressurizer pressure control with heaters and spray is assumed to function normally to delay the trip on high pressurizer pressure; in other cases pressurizer spray is disabled.
The MPS is credited to protect the NPM in the event of an uncontrolled CRA withdrawal. The following MPS signals protect the NPM during an uncontrolled CRA withdrawal:
high power high power rate high RCS hot temperature high pressurizer pressure high RCS average temperature
NuScale Final Safety Analysis Report Reactivity and Power Distribution Anomalies NuScale US460 SDAA 15.4-9 Draft Revision 2 misalignment of the rods inserted to the PDIL but with one CRA fully inserted is not a credible condition. Reactor hold points prohibit the movement of rods for that severe peaking distortion and therefore is not analyzed. The CRA misalignments are classified as AOOs.
The single rod withdrawal transient occurs when a control rod is set at the bank position PDIL and is postulated to withdraw. This event may occur due to wiring failures or operator error where one rod is pulled with disregard for rod position information. The single rod withdrawal adds reactivity and initiates a power increase transient. The power distribution in the core becomes asymmetric and peaking can challenge the MCHFR safety limit. A CRM that results in a withdrawal is classified as an AOO.
The CRA or bank drop occurs when a single rod or entire group from the control or shutdown banks drops into the core. The CRA or bank drop can be caused by a mechanical or electrical failure. The event is characterized by a sudden drop in reactor core power. When the rod worth is not significant enough to shut the core down or cause a reactor trip, the constant demand of the secondary side causes a decrease in core inlet temperature, which could result in a power increase. The control system for the regulating control rod bank could withdraw the regulating bank to restore power. The resulting power overshoot with asymmetric peaking could challenge the MCHFR safety limit. A single CRA drop event is classified as an AOO.
15.4.3.2 Sequence of Events and Systems Operation The sequence of events for each CRM transient is discussed in the respective results section.
Unless specified below, the analysis of a CRM event assumes the control systems and engineered safety features perform as designed, with allowances for instrument inaccuracy. No operator action is credited to mitigate the effects of a CRM event.
Audit Question A-4.3-32 The regulating CRA groups contain the only CRAs that are not fully withdrawn during power operation. The PDIL restricts the amount of insertion steps that the regulating groups can achieve during power operation. The CRM analyses assume that the regulating bank CRAs have a position uncertainty of six insertion or withdrawal steps. The expected normal travel rate of the CRAs is 6 in/min.
However, tThe maximum allowed withdrawal rate of a CRA is in Section 4.3.115 in/min, with a step size no greater than three-eighths inch.
The effect of a reactivity insertion event on the RCS is an increase in temperature, which decreases density and causes flow into the pressurizer, increasing RCS pressure. As a result, the normal module control system response would be to decrease pressurizer heater power and increase pressurizer spray. Pressurizer pressure control with heaters and spray is allowed to function normally to delay the trip on high pressurizer pressure.
NuScale Final Safety Analysis Report Reactivity and Power Distribution Anomalies NuScale US460 SDAA 15.4-12 Draft Revision 2 Table 15.4-9 with respect to MCHFR and LHGR. The following initial conditions and assumptions ensure the results have sufficient conservatism.
Initial power level: 20 percent, 35 percent, 45 percent, 55 percent, 65 percent, 75 percent, 85 percent, 100 percent, and 102 percent of nominal power are analyzed to find the limiting cases. The initial power level for the limiting MCHFR and LHGR cases is 65 percent of nominal power.
Audit Question A-15.4.3-1, Audit Question A-4.3-32 Reactivity insertion rate: The positive reactivity inserted by the CRA withdrawal is modeled as a constant reactivity addition beginning at the transient initiation. The reactivity insertion continues until the time of the reactor trip or the CRA is fully withdrawn. A range of reactivity insertion rates is considered for each initial power level, up to the reactivity insertion rate associated with the maximum rod speed identified in Section 4.3.1.
The total range of reactivity insertion rates analyzed is from 0.0015 $/sec to 0.0110 $/sec.
Reactivity feedback: The BOC (least negative) reactivity coefficients are implemented in the limiting CRA withdrawal cases. The least negative reactivity coefficients provide the least amount of feedback to mitigate the power increase due to a CRA withdrawal.
Conservative reactor trip characteristics are used, including a maximum time delay, holding the most reactive rod out of the core, and using a bounding control rod drop rate.
The turbine bypass system is not credited in this analysis to minimize heat removal by the secondary side.
Allowances for instrument inaccuracy are accounted for in the analytical limits of mitigating systems in accordance with RG 1.105.
The limiting axial and radial power shapes are used in the subchannel analysis to ensure a conservative evaluation of the SAFDLs.
The results from the thermal hydraulic evaluation are used as input to the subchannel analysis to determine the limiting MCHFR and LHGR for this event. The subchannel evaluation model is discussed in Section 15.0.2.
15.4.3.4.3 Results The sequence of events for a single CRA withdrawal that results in the minimum MCHFR is provided in Table 15.4-10. Figure 15.4-11 through Figure 15.4-16 show the transient behavior of key parameters for this event.
The limiting MCHFR and LHGR are provided in Table 15.4-11.
The withdrawal of a single CRA that results in a limiting MCHFR has an initial power of 65 percent. The withdrawal of the CRA results in a reactivity insertion that increases reactor power. The power increase leads to a rise in RCS temperature, pressurizer level, and RCS pressure. The CRA misalignment with the rest of the bank causes an asymmetry in the core, where power peaking increases in the location of the withdrawn CRA. Reactivity feedback