ML18128A200

Follow-Up Response Regarding TS 3.2.3 to Request for Additional Information for the License Amendment Request to Upgrade the Nuclear Safety System at the Mit Reactor, License R-37, Docket No. 50-20 (CAC No. MF5003)

ML18128A200
Person / Time
Site:	MIT Nuclear Research Reactor
Issue date:	05/03/2018
From:	Lau E S, Queirolo A Massachusetts Institute of Technology (MIT)
To:	Document Control Desk, Office of Nuclear Reactor Regulation
References
CAC MF5003
Download: ML18128A200 (11)

Text

MIT NUCLEAR REACTOR LABORATORY AN MIT INTERDEPARTMENTAL CENTER Edward S. Lau Assistant Director Reactor Operations Mail Stop: NW12-122 138 Albany Street Cambridge, MA 02139 Phone: 617 253-4211 Fax: 617 324-0042 Email: eslau@mit.edu 3 May 2018 U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Attn.: Document Control Desk

Subject:

Follow-Up Response Regarding TS 3.2.3 to Request for Additional Information for the License Amendment Request to Upgrade the Nuclear Safety System at the MIT Reactor, License R-37, Docket No. 50-20 (CAC No. MF5003) The Massachusetts Institute of Technology (MIT) hereby submits a follow-up response to the NRC Request for Additional Information (RAI) date.cl 12 October 2017 on the License Amendment Request (LAR) to upgrade the Nuclear Safety System at the MIT Reactor (MITR). MIT docketed an initial response to the RAI on 14 December 201 7, and is now providing a modification to the RAI Question #6a response regarding the proposed Technical Specification (TS) 3.2.3 Reactor Protection System. MIT's 14 December 2017 initial response to Question #6a referenced the response letter's Enclosure S for TS 3.2.3. The modification here to Enclosure S is based on discussion of the proposed TS 3.2.3 in a Public Meeting with NRC on 19 April 2018. Accordingly, MIT is modifying TS 3.2.3 as described in the following, which can also be seen in the enclosed document.

a. The minimum number of required operable nuclear safety channels is changed from two to three. b. Footnote (5) for Table 3.2.3-1 is expanded to include time-limited action statements.

It now reads, "5) Within 15 minutes of declaring any nuclear safety system channel inoperable, the channel must be placed into a tripped state, which will be indicated on the Safety System Condition LED Scram Display. If any nuclear safety channel is in a tripped state, and a second nuclear safety channel is declared inoperable, then within 15 minutes at least one of the two must be returned to an operable state or the reactor must be shut down. 11 This addresses several outstanding concerns:

-Use of a brief but non-zero time limit prevents an instantaneous TS violation, should a malfunction decrease the number of operable nuclear safety channels below three. -When a trip is present at the Scram Logic Cards, it is visually confirmed by the indicator lights on the LED Scram Display (full name "Safety System Condition LED Scram Display").

The wording is clarified so as to avoid reading like a limitation on what types of scrams are included.

RAI Responses for Upgrade ofNSS Page2 Inoperability of a second channel is explicitly covered, to prevent "rolling 15-minute intervals" from potentially allowing more channels to be inoperable.

c. Line 13 of Table 3.2.3-1 is no longer needed as a separate item and is deleted, because the minimum number of operable channels has been increased from two to three, and footnote (1) already covers the two-out-of-four trip function.

d. The first paragraph of the Basis is expanded to support and describe the reasoning behind "three" as the required minimum number of operable channels, together with the footnote ( 5) action statement.

It also explicitly states that the new system is designed to allow reactor operation with one channel out of service. The MIT Reactor Safeguards Committee has approved these modifications to the proposed TS 3 .2.3. This RAI response follow-up and material submitted herewith do not contain any proprietary information.

The response contains the following

Enclosure:

Enclosure S. Technical Specification 3.2.3 Reactor Protection System, final version and version showing tracked changes. Sincerely, Edward S. Lau, NE Assistant Director of Reactor Operations MIT Research Reactor O~e Alberto Queirolo Director of Reactor Operations MIT Research Reactor I declare under penalty of perjury that the foregoing is t e correct. Executed on M"-Q 3 , .;)-o[ 8 Date

Enclosures:

As stated. cc: USNRC -Senior Project Manager Research and Test Reactors Licensing Branch Division of Policy and Rulemaking Office of Nuclear Reactor Regulation USNRC -Senior Reactor Inspector Research and Test Reactors Oversight Branch Division of Policy and Rulemaking Office of Nuclear Reactor Regulation

~/c 3 .2.3 Reactor Protection System Applicability This specification applies to the reactor protection system. Objective To ensure that automatic protection action is provided as required by the reactor . protection system. Specifications

1. The reactor shall not be made critical unless the reactor protection system is operable in accordance with Table 3.2.3-1. 2. Fuel shall not be moved and no work involving reactivity shall be performed . in the core unless the period and neutron.flux level channels are set to alarm within the zero primary pump limits of Table 3 .2.3-1. In addition, the manual major scram is operable for building isolation and the D20 dump valve selector switch is operable unless the D20 reflector is already dumped. 3. The reactor shall not be made critical unless scram setpoints are set more conservatively than the corresponding LSSS. 3-18 26 APR2018

,-----' I I Channel I Parameter Action 1. Period Scram 2. Neutron flux level Scram 3. Low count rate Scram 4. Primary coolant outlet Scram temperature

5. Core tank level Scram 6. Reflector tank level Scram 7. D 2 0 dump valve Reflector dump selector switch & scram 8. Manual major scram Reflector dump, containment closure & scram 9. Manual minor scram Scram 10. Primary coolant Scram flow rate 11. D 2 0 reflector Scram flow rate 12. Shield coolant Scram flow rate Table 3.2.3-1 Required Safety Chan_nels 2 Primaa Pumus Limiting Min. No. Setuoint Reguired > 7 sec. 3(1)(5) <7.4MW 3(1)(5) > 5 cps 3(1)(5) <60° C 2 4" below 1 overflow pipe 4" below 1 overflow NIA 1 NIA i(3) ' NIA 1 > 1800 gpm i(4) > 75 gpm 1 > 50 gpm 1 1 Primaa Pum12 0 Primaa Pumu Limiting Min.No. Limiting Min.No. Setuoint Reguired Seruoint Reguired > 7 sec 3(1)(5) -> 7 sec 3(1)(5) <3.2MW 3(1)(5) < lOOkW 3(1)(5) > 5 cps 3(1)(5) > 5 cps 3(1)(5) <60° C 2 <60° C 2 4" below 1 4" below 1 overflow pipe overflow pipe 4" below 1 4" below 1 (2) overflow overflow NIA 1 NIA 1 NIA i(3) NIA i(3) NIA 1 NIA 1 >900 gpm iC4) NIA 0 > 75 gpm 1 NIA 0 > 50 gpm 1 NIA 0 1) Nuclear safety scram logic system ensures that reactor scrams when two trips are present simultaneously from any two of the four nuclear safety channels.

2) For reflector reactivity measurement, the reflector scram can be bypassed at power levels less than 100 kW. 3) One in utility room. 4) At least one safety channel on the primary coolant flow rate scram must be by core inlet pressure sensor. 5) Within 15 minutes of declaring any nuclear safety system channel inoperable, the channel must be placed into a tripped state, which will be indicated on the Safety System Condition LED Scram Display. If any nuclear safety channel is in a tripped state, and a second nuclear safety channel is declared inoperable, then within 15 minutes at least one of the two must be returned to an operable state or the reactor must be shut down. 3-19 26 APR2018 I Channel / Parameter

13. Building overpressure

14. Main personnel lock gaskets deflated 15. Basement personnel lock gaskets deflated 16. Hold-down grid unlatched

17. Experiment scrams Table 3.2.3-1 (Continued)

Required Safety Channels Any Number of Pumps (Two, One, or Zero) Action Setpoint Scram < 3" water above atmospheric Scram Both gaskets deflated Scram Both gaskets deflated Scram Grid unlatched (As Required by Experiment Approval) 3-20 I Minimum No. Required 1 1 1 1 26 APR 2018 The nuclear safety system, consisting of four wide-range nuclear safety channels, provides protection against high power level and short reactor period. Each nuclear safety channel produces a trip signal on high power, short period, low detector count rate, channel in test, or channel fault / equipment malfunction.

The scram logic system downstream will scram* the reactor upon any simultaneous combination of these trips from two of the four nuclear safety channels, thereby ensuring there are three operable channels whenever the reactor is not shut down. The system is designed to allow the reactor to be critical with one channel in an inoperable state, including removal of the channel for service or maintenance; should any one of the remaining three required channels produce a trip, the scram logic system will scram the reactor. Any nuclear safety channel declared inoperable will be placed into a tripped state as indicated on the LED Scram Display. The 15-minute time allowance is based on the time needed to make the necessary notifications.

The nuclear safety system is required at all power levels including certain subcritical operations such as refueling, absorber change-out, or other in-core work that affects reactivity.

Above 100 kW, protection is also required on primary, D20, and shield coolant flows. The parameters listed in Table 3.2.3-1 are monitored by the reactor protection system. This system automatically initiates action to ensure that appropriate limiting safety system settings and limiting conditions of operation are not violated.

In practice, low power physics tests including rod reactivity worth measurements are usually performed at power levels of less than 10 kW and in the absence of forced convection primary flow. The upper limit of 100 kW for this type of operation was established on the basis of adequate natural convection cooling. The maximum plate temperature at 100 kW with natural convection cooling is estimated to be below incipient boiling, if the coolant outlet temperature is maintained below the normal scram point of 60°C. Therefore, the reactor outlet temperature channel is specified in Table 3.2.3-1 as 60°C for zero pump operation.

The reflector tank low D 2 0 level scram must be bypassed during low power operation if calibration of the reactivity effect of the D 2 0 reflector dump safety system is to be performed.

For refuelings, the reactor is in a shutdown condition, primary :flow is secured, and the D 2 0 reflector is normally dumped. Therefore, the nuclear safety channels are set to alarm within the zero primary pump limits for period and level. The capability to isolate the building is required.

This is provided by the major scram. Finally, it should be possible to dump the D20 reflector, if it is not already dumped. 3-21 26 APR2018 3 .2.3 Reactor Protection System Applicability This specification applies to the reactor protection system. Objecti v e To ensure that automatic protection action is provided as requir e d by the reactor protection system. Specifications

1. 2. The reactor shall not be made critical unless the reactor protection system is operable in accordance with Table 3.2.3-1. Fuel shall not be moved and no work involving reactivity s h all be performed in the core unless the period and neutron flux level channels are set to alarm within the zero primary pump limits of Table 3.2.3-1. In addition , the manual major scram is operable for building isolation and the D 2 0 dump valve selector switch is operable unless the D 2 0 reflector is alread y dumped. 3. The reactor shall not be made critical unless scram setpo i nts are set more conservatively than the corresponding LSSS. 3-18 e ocT 2Ql726 APR 2018 I Channel I Parameter Action 1. Period Scram 2. Neutron flux level Scram 3. Low count rate Scram 4. Primary coolant outlet Scram temperature

5. Core tank level Scram 6. Reflector tank level Scram 7. D 2 0 dump valve Reflector dump selector switch & scram 8. Manual major scram Reflector dump, containment closure & scram 9. Manual minor scram Scram 10. Primary coolant Scram flow rate 11. D 2 0 reflector Scram flow rate 12. Shield coolant Scram flow rate Table 3.2.3-1 Required Safety Channels 2 £cimao: fu.11112~

Limiting Min. No. Semoint Reguired > 7 sec. iB (lX5) <7.4MW ~3 (1X5) > 5 cps ~3 (1)(5) <60' C 2 4" below 1 overflow pipe 4" below 1 overflow NIA 1 NIA 2'3) NIA I > 1800 gpm 2'4) > 75 gpm 1 > 50 gpm 1 1 frimao: fu.11112 Q Pcima;o: Pu.m12 Limiting Min. No. Limiting Min. No. Semoint Reguired Semoint Reguired > 7 sec ~3 (1)(5) > 7 sec ~3 (1)(5) <3.2MW ~3 (1X5) < 100 kW ~3 (1)(5) > 5 cps ~3 (1)(5) > 5 cps ~3 (1)(5) <60' C 2 <60' C 2 4" below 1 4" below 1 overflow pipe overflow pipe 4" below 1 4" below 1 (2) overflow overflow NIA 1 NIA 1 NIA 2'3) NIA 2'3) N I A 1 NIA 1 > 900 gpm 2'4) NIA 0 > 75 gpm 1 NIA 0 > 50 gpm 1 NIA 0 1) Nuclear safety scram logic system ensures that reactor scrams when two tnps are present simultaneously from any two of the four nuclear safety channels.

2) For reflector reactivity measurement , the reflector scram can be bypassed at power levels less than 100 kW. 3) One in utility room. 4) At least one safety channel on the primary coolant flow rate scram must be by core inlet pressure sensor. 5) Within 15 minutes of declaring A y nuclear safety system channel reH1:e, 1 ee H'@IB sef\1 ieeinoperable , the channel must be ~placed in to a tripped state , which will be-as indicated on the Safety System Condition LED Scram Display. If any nuclear safety channel is in a tripped state, and a second nuclear safety channel is declared inoperable, then within 15 minutes at least one of the two must be returned to an operable state or the reactor must be shut down. 3-19 e OCT 2Q1726 APR 2018 I Channel / Parameter )huilea, sskl* ehsMel in test !!!! iudt 1 43. Building overpressure l M. Main personnel lock gaskets deflated H ,5. Basement personnel lock gaskets deflated 1'16. Hold-down grid unlatched 1 37. Experiment scrams Table 3.2.3-1 (Continued)

Required Safety Channels Any Number of Pumps (Two, One, or Zero) Action Setpoint GhsMel in tesl !!fl ftlttlt e!!nliiti@n Scram < 3" water above atmospheric Scram Both gaskets deflated Scram Both gaskets deflated Scram Grid unlatched (As Required by Experiment Approval)

I Minimum No. Required 1 1 1 1 1) )Ittele8f saf@~, eeraHI. legie syet@HI. eRettree tkat rHeter eer81Me wkeR tv:re trif!B ar@ f!F@s@Rt eutndt8RB8ttBly fre111. My t¥;1e eftke fl!ttr Rtt@le8f saf@~, ekannels.

~) A8'1 fllt8l88f 88F@~I syst@HI. 8R8f'.B8l f8Hl.8\'88 fr@HI. 88f'l'i@e Mlt8t @8 l@it iB 8 trif!f!il8 stat@ 88 ifteieatea 8R the ~8f@~r ~yst@HI. C@R@iti@R b~Q ~8f8M Qisf!l8~'.

3-20 e OCT 2Q1726 APR 2018 I The nuclear safety system , consisting of four wide-range nuclear safety channels, provides protection against high power level and short reactor period. Each nuclear safety channel produces a trip signal on high power, short period, low detector count rate , channel in test, or channel fault / equipment malfunction.

The scram logic system downstream will scram the reactor upon any simultaneous combination of these trips from two of the four nuclear safety channels , thereby ensuring there are tw&=three operable channels whenever the reactor is not shut down. The system is designed to allow the reactor to be critical with one channel in an inoperable state, including removal of the channel for service or maintenance; should any one of the remaining three required channels produce a trip, the scram logic system will scram the reactor. Any nuclear safety channel declared inoperable will be placed into a tripped state as indicated on the LED Scram Display. The 15-minute time allowance is based on the time needed to make the necessary notifications.

Th@s@ systems llf@ The nuclear safety system is th@F@Mlf'@

required at all power levels including certain subcritical operations such as refueling , absorber change-out , or other in-core work that affects reactivity.

At JH~W@f' levels e:A bove 100 kW , protection is also required on primary , D20, and shield coolant flows. The parameters listed in Table 3.2.3-1 are monitored by the reactor protection system. This system automatically initiates action to ensure that appropriate limiting safety system settings and limiting conditions of operation are not violated.

In practice , low power physics tests including rod reactivity worth measurements are usually performed at power levels of less than 10 kW and in the absence of forced convection primary flow. The upper limit of 100 kW for this type of operation was established on the basis of adequate natural con v ection cooling. The maximum plate temperature at 100 kW with natural convection cooling is estimated to be below incipient boiling, if the coolant outlet temperature is maintained below the normal scram point of 60°C. Therefore , the reactor outlet temperature channel is specified in Table 3.2.3-1 as 60°C for zero pump operation.

The reflector tank low D 2 0 level scram must be bypassed during low power operation if calibration of the reactivity effect of the D 2 0 reflector dump safety system is to be performed. For refuelings , the reactor is in a shutdown condition , primary flow is secured , and the D 2 0 reflector is normally dumped. Therefore , the nuclear safety channels are set to alarm within the zero primary pump limits for period and level. The capability to isolate the building is required.

This is provided by the major scram. Finally , it should be possible to dump the D 2 0 3-21 (i OCT 2Ql726 APR 2018 reflector , if it is not already dumped. 3-21 e OCT 2Ql726 APR 2018 I