CHAPTER 07 final Rev 17.docx

CHAPTER 7 – TABLE OF CONTENTS

List of Tables

List of Figures

Chapter 7 – Record of Revisions

Update all references to the thermal shield system due to a new system.

Change of the reg rod indication from analog to digital.

Added section 7.3.1.5 reactor protection and rod control system testing

Add text to appendix 7A for BT-9 I&C.

Update Figure 7.4a

Updated Distribution Panel Tables 7.7b, 7.7c, 7.7d, 7.7e, 7.7f.

Changes to section 7.3.4 for additional LOCA actions on a moderator dump. Changes to table 7.5e.

Remove Section 7.3.1.6.4. Update Tables 7.2 and 7.5a

7 Instrumentation and Control Systems

7.1 Summary Description of the Instrumentation and Control System In order to achieve safe and efficient reactor operation, the important variables related to the reactor process, its systems, and its environment are monitored, processed, and controlled. The NBSR Instrumentation and Control (I&C) System consists of five nuclear instrument channels, an automatic reactor power control that utilizes a single control rod (regulating rod) with a small reactivity worth, a manual reactor power control that allows motion of four control rods (shim arms) with a large reactivity worth, multiple process instrument channels for indication and protective action, the Reactor Control and Safety System, the Main Control Panel, and the Radiation Monitoring System. Details of the instrumentation loops for the I&C system, including non-safety related channels, may be found in the reference documentation.

The Reactor Control System (RCS) and the Reactor Safety System (RSS) comprise the control and safety system, which can generate protective actions such as scram signals and rundown signals after receiving inputs from the nuclear and process instrumentation. The values for these signals as described in the SAR may be less conservative than those in the technical specifications for the NBSR, consistent with the design criteria of the RSS and the conservative approach to establishing operating limits vis-a-vis safety limits.

The Main Control Panel consists of instrumentation, controls, and annunciators. It is the primary human machine interface for control of the reactor. The Radiation Monitoring System (RMS) measures gamma radiation levels at different locations throughout the facility and monitors the radioactivity of the air within the confinement building and air within exhaust paths from the confinement building. Monitoring of liquid releases is described in Chapter 9; no reactor safety issues are associated with liquid releases.

The functions of the RCS, RSS, and RMS overlap. For example, the RCS includes the drive mechanisms for the shim arms, the clutches for which can be released with scram signals from the RSS. Another example is the inclusion of all scrams within the RSS, e.g. scrams initiated from RMS radiation monitors in the confinement building exhaust air. However, the RSS is distinguished here from the other elements of the NBSR I&C System in that a change to the reactor safety system is defined as only a change to instrumentation and controls that affect scram functions and the reactor outlet temperature rundown function.

Modifications to the reactor facility have been made since the initial license of 1967. New instruments have been either analog or a hybrid of digital and analog technology. The NBSR reactor is not equipped with a fully digital control console and the scram circuit of the RSS remains entirely analog. The term “digital hybrid” as used here implies an instrument that obtains an analog signal, transmits that signal to an analog-to-digital converter, and then makes the digital output available for display or other desired use. Setpoints and alarms may be altered by authorized personnel for both the analog and digital-hybrid instruments. However, the programming of the digital-hybrid instruments cannot be changed by the NBSR staff. The firmware for the digital hybrid instruments is installed by the manufacturer and cannot be field modified.

7.2 Design of the Instrumentation and Control System

7.2.1 Design Criteria

Since the NBSR is a test reactor, there is no reason to continue operation during adverse conditions such as a severe natural phenomenon, a seismic event, or a fire. Administrative procedures require the reactor to be shut down should any of these events occur. While it is anticipated that the NBSR I&C System would remain operable during such circumstances, it is necessary to ensure the functionality of only those I&C system components associated with the operability of nuclear instrumentation, confinement, and the emergency exhaust fans. The nuclear instruments provide confirmation of the reactor shutdown, the public is protected from potential radiation releases after a shutdown if the reactor fuel is covered with coolant, and air releases from the building are prevented by maintaining the confinement building at a negative pressure relative to the pressure outside the building.

The following design criteria exist for the NBSR I&C System:

1. Elements of the I&C System that are important to safety include both redundancy and diversity. For example:

· The RSS receives Period Scram signals from three Log/Linear channels.

· The RSS receives redundant inputs from Reactor Vessel Level instruments (LRC-1, LIA-40) to initiate a reactor scram.

· Two Engineered Safety Feature (ESF) systems, emergency ventilation and confinement, receive redundant and diverse inputs from the Irradiated Air Monitor Channel (RM 3-4), the Normal Air Monitor Channel (RM 3-5) and the Stack Monitor Channel (RM 4-1) to initiate a reactor scram and seal the confinement building.

2. The RSS and actuation of the ESF do not require operator action to mitigate the consequences of abnormal conditions.

3. The I&C System is designed to be as fail-safe as practicable and to tolerate single failures without a significant reduction in safety and monitor for failures which do not fail in the safe direction.

4. A single failure will not prevent a safe shutdown of the reactor.

5. Most of the I&C System equipment is not required to operate during a credible accident. The requirement is for the reactor to be placed in a secured condition. Equipment for this purpose has backup power supplies.

From accident analysis, different stages of reactor operation have been defined and adequate logic control chains have been developed to ensure safe operation. The main parameters which are monitored and provide inputs to the logic chains are:

1. Primary coolant flow and reactor vessel level;

2. Neutron flux level and period (rate of change);

3. Radioactivity levels; and

4. Electrical power.

7.2.2 Design Basis Requirements

7.2.2.1 Reactor Control System

The control philosophy of the NBSR stems from the nature of the xenon poison problem, which is characteristic of high flux thermal reactors. After a shutdown, xenon poison builds up to levels which are exceedingly high. In order to be able to restart the reactor after shutdown without major core reloading, large excess reactivity and rapid rod withdrawal would be necessary, both of which are counter to safe operation. It was therefore decided to design a control system that stresses reliable operation and minimizes inadvertent reactor shutdown. Little reactivity is carried for xenon override and rod withdrawal rates are conservatively slow. The control rods are designed to limit both reactivity and reactivity rate of change. The potential for false scrams is minimized through the use of redundant circuitry and coincidence logic.

Of all the parameters that are measured and controlled, the thermal neutron flux level is the primary quantity that is measured for reactor operation and safety. The flux measuring instruments indicate over the entire range, from source range level to in excess of full power, and signal the safety system if the reactor power level exceeds a preset maximum. Indication overlap exists between the instrument types used to measure and indicate flux.

7.2.2.2 Reactor Safety System

The primary parameters of concern are the reactor power level, the reactor period, the reactor vessel level, and the primary coolant flow. Other parameters include Irradiated Air activity, Normal Air activity, and Exhaust Stack activity. In addition to initiating a reactor scram, these last three parameters also automatically activate equipment to prevent activity in the air from escaping the building. The RSS also receives inputs from the Moderator Dump, scram switches, and relays that monitor the Process Instrument 28 VDC power supplies and the 24 VDC clutch card power supplies. It is unnecessary to monitor the Nuclear Instrument 120 VAC power supply, because a loss of this power supply causes a nuclear instrument channel scram.

There is a large margin between the setpoints at which RSS action occurs and the limiting safety system settings. This conservative approach provides further assurance that the safety limit will not be approached. For example, the normal licensed operating power level is 20 MW and the scram is set at 125% of this level (25 MW), while the limiting safety system setting is 130% (26 MW).

Prevention and mitigation of undesirable reactor conditions may be accomplished by stopping the addition of positive reactivity to the core or through the addition of negative reactivity to the core, i.e. reactor power reduction or reactor shutdown. Significant negative reactivity can be added through scrams, rundowns, and moderator dump.

· A scram signal de-energizes the scram relays, which decouple the magnetic clutches from each shim arm drive motor, allowing the four shim arms to fall into the core assisted by a large downward force produced by a spring on the shim drive shaft. The same signal causes the regulating rod to drive down into the core at normal speed until the rod reaches its lower limit of travel.

· A rundown signal causes all five control rods to drive down into the core at a normal speed until the rundown signal ceases or the lower limit of travel is reached for each rod.

· The moderator dump rapidly drains away the heavy water above the core, removing the reflector necessary to maintain the reactor critical. The moderator dump can only be initiated manually.

· Rod stop signals such as Withdraw Prohibit prevent the control rods from moving upward, i.e. prevents adding positive reactivity.

The logic control chains, in order of impact on the reactor, that are grouped within the reactor safety system are:

1. Major Scram (reactor trip and confinement isolation);

2. Reactor Scram (automatic and manual);

3. Non-RSS Start Up Prohibit (disable reactor startup);

4. Non-RSS Withdraw Prohibit (disable shim arm withdrawal), and;

5. Outlet Temperature Rundown.

7.2.3 System Performance Analysis

The I&C System has an excellent performance history since the reactor achieved initial criticality on December 7, 1967. All of the equipment and subsystems that comprise the I&C System have been well designed and maintained. NBSR 15 contains specifications, surveillance requirements, and bases for specific I&C components. Instruments are tested for operability and calibrated on a regular basis. All maintenance is documented and reviewed to reveal a failing or failed instrument channel. In addition, there is an ongoing program to upgrade and/or replace these systems, components, and equipment with the latest available technology.

7.3 Description and Operation

Figure 7.1 presents a simplified block diagram of the Reactor Instrumentation and Controls (I&C) System. It shows the important design aspects of the system and the interconnections and relationships among the subsystems that comprise the I&C System.

7.3.1 Instrument Channels

7.3.1.1 Nuclear Instrument Channels

Seven separate nuclear instrument channels (NC-1 to NC-7) monitor the reactor power level from the subcritical state at start-up through the power range, i.e. a power level of 1 MW or greater. Each channel consists of a detector, high voltage and signal cabling, amplifiers, local and remote output display devices, and associated alarm, scram or control circuitry. Diagrams of the nuclear instrument channels are provided in Drawing , 7.4a, and 7.4b. Five channels are installed and two channels are normally not installed.

The detectors are located in instrument wells in the biological shield and may be positioned at different elevations within the well. Each detector location can view the reactor core through a lead window, which is at a fixed elevation in the well. The purpose of this window is to shield, if necessary, the detectors from the strong gamma radiation field that would otherwise be present at the detector location as a result of the fission process. Hence, they measure the leakage neutron flux from the core.

The two channels which are not normally installed are designated NC-1 and NC-2. They are placed into service and used as startup channels when neutron levels fall below the detection capability of the installed nuclear channels. These channels are the NBSR source range channels; detection and indication occurs at power levels of less than 2 x 10-10 amps, the equivalent of approximately tens of watts. Each channel monitors reactor power (counts/second) and reactor period (seconds). These channels produce a Startup Prohibit signal when the count rate drops below 2 cps (Low Count Rate) or produce a Withdraw Prohibit signal when the period decreases below 15 seconds (Source Range Period Rod Stop). In the source range, a rate of less than 2 cps does not provide assurance of an accurate measurement of neutron population and a period shorter than 15 seconds does not provide assurance, with a conservative margin, of adequate instrument response for a startup accident.

Drawing shows a schematic of the Source Range channel. The detectors are B10-lined proportional counters. These channels are powered by a 120 VAC outlet supplied from critical power panel CP-1.

The installed channels are designated NC-3,-4, -5, -6, and -7. NC-3, -4, -6, and -7 are Log/Linear channels. Figure 7.4a shows a typical Log/Linear channel. These channels are powered by a 120 VAC outlet supplied from CP-1. The signal from a compensated ion chamber is sent to both a log amplifier and a linear amplifier, although compensating voltage is not necessary because of the attenuation of gamma signal by the reactor shield in which the detectors are located. The log circuit produces indication of nuclear power between 10-10 and 10-3 amps, with the high end nearly an order of magnitude greater than nominal full power; the low end of the scale allows for overlap with the source range indication and the high end allows for accurate indication at the highest anticipated power level. The log circuit provides protection from a startup accident during low power conditions, i.e. power less than 5% of full power, through a scram signal generated for a period shorter than 5 seconds.

The linear circuit provides power indication in units of percent power between 0 and 150% of full power and provides protection from excessive power levels through a scram signal generated at 125% of full power. The scram function is bypassed once the reactor is operating above the technical specification limit of 5% power.

The NC-5 channel uses a compensated ion chamber as a detector, with no compensating voltage applied for the same reason none is applied in the log/linear channels. NC-5 is powered by a 120 VAC outlet supplied from CP-1. The settings on the NC-5 Range Select switch vary from 0-2 W through 0-20 MW in eight steps. The power level range covered by the recorder is 0-150% of the setting of the NC-5 Range Select switch, with indication in percent of full scale. This channel is for power indication and automatic control of the reactor through motion of the regulating rod. The channel has no related protective actions.

A minimum of one decade of overlap is designed into the transition between Source Range and the log circuit of the Log/Linear channels. The heavy water moderated reactor normally produces sufficient photoneutrons after shutdown to make the two Source Range channels unnecessary. The source range channels are needed following extended shutdowns which result in the photoneutron source decaying to a level below that detectable by the Log/Liner channels. The source range channels may also be needed for refueling following a full core off-load.

7.3.1.2 Process Instrument Channels

The Process Instrumentation Channels monitor the process parameters. These parameters are primary coolant flow, primary coolant differential temperature across the core, and reactor vessel level. In addition, all parameters that cause a reactor scram have an input to the RSS. The Process Instrumentation is both diverse and redundant. The Reactor Vessel Level Indicator Channel and Reactor Vessel Level Recorder Alarm Channel provide inputs to the scram circuit. The Reactor Outer Plenum Flow Recorder Channel, the Reactor Inner Plenum Flow Recorder Channel, and the Reactor Outlet Flow Indicator Alarm Channel provide diverse inputs to the scram circuits.

7.3.1.3 Thermal Power Channel

The Thermal Power Recorder Channel, BTUR, provides the reactor operator with indication of the thermal power output from the reactor core. This channel derives the power measurement from the output of the Reactor Vessel Outlet Flow Recorder Channel, a dedicated inlet temperature channel, and a dedicated outlet temperature channel. These channels are calibrated annually and periodic calorimetric calibrations are performed to verify the thermal output of the reactor. The indications of NC-3, -4, and -6 are adjusted to read 100% power after reactor thermal power has risen to 20 MW.

7.3.1.4 Reactivity Control Devices

7.3.1.4.1 Shim Safety Arms

The purpose of the shim safety arms is twofold:

1. To adjust for gross changes in reactivity, and;

2. To shut the reactor down quickly.

Shim arms are normally used to bring the reactor critical and change power level. After the nominal full power level is attained, the shim arms are typically moved up a small amount every 2 or 3 days to add positive reactivity to compensate for fuel burnup. The shim arm movement also causes the regulating rod to move down a large amount. This action is repeated until the end of the operating cycle or until the shim arms are in the full up position, after which the regulating rod and coolant temperature are the only routine means to compensate for fuel burnup.

The shim arms have a negative reactivity worth greater than the maximum excess reactivity of the reactor and will shut the reactor down and hold it sub-critical even after the water is cooled and the fission products have decayed.

The design of the shim safety arm drive includes a spring which assists gravity to accelerate the shim arm into the core upon release of an electromagnetic clutch. The release time, including instrument response, clutch release, and the top 5° of rod travel, is no more than 240 milliseconds. The total time for the shim safety arm to fully insert, including instrument detection and signal propagation, is less than approximately 500 milliseconds. The normal insert/withdraw rate of the shim safety arms is approximately 0.047 °/sec. Each shim arm is worth approximately 6.5% reactivity. See Chapter 4 for details of control rod worth. Position indication is transmitted to the control panel for each arm individually.

Individual shim position switches allow the reactor operator to move a shim safety arm without changing the position of the other three shim safety arms. A Shim Rod Gang switch allows the operator to move the four shim safety arms simultaneously. Indication is included for both full up and full down position.

7.3.1.4.2 Regulating Rod

The reactor power is normally maintained by the regulating rod, which mechanical operation is described in Chapter 4. Sections 7.3.1.1.1 and 7.3.3 describe the control mechanism for manual and automatic operation of the regulating rod.

The rod is driven by two reversible 115 volt, 60 cycle AC servomotors in a drive assembly which positions a lead screw. Simultaneously, selsyn transmitters on the top of the motor transmit electrical signals to a synchro signal digital converter, which drives a digital display on the main control panel. Both coarse and fine control indications are transmitted by separately geared position transmitters. Gear reducers are coupled to the position transmitters and give speed reductions of 5:1 and 30:1. The indication is accurate to 0.02 inches (0.05 cm).

The regulating rod drive has a travel of approximately 29 inches and the servomotor drives the rod full travel in about 15 seconds. The total rod worth is approximately 0.6% reactivity. The maximum rate of reactivity control with the regulating rod is approximately 0.05% per second, as determined by rod calibrations. By design, the withdrawal and insertion speeds of the regulating rod are the same whether in automatic mode or manual mode of operation.

While the regulating rod does not release and drop into the core during a reactor scram, it is automatically inserted by the rundown circuit. The scram relays de-energize the startup prohibit relays. One set of contacts in the startup prohibit relays is wired in series with the rundown relays, so de-energizing the startup prohibit relays generates a rundown signal.

Annunciator indication is included for both near up and near down position in addition to full up and full down position. This feature permits operators to move the shim arms as described in Section 7.3.1.4.1 before achieving full up or down conditions for the regulating rod, thereby permitting more nearly linear reactivity control with rod position.

7.3.1.5 Manual Scram Stations

In addition to the scram buttons on the main control panel, one manual scram station is located on the east wall of the Process Room, near the Process Room door. The station consists of a momentary pushbutton that has contacts in the manual scram rung of Drawing 70-009-01-ED.

7.3.1.6 Main Control Panel

The panel in the Control Room provides all of the information and controls needed by the operator to safely operate the reactor from a centralized location. The center, angled, portion of the console (Panels C, D, and E shown on Figure 7.2) holds instrumentation and controls associated with the reactor and has selected channels which record as well as indicate for trending purposes. Nuclear instrumentation provides overlapping indication of reactor power level from startup to full power, as well as indication of reactor period. There are controls and indications for the shim safety arms, the automatic regulating rod, and the primary and cooling pumps. Individual annunciator plates comprise three annunciator panels, located at the top of the vertical backboard on this portion of the console. The individual annunciator plates alert the reactor operator to abnormal conditions, as well as indicate the source of scrams and rundowns. An additional three-window annunciator panel located just below the center annunciator panel alerts the operator to the presence of a scram, rundown, or withdraw prohibit signal.

The console to the left of the reactor controls (Panels F, G, H, J, K, and L) provides instrumentation and controls associated with the auxiliary systems, experimental facilities, and radiation monitoring equipment. Two annunciator panels on this portion of the console alert the reactor operator to abnormal conditions in these systems. Each annunciator plate on a panel is labeled with the underlying cause.

The console to the right of the reactor controls (Panels A and B) holds much of the instrumentation and controls associated with nuclear instrumentation. The electronics for NC-5 are located in Panel C.

A second function of the display system is to provide essential information at the Emergency Control Station (ECS) located outside of the confinement building in the basement level of the A-wing. Information is available at the ECS for use during emergencies that result in the evacuation of the Control Room. The Emergency Ventilation Control Panel is in the ECS.

7.3.1.6.1 Instrument Test Panel

Reactor process and nuclear instrumentation channels are routinely tested using the Instrument Test Panel (ITP). The ITP allows the simulation or bypass of multiple (approximately 20) instrumentation channels to perform maintenance. The ITP simulation function is enabled by operating a key switch which actuates an “ITP Test Mode Enabled” annunciator alarm and allows the insertion of external test signals into the instrument signal path. Locking toggle switches are used for individual process test circuits, e.g. cold source pressure rundown, so that multiple signals or alarms may be simulated for testing by an individual. Channels that provide a reactor scram function use momentary push button switches that do not lock. This feature prevents a single individual from simultaneously bypassing scram functionality and controlling the reactor.

7.3.1.6.2 Rod Drop Test Key Switches

The Rod Drop Mode (Rod Drop Test Mode) is an operating mode that allows single shim arm manipulation and testing without the requirement for reactor confinement or the operation of systems normally required for reactor startup or testing, such as reactivity worth measurements of the shim arms. The Rod Drop Test Mode prohibits the withdrawal of more than one shim arm through a circuit in the safety system ladder logic and concurrently disables some interlocks in the startup prohibit and scram rungs. Rod Drop Test Mode is established by placing key switches S-11A and S-11B on Panel B of the main control panel in the enable position and selecting a shim arm to test with the Rod Test Selector Switch (S-12) on Panel F of the main control panel. The two key switches are configured to assure that scrams and rundowns will not remain bypassed if a switch fails in closed position. Rod Drop Test Mode performs the following functions:

1. Bypasses reactor inlet and outlet low flow scrams.

2. Bypasses all contacts in the Startup Prohibit circuit.

3. Removes a bypass of the Rod Drop Test logic rung, which will cause a rundown if any shim arm but the selected shim arm is moved above its lower limit.

A rundown is initiated, a “Rod-Test On” alarm is received, and a Withdraw Prohibit is enabled if the operator raises any shim arm other than the selected shim arm or the operator uses the shim arm gang switch.

7.3.1.6.3 Process Test Key Switches A & B

A capability to test the process scrams during reactor operation is implemented through the process test key switches, each of which have two positions. Normally, with both switches in the 1 of 2 position, each of the four shim arm clutches are energized through contacts associated with a single K103 scram relay, e.g. K103c. Opening a contact in the two scram rungs described in Section 7.3.4 will cause a loss of power to the four K103 scram relays, resulting in de-energized clutches and a scram. When the switches are in a 2 of 2 configuration, each shim arm clutch receives power through contacts associated with two of the K103 scram relays, ensuring that a scram signal from a single process instrument channel will not cause a scram. It is therefore possible to test a process instrument channel and not cause a scram; the 2 of 2 configuration affects only one scram rung and therefore scram protection is still available from the other rung. The key switches are located in the rear of Panel E.

7.3.2 Radiation Monitoring System

7.3.2.1 Area Radiation Monitor Channels

The Radiation Monitoring System consists of area monitors, duct monitors, and effluent monitors located throughout the facility to indicate a release of radioactive isotopes of activity greater than limits established for those isotopes and their potential release to the environment. Area monitors have been positioned at locations where either experimental work is performed or where work involving radioactive material is likely to be undertaken. As a result, personnel in those areas can be warned by the alarms associated with the monitors of any unanticipated changes or hazards. The effluent monitors provide continuous indication of the radioactivity in the air, either gaseous or particulate. Secondary coolant is normally continuously monitored for beta-gamma radiation and sewer discharge is sampled periodically for beta-gamma radiation. If radioactivity thresholds are exceeded for the gaseous monitors, a scram signal would be generated and two Engineered Safety Features systems would be activated; the confinement building penetrations would close and the emergency ventilation would start. All area and effluent radiation monitors alarm in the control room.

Area Radiation Monitor Channels, RM1-1 through RM1-10, measure selected areas in the confinement building for radiation. Detectors are mounted on the walls or ceilings. Each detector location has a local meter that indicates the radiation level and an alarm and warning light. An annunciator on annunciator panel 2 alerts the reactor operator to a high radiation condition in the confinement building. The monitors provide a signal to a recorder dedicated for direct radiation measurements and located in the control room.

Rabbit Lab Radiation Area Monitor Channel, RM1-15, monitors room C-001 for high radiation levels in the vicinity of the rabbit receivers. Local indication only is provided at the entrance to this room. Audible and visual alarm signals are provided locally and on annunciator panel 2.

The Guide Hall Area Monitor System measures and records the radiation level at selected points in the guide hall. Detectors are mounted on the exterior walls of the guide Hall around its perimeter and in the storage and truck loading area. Each detector location has a local meter and an alarm and warning. Remote indication, recording and alarm are provided on an equipment rack located at the south entrance to the guide hall.

If the trip levels of the Normal Air Monitor, the Irradiated Air Monitor, or the Stack Monitor channels exceed their trip set point, a Major Scram is initiated, shutting the reactor down and initiating confinement building isolation.

7.3.2.2 Duct Filter Monitor Channels

Duct Filter Monitor Channels, RM1-11 thru RM1-13, measure the radiation levels in the exhaust duct filters for the confinement building. They monitor the duct filters on the suction sides of the Irradiated Air Exhaust Fan EF-4, the Normal Air Exhaust Fan EF-3, and the Reactor Basement Recirculation Fan EF-27. There are individual channel alarms in the Control Room and a common annunciator on annunciator panel 2. The three monitors provide a signal to the recorder that also displays the output from the ARM.

The Duct Filter Monitor System for the Warm Labs outside of Reactor Confinement monitor the radiation levels in the exhaust duct filters serving the labs in the basement of the Confinement building and in the office building adjacent to the confinement building. The system is a computer based data acquisition system located in Room A-134. The system monitor provides a graphical depiction of the floor plan for the warm wing of Building 235. Each of the monitoring channels is located on this floor plan in the associated room. Level and status is provided for each location.

7.3.2.3 Secondary Cooling N-16 Radiation Channel

RM3-1 and RM3-3 monitor the secondary coolant for the presence of N-16, an indicator of a primary to secondary leak. A sample line taps off of the secondary header after the Main Heat Exchangers and provides water flow through the detector for each channel. Indication and alarms are provided locally at the equipment rack in the Pump House and in the Control Room. An alarm on either of these two channels alerts the reactor operator to a high activity condition in the secondary coolant.

7.3.2.4 Helium Sweep Gas Radiation Channel

RM3-2 checks for the presence of fission products in the Helium Sweep Gas System. The presence of fission products is indicative of a fuel cladding failure. A sample line diverts a portion of the helium gas from the system by the detector for the channel. A rate meter provides: Local indication at the monitoring station located on the Reactor Mezzanine; an input signal to a recorder dedicated for effluent monitors and located in the Control Room; and an alarm output that supplies a signal to an annunciator in the Control Room.

7.3.2.5 Ventilation Tritium Monitor

The Tritium Monitor Channel samples the air within the confinement building for the presence of tritium, which is present in elemental form and in hydrogen compounds, predominately tritiated water vapor. Elemental tritium and tritiated water vapor are of concern only as a radiation hazard to personnel. A detector located on the B-1 level of the confinement building is supplied with air samples drawn by an associated blower from nine different sample points located throughout the confinement building. The purpose of this system is to detect and monitor tritium concentrations in the sampled air volume, but the detector is sensitive to other nuclides. Therefore, indications may represent a mixture of radionuclides and during reactor operation this system could readily detect argon-41, resulting in a false tritium signal; consideration of the sample conditions may be necessary to properly characterize the tritium concentrations. The tritium concentration detected by the dual ion chambers monitor is indicated on a dedicated tritium recorder in the Control Room, with an alarm set to alert the reactor operator to an abnormal tritium level. A loss of flow through the detector will also initiate an alarm.

7.3.3 Reactor Control System

This system consists of the instrumentation and controls to move the control rods. The control rods can be moved to startup the reactor, change power level, operate automatically or manually at a selected power level, and shutdown the reactor. In manual mode, the reactor operator manipulates the four shim safety arms and the regulating rod, as needed, to start up and shut down the reactor and to change power levels. In automatic mode, a flux controller automatically positions the regulating rod to maintain a specified power level as measured by the Wide Range Linear Channel, NC-5. The power level may also be changed in the automatic mode by moving the regulating rod through use of the power demand potentiometer on the Main Control Panel. The Main Control Panel provides the operator with all of the controls and instrumentation necessary to change rod positions.

Reactivity can be controlled in the NBSR by means of three separate systems: the regulating rod, the shim safety arms, and the top reflector (moderator) dump. The latter two can also be individually or collectively brought into action for reactor scram purposes.

There are several interlocks associated with the Reactor Control System:

· Scram: The shim safety arms and regulating rod cannot be withdrawn to start up the reactor until all of the contacts in the scram logic circuits are closed, indicating that the parameters associated with these contacts are in their normal ranges and the K103 scram relays can be reset (energized) by the reactor operator. This ensures that scram protection is enabled before more than one shim safety arm is withdrawn.

· Startup Prohibit: A reactor startup cannot commence after a scram signal has been received until all of the contacts in the startup prohibit logic circuit are closed, indicating that the parameters associated with these contacts are in their normal ranges, after which the reactor operator may reset the control power (K104) relays. This ensures that scram protection is enabled and that operating conditions in the plant are stable and within their normal operating ranges prior to startup. An indicator associated with the control power key switch on the console indicates the status of the logic string, i.e. “control power” is enabled.

· Withdraw Prohibit: The shim safety arms and regulating rod cannot be withdrawn until all of the contacts in the withdraw prohibit logic circuit are closed, indicating that the parameters associated with these contacts are in their normal ranges and the shim arms are not in an abnormal condition for startup.

· Automatic Regulating Rod Control: The regulating rod can be placed in the automatic mode at any power level within the control range of NC-5. The flux controller automatically positions the regulating rod to maintain reactor power level within ± ½% of the setting of the Power Demand Potentiometer. A deviation of 2% from the NC-5 power setting will activate an annunciator on the Main Control Panel. Operation will revert to manual operation if: A reactor scram signal occurs; the regulating rod reaches the full in or full out positions; a deviation of at least 10% from setpoint for NC-5 exists; or the regulating rod switch is operated.

· Rundown: This action occurs if any of the contacts in the rundown logic circuit open, indicating that the parameters associated with the contacts are not in their normal range. The parameters in this logic string include those process and nuclear instruments in the scram logic circuit as well as additional parameters associated with the reactor outlet temperature, the cold sources, the thermal column tank cooling system, and the thermal shield cooing system.

7.3.4 Reactor Safety System

The Reactor Safety System, shown in Drawing 70-009-01-ED, is a hardwired relay logic ladder with multiple inputs and multiple functions. Refer to Table 7.6 for a list of the instrumentation designators used in the relay logic diagrams. A ladder rung (also called a circuit or a string) is formed by multiple contacts wired in series with either a single relay or multiple relays wired in parallel. Each contact in a given rung represents a specific plant parameter and is controlled by the instrument or equipment associated with that parameter. Each rung in this ladder has a unique function assigned to it. Some of the functions are part of the RSS while the remaining functions are part of the Reactor Control System. Examples of the assigned functions are scram, manual scram, and withdraw prohibit.

The RSS relay logic is supplied by a combination of parallel redundant 24 VDC power supplies and parallel redundant 48 VDC power supplies, fed from panel CP-1 as shown in Figure 7.3 and Drawing70-007-BD. CP-1 has backup power in the event that offsite power is unavailable, as described in Chapter 8. This power distribution system design assures that control power is always available to all but the Startup Prohibit (rung 5) and Scram logic rungs (4A & 4B). Control power to these three rungs is applied through key switch S-4.

In addition to the contacts associated with specific actions, e.g. scram or rundown, there are “maintaining contacts” in each of the four K103 scram relays. These contacts ensure that the system does not automatically return the reactor to a non-secured condition or reset the scram protections without operator action, in accordance with the design criteria. The contacts are wired in parallel with the normally open contacts for the scram reset pushbuttons. The maintaining contacts and the reset button contacts are wired in series with the scram circuits. If all of the contacts in the scram logic strings are closed and the control power key switch is ON to provide power to the two scram strings, then the K103 scram relays can be energized by depressing the scram reset pushbuttons. Once the K103 relays are energized, the maintaining contacts stay closed and will keep the relays energized, regardless of the condition of the pushbuttons, thereby allowing the release of the reset pushbuttons. Any scram that occurs breaks the circuit and de-energizes the K103 relays and opens the associated maintaining contacts. This prevents an automatic reset of the K103 relays, i.e. operator action is required, after the initiating scram signal is no longer present. After the scram relays are reset, power is then available to the startup prohibit K104 relays, i.e. operator action is required to take the reactor from a shutdown condition to an operating condition.

The Normal Air Monitor Channel, Irradiated Air Monitor Channel and the Stack Monitor Channel control the relays in the major scram circuit. Upon the detection of an excessive activity level by any of the three channels, the major scram relays open contacts in the scram logic strings, thereby initiating a reactor scram and isolation of the confinement building; the relays shut the doors at the entrances to the confinement building by de-energizing the Door Scram Relays (DSR), shift the ventilation lineup to the Emergency Exhaust System by de-energizing the Fan Scram Relays (FSR), and close the Neutron Guide Isolation Valves.

The moderator dump switch S6, located on the main control panel, has contacts in the scram logic strings. Additional contacts in this switch open the Moderator Dump Valve DWV-9, dumping primary coolant above the core into to the D2O Storage Tank. These contacts also cutoff the main coolant pumps, prohibit the shutdown pumps from starting, and automatically close LOCA isolation valves DWV-1, DWV-2, DWV-19, DWV-95A, DWV-95B, DWV-100A, and DWV-100B.

NC-1, 2, 3, 4, and 6 control relay contacts in the startup prohibit circuit. This ensures visible indication of reactor power level before any control rods are withdrawn in accordance with the design requirements for the reactor control system. Other contacts in the startup prohibit string ensure that the control rods cannot be withdrawn unless: The level in the emergency tank is in its normal operating range; the reactor vessel is in its normal operating range; and the shim safety arm clutches have sufficient current.

Functions that generate alarms only include test fault contacts that ensure the reactor operator is not unknowingly observing test signal indications from the nuclear instrumentation. Similarly, the Instrument Test Panel (ITP) generates an alarm if the process instruments test circuits are not in the proper configuration for operating the reactor. The input parameters to the startup prohibit circuit are listed in Table 7.2.

Reactor Control System components that overlap with the RSS include:

· The Withdraw Prohibit function (Rung 7). NC-1, 2, 3, 4, and 6 control relays that prevent the withdrawal of any shim arms when the reactor period is too short. The rundown function also prevents a withdrawal of the control rods when a rundown signal is present. The input parameters to the withdraw prohibit circuit are listed in Table 7.3.

· The rundown function (Rung 6). Selected primary plant parameters and selected cold source parameters control relay contracts in this rung of the logic ladder. If any of the contacts in the rundown logic string open, a rundown occurs. The input parameters to the rundown circuit are listed in Table 7.4.

· The shim safety arms and regulating rod positioning and indicating functions.

The source range channels provide to the RSS the following inputs:

· Input is provided for a short period withdraw prohibit and a low count rate (detector not indicating) condition in the startup prohibit rung. A short period is defined as the longest period at which period-related protective actions commence.

The log circuits of NC-3, -4, and -6 have within the RSS the following functions:

· De-energize the high voltage supplied to the source range detectors when the current exceeds 2 x 10-10 amps (Source Range High Voltage Disconnect) on all three channels;

· Produce a withdraw prohibit signal when the period decreases below 15 seconds on any of the channels and with power ≤ 10%;

· Rundown the reactor when the period decreases below 10 seconds on any of the three channels with power ≤ 10%, and;

· Scram the reactor when the period decreases below 5 seconds on any of the three channels with power ≤ 10%.

The linear circuits NC-3, -4, -6 have within the RSS the following functions:

· Disable the Period Stop (15 seconds), Period Rundown (10 seconds), and Period Scram (5 seconds) when the reactor power level on all three channels exceeds 10%;

· Rundown the reactor at 115% power, and;

· Scram the reactor at 125% power.

· For the 125% power scram, the selected position of the Coincidence Selector Switch determines if a scram occurs when any one of the three linear circuits’ indications (1 of 3 coincidence) exceeds the setpoint, or if it requires that any two of the three linear circuits (2 of 3 coincidence) exceed their setpoint before a scram occurs.

7.3.5 Process Safety System

The process instrumentation utilized for the NBSR reactor is of solid state design utilizing transmission of standard 4 to 20mA direct current signals. Typically, that transmission is via twisted pair instrumentation and control cables, which provide shielding to maintain signal integrity. The receivers, recorders, controllers, and bistable trips (monitor switches) are connected in series loop circuits at 24 VDC, the regulators for which are powered from a redundant pair of ±28VDC ungrounded power supplies. Two separate circuits from panel CP-1 feed power to each of the two Process Instrumentation Safety System power supplies as shown on Figure 7.3 and Drawing 70-007-BD.

Table 7.1 lists the scrams associated with operation of the NBSR reactor.

7.3.6 I&C Panels Outside of the Control Room

7.3.6.1 Emergency Ventilation Control…