TRANSMITTED TO DOE/M. WHITAKER 7/5/95 DEFENSE NUCLEAR FACILITIES SAFETY BOARD June 3, 1992 MEMORANDUM FOR: G. W. Cunningham, Technical Director COPIES: Board Members FROM: J. D. Roarty A. F. DeLaPaz U. S. Rohatgi SUBJECT: Trip Report from DNFSB Staff Visit to Savannah River Site to Discuss K-Reactor Axial Power Monitors 1. Summary The design basis for the Savannah River K-Reactor incorporates an Axial Power Monitor (APM) that provides a control on the axial neutron flux (and heat flux) distribution in each fuel assembly. Recent calibration of these monitors indicates larger errors exist than were used in the analysis to establish the power limits for core. Reactivity addition accident analyses are impacted as a result of these errors and WSRC estimates that the power capability defined in the Safety Analysis Report for Single Rod Injection accidents may be reduced from 50% of historical full power (2400MW) to between 40% and 45%. Thus, the current established power limit of 30% is not affected. The following are the primary observations made during the meeting: a. The LOCA (including the limiting gamma heating phase) analyses are unaffected by the increased APM uncertainties. However, non-LOCA accidents such as Gang Rod Withdrawal, Single Rod Withdrawal, and Single Rod Insertion accidents are affected. WSRC estimates that a decrease of between 5 and 10% on initial reactor power will result for these accidents due to the increase in the APM uncertainties. WSRC stated that the final "refined" safety analysis will be completed within four weeks. Non-LOCA accident analyses using an initial power level of 31% have been completed and demonstrate that for all design basis non-LOCA accidents, the reactor can be shut down without violating the thermal-hydraulic limits. The Loss-of-Pumping accident (LOPA) margin decreased by approximately 2% with the resulting initial power being 38%. b. APM biases are being used for each of the nine APM rods. These biases are incorporated into the Control Computer software and correspond to reactor shutdown conditions with full process water flow. However, WSRC has not estimated how much the APM biases will change as a function of core condition (process water temperature, power level, power shape, and fission product distribution). The APM biases will be reexamined at several power levels during the Power Ascension Program. Yet, WSRC has not stated at what point (percentage change in APM biases) they would change the programmed APM biases currently used in the Control Computer software. In addition, Travelling Wire Flux Monitor (TWFM) runs will be performed at several power levels for comparison with APM response. WSRC stated that if the APM and TWFM results differ by greater than 10 percent, calculations would be performed to better determine the axial power shape for the specific reactor conditions present using a neutron diffusion theory program or a Monte Carlo program such as MCNP. Any changes to the APM biases used by the Control Computer would include the consideration of these calculational results as well as the APM and TWFM data. c. During the DNFSB staff review of the APM uncertainty issue, it was learned that a reactor special procedure exists which allows the control computer to hold or change reactor power. The DNFSB staff believes that at no time should the Control Computer be used to hold or change reactor power. Central Control Room Operators (CCRO) must always be attentive to current reactor conditions which requires the constant use of manual control. d. The DNFSB noted in Recommendation 91-5, dated December 19, 1991, that the basis for limiting K-Reactor power to 30% of historical full power was the need for development studies in thermal-hydraulic methodology, acceptance criteria and experimental test programs used to analyze the core condition during an accident. DOE chose not to respond to this need as there are currently no plans to operate K-Reactor above 30% power. The recent K-Reactor experience with the APM calibration at low powers points up the need to have in-place adequately verified design procedures and methodology. The current analysis of overpower reactivity addition accidents indicates a loss in previously existing margin above 30% power. Upgraded analytical tools and supporting experimental programs as noted below are needed to better define thermal-hydraulic performance during accident conditions. 1. The thermal-hydraulic conditions in limiting fuel assembly subchannels are not predicted by a limited channel methodology, but are based upon best estimate nominal channel predictions coupled with a control over effluent temperature, that presumably accounts for off-nominal conditions and manufacturing uncertainties. With the lack of definition of limiting subchannel parameters, it is difficult to define and interrogate experimental test programs to assure that limiting subchannels are adequately protected. A limited selection of bounded subchannel conditions is appropriate to define experimental test conditions to benchmark and to assure the reference methodology is conservative. 2. WSRC discussed a recent experience from a Columbia University test program with a non-metallic, ribbed annular test section, where burnout occurred at a rib near the exit of the test section. This experience should be examined carefully as it suggests the need to better understand local flow and heat transfer adjacent to ribs. Currently, the thermal-hydraulic analysis of ribs in the limiting sub-channels is very approximate and utilization of a more sophisticated Computational Fluid Dynamics (CFD) code, coupled with metallic rib experiments, are needed to resolve this uncertainty. An example of the limitations in the testing database for non-LOCA analyses is the restriction of test heat flux to 400,000 BTU/foot2- hour whereas the heat flux predicted to be present during a Single Rod Insertion accident could be as high as 600,000 BTU/foot2-hour. 3. Single-phase analytical codes are used to analyze reactivity addition accidents in the flow instability phase of double-ended guillotine break loss-of-coolant accidents (DEGB LOCA). This methodology is not capable of predicting steam quality conditions that may exist in local regions of a subchannel (e.g., adjacent to ribs). Furthermore, it would be appropriate for the code algorithm for predicting local boiling pressure drop to be benchmarked at K- Reactor conditions to ensure accurate prediction of flow degradation during local boiling. 4. Critical heat flux (CHF) correlations are based on an antiquated methodology derived from two foot long test sections. A program is needed to ensure that CHF does not preempt flow instability and cause burnout. Such a program could incorporate prototypical conditions to the maximum extent practical. 2. Presentation This section describes the WSRC presentations given to the DNFSB staff. a. The first part of the meeting provided a background of the Axial Power Monitor (APM) uncertainty issue. 1. This APM uncertainty issue is the linearity of the APM sensors at low power ranges, i.e., just below the Instrument Shape Applicability Limit (ISAL), at which time the APM response is used in controlling the axial power shape in the core. The Radial Shape Factor and Tilt are used to control the radial power distribution in the core. ISAL is defined as the point when the difference between the maximum assembly exit temperature and the minimum plenum inlet average temperature is just equal to 7OC. 2. Originally, the APM's sensor voltage response was used in three separate applications by the Control Computer. These included the following: a. The Roof-Top-Ratio (RTR) is defined as the voltage response of sensor 2 divided by the voltage response of sensor 6 for each of the nine APMs. b. The Peak-to-Peak Ratio (PTPR) was determined using all seven sensors of each APM. The PTPR was used in monitoring saddle- shaped axial power shapes in the reactor. Recent SRS K-Reactor Technical Specification revisions included the removal of PTPR operating guidelines since saddle-shaped axial power shapes are not expected to occur during operation with the K-14 charge. This is due to the current plan of not replacing the inner target tubes during the demonstration run. c. Lastly, the lowest sensor from the APM rods is hardwired to a Power Density Monitor (PDM). The PDM compared the APM voltages to an adjustable setpoint. A control rod reversal signal was generated in the Control Computer when the APM signal reached the PDM setpoint. Recently, the PDM signal was bypassed such that a control rod reversal will no longer occur. No credit was taken for the PDM in the safety analyses. d. The APM response was previously monitored in the Central Control Room by use of the APM data acquisition system (DAS). However, addition of biases in the Control Computer software necessitated a change to the procedures for the use of the APM DAS such that the instrument will now be used only for trending purposes. 3. WSRC believes that, based upon APM testing at the vendor and at SRS using Joule heating techniques and the self-calibrating mode of the APMs, the uncertainties in the APM response are in the range of 6 to 9 percent. This compares to 2.2 percent originally assumed in the safety analyses. 4. The travelling wire flux monitor (TWFM) will be compared with the response of the APM sensors at power. There are hold points in the applicable test procedure of the Power Ascension Program if these differences exceed 10 percent. WSRC expects that these differences will be less than 10 percent based upon C-Reactor APM and TWFM comparisons in 1984. b. The next part of the meeting discussed the revised non-LOCA operating envelope due to the effects of the expanded RTR range as a result of the increase in the uncertainty in the APM sensor response. 1. The non-LOCA accidents which were most limiting included the Single Rod Insertion accident at lower river water temperatures and the Gang Rod Withdrawal accident at higher river water temperatures. 2. The previous non-LOCA safety analyses were based upon a 2.2 percent uncertainty in the RTR. The current Technical Specifications require that RTRs be between 0.8 to 1.20 from ISAL to PSAL (power shape applicability limit) and 0.9 to 1.10 from PSAL to full power (30% of 2400 MW). PSAL is defined as 80% of the applicable maximum allowable assembly average temperature increase. The new non-LOCA safety analyses use RTRs from 0.66 to 1.46 over all power ranges above ISAL. Even with these conservative limits, K-reactor is adequately protected at a power level of 31 percent. WSRC is currently refining the non-LOCA safety analyses to demonstrate a higher acceptable power level of 40-45 percent. c. The third part of the meeting discussed the effect of the revised axial power shapes on the Double-Ended Guillotine Break (DEGB) LOCA analyses. 1. The most limiting initial axial power shapes for the LOCA is a bottom-skewed cosine shape. The axial power shape assumed in the LOCA analyses used an RTR of 0.66. This includes the LOCA flow instability and emergency cooling system phases. Thus, no revision to the LOCA safety analyses was necessary. d. The fourth part of the meeting discussed the effect of the revised axial power shapes on the LOPA analysis. 1. The LOPA safety analyses assumed that the range of the RTRs could be between 0.66 and 1.51. For the most limiting phase of the LOPA, the emergency cooling system phase, the bottom-skewed cosine shaped axial power shape resulted in an initial power level of 40.4% to prevent the onset of significant voiding as determined using the single-phase FLOWTRAN-FI program. The use of a top-skewed axial power distribution led to the reduction of the maximum initial power level to 38%. e. The fifth part of the meeting discussed the effect of the revised axial power shapes on the gamma heating portion of the DEGB LOCA analysis. 1. The axial fission power distribution is derived from P-10 core power ascension data whereas the radial power shape is based upon calculations. The axial power shape uncertainty is based upon a cosine shape with no credit taken for the presence of partial length control rods which would tend to yield a flatter power distribution. The gamma deposition peak occurs in the same axial region as the axial fission power peak. f. The sixth part of the presentation discussed the APM biases. 1. At 75 MW, the APM sensor voltage response is expected to be between 0.45 and 1.0 mV. 2. The APM rod and the TWFM guide tube are separated from each other by a spacer. This spacer, which is close to APM sensor 6 is thought to be a large contributor to the APM bias. g. The seventh part of the presentation discussed the TWFM. 1. A basic overview of the TWFM system was provided by WSRC. A more detailed documented discussion of the TWFM system was provided to the DNFSB. 2. Each of the nine TWFM guide tubes includes two flux suppressors which serve as reference points when examining the resulting axial flux profile traces. These points were used to infer the uncertainty due to the variation in wire speed for successive wire irradiations. The one sigma variation has been determined to be 1.5%. 3. Comparison between TWFM measurements using five minute and ten minute irradiation times showed errors on the order of 6.1% at the one sigma level. WSRC stated that this error includes reactor power drift as well as all errors affecting TWFM measurements. 4. WSRC stated that the 1984 C-Reactor test comparing the self- calibrating gamma monitor (similar to current APM design installed in the K-Reactor) and TWFM results were within 10% at a reactor power level of 2500 MW. Due to the lower power levels at which the APM and TWFM comparisons will be made during the K- Reactor Power Ascension Program, the DNFSB staff expects violation of the 10% acceptance criteria. WSRC stated that in the event any acceptance criteria were exceeded for APM and TWFM comparisons, testing would not continue and WSRC-SRTC would perform neutronic calculations to characterize the axial power shape for the specific reactor conditions existing during the APM/TWFM comparison. These calculations would be used in addition to the TWFM data to determine the necessity of changing the APM biases programmed into the Control Computer. h. WSRC presented a discussion of the Flow Instability calculational process used for non-LOCA analyses and a recent Columbia University test with a ribbed annulus. i. The final discussions concerned the Control Computer software, procedure, and Technical Specification changes necessary to implement the application of biases for each of the APM rods. 1. The DNFSB staff was previously briefed by WSRC that administrative controls on Control Computer software changes would normally require several weeks (minimum) to change a single number in the software. These controls include the generation of software requirements, software acceptance criteria, a test plan, a test procedure, implementing the change, as well as quality assurance for each step of the process. The total time to implement these changes was approximately one week for the incorporation of the APM biases. WSRC stated that additional resources were applied that did not compromise the quality assurance of the program changes. 2. APM operability is defined as sensors 2 and 6 both reading greater than 0.31 mV as well as passing DPSOL 1137A surveillance. The Technical Specifications require that 7 of 9 APM rods be operable, including APM#1 or APM#2 when reactor power is greater than ISAL. 3. The Control Computer is used to determine the Radial Shape Factor and Tilt, as well as RTR. The Technical Specification surveillances require that these parameters be verified every 12 hours. WSRC stated that in the event both Control Computers are inoperable, reactor power is lowered to below PSAL. In addition, a Control Computer must be returned to service within 8 hours or the reactor shutdown. This 8 hour limit is likely based upon meeting the surveillance requirements of the Technical Specifications. However, the Control Computer is used by the CCROs to monitor the "pad" to thermal limits in the reactor. Even with the reduction in power to below PSAL, the CCROs should, to the maximum extent practical, be able to monitor reactor conditions at all times. Therefore, a 90 minute inoperable time limit for the Control Computers would be more appropriate.