ML20094P064

Proposed Tech Specs Reflecting Deletion of Boron Dilution Mitigation Sys

ML20094P064
Person / Time
Site:	Wolf Creek
Issue date:	11/22/1995
From:	WOLF CREEK NUCLEAR OPERATING CORP.
To:
Shared Package
ML20094P061	List: ML20094P059 ML20094P064
References
NUDOCS 9511280290
Download: ML20094P064 (29)

Text

i. .

j E-:

M'$

2'%- ~

l]M. w[

!ihO-to 't

!l 5 TABLE 3.3-1 s<

j Q

• n REACTOR TRIP SYSTEM INSTRUMENTATION

[ et

, w g o U N MINIMUM Q l3 TOTAL NO. CHANNELS CHANNELS APPLICABLE -

IN ' FUNCTIONAL UNIT OF CHANNELS TO TRIP OPERABLE MODES ACTION i f

'b I 1. Manual Reactor Trip 2 1 2 1, 2 1 S

'L 'G N

- 2 1 2 3*,4*,5* 10

2. Power Rarge, Neutron Flux

a. High Setpoint 4 2 3 1,2 2#

b. Low Setpoint 4 2 3 1###,2 2#

3. Power Range, Neutron Flux, 4 2' 3 1, 2 - 2#

High Positive Rate .

4. Power Range, Neutron Flux, 4 2 3 1, 2 2#

High Negative Rate

$ 5. Intermediate Range, Neutron Flux 2 1 2 1###,2 3

[ 6. Source Range, Neutron Flux 3

a. Startup g 6elete 2 1 2 2##" 4 reference-

b. Shutdown 2 1 2 3" 4, 5 5 to Note **

( J

7. Overtemperature AT Four Loop Operation 4 2 3 1,2 6#

8. Overpower AT Four Loop Operation 4 2 3 1, 2 6#

9. Pressurizer Pressure-Low 4 2 3 1 6#

10. Pressurizer Pressure-High 4 2 3 1,2 6#

/

+

'Attcchment IV to ET 95-0106 Page 3 of 6 IABLE 3.3-1 (Continued)

TABLE NOTATIONS

• Only if the Reactor Trip System breakers happen to be in the closed position and the Control Rod Drive System is capable of rod wit;idrawal.

"he ':cron d!!ut:en ux a doub!!ng :!gnc! 'ncy-be Med dudng reacter

!2 dup !n rece' dance e* norm 2! Operating precede %

1. The provisions of Specification 3.0.4 are not applicable.

1. 1. Below the P-6 (Intermediate Range Neutron Flux interlock) Setpoint.

1. 1. 1. Below the P-10 (Low Setpoint Power Range Neutron Flux Interlock) Setpoint.

(1) The applicable MODES for these chatinels noted in Table 3.3-3 are more restrictive and therefore applicable.

6CTION STATEMENTS ACTION 1 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABL E status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or be in HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

ACTION 2 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inoperable channel is placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />;

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels per Specification 4.3.1.1; and

c. Either, THERMAL POWER is restricted to less than or equal to 75% of RATED THERMAL POWER and the Power Range Neutron Flex Trip Setpoint is reduced to less than or equal to 85% of RATED THERMAL POWER within 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />; or, the

'JUADRANT POWER TILT RATIO is monitored at least once per 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> per Specification 4.2.4.2.

ACTION 3 - With the number of channels OPERABLE one less than the Minimum Channels OPERABLE requirement and with the THERMAL POWER level:

a. Below the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above the P-6 Setpoint; or

b. Above the P-6 (Intermediate Range Neutron Flux Interlock)

Setpoint but below 10% of RATED THERMAL POWER, restore the inoperable channel to OPERABLE status prior to increasing THERMAL POWER above 10% of RATED THERMAL POWER.

ACTION 4 - With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement suspend all operations involving j positive reactivity changes. I WOLF CREEK UNIT 1 3/4 3-5 Amendment No. 42,43

s l

'Attechment IV to ET 95-0106 i Page 4 of 6 I I

TABLE 3.3-1 (Continut;.d)

ACTION STATEMENTS (Continued) l ACTION 5- a. With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or open the Reactor Trip Breakers, and suspend all operations involving positive reactivity changes and verify valve BG Vi?S and BG VS01 cre d Od and secured *y>osition within the next hour.

b. With no channels OPERABLE, open the Reactor Trip Breakers, suspend all operations involving positive reactivity changes and verify compliance with the SHUTDOWN MARGIN requirements of of Specification 3.1.1.1 within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> thereafter.randverify+alve BG Vi?S and BG V601 are deced nd secured !=

positionwithm4hourrrend+erified4c be c!cced and secured in peeltion every-44-days, ACTION 6 - With the number of OPERABLE channels one less than the Total Number of Channels, STARTUP and/or POWER OPERATION may proceed provided the following conditions are satisfied:

a. The inopernble channel is placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; and

b. The Minimum Channels OPERABLE requirement is met; however, the inoperable channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing of other channels per Specification 4.3.1.1.

ACTION 7 - With the number of OPERABLE Channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> or be in at least HOT STANDBY within the next 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; however, one channel may be bypassed for up to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> for surveillance testing per Specification 4.3.1.1, provided the other channelis operable.

ACTION 8 With less than the Minimum Number of Channels OPERABLE, within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> determine by observation of the associated permissive annunciator window (s) that the interlock is in its required state for the existing plant condition, or apply Specification 3.0.3.

ACTION 9 - With the number of OPERABLE Reactor Trip Breakers one less than the Minimum Channels OPERABLE requirement, be in at least HOT STANDBY within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />; however, one breaker may be bypassed for up to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> for surveillance testing per Specification 4.3.1.1, provided the other breaker is OPERABLE.

ACTION 10 -With the number of OPERABLE channels one less than the Minimum Channels OPERABLE requirement, restore the inoperable channel to OPERABLE status within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> or open the Reactor trip breakers within the next hour.

ACTION 11 With the number of OPERABLE channels less than the Total Number of Channels, operation may continue provided the inoperable channels are placed in the tripped condition within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

WOLF CREEK - UNIT 1 3/4 3-6 Amendment No. 42,26,43,82

_ _ . . __. _ _ _ .m -... _. . . _ - . _ . . ~, ,_ _ - .. . . - . ......._

! Attcchment IV to ET 95-0106 + t

j. Page S of 6 gg

'S E n

l 5 TABLE 4.3-1 "$

! N REACTOR TRIP SYSTEM INSTRUMENTATIONSURVEILIANCE REQUIREMENTS k$

l n ,et M

.N TRIP <

ANALOG ACTUATING MODES FOR g 8

CHANNEL DEVICE WHICH l

c CHANNEL CHANNEL OPERATIONAL OPERATIONAL ACTUATION SURVEILLANCE $

l 3 FUNCTIONAL UNIT CHECK CAllBRATION TEST TEST LOGIC TEST IS REQUIRED ,

n w

- 1. Manual Reactor Trip NA NA NA R(11) NA 1, 2, 3*, 4*, 5* $

E

2. Power Range, Neutron Flux X

a. High Setpoint S D(2, 4) Q NA NA 1, 2 M(3,4)

O(4,6)

R(4, 5)

b. Low Setpoint S R(4) S/U(1) NA N.A. 1###,2

3. Power Range, Neutron Flux, N.A. R(4) Q NA N.A 1,2 High Positive Rate R

4. Power Range, Neutron Flux. N.A. R(4) Q NA NA 1, 2

• High Negative Rate Y= 5. Intermediate Range, Neutron Flux S R(4,5) S/U(1) NA NA 1###,2

6. Source Range, Neutron Flux S R(4, 5, 42) S/U (1), Q(9) NA NA 2##,3,4,5

7. Overtemperature AT S R Q NA NA 1, 2 3

8. Overpower AT S R Q NA NA 1, 2 6elete reference

9. Pressurizer Pressure-Low S R Q NA NA 1 to N to 12 J

10. Pressurizer Pressure-High S R Q NA NA 1, 2

11. Pressurizer Water Level- High S R Q NA NA 1

12. Reactor Coolant Flow - Low S R Q NA NA 1 i to

l I

l

'Attachm:nt IV to ET 95-0106 f* Page 6 of 6 TABLE 4 3-1 (Continued)

TABLE NOTATIONS

• Only if the Reactor Trip System breakers happen to be closed and the control rod drive system is capable of rod withdrawal.

1. 1. Below P-6 (Intermediate Range Neutron Flux Interlock) Setpoint.

1. 1. 1. Below P-10 (Low Setpoint Power Range Neutron Flux Interlock) Setpoint.

(1) If not performed in previous 31 days.

(2) Comparison of calorimetric to excore power indication above 15% of RATED THERMAL POWER. Adjust excore channel gains consistent with calorimetric power if absolute difference is greater than 2%. The provisions of Specification 4.0.4 are not applicable for entry into MODE 2 or 1.

(3) Single point comparison of incore to excore AXIAL FLUX DIFFERENCE above 15% of RATED THERMAL POWER. Recalibrate if the absolute difference is greater than or equal to 3%. The provisions of Specification 4.0.4 are not applicable for entry into MODE 2 or 1.

(4) Neutron detectors may be excluded from CHANNEL CAllBRATION.

(5) For Source Range detectors, integral bias curves are obtained, evaluated, and compared to manufacturer's data. For Intermediate Renge and Power Range channels, detector plateau curves shall be obtained, evaluated, and compared to manufacturer's data. For the Intermediate Range and Power Range Neutron Flux channels the pmvisions of Specification 4.0.4 are not applicable for entry into MODE 2 or 1 (6) Incore - Excore Calibration, above 75% of RATED THERMAL POWER. The provisions of Specification 4.0.4 are not applicable for entry into MODE 2 or 1.

(7) Each train shall be tested at least every 62 days on a STAGGERED TEST BASIS.

(9) Quarterly surveillance in MODES 3*,4* and 5* shall also include verification that permissives P-8 and P-10 are in their required state for existing plant r:onditions by observation of the permissive annunciator window. Quarterly 4urveillanceshalWwiude+eriSca!!cn of the-BoronDdution,Alam>Setpointd4ess4hartwegua&40en inc e:te Of twica4he40unt4atewithine-104ninutsperiode (10) Setpoint verification is not required.

"(11)The TRIP ACTUATING DEVICE OPERATIONAL TEST shallindependently verify the OPERABILITY of the undervoltage and shunt trip circuits for the Manual Reactor Trip Function. The test shall also verify the OPERABILITY of the Bypass Breaker trip circuit (s).

(12) Deleted. Atleastencaper-18-month &4uring4hutdown, veriFj that en : Oh ted BoronDilution-Ooubling4eskigna&4hanorma! CVCS d4schargewalveswil c!cce andthe-centrifugakhargingpumps-suctionwalves4rorn4he-RWST wdtopenwit>!n 30 seconds,

" Complete verification of OPERABILITY of the manual reactor trip switch circuitry shall be performed prior to startup from the first shutdown to Mode 3 occurring after August 14,1992.

3/4 3-12 Amendment No. 42,26,-65,83 WOLF CREEK - UNIT I

.. .-. -. . - . . . _ , . - . - . . . - -. . . - _ . . . . . ~ . ..

h' 4 WOLF CREEK NUCLEAR OPERATING p CORPORATION >

4 4

f.

h ENCLOSURE 1 TO ET 95-0106 4

t

-SAFETY EVALUATION OF THE PROPOSED CHANGES ON THE SOURCE RANGE FLUX DOUBLING BORON DILUTION MITIGATION SYSTEM FOR MODES 3, 4 AND 5.

1 l

I l

(. .

j

w l

-'Enclo:uro'l to ET 95-0106 ' Pega 2 of 24 -

1 4

I Table of Contents' .

]

I. Introduction and Background- 3 II.: Regulatory Basis: .4

'III. Event Description 5

' IV. -Description of'RMCS Design and Operation 8 V. Detection of an-Inadvertent Boron Dilution' Event

'in Modes 3, 4'and'5 9

.~.VI . Inadvertent. Boron Dilution Event Scenarios- -10

- VII.- .' Equipment Qualification 14

, ;VIII. ' Method ~of Aralysis 14

.IX. 2 WCGS Analysis' Inputs and Results 21 X, WCGS Specific ~ Actions Required for Implementation 23 XI. Summary 24

. . . _ . . m_, _ _ _

• Enclosure 1 to ET 95-0106 Page 3 of 24 I. Introduction and Background The inadvertent boron dilution event is considered in the licensing basis of Wolf Creek Generating Station (WCGS). This event is postulated to be initiated by a malfunction in the Chemical volume and Control System (CVCS) which results in a decrease in the boron concentration of the RCS. The possibility of this event is considered for all modes of normal plant operation.

Several recent studies have been performed concerning the risk associated with inadvertent boron dilution events, particularly during shutdown and refueling.

Among the most recent is NSAC-183 (December 1992), " Risk of PWR Reactivity Accidents During Shutdown and Refueling". Several conclusions of this report are relevant to the analysis of the inadvertent boron dilution event:

1) Due to their self-limiting nature, gradual inadvertent boron dilution events are not expected to cause core damage, even if they are unmitigated.

2) No inadvertent criticalities have resulted from any of the gradual inadvertent boron dilution events that have occurred to date.

, 3) The frequency of gradual inadvertent boron dilution events reported at commercial nuclear plants in the United States has declined significantly in recent years. (The frequency of an inadvertent criticality from an inadvertent boron dilution event is expected to be less than IE-4 per reactor year.)

In the typical analyses of the inadvertent boron dilution event in Modes 3, 4, and 5, the source range flux doubling Boron Dilution Mitigation System (BDMS) provided by Westinghouse is relied upon to detect an inadvertent boron dilution and to initiate actions to terminate the dilution. The analyses must demonstrate that the automatic BDMS actuates and effectively mitigates the boron dilution transient prior to the complete loss of shutdown margin.

Analytically, operation of this system is simulated by predicting the time of

" flux doubling" as seen by the source range neutron detectors through the use of an empirical inverse-count-rate-ratio (ICRR) curve. However, questions have recently been raised regarding the adequacy of the BDMS under certain core configurations because of the nonconservatisms of the input assumptions and boundary conditions used in the analyses. These nonconservatisms include:

1) The original licensing-basis inadvertent boron dilution event analysis for modes of operation which take credit for the BDMS did not properly account for the instrumentation uncertainties (i.e., source range channel noise, flux-doubling alarm setpoint, etc.) associated with the actuation of the BDMS, and

2) The cycle specific ICRR data may have a worse characteristic than that used in the analyses. The cycle-specific ICRR curve is very sensitive to the location of the neutron source relative to the source range excore neutron detectors and also to the burnup of the fuel assemblies between the source and the detectors. This sensitivity makes the appropriateness of the empirical ICCR curve to a specific core configuration difficult to demonstrate. With current analysis tools,

• Enclosure 1 to ET 95-0106 Pcge 4 of 24 the prediction of the source range detector response for a cycle-specific core configuration is not practical.

. If the possible effects of these nonconservatisms were accounted for, it may not be feasible to demonstrate the adequacy of the BDMS for a particular core configuration prior to plant startup. This concern prompted NRC Information Notice 93-32. Thus, an alternative approach has jointly been developed by the affected utilities. This approach is based on the detection of mass inbalances in the CVCS, which is unaffected by the previously described uncertainties. With the exception of initial and critical boron concentrations, this approach is insensitive to reload-dependent parameters.

Because the values of important parameters can be predicted prior to plant start, this approach also allows for the performance of reload safety I

evaluations in accordance with 10CFR50.59.

II. Regulatory Basis The inadvertent boron dilution event is analyzed to demonstrate compliance with several of the General Design Criteria described in 10CFR50, Appendix A.

The NRC has developed the Standard Review Plan, NUREG-0800, Revision 2 (SRP) which provides specific guidance as to how compliance with the General Design Criteria may be demonstrated.

Even though recent studies have reported the expected frequency of occurrence of an inadvertent criticality from a gradual dilution event as = 1.E-4 per reactor year, the inadvertent boron dilution event is classified as an ANS Condition II event, an event of moderate frequency in accordance with ANSI N-18.2, " Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants". ANS Condition II occurrences include incidents beyond normal plant operation, any one of which may occur during a calendar year of operation.

Consistent with the SRP, Section 15.4.6, the relevant General Design Criteria are GDCs 10, 15, and 26. Compliance with these GDCs is demonstrated by ensuring that the following specific criteria are satisfied:

1) The pressures in the RCS and Main Steam System are maintained below 110%

of the design values.

2) Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit.

3) An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

4) An incident of moderate frequency in combination with any single active component failure shall be considered.

, 5) If operator action is required to terminate the tranuient, the following minimum time intervals must be available between the time when an alarm announces an unplanned moderator dilution and the time of loss of shutdown margin:

._ _ , .. __ _ _ _ ~ . _. . -. - - _ _ _ _ m . - . - _ _ . . - . . _ _ _ _ _

i -

fEnclosure 1 to ET 95-0106 PEga 5 of 24 1

i

a. During refueling: 30 minutes

b. During startup, cold shutdown, hot standby, and power operation:

15 minutes.

For the present purposes, this definition is modified to require that the required operator action time. interval extends from the

time when an alarm announces an unplanned moderator dilution to I the time when the corrective actions must be' initiated in order to prevent a complete loss of shutdown margin.'

• For some events, particularly those events involving low dilution flow rates or small deviations in the boron concentrations, the

. time between the initiation of the event and the time at which the

shutdown margin becomes completely eroded may be relatively large.

4 Therefore, in addition to the guidance provided in Item 5, a third acceptance criterion for operator action times will be introduced:

c. The minimum time between the initiation of the event and the loss of shutdown margin: 30 minutes.

t

!' Although not specifically required for an ANS Condition II event, the

inadvertent boron dilution event is currently analyzed to demonstrate that the event is terminated prior to the time the shutdown margin is completely ^

j eroded. If it is demonstrated that the reactor remains suberitical, there will be no power, pressure, or temperature excursions which could challenge the RCS and main steam system pressure limits, the minimum DNBR limits, nor l lead to a more serious plant condition. Therefore, further demonstration of

'- compliance with Items 1, 2, and 3 is not required, provided that it is shown that the shutdown margin is not completely eroded, thereby ensuring that the

. reactor remains suberitical.

l III. Event Description In the following discussions, the valve numbers are specific to WCGS.

one of the principal means of positive reactivity insertion to the core is the b addition of unborated, primary grade water from the Reactor Makeup Water l System (RMWS) into the RCS through the reactor makeup portion of the CVCS.

Boron dilution with these systems is a manually initiated operation requiring

close operator surveillance and is performed in accordance with strict administrative controls which limit the rate and duration of the dilution. A boric acid blend system is available to allow the operator to match the makeup boron concentration to that_of the RCS during normal charging.

i The principal means of causing an inadvertent boron dilution event are the opening of the RMWS control valves and the failure of the blend system, either by controller or mechanical failure. The CVCS and RMWS are designed to limit, i even under various postulated failure modes, the potential rate of dilution to

. values which, with indication by alarma and instrumentation, will allow sufficient time for operator response to terminate the dilution. An 1

inadvertent dilution from the RMWS may be terminated by closing the primary ,

+ - . - _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . . _-___.- _ -_____. -

, . . , ~ . - _ _ _ . _ - - ~ . . . - - _ ~ . - _ _ ~ ~ . - _ . - _ _ - . . - . . _ . _ . .

a

~

I* ' Enclosure 1 to ET 95-0106 Page 6 of 24 l ' water makeup control valve. The expected sources of an inadvertent dilution  ;

I- may be terminated by closing isolation valves in the CVCS; i.e., LCV-112B and

C (see Figure III-1); other sources are isolated by normally closed, manual-

valves. -The lost shutdown margin may be regained by opening the isolation valves to the Refueling Water Storage Tank' (RWST); i.e., LCV-112D and E, to

- allow the addition of highly borated water into the RCS. I 1

k Generally, to intentionally initiate a dilution, the operator must perform two i distinct' actions:

e i .

1 1) Switch the RMWS control of the makeup from the automatic makeup mode to l l the dilute or alternate dilute' mode, and l

2) Turn the RCS makeup actuation handswitch to the " start" position. i

{

Failure to carry out either of the above actions prevents initiation of. i l '

! dilution.

a l~ II n addition, during normal operation, the operator may add borated water to [

the RCS by blending boric acid from the Boric Acid Setorage Tanks with . ,

unborated, primary grade water. The makeup controller will then limit the sum of the boric acid flow rate and primary grade water flow rate to the blended i flow rate after turning the RMWS makeup actuation handswitch to the " start" i position (i .e. , the controller regulates the unborated, reactor makeup water l flow rate).

l An inadvertent boron dilution may be initiated by a failure in the Reactor j Makeup Water System (RMWS) which results in either a reduction in the boric 4 acid flow rate from the boric acid storage tanks, or an increase in the flow l- rate of unborated water from the Reactor Makeup Water Storage Tank (RMWST).

• 1 l -

4

}~

i i

1 i ..

i..

j  !

i t

i ,

t , f h d$kio ef o y eT ti * *O + Sy yHbm gMe D' - G C"

• 4 E-AB" ,

• L-L L C iK

" C A R-E E RN S S V

' OA O BT C S

/ -.1 .5 R P

) ~

C S -

A' B' R O-S '

" 5 - R W P P 0 Q 1

O C- -

T M V M - S- -

R U U V 0

C--

P P H R-(

MS EC

)

R E

F D

CR f

A FE 8M6 1 8

V H

- M-O-

R.

T V -

S N C S N

.SC 1 =~ A RA 1 Fn

. Y( R OR 2 T BT 1 ;-

S D ) q M I C" T E F

. RE A A '

C

[-

E T C ,g G T S i K '

A' AY RN -

8 1 '

B" .

OA - 2 " .

WS BT 0

1 1

V

- P V

P O L V C U P_

M C F P j E N U_

U A F P E R' I  :

0 1 G i

L K T N G b

1 }

W N i

A N E V G ) 3 g

I R O G MO 1

E C 1 A /

C T F 1 / L R D -

H F A E

C H I

R E CG F 1)) N C

AN O ' M T M i

C Dly y-- . ( T CU N -

R' E A .L L 8 C D E A OL 2 2 E O BB A 8 1 2 1 2 1

1 1 1 2 1

_t O 1 R V 1 1

1 1

VR V 1

V t V N1V -

F D NI V C

V UT K LNN C L

C C L

C C OOA L L ONA -F F VCT

, 2 fI H D L 0 H j q;ibglI z g

C A T M6 V E j ll!ll ,

i j4 _

_;l.<

E i C 0 - ]8 L G u" $$ _

N S 1

C A ,.Q- W E K M R O@ -

!X71 YK 2

_ _OC SE E F - V CN 1 1

_DIT iF H T 0

1 EA -

DC A W M6V RT C

V c4 . LE RLO E L R .

DR

• i _

D iE FI U UE T EF A K

]b L R . N EM K KS "U E WA P AA AN EF T M VT MA KS G I

R ih AN ~

NE S RE R T "A ,f VA I L G OG O R T A TR' _ 3 RT"B =

E A UR CR AO CEP AT M  : [ C TR" FO ET ET E AU CEP RS RWP i

(

RS AT V EAU 1I RWP x

l g = ~

ee . ~

a

' Enclosure 1 to ET 95-0106 Page 8 of 24 i

IV. Description of RMCS Design & Operation l The Reactor Makeup Control system (RMCS) consists of a group of instruments i

arranged to provide a manually pre-selected makeup compocition to the charging pump suction or the volume control tank (VCT). The RMCS control functions are to maintain the desired fluid inventory in the VCT and to adjust the reactor coolant boron concentration.

i Under normal plant operating conditions, the RCS letdown is routed to the VCT.

A-three-way diversion valve (LCV-112A) is provided which may be used to divert letdown to the Recycle Holdup Tank (RHT). At WCGS, this valve is normally in 4

the manual "VCT" mode. For planned plant evaluations performed in accordance j with the approved procedures, the letdown divert valve may be place in " AUTO" 4 (i.e., the valve will modulate to divert a certain amount of the letdown flow

to the RHTank), or in the ca.nual "RHT" mode. The VCT level controller g

controls the operation of the letdown divert valve when in AUTO. The reactor

~

operator controls'the valve position in the manual RHT mode. In these modes, the operation of the letdown divert valve (by either automatic or manual control) would act to prevent the VCT water level from exceeding the high VCT water level alarm setpoint. Upon loss of air or electric signal, the letdown divert valve fails to the VCT position.

The control switches required to initiate a boron dilution are located on the main control board. At WCGS, two switches are provided

one mode selector switch for Off/ Borate / Manual / Auto / Alternate Dilute / Dilute; and one makeup control switch for Stop/ Neutral / Start.

The manual mode allows for addition of blended flow into the RWST, the RHTs, or the spent fuel pools. While in this mode, makeup to the RCS is precluded.

The automatic makeup mode of operation of the RMCS provides a blended boric 4

acid solution, pre-set to match the boron concentration in the RCS. The

automatic makeup controller operates on demand signals from the VCT level

I controller. Under normal plant operating conditions, the mode selector switch is set in the " Automatic Makeup" position and the boric acid and total makeup j I

flow controllers are set to provide the same concentration of borated water as contained in the RCS. The mode selector switch must be in the correct position and the controller energized by prior manipulation of the " Start" switch. A pre-set low level signal from the VCT level controller causes the automatic makeup control action to start a reactor makeup water pump, start a boric acid transfer pump, open the makeup stop valve (FCV-110B) to the 4 charging pump suction, and position the reactor makeup water and boric acid

, flow control valves (FCV-111A and FCV-110A, respectively). The flow I

controllers automatically set the boric acid and reactor makeup water flows to the pre-set rates.

Makeup addition to the charging pump suction header causes the water level in i the VCT to rise. At the pre-set high level point, the boric acid transfer pump stops; the reactor makeup water and boric acid flow control valves close; 1 and the makeup stop valve closes. This operation may be terminated manually )

at any time by actuating the makeup stop. '

The dilute. mode of operation permits the addition of a preselected quantity of reactor makeup water at a pre-selected flow rate to the RCS. The reactor 4

9

• 'Enclosuro 1 to ET 95-0106 Page 9 of 24 operator sets the mode selector switch to " Dilute", the total makeup flow controller setpoint to the desired flow rate, and the total makeup batch integrator to the desired quantity and actuates the makeup start switch. The start signal causes the makeup control to ctart a selected reactor makeup water pump, open the reactor makeup isolation valve to the VCT inlet (FCV-111B) and open the makeup water flow control valve. The makeup water is injected through the VCT spray nozzle and through the VCT to the charging pump suction header. When the pre-set quantity of reactor makeup water has been added, the batch integrator causes the reactor makeup water flow control valve to close. This operation may be terminated manually at any time by actuating the makeup stop.

The alternate dilute mode of operation is similar to the dilute mode except a portion of the dilution water flows directly to the charging pump suction (through FCV-110B) and a portion flows into the VCT (through FCV-111B) before flowing to the charging pump suction. This mode of operation is used when intentionally diluting the RCS in order to minimize the delay caused by diluting the VCT before the RCS can be diluted. When the pre-set quantity of reactor makeup water has been added, the batch integrator closes the reactor makeup water flow control and reactor makeup stop valves to the inlet and outlet of the VCT. This operation may be terminated manually at any time by actuating the makeup stop.

The borate mode of operation permits the addition of a preselected quantity of concentrated boric acid solution at a pre-selected flow rate to the RCS. The operator sets the mode selector switch to " borate", the concentrated boric I

acid flow controller setpoint to the desired flow rate, and the concentrated boric acid batch integrator to the desired quantity and actuates the makeup start switch. The concentrated boric acid is added to the charging pump suction header. The total quantity added in most cases will be so small that it will have only a minor effect on the VCT level. When the pre-set quantity of concentrated boric acid solution has been added, the batch integrator causes the makeup to stop. This operation may be manually terminated at any time by actuating the makeup stop.

V. Detection of an Inadvertent Boron Dilution Event in Modes 3, 4, and 5.

The inadvertent boron dilution event is assumed to be initiated through a malfunction in the Reactor Makeup Control System or by operator error.

Several indications and alarms are provided in the RMCS design for the monitoring of proper system operation. The available alarms and indications include:

' - boric acid flow indication and deviation alarm,

- audible clicks from the boric acid totalizer (flow integrator),

boric acid flow strip chart recorder,

- total makeup blended flow indication and deviation alarm, audible clicks from the total makeup blended flow totalizer, total makeup blended flow strip chart recorder, l -

high charging flow indication, and Centrifugal charging pump, boric acid transfer pump, and reactor makeup control system pump status lights.

l

' l

'Enclosura 1 to ET 95-0105 Paga 10 of 24 Several potential RMCS failures will result in an increase in the VCT water level and pressure. The available alarms are the VCT high pressure, VCT high water level, and VCT high-high/ full divert to RHT alarms.

Other diverse indications of an ongoing inadvertent boron dilution event are provided by the Nuclear Instrumentation System. The available indications and alarms include:

- High source range neutron flux at shutdown alarm,

- Indicated and recorded source range neutron flux rate count rate and startup rate,

- Audible source range neutron flux count rate, and

- WCGS also has a source range neutron flux-multiplication alarm.

VI. Inadvertent Boron Dilution Event Scenarios The inadvertent boron dilution event is assumed to be initiated by a malfunction in the RMCS. A failure modes and effects analysis is provided below for each of the significant modes of RMCS operation with a focus on those malfunctions which result in either a reduction in the boric acid flow rate from the boric acid storage tanks, or an increase in the flow rate of unborated water from the RMWST. It is assumed that the CVCS and RMCS valve positions correspond to their normal alignments. The scenarios described below are initiated by a postulated malfunction; no additional single failure is assumed.

Potential inadvertent dilutions from sources other than through the RMWS (e.g., the Boron Thermal Regeneration System or Boron Recycle System) are precluded during normal operations by at least one and usually several closed manual valves. Because operations of these systems are plant evolutions performed in accordance with approved procedures and require a significant level of reactor operator interaction with the plant; these dilution scenarios are not considered further.

Automatic Operation In this mode, the reactor operator manually sets the RMCS controller to provide the same concentration of borated water as contained in the RCS. The total makeup flow is initiated by the VCT water level controller when the VCT water level falls below the " start auto makeup" setpoint (see Figure VI-1).

The flow is terminated when the VCT water level rises above the "stop auto makeup" setpoint. In this mode of operation, the potential malfunctions which could affect the inadvertent boron dilution event are:

a) Concentrated boric acid flow is less than required, b) Reactor makeup flow is greater than required.

c) Due to operator error, calibration errors, or instrument drift, the makeup water boron concentration is less than the RCS boron concentration, d) Total makeup flow is not terminated at the "stop auto makeup" setpoint.

Individually, potential malfunctions a, b and c could result in the addition of dilute water into the VCT and subsequently, the RCS. However, in the a

e

' Enclosure 1 to ET 95-0106 Page 11 of 24 absence of an additional failure, the dilution would be limited to the volume of water between the " start auto makeup" and "stop auto makeup" VCT water level setpoints.

A malfunction which results in the continuation of total makeup flow to the VCT after the "stop auto makeup" setpoint has been exceeded would eventually result in a VCT high pressure or VCT high water level alarm. However, in the absence of an additional failure, no dilution would occur, because the boron concentration of the makeup would be the same as the RCS boron concentration.

Dilute and Alternate Dilute Operation In these modes, the reactor operator intentionally injects a pre-selected quantity of reactor makeup water at a preselected flow rate to the RCS. These are planned dilutions, performed in accordance with approved plant procedures.

The postulated malfunctions of importance to the inadvertent boron dilution event analysis are the malfunction of the RMCS to limit the flow rate of the reactor makeup water or the malfunction of the totalizer (integrator) to terminate the dilution when the requisite amount of reactor makeup water has been added. The proper operation of the totalizer would offset any failure to control the flow rate.

Borate Operation In this mode, the reactor operator intentionally injects a pre-selected quantity of concentrated boric acid solution at a pre-selected flow rate to the 2CS. There is no blending with reactor makeup water to form a more dilute boric acid solution; hence, there is no possibility for an inadvertent boron dilution event in this mode.

Design Basis scenario The design basis scenario for the inadvertent boron dilution event is that scenario which results in a continuous dilution at the highest dilution rate.

As may be inferred from the previous discussions, only operation in the automatic and dilute / alternate dilute modes can result in inadvertent boron dilutions. In the scenarios described below, a single failure is assumed in addition to the initiating malfunction.

Because operation in the dilute / alternate dilute modes is by definition a planned plant evolution, the reactor operators are expecting a specific response in accordance with their training. It is expected that any malfunctions which occur would be immediately observed, resulting in timely operator action to mitigate the dilution. The CVCS alarms previously described are available for the detection of inadvertent dilutions. In addition, diverse alarms for the Nuclear Instrumentation System are available to the reactor operators in the detection of a potential malfunction.

Procedural guidance is also provided to the operators concerning methods of terminating unplanned moderator dilutions. Hence, inadvertent dilutions in these modes of operation will not be considered in the development of the design basis scenario.

Any malfunction in the RMCS, while in the automatic mode of operation, coupled with an additional, single active failure, could result in the continuous

h.

• Enclosure 1 to ET 95-0106 Paga 12 of 24 injection of nearly pure water into the RCS. In order to bound all combinations of two failures (initiating malfunction plus additional single failure), the design-basis scenario for the inadvertent boron dilution event is defined to be:

'1) The plant is initially at steady-state conditions, with the CVCS and RMWS valve positions in their normal alignment, which implies that the letdown-divert valve is in the "VCT" position.

I 2) The initiating malfunction in the RMCS results in the delivery of the maximum amount of reactor makeup water (equal to maximum charging flow rate alarm) at the lowest boron concentration (o ppm boron).

3) A single failure in the VCT level controller which results in the j continuation of the dilution flow, even after the "stop auto makeup" I

setpoint is exceeded.

4) HighiVCT water level alarm provides the first alarm indicating that a f boron dilution may be in progress.

5) The reactor operators are allocated 15 minutes to diagnose the event and initiate actions to isolate dilution sources and initiate re-boration.

The operator response time is assumed to extend from the time when the high VCT water level is annunciated until the operator initiates corrective actions.

l l

l l

i

• Enclosure 1 to ET 95-0106 Page 13 of 24 Figure VI-1 VCl Water Level Setpoints FROM DE MINER ALIZE RS I

- I N

\ '

FULL DIVERT TO RECYCLE HOLDUP 7- _I 1ANK 97%

l HIGH LEVE~i 70 y'

/ -\s ' I

._I S T AR T DIV ER T TO VOLUME RECYCLE HOLDUP l CONTROL TANK 70%

TANK

_ . . STOP AUTO MAKEUP a 50%

v'^^-~'^^~ NORMAL RANGE g

START AUTO M AKEUP 30X

- LOW LEVEL 22%

- SHIF T SUC TION TO RWST 5%

'w_, /

l 10' CHARGING PUMPS

' Enclosure 1 to ET 95-0106 Page 14 of 24 VII. Equipment Qualification The following information is specific to WCGS. Recall that the inadvertent boron dilution event in Modes 3, 4, and 5 is an ANS Condition II event. As a result of this event, no automatic Reactor Trip System or Engineered Safety Features Actuation System actuations are required for event detection, termination, or mitigation. No adverse containment environments are generated.

The normal charging and letdown portions of the CVCS, as well as the RMCS, are

" control grade" systems. The power supplies for the level, pressure and flow instrumentation are derived from Class 1E inverters. With the exception of the VCT water level channele, none of the CVCS/RMCS alarms previously mentioned are redundant. All transmitters associated with the CVCS and RMCS are subjected to periodic calibrations.

The valves required for termination of the dilution and subsequent reboration and the centrifugal charging pumps are powered from Class 1E power supplies.

VIII. Method of Analysis For the analytical evaluation of this event, hand calculations are used to determine the periods of time required to move water at known flow rates to dilute known masses of water and to fill known volumes. Variations in the flow rates over time are smeared into constant average values. Changes in the water level in the VCT will generate alarms when setpoints are exceeded.

Maximum or minimum values are assumed for flows, volumes, and boron concentrations as appropriate to effectively bound the most conservative average values. The analysis is performed over the entire range of RCS temperatures f rom 557*F to 68'F in order to ensure that the most conservative combinations of RCS coolant density, critical boron concentration, and shutdown margin are evaluated. The results of this analysis will demonstrate that at least 15 minutes is available for the reactor operator to initiate corrective actions in order to prevent the complete loss of shutdown margin from the time the high VCT water level alarm is generated.

RCS leakage and control system anomalies can affect the volume of water in the RCS and in the CVCS. This analysis conservatively bounds those effects by assigning a bounding steady-state mismatch value to the flows which affect the VCT water level.

Model Limitations and Assumptions

1) The RCS volume remains constant. The water level in the pressurizer does not change. Reactor operators set charging and letdown to maintain a constant system volume during steady state operations if automatic systems are not available. Small deviations of RCS mass during the dilution event can result from charging and letdown flow mismatches. A flow mismatch term is included to account for these small deviations.

2) The RCS and CVCS combine to form a closed system. Dilution water may enter the system boundary, but no water leaves the boundary. The small

• Enclosure 1 to ET 95-0106 Page 15 of 24 values of RCS leakage during operating modes can be accommodated by the flow mismatch term. All changes to the system volume are assigned to the VCT. Any addition of water to the RCS results in a change in VCT volume without changing the volume of water in any other system.

3) All dilutions occur at a constant rate. The RCS dilution is modeled as a step change from zero gpm to a constant dilution rate. The maximum dilution rate is considered.

4) The Net Operator Response Time (the actual time available for the reactor operator to respond before the shutdown margin is completely eroded) begins only after the high VCT water level alarm is reached, and it ends at the time when operator action would no longer prevent criticality. System delays for valve manipulations and purging diluted pipes with boric acid reduce the Net Operator Response Time.

5) The subsystem temperatures are selected in such a way as to minimize the available missing mass and maximize the dilution mass flow rate. The RCS mass is evaluated at operating temperature boundaries, i.e., 557'F, 3 5 0*F, 2 0 0*F, and 6 8'F . The CVCS/RMWS fluid is evaluated at 45'F.

Maximizing the density of the CVCS/RMWS and minimizing the density of the RCS act to increase the dilution rate.

6) The RCS temperature remains constant. The small fluctuations in RCS temperature during steady-state operations can be accommodated with the flow mismatch term.

7) The reactor is shutdown and the initial boron concentration is sufficient to meet the minimum shutdown margin required for each particular mode of operation, in accordance with the plant Technical Specifications.

8) It is assumed that the most reactive rod is stuck out of the core.

9) A conservatively low value for the RCS volume is assumed. This volume includes the reactor vessel, loop piping, reactor coolant pumps, and steam generator tubes. The volumes of the reactor vessel upper head, the pressurizer, the pressurize spray and surge lines, the CVCS, and the Residual Heat Removal System are not included. The volumes are based on cold metal dimensions, with no allowance for thermal expansion of the volumes.

10) All times in core lifetime are considered. Generally, beginning of life (BOL) is limiting due to the higher boron concentrations which maximize the dilution rate.

As described in Section VI, the design basis inadvertent boron dilution event is assumed to be initiated from normal steady-state conditions with all CVCS and RMWS valves in their normal positions for the shutdown modes of operation.

In this state, all letdown is eventually returned to the VCT. The event is assumed to be initiated when the RMCS initiates auto makeup, based on the VCT water level at the " start auto makeup" setpoint. The initiating event is assumed to be a malfunction in the RMCS which results in the delivery of

0 Page 16 of 24

' Enclosure 1 to ET 95-0106 diluted (0 ppm boron) water into the charging pump suction. This dilute fluid is then injected into the RCS through the normal charging flow path. An additional failure in the VCT water level controller is assumed such that the dilution continues after the VCT water level has risen above the "stop auto makeup" setpoint.

Even though it is likely other alarm functions will have annunciated, it is assumed that the reactor operator is first made aware of the RMCS malfunction when the high VCT water level alarm annunciates. To terminate the event and initiate re-boration, the reactor operator must re-align the suction of the charging pumps from the VCT to the RWST. The diluted water in the CVCS lines must be purged before the borated water from the RWST enters the RCS, terminating the event. In the analysis of this event, it must be demonstrated that following receipt of the high VCT water level alarm, the reactor operator has at least fifteen minutes in which to initiate the re-alignment of the charging pump suction from the VCT to the RWST prior to the time that the shutdown margin is completely eroded. As discussed above, the actual time available for reactor operator response is referred to as the " Net Operator Response Time."

variables All variables used in the hand calculations are defined in Table VIII-1.

Variables are defined in three types: (1) Input: a physical parameter fixed by the operating characteristics of the plant, (2) Property: determined from steam tables, and (3) Cale: a calculation result determined by algebraic combinations of the inputs and properties. A " conservative direction" has been assigned to the inputs. The conservative direction minimizes the time between the alarm annunciation and the loss of shutdown margin. This assumption, in turn, minimizes the available time between the alarm annunciation and the loss of shutdown margin. This assumption, in turn, minimizes the available time interval for operator action. All other conservative directions are selected based on how the time interval available for operator action is affected. Because all properties are extracted directly from the 1967 ASMS steam tables, no conservative direction is

applied.

l 1

'Encloruro 1 to ET 95-0106 Pign 17 of 24 l 1

l Table VIII-1: Definition of Variables ,

l 1

Type Variable Definition Conservative l Direction Input Vacs - ft' RCS Mixing Volume Low Input T,es - *F Initial Temperature of RCS Mixing High Volume Property pacs - Weight density of Water in Vacs lbm/ft' Input Van - it' Volume of VCT between " start auto High makeup" and "high VCT water level" alarm setpoints, plus uncertainties Input Tyci. - 'F VCT/CVCS Purge Volume Temperature Low Property pyc,3 - Weight density of water in VCT/ Purge ft'/lbm Volume Input Vpuna - ft' CVCS Purge Volume High Input Quma - 9Pm Charging Flow High Calc tsuna - min Purge time of charging line Input Oms - gpm Mismatch flow: Net Letdown minus Net Most negative Charging Input Omt - gpm Dilution flow rate High Input Beurr - ppm Critical boron concentration High Input B,es - ppm Initial boron concentration Low Calc triu. - min Time to fill Vver Calc tenrr - min Time to dilute from BRCS to BCRIT Input tsu, - min Total time of VCT/RWST swapover High

'E.c lc to,1s - min Net Operator Response Time Inputs and Properties Input variables correspond with the most conservative conditions expected during normal plant operations.

RCS Mixing Volume (Vacs) ;

This volume corresponds to the number of cubic feet of water which becomes diluted during the transient. This volume includes the reactor vessel, hot legs, cold legs, reactor coolant pumps, and steam generator tubes. It does not include the reactor vessel head, the CVCS, the Residual Heat Removal Sj;Lem, the pressurizer, or the pressurizer spray and surge lines. The volumes are based on cold metal dimensions; i.e., the thermal expansion at elevated temperatures is neglected. An allowatea for plugging of 10% of the steam generator tubes is provided.

The entire volume of the RCS can be included if at least one reactor coolant pump is operating. The proposed Technical Specification changes for WCGS will preclude boron dilutions, except under strict administrative controls, unless at least one reactor coolant pump is operating.

Enclosure 1 to ET 95-0106 P&ga 18 of 24 Initial Temperature of the RCS Mixing Volume (Tus) :

This temperature is used to determine the density and mass in Vas. The temperature is dependent on the specific operational mode under consideration.

Weight Density of Water in Vum (p,es) :

This parameter is the weight density of saturated water at Taa. The temperature is dependent on the specific operational mode under consideration.

A smaller RCS mass (corresponding to a smallar density) is conservative with respect to the rate of dilution.

Volume of VCT between Start Auto Makeup and High VCT Water Level Setpoints (Vwy) :

This parameter is the number of cubic feet of water required to actuate a high VCT water level alarm assuming the transient begins from just below the " start auto makeup" setpoint. Uncertainty allowances of 15% of span are provided, thereby increasing the L. cal difference in the setpoints by 10% span.

Charging Temperature (Tva):

This parameter is the temperature of the water in the purge volume and is used to determine the density and mass of the purge fluid. In order to maximize the dilution, the temperature is set to the conservatively low value of 45'F.

This temperature is also assumed for the VCT and the letdown. Lower temperatures are not expected during normal operations.

Weight Density of Water in Vnma (pwn) :

This parameter is the weight density of saturated water at Tya.

pcgevolume (Vnma) :

This parameter corresponds to the nunber of cubic feet of diluted water which must be purged from the charging system piping before the highly borated water

from the RWST reaches the cold leg. This volume is required to extend from the check valve downstream of the RWST isolation valves to the injection point of the charging flow into the RCS. However, for added conservatism, this volume is increased to include the volume of pipes and components upstream of the RWST check valve back to the RWST supply line isolation valves (LCV-112D and E) and the volume upstream of the VCT/RWST tee back to the VCT isolation valves (LCV-112B and C). Because the effect of the purge volume is to delay the injection of Paron into the cold leg, it is conservative to use a maximum purge volume for a particular plant condition.

Charging Flow Rate (Qamo) :

This parameter is set equal to the sum of the seal injection and normal charging flow rates. All of the charging flow is assumed to enter the RCS mixing volume. This flow is limited on the high side to 150 gpm by the alarm

- . - -. . ~ . . . - -. - . _ _ . - . _ . -.~ - - . - - . _ ~ . . .

a

.t.

• Enclozura 1 to ET 95-0106' Page 19 of 24 j limits for this parameter. A +5% uncertainty allowance for the flow instrumentation is provided.

Flow Mismatch (Oce) :

This term is used to account for all of the effects which would invalidate the constant RCS volume or mass assumption. Small control system fluctuations or  !

temperature changes could result in a mismatch between the charging and ,

letdown flow rates, and small RCS leaks could also increase the need for l charging. Because these mismatches could affect the VCT level, it is necessary to explicitly account for them. Oc, is defined by:  !

Om, = Letdown (gpm) - Charging (gpm) [

The value of Qc, will conservatively be set to -22 gpm. The 22 gpm penalty is based on 12 gpm RCP seal return leakage allowance and 10 gpm for control system uncertainties and system leakage. (Note that the reactor coolant pump seal leakof f is returned to the CVCS downstream of the VCT.) A 10 gpm control system bias is considered to be ee;ily detectable, as it would result in an increase in the pressurizer water level of = 15% span over a 30 minute period.

A negative value of On, will result in a decreasing VCT water level, which would act to delay the high VCT water level alarm expected if dilution flow was filling the VCT.  ;

Dilution Flow Rate (Ont) :

This parameter is the rate at which water flows into the charging pump suction from a diluted water source. The most limiting value of Ont is always less than or equal to the charging flow rate. If Qno is greater than the charging flow rate, then the VCT water level would change faster without resulting in a more rapid RCS dilution. The RCS dilution rate is limited by the value of the charging flow rate, Qoma. For this reason, Qan must always be less than or equal to Q3 3 A larger dilution rate is conservative; hence, Qut will be assumed to be equal to Qamo-  !

Critical Boron Concentration (Baur) :

The critical boron concentration represents the maximum boron concentration at which the reactor will attain criticality. The value of this parameter is 1 l calculated on a cycle-specific basis. A conservative value is established l j based upon the core conditions corresponding to the critical, zero power, all l 4

rods inserted (ARI) except for the most reactive rod, which is assumed to be i fully withdrawn (ARI, N-1) condition. These values are calculated at 557*, I

350*, 200*, and 68'F. The highest value over the cycle life is used.

! Uncertainties associated with the critical boron calculation are applied in accordance with the shutdown margin calculational methodology.

j Initial RCS Boron Concentration (Bus) :

The initial Boron Concentration represents a minimum concentration to maintain the reactor suberitical by the Technical Specification requirements. The

. value of this parameter is calculated on a cycle-specific basis. The core

! conditions correspond to the ARI, N-1 condition which just meets the Technical l

i i

s'

' Pign 20 of 24 Enclo2uro 1 to ET 95-0106 Specification shutdown margin value for a particular operational mode. These values are calculated at 557*, 350', 200*, and 6 8'F . The time in cycle lifetime is consistent with the Bour calculation.

Total Time of Valve Swapover (tsu,) r This parameter is the sum of the opening time of the RWST isolation valves and the closing time of the VCT isolation valves. Due to the valve stroke times, this value is 25 seconds (0.417 minutes).

Calculated Variables The calculated variables can be expressed in terms of the inputs and properties defined in the previous section.

Purge Time of the Charging Line (tamo)

The value of thir parameter is the period of time from the end of the valve swapover to the time that borated water from the RWST enters the RCS.

tnma is det!ned by the following equation:

Vruna truna = 7.4805galIft, Qcuna Time to Fill Vyer (trum)*

The value of this parameter is the period of time required to increase the net volume of the RCS and CVCS by the amount Vye. The time required to fill the VCT is affected by both the dilution flow rate and by the charging / letdown f'ow mismatch. This parameter, truz, can be defined by the following equation:

Vnr 7.4805galIft Qcuna + Quis Time to Dilute from Bacs to Benzt (teni7) -

This parameter is defined as the period of time to dilute Vacs from the shutdown margin concentration to the critical concentration. When the charging flow rate is greater than the dilution flow rate, then the water from the VCT can affect the charging line boron concentration. This calculation does not consider the benefits of the additional mixing volumes provided by the VCT or the CVCS piping in the letdown streams. Parameter taur is dependent upon the dilution flow rate and the density corrected volume of vac, only. If Qama 2 Omt, then taux can be defined by the following equation. i 1 Bucs tcarr a= -In(Benrr)

e e*

• Enclosurs 1 to ET 95-0106 Prga 21 of 24

• QNL pucshics. 7.4805 Not Operator Response Time (top) :

This parameter is the period of time from the high VCT water level alarm to the last opportunity for the operator to actuate the valve swap-over, TOP can be defined by the following equation:

to, = tear r - tria - t SWAP ~ D FURG*

The only cycle-specific term in the above equation is tc,1.r. The event acceptance criterion is satisfied if to, 215 minutes IX. WCGS Specific Analysis Inputs and Results The following values of the previously defined input and property parameters are applicable to WCGS.

Table 2 WCGS Specific Values Type Variable Definitic,n Value Input Vacs - f t' RCS Mixing Volume 8725 Input Initial Temperature of RCS Mixing

• Tacs - *F Volume Property paes - lbm/f t' Weight density of Water in Vacs

• Input von - f t' Volume of VCT between " start auto 137.44 makeup" and "high VCT water level" alarm setpoints, plus uncertainties Input Tver - F VCT/CVCS Purge Volume Temperature 45 Property pver - lbm/ f t' Weight density of water in 62.42 VCT/ Purge Volume Input Veuna - f t' CVCS Purge Volume 78.8 Input Qcnao - gpm Charging Flow 157.5 Input QMis - 9pm Mismatch flow: Net Letdown minus -22 Net Charging Input Qon,- gpm Dilution flow rate 157.5 Input Bear.r - ppm Critical boron concentration

• Input Bacs - ppm Initial boron concentration

• Input tswa, - see Total time of VCT/RWST swapover 25

+

'- Enclosure 1 to ET 95-0106 Paga 22 of 24 Substituting the values in Table 2 into the equations described in the previous section, the WCGS' specific results are obtained. The results of the analyses, as,shown in Table 3, showed that the. operator has greater than 15 minutes to take corrective actions to terminate an inadvertent boron dilution event before the shutdown margin is completely eroded if the event occurs during Modes 3, 4, and 5.

Table 3. Results of Revised Inadvertent Boron Dilution Event Analysis for Modes 3, 4, and 5 Initial RCS Temperature (*F) 557 350 200 68 Bacs (ppm) 1734 1789 1767 1750 Beart (ppm) 1520 1633 1634 1632 Qogn (gpm) 157.5 157.5 157.5 157.5 Vacs (ft3) 8725 8725 8725 8725 pg3 (lbm/f t') 45.50 55.59 60.11 62.32 a (min") 3.310E-3 2.710E-3 2.506E-3 2.417E-3 t nmo (min) 3.743 3.743 3.743 3.743 tsup (min) 0.417 0.417 0.417 0.417 t rzu. (min) 7.588 7.588 7.588 7.588 tarr (min) 39.795 33.667 31.226 28.883 top (min) 28.047 21.919 19.478 17.135 l

Other considerations i

r The design basis analysis previously described is initiated from a steady-state condition. Allowances for normal fluctuations in RCS temperature and small RCS leakage paths have been provided. The maximum dilution rate has been considered. These analysis assumptions are consistent with the design i basis analysis currently presented in the Section 15.4.6 of the Updated Safety

. Analysis Report and with the guidance provided in the Section 15.4.6 of the Standard Review Plan, NUREG 0800, Revision 1.

}

There are other plant evaluations which are not obviously bounded by the scenario described above. For small dilution flow rates, the time required to fill the VCT to the high VCT water level setpoint may be greater than the time

required to dilute the RCS to the critical condition; however, the total time available for operator action can be shown to exceed 30 minutes. Alarms

available to alert the reactor operator of a potennial inadvertent boron 4

dilution event include the concentrated boric acid flow and total makeup flow deviation alarms. The alarms generated by the Nuclear Instrumentation System, or the available trend recorders, may be of more use te aid the reactor operators in the identification of an inadvertent boron dilution event for

, these slow dilution cases.

I __ ._.

e e"

• Enclorurs 1 to ET 95-0106 Pago 23 of 24 During the planned plant heatup and cooldown transients, the CVCS and RMWS may not be in their normal alignments. However, these evolutions are transitions between stable plant states and are performed in accordance with approved procedures. Strict administrative controls are in place which require significant operator interaction with the plant. In accordance with their training, the reactor operators are expecting specific responses during the evolutions and deviations from the norm receive additional attention.

During a plant heatup, water from the RCS is expelled from the closed RCS/CVCS system into the Recycle Holdup Tank. The dilution sources are typically isolated during this mode of operation in order to minimize the liquid radwaste processing above the letdown flow already being diverted to the RHT.

If, through operator error, a dilution mechanism was introduced, the letdown divert valve would not be in the "VCT" mode; hence, the high VCT water level alarm function is not an appropriate alarm for use in the detection of an inadvertent boron dilution event. However, the total makeup flow and concentrated boric acid flow rate deviation alarms remain useful, and the Nuclear Instrumentation System continues to provide diverse clarms and indications of inadvertent reactivity changes.

Prior to performance of a plant cooldown, the RCS is borated to that concentration required to maintain the shutdown concentration at the target temperature. During the cooldown itself, the mismatch between the charging and letdown flow rates is fairly large, as additional fluid is injected into the RCS to compensate for shrinkage. This exceptionally large mismatch between the charging and letdown flow rates may be sufficient to mask certain indications of an inadvertent boron dilution. However, the total makeup flow and concentrated boric acid flow rate deviation alarms remain useful, and the Nuclear Instrumentation System continues to provide diverse alarms and indications of inadvertent reactivity changes. In addition, cooldowns are performed with the reactor trip breakers open; hence, the assumption that the most reactive rod is withdrawn from the core is not necessary. Consideration of this assumption alone is sufficient to compensate for all cooldown scenarios allowed within the context of the plant technical specifications.

X. WCGS-Specific Actions Required for Implementation The revised analytical methodology for the inadvertent boron dilution ev3nt is based on the premise that certain plant-specific activities will be cotapleted prior to implementation. These activities are:

Installation of an alarm on the letdown divert valve (LCV-112A) which will annunciate when the valve is not in the "VCT" mode. The VCT mode is defined as the normal mode; hence, the annunciator window will be dark during normal operations.

Installation of redundant alarms for high VCT water level. The analysis is based on the assumption that a new VCT water level alarm function will be created. The setpoint for this function (70% span) is credited in the analysis, and is lower than the current high-high VCT water level alarm (97% span) and greater than the "stop auto makeup" setpoint (50%

span).

I, O

• Enclosura l'to ET'95-0106 Paga 24 of 24  ;

1

-- Alarm procedures for the CVCS alarms will be enhanced to alert the '

reactor operators to the possibility of an inadvertent boron dilution  ;

event. )

- Administrative controls will be implemented which preclude the dilution- ,

events unless at least one reactor coolant' pump is operating.

XI. Summary l

The. original analysis of the inadvertent boron dilution event for Modes 3, 4, and 5,Tdescribed in USAR Section 15.4.6, was based on the operation of the  ;

Boron Dilution Mitigation System. Since that analysis was developed, concerns "have been identified which render the BDMS of limited use from an accident 'l

-analysis standpoint. Thus, a revised _ analytical methodology for the  ;

inadvertent boron dilution event has been developed. }

With this revised method, it is recognized that the Cncmical and Volume i

. Control System and the Reactor Control System form a closed system, and mass imbalances which affect the RCS may be detected in the CVCS. Numerous alarm ,

functions in the CVCS have been identified which will provide indication to f the reactor operators of a potential inadvertent boron dilution event. The  !

Nuclear Instrumentation System also provides several diverse alarms to assist-  !

the reactor operators in the detection of such an event.

Using the revised analysis methodology, an analysis of the event has been .-;

performed for Wolf Creek Generating Station, Unit 1 (Cycle 9) . Compliance j with event-specific acceptance criteria, . selected to be consistent with the  :

guidance of the Standard Review Plan, has been demonstrated for these core

• configurations.

f l

f i

l

~

l i

?

[

l l

I f

-. -