ML20126M029
| ML20126M029 | |
| Person / Time | |
|---|---|
| Site: | Vogtle  |
| Issue date: | 07/25/1985 |
| From: | Bailey J GEORGIA POWER CO. |
| To: | Adensam E Office of Nuclear Reactor Regulation |
| References | |
| GN-666, NUDOCS 8508010198 | |
| Download: ML20126M029 (73) | |
Text
r Georgia Power Company Routa 2. Box 293A W ynstoro, Georgia 30830 Telephone 404 554 9961 404 724 8114 Southem Company Services, inc-Post Office Box 2625 Birmingham, Alabama 35202 Teleph >ne 205 870-6011 Vogtle Proj.ect July 25, 1985 Director of Nuclear Reactor Regulation File: X7BC35 Attention:
Ms. Elinor G. Adensam, Chief Log:
GN-666 Licensing Branch 84 Division of Licensing U.S. Nuclear Regulatory Commission Washington, D.C.
20555 NRC DOCKET NUMBERS 50-424 AND 50-425 CONSTRUCTION PERMIT NUMBERS CPPR-108 AND CPPR-1209 V0GTLE ELECTRIC GENERATING PLANT - UNITS 1 AND 2 SER CONFIRMATION ITEM-47: BORON DILUTION
Dear Mr. Denton:
Your staff requested a copy of the Vogtle Electric Generating Plant Boron Dilution Analysis. Enclosed are five copies of the requested report. The results of this report have been incorporated in Amendment 17 of the VEGP FSAR.
If your staff requires any additional information, please do not hesitate to contact me.
Sincerely,
\\.
=
J. A. Bailey Project Licensing Manager JAB /caa Enclosure xc:
D. O. Foster G. Bockhold, Jr R. A. Thomas T. Johnson (W/o Encl.)
J. E. Joiner, Esquire D. C. Teper (W/o Encl.)
B. W. Churchill, Esquire L. Fowler M. A. Miller W. C. Ramsey B. Jones, Esquire (W/o Encl.)
Vogtle Project File L. T. Gucwa
\\
0053V AD 24 E
PDR I
(-
V0GTLE ELECTRIC GENERATING PLANT BORON DILUTION ANALYSIS t
8026Q:1D/061885
TABLE OF CONTENTS Page
1.0 INTRODUCTION
1 2.0 SYSTEM DESCRIPTION 2
~
2.1 Function 2
2.2 General Description 3
2.3 Electric Power Requirements 10 2.4 RMCS Operation 10 2.5 CVCS Operation 15 3.0 ANALYSIS 21 3.1 Initiating Events 21 3.2 Operator Response Times 24 3.3 Event Trees 25 3.4 Failure Probabilities for Top Events 27
/
l 4.0 RESULTS 36 l
l
5.0 CONCLUSION
S 38 1
REFERENCES 39 APPENDIX A:
Failure Modes and Effects Analysis A-1 APPENDIX B:
Response Time Calculations B-1 APPENDIX C:
Data C-1 l
l 1
i 8026Q:10/061885 2
r-V0GTLE ELECTRIC GENERATING PLANT BORON DILUTION ANALYSIS
1.0 INTRODUCTION
An analysis was used to evaluate boron dilution events during shutdown modes 3 through 6 at the Vogtle Electric Generating Plant (VEGP). The analysis estimated the probability of incurring a boron dilution event which progresses to unplanned criticality. The technique modeled realistic plant conditions and responses, including both mechanical and human errors.
Failure modes and effects analysis, human error analysis, and event tree analysis were used to determine possible events and responses to those events.
Single failure criteria was applied when determining initiating events. Time intervals from alann to loss of shutdown margin were calculated for each initiator in each mode to determine the length of time available for operator Eesponse. These calculations depended on dilution flowrates, initial boron concentrations, and Reactor Coolant System (RCS) volumes specific to the event and mode.
From these times, human error probabilities were determined.
Mechanical and human failure rates were then assigned to the event trees, and the trees were quantified to obtain an estimate of the probability of loss of shutdown margin due to boron dilution. Also, this analysis provided a list of the most likely scenarios leading to this type of accident, referred to as dominant accident sequences.
The Chemical and Volume Control System (CVCS) is described in the following section to aid in understanding the analysis described in Section 3.
The results and conslusions are presented in Sections 4 and 5, respectively.
8026Q:1D/030885 1
- - 2.0- CHEMICAL AND VOLUME CONTROL SYSTEM DESCRIPTION 2.1 FUNCTION ThebasicfunctionsoftheChemicalandVolumeControlSystem(CVC5) areas follows:
a.
Maintain programmed water level.in the pressurizer, i.e., neintain required water inventory in Reactor Coolant System (RCS).
b Maintain seal-water injection flow to the reactor coolant pumps.
c Control reactor coolant water chemistry conditions, activity level, soluble chemical neutron absorber concentration and makeup.
d.
Provide means for filling, draining, and pressure testing of the RCS.
Provide injection flow to the RCS following actuation of the Safety e.
Injection System (SIS).
i l
l i
I l
8026Q:10/022285 2
1 a
2.2 GENERAL DESCRIPTION Figures 2-1 through 2-6 show the CVCS piping and instrumentation.
2.2.1 CHARGING, LETDOWN AND SEAL WATER The charging and letdown functions of the system are employed to maintain a progransned water level in the reactor coolant system pressurizer, thus
.naintaining proper reactor coolant inventory during all phases of plant operation. This is achieved by means of a continuou's feed and bleed process during which time the feed rate is automatically controlled by pressurizer water level.
The bleed rate can be chosen to suit various plant operational requirements by selecting the proper combination of letdown orifices in the letdown flow path.
Reactor coolant is discharged to the CVCS from cold leg of the RCS; it then flows through the shell side of the regenerative heat exchanger where, during normal operation, its temperature is reduced to approximately 290*F. The coolant then experiences a large pressure reduction in passing through a letdown orifice (A, = 1700 psi) and after passing through the containment boundary it flows through the tube side of the letdown heat exchanger where its temperature is further reduced to about ll5*F.
Downstream of the letdown heat exchanger a second pressure reduction occurs as the coolant flows to the purification system demineralizers. This pressure reduction is performed by the low-pressure letdown valve, which maintains an upstream pressure sufficient to prevent flashing downstream of the letdown orifices.
l The coolant then normally flows through one of the mixed-bed demineralizers through the reactor coolant filter, and into the volume control tank via a diversion valve and finally a spray nozzle in the gas space of the tank. The gas space in the volume control tank is filled with hydrogen, which is regulated to a pressure of 15-20 psig during normal plant operation. The partial pressure of hydrogen in the volume control tank determines the concentration of hydrogen dissolved in the reactor coolant.
l l
8026Q:10/022285 3
L
c An alternate letdown path is provided which allows the letdown flow to pass
_through the Boron Thermal Regeneration System (BTRS) when boron concentration changes are desired to follow plant load. This alternate letdown flow path is directed to the BTRS downstream of the mixed bed demineralizers. After
~
processing by the BTRS, the flow is returned to the CVCS at a point upstream of the reactor coolant filter.
The charging pumps normally take suction.from the volume control tank and return the cooled, purified reactor coolant to the reactor coolant system via the charging system. The charging pumps discharge at a pressure dictated by the prevailing reactor coolant system pressure, the resistance of the charging line, and the pressure drop impressed by the positioning of an air-operated control valve situated in the charging line (normally the pressure will be about 2350 psig). Normal charging flow is handled by the positive displacement (PD) charging pump or one of the centrifugal charging pumps.
Should the PD pump be operating the flow rate will be dependent upon the speed of the positive displacement charging pump, controlled either by pressurizer level requirements or by operator choice.
If this pump reaches the high speed limit, it becomes necessary to place a centrifugal pump in operation to provide the higher flow capacity, and to remove the positive displacement pump from service.
The flow rate for the centrifugal charging pump is controlled by a modulating valve in the pump discharge line. The charging flow controller maintains the preset charging flow, which is preset by the pressurizer level requirements.
A minimum flow for the centrifugal charging pump protection is continuously diverted from the charging pump discharge via a miniflow orifice and the seal water heat exchanger back to the volume control tank discharge.
The bulk of the charging flow is pumped back to the reactor coolant system via the tube side of the regenerative heat exchanger where the outlet temperature 2
approaches the reactor coolant temperature. The flow is the injected into a cold leg of the RCS. Two redundant charging paths are provided. A flow path l
15 also provided from the regenerative heat exchanger outlet to the pressurizer spray line.
An air operated valve in the line is employed to i
8026Q:1D/022285 4
provide auxiliary spray to the vapor space of the pressurizer during cooldown to supplement the spray f rom the reactor coolant system, and thus provide a rapid means of cooling the pressurizer near the end of plant cooldown when the reactor coolant pumps are not operating.
The remainder of the charging flow is directed to the reactor coolant pumps via the seal-water-injection filters.
It enters the pumps at a point'between the labyrinth seal and the No. 1 seal. Here the flow splits and a portion enters the RCS via the labyrinth seals and thermal-barrier-cooler cavity, with the remainder flowing up the pump shaft and leaving the pump via the No. 2 seal.
The labyrinth flows are removed from the RCS as a portion of the letdown flow. The No. I seal discharges flow to a comon manifold, exits the containment, and then passes through the seal-water return filter and the seal-water heat exchanger to the suction side of the charging pumps, or by alternate path to the volume control tank. The alternate path enters the volume control tank through a spray nozzle which is used during plant shutdown and degassing to provide some recycle flow to improve the overall fission gas -
/
stripping in the tank.
An alternate letdown path from the RCS is provided in the event that the normal letdown path is inoperable.
Reactor coolant can be discharged from a cold leg and flows through the tube side of the excess letdown heat exchanger, where it is cooled to ~165'F.
Downstream of the heat exchanger a remote-manual control valve controls the excess letdown flow. The flow then l
normally joins the No. 1 seal discharge manifold flow and passes through the f
c r ng s
ee e ed ow ca ob d rec t
I reactor coolant drain tank, bypassing the No.1 seal return manifold. The excess letdown flow path can also be used to maintain normal heatup rate of the plant, by providing additional letdown capability during the final stages f
of heatup. This path removes some of the excess reactor coolant due to expansion of the system as a result of the reactor coolant system temperature i
- increase, j
i i
8026Q:10/030685 5
4 Surges in reactor coolant system volume due to load changes are acconunodated 7j.
for the most part in the pressurizer; however, the volume control tank is designed to acconunodate progransned pressurizer level mismatches which may occur due to a i 4*F temperature error. High water level in the volume control tank causes letdown flow normally entering the tank to be d'lverted to the recycle holdup tanks located in the Boron Recycle System.
Low level in the volume control tank initiates makeup from the Reactor Makeup Control System (RMCS).
If the RMCS does not supply sufficient makeup to keep the volume control tank level from continuing to fall, a low-low level signal j
actuates an alarm and causes the suction of the char'ging pumps to be transferred to the refueling water storage tank.
j i
2.2.2 CHEMICAL CONTROL, PURIFICATION AND MAKEUP The water chemistry, chemical shim and makeup requirements of the RCS are such that the following functions must be provided:
a.
Means of addition and removal of pH control chemicals for startup and f
normal operation.
b.
Control of oxygen concentration during normal and shutdown operation of the plant.
c.
Means of purification to remove corrosion and fission products.
d.
Means of addition and removal of soluble chemical neutron absorber (boron) and makeup water a6 concentrations and rates compatible with all phases of plant operation including emergency situations.
oH Control The chemical control element employed for pH control is lithium hydroxide (Li 0H). This chemical is chosen for its compatibility with the materials 7
and water chemistry of borated water / stainless steel / zirconium systems; in addition, Li-7 is produced in the core region due to irradiation of the dissoived boron in the coolant. The Li 0H is introduced to the reactor y
coolanc system via the charging flow. A chemical mixing tank is provided to 8026Q:lD/022285 6
introduce the solution to the suction of the charging pumps. The solution is prepared in the laboratory and poured into the chemical mixing tank.
Reactor makeup water is then used to flush the solution to the suction manifold of the charging pump.
Oxvaen Control During initial plant startup from the cold condition hydrazine is employed as an oxygen scavenging agent. The hydrazine solution is introduced to the reactor coolant system in the same manner as described above for the pH control agent. Hydrazine is not employed at any time other than startup from the cold shutdown state.
During normal plant operation, hydrogen in the reactor coolant scavenges oxygen produced in the core region due to the radiclysis of water. Sufficient partial pressure of hydrogen is maintained in the volume control tank, such that an equilibrium concentration of 25 - 35 cc of hydrogen per kg of reactor coolant is maintained in the reactor coolant system. Hydrogen is supplied from the hydrogen manifold in the Waste Processing System and a pressure control valve maintains a minimum pressure of 15 to 20 psig in the vapor space of the volume control tank. This regulator
/
can be adjusted to provide the correct equilibrium hydrogen concentration.
Purification Mixed-bed demineralizers are provided in the letdown line to provide cleanup of the letdown flow. The demineralizers remove ionic corrosion products, certain fission products, and act as filters. One demineralizer is usually in continuous service for nornal letdown flow and can be supplemented by the cation bed demineralizer when additional purification is desired. The cation resin removes principally cesium and lithium isotopes from the purification flow. When the BRS is being utilized, the cation bed demineralizer is utilized to remove as much Li-7 and Cesium as possible before the water is diverted to the BRS.
l l
l l
80260:10/030685 7
~~A further cleanup feature is provided for use during cold shutdown and residual heat removal. A remote-operated valve admits a bypass flow from the Residual Heat Removal System (RHRS) into the letdown line upstream of the letdown heat exchanger. The flow passes through the heat exchanger, through a mixed-bed demineralizer and a reactor coolant filter to the volume control tank. The fluid is then returned to the reactor coolant system via the normal charging route.
Filters are provided at various locations to ensure filtration of particulate and resin fines and to protect the seals on the reactor coolant pumps.
Chemical Shim and MakeuD The function of soluble neutron absorber (boron) concentration control and makeup is provided by the RMCS employing 4 wt. percent boric acid solution and reactor makeup water from the Reactor Makeup Water Storage Tank.
In addition, for emergency boration and makeup the capability exists to provide refueling water or 4 wt. percent boric acid to the suction of the charging pump.
Initial filling and makeup quantities of 4 wt. percent boric acid solution are prepared in the boric acid batching tank where boric acid crystals are dissolved in hot water and pumped to the boric acid storage tank.
The batching tank is steam-heated to allow heating the contents to the desired temperature (= 85'F) at which the 4 wt. percent solution is prepared.
l The batch is transferred to the boric acid storage tank by the transfer pumps.
The two tank is located in a compartment that is maintained at a temperature greater than or equal to 65'F.
A pump can be periodically run to recirculate the tank contents through the boric acid filter back to the tank.
OnademandsignalbytheRMCS,onepumpalignedtothatug[g,wherethesignal l
was generated starts and delivers boric acid for makeup.
l The reactor makeup water pumps take suction from the t' actor makeup water storage tank, and are employed for various makeup and flushing operations throughout the systems. One of those pumps also starts on demand from the RMCS.
l 80260:10/030885 8
The flow of boric acid from the boric acid transfer pump and the reactor makeup water from the reactor makeup water pump is directed to either the suction manifold of the charging pumps or is sprayed into the volume control tank through the spray nozzle. The normal flow path will be the li,ne to the volume control tanks where hydrogen pickup will be assured during long dilution processes.
In the event that xenon transients require rapid boration, the direct line to the charging pumps suction can be used.
/
8026Q:10/022285 g
i 2.3 ELECTRICAL POWER REQUIREMENTS To eliminate the possibility that a single electrical failure could prevent shutdown of the reactor, electrical separation in the areas of power supplies, cable tray allocations, etc., is required.
In general, this separation provides for reduhdant means to provide boration and makeup to the RCS.
In addition, local control stations enable the opera" tors to maintain the plant in a safe condition, assuming that the control room is inaccessible.
2.4 REACTOR MAKEUP CONTROL SYSTEM OPERATION The reactor makeup control consists of a group of instruments arranged to provide a manually pre-selected makeup composition to the charging pump suction header or the volume control tank. The makeup control functions are to maintain desired operating fluid inventory in the volume control tank and to adjust reactor coolant boron concentration for reactivity and shim control.
The control switches are located on the main control board along with the batch integrators and the flow controllers. Two switches are provided, one for Off/ Manual / Borate / Auto Makeup / Alternate Dilute / Dilute and one for Stop/ Neutral / Start.
Automatic Makeuo The automatic makeup mode of operation of the reactor makeup control provides dilute boric acid solution, preset to match the boron concentration in the Reactor Coolant System. The automatic makeup compensates for minor leakact of reactor coolant without causing significant changes in the coolant boron concentration.
It operates on demand signals from the volume control tank level controller (LICA-ll2).
8026Q:10/022285 10
h Under normal plant operating conditions, the mode selector switch is set in the " Automatic Makeup" position and the boric acid and reactor makeup water flow controllers are set to give the same concentration of borated water as contained in the Reactor Coolant System. The mode selector switch must be in the correct position and the control energized by prior manipulation of the
" Start" switch. A preset low level signal from the volume control tank level controller (LICA-112) causes the automatic makeup control action to start a selected reactor makeup water pump, start a boric acid transfer pump, open the makeup stop valve (FV-1108), makeup water flow control valve (FV-111 A) and
~
boric acid flow control valve (FV-110A). The flow controllers automatically set the boric acid and reactor makeup water flows to the present rates.
Makeup addition to the charging pump suction header causes the water level in the volume control tank to rise. At a preset high level point, the reactor makeup water pump stops; the boric acid transfer pump stops; the reactor makeup water and boric acid flow control valves close; and the makeup stop valve closes. This operation may be terminated manually at any time by actuating the makeup stop.
The quantities of boric acid and reactor makeup water injected are totalized by the batch counters and the flow rates are recorded on strip recorders.
Deviation alarms for both boric acid and reactor makeup water are provided if flow rates deviate from set points.
Dilute l
The " Dilute" mode of operation permits the addition of a preselected quantity l
of reactor makeup water at a pre-selected flow rate to the Reactor Coolant System. The operator sets the mode selector switch to " Dilute", the reactor l
makeup water flow controller set point to the desired flow rate, the reactor j
makeup water batch integrator to the desired quantity and actuates the makeup start. The start signal causes the makeup control to start a selected reactor
(
makeup water pump and open the makeup stop valve (FV-111B) to the volume i
control tank inlet and the makeup water flow control valve (FV-111 A). The makeup water is injected through the volume control tank spray nozzle and through the tank to the charging pump suction header.
Excessive rise of the l
l 8026Q:10/022285 11 L-
volume control tank water level is presented by automatic actuation of a three-way diversion valve (by the tank level controller), which diverts the reactor coolant letdown flow to the recycle holdup tanks. When the pre-set quantity of reactor makeup water has been added, the batch integrator causes the reactor makeup water pump to stop and the reactor makeup water ' control valve and reactor make up water stop valve to the VCT inlet to close. This operation may be terminated manually at any time by actuating this makeup stop.
Alternate Dilute The alternate dilute mode is similar to the dilute mode except a portion of the dilution water flows directly to the charging pump suction and a portion flows into the volume control tank via the spray nozzle and then flows to the charging pump suction.
The operator sets the mode selector switch to " Alternate Dilute", the reactor makeup water flow controller set point to the desired flow rate, the makeup water batch integrator to the desired quantity and actuates the makeup start.
The start signal causes the makeup control action to start a selected reactor makeup water pump and opens the makeup stop valve to the volume control tank and the makeup stop valve to the charging pump suction header and the reactor makeup water control valve.
Reactor makeup water is simultaneously added to the volume control tank and to the charging pump suction header. This minimizes the delay in having to dilute the volume control tank before the RCS can be diluted.
Excess water level in the volume control tank is prevented by automatic actuation of the volume control tank level controller, which diverts the reactor coolant letdown flow to the recycle holdup tanks. When the preset quantity of reactor makeup water has been added, the batch integrator causes the reactor makeup water pump to stop and the primary makeup water control valve and the reactor makeup stop valves to close.
This operation may be terminated manually at any time by actuating the makeup stop.
8026Q:10/022285 12
Borate The borate mode of operation permits the addition of a pre-selected quantity of concentrated boric acid sclution at a pre-selected flow rate to the Reactor Coolant System. The operator sets the mode selector switch to " Borate" the concentrated boric acid flow controller set point to the desired flow rate, the concentrated boric acid batch integrator to the desired quantity and actuates the makeup start. Actuating th,e start switch opens the makeup stop valve (FV-1108) to the charging pump suction and the boric acid control valve (FV-110A) and starts the selected boric acid transfer pump. The concentrated boric acid is added to the charging pump suction header. The total quantity added in most cases will be so small that it will have only a minor effect on the volume control tank level. When the preset quantity of concentrated boric acid solution has been added, the batch integrator causes the boric acid transfer pump to stop and the concentrated boric acid control valve and the makeup stop valve to close. This operation may be terminated manually at any time by actuating the makeup stop.
MakeuD StoD l
By actuating the makeup stop, the operator can terminate the makeup operation in any of the four modes of operation.
Manual The manual mode of operation permits the addition of a preselected quantity of boric acid solution at a preselected flow rate to the refueling water storage tank or through the temporary (flanged) connection to other items of equipment. While in the manual mode of operation, automatic makeup to the Reactor Coolant System is precluded. The discharge flow path must be prepared by opening manual valves in the desired path.
The operator then sets the mode selector switch to " Manual", the boric acid and makeup water flow controllers to the desired flow rates, the boric acid and makeup water batch integrators to the desired quantities and actuates the l
1 8026Q:10/022285 13
~
umkeup start switch. Actuating the start switch activates the boric acid flow control valve (FV-110A) and makeup water flow control valve (FV-111 A) and starts the preselected reactor makeup water pump and boric acid transfer pump.
When the present quantities of boric acid and reactor makeup water have been added, the pumps stop and the boric acid and makeup water flow control valves close. This operation may be stopped manually by actuating the makeup stop switch.
If either batch integrator is satisfied before the other has recorded its required total, the pump and valve associated with the integrater which has been satisfied will terminate flow. The flow controlled by the other integrator will continue until that integrator is satisfied. The boric acid flow rate should always be set slightly higher than the required mixture rate, to insure that boric acid flow is terminated and the lines are flushed by reactor makeup water.
Alarm Functions The reactor makeup control has been provided with alarm functions to call the operator's attention to the following conditions:
a.
Deviation of total makeup water flow f rom control set point.
b.
Deviation of concentrated boric acid flow rate from control set point.
i
(
8026Q:10/022285 14
2.5 CHEMICAL AND VOLUME CONTROL SYSTEM OPERATION 2.5.1 PLANT STARTUP Plant startup is defined as the operations which bring the reactor plant from the cold shutdown condition to normal, no-load operating temperature and pressure, and subsequently to full-power operation.
The charging pumps initially fill and pressurize the reactor coolant system.
During filling, makeup water is drawn from the reactor makeup water storage tank and blendtd, using the Reactor Makeup Control System, with boric acid, to provide makeup' water to the prevailing reactor coolant system boron concentration. The Reactor Coolant System is vented via the reactor vessel head. The pressurizer is vented separately to the pressurizer relief tank.
Following the venting operation, a letdown flow path is established by opening the letdown valve and the low-pressure letdown control valve.
The pressurizer heaters are energized to start increasing the pressurizer temperature.
Cleanup via the residual heat removal loop is terminated. The charging pumps -
are then employed to increase the reactor coolant system pressure (water solid j
at this time). The manual throttle valves in the seal water supply lines are set to provide labyrinth and No.1 seal flow (-8 gpm/ pump).
The rate of increase of system pressure is controlled by manual operation of the low-pressure letdown valve and regulating the charging pump flow.
If desired, the low-pressure letdown valve may be set in " Auto" to maintain a pressure of about 400 psig in the letdown system downstream of the orifices; pressurization is then controlled by the charging system.
When the reactor coolant system pressure has reach =400 psig, residual heat removal is terminated, and the AP across the No. 1 seal leakoff is checked.
If in order, a check is made to ensure that seal-water injection flow is adequate. The reactor coolant pumps are started sequentially.
If chemical treatment such as hydrazine addition is required, performed at this time.
The mixed-bed demineralizers are bypassed during chemical addition. The Reactor 8026Q:lD/030685 15
Coolant System will heat up due to the reactor coolant pump heat input and residual heat addition; hence excess coolant will accumulate in the volume control tank. The volume control tank level rises and the nitrogen cover gas is expelled to the waste processing system.
As soon as high level is reached in the volume control tank, the nitrogen supply is secured and the hydrogen makeup value is brought into operation.
During this operation the volume control, tank pressure is maintained at =15 psig by the pressure control valve in the gaseous vent line. The volume control tank level is allowed to decrease to normal by manually diverting the letdown flow to the recycle holdup tanks. This operation establishes the hydrogen overpressure in the volume control tank.
Heatup is continued until a tems:erature of about 250*F is achieved. At this point, the pressurizer heaters are employed to draw a steam bubble in the pressurizer. The low-pressure letdown control valve is now set in " Auto" to maintain about 350 psig downstream of the letdown orifices and charging-pump flow is controlled manually to obtain normal water level (no load) in the pressurizer. The charging pump can be placed in " Auto" following attainment
/
of normal water level. As heatup proceeds it will be necessary to provide extra letdown flow capability is provided by opening selected orifice isolation valves. This requirement will be dictated by the regenerative heat exchanger (a maximum of 380'F is allowed at the outlet from the heat exchanger upstream of the letdown orifices), and the rate of expansion of the coolant due to heatup as reflected by pressurizer level. The excess letdown heat exchanger may be employed as the reactor coolant temperature approaches T,yg no-load to accelerate the heatup phase. The pressurizer heaters are employed periodically during heatup to ensure a temperature difference between the coolant in the pressurizer and the reactor coolant system lines of at least 50*F but not more than 200*F.
Following chemical analysis to establish that water quality, boron concentration and hydrogen concentration are within specification, criticality is achieved by appropriate rod withdrawal; subsequent reduction of boron
?
8026Q:10/022285 16
cenccntraticn by dilution will be rcquired.
Further adjustments in boron concentration by operation of the Reactor Makeup Control System to establish preferred control-group rod positions and to compensate for xenon buildup will also be necessary.
Following attainment of full power, the letdown orifices are set for normal letdown.
During the heatup phase it should not be necessary to adjust the seal water injection valves; however, some adjustment of the charging line control valve may be required to maintain the required seal injection flow.
2.5.2 NORMAL OPERATION Normal operation includes operation at steady power (base load) level, load follow operation and hot standby.
Base Load At a constant power level, the rates of charging and letdown are dictated by
/
the requirements for seal water to the reactor coolant pumps and the normal purification of the Reactor Coolant System. One charging pump is employed and is controlled automatically from pressurizer level. The only adjustments in boron concentration necessary are those to compensate for core burnup.
These adjustments are made at infrequent intervals (= twice per week) to maintain the rod control groups within their allowable " limit".
Rapid variations in power demand will be accommodated automatically by control rod movement.
If variations in power level occur, and the new power level is sustained for long periods, some adjustment in boron concentration may be necessary to ensure preservation of shutdown margin.
During nornal operation the letdown flow is 75 gpm and one mixed-bed demineralizer is in service.
Reactor coolant samples are taken at frequent intervals (= once per shif t) to check boron concentration, water quality, 8026Q:10/022285 17
pH, and activity level.
The charging-pump speed control or flow control valve position maintains the pressurizer water level at the setpoint programmed for a prevailing reactor coolant average temperature. During operation at constant power the Reactor Makeup Control System is set in " Auto" to, provide leakage makeup at prevailing reactor coolant system boron concentration.
Makeup is initiated automatically if the volume control tank level fal.ls to the low-level setpoint.
Operator Action for load Follow When a change in plant load occurs, the control system will position the control rod banks ira accordance with the load dependent program for reactor coolant temperature. The Boron Thermal Regeneration System is then employed to effect the required boration concentration change in the Reactor Coolant System to accommodate the reactivity transients which occur as a result of load changes.
2.5.3 PLANT SHUTDOWN Hot Shutdown If required, for periods of maintenance, or following spurious reactor trips, the reactor can be held subcritical, but with the capability to return to full power within the period of time it takes to withdraw control rods.
During this hot shutdown the average temperature is maintained at no-load T,yg by initially steam dumping to provide residual heat removal, or at later stages by running reactor coolant pumps to maintain system temperature.
Following shutdown, xenon buildup occurs and increases the degree of shutdown; i.e., initially, all control rods are inserted and the core is maintained at a minimum of 2 percent Ak/k subcritical. The effect of xenon buildup is to increase this value to a maximum of about 3 percent Ak/k at about nine hours following shutdown.
8026Q:10/062085 18
If rapid recovery is required, dilution of the system may be performed to counteract this xenon buildup. A shutdown group of rods must be withdrawn during dilution and frequent checks made on critical rod position.
Plant Shutdown Plant shutdown is defined as the operations which bring the reactor plant from normal operating temperature and pressure to cold shutdown for maintenance or refueling.
Before initiating a cold shutdown, the volume control tank overpressure is reduced to lower the Reactor Coolant System hydrogen gas concentration.
This requirement will also apply to cold shutdowns for refueling purposes.
Also, the reactor coolant boron concentration is increased to the cold shutdown value.
The operator sets the reactor makeup control to " Borate",
selects the volume of concentrated boric acid solution necessary to perform the boration, samples the reactor coolant to verify that the concentration is corret.t, and sets the reactor makeup control for leakage makeup at the shutdown reactor coolant boron concentration.
Contraction of the coolant during cooldown of the Reactor Coolant System results in actuation of the pressurizer level control to maintain normal pressurizer water level. The charging flow is increased, relative to letdown flow, and results in a decreasing volume control tank level. The volume i
control tank level controller automatically initiates makeup to maintain the j
inventory.
After the Residual Heat Removal System is place in service and the reactor coolant pumps are shutdown, further cooling and depressurization of the i
pressurizer fluids are accomplished by charging through the auxiliary spray connection.
1 8026Q:10/022285 I
zg J
3
_If _r; quired, the Cix d-bed demineralizer and gas stripping in th2 volume control tank can be operated at maximum letdown in advance of a planned shutdown. Demineralization of ionic radioactive impurities and stripping fission gases reduce the reactor coolant activity level sufficiently to permit personnel access for refueling or maintenance operations.
2.5.4 A8 NORMAL OPERATION Loss of Norwel Letdown If the nornal letdown path is lost, an alternate letdown path through the excess letdown heat exchanger is available. The excess letdown flow is sufficient to allow the pressurizer level to be maintained while seal injection water flow to each reactor coolant pump is continued.
Reactor Coolant System Leak The CVCS is capable of making up for a small RCS leak of approximately 130 gpm using one centrifugal charging pump while maintaining seal injection flow to the reactor coolant pumps. This capability includes allowance for a minimum
/
RCS cooldown contraction, and assumes the letdown line will be isolated on low pressurizer level (LV-459, 460).
l l
l l
l l
l l
8026Q:10/022285 20 1
t
s x
i 3. 0' ANALYSIS t
3.1 INITIATING EVENTS Thepossib(9eventswhichcouldinitiateaborondilutionaccidentwere determined using a failure modes and effects analysis (FMEA) of the Chemical andVolumeControlSystem.jEachcomponentofthesystemwasconsideredto determinetheconsequencesffitsfailure:
For those components whose failure could lead to boron dilution, associated alarms were identified. The results of the FMEA appear in Appendix A.
Each failure which was identified as a possible boron dilution initiator was examined to determine if, because of administrative controls or similar precautions, it would require a double failure to lead to boron dilution. Where double failures, rather than single, were necessary to cause an event, the probability of the event becomes much 1
lowerthanthesinglyfailureeventsandis,thus,boundedbythem. Table 3-1 lists all of the possible initiators which were identified by the FMEA, the modes in which they apply, and any procedure which would make the initiators \\
require double failures.
A final list of four single failure initiators was produced and is shown in Table 3-2.
Next, the frequencies of these four initiators were calculated.
Bota mechanical failures and human errors were considered to determine the i
frequencies.
The following paragraphs explain how each of the frequencies was calculated.
All human error data was taken f rom NUREG/CR-1278.
3.1.1 DEMINERALIZER OUTLET ISOLATION VALVE OPEN DURING RESIN FLUSHING s
x
\\
The main contribution to this event is failure of the operator to close the isolation valve, as stated in the procedure.
The valve could also transfer open due to mechanical failure, but this is less likely than the human error.
The following assumptions were made in the analysis:
L 9
1 80260:10/062085 21 g
a) The procedure involved includes more than 10 steps.
b) Each Demineralizer is flushed once per year.
c) One hour is required for each flushing operation.
Using these assumptions, a frequency of.03 per reactor year was calculated, based on the following data:
human error (omit step in written procedure).012 (Table 15-3, Reference 4) human error (incorrect valve operation)
.003 (Table 14-1, Reference 4) frequency of demineralizer flush (per reactor year) 2 This procedure is normally performed in cold shutdown and 80% of the initiating events were assumed to occur in mode SA, and 20% in mode 58.
However, administrative controls prevent the occurance of a boron dilution incident from this event during mode 58.
3.1.2 VALVE 226 OPEN FOLLOWING BTRS DEMINERALIZER FLUSHING OPERATION
/
This event also involves a human error or a mechanical failure. The operator could fail to close valve 226 following demineralizer flushing. This is very similar to the error mentioned above in that it is an omission of a step in a long procedure that is used about once per year. This procedure was also assumed to be performed twice per year and thus the frequency of this initiating event was also calculated as.03 per reactor year.
3.1.3 FAILURE TO SECURE CHEMICAL ADDITION This event could be caused by a human error or by a double mechanical failure j
of valves 176 and 181.
The double failure has a negligibly low probability, i
The human error involves leaving out a step in a short procedure.
It was estimated that chemical addition is used about 25 times per year in modes 3 and 4 and once per year in modes SA and 5B each.
l l
8026Q:10/062005 22 t
Thus the frequency of this initiating event was calculated as 0.12 per reactor year in modes 3 and 4 and 0.0094 per reactor year in modes SA and 58. The probability of failure to secure a specific chemical addition operation was
-3 calculated as.0047 (3.7 x 10 for omission of a step (ref,erence 4,* Table 15-3) and.001 for incorrect valve operation (Table 14-1).
3.1.4 VALVE FV-110A FAILS CLOSED DURING,MAKE-UP This event involves mechanical failure of the flow control valve from the Boric Acid Storage Tank. The hourly failure rate for this type of valve is 1.5 x 10-6 (Reference 3). The following conservative estimates of times spent in modes were assumed:
mode 3
- 20 days /yr mode 4
- 40 days /yr mode 5 (filled) - 60 days /yr mode 5 (drained) - 10 days /yr Reactor makeup from this path is isolated by locked closed valves during mode SB and mode 6 operation.
The resulting initiating event frequencies were calculated:
modes 3, 4
- 2.2 x 10 /yr
-3 l
mode 5 (filled) - 2.2 x 10 /yr Note that modes 3 and 4 are combined because their similar volumes and boron concentration allow one event tree to cover both modes.
80260:1D/062085 23
3.2 OPERATOR RESPONSE TIMES Most of the boron dilution events require operator action to prevent unplanned criticality. The operator may either diagnose the problem and correct it or may react to an alarm and follow the corresponding procedure.
In this analysis operator response was modeled in response to either the high flux alarm or to the high volume control tank level alarm. Conservatively 7no credit was taken for operator response to,. increasing source range counts or to boronmeter indications, however for very slow dilutions (greater than 10 hours1.157407e-4 days <br />0.00278 hours <br />1.653439e-5 weeks <br />3.805e-6 months <br />) the possibility of detecting the event during the daily verification of shutdown margin was considered. The time for response to the alarm is limited to the time from alarm actuation to unplanned criticality. Appendix B contains the derivation of the equations and the calculation of the available times. Calculations are shown for the BA Flow Deviation Alarm, the Volume Control Tank High Level Alarm, and the High Flux at Shutdown Alarm. An alarm actuates more than 15 minutes before criticality for each initiator and in each mode. This shows that the design meets the 15 minute time requirement of the Standard Review Plan.
8026Q:1D/061885 24
3.3 EVF.NT TREES The responses to each initiating event were modeled in event trees.
The first two events had similar sequences of responses; therefore, the same event tree structure was used for all three. The third and fourth had some different responses, which required separate event trees. Three modes were considered:
- 1) modes 3 and 4, combined
- 2) mode 5, filled (mode SA)
- 3) mode 5, drained (mode SB)
Figure 3-1 shows the event tree for initiators 1 and 2.
The top events of the tree are explained below:
ETl or ET2 - Improper CVCS or BTRS Demineralizer Flushing TLA - Volume Control Tank Level HFA - High Flux Alarm DAI - Operator diagnoses problem and isolates cause These initiators result in an inflow of dilute water into the letdown flow
/
upstream of the Volume Control tank.
In response to these events, the VCT level will increase and the operator will receive VCT high level indications (i.e. VCT high level alarm and/or indication of flow diversion to the recycle holdup tank).
If the operator does not receive or respond to the VCT level indications the high flux alarm will actuate and the operator will terminate the dilution event and restore shutdown margin.
l Figure 3-2 illustrates the event tree for the failure to secure chemical addition event. The top events of the tree are as follows:
ET3 - Initiating event - Failure to secure chemical addition HFA - High flux at shutdown alarm actuates DAI - Operator diagnoses dilution event and isolates.
I 8026Q:lD/061885 25
-This-initiating event (failure to secure chemical addition) results in an extremel'y slow dilution of the reactor coolant system.
Because of the long time involved in the dilution event, operator diagnosis of the boron dilution event is likely during the daily shutdown margin verification even if the high 4
flux alarm fails to operate.
The event tree which represents the fourth initiator (the failure closed of FV-110A) appears in Figure 3-3.
The top svents of the tree are as follows:
ET4 - Initiating event - Failure closed of FV-110A FA - Flow deviation alarm actuates MUI - Makeup is isolated either automatically or by operator HFA - High flux at shutdown alarm actuates DAI - Operator diagnoses problem and isolates source This event would cause almost immediate Boric Acid and Makeup flow deviation alarms and automatic isolation of makeup.
If the flow deviation alarm or automatic isolation of nakeup fails then the high flux alarm should annunciate and the operator would respond by isolating charging and initiating emergency boration.
1 1
8026Q:10/030885 26
3.4 FAILURE PROBABILITIES FOR TOP EVENTS The probabilities of failure of the top events or nodes, of the event trees were calculated using the data in Appendix C.
Table 3-3 lists the values for each node of each tree and summarizes the results of this section.
3.4.1 HIGH FLUX ALARM (HFA)
Technical Specifications require that at least one source range detector be operable during shutdown modes 3, 4 and 5, with a channel check performed every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and an analog channel operational test monthly. Based on the
-4 above and data from Appendix C a failure probability of 3.9 x 10 was calculated for this alarm.
3.4.2 VOLUME CONTROL TANK LEVEL ALARM (TLA)
The volume control tank has two level detectors, however the high level alarm is actuated by only one detector. Credit for the redundant detector was taken
~
only for facilitating in the detection of failures of the high level alarm detector and associated instrumentation. A total failure probability of 9.1 x
-3 10 was calculated for this alarm (Appendix C).
3.4.3 FLOW DEVIATION ALARM (FDA) l Failure closed of the boric acid flow control valve will result in imediate control room annunciation via the boric acid flow deviation alarm.
Additionally the total makeup flow deviation alarm will actuate if the boric acid flowrate is greater than 8 gpm as is normally the case. The probability
~3 of neither alarm actuating was calculated as 7.3 x 10 t
3.4.4 MAKEUP ISOLATED (MUI)
This event tree node is addressed in the boric acid flow valve failed closed initiating event (event tree 4).
If a flow deviation alarm is actuated.
l l
8026Q:10/030885 27 L
FV-110B and FV-lllB automatically close to isolate makeup flow. A failure
~
-2 probability of 4.0 x 10 was calculated for this event tree node.
3.4.5 DIAGNOSE AND ISOLATE NODE (DAI)
Success of this action is addressed by all four boron dilution event. trees and is affected by a number of variables including:
1.
the alarms which have been annunciated 2.
the time available between alarm annunciation and loss of shutdown margin.
For the high flux alarm, it is assumed that all operators are familiar with the immediate actions to the alarm which will include isolation of the normal charging flow and actuation of emergency boration. Additionally it is assumed that the Abnormal Operating Instructions will be available in the control room and that the operators will be trained to refer to the appropriate procedure in the event of a high flow alarm. Under these conditions the lower bound human error probabilities of figure 12-4 of reference 4 are applicable.
j If only high volume control tank level indications are received in the control room, the operator response may be impaired because of misdiagnosis of the cause of the alarm.
For some events it is possible that the operator will attribute the high VCT level to expansion of reactor coolant or to makeup operations.
For these reasons the upper bound curve of figure 12-4 of l
reference 4 was used to estimate the response to this alarm. Additionally a l
failure probability of.05 was added to account for misdiagnosis errors if l
greater than 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> was available for detection and.2 was added if between 30 and 60 minutes was available.
If both the VCT level alarm and the high flux alarm are received in the control room the product of the human error probabilities is used to estimate the total human error probabilities since the two alarms would result in event termination by different methods.
t l
l 8026Q:lD/030885 28
For the failure to secure chemical addition event tree, operator diagnosis and event termination is considered even in the absence of a positive alarm due to the long time required for loss of shutdown margin.
In this case the daily shutdown margin check may discover the boron dilution event and result in operator action to recover the required shutdown margin.
If the time to criticality was greater than 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> then the human error probability (HEP) was estimated as.01.
For modes SA and SB the, HEP was calculated as 1.0- 0.7
[(time to criticality)/24 hour] +.01.
l 8026Q:10/030885 29
TABLE 3-1 6
POSSIBLE INITIATING EVENTS Event Modes Comments-
~
1.
Manual valve 183 left open A11 Double failure because of following test or maintenance independent safety verification 2.
Demineralizer outlet 3,4,5 In mode 6, demineralizers isolation valve open are isolated by locked valves during resin flushing 3.
Failure to secure chemical 3, 4, S Credible event, but extremely addition (valves 176 and slow dilution 181 open) l 4.
Valve FV-110A fails closed 3,4,5 Makeup isolated during during makeup, causing loss mode 6 of boric acid flow 5.
Valve 226 left open following 3, 4, 5 BTRS isolated during demineralizer flushing mode 6 l
6.
BA Storage Tank isolation All Valve is locked open and valve closed during makeup has independent safety l
verification following l
maintenance 8026Q:10/030685 30
TABLE 3-2 INITIATING EVENTS INVOLVING SINGLE FAILURES i
Modes
~
Event 1.
Demineralizer outlet isolation valve 3, 4, 5A open during resin flushing 2.
Valve 226 open during BTRS operation 3, 4, 5A 3.
Failure to secure chemical addition 3,4,5 g
4.
Valve FV-110A fails closed during makeup 3, 4, 5A l
l l
l
\\
8026Q:lD/061885 31
TABLE 3-3 4
TOP EVENT FAILURE PROBABILITIES Event Tree Node Mode 3.4 Mode Sa Mode Sb 1
ET1 2.4E-3
.024 TLA 9.1E-3' 9.1E-3 HFA 3.9E-4 3.9E-4 DAI (Both alarms) SE-6 SE-6 DAI (HFA only) 1E-4 1E-4 DAI (TLA only) 5.0E-2
.05 2
ET2 2.4E-3
.024 TLA 9.1E-3 9.1E-3 HFA 3.9E-4 3.9E-4 DAI (TLA only)
.06
.06 DAI (HFA only) 4E-4 4E-4 DAI (Both alarms) 2.4E-5 2.4E-5
/
3 ET3 0.12 9.4E-3 9.4E-3 HFA 3.9E-4 3.9E-4 3.9E-4 DAI (HFA) 1E-6 1E-6 1E-6 DAI (No alarm)
.01
.01
.31 4
ET4 3.3E-3 3.3E-3 FA 7.3E-3 7.3E-3 MUI 4.0E-3 4.0E-3 HFA 3.9E-4 3.9E-4 DAI 2E-3 2E-3 80260:10/061885 32
ETI TLA HFA DAl 1 SUCCESS i
2 LSM 3 SUCCESS 4 LSM 5 success e LSM 7 LSM LSM = Loss Of Shutdown Margin Possible FIGURE 3 - 1 EVENT TREE 1 - CVCS Demineralizer Outlet Valve Open During Flushing EVENT TREE 2 - Valve 226 Open following BTRS Demineralizer Flushing
S S
S S
E E
C C
C MC M U S U S S L S L 1 2 3 4 6
l AD no i
t i
d dA lac ime hC i
,i eruce S
2 o
T 3
er E
u R
l A
U i
F G
a H
I F
F 3
E E
R T
TN EV E
u 3
_r l
,lllIll
i l
I I
J I
i I
l ET4 FA MUI MFA DA1 1 SUCCESS 2 SUCCESS i
3 LSM 4 LSM S SUCCESS l
I S LSM l
N F LSM i
l l
I i
FIGURE 3 - 3 t
EVENT TREE 4 - FV-110A Fails closed During Makeup
~
e
T 4.0 RESULTS The event trees were quantified using the frequencies and failure probabilities presented in Section 3.
The results of each tree are Jisted in Table 4-1, along with the total f requency of unplanned criticality.
-6 A total f requency of 4.0 x 10 per reactor year is calculated for the occurrence of a loss of shutdown margin due to boron dilution events. The frequency of loss of shutdown margin events was initially dominated by demineralizer flush valve misalignments, particularly in mode 58. Vogtle administrative procedures have since been modified to require isolation of the dilute water supply to the primary and BTRS demineralizers prior to proceeding to mode 58. Additionally this analysis assumed that the demineralizer flush procedures would include strict administrative controls (including independent verification of the valve lineup) to prevent an inadvertent dilution. These administrative controls and the redundancy of alarms accounts for the low frequency of loss of shutdown margin events.
i
{
l l
8026Q:10/062085 36 1
)
TABLE 4-1 RESULTS Frequency cf Unplanned E.T.
Mode Criticality (per Year)
% Contribution 1
3, 4 7.01-8 2
Sa 7.0E-7 17 Sb 2
3,
- 1.3E-7 3
Sa 1.3E-6 32 Sb 3
3, 4 5.9E-7 14 Sa 4.6E-8 1
Sb 1.1E-6 27 4
3, 4 8.9E-8 2
Sa 8.9E-8 2
Sb Total 4.0E-6 P
8026Q:10/061885 37 i
L
~
5.0 CONCLUSION
S As was mentioned in Section 3.2, the times between an alarm and unplanned criticality for all initiating events in all modes are greater than 35 minutes. This allows sufficient time for the operator to respond to the events.
It also shows that the 15 minute minimum requirement specified in the Standard Review Plan is met for all events.
l l
l l
l 8026Q:10/062085 38
REFERENCES 1.
Letter from Tom Gerlowski to Sherrie Erwin, FSD/SS-GAE-3590, January 8, 1985.
2.
Personal Communication with Arto Cinar to 8echtel, November 5,1984.
3.
NUREG/CR-2770, " Common Cause Fault Rates For Valves", Steverson, J. A. and Atwood, C.
L., February 1983.
4.
NUREG/CR-1278, Handbook of Human Reliability Analysis with emphasis on Nuclear Power Plant Applications, Final Report, A. D. Swain and H. E.
Guttman, June 1983.
5.
Millstone Unit 3 Probabilistic Safety Study, August, 1983.
1 6.
Annunciator Response Procedures for AL8-07, Rev. O,17007-1, Georgia Power Vogtle Electric Generating Plant.
l l
8026Q:10/061885 39 l
L
APPENDIX A FAILURE H0DE AND EFFECTS ANALYSIS CHEMICAL AND VOLUME CONTROL SYSTEM ACTIVE COMPONENTS - NORMAL PLANT OPERATION AND SAFE SHUTDOWN CVCS Operation Effect on System Comp?nent Failure Mode Function Operation and Shutdown Additional Information**
1.
Air diaphragm a.
Fails open a.
Charging and Volume a.
Failure reduces cperated globe Control - letdown redundancy, of valve LV459 flow.
providing letdown (LV460 analogous) flow isolation to protect PRZ heaters from uncovering at low water level in PRZ.
No effect on system operation.
Alternate isolation l
valve (LV-460) provides backup letdown flow isolation.
b.
Fails closed b.
Charging and Volume b.
Failure blocks a Control - letdown normal letdown flow.
flow to VCT. Minimum letdown flow re-quirements for boration of RCS of safe shutdown concentration level
- ~
may be met by establishing letdown flow through alternate, excess letdown flow path.
If the alternate, excess letdown flow 80260:10/022285
APPENDIX A (Cont)
CVCS Operation Effect on System Component Failure Mode Function Ooeration and Shutdown Remarks path to VCT is not available due to l
common mode failure I
(loss of instrument air supply) affecting the opening operation of isolation valves l
in each flow path, the plant operator can borate the RCS to a safe shutdown concentration level without letdown flow by taking advantage Y
of the steam space available in the PRZ.
Letdown can s
also be provided from the reactor vessel head.
2.
Air diaphragm a.
Fails open.
a.
Charging and Volume A.
Failure prevents cperated globe Control - letdown isolation of normal valve HV-8149B flow.
letdown flow through (8149C and regenerative heat 8149A analogous) exchanger.
No effect safe shutdown operation.
Containment isolation valve (HV-8152 or 8160) may be remotely l
closed from the CB to isolate letdown flow through heat exchanger.
' 8026Q:10/030685
APPENDIX A (Cont)
CVCS Operation Effect on System Comp?nent Failure Mode Function Operation and Shutdown Additional Information**
b.
Fails closed, b.
Charging and Volume b.
Failure blocks normal Control - letdown letdown flow to VCT.
flow.
Normal letdown flow to VCT may be maintained by opening alternate letdown orifice isolation valve HV-8149C.
Minimum letdown flow requirements for boration of RCS to safe shutdown con-centration level may be met by opening letdown orifice 1 solation, valve 2
! la HV-8149A or 8149C.
If common mode failure (loss of instrument air) prevents opening of these valves also prevents establishing alternate flow through excess i
letdown flow path, l
plant operator can borate the RCS to a i
l safe shutdown l
concentration level without letdown flow l
by taking advantage of steam space l
available in PRZ.
Letdown can also be i
provided from the j
reactor vessel head.
l 8026Q:10/022285 l
t
APPENDIX A (Cont) l CVCS Operation Effect on System Component Failure Mode Function Operation and Shutdown Additional Information**
{ 3.
Air diaphragm a.
Fails closed.
a.
Charging and Volume a.
Same effect on system cparated globe Control - letdown operation as that valve HV-8152
- flow, stated for Item No. 1, (8160 analogous) failure mode " Fails i
closed".
i i
b.
Fails open.
b.
Charging and Volume b.
Failure has no effect Control - letdown on CVCS operation flow.
during normal plant operation. However, under accident con-ditions requiring containment isola-i i
tion, failure reduces l
the redundancy of providing isolation i
of normal letdown 2j, line.
q I
1 4.
Air diaphragm a.
Fails open.
a.
Boron Concentration a.
Failure inhibits use j
cp; rated globe Control - boron of BTRS for load j
valve TV-381B thermal regeneration follow operation (boration).
(boration) due to low temperature of let-down flow entering jl BIRS demineralizers.
l Alternate boration of i
i reactor coolant is I
possible using RMCS i
of CVCS.
No effect on operation to bring reactor to safe shutdown condition.
) 8026Q:lD/022285
I l
APPENDIX A (Cont) 1 CVCS Operation Effect on System Component Failure Mode Function Doeration and Shutdown Additional Information**
)
b.
Fails closed.
b.
Boron Concentration b.
Failure inhibits use Control - boron of BTRS for load thermal regeneration follow operation (boration).
(boration) due to loss of temperature control of letdown i
flow entering BTRS demineralizers.
l Failure also blocks normal letdown flow to VCT when BTRS is not being used for load follow. Minimum letdown flow re-quirements for I~
boration RCS to safe 6
shutdown concentration level may be met as stated for effect on system operation for item No.1, f ailure
" Fails closed".
5.
Air diaphragm a.
Fails open.
a.
Charging and Volume a.
Failure prevents eperated globe c
Control - letdown control of pressure valve PV-131 flow.
to prevent flashing of letdown flow in letdown heat ex-changer and also allows high pressure fluid to mix bed de-mineralizers.
Relief valve PSV-8119 opens in demineralizer line i
to release pressure l
l
~.
t
+ 80266:10/030685
APPENDIX A (Cont)
CVCS Operation Effect on System camannent Failure Mode Function Oneration and Shutdown Additional Information**
to VCT and valve (TC-1?9) changes position to divert flow to VCT.
Boration of RCS to safe shutdown concentration level is possible with valve failing open.
I b.
Fails closed.
b.
Charging and Volume b.
Same effect on system Control - letdown operation as that for flow.
item No. 1, failure mode " Failed closed".
6.
Air diaphragm a.
Fails open for a.
Charging and Volume a.
Letdown flow bypassed cperated three-flow only to Control - letdown from flowing to mixed 6
way valve TV-129 VCT.
flow.
bed demineralizers and BTRS.
Failure prevents ionic purification of i 2, letdown flow and
.a prevents operation of
)
BTRS.
Boration of i
.RCS to safe shutdown concentration level i
is possible with valve failing open I
for flow only in VCT.
l b.
Fails open for b.
Charging and Volume b.
Continuous letdown to l
flow only to Control - letdown mixed bed de-mixed bed fl0W mineralizers and BTRS.
demineralizer.
Failure prevents automatic isolation of i
~.
80260:10/030685
l APPENDIX A (Cent) l CVCS Operation Effect on System Como?nent Failure Mode Function Operation and Shutdown Additional Information**
i mixed bed de-mineralizers and BTRS under condition of l
high letdown flow tem-l peratures.
Boration of RCS to shutdown concentration level is possible with valve failing open l
for flow only to i
demineralizers.
I 7.
Air diaphragm a.
Fails closed, a.
Charging and Volume a.
Failure prevents use l
l cperated globe Control - excess of the excess letdown valve HV-8153 letdown flow.
line of the CVCS as an l
i (8154 analogous) alternate path that
{=
may be used for
-4 letdown flow control.
i I
'1 l
b.
Fails open.
b.
Charging and Volume b.
Failure reduces re-Control - excess dundancy of providing j
letdown flow.
excess letdown flow
. isolation during normal plant operation and for plant startup. No effect on system operation.
l 1
I 80260:10/022285 j
APPENDIX A (Cont)
CVCS Operation Effect on System Comp *nent Failure Mode Function Operation and Shutdown Additional Information**
8.
Air diaphragm a.
Fails closed.
a.
Charging and Volume a.
Failure prevents use cperated globe Control - excess of excess letdown line valve HV-123 letdown flow.
of the CVCS as an al-ternate path that may be used for letdown flow control.
b.
Fails open.
b.
Charging and Volume b.
Failure prevents Control - excess nanual adjustment letdown flow.
f rom control board (C8) of RCS system pressure downstream of excess letdown heat exchanger to a low pressure consistent with No. 1 9-seal leakoff back-oo pressure requirements.
Relief valve PSV-8121 opens in seal return line to release pressure to PRT.
9.
Air diaphragm a.
Fails closed.
a.
Charging and Volume a.
No automatic makeup of cperated Control - seal water seal water to seal i
diaphragm valve flow.
standpipe that l -LV-181, services No. 3 seal (1 -LV-180, of RC pump No. 1.
No 1-LV-179, and effect on operation l-LV-178 are to bring the plant to analogous) safe shutdown conditions.
~.
8026Q:lD/022285
APPENDIX A (Cont)
CVCS Operation Effect on System i Compontnt Failure Mode Function Operation and Shutdown Additional Information**
{
b.
Fails open.
b.
Charging and Volume b.
Overfill of seal water Control - seal water standpipe and dumping flow.
of reactor makeup water to containment sump during automatic l
makeup of water for l
No. 3 seal of RC pump No. 1.
No effect on operations to bring reactor safe shutdown condition.
- 10. Motor operated a.
Fails open.
a.
Charging and Volume a.
Failure has no effect globe valve Control - seal water on CVCS operation HV-8112 (8100 flow and excess let-during normal plant
- }"
analogous) down flow.
operation. However, under accident conditions requiring t
containment isolation I:
of seal water flow and excess letdown flow, redundancy is reduced.
b.
Fails closed.
b.
Charging and Volume b.
RC pump seal water re-Control - seal water turn flow and excess flow and excess let-letdown flow blocked.
down flow.
Failure inhibits use of the excess letdown fluid system of the CYCS as an alternate 3
j system that may be used for letdown flow i
]8026Q:1D/022285
APPENDIX A (Cent)
CVCS Operation Ef fect on Sy' stem Como'nent Failure Mode Function Operation and Shutdown Additional Information**
control during normal plant operation.
Relief valve PSV-8121 t
provides capability of seal water to o<
cooling RC pump bearings.
- 11. Motor operated a.
Fails open.
a.
Charging and Volume a.
Failure has no effect gate valve HV-8105 Control - charging on CVCS operation (8106 analogous) flow.
during normal plant operation.
- However, under accident condition requiring isolation of charging line, failure reduces redundancy of pro-J, viding isolation of f
c) normal charging flow.
i b.
Fails closed.
b.
Charging and Volume b.
Failure prevents use r
Control - charging of normal charging flow.
line to RCS for
'boration, dilution, and coolant makeup operations.
Seal water injection path remains available for boration of RCB to a safe shutdown con-t 4
centration level and makeup of coolant during operations to bring the reactor to safe shutdown l
conditions.
8026Q:1D/022285 4
j
APPENDIX A (Cont)
J CVCS Operation Effect on System Compor:ent Failure Mode Function Operation and Shutdown Additional Information**
1
- 12. Air diaphragm a.
Fails open.
a.
Charging and Volume a.
Failure prevents cperated globe Control - seal water manual adjustment at valve HCV-182 flow.
CB of charging flow, 1
resulting in i
increased charging 4
flow and decrease
{
seal injection flow.
i b.
Fails closed.
b.
Charging and Volume b.
Failure prevents Control - charging normal charging flow.
flow.
Seal injection path remains for boration i
to safe shutdown.
i
- 13. Motor operated a.
Fails open.
a.
Charging and Volume a.
Failure has no effect s
giche valve HV-8110 Control - charging on CVCS operation
- 3, (8111A and 81118 flow and seal water during normal plant analogous) flow.
operation. However, under accident con-dition requiring isolation of centrifugal charging i
pump miniflow line, failure reduces re-l dundancy of providing i
isolation of miniflow
{
to suction of pump via seal water heat exchanger.
8026Q:lD/022285 1
APPENDIX A (Cont)
CVCS Operation Effect on System Comprnent Failure Mode Function Operation and Shutdown Additional Information**
b.
Fails closed.
b.
Charging and Volume b.
Failure blocks mini-Control - charging flow to suction of flow and seal water centrifugal charging
- flow, pumps via seal water heat exchanger.
Normal charging flow and seal water flow prevents deadheading of pumps when used.
Boration of RCS to a safe shutdown concentration level and makeup of coolant during operations to bring reactor to safe shutdown condition is still possible, i
- 14. Motor operated a.
Fails open.
a.
Charging and Volume a.
Failure has no effect globe valve HV-8146 Control - charging on CVCS operation 3
flow.
during normal plant operation, or safe n>
shutdown operation.
Valve is used during cold shutdown operation to isolate normal charging line I
when using the auxiliary spray during the cooldown of the pressurizer.
I Cold shutdown of reactor is still possible, however, time for cooling down PRZ will be extended.
~.
8026Q:lD/022285
APPENDIX A (Cent)
CVCS Operation Effect on System Comornent Failure Mode Function Operation and Shutdown Additional Information**
b.
Fails closed.
b.
Charging and Volume b.
Failure blocks normal Control - charging charging flow to the flow.
RCS.
Plant operator can maintain charging flow be establishing flow through alternate charging path by opening of isolation valve (HV-8147).
- 15. Motor operated a.
Fails closed.
a.
Charging and Volume a.
Failure reduces re-globe valve HV-8147 Control - charging dundancy of charging flou.
flow paths to RCS.
No effect on CVCS l }"
operations during f
normal plant operation, or saf e shutdown operation.
Normal charging flow path remains avail-able for charging flow.
b.
Fails open.
b.
Charging and Volume b.
Same effect on system Control - charging operation and shutdown flow.
as that stated above for item No.14, failure mode " Fails open" if alternate charging line is in use.
8026Q:10/022285
APPENDIX A (Cont)
CVCS Operation Effect on System Comp *nent Failure Mode Function Operation and Shutdown Additional Information**
- 16. Air diaphragm a.
Fails open.
a.
Charging and Volume a.
Failure results in cperated globe Control - charging inadv~ertent operation valve HV-8145 flow.
of auxiliary spray that results in a re-duction of PRZ pressure during nornal plant opera-tion.
PRZ heaters operate to maintain required PRZ pressure.
Boration of RCS to a safe shutdown concentration level and makeup of coolant during operation to bring reactor to safe j[
shutdown is still a
possible.
b.
Fails closed.
b.
Charging and Valume b.
Failure has no effert Control - charging on CVCS operation flow.
during normal plant l
operation.
Valve is used during cold shutdown operation to activate auxiliary l
spray for cooling down the pressurizer after operation of RHS.
80260:10/022285 i
APPENDIX A (Cont)
CVCS Operation Effect on System Component Failure Mode Function Operation and Shutdown Additional Information**
- 17. P:sitive Dis-a.
Fails to a.
Charging and Volume a.
Failure reduces re-placement Pump deliver Control - charging dundancy of providing working fluid flow and seal water charging and seal flow.
water flow to RCS.
Centrifugal charging pumps provide al-ternate means of providing flow.
- 18. Centrifugal a.
Fails to a.
Charging and Volume a.
Failure reduces re-charging pump A deliver Control - charging dundancy of providing (Pump B analogous) working fluid.
flow and seal water charging and seal flow.
water flow to RCS. No effect on normal plant operation, or bring reactor to a safe 6
shutdown condition.
Two centrifugal pumps L
are provided, both of which are backups to u'
the normally running positive displacement-pump.
- 19. Air diaphragm a.
Fails closed.
a.
Chemical Control a.
Failure blocks cperated globe Purification and hydrogen flow to VCT valve PCV-8156 Makeup - oxygen resulting in loss of control.
hydrogen over-pressure.
No effect on operation to bring the reactor to safe shutdown condition.
80260:10/030685
APPENDIX A (Cont)
CVCS Operation Effect on Sy' stem component Failure Mode Function Qgeration and shutdown Additional Information**
- 20. Motor operated a.
Fails open.
a.
Charging and Volume a.
Failure has no effect gate valve LV-112B Control - charging on CVCS operation (LV-112C flow and seal water during normal plant analogous) flow.
operation, and bringing reactor to a safe shutdown condition.
- However, under accident conditions requiring isolation of VCT, failure reduces re-dundancy of providing isolation for discharge line of VCT.
b.
Fails closed.
b.
Charging and Volume b.
Failure blocks fluid Control - charging flow from VCT during
}-
flow and seal water normal plant opera-flow.
tion, and when g;
bringing the reactor to safe shutdown condition. Alternate-supply of borated
-(2000 ppm) coolant from the RWST to suction of charging pumps can be es-tabiished from the control room by the operator through the
- ~
opening of RWST isolation valves (LV-1120 and LV-112E) and starting a centrifugal charging pump.
80260:10/030685
APPENDIX A (Cont)
CVCS Operation Effect on Sy' stem Component Failure Mode Function Operation and Shutdown Additional Information**
- 21. Air diaphragm a.
Fails closed.
a.
Chemical Control, a.
Failure blocks vent-cperated valve Purification and ing of VCT gas mixture l
PV-115 Makeup - oxygen to gas waste pro-control.
cessing system for stripping of fission products from RCS coolant during normal plant operation.
No effect on operations to bring the reactor to safe shutdown condition.
- 22. Air diaphragm a.
Fails closed.
a.
Boron Concentration a.
Failure blocks fluid cperted Control - reactor flow from reactor diaphragm valve makeup control -
makeup control system FV-110B boration, auto for automatic boric I"
makeup, and alternate acid addition and dilution.
reactor water makeup during normal plant operation.
Failure also reduces redundancy of fluid flow paths for dilution of the RCS coolant by reactor j
makeup water and blocks fluid flow for boration of the reactor coolant when bringing the reactor t
to a safe shutdown condition.
Boration (at BA storage tank f
i l
8026Q:10/022285 l
- ~ ~ - - - ~ ~ ' -
--- - ' ~
- - - - - ~ - - - - - - - - - -
APPENDIX A (Cent)
CVCS Operation Effect on System Comptnent Failure Mode Function Operation and Shutdown Additional Information**
boron concentration level) of RCS coolant is possible by opening of alternate BA tank isolation valve (HV-8104) at CB.
b.
Fails open.
b.
Boron Concentration b.
Failure allows for i
Control - reactor alternate dilute makeup control - '
mode type operation boration, auto for system operation makeup, and alter-of normal dilution of nate dilution.
RCS coolant.
No effect on CVCS operation during nornal plant operation and bringing the reactor to a safe 3,
2.
shutdown conuition.
co
- 23. Air diaphragm a.
Fails closed.
a.
Boron Concentration a.
Failure blocks fluid cperated Control - reactor flow from RMCS for diaphragm valve makeup control -
dilution of RCS cool-FV-lllB dilution and alter-
' ant during nornal nate dilution.
plant operation. No effect on CVCS operation.
Operator can dilute RCS coolant by estab-11shing " alternate dilute" mode of system operation.
i I
8026Q:lD/022285
APPENDIX A (Cont)
CVCS Operation Effect on System Component Failure Mode Function Operation and Shutdown Additional Information**
b.
Fails open.
b.
Boron Concentration b.
Failure allows for i
Control - reactor alternate dilute makeup control -
mode type operation i
dilution and alter-for system operation nate dilution.
of boration and auto makeup of RCS coolant. No effect on i
CVCS operation during l
normal plant operation or shutdown.
l
- 24. Air diaphragm a.
Fails open.
a.
Boron Concentration a.
Failure prevents the 1.
Valve is cperated globe Control - reactor addition to a pre-designed to i
valve FV-110A makeup control -
selected quantity of fail open.
boration and auto concentrated boric makeup.
acid solution at a 2.
Valve position preselected flow rate indication (open 7*
to the RCS coolant to closed G$
during normal plant position change) operation, and when in control room; bringing the reactor and boric acid to a safe shutdown flow recording i
condition.
Boration*
(FR-110) and to bring the reactor flow deviation
'to a safe shutdown alarm at the condition is possible, control board.
however, flow rate of solution from the BA storage tank cannot be automatically controlled.
8026Q:lD/022285 l
APPENDIX A (C:nt)
CVCS Operation' Effect on System Comp *nent Failure Mode Function Operation and Shutdown Additional Information**
b.
Fails closed.
b.
Boron Concentration b.
Failure blocks fluid 1.
BA flow Control - reactor flow of boric acid deviation makeup control -
solution from BA stor-alarm and boration, and auto age tanks during makrup.
total makeup makeup.
Boration (at BA stor-flow devi-age tank boron concen-ation alarm.
tration level) of RCS coolant is possible by opening of alternate BA tank isolation valve (HV-8104) from control room.
- 25. Air diaphragm a.
Fails closed.
a.
Boron Concentration a.
Failure blocks fluid cperated globe Control - reactor flow of water from valve FV-111A makeup control -
reactor makeup 2-dilute, alternate control system during da dilute and auto normal plant oper-
- makeup, ation. No effect on system operation.
I b.
Fails open.
b.
Boron Concentration b.
Failure prevents the' l
Control - reactor addition of a pre-makeup control -
' selected quantity dilute, alternate of water makeup at a dilute and auto preselected flow makeup.
rate to the RCS coolant during normal plant operation.
8026Q:10/022285 i
APPENDIX A (Cont) l CVCS Operation Effect on System component Failure Mode Function Goeration and Shutdown Additional Information**
- 26. Motor operated a.
Fails closed, a.
Boron Concentration a.
Failure reduces re-1.
Valve is at a globe valve HV-8104.
Control - reactor dundance of flow paths closed position makeup control -
for supplying Doric during normal boration and auto acid solution from BA RMCS operation.
makeup.
storage tank to RCS via charging pumps.
2.
Valve position Normal flow path via indication i
RMCS remain available (closed to open i
for boration of RCS position change) coolant.
and flow indication (FI-183A) at con-trol board.
3.
If both flow paths f rom the boric acid l
storage tank are s
blocked due to i
A failure of i' solation valves (FV-110A and 1
~
HV-8104), borate (2000 ppm) from j
RWST is available i
opening isolation I
valve LV-1120 or l
LV-112E.
b.
Fails open, b.
Boron Concentration b.
Failure prevents the Control - reactor addition of a pre-I makeup control -
selected quantity of boration and auto concentrated boric
- makeup, acid solution at a preselected flow rate to the RCS coolant.
Boration is possible, l
80260:10/030685
+
APPENDIX A (Cont)
CVCS Operation Effect on System Component Failure Mode Function Doeration and Shutdown Additional Information**
however, the flow rate from the boric acid storage tank cannot be automatically controlled.
- 27. Boric acid a.
Fails to a.
Boron Concentration a.
Failure prevents re-transfer pump deliver Control - reactor dundancy of delivering Pump 1208-P6-006 working fluid.
makeup control -
is a solution to CVCS.
(Pump 1208-P6-007 boration and auto Alternate BA transfer similar) makeup.
pump may be used to provide necessary delivery of working fluid for CVCS system 2,
g, operation.
^2 6
- 28. Air diaphragm a.
Fails open for a.
Charging and Volume a.
Failure bypasses normal (perated three-flow only to Control - letdown down flow BRS recycle way valve LV-112A BRS recycle flow.
holdup tank resulting holdup tank.
in excessive use of RMCS.
- 29. Air diaphragm a.
Fails open.
- a. Charging and Volume a.
Failure prevents manual 1.
Valve is designed cperated globe Control - charging adjustment at CB of to fail open.
valve FV-121 flow and seal water charging flow from the flow.
centrifugal charging pumps. Speed control of positive displacement pump is not affected.
80260:1D/030685
APPENDIX A (Cont)
CVCS Operation Effect on System comornent Failure Mode Function Operation and shutdown Additional Information**
b.
Fails closed.
b.
Charging and Volume b.
Failure blocks normal Control - charging path for use of flow and seal water centrifugal charging flow.
pumps for charging and seal water flow.
Manual valve 151 or 152 can be open to allow flow from the i
corresponding pump. A path from the positive displacement pump would also still be available.
- 30. Manual Valve a.
Fails open.
a.
Charging and volume a.
Failure provides un-Emergency boration 183 control-emergency borated water flow flow indication boration line flush to centrifugal (YI-183), VCT f rom Reactor Water charging pump A level indication 3,
A, makeup suction.
(LI-ll2) and high level alarm at CB.
- 31. Demineralizer a.
Fails open.
a.
Normal Plant Opera-a.
Failure during resin' VCT level indication Discharge tion-open.
Resin flush with reactor (LI-ll2) and high Valves 65 Flush Operation-makeup water would level alarm at C8.
(63, 74, Closed.
provide unborated 259, 260, 261 water to charging 262, 263 analogous) pump suction.
~.
8026Q:lD/022285 l
APPENDIX A (Cont)
CVCS Operation Effect on System Comoonent Failure Mode Function Ooeration and Shutdown Additional Information**
- 32. Manual Valves 176 a.
Operator fails a.
Chemical addition a.
Operator error VCT level indication and 181.
to close.
make up water supply (failure to secure (LI-112) and high and discharge valves.
chemical addition) level alarm at CB.
provides unborated Flow orifice restricts water to charging dilution flow to 3.5 gpm pump suction.
or less.
- 33. Diaphragm Valve a.
Fails closed.
a.
Boric Acid supply to a.
Closure during make-BA flow deviation HV-B461.
transfer pumps up terminates borated alarm and total makeup during makeup.
water flow to CVCS.
flow deviation alarm.
- 34. Manual Valve 226
.a.
left open a.
Demineralizer a.
Reactor makeup water flushing would be admitted into BTRS lines NOTES:
9
- List of acronyms and abbreviations used:
BA
- Boric Acid BRS
- Boron Recycle System BTR
- Boron Thermal Regeneration BTRS
- Boron Thermal Regeneration System CB
- Control Board CNS
- Chemical and Volume Control System Demin.
- Demineralizer HX
- Heat Exchanger PRZ
- Pressurizer RC
- Residual Heat Removal System
~
- Refueling Water Storage Tank RMCS
- Reactor Makeup Control System VCT
- Volume Control Tank RHT
- Boron Recycle System Recycle Holdup Tank Additional Information supplied when failure is significant in boron dilution analysis.
t 1
-8026Q:lD/030885
T APPENDIX B RESPONSE TIME CALCULATIONS This appendix presents the derivation ~. of the equations and the parameters used in the calculations of rasponse times.
I.
Time to Criticality (T )
g A differential equation representing tfie rate of change of boron concentration is a mixing volume can be written as:
Y dc/dt = QC
~0 9' I in where:
V
= RCS volume (gallons)
C
= boron concentration in the RCS (ppm)
Cin = boron concentration of injected water (ppm)
Q
= dilution flow rate (gallons / minute)
Assuming that the injected water contains no boron (Cin = 0), Eq. I becomes:
dc/dt = -Q/V C Eq. 2 Integrating gives the following:
C = C, exp (-Q/V t)
Eq. 3 Where C, is the initial boron concentration. At time t '
c C = C, exp (-Q/V t )
Eq. 4 c
Where C is the critical boron concentration. Solving for t,
e e
t
/Q in (C,/C )
=
c c
8026Q:10/061885 8-1
II. Time to High Flux at Shutdown Alarm The time to this alarm is the time required to increase the neutron count to 3.16 times background. The neutron flux, and thus the count rate, is inversely proportional to K,ff.
If 9, is the neutron flux at t = o and K,ff(o) is the initial K,ff value.
9/6, = (1-K,ff(o))/(1-K,77)
Eq. 6 The following equation can also be written:
K,ff = 1 - (C-C )B Eq. 7 where B is boron worth. This is assuming that B is constant with respect to boron concentration, which is valid for relatively small changes in concentration (a few hundred ppm).
From Equations 6 and 7:
9/0, = ( C,-C ) / ( C - C )
- q. 8 c
c Substituting Eq. 3 into Eq. 8:
9/0, = ( C,-C ) / [ C, exp (-Qt/V) - C ]
Eq. 9 c
c Solving for the time of the high flux alarm (9/0, = (10)
T(HF) = - V/Q in [.3162 (1-C /C,) + C,/C, )
c 8026Q:1D/062085 B-2
III. Time to High VCT Level Alarm The VCT high level alarm sounds when 2167.1 gallons are in the VCT. Assuming that the VCT is operating at the low level setpoint an increase of 1366 s
gallons is required to obtain the alarm. This is conservative, since the VCT initial level would normally be well above the low level setpoint. With a dilution flowrate of Q gpm, the time to the high level alarm is:
t = 1366 / Q IV. Boron Dilution Parameters A detailed review of the CVCS system and associated procedures was performed and potential boron dilution events identified.
For each of these initiators the resulting dilution flow rate was calculated, and it was conservatively assumed that this entire dilution flowrate was supplied to the RCS.
Additionally conservative estimates of the effective volume of the RCS were calculated (e.g. - In modes 3 or 4 with one RCP running, no credit was taken for backflow through the idle RCS loops). The cycle 1 core characteristics of the core were reviewed and the limiting conditions of critical boron concentration and boron worth obtained for each mode. These calculations conservatively assumed beginning of life, Xenon free conditions with the most reactive control rod fully withdrawn.
Vogtle Electric Generating Unit has strict administrative controls to preclude the possibility of initiators 1, 2 and 4 in mode 5 when the pressurizer level is below the bottom of the indicated range. Therefore mode SB (RCS volume of 3435 ft ) was analyzed only for initiator number 3 (chemical addition). The parameters used in the boron dilution analysis are summarized in Table B-1.
V.
Results Table B-1 lists the parameters used to calculate the response times.
The critical boron concentrations were obtained from core physics calculations performed for a very similar reactor core. The critical boron concentrations used are for beginning of life Xenon free conditions and assume that the most reactive rod is fully withdrawn.
8026Q:10/061885 B-3
Table 8-2-shows tha results of th] resp:nsa time calculations. Tha table includes the time to alarm annunciation of the alarm which first warns of the boron dilution event. Greater than fifteen minutes is available between boron dilution annunciation and criticality for all cases.
t 8026Q:10/061885 8-4
TA8LE B-1 PARAMETERS Dilution Flowrates:
(Source - References 1 and 2)
Initiator Flowrate(com) 1 63 2
120 3
3.5
~
4 186 Volumes:
I. Source - Reference 1) 3 Mode Volume (ft 1 Volume foal) 3, 4 5840.0 43800 Sa (filled) 11200.9 84007 Sb (drained) 3435.0 25763 8oron Concentrations:
Mode C (ppm)
C,(ppm)
% SDM g
3, 4 720 870 2.0 5
971 1077 1.5 8026Q:10/062085 B-6
TABLE B-2 RESPONSE TIME CALCULATIONS 3
INITIATOR FLOWRATE MODE T'
T k)
-T c
HF a
HF c
1 63 3, 4 13 2 87 23(VL) 45 2
120 3, 4 69 46 12(VL) 23 3
3.5 3, 4 2368 1570 1570(HF) 798 4
186 3, 4 44.5 29.5
<1(FD) 15 1
63 5A 138 93 23(VL) 45 2
120 SA 73 49 12(VL) 24 3
3.5 SA 2487 1672 1672(HF) 815 4
186 SA 46.8 31.5
<1(FD) 15.3 3
3.5 5B 1463 983 983(HF) 480 Notes:
(1) Tc is the time to criticality in minutes (2) Ta is the time to the annunciation of an alarm which has appropriate procedures to terminate the dilution event.
"A" represents the alarm which is applicable for the specific dilution initiator:
FD = Boric Acid and Makeup Flow Deviation Alarms VI. - VCT high level alarm HF = High Flux at Shutdown Alarm (3) Dilution Flowrates into the CVCS system in gpm.
8026Q:10/062085 B-5
APPENDIX C DATA This appendix presents the component failure rates which were used in this study. Component failure rates are addressed first, followed by examp1e calculations of alarm reliabilities.
Component Failure Rates Component Failure Rate Source I
Level or Flow detectors 4.7 E-6 / hour NUREG/CR-2771 Air operated FCV fails open 1.5 E-6 / hour NUREG/CR-2770 I
Source range flux detector 5.0 E-6 / hour NUREG/CR-2771 I
Instrument signal conditioning system 7.5 E-6 / hour NUREG/CR-2771 Alarm bistable 8.2 E-7 / hour IEEE-500 Alarm annunciator fails to operate 1.0 E-6 / hour IEEE-500 Air operated valve fails to close 2.0 E-3 / demand NUREG/CR-1363 Notes:
(1) Includes both inoperability faults and reduced capability faults l
Example alarm reliability calculations:
Nigh Flux Alarm Reliability:
Failed detector:
5.0E-6 x 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> = 3.0 E-05 (1)
Failed signal conditioning system:
7.5E-6 x 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> = 4.7E-05 Alarm bistable failure: 8.2E-7 x 15 x 24 = 3.0E-04 (2)
Alarm failure: 1.0E-6 x 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> = 1.2E-05 (3)
Total HFA unavailability
= 3.9E-04 t
(
l i
80260:10/061885 C-1 b
i J
Notes:
(1) It was assumed that any detector or signal conditioning fault would be detected within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> either during the channel check or by comparison with the redundant detector indications.
No additional credit was taken for the redundant channel.
(2) Analog channel operational test performed monthly.
(3) Alarm annunciator tested daily.
Volume Control Tank Level Alarm Reliability; Failed detector: 4.7E-6 x 360 = 1.7 E-03 (1)
Failed signal conditioning system:
7.5E-6 x 360 = 2.7E-03 Maintenance unavailability:
1.2E-5 x 8760 x 100 / 8760 = 1.2E-3 Alarm bistable failure: 8.2E-7 x 180 x 24 = 3.5E-03 Total VCT level alarm unavailability: 9.1 E-03 Notes:
(1) Any detector or signal conditioning failure was assumed to be detected within 15 days,of the failure either by test or by comparison with the redundant detector.
(2) VCT level alarm bistable assumed tested annually.
(3) Assumed a mean time to repair of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br />.
8026Q:1D/061885 C-2
.