05000423/LER-1996-026, :on 960730,non-conservative Primary Grade Water Flow Rates Was Used in Boron Dilution Safety Analysis. Caused by Loss of Control of Tracking Appropriate Design Basis Calculations.Calculations Will Be Updated or Deleted

:on 960730,non-conservative Primary Grade Water Flow Rates Was Used in Boron Dilution Safety Analysis. Caused by Loss of Control of Tracking Appropriate Design Basis Calculations.Calculations Will Be Updated or Deleted

ML20134K997
Person / Time
Site:	Millstone
Issue date:	11/20/1996
From:	Laudenat R NORTHEAST NUCLEAR ENERGY CO.
To:
Shared Package
ML20134K986	List: 05000423/LER-1996-026, :on 960730,non-conservative Primary Grade Water Flow Rates Was Used in Boron Dilution Safety Analysis. Caused by Loss of Control of Tracking Appropriate Design Basis Calculations.Calculations Will Be Updated or Deleted 05000423/LER-1996-026-02, Forwards LER 96-026-02 Which Documents Condition That Was Determined at Plant,Unit 3 on 960730
References
LER-96-026, LER-96-26, NUDOCS 9611200118
Download: ML20134K997 (6)

LER-1996-026, on 960730,non-conservative Primary Grade Water Flow Rates Was Used in Boron Dilution Safety Analysis. Caused by Loss of Control of Tracking Appropriate Design Basis Calculations.Calculations Will Be Updated or Deleted

Event date:
Report date:
Reporting criterion:	10 CFR 50.73(a)(2)(iii) 10 CFR 50.73(a)(2)(v), Loss of Safety Function 10 CFR 50.73(a)(2)(ii)(B), Unanalyzed Condition
4231996026R00 - NRC Website

text

..

t NRC FORM 366 U.s. WUCLEAR REGULATORY COMMisslON APPROVED BY oM6 NO. 3150-0104 j

(0 95)

EXPIRES 04/30/98 l

fN O OL E T"K REO EST?50 IO RS E

D 0

s'[c"['So'"do$rR"YMOR[ARD 70 "RGkNG R

L!CENSEE EVENT REPORT (LER) l5"du'? TucttinYoTt&"482$ "s'o"e '"We^n"&

s

!Ec'SU20osEIn"'lNo"e"E8E"r" "'*EI87"oA."f8Ss$'"

4 (See reverse for required nurnber of digits / characters for each block)

FACGfrY NAME (1)

DOCKET NUMBER (2)

PAGE (3)

Millstone Nuclear Power Station Unit 3 05000423 1 of 7 TITLE (4)

Non-conservative Primary Grade Water Flow Rates Used in Boron Dilution Safety Analysis 1

EVENT DATE (5)

LER NUMBER (6)

REPORT DATE (7) oTHER FACILITIES INVOLVED (8)

MONTH DAY YEAR YEAR SEQUENTIAL REvlsloN MONTH DAY YEAR FACluTY NAME DOCKET NUMBER NUMBER 07 30 96 96 026 02 11 20 96 I

OPERATING THis REPORT is SUBMITTED PURSUANT To THE REQUIREMENTS oF 10 CFR 5: (Check one or more) (11)

MODE m 5

20.2201(b) 20.2203(a)(2)(v)

So.73(a)(2)(i)

So.73(a)(2)(viii)

POWER 20.2203(a)(1) 20.2203(a)(3)(n So.73(a)(2)(ii)

So.73(a)(2)(x)

LEVEL (10) 000 20.2203(a)(2 Hit 20.2203(a)(3)(ii) 50.73(a)(2)(iii)-

73.71

<x 20.2203(a)(2)(ii) 20.2203(a)(4)

So.73(a)(2)(iv>

X oTHER

""""+s" "

" " ' """ g+. ""~.20.2203(a)(2)(iii)

So.36(C)(1) 50.73(a)(2)(v) specify in Abstract below my?

or in NRC Form 366A s

LICENSEE CONTACT FOR THis LER (12) j EME TELEPHONE NUMBER linclude Area Codel R. T. Laudenat, Nuclear Licensing Supervisor (860)444-5248 J

COMPLETE ONE LINE FOR EACH COMPONENT FAILURE DESCRIBED IN THIS REPORT (13)

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE

CAUSE

SYSTEM COMPONENT MANUFACTURER REPORTABLE TO NPROS TO NPROS SUPPLEMENTAL REPORT EXPECTED (14)

EXPECTED MONTH DAY YEAR SUBMISsloN f

]

(if yes, complete EXPECTED submission DATE).

YES No ABSTRACT (Limit to 1400 spaces, i.e., approximately 15 single-spaced typewritten lines) (16) 1 On July 30,1996 with the unit in mode 5 of an extended cold shutdown, it was determined that the maximum Primary Grade Water System (PGS) flow rate to the charging pumps assumed in the boron dilution safety analysis contained within Chapter 15 of the Unit's Final Safety Analysis Report (FSAR) may not have been conservative.

The use of potentially non-conservative values was the result of modifications to the normal dilution pathway and inadequate review and assessment of the impact on the Boron Dilution event analysis during the design control process. Therefore, this event was reported on August 29,1996 pursuant to 10CFR50.73(a)(2)(ii)(B) as a condition outside the design basis of the unit.

The valves used to isolate the dilution pathways are currently administratively tagged closed for Technical Specification 4.1.1.2.2. Therefore, there is no safety significance associated with the present condition while the plant is maintained in Mode 5.

A detailed analysis was performed to determine the maximum system flows. Based on the results of this analysis the plant did not operate outside its design basis or in an unanalyzed condition. The programmatic conditions which initiated this event were investigated and-are identified along with appropriate corrective actions.

The FSAR will be updated to clarify the design basis dilution flow paths and the major assumptions of the boron dilution event. The justification for excluding deliberate dilutions will be added to the FSAR.

9611200118 961115 PDR ADOCK 05000423 S

PDR

,U.s. NUCLEAR REGULATORY Commission (4-95)

UCENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL Revision Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 2 of 7 96 026 02 TEXT (If more space is required, use additional copies of NRC Form 366A) (11) 1.

Description of Event

=

On July 30,1996 with the unit in mode 5 of an extended cold shutdown, it was determined that the maximum Primary Grade Water System (PGS) flow rate to the charging pumps used in the boron dilution safety analysis contained in Chapter 15 of the Unit's Final Safety Analysis Report (FSAR) was in error. The flow rate value utilized in the boron dilution safety analysis was non-conservative. Therefore, this event was reported on August 29,1996 pursuant to 10CFR50.73(a)(2)(ii)(B) as a condition outside the design basis of the unit.

The original plant design calculation utilized 147 gpm as the maximum possible PGS flow rate. This flow rate was achieved via the emergency boration pathway. A calculation was performed in December 1983, to determine the maximum potential unborated water flow rate to the Reactor Coolant System (RCS) via the Chemical and Volume Control System (CVCS) for use in the boron dilution analysis. This calculation determined that the maximum possible PGS flow rate for two PGS pumps was 130 gpm.

A plant design change completed April 16,1986 replaced a check valve in the normal dilution pathway with one of a different size and type because of the inability to attain the design flow (120 gpm). This problem occurred during initial startup testing when using the normal dilution flow path. In addition, a procedure change was implemented at that time to allow the use of the attemate dilution pathway whenever make up of greater than 115 gpm was required.

The calculation performed in support of this design change indicated that the modification lowered the flow resistance in this pathway. The supporting calculation determined that maximum boron dilution flow for this pathway, using one pump, would be 138 gpm.

Currently the boron dilution analysis contained within Chapter 15 of the unit's FSAR is based in a Westinghouse calculation (FSE/SS-NEU 1481, " Millstone Unit 3 Boron Dilution Input," dated 7/30/90). This calculation uses the one PGS pump case with the normal make-up path it provides a maximum PGS flow of 150 gpm upon which the boron dilution analysis was based.

On July 1,1996, during the performance of system reviews plant personnel identified this discrepancy in boron dilution flow rates between the normal dilution pathway and the emergency boration pathway. During the resolution of this discrepancy, it was also determined that a potentially higher flow pathway existed. This pathway, the attemate dilution pathway, would be capable of providing greater PGS flow than had previously been considered. This pathway had not been evaluated during the boron dilution analysis. Additionally, because of several modifications to the dilution pathway, including the change out of a check valve (which decreased the path's resistance to flow) and reduction in the orifice diameter for a flow instrument (which increased the path's resistance), the actual value for the maximum dilution flow for both the one and two pump cases was uncertain. A detailed analysis was undertaken to determine the maximum system flows. This analysis was reported within the previous License Event Report (LER) supplement, submitted on October 11,1996, as having been completed. A subsequent document verification determined that at the time the LER was submitted the calculation had been prepared and was being reviewed. The calculation was approved by management on October 21,1996. The approved calculation did not change the results of the analysis nor the earlier conclusions. Based on the results of this analysis the plant did not operate outside its d: sign basis or in an unanalyzed condition.

The valves used to isolate the dilution pathways are currently administratively tagged closed for Technical Specification 4.1.1.2.2. Therefore, there is no safety significance associated with the present condition while the plant is maintained in Mode 5.

- NRC FORM 366A U.S. NUCLEAR REGULATORY CoMMisSloN W95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REVislON Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 3 of 7 96 026 02 TEXT (If more space is required, use additional copies of NRC Form 366A) (17)

11. Cause of Event

As a result of procedure changes and plant modifications to the normal dilution pathway, the flow path required to be utilized in the boron dilution safety analysis changed. This invalidated the previous boron dilution safety analysis calculations. Additionally, no calculations were performed for this pathway utilizing the two PGS pump case. In addition, the most conservative boron dilution path (altemate dilution mode flow path) was not used in the boron dilution analysis. Furthermore, because of several modifications to the dilution path, including the change out of a ch ck valve (which decreased the path's resistance to flow) and the reduction in orifice diameter for a flow instrument (which increased the path's resistance), the actual value for the maximum dilution flow in the one and two pump cases is not certain. Contributing to this situation was an incomplete description of the applicable dilution paths relative to th3 unit's design basis within Chapter 15 of the Final Safety Analysis Report (FSAR).

These conditions arose as a result of review and assessment inadequacies that occurred over several years. The programmatic deficiencies which led to this event include:

Loss of control of tracking appropriate design basis calculations.

Change in the methodology of analysis of the boron dilution event.

insufficient evaluation of the impact of plant changes on the boron dilution event.

e Errors in the FSAR description of the boron dilution event.

Lack of tracking of cumulative plant changes on the boron dilution path.

e The erroneous reporting of the completion of the analysis undertaken to determine the maximum system flows was ths result of an failure of supervision and management to verify the accuracy of the information contained within the license event report prior to submittal.

111. Analysis of Event Boron dilution is a Chapter 15 analyzed Design Basis Event. The boron dilution analysis is performed for Northeast Nuclear Energy Co. by Westinghouse Electric Corp. The accident scenario considered is the inadvertent opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure.

The addition of unborated water to the RCS would result in a positive reactivity insertion and a reduction of available shutdown margin. For at power operation and start-up conditions, the dilution accident reduces the shutdown margin.

For shutdown modes, the dilution accident reduces the total negative reactivity inherent in the borated RCS inventory and thereby reduces the shutdown margin which would normally be available.

The most probable limiting dilution event analyzed is the mis-operation of the CVCS system. The specific scenario id;ntified is the inadvertent operation of the primary makeup control valve (FCV-111 A) and failure of the blend system

(:ither by controller or mechanical failure). This failure permits the primary makeup water system to injc';t directly to the charging pump suction (at the Volume Control Tank outlet) without being blended with boric acid at the maximum rate permitted by the piping system. The limiti'1g dilution flow rate for this scenario has been determined to be 150 gpm for all modes of plant operation except Mode 1-automatic. The limiting dilution flow rate for Mode 1-automatic has been determined to be 120 gpm. For conservatism, all analyses for the bo,on dilution event assumed the limiting c1se flow rate of 150 gpm dilution flow. An analysis is not performed for an uncontrolled boron dilution accident

• NRC FORM 366A U s. NUCLEAR REGULATORY Commission (4-95)

UCENSEE EVENT REPORT (LER)

TEXT CONTINUATION

~ FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REVISION Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 4 of 7 96 026 02 TEXT filmore space is required, use additional copies of NRC Form 366A) (11) during refueling. In this mode (mode 6), the event is prevented by administrative procedures which isolate all potentially unborated water paths to the CVCS. This precludes the addition of unborated water to the reactor vessel via CVCS.

While performing the system review it was discovered that a potentially more conservative flow path (i.e. one producing greater flow rate), the alternate dilute flow path, was not analyzed in the boron dilution analysis. This scenario also assumes identical failure modes as previously analyzed but while operating the CVCS system in an alt: mate dilute mode. While in the altemate dilute mode, the flow is provided to the top of the Volume Control Tank (VCT) via the VCT spray nozzle while simultaneously being provided to the suction side of the charging pumps, th:reby bypassing the VCT. These two flow paths are in parallel such that all fluid eventually winds up in the suction side of the charging pumps. Because the flow path in operation has changed, the previously calculated flow for two PGS pumps calculation would no longer be valid. Thus, operation of two PGS pumps could potentially place the plant in a condition outside of the Design Basis condition for the unit (i.e. two PGS pump flow rate may be in excess of 150 gpm). Although the potential exists for exceeding this dilution flow rate assumption, review of the CVCS flow control system indicates that total make-up flow deviation circuit (non-safety grade) most likely would have performed its function and terminated any dilution event within 30 seconds of initiation.

Subsequent investigation has revealed that the current Westinghouse standard practice for boron dilution safety analysis is to consider only " inadvertent dilutions". Tous neither the normal dilution nor attemate dilution pathways are included in the analysis. The justification for excluding " deliberate dilutions" from the analysis is that during intentional boron dilution operations, the plant operators are keenly aware of, and continuously monitor, the dilution process in progress for any sign of deviation or malfunction, such that the possibility of an undetected malfunction is considered remote.

Conversely, during automatic makeup mode of operation, high concentration boric acid solution is normally blended with unborated makeup water to provide a solution matching the prevailing RCS boron concentration. This blended solution is delivered into the charging pump suction at the VCT outlet. In this mode, the CVCS malfunction is defined as the failure of the blender system to provide concentrated boric acid, while the primary water flow control valve simultaneously goes to the fully open position. As a consequence, the RCS is inadvertently and unintentionally diluted. This comes at a time when the operator expects the RCS boron concentration to remain the same or to increase. Thus this operating mode forms the basis for calculating the limiting boron dilution analysis flow rates.

A calculation completed on October 21,1996 showed that for the borate / blend pathway (the boron dilution path of l

r: cord for the boron dilution analysis) the flow delivered to the suction side of the charging pumps with one PGS pump running is 132.1 gpm and with two PGS pumps running is 142 gpm. This is below the analyzed boron dilution limit of 150 gpm. Thus, while it was believed at the time of reporting of this event that the plant may have operated in an unanalyzed condition (the two PGS pumps case was not covered in the availab!e calculations or the boron dilution (nalysis), the most recent calculation shows that it was not the case. The calculation shows that even with the two PGS pumps operating, the makeup flow rate at delivered to the charging pumps is below the 150 gpm analyzed boron j

dilutio.1 limiting flow rate.

IV. Corrective Action

The corrective action for the resolution of this issue includes a detailed calculation, using the appropriate limiting flow path and accounting for any modifications that have occurred within that path, for both the one PGS pump case and the two PGS pump case. The calculation was performed and determined that boron dilution flow rate with one PGS pump is 132.1 gpm and with two PGS pumps running the flow rate is 142 gpm. Both cases show that the resulting

' NRC FORM 366A U.S. NUCLEAR REGULATORY CoMMISsloN 16 95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL Revision Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 5 of 7 96 026 02 TEXT (11more space is required, use additional copies of NRC Form 366A) (11) flow rate is below the 150 gpm boron dilution limit. Thus the results of the calculation show that the plant did not operate outside its design basis.

In addition, Westinghouse and unit personnel evaluated the technical basis for use of the attemate dilute mode pathway as the limiting case for the boron dilution analysis. The results of the evaluation show that the boron dilution analysis of record did not consider the alternate dilute path or the normal dilute path because both paths are used only during deliberate plant dilution operations and deliberate dilutions are excluded from the boron dilution analysis. This is standard practice for boron dilution analysis of the FSAR Chapter 15 event. During deliberate dilutions the operators manually control dilution and have means of monitoring it so that any deviations from the expected values are identified and corrective steps are taken by the operators:

The FSAR will be updated to clarify the design basis dilution flow paths and the major assumptions of the boron dilution event. The justification for excluding deliberate dilutions will be added to the FSAR.

The calculations (for the boron dilution event) will be updated or deleted as applicable and entered into Calculation tracking database.

The programmatic conditions which allowed this event to occur were investigated and have been identified along with appropriate corrective actions. These are listed as follows:

Superseded calculations were not identified as no longer applicable e

Corrective action

Superseded calculations are currently identified on new calculation cover sheets and are further tracked as related calculations on a Calculation Tracking Program database via page two of the new calculation.

Inconsistent assumptions were used in the calculations which tried to address boron dilution flow rates.

Corrective action

The FSAR will be updated to reflect the proper assumptions, limiting fP.nypaths and number of pumps which are allowed to operate for the analyzed boro e dilution event.

In addition the calculation of record has been revised to reflect the la est applicable flow rates for the boron dilution event incorporating applicable plant c.'anges to the i

boron dilution flowpath and restating the appropriate boron dilution analysis assumptions.

The implementation of a modification of the boron dilution flowpath (via change out of a check valve to a different size and type) was not evaluated in terms of its impact on the boron dilution analysis. Specifically the 50.59 safety evaluation did not evaluate this change's impact on the boron dilution event.

Corrective action

The latest Design Control Manual Rev. 03 and related Nuclear Group Procedures for safety evaluations provide additional guidance for considering the impact of modifications on FSAR Chapter 15 Design Basis Events during the design change process. The use of an integrated Safety Evaluation was implemented after this modification was done. The use of an Integrated Safety Evaluation is an additional barrier present today which is designed to prevent this type of error from occurring.

" NRC FORM 36fA U.s. NUCLEAR REGULATORY Commission I4 95)

LICENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REVISloN Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 6 of 7 96 026 02 TEXT lif more space is required, use additional copies of NRC Form 366A) t17) i A change in the methodology for the analysis of the boron dilution event occurred. Prior to 1988 the boron e

dilution event was done in a Probabilistic Risk Assessment (PRA) type of assessment which included all j

possible boration paths evaluated as a statistical probability of that path being utilized a certain amount of time. The assumptions used in the most recent boron dilution analyses were generalin nature. Thus it was not clear as to which boron dilution flow path to use as the limiting case and what specific assumptions to i

apply.

Corrective action

In 1989, Westinghouse issued Safety Analysis Standard 4 which identified the methodology and regulatory acceptance criteria associated with the licensing basis Boron dilution accident for a plant specific FSAR or other licensing documentation. In 1990 the Boron Dilution using the methodology defined in Standard 4 was performed.

The FSAR Chapter 15 Boron Dilution Event description was changed to reflect the I

standard methodology and assumptions. Standardizing the methodology and assumptions will permit the application of consistent methodology and assumptions in any future re-analysis of the boron dilution event which might occur as the result of plant modifications or other changes.

In response to the erroneous reporting of the completion of the analysis undertaken to determine the maximum system flows the individuals involved were counseled by their supervision. Additionally, validation of factual 3

statements contained within docket submittals has been instituted within the management review process.

V.

Additional Information

Similar Events LER 96-009-00: InoDerable Shutdown Marain Monitors from Low Count Rate. Due to inadeauate Desian Control This event was attributed to an inadequate design control program. During the initial design of the SMM system, the analytical setpoint was determined to be less than or equal to a value of 2. As installed in 1991, the SMMs were conservatively set at 1.5 to account for time delays associated with low count rate operation per the vendor technical manual. A setpoint calculation specifying the minimum t,hutdown margin monitor count rate necessary for operability was not performed when the system was originally installed. This calculation was required to ensure that the hardware used to mitigate a boron dilution event met the requirements of the analysis. The lack of the minimum count rate calculation allowed the possibility for the plant to be in Mode 5 with a SMM count rate that was too low for operability of the system. The assumed accident analysis shutdown margin derived from RCS boron concentration was too low and may not have allowed the required 15 minute response time for the operator to mitigate the event with the SMM alarm setpoint set at 1.5 times the present steady state count rate.

Design Control was identified within the corrective actions as an area in which improvements had occurred in recent years. The implementation of the Design Control Manual, and the training and improvements made in the use and control of vendor services since that time were credited towards preventing future recurrences of this event.

NRC FORM 386A (4 95)

_m

_._,m_.__..

-._..m e

• NRC FORM 366A U.S. NUCLEAR REGULATORY COMMISSION (4-95)

UCENSEE EVENT REPORT (LER)

TEXT CONTINUATION FACILITY NAME (1)

DOCKET NUMBER (2)

LER NUMBER (6)

PAGE (3)

YEAR SEQUENTIAL REVISION Millstone Nuclear Power Station Unit 3 05000423 NUMBER NUMBER 7 of 7 96 026 02 TEXT (11more space is equired, use additionalcopies of NRC Form 366A) til) l Manufacturer Data i

None l

I i

l l

1 3

d,