ML20154P426

From kanterella
Jump to navigation Jump to search

Cse License Annex,Pelleting
ML20154P426
Person / Time
Site: Westinghouse
Issue date: 10/16/1998
From:
WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML20154N452 List:
References
NUDOCS 9810220322
Download: ML20154P426 (76)


Text

_.

i 4

J 1

l CSE LICENSE ANNEX PELLETING i

1 l

l l

a-9810220322 981016 i

PDR ADOCK 07001151 C

PDR

]

1

CSE LICENSE ANNEX PELLETING TABLE OF CONTENTS TABLE OFCONTENTS i

REVISIONRECORD ll Process Summary 1

Environmental Protection and Radiation Safety Controls 15 Nuclear Criticality Safety (NCS) Controls And Fault Trees 15 Chemical Safety and Fire Safety Controls 73 l

l Initial Issue Date:

16 OCT 98 Page No.

i j

Revision Date:

Revision No.

0 J

CSE LICENSE ANNEX PELLETING REVISION RECORD REVISION DATE OF PAGES REVISION NUMBER.

REVISION REVISED RECORD Initial Issue Date:

16 OCT 98 Page No.

ii

. Revision Date:

Revision No.

O

l CSE LICENSE ANNEX i

PELLETING 1

Process Summary This document describes the normal operation of the ADU Pellet Area process for fabricating l

uranium dioxide fuel pellets from ceramic grade uranium oxide powders and includes all j

auxiliary operations.

The pellet fabrication process consists of five basic operations - pressfeed preparation, pellet pressing, pellet sintering, pellet grinding and inspection, and scrap processing.

PRESSFEED PREPARATION Uranium oxide powders, both UO and U 0s, are delivered to the Pellet Area from the ADU 2

3 Conversion Area as a blended product that meets the acceptance criteria of the powder product specification MA-PWUOOO (NFP 31036), Uranium Oxide Powder.

The UO2 Powder is delivered in bulk blending containers,1750 kg UO maximum, or 8 inch diameter polypaks, 2

approximately 10 kg UO each, on powder carts. The U 0, is delivered in 8 inch diameter 2

3 polypaks, approximately 10 kg U 0, each, on powder carts.

3 In addition, U 0, is generated in the Pellet Area in the scrap processing operation. The U 0, 3

3 is packaged in 8 inch diameter polypaks and stored on powder carts or stationary racks in the Pellet Area.

Green scrap powder and pellets are also generated in the Pellet Area. The green scrap materials are packaged in 8 inch diameter polypaks and stored on powder carts or stationary racks in the Pellet Area.

POWDER MIXING AUTOMATED POWDER MIXING UO2 Powder is delivered to the Pellet Line from the Bulk Blending Area in the bulk blending container with a powder feeder assembly attached. The bulk blending container is placed in the MODCON room on top of the UO vibratory feeder equipped with an inflatable seal. The 2

inflatable seal is inflated to make contact with the bulk container to prevent spillage of powder into the MODCON room Initial Issue Date:

16 OCT 98 Page No.

1 Revision Date:

Revision No.

O

A powder batch is prepared by mixing UO with U 0, recycle and green scrap recycle. A 2

3 Process Information Form (PIF) issued by Process Engineering specifies the processing parameters for the blend of UO powder. The UO weight, weight percent U 0,, and weight 2

2 3

percent green scrap recycle specified on the blend PIF are programmed into the automated powder mixing system PLC by the Process Operator. The automated powder mixing system is started by the Process Operator. UO powder is fed from the bulk blending container into the 2

batch weighing hopper. When the correct UO weight is obtained the UO stops feeding. The 2

2 PLC calculates the weight of the first recycle material based on the weight percentage programmed into the PLC and the actual weight of the UO in the weighing hopper. The first 2

recycle feeder feeds the recycle into the weighing -hopper until the calculated weight is reached. The process repeats for each programmed weight percent recycle until the batch of UO and recycle materials is made. The valve in the bottom of the weighing hopper opens and 2

dumps the batch into the powder mixing blender. The mixing cycle starts when the weighing hopper valve closes. When mixing is completed the valve on the bottom of the blender opens while the mixer is operating. The mixed materials are emptied out of the blender into the powder lift pan underneath. The mixed batch of UO and recycle material in the powder lift 2

pan is raised by the powder lift elevator pre-compactor feed hopper and the. empty pan i

returned to the powder mixing hood, A level probe in the pre-compactor hopper controls the maximum amount of mixed material allowed in the hopper. This process step will not initiate j

unless there is no material detected at the level probe.

This operation will repeat I

automatically, the normal mode of operation, or on request by the Process Operator, in the manual operation mode, when the emptied powder lift pan returns and is positioned under the blender. When in the automatic operational mode, the powder batching, mixing, and delivery to the pre-compactor hopper will repeat automatically until powder is detected by the powder level probe in the pre-compactor hopper. The process will stop and hold until the powder level in the pre-compactor hopper is below the powder level probe. This process sequence is controlled by the PLC.

1 Ventilation of the MODCON room for the bulk container, recycle hood, powder mixing hood, and powder lift elevator is provided by a dust collector.

The Process Operator is required to routinely visually check the MODCON room powder collection system, green scrap recycle mill hood, recycle feeders and top and bottom interior of the powder lift elevator enclosure for powder leaks and/or accumulations. The checks are documented on a controlled form.

. Three active engineered safety significant controls (interlocks) exists in the MODCON room containing the bulk blending container to prevent and/or detect powder spills. A low seal

~

pressure on the inflatable seal between the UO feeder and the bulk container is interlocked via 2

a pressure switch to stop the feeder on the bulk blending container, close the valve in the bulk container feeder, stop the UO feeder, and sound an audible alarm. The same interlock actions 2

occur if a powder leak / spill is detected via powder accumulation in a collection container with I

a level probe located below the MODCON room. The third interlock action prevents the F

- Initial Issue Date:

16 OCT 98 Page No.

2 Revision Date:

Revision No.

0

- inflatable seal from inflating unless the bulk container is in position on top of the UO feeder, 2

preventing damage to the seal during bulk container handling.

Two active engineered safety significant controls (interlocks) exist in the powder lift elevator to detect powder spills. Two powder detection level probes are located in the bottom of the

' powder lift elevator. A high powder level in the bottom of the elevato, detected by either probe, is interlocked to stop the operation of the powder lift elevator.

MANUAL POWDER MIXING A manual mixing operation is sometime used on the Pellet Lines when the UO powder is 2

supplied in polypaks. The manual mixing operation is performed in the powder mixing hood l

of the pressfeed preparation area.

UO Powder is supplied to the Pellet Line from the Blending Area in 8 inch diameter 2

polypaks. The polypaks are delivered on powder carts.

' A powder batch is prepared by mixing UO with U 0, recycle and green scrap recycle in the 2

3

powder mixing hood. A Process Information Form (PIF) issued by Process Engineering specifies the' processing parameters for the blend of UO2 Powder. One polypak of UO2 powder is transferred into the hood and the powder, approximately 10 kg, is dumped into the

. powder lift pan. A volumetric scoop is used to added the correct amount of U 0, and green 3

scrap recycles to the UO. ' The batch of material is mixed manually. The powder lift pan is 2

repositioned in the powder lift elevator. A minimum 12 inch spacing is maintained between containers'of material in the powder mixing hood.

The Process Operator initiates the powder lift elevator to raise the mixed batch to the pre-compactor hopper, The mixed batch is dumped into the pre-compactor hopper and the empty pan returned to the powder mixing hood. A level probe in the pre-compactor hopper controls the maximum amount of mixed material allowed in the hopper. This process step will not initiate unless there is no material detected at the level probe. The operation of the powder lift elevator is controlled by a PLC.

This operation is repeated as required by the Process Operator.

Ventilation of the powder mixing hood and powder lift elevator is provided by a dust collector.

The Process Operator is required to routinely visually check the top and bottom interior of the powder lift elevator enclosure for powder leaks and accumulations.

The checks are documented on a controlled form.

Two safety significant controls (interlocks) exist in the powder lift elevator to detect powder spills. Two powder detection level probes are located in the bottom of the powder lift 4-J Initial Issue Date:

16 OCT 98 Page No.

3 Revision Date:

Revision No.

0

elevator. A lugh powder level in the bottom of the elevator, detected by either probe, is interlocked tc. stop the operation of the powder lift elevator.

PRE-COMPACTION - GRANULATION - PRESSING LUBRICANT ADDITION i

All of the Pellet Lines are equipped with a similar pre-compaction / granulation / pressing lubricant addition system. The pre-compaction and granulation part of the system is controlled by a PLC.

The' mixed UO2 Powder and recycle materials are fed from the pre-compactor hopper by a vibratory feeder and drop by gravity into the pre-compactor. The compacted product drops by i

gravity into the granulator located in the roll mixing. The granulator consists of a serie: ef rotating bars adjacent to a screen. The compacted product from the pre-compactor is forced i

through the granulator screen by the wiping action of the rotating bars. The resulting product from the granulator is granules. Granules drop by gravity from the granulator into a 9.5" diameter collection polypak. The collection polypak is positioned on a weight trip platform.

When the weight trip limit is reached, the PLC stops the operation of the roll compactor hopper vibratory feeder, pre-compactor,' and granulator. The Process Operator removes the filled polypak of granules and installs an empty polypak on the weight trip platform.

A pressing lubricant is added to and dispersed in the batch of granules in the 9.5 inch diameter polypak in the roll mixing hood. A lid is placed on the polypak and sealed with tape. The polypak is rolled to disperse the lubricant in the granules. When the roll mixing is completed, the polypak is opened and the granules are dumped into the pellet press feed hopper, the top of the hopper being at the floor level of the roll mixing hood.

This process is repeated as required by the Process Operator.

Ventilation of the pre-compactor, granulator, and roll mixing hood is provided by a dust' collector.

The Process Operator is required to routinely visually check the area around the pre-compactor for powder leaks and accumulations and for compacted powder accumulation in the granulator feed hopper. The checks are documented on a controlled form.

The granulator feed hopper has a safe geometry by virtue of an installed volume limiter box inside the hopper.

A batch counter program in the automated powder mixing system PLC monitors and controls the number of batches inputted to the pre-compactor hopper and removed from below the p

granulator. Each time a batch is inputted to the pre-compactor hopper the batch counter adds l

one count, and each time a batch is removed from the weight trip platform below the granulator the batch counter subtracts one count. If the batch count difference equals the maximum allow count, the powder lift elevator operation will stop. This is an indication of Initial Issue Date:

16 OCT 98 Page No.

4 Revision Date:

Revision No.

0 l

l

~

_.___m ll L

L possible accumulation of compacted powder in the granulator feed hopper. The Process Operator checks for actual accumulation, cleans out the accumulation if present, corrects the cause of the accumulation, and resets the batch counter to zero. If no accumulation is present, the Process Operator will run the pre-compactor and granulator empty and reset the batch

. counter to zero.

PELLET PRESSING The pellet pressing operation consist of forming a green (unsintered) pellet with required

.: physical dimensions and loading the green pellets into the molybdenum (moly) sintering boats

('

for the sintering operation.

The batches of pressfeed (the UO, recycle materials, and pressing lubricant produced by the 2

pressfeed preparation. operation) are dumped into the pellet press feed hopper for delivery to the pellet press dies. The green pellets are formed in the dies filled with pressfeed when the top and bottom punches apply pressure to the pressfeed.

l-The green pellets are loaded into the moly sintering boats either with a vacuum head boat i

loader or manually.

l PELLET PRESS i

The pellet press is a rotary press. A central lubrication system supplies lubricating oils to the press to prevent wear and' damage to the moving parts. The spent lubricating oils, containing i

very.small amounts of SNM, drain to the oil sump in the bottom of the press. The oil sump is approximately 10 inches x.20 inches x 5.5 inches. In the event the oil sump overfills, the overflow will be collected in a metal pan under the pellet press that is approximately 1 inch

~ deep.

Pressfeed for pressing pellets is contained in the pellet press hopper. The hopper is 9 inches in diameter and can hold up to 90 kg of pressfeed. On the bottom of the hopper is a vibratory feed shoe to meter out the pressfeed into the feed frame resting on the rotating pellet press j

table where the dies are located. The purpose of the feed frame is to delivet pressfeed into the dies as they rotate below a bed of pressfeed. The feed frame is curved to match the pellet press table curvature and maintains a bed of pressfeed approximately 3 inches x 14 inches x 0.75 inches deep on the press table. An overflow stream of pressfeed, approximately 0.75 l-inches x 0.5 inch high, from the feed frame rotates around the inside of the press table and re-L enters the feed frame on the other end.

l The green pellets are pushed out of the die by the bottom punch and removed from the press L

' table by the pellet wipe off bar. The green pellets are delivered to a belt conveyor for delivery L

to the boat loader or collected on a platform for removal by the Process Operator for manual loading of the boats o

I t

(~

Initial Issue Date:

16 OCT 98 Page No.

5 Revision Date:

Revision No.

0 l

l:

p l

l The green pellets are right circular cylinders that range in size from approximately 0.4 inches long x 0.3 inches in diameter to 0.7. inches long x 0.5 inches in diameter, weighing 5 - 10 gm.

j The area of the pellet press where the pellets are being pressed and transferred to the boat r

loader or manually loaded into moly boats is contained in a hood. The hood is ventilated by a l

dust collector. There is some leakage of pressfeed from the press table and from around the 1

l'

' bottom punches in the dies. The material will accumulate in the hood and pellet press enclosure. Green pellets may also be knocked over and fall off the press table and accumulate in the hood.

The Process Operator is required to clean out pressfeed and green pellet accumulations in the pellet press hood at the end of each shift of operation.

The oil sump is drained once per week by Maintenance personnel. The Process Operator-checks for oil-powder sludge accumulation in the sump once p::r week. An oil-powder sludge accumulation over 0.5 inch deep is cleaned out and a sample submitted to the Chem Lab for

%U analysis. The checks and clean out are documented on a controlled form.

l l

BOAT LOADER l

The green pellets from the pellet press are delivered to the vacuum head boat loader by a belt conveyor. A layer of pellets to be loaded in the moly sintering boat is made up. When a complete layer is made it is placed into the moly sintering. The process repeats for the next l

layer of pellets. Any pellets and pellet chips left will be swept off into a collection pan under i

the table.

Other pellets will fall down into the boat loader and collect in a collection tray surrounding the top of the moly boat.

When the boat is full, as determined by the number of layers in the boat, the boat will be ejected onto the moly boat roller conveyor for delivery to the. sintering furnaces. An empty moly boat will be moved into position for loading.

l The pellets are loaded into the moly boats to a height of approximately 4 inches. The weight in the boat is approximately 11.5 kg.

l

' The operation of the pellet press, belt conveyor, and boat loader are controlled by a programmable logic computer (PLC).

The belt conveyor and boat loader are contained in hoods. The hoods are ventilated by a dust collector.

L The Process _ Operator is required to clean out pellets and pellet chips from the collection pan l

under the boat loader table, the collection tray around the top of the moly boat, and the l

collection polypak for the " flash" removal vacuum once per shift.

1 i

InitialIssue Date:

16 OCT 98 Page No.

6 Revision Date:'

Revision No.

0 l-

m

~

l:

I MANUAL BOAT LOADING The loading process is performed in the pellet press hood. An empty moly boat is placed in the hood undu the platform where the pellets are collected off of the pellet press table. The Process Operatoi -akes the pellets off into their hand and places the pellets in the moly boat.

l=

The boat is loaded to the top edge and is leveled off at that height.

L PELLET SINTERING Green (unsintered) pellets are delivered to the sintering operation in molybdenum-(moly)-

sintering boats. The weight of pellets in a moly boat is approximately 11.5 kg. The moly i

. boats are transported to the sintering furnaces on a roller conveyor system, one layer high.

The sintering furnaces are pusher type furnaces.

They are electrically heated.

The atmosphere gases are: 1) nitrogen for purging air out of the furnace during start up, the safety backup gas in the event of a power failure, and as the second gas when the furnace is operating in the mixed gas hyJrogen and nitrogen mode and 2) hydrogen for operating at 100% hydrogen. Natural gas is used as the pilot light at the furnace doors and burn off stacks to insure that the hydrogen exiting the furnace from the doors and burn off stacks is ignited and burns. Cooling water is required on the furnace heating element connections and the

{

cooling chamber section of the furnace.

i U

The purpose of the sintering operation is to increase the density of the pellets by sintering at a high temperature and reduce the O/U ratio of the uranium oxide to slightly above 2.00 by sintering in a reducing atmosphere. The maximum sintering temperature used is 1780"C. The normal sintering atmosphere is 50% hydrogen and 50% nitrogen. The atmosphere can also be 100% hydrogen. The source of the atmosphere gases is a cryogenic supply system for the plant.

The dew point of the sintering atmosphere gas (s) input to the furnaces is controlled. This dew point is controlled by passing part of the gas through water in a moisturizing tank.

The furnace consist of three sections, the preheat section, the high heat section, and the cooling section. The preheat section is an inconel muffle with a cross section of approximately 10 inches x 7.5 inches. The high heat section is an high alumina brick line chamber with a

- cross section of approximately 17 inches x 13 - 16 inches. The cooling section is a metal

' muffle with a cross section of 10 inches x 7.5 inches.

The furnaces are a pusher design. The pushing cycle is as. follows: 1) the entrance door opens, a boat is pushed into the entrance chamber of the furnace, and the door closes, 2) the i

main pusher pushes the entire row of boats down the furnace one boat width until the end boat l

contacts a limit switch indicating it is in' position at the exit end of the furnace, 3) the main boat pusher retracts,4) the exit door opens, the boat at the end of the furnace is pushed out of the furnace, and the exit door closes, and 5) the furnace sits waiting for the timer to time out I

l Initial Issue Date:

16 OCT 98 Page No.

7 Revision Date:

Revision No.

O L

1 l

. and start the next boat push cycle. This process is automatic and is controlled by an electrical

. stepping switch. The Process Operator expects to get a boat out of the exit end shortly after a boat goes in the entrance end. If the main pusher travels past the distance equal to one boat width, a limit switch will be made which sounds an alarm indicating a possible boat jam and stops the main pusher. The' Process Operator must contact the Team Manager and inform them of the possible boat jam in the furnace.

i 4

When a boat exits a furnace, the sintered pellets are transferred to stainless steel pans with lids, approximately 9 inches x 11.5 inches x 2.25 inches deep. Sintered density sample pellets are obtained from each boat / pan of pellets. The sample pellets are ground and the sintered-density of the samples are measured. The pans with acceptable density pellets are stored, with lids on, one layer high on a storage shelf and held for grinding.

The furnaces are controlled with both manual controls and a PLC. All the safety controls are controlled by the PLC.

A loss of electrical power or a loss of hydrogen pressure is interlocked to shutoff the hydrogen gas supply and turn on the nitrogen supply. A loss of nitrogen pressure is interlocked to shutoff the hydrogen supply.

An over temperature condition is interlocked to shut off electrical power to the heating elements.

PELLET GRINDING The pellet grinding operation consist of grinding the OD of the sintered pellets with acceptable densities to a specific size, loading the ground pellets on stainless steel trays, drying the pellets, and visually inspecting the pellets.

Water is used as the coolant for the pellet grinding process. Coolant water is sprayed on the grinding wheel and pellets during grinding, the water containing the ground off UO flows 2

from the grinder to a centrifuge, the centrifuge removes the majority of the UO and water 2

from the centrifuge flows to a surge tank with a coolant pump, the coolant pump pumps the water back to the grinder.

The ground off UO (grinder sludge) is cleaned out of the 2

centrifuge bowl after grinding 150 trays of pellets.

PELLET CENTERLESS GRINDING Sintered pellets have a diameter that is slightly larger than the diameter required on the fuel pellet product drawing. To achieve the final required diameter the pellets are ground to size using a centerless grinder. The grinder uses an Al O regulating wheel to hold the pellets in 2 3 contact with the grinding wheel, a diamond impregnated grinding wheel, a recirculating cooling water system, an entrance vibratory feeder to orient and present the pellets to the grinder, and an exit vibratory feeder and belt conveyor or vibratory track to remove the ground pellets away from the grinder.

The sintered pellets in the stainless steel pans are in a random configuration. The pellets must

'a presented to the grinder oriented in the axial direction. A spiral bowl feeder is used to t.

Initial Issue Date:

' 16 OCT 98 Page No.

8 Revision Date:

Revision No.

O d

~

v-r--

. -. ~

._ -. -.- - ~. - - -.. - -

y orient the pellets in the axial direction. The bowl is approximately 15 inches in diameter x 3 l

inches deep. 'A pan of pellets is placed in the manually operated pan dumper and upended to -

L dump the pellets into the pellet bowl feeder. Approximately 5 - 15 kg of pellets will be maintained in the feed bowl during the operation of the grinder. As the feed bowl vibrates, the pellets move around the outer part of the bowl and move onto a spiral track. Orienting devices allow the pellets lying on their side and aligned with their axis in line with the spiral track to stay on the track as the other pellets fall off back into the bowl. The aligned pellets feed out of the bowl feeder onto the entrance linear vibrator. The linear vibrator vibrates the pellets into the grinder. The linear vibrator is set to feed the pellets at a speed a little slower than the bowl feeder. A sensor on the front end of the linear vibrator detects when the pellet queue on the feeder backs up to the front end and is interlocked to stop the bowl feeder.

'When the pellet queue moves away from the sensor the interlock allows the bowl feeder to restart and feed pellets to the linear vibrator thus maintaining a continuous flow of sintered

/

pellets to the grinder.

I The~ bowl feeder is completely enclosed in a containment housing to prevent airborne contamination. On Pellet Lines 1 - 4 the top of the containment is approximately 30 inches in diameter x 17 inches high and the bottom is conical shaped approximately 30 inches in

' diameter at.the top,2 - 4 inches in diameter at the bottom x 21 inches high with an 8 inch l

collection polypak below. On Pellet Line 5 the top of the containment is approximately 30 l

inches in diameter x 17 inches high and the bottom is conical shaped approximately 30 inches in diameter.at the top, 9 inches in diameter at the bottom x 9 inches high with an 8 inch collection polypak below. The bowl feeder is designed to segregate out pellet chips and pieces of pellets from the whole pellets. These pelle chips and pieces drop into a reject slot / hole and

' fall into the 8 inch diameter collection polypak in the bottom of the feed bowl containment.

The Process Operator cleans out the polypak at the end of the shift and documents the cleanout j'

and amount of material removed on a control form. On Pellet Lines 1 - 4 the collection polypak is housed in a non-favorable geometry containment, approximately 14 inches x 14 inches x 14 inches. On Pellet Line 5 the collection polypak is housed in a favorable geometry containment, approximately 9 inches in diameter x 22 inches high, with a level probe located in a position just above the polypak. A pellet accumulation in the polypak on Pellet Line 5 will activate the level probe which will activate an alarm light and stop the bowl feeder, entrance linear vibrator, exit linear vibrator, and vibratory track, j

Pellets are pushed into the grinder by the entrance linear vibrator. When the pellets get between the regulating wheel and diamond grinding wheel, the rotation of the two wheels pull the pellets through as the OD is ground off to the required diameter. The wheels are enclosed l

in a containment which is ventilated. Cooling water is flushing the pellets being ground to keep them cool and wash away the grinding residue. The water flows down to the bed of the grinder and out the drain to the centrifuge. The grinder base is approximately 20 inches x 25 l

inches with a depth of approximately 0.5 inches on the front and 1.5 inches on the back. The L

regulating wheel assembly occupies approximately half of the base area. Some pellet chips l

and whole pellets will fall onto the grinder bed and are periodically removed by the Process Initial Issue Date:

16 OCT 98 Page No.

9 Revision Date:

Revision No.

0

Operator. The drain in the base of the grinder is covered with an 8 mesh screen to prevent whole pellets and large pellet pieces from getting into the centrifuge.

The feed bowl and grinder wheels are ventilated by a dust collector. The ventilation air passes through a moisture drop out tank in the ventilation line where any water in the air will drop out-The pushing action of the succeeding pellets being ground pushes the pellets onto the exit linear vibrator. The exit linear vibrator moves the pellets in single file onto the belt conveyor, Pellet Lines 1 - 4, or vibratory track, Pellet Line 5. A high velocity vacuum is pulled through slots in the side of the V-track of the exit vibrator to remove surface water from the pellets.

The vacuum to the slots is pulled through an approximate 1.5 inch x 1.5 inch x 24 inches long

- chamber under the slot. The vacuum air stream passes through a stand pipe on the surge tank where the water is dropped out of the air stream. The vacuum pump exhausts to the grinder ventilation dropout tank to remove ::ny water from the air stream that may have passed through the standpipe.

Ground pellets on Pellet Lines 1 - 4 are transferred in single file by the belt conveyor to the pellet stroker. The drive system of the belt conveyor is located below the conveyor in a 7 inches x 15 inches x 60 inch containment.

Personnel safety is primary reason for the containment. Few, if any, pellet chips or whole pellets can get into the containment because of its construction. The pellet stoker is an oscillating clamping mechanism that grips a row of pellets and pushes the row of pellets onto the pellet tray positioned on the pellet tray loader.

The pellet stroke is enclosed, approximately 21 inches x 11 inches x 9 inches, with a collection funnel in the bottom for pellets. The collection funnel is aptaoximately 20 inches long x 4 inches wide at the top and approximately 6 inches deep with a 2 inch diameter connection to a flexible hose with an 8 inch polypak on the end to collect any pellets that fall from the pellet stroker.

Ground pellets on Pellet Line 5 are transferred in single file by the vibratory track and pushes a row of pellets onto the pellet tray positioned on the pellet tray loader. The vibratory track is enclosed in a contaimnent approximately 16 inches x 35 inches x 16 inches deep. Any pellets that fall from the vibratory track fall into a collection funnel below the track and into a 8 inch collection polypak. The collection funnel is approximately 16 inches long x 35 inches x 14 inches deep with an approximately 6 inch diameter bottom. The collection polypak is housed in a favorable geometry contair :nt, approximately 9 inches in diameter x 12 inches high, which is connected to the collection funnel by an approximately 4 inch long x 6 inch diameter rubber boot. A level probe is located in a position just above the polypak. A pellet accumulation in the polypak will activate the level probe which will activate an alarm light and stop the bowl feeder, entrance linear vibrator, exit linear vibrator, vibratory track, coolant pump, and centrifuge. The vibratory track enclosure is ventilated by a dust collector.

j PELLET GRINDLNG RECIRCULATING COOLING WATER SYSTEM Initial Issue Date:

16 OCT 98 Page No.

10 Revision Date:

Revision No.

0

-During pellet grinding, cooling water is flushing the pellets being ground to keep them cool

- and wash away the grinding residue. The water containing the ground off UO drains from the 2

grinder to the centrifuge via a 2 inch diameter flexible hose. The centrifuge removes the majority of the UO from the water. The water from the centrifuge flows to a surge tank via a 2

2 inch diameter flexible hose. A coolant pump in the surge tank pumps the water back to the grinder.

The centrifuge consists of an outer housing and inner bowl. The cooling water from the grinder flows into the spinning bowl and the centrifuged water overflows into the outer

' housing which drains to the surge tank. The bowl has been modified to a total volume of 19

. liters, it is approximately 20 inches in diameter and 4.5 inches deep. The wet UO (grinder 2

sludge) deposits on the outside wall of the bowl and builds up to a maximum depth of approximately 2 inches. The estimated weight of a 2 inch depth of grinder sludge in the bowl is 46 7 kg.

The centrifuged water overflows into the surge tank. The surge tank is cylinderical in shape and is approximately 10 inches in diameter x 20 inches long. A coolant pump is mounted in the tank and pumps the water back to the pellet grinder. There are four sources of water entry ir.to the tank; centrifuged water from the centrifuge (primary source), make up water from a water supply line, water from the exit linear vibrator vacuum pellet drier, and water from the ventilation line moisture drop out tank.

The centrifuge bowl is cleaned out routinely. The grinder system PLC has a tray counter which counts the number of trays ground based on the indexing of pellet tray out of the pellet tray loader. When the tray count reaches 150 the pellet grinder, centrifuge and coolant pump j

are automatically shutdown by the PLC. The Process Operator must clean out the grinder sludge from the centrifuge bowl before restarting the grinder system. The 150 tray limit is based on not completely tilling the centrifuge bowl to the 2 inch grinder sludge depth when grinding the pellet design that will result in the most ground off UO2 Per pellet.

PELLET LOADING ON TRAYS Ground pellets are loaded onto stainless steel trays by the pellet tray loader. The pellet tray is a corrugated stainless steel sheet, with stiffeners on the bottom and one end closed, that is approximately 23 inches x 15 inches.

The corrugations allow 25 rows of pellets, approximately 22 inches long, to be loaded onto a tray. A full tray of pellets will weigh between 5 to 10 kg net, depending on the pellet design.

The pellet tray loader is a mechanical device that positions an empty pellet tray in place for loading, indexes the tray one row at a time until the tray is full, and moves the filled tray onto roller conveyor for transporting the tray of pellets to the drying oven. A row of pellets is pushed onto a tray by the pellet stroker on Pellet Lines 1 - 4 or vibratory track on Pellet Line

5. A sensor located above the end of the tray detects when the pellet row reaches the end of the tray. Pellet feeding to the tray is stopped, the tray loader indexes over to the next empty Initial Issue Date:

16 OCT 98 Page No.

11 Revision Date:

Revision No.

O

-.. -. ~ ~

position of the tray, and pellet feeding is resumed. Pellets that fall from a tray are caught on a catch pan, 23 inches x 28 inches, under the tray and are readily visible to the Process Operator for clean up. An 8 inch diameter collection polypak is located on the floor next to the pellet tray loader for the Process Operator to discard pellets into.

PELLET DRYING i

l The pellet trays are transported to the on-line drying oven on a roller conveyor. Trays are l

transported one layer high. A catch pan under the roller conveyor will catch any pellets that may fall off of a tray. The pellets are readily visible to the Process Operator for clean up.

1 A continuous drying oven is used to dry the ground pellets on a tray. The oven is operated at 120 C.

Pellet trays move through the oven on a power driven roller conveyor at a rate of approximately 4 inches per minute. Pellets that fall from a tray are caught on a catch pan L

inside the oven. Very few pellets fall from the trays at this rate of travel.

PELLET VISUAL INSPECTION The pellet trays.are transported to the inspection station on a roller conveyor. Trays are transported 'one layer high. A catch pan under the roller conveyor will catch any pellets that may fall off of a tray. The pellets are readily visible to the Process Operator for clean up.

The visual inspection is performed in a hood located adjacent to the roller conveyor. The Process Operator transfers a single tray of pellets into the hood. The pellets are visually inspected on the tray for physical defects, such as chips, cracks, holes, etc. The defective l

pellets are removed and discarded into a 2 inch diameter flexible hose connected to an 8 inch polypak. The tray of pellets is filled back up with pellets obtained from a filler tray. The filler tray is positioned in the hood'approximately 13 inches above the working surface of the hood. The visually inspected tray is manually transferred to a pellet tray cart for storage.

The pellet tray storage cart contains five groups of three or four shelves for storing single pellet trays, the shelf spacing only allows one tray per shelf. Each group of shelves is separated from the next group by 8.625 inches. A total of 14 - 16 pellet trays are normally stored in a cart, the bottom four shelves are not normally used. The cart has a door that is kept closed except when loading or unloading trays from the cart. The cart is mounted on wheels so that it can be transported from one location to another. A stabilizer box is mounted to the bottom of the cart to prevent the cart from falling over if a wheel should fail.

The visual inspection station hood is ventilated by a dust collector.

L SCRAP PROCESSING There are two basic types of scrap generated in the ADU Pellet Area, green scrap (unsintered material) and sintered scrap.

Initial Issue Date:

16 OCT 98 Page No.

12 Revision Date:

Revision No.

0

-~

' Clean green scrap is recycled with the UO during the powder mixing process described in 2

Section 1.1.1.

Contaminated green scrap is sintered, packaged in 8 inch polypaks, and transferred to ADU Conversion Scrap Processing Area.

Sintered scrap is generated from three sources; contaminated sintered scrap, scrapped sintered

- pellets, and grinder sludge cleaned out of.the grinder centrifuge. The contaminated sintered scrap is packaged in 8 inch polypaks and transferred to ADU Conversion Scrap Processing Area. Both the hard scrap pellets and grinder sludge are oxidized to U 0, in the Pellet Area.

3 OXIDATION OF SINTERED SCRAP Each Pellet Line is equipped with an oxidation process. In addition there is an off line oxidation process to handle excess sintered scrap from the Pellet Lines and sintered pellets from scrapped fuel rods.

The sintered scrap la stored on the Pellet Line for processing. Sintered hard scrap pellets are i

- stored in 8 inch polypaks on stationary racks or powder carts. The wet grinder sludge is stored in stainless steel oxidizing pans, approximately 17.75 inches x 10.75 inches x 2.25 inches deep, on a stationary rack for wet grinder sludge only.

Each oxidizing process uses an oxidizing oven for oxidizing the scrap in an air atmosphere.

l The hard scrap. pellets or wet grinder sludge are placed in oxidizing pans. Approximately 5 kg of hard scrap pellets or wet grinder sludge are placed in an oxidizing pan. Up to four pans are placed in the oxidizing oven per oxidation run. The material is heated in air to oxidize the

. UO to U 0,.

The oxidized material is screened. The oversize material will be re-oxidized.

2 3

The screened U 0, will be transferred to the powder mixing process in the Pellet Lines or 3

packaged in 8 inch polypaks and stored on powder carts or stationary racks.

U 0, screening is normally performed in the vibratory sifter. The sifter is a vibrating screen 3

device. The screening container is approximately 8 inches in diameter x 8 inches high. The i

sifted U 0, drops into an 8 inch diameter polypak. A sensor in the connection between the 3

vibrating screen and the 8 inch palypak will shut the sifter off when the polypak is filled.

L U 0, can also be screened by hand. The hand screen is approximately 8 inches in diameter x 3

2 inches deep. Oxidized U 0, is placed in the screen and the Process Operator shakes the 3

screen over an empty oxidizing pan to catch the screened U 0s.

The screened U 0, is 3

3 l

transferred to an 8 inch polypak.

All handling of the sintered scrap and screening of the U 0, is perF med in a ventilated hood.

3 The ventilation is provided by a dust collector.

MOISTURE SAMPLING OF THE U 0, 3

1

. Initial Issue Date:

16 OCT 98 Page No.

13 Revision Date: __

Revision No.

0 l

l

L All the U 0, that is 'to be transferred out of the Pellet Lines must be moisture sampled and o

3 have acceptable results before it is transferred.

Two moisture samples are obtained. The first moisture sample is a composite sample. The composite sample is analyzed for moisture content. If the first moisture result is =/< 0.3%

then the second moisture sample is requested by Quality Control. Three randomly picked -

polypaks will be. sampled by Quality Control and analyzed for moisture.

If the second moisture result is =/< 0.3% then the sampled polypaks of U 0, can be transferred from the 3

Pellet Line.

The Team Manager is notified if either moisture sample result is > 0.3%.

The following operating procedures 'are used to fabricate uranium dioxide fuel pellets in the ADU Pellet Area:

COP-820112, Bulk Container Handling At Powder Prep COP-820114, Automatic Feed Preparation - Pellet Lines 1,2,3, And 4 COP-820116, Manual Press Feed Preparation COP-82.0206, Pellet Press Operation COP-822524, Pellet Press Boat Loader COP-820207, Servicing Of Torit 84 And 124 Dust Collectors In Pellet' Area COP-822521, Pellet Area Fabricmax Dust Collector - Startup, Operation, And Shutdown COP-820301, Sintering Furnace Operation COP-820401, Grind Pellets - ADU Lines 1-4

. COP-829012, Grind Pellets On ADU Grinding Line 5 COP-820404, Clean Pellet Grinder System COP-825202, On-Line Pellet Dryer Oven COP-820406, Pellet Inspection COP-825101, Oxidation - Lines 1, 2, 3, 4, 5 COP-829007, Oxidation / Screen Reject Pellets, Clinkers, And Grinder Sludge - Pilot Line COP-829005, Moisture Sampling Of U 0, 3

COP-829013, Functional Verification Of Safety Significant Controls OM82000, SI - Safety Interlock Check, Pellet Lines PM82012, SS - Moisture Drop Out Tank (Quarterly PM)

~ Initial Issue Date:

16 OCT 98 Page No.

14 Revision Date:

Revision No.

0

Environmental Protection and Radiation Safety Controls To be provided in a future Integrated Safety Assessment.

Nuclear Criticality Safety (NCS) Controls And Fault Trees This Section summarizes the results of the Safety Analysis of the ADU Pellet Process.

The analysis for the hoods used in the pelleting system, the process ventilation that supports the hoods and enclosures, and storage of material in the area is addressed is separate documents.

PELLET BULK CONTAINER / ENCLOSURE SYSTEM Controls Safety Significant Controls Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

a)

Container or prep feed line integrity fails. IE# BLK 1. Periodic verification is no_t required because of continuous surveillance provided by events BLK 6, 7, and 8.

Integrity of the bulk container is addressed in a separate CSE (including periodic PM's to assure container integrity). Control ID: P-PEL-x-01.

b)

Bulk container feeder valve fails open. IE# BLK 4.

Periodic verification is accomplished by the test each time a feeder valve is readied for use; further annual verification is not required. Control ID: P-PEL-x-02.

c)

Cover plate comes off bulk container -(with feeder valve).

IE# BLK 5.

Continuous verification is accomplished by having a person (s) in attendance during movement of the container; further annual verification is not required.

Control ID: P-PEL-x-03.

d)

Favorable geometry collection capability fails.

IE# BLK 6.

Periodic verification is no_t required because of continuous protection and surveillance provided by events BLK 1,2,3, and 8. Control ID: P-PEL-x-04.

e)

Water available from outside source (roof leak, pipe leak, etc.). IEN BLK 9.

Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-05.

f)

Bulk enclosure room leaks.

IE# BLK 10.

Periodic verification required.

Control ID: P-PEL-x-06.

Initial Issue Date:

16 OCT 98 Page No.

15 Revision Date:

Revision No.

O

i g)

Overflow slots in FG collection system fail. IE# BLK 12. Periodic verification required. Control ID: P-PEL-x-07.

l Active engineered controls (AEC) l Active Engineered Controls are described in License SNM-1107 and in Regulatory Affairs Procedure RA-108. They are also called safety significant interlocks. The requirements for functional verification are determined by this evaluation, a)

Inflatable O-ring seal interlock fails.

IE# BLK 2.

Periodic functional L

verification is required. Control ID: PEL-x-01.

b)

Container-in-place interlock fails. IE# BLK 3. Periodic functional verification is required. Control ID: PFL-x-02.

c)

Powder level probe fails. IE# BLK 7.

Periodic functional verification is required. Control ID: PEL-x-03.

Administrative controls with computer er alarm assist (AC)

Administrative controls with computer or alarm assist (AC) typically consist of l

operator actions that are prompted or assisted by computer output or hard-wired alarm.

L The requirements for functional verification are determined by this evaluation.

[none]-

t Administrative controls Safety Significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or some other record.

Functional verification is not normally required.

a)

Operators fail to detect accumulation of powder or moderator. IE# BLK 8.

Control ID: A-PEL-x-01.

b)

Bulk enclosure room doors left open. IE# BLK 11. Control ID: A-PEL-x-02.

Margin of Safety The nuclear criticality margin of safety has been evaluated to be very strong for the bulk enclosure. The neutron multiplication factor (k,y) has been calculated to be s 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take k,y 21.00.

The parameters that directly affect neutron multiplication for the bulk enclosure, L

assuming 5.0 wt.% 2"U enrichment, are mass and moderation. Criticality safety limits l

(CSLs) and Bounding Assumptions (BA) are established for mass and moderator, j

ultimately with the intent to limit geometry. A criticality (k,y = 1.00) could be l

possible in the bulk enclosure given the following upset condition:

l I

Initial Issue Date:

16 OCT 98 Page No.

16 Revision Date:

Revision No.

0

i

'.The cone' transition piece filled to at least 13 inches with optimally moderated 3

e i

UO2 Powder at optimum density. This equates to approximately 148.7 kg UO2 powder or 60,1 liters of water (km = 1.0).

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS

- FOR THE BULK ENCLOSURE (a)1 Group 1 Defense Elements (IE#s BLK 1-9: Mass Defenses)

(a.1)

IE #BLK 1 Bulk container or prep feed line integrity is violated.

- This event assumes that the integrity of either the bulk container or the prep feed system line is-compromised such that an avenue becomes available for powder to spill into the enclosure.

Possible causes include:

Material defect 1

4-e Inadequate preventive maintenance j

- Intrusion of foreign object e

Consequences of this event occurring:

e.

'UO2 Powder begins to flow into enclosure i

l Defenses designed to prevent this event occurring:

Bulk container integrity certified (DOT) e Preventive maintenance requirements e

Independent residual defenses:

BLK 6 Favorable Geometry Collection Container BIX 7 Powder Level Probe Interlock BLK 8 Operators Inspect e

Moderator Defense (a.2) IE #BLK 2 Inflatable 0-ring fails 4

This event assumes that the active engineered control for low air pressure to the inflatable O-ring between the container and feed system fails, allowing powder to pass into the enclosure.

This safety significant interlock is designed to give a visual alarm, audible alarm, stop the vibratory feeder, shut the bulk container feeder valve, and stop the vibratory feeder upon

- sensing low air pressure.

Possible causes include:

' Improper operator handling of container when loading damages o-ring or seal Under inflation (0-ring) e Initial Issue Date:

16 OCT 98 Page No.

17 Revision Date:

Revision No.

0

e Settling of seal collar Puncture of inflatable seal.

'Overpressurization of inflatable ring leading to bursting Consequences of this event occurring:

- Powder falls into the enclosure Defenses designed to prevent this event from occurring:

Interlock for low air pressure to inflatable seal fails Operator training for container handling e

Procedural compliance Preventive maintenance e

Independent residual defenses:

BLK 3 Container in Place Interlock BLK 6 Favorable Geometry Collection Container.

e BLK 7 Powder Level Probe Interlock BLK 8 Operators Inspect o'

Moderator Defense (a.3) IE #BLK 3 Container - in - place interlock fails This event' assumes that the active engineered control (safety significant container-in-place interlock) fails, such that the container comes off the o-ring / seal and the interlock fails to

' function as designed when called upon to do so. The container-in-place switch allows the seal to inflate. If the tank comes off the switch, the seal deflates, resulting in low seal pressure; upon sensing low seal pressure, the interlock stops the process. The interlock also functions to prevent seal damage during tank installation.

Possible causes include:

Container shifts off stick probe e

Feeder valve actuator fails Loss of actuator air pressure e-Consequences of this event occurring:

Feeder valve will not shut if interlock is activated Defenses designed to prevent this event occurring:

Safety significant interlock verification Operator training e

Procedural compliance Independent residual defenses:

BLK 6 Favorable Geometry Collection Container Initial Issue Date:

16 OCT 98 Page No.

18 Revision Date:

Revision No.

O

f

- e BLK 7 Powder Level Probe Interlock i

BLK 8 Operators Inspect e

Moderator Defense i

e L

e l-(a.4) IE #BLK 4 Fecder valve fails open during bulk container installation

- This event assumes that the bulk container feeder valve somehow fails open during the l

container loading ' evolution, resulting in powder spilling into the enclosure. Note that l

in order for this to happen, the cover plate would have to be removed.

l Possible causes include:

Valve failure

-e Operator error (opening valve) j e

Consequences of this event occurring:

UO powder spills into enclosure (if cover plate is off) 2 Defenses designed to prevent this event occurring:

e:

Very strong spring return to close Feeder valve checks before container leaves blend room l.

Operator training Procedural compliance Independent residual defenses:

BLK 5 Cover plate in place l

BLK 6 Favorable Geometry Collection Container BLK 7 Powder Level Probe Interlock e

BLK 8 Operators Inspect Moderator Defense (a.5) IE #BLK 5 Cover plate comes off during transport This event assumes that the cover plate comes off or becomes dislodged during container handling, and that it allows powder to spill into the enclosure. The feeder valve would also have to fail open in order for the cover plate failure to result in powder spillage.

Possible causes include:

Installed incorrectly Container dropped in enclosure e

Clamp failure e

j:

Consequences of this event occurring:

Powder spills into enclosure (if feeder valve is open)

Initial Issue Date:

16 OCT 98 Page No.

19 Revision Date:

Revision No.

O

- ~.....

.~

Defenses designed to prevent this event occurring:

'e

. Operator training Procedure Independent residual defenses:

BLK 4 Feeder valve shut e'

BLK 6 Favorable Geometry Collection Container BLK 7 Powder Level Probe Interlock e

BLK 8 Operators Inspect Moderator Defense (a.6) IE #BLK 6 Favorable geometry collection capability fails

. This event assumes that the passive engineered control favorable geometry powder collection system somehow fails, and that powder is not collected in a favorable geometry.

Possible causes include:

Blockage at bottom of enclosure e.

Powder bridges Different means of discharge screw control / indication from line to line e

Consequences of this event occurring:

. Powder potentially accumulates in NFG configuration e-Defenses designed to prevent this event occurring:

Operator training (keep bottom of enclosure clear)

Procedure Independent residual defenses:

Moderator defense (a.7) IE #BLK 7 Powder level probe interlock in favorable geometry collection system fails This event assumes that the powder level interlock fails to function when called upon to do so, that the feeder valve remains open and the alarm fails to sound, and that powder continues to l

spill into the enclosure. It is noted that this probe is also effective in detecting accumulation of moderator.

Possible causes include:

Probe fails to detect powder due to density variation Feeder valve actuator malfunctions e

Loss of actuator air pressure e

t l

Initial Issue Date:

16 OCT 98 Page No.

20 I'

Revision Date:

Revision No.

O

~_ -. _ _

Consequences of this event occurring:

Either powder (or moderator) accumulate in enclosure Defenses designed to prevent this event from occurring:

  • L Safety significant interlock verification

' Fail-safe design

- e Operator training.

~

. Procedural compliance

. Independent residual defenses:

- e BLK 8 Operators Inspect _

Mass ~ Defenses if moderator is accumulating Moderator Defenses if mass is accumulating (a.8) IE #BLK 8 Operators fail to inspect once per day This event assumes that operators fail to inspect the enclosure once per day as required by

. COP-820114,' and fail to detect the powder or moderator accumulation, or that the operator

+

checks, but does not detect the powder or moderator accumulation.

~

Possible causes include:

Operator error.(fails to detect) '

e Failure to follow procedure (fails to inspect once per day)

Consequences of this event occurring:

~

- Either powder (or moderator) continues to accumulate in enclosure e

Defenses designed to prevent this event from occurring:

Training

~ Independent residual defenses:

K Mass Defenses if moderator is accumulating Moderator Defenses if mass is accumulating (b)

' Group 2 Defense Elements (IE#s BLK 9-12: Moderation Defenses)

(b.1) IE #BLK 9 Moderator (water) becomes available from source outside enclosure i

This event assumes that water becomes available to the enclosure from some source outside the enclosure. Possible sources inc!;

rain water leaking through the roof, air conditioning duct condensation, and water lines wt run overhead.

-4

- Initial Issue Date:

16 OCT 98 Page No.

21 Revision Date:

Revision No.

0 v--

-1 Possible causes include:

Failed cooling water piping

-e Failed city water piping p

e y

' Consequences.of this event occurring:

' Water available to enclosure e

?

- Defenses designed to prevent this event occurrmg:

- Piping integrity

_ Operators present in area

e

- Roof integrity e^

= Independent residual defenses:

L e'

BLK 8 Operators Inspect

]

BLK 10 Bulk Enclosure Watertight e

' BLK 12 Overflow Slots for Water Mass Defense i

(b.2) IE #BLK 10, Dulk Enclosure room leaks

- This event assumes that the bulk enclosure leaks.-

Possible causes include:

e' Gaps in enclosure wall-to-wall or wall-to-roof seams.

. Loose gasket material covering front doors or rear door Material failure of enclosure.

Hole in lexan window.

Consequences of this event occurring:

e.

Path created for water to enter enclosure Defenses' designed to prevent this event from occurring:

l Enclosure inspections / maintenance e

Gasketed doors e

LIndependent residual defenses:

BLK 9 Moderator Not Available

  • L

_ Operator presence in area

- Mass defense (b.3). IE #BLK 11 Bulk enclosure doors left open during processing l

l This event assumes that bulk enclosure doors are left ajar while processing a container, e

i InitialIssue Date:

16 OCT 98 Page No.

22.

, Revision Date:

Revision No.

O

. providing a path for water to enter.

l

- Possible causes include:

L Operator error (doors closed in incorrect order)

Doors drift open '

e.

Operator fail to shut door Consequences of this event occurring:

Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance e

Independent residual defenses:

BLK 8 Operators Inspect e

Mass defense (b.4) IE #BLK 12 Overflow slots in favorable geometry collection system fail to drain

. water This event assumes that water has somehow entered the enclosure, drains to the bottom as designed, and then does not drain out the built-in overflow slots at the bottom, resulting in water accumulating in the enclosure.

Possible causes include:

Foreign material plugs slots (plastic, tape) e

' Water flow rate in overwhelms maximum drain rate slots can provide.

' Consequences of this event occurring:

Water continues to accumulate in enclosure Defenses designed to prevent this event from occurring:

Training (to keep the slots clear)

Independent residual defenses:

BLK 8 Operators Inspect Mass defense

.(b.5) See IE# BLK 7 (b.6) See IE# BLK 8 L

Common Mode Failure InitialIssue Date:

16 OCT 98 Page No.

23 Revision Date:

Revision No.

0

l In a classic sense, there is common mode failure potential in that IE# BLK 7, powder l

level probe interlock failure, appears in both the mass and the moderator branch of the fault tree. In reality there is very low risk in that the potential occurrence of mass and l

moderator in the chute are essentially independent of each other. The primary function of the probe is to detect any mass accumulations.

The primary defense against potential water in the chute is the passive engineered control of slots in the bottom of the chute, which would cause water to flow into the collection pot hood and onto the floor. The probe was shown in the moderator portion of the tree, however, because it would be very effective in detecting accumulations of water in the collection pot.

In a similar way, IE# BLK 8, operators fail to detect accumulations of mass of moderator, is a potential common mode failure. The risk is judged acceptable because l

there are no sources of moderator in the bulk enclosure room, and because any l-moderator sources (leaks) would be readily detected by persons in the area.

Summary Tables - see Tables 5.3.1-1 and 5.3.1-2.

l l

l l

l l

l l

l L

Initial Issue Date:

16 OCT 98 Page No.

24 Revision Date:

Revision No.

0 l

TABLE 5.3.1-1

SUMMARY

OF DEFENSES PROVIDED AGAINST A SINGLE FAILURE

]

FOR THE BULK ENCLOSUPE

Defense SetIliu
Defense. Set 20

^

.=

-m jdenerai Descriptor-

~

.f' i-

Preventh
Regula l Detect /i LPreven" Regula Detect
t

. React::

t-e t-i

.J

+

L eact Je

'e R

MASS DEFENSE Container or Seal /O-ring 1,2 erator Defense 6

7,8 failure during processing Container comes off seac 3

6 7,8 during processing Mass spillage during 4,5 6

7,8 cont.iner installation or removal MODERATOR DEFENSE Moderator available from This scenario is determined to be not credible. The enclosure internal source s a moderation control area, and the containers are under moderation control.

Moderator available from 9,10,11 12 7,8 Mass Defense external source NOTES:

1)

The level probe interlock and administrative control to detect the accumulation of either mass or moderator is a potential common mode failure.

2)

See the end of CSE Section 5.3.1.12 for a discussion of common mode failure potential.

1 Initial Issue Date:

16 OCT 98 Page No.

25 Revision Date:

Revision No.

O

TABLE 5.3.1-2 NUCLEAR CRITICALITY SAFETY LIMITS FOR k,y = 0.90, 0.95, AND DELAYED CRITICAL PARAMETER

.NORMALL BOUNDING l

.CRITICALITYJ

' CRITICALITY:: ' CRITICALITY {

[_

OPERATING

ASSUMPITON-.

SAFETY

=SAFETYJ LLIMIT lLI.MIT -

LIMIT -
Delayed Critical.

CONDITIONS :

s 0.90 -

-s 0.95

' (0.98) <

235U M ass Essentially 89.1 Kg UO 112.7 Kg U0 13-2.1 Kg UO2 2

2 Zero Moderator /

s 1.0 Wr. %

Optimum 36.0 Liters 45.6 Liters 53.4 Liters j

Concentration Moisture Water Water Water Geometry Inches 10.7 Inches 11.75 Inches 12.5 Inches

)

In Chute Spacing N/A N/A N/A N/A N/A

)

l Homogeneous -

Density Optimum 1.9447 gUO /Cc 2

Absorbers None None None None None Enrichment s 5.0 Wt. %

<5.0 Wt.%

s 5.0 Wt. %

s 5.0 Wt. %

5 5.0 Wt. %

1 Partial Water Reflection (l") Except 24" CONC -Z

]

Offset 24" Notes i

1) Mass limits calculated from height in collector chute at H/235U = 250. (1.9447 gUO2/cc)
2) Moderator limits calculated from height in collector chute at H/235U = 200. (0.7861 H 0/cc) 2
3) See CRI-96-033-0, Chart I and Tables BLK-ENCL.XLS.
4) Delayed critical limits set at k,y = 0.98. (arbitrary - see Section 5.3.1.11)

Initial Issue Date:

16 OCT 98 Page No.

26 Revision Date:

Revision No.

0 1

FIGURE 6.3.1-1 ADU PELLET AREA BULK ENCLOSURE FAULT TREE

)

CRITICALITY POSSIBLE l

< CRITICALITY PRECURSOR >

UNACCEPTABLE AMOUNT OF MASS AND MODERATOR INSIDE THE NONFAVORABLE GEOMETRY l

l MASS MODERATOR CONFIGURATION DEFENSES DEFENSES FAIL DEFENSES FAIL Fall I

l A1

". ;neommenevirrE9 tmwcoemwo=Norrmm

-;; -4,

' 2 :. l.L.i fra i

'!OR5ATER THANIME SAP 87YLMITS THE SAPETY LIMIE OP WATER (SBA UTERS)SBTS IltVO.

N/A IIASS(132.1 k8 UO2)ht#d[

i-I

' 2' Ah0 ' ACCUMULATES'W*s i d

fESllN ENCLOSUR(J) yt @y5 ENCLOSUREg'j:

BULK

-~"

ENCLOSURE IS NONFAVORABLE GEOMETRY YESSEL I

I GREATER THAN THE GREATER THAN THE

/X WATER (534 LITERS SAFETY LIMIT OF SAFETY LIMIT OF 2

S WATER (53 4 LITERS H2O) GETS INTO H2O) ACCUMULATES ENCLOSURE IN ENCLOSURE Initial Issue Date:

16 OCT 98 Page No.

27 Revision Date:

Revision No.

O

FIGURE 6.3.1-1 (Cont'd)

ADU PELLET AREA BULK ENCLOSURE CONTINGENCY PROTECTIONS 3WcoNTINGENcVTWO?P}

.i

.L?

LKYl MMOM9341 MG.UO2)0!!)

QACCUMULAfg$EE108URE I

I FG Operators Fail Collection to Detect System Falls i

a Material Leaks Material Leaks eAnmo into Enclosure into Enclosure During Operation During installation cop-s20114 elks or Removal A#EL-X41 hO I

I i

i Container or inflatable Container Feeder Valve Cover Plate Is)

Prep Feed 0-Ring Fails in-Place Fails Open Off Line Integnty Interlock Fail Fails Favorable Powder Geometry Level Collection Probe SLK1 BLK2 BLK3 BLK4 SLK$

PEC PEC AEC P.PEL X41 PEL-X41 PEL X 02

)

gg PSEL X42 P-PEL X43 BLK6 p

P.PEL-X44 Initial Issue Date:

16 OCT 98 Page No.

28 Revision Date:

Revision No.

O

FIGURE 6.3.1-1 (Cont'd)

ADU PELLET AREA BULK ENCLOSURE CONTINGENCY PROTECTIONS GREATER THAN THE GREATER THAN THE SAFETY LIMITOFWATER SAFETY LIMITOF WATER (53.4 LITERS H2O)GETS (53.4 LtTERS H2O)

INTO ENCLOSURE 2

3 ACCUMULATESIN ENCLOSURE I

b 8

i Water Avsilable Bulk Enclosure l

From Outside Water Tight g,,

gm etKs Source integrity Falls Overflow Powder Slots in FG Operators Level Probe Collection Fallto Detect Interlock System Falls Falls su1o l eLKii PEC AEC p.pg. g C0p-820114 Bulk Enclosure Bulk Enclosure p.pa X-07 PR X43 Room Leaks Room Doors A-PEL X41 Left Open p.pa.xa PEC Ppa X42 4

Initial Issue Date:

16 OCT 98 Page No.

29 Revision Date:

Revision No.

O

POWDER TRANSPORT SYSTEM The powder transport system, also called the automatic feed preparation (auto feed prep) system, includes the powder feed line from the bulk enclosure, add back system, ribbon blending system, powder lift, and roll compactor hopper. The transport system components which warrant evaluation are the powder lift enclosure and the roll compactor hopper.

Powder Lift System j

Controls Safety Significant Controls Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# MOD 1.

Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-12.

b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# MOD

2. Periodic verification required. ControlID: P-PEL-x-13.

Active engineered controls (AEC)

Active Engineered Controls are described in the License and in Regulatory Affairs i

procedure RA-108.

They are also called safety significant interlocks.

The requirements for functional verification are determined by this evaluation.

a)

Drexelbrook capacitance level probe interlock fails. IE# PWL 1.

Periodic functional verification is required. Control ID: PEL-x-05.

b)

Endress-Hauser vibration fork level interlock fails. IE# PWL 2.

Periodic functional verification is required. Control ID: PEL-x-04.

Administrative controls wit'i computer or alarm assist (AC)

Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm.

The requirements for functional verification are determined by this evaluation.

Initial Issue Date:

16 OCT 98 Page No.

30 Revision Date:

Revision No.

O l-

[none]

l

' Administrative controls Safety Significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or' some other record.

Functional verification is not normally required, a)

Operators fail to detect accumulation of powder or moderator. IE# PWL 4.

Control ID:

. A-PEL-x-05.

b)

Enclosure access door (s) not closed properly. IE# MOD 3. This condition l

. should cause the process control interlock to prevent operation. Control ID: A-f PEL-x-06.

4 Margin of Safety i

The nuclear criticality margin of safety has been evaluated to be very strong for this system. The neutron multiplication factor (k n) has been calculated to be 5; 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take k,y 21.00.

The parameters that directly affect neutron multiplication, assuming 5.0 wt.% 235U enrichment, are mass (controlled by level) and moderation. Criticality safety limits (CSLs) and Bounding Assumptions (BA) are established for mass and moderator. A criticality (k,y = 1.00) could be possible in the powder lift enclosure only given the following upset condition:

Powder of optimum density becomes optimally moderated (100.81 kg UO ag 2

42.6 liters of H O), and forms into a piled hemisphere (a conservative 2

. geometry).

SUMMARY

. OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS (a) Group 1 Defense Elements (IE#s PWL 1-4 Geometry Defenses)

(a.1)

IE #PWL 1 Drexelbrook capacitance probe interlock in the lift i

enclosure system fails This event assumes that the Drexelbrook capacitance powder probe level interlock fails to' function as designed, so that the alarm fails to alert operator, and that powder continues to accumulate into the enclosure.

Possible causes include:

Initial Issue Date

16 OCT 98 Page No.

31 l

Revision Date:

Revision No.

0

Probe fails to detect powder -

e Electrical failure of supporting equipment Consequences of this event occurring:

Powder accumulates in the enclosure Defenses designed to prevent this event from occurring:

Fail-safe design Operator training e

Procedural compliance Independent residual defenses:

Endress-Hauser vibrating fork probe Operators inspect Moderator defenses

- (a.2)-' IE #PWL 2 Endress-Hauser vibrating fork probe interlock in the lift enclosure system -

fails This event assumes that the Endress-Hauser powder probe level interlock fails to function as designed, so that the alarm fails to alert operator, and that powder continues to accumulate into the enclosure.

Possible causes include:

Probe fails to detect powder Electrical failure of supporting equipment e

Consequences of this event occurring:

Powder accumulates in the enclosure Defenses designed to prevent this event from occurring:

Fail-safe design e

Operator training Procedural compliance Independent residual defenses:

Drexelbrook capacitance probe Operators inspect Moderator defense (a.3)

IE# PWL 3 Powder Repeatedly Spills into Enclosure i

i Tho event assumes that with each lifting process an amount of powder is spilled into the enclosure bottom. This could be a small amount, which over a period of time Initial Issue Date:

16 OCT 98 Page No.

32 Revision Date:

Revision No.

0 1

J would accumulate to a nonfavorable geometry, or the entire pan contents, which would need to occur at least 4 times in order to accumulate greater than the safety limit.

Possible causes include:

Material defect of pan Operator error (over-filling the pan)

Mechanical malfanction of the lifting system Consequences of this event occurring:

Significant accumulation of powder

' Defenses designed to prevent this event from occurring:

Design of the process Operator training Procedural compliance Independent residual defenses:

IE #PWL 1 Drexelbrook capacitance probe interlock IE #PWL 2 Endress-Hauser vibrating fork probe interlock Moderator Not Available e

Operator presence in area (a.4)

IE #PWL 4 Operator fails to inspect lift enclosure per procedure This event assumes that certain other controls have failed, and that either material or moderator have begun to accumulate in the powder lift enclosure.

Possible causes include:

- Operator error (fails to detect)

Failure to follow procedure (fails to inspect once per shift) e Consequences of this event occurring:

Either powder (or moderator) continues to accumulate in enclosure Defenses designed to prevent this event from occurring:

Training Independent residual defenses:

IE #PWL 1 Drexelbrook capacitance probe interlock l-

-IE #PWL 2 Endress-Hauser vibrating fork probe interlock e

Moderator Defenses (a.5)

IE #PWL 5 Batch counter interlock fails Initial Issue Date:

16 OCT 98 Page No.

33 Revision Date:

Revision No.

O

l:

i Possible causes include:

. Sensor failure

. Circuitry failure Consequences of this event occurring:

l.

Accumulation of powder in the system f

- Defenses designed to prevent this event from occurring:

- e Batch counter interlock Independent residual defenses:

. IE #PWL 1 Drexelbrook capacitance probe interlock IE #PWL 2 Endress-Hauser vibrating fork probe interlock e

IE # PWL 4 Operator detects e

Moderator defenses e

i

- (b) Group 3 Defense Elements (IE#s MOD 1-4: Enclosure Moderation Defenses)

'(b.1)

IE # MOD 1 Moderator (water) becomes available from source outside enclosure This event assumes that water becomes available to the enclosure from some source outside the enclosure. Possible sources include: rain water leaking through the roof, i

. air conditioning duct condensation, and water lines which run overhead.

Possible causes include:

Leaky roof e

Failed cooling water piping Failed city water piping e

Consequences of this event occurring:

-- Significant water available to enclosure (greater than the safety limit)

Defenses designed to prevent this event occurring:

Piping integrity e-Operators present in area Roof integrity e

Independent residual defenses:

Operators inspect.

L Mass defense e

P e

Gasket seal around maintenance access doors IE # MOD 2 enclosure doesn't leak e

IE # MOD 3 access doors properly secured n

-InitialIssue Date:

16 OCT 98 -

Page No.

34

. Revision Date:

Revision No.

O

>--r 4

e v

<-e-r--

.=.

P l

f

~

IE # MOD 4. access doors interlock e

[

Redundant, diverse level probes with interlock j

l

)

L

~(b.2)-

IE # MOD 21 Enclosure integrity L

This event assumes that the powder lift enclosure leaks at any point.

L Possible causes include:

' Gaps in enclosure service doors.

L.

Improper sealing of gasket material on access doors

  • 1

. Material failure of enclosure Hole in lexan windows of access doors

~ Gap in light fixture on base of enclosure Consequences of this event occurring:

j

-Airborne problem in area -

e Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance Independent residual defenses:

1 Operator presence in area e-IE # MOD 1 Moderator available IE # MOD 3. Access Doors Properly Secured e

. IE # MOD 4 Access Doors Interlock e

Mass Defense (b.3)

IE # MOD 3 Containment Enclosure Access Doors Not Properly i

Secured This event assumes that containment enclosure access doors are not properly installed while processing, providing a path for water to enter.

Possible causes include:

Operator error (doors not closed properly)

Doors drift open Operator fail to shut door e-Consequences of this event occurring:

Airborne problem in arca L

e L

e Path created for water to enter enclosure L

Defenses designed to prevent this event from occurring:

L Initial Issue Date:

16 OCT 98 Page No.

35 Revision Date:

Revision No.

0

e' Enclosure inspections / maintenance Independent residual defenses:

j Operators Inspect e

Geometry defense e

e' IE # MOD 1 Moderator available IE # MOD 2 Enclosure Doesn't Leak IE # MOD 4 Access Doors Interlock l

(b.4)'.

IE # MOD 4 Containment Enclosure Access Door Interlock failure This event assumes that operators have installed an access door improperly, and the containment enclosure access door interlock fails.

-l Possible causes include:

e -

Contact switch failure 1

Door misalignment during installation

-e i

Consequences of this event occurring:

Airborne problem in area 3

Path created for water to enter enclosure 1

Defenses designed to prevent this event from occurring:

Component reliability e

Operator training e

Training (to keep the slots clear)

H Independent residual defenses:

4 IE # MOD 1 Moderator available IE # MOD 2 Enclosure Doesn't Leak e

IE # MOD 3 Access Doors Properly Secured Geometry Defense e

Conunon Mode Failures There is common mode failure potential regarding the level probes appearing in both

- the mass and the moderator branches of the fault tree. The risk is acceptable because 1)

The reason for the probes is primarily for potential powder accumulation. They are, however, shown in the moderator branch because they are equally effective for water.

2)

The strength of the other controls.

3)

Any sources of moderator are expected to be readily detected.

- There is more significant common mode failure potential regarding IE# PWL 4. The

- Initial Issue Date:

16 OCT 98 Page No.

36 Revision Date:

Revision No.

0

~

required periodic operator inspection should detect either powder accumulation or water leaking into the enclosure. The risk is considered acceptable because of 1)

Operator training, including sensitivity to past incidents.

'2)

Documented inspections.

3)

Good visibility into the enclosure.

4)

The strength of the other controls, including SS interlocks.

5)

Any sources of moderator are expected to be readily detected.

Summary Tables - see Tables 5.3.2.1-1 and 5.3.2.1-2.

i InitialIssue Date:

16 OCT 98 Page No.

37 l

Revision Date:

Revision No.

O p

l'

Table 5.3.2.1-1: Summary of Defenses Provided Against a Single Failure for the Powder Lift Enclosure Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React

,. w r

r; x

o" -

~

GEOMETRY DEFENSE 2' Mass spillage during lift process PWL3 PWL Moderator defense 1,2,4,5 Y$i "%, '

~

~

MODERATOR DEFENSE Moderator available from

'Thishs hnario.?ls dite'rmihedit$ beinotieredible.: bhNenclosure'is a internal source moderation contro! ar'eaJ Moderator available from MOD 1,2,3 PWL Geo:aetry defeme external source 1,2,4 MOD 4 NOTES:

1)

See Section 5.3.2.1.12 for a discussion of common mode failure potential.

i Initial Issue Date:

16 OCT 98 Page No.

38 Revision Date:

Revision No.

O

l Table 5.3.2.1-2: Nuclear Criticality Safety Limits fc-k,y = 0.90, 0.95, and Delayed Critical Powder Lift

^

.t.

l

+v s,.

l

< PARAMETER i NORMAbl BOUNDINGi.

CRITICALITYs; CRITICALITYI CRTI1CALITYn I

OPERATING !, ?ASSUMFFION ? iSAFETY

' SAFETY @

LIMIT.1

?

CONDITIONS 1

LIMIT i.

FLIMIT A

Delayed Critical

.ni; ' W;

s 0.9017 ;

is 0.9453?

!(0.98)M 4

4 2"U MASS Very Low 75.38 kg UO 91.27 kg UO 2

2 l

t l

MODERATOR /

s 0.3 wt. %

Optimum 31.8 liters H O 38.5 liters H O 2

2 CONCENTRATION moisture I'

L i

i GEOMETRY inches 0 inches Iinch 2.4 inches l

plus hemisphere plus hemisphere plus hemisphere SPACINO N/A N/A N/A N/A N/A Homogeneous -

{

DENSITY Optimum l

1.9447 l

gUO2/cc l

ABSORBERS None None None None None ENRICHMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

i Partial Water REFLECTION (1") except 12" CONC (-z)

Notes:

1) Moderator limits calculated from h/u235 = 250. (0.821 liters H20/cc)
2) See Section 5.3.2.1.11 of CSE.

Initial Issue Date:

16 OCT 98 Page No.

39 Revision Date:

Revision No.

O

s..-.

,n.

_. = _.. -, +

..... - ~ _. -

d FIGURE 6.3.2.1-1 FAULT TREE FOR PELLET POWDER LIFT ENCLOSURE CRITICALifY POSSIBLE GREATER THAN THE BAFETY LIMITS OF WASS.

MODERATOR. AND GEOMETRY I

I I

N MODERATOR DEFENSES Fall CONFIGURATCH DEFENSES Fall DEFENSE 5 FAIL NeA MASS LEVEL 18

. ?MTROLLEO AS MFIGURATnON DEFENSE IE MOD 1 l IE MOO 2 1 E PWL 4 l l

A WATER AVAILABLg WATER GETS INTO OPERATOR FAA8 TO LEVEL PROBES

==

FROM ENCLOSURE DETECT (PWL 4)

INTERLOCK FAIL TO j

,, 'M EC iE m i mewt.

i i

=Pwtei SATCH COUNTER POWOER LEVEL PROBES OPERATOR FAILS E

3 APEL X45 2

INTERLOC REPEATEDLY $ PILLS INTERLOCKS Fall TO DETECT t^rl NM E.NC_RE s

TEO IE MOO 3 l IE M00 41 T

ACCESS DOOR (S)1407 ACCESS DOOR l

A-X4S CLOSED PROPERLY INTERLOCK FAILS mM2 l OC DR sR E MOSE U M8 gg, g g

, g f

,m,E EM PR08E AILS FORx,VIBR.ATI,ON.

w eE 7 g RO E m n'agA,,

nt-xag 7 N O S wORx,w:Tc8 4

A.PEL X48 1

Initial Issue Date:

16 OCT 98 Page No.

40 Revision Date:

Revision No.

0

__ _~

l l

l Roll Compactor Hopper Controls Safety Significant Controls l

Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this L

evaluation.

i i

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# MOD 1.

l Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-14.

b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# MOD

2. Periodic verification required. Control ID: P-PEL-x-15.

c)

Water accumulates in hopper.

IE# MOD 5.

Periodic verification is ng required because the hopper naturally drains by gravity down through the roll compactor and granulator. Control ID: P-PEL-x-16.

Active engineered cont:ols (AEC) i Active Engineered Controls are described in the License and in Regulatory Affairs procedure RA-108.

They are also called safety significant interlocks.

The requirements for functional verification are determined by this evaluation. Control ID:

PEL-x-08.

a)

Level probe fails. to stop operation.

IE# RHD 1.

Periodic functional verification is required.

Administrative controls with computer or alarm assist (AC)

Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm.

The requirements for functional verification are determined by this evaluation.

[none]

Administrative controls Safety Significant administrative controls are required operator actions that usually occur without prompting from' a computer / control panel alarm or indication. These controls.may require documentation via Control Form or some other record.

Functional verification is not normally required.

i-l l

. Initial Issue Date:

16 OCT 98 Page No.

41 Revision Date:

Revision No.

0

a)

Vibratory feeder fails, allowing bridging. IE# RHD 2. Control ID: A-PEL-x-07.

~

b)

Operator fails to detect buildup of powder or water in hopper. IE# RHD 3.-

Control ID:

A-PEL-x-08.

c)

Enclosure access door (s) not closed properly. IE# MOD 3.

This condition should cause the process control interlock to prevent operation. Control ID: A-PEL-x-% (the same control as in Section 5.3.2.1).

Margin of Safety The nuclear criticality margin of safety has been evaluated to be very strong for this system. The neutron multiplication factor (km) has been calculated to be s 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take k,2: 1.00.

- The parameters tha' directly affect neutron multiplication, assuming 5.0 wt.% 2"U t

enriclunent, are mass (controlled by level) and moderation. Criticality safeny limits (CSLs) and Bounding Assumptions (BA) are established for mass and moderator. A criticality (k, = 1.00) could be possible only given the following upset condition-A sufficient mass (full hopper, i.e., more than 114.7 kg UO ) accumulates in 2

the hopper such that it forms a nonfavorable geometry, and the powder becomes optimally moderated (more than 48.4 liters H O).

2 r

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS i

(a) Group 1 Defense Elements (IE#s RHD 1-3: Geometry Defenses)

(a.1)-

IE #RHD 1 Level Probe Fails to Stop Fill Operation 4

This event assumes that the powder sensing level probe in the hopper fails to stop the fill operation when it senses powder as designed, so that powder continues to accumulate in the hopper, filling the hopper and potentially also eventually spilling over into the enclosure bottom.

- The probe elevation in the hopper is such that only one pan of powder at a time is allowed to be dumped. As the powder flows through the compactor, and drops below the probe, the system allows the elevator to send another pan of powder up. Volume in the hopper is approximately 57 liters. A single overfill incident, caused by a failed level probe, would not

- result in greater than a minimum critical mass in the hood, as long as the operator regularly inspects and cleans out the hood as required.

Possible causes include:

Level probe failure e

Initial Issue Date:

16 OCT 98 Page No.

42

- Revision Date:

Revision No.

O

Electrical failure of supporting equipment Interlock failure Consequences of this event occurring:

Powder accumulation in the hopper and enclosure Defenses designed to prevent this event from occurring:

Level probe is reliable instrument Operator training e

Procedural compliance Operators periodically verify operation Independent residual defenses:

IE #RHD 2 Vibratory feeder IE #RHD 3 Operator detects IE #RHD 4 Batch counter interlock e

Moderator defense (a.2)

IE #RHD 2 Vibratory Feeder Fails to Operate This event assumes that the vibratory feeder mounted on the hopper fails, which might cause powder to bridge across the opening at the bottom. Successive cycles could fill the hopper to n nonfavorable geometry.

Possible causes include:

Electrical or mechanical failure Consequences of this event occurring:

UO2 Powder bridges across opening, and may accumulate in hopper i

- Defenses designed to prevent this event from occurring:

Operators take material off granulator Operators monitor feeder operation e

Independent residual defenses:

' IE #RHD 1 Level probe IE #RHD 3 Operator detects IE #RHD 4 Batch counter interlock Moderator defense e

(a.3)

IE #RHD 3 Operator Fails to Detect Powder Accumulation in Hopper This event assumes that the operator fails to realize that material is accumulating in the hopper. This would be evident to him because the pack in the roll hood would not fill.

Initial Issue Date:

16 OCT 98 Page No.

43 Revision Date:

Revision No.

0 l

_~

I Possible causes include:

Operator attention diverted elsewhere on line Shift change -

e Inadequate training e'

Consequences of this event occurring:

Powder fills the hopper after approx. sixth dump Defenses designed to prevent this event occurring:

. Operator training Independent residual defenses:

IE #RHD 1 Level probe l

IE #RHD 2 Vibratory feeder IE #RHD 4 Batch counter interlock Moderator defense e

(a.4)

IE #RHD 4 Batch counter interlock fails (process control - not SS)

Possible causes include:

Sensor failure Circuitry failure e

Consequences of this event occurring:

Accumulation of powder in the system l

Defenses designed to prevent this event from occurring:

Batch counter interlock Independent residual defenses:

IE #RHD 1 Level probe IE #RHD 2 Vibratory feeder e

IE #RHD 3 Operator detects e

Moderator defense (b); Group 3 Defense Elements (IE#s MOD 1-4: Enclosure Moderation Defenses)

[ Note: These events are essentially identical to those for the powder lift.]

l.

(b.I)

IE # MOD 1 Moderator (water) becomes available from source outside l

enclosure This event assumes that water becomes available to the enclosure from some source outside the' enclosure. Possible sources include: rain water leaking through the roof,

' Initial Issue Date:

16 OCT 98 Page No.

44 Revision Date:

Revision No.

O

L l-air conditioning duct condensation, and water lines v hich nm overhead.

Possible causes include:

Leaky roof Failed cooling water piping 1

Failed city water piping e

Consequences of this event occurring:

Significant water available. to enclosure (greater than the safety limit) j E.

Defenses designed to prevent this event occurring:

Piping integrity.

. Operators present in area

- Roofintegrity i

Independent residual defenses:

IE #RHD 3 operators detect e

IE ~# MOD 2. enclosure doesn't leak e

IE # MOD 3 access doors properly secured e

IE # MOD 4 access doors interlock IE # MOD 5 water does not accumulate in hopper e

Geometry defense e

(b.2)

IE # MOD 2 enclosure leaks This event assumes that the powder lift enclosure leaks at any point..

Possible causes include:

Gaps in enclosure service doors.

l_

Improper sealing of gasket material on access doors e

Material failure of enclosure Hole in lexan windows of access doors Gap in light fixture on base of enclosure e

Consequences of this event occurring:

Airborne problem in area l

Path created for water to enter enclosure -

l.

Defenses designed to prevent this event from occurring:

[

Enclosus inspections / maintenance

~

Independent residual defenses:

F RHD 3 Operators Detect e

~E# MOD 1 Moderator not available I

(

Initial Issue Date:

16 OCT 98 Page No.

45 Revision Date:

Revision No.

O s

t I

IE # MOD 3 Access Doors Properly Secured E

e.

IE # MOD 4 Access Doors Interlock IE # MOD 5 Water does not accumulate in hopper j.

Geometry Defense

'(b.3)-

IE # MOD 3 Containment Enclosure Access Doors Not Properly Secured This event assumes that containment enclosure access doors are not properly installed p

while processing, providing a path for water to enter.

Possible causes include:

l Operator error (doors not closed properly)

[

Doors drift open e

. Operator fail to shut door Consequences of this event occurring:_

Airborne problem in area e

Path created for water to enter enclosure l.

Defenses designed to prevent this event from occurring:

j Enclosure inspections / maintenance e

i L

- Independent residual defenses:

IE #RHD 3. Operators Detect IE # MOD 1 Moderator not available i

IE'# MOD 2 Enclosure Doesn't Leak e

L IE # MOD 4 Access Doors Interlock e

IE # MOD 5 Water does not accumulate in hopper Geometry defense e

.(b.4)

IE # MOD 4 Containment Enclosure Access Door Interlock failure This event assumes that operators have installed an access door improperly, and the containment enclosure access door interlock fails.

Possible causes include:

l Contact switch failure e

l

' Door misalignment during installation Consequences of this event occurring:

Airborne problem in area -

Path created for water to enter enclosure i;

Initial Issue Date:

16 OCT 98 Page No.

46

[

Revision Date:

Revision No.

O i

L L

Defenses designed to prevent this event from occurring:

l ~

Component reliability l.

Operator training

' Training (to keep the slots clear) e g

H

' Independent residual defenses:

e' RHD 3 Operators Detect IE # MOD 1 Moderator available IE # MOD 2 Enclosure Doesn't Leak IE # MOD 3 - Access Doors Properly Secured e-IE # MOD 5 Water does not accumulate in hopper

' Geometry Defense Common Mode Failures -

l.

There is significant common mode failure potential regarding IE# RHD 3.

The required periodic operator inspection should detect either powder accumulation or water leaking into

^

the enclosure. The risk is considered acceptable because of 1);

Operator training, including sensitivity to past incidents.

2)

Documented inspections.

3)

. Good visibility into the enclosure.

4)

The strength of the other controls, including SS interlocks.

5)

Any sources of moderator are expected to be readily detected.

6)

Any water getting into the roll compactor hopper should past, down through the rollers, the granulator, and out into the roll hood, i.e., it is not expected to be able to collect in the hopper.

Summary Tables - see Table 5.3.2.2-1 and 5.3.2.2-2.

L Initial Issue Date:

16 OCT 98 Page No.

47 Revision Date:

Revision No.

0

Table 5.3.2.2-1:

Sununary of Defenses Provided Against a Single Failure for the Roll Compactor llopper Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React cWup

'GEOMETRYJDEFENSE =,

Hopper fills with powder RHD 2 RHD 1,4 RHD 3 Moderator Defense MODERATOR DEFENSE Moderator available from

Thisi scensriolis determined 16 beinoticredibis. iThe ;enclosureils{ai moderation ~ control" area,-J sd the containeis are under modhration control.

internal source a

Moderator available from MOD MOD 4 Geometry Defense external source 1,2,3,5 RHD 3 NOTES:

1)

See Section 5.3.2.2.12 for a discussion of common mode failure potential.

Initial Issue Date:

16 OCT 98 Page No.

48 Revision Date:

Revision No.

O

Table 5.3.2.2-2: Nuclear Criticality Safety Limits for kerr = 0.90, 0.95, and

{

Delayed Critical Roll Compactor Hopper l

1 4

l

PARAMETER.:
NORMALL L BOUNDING:
CRITICALITY! s CRITICALITY <

i CRITICALITY <

'f5

. C'ONDITIONS

' LIMIT c

. LIMIT.

Delayed :

. OPERATING '

ASSUMITION

. SAFETY:

nSAFETY

' LIMIT *,

' s 0.90 i

~ s 0.95-

' Critical i

- (0.98);

235U MASS Approx.

69.3 kg UO2 90.3 kg UO 106.3 kg UO 2

2 38 kg UO, MODERATOR /

s 0.3 wt. %

Optimum 29.3 liters 110 38.1 liters 1I 0 44.9 liters 110 2

2 2

CONCENTRATION moisture GEOMETRY Approx.

11.0 inches 12.5 inches 13.5 inches 8 inches SPACING N/A N/A N/A N/A N/A Ilomogeneous -

l DENSrrY Optimum i

t.9447 gUO2/cc ABSORBERS None None None None None ENRICilMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

l REl LECTION Partial Water j

(l")

I Notes

)

1) See Section 5.3.2.2.11 of CSE.
2) Mass during normal operation is up to approx. 38 kg UO (level probe height plus one batch) 2
3) Volume / geometry during normal operation is approx. 8" height in hopper (probe height vol, plus 9 liters)
4) The heights for 0.98,0.95, and 0.90 were actually a little higher, but were rounded down to the next lowest j

%" for conservatism.

Initial Issue Date:

16 OCT 98 Page No.

49 Revision Date:

Revision No.

0

.m m_

___..=.-_.-.m.__.

_. -... ~. _ _ _ _ _ _ _

FIGURE 6.3.2.2-1 FAULT TREE FOR PELLET ROLL COMPACTOR HOPPER Po

"%"Of""

WooERATOR, AfeotoMETRY I

I I

l

" '"^'a

,'r#,T

-E

=

c Z" aa*

OEFRNSE EM00ti 6 Moo 6 h a MMD 3 l A

mTER

<d.Aata wA or to WATER ACCUAAA.ATES OPERA OAS % TQ y c gg MAT Fus 6, ;..

=

Q edTEofuYY A PEL X48

=== > l

. =.1 88l:sf u..

d., To 2T_o Yn,'o.$m$

' ~

T'L To',@ XiL"Ti.

g Au a i-o-o

.To,on -

h h

4>

APEL 148

"#I i

Initial Issue Date:

16 OCT 98 Page No.

50 Revision Date:

Revision No.

0

Compaction and Granulation Controls Safety Significant Controls Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# RHD 5.

Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-08.

b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# RHD

6. Periodic verification required. Control ID: P-PEL-x-09.

c)

Water accumulates in hopper.

IE# RHD 9.

Periodic verification is pot required because the hopper naturally drains by gravity down through the granulator, and into the pack being filled, and because any water leaks are l

expected to be readily detectable. Control ID: P-PEL-x-10.

d)

Volume reducer removed. IE# GRA 1. Periodic verification is pot required because of periodic, documented check by operations per COP-820114, and because the granulator hopper will be flagged (as a result of this evaluation) as equipment that contains safety significant components (see IE GRA 1 in Section 5.3.3.12). Control ID: P-PEL-x-11.

Active engineered controls (AEC)

Active Engineered Controls are described in the License and in Regulatory Affairs procedure RA-108.

They are also called safety significant interlocks.

The requirements for functional verification are determined by this evaluation.

l

[None]

Administrative controls with computer or alarm assist (AC)

Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm.

The requirements for functional verification are determined by this evaluation.

[none]

Administrative controls i

Initial Issue Date:

16 OCT 98 Page No.

51 Revision Date:

Revision No.

O

l l

l' Safety Significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or some other record.

Functional verification is n_ot normally required.

o i

L a)

Operators fail to detect accumulation of powder or moderator. IE# GRA 2.

l Control ID: A-PEL-x-03.

b)

Powder lift enclosure access door (s),1 or more, not closed properly. IE# RHD

7. This condition should cause an interlock to prevent operation of the lift (see

-1 IE# RHD 8 below). ControlID: A-PEL-x-04.

l Margin of Safety The nuclear criticality margin of safety for the granulator hopper is evaluated to be l

strong. Calculations performed in support of this CSE indicate that k,y s 0.95 for all normal conditions and expected process upsets.

The parameters that directly affect neutron multiplication for the granulator hopper, assuming 5.0 wt.% "U enrichment, are moderator and geometry.

That is, the 2

geometry of the hopper must become nonfavorable by removal of the volume reducer inside, and it must be filled with UO powder at optimum moderation. Criticality 2

l safety limits (CSLs) and bounding assumptions (bas) have been established to prevent i

the removal of the volume reducer, and the introduction of moderator. A criticality I

would be possible in a granulator hopper given the following process upsets:

Volume reducer is removed and not detected, and the hopper is filled with UO e

2 l

powder at optimum moderation.

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS The fault tree in Figure 6.3.3-1 shows potential initiating events (IE's) that could lead to criticality, and the backup or residual defenses that provide protection should the initiating event take place. The discussion below briefly describes the event, and provides supplemental information regarding the fault tree.

IE GRA 1 This event assumes that the volume reducer is removed from the granulator hopper.

l This event alone constitutes a contingency, in that it renders the hopper a nonfavorable L

geometry. As a result of this evaluation, this piece of equipment will be flagged in l

MAPCON as containin3 safety significant (SS) components. This means that if any maintenance is performed on the granulator hopper, the work order will include an "SS" flag, and a warning that functional testing may be required prior to returning the i

I Initial Issue Date:

16 OCT 98 Page No.

52 Revision Date:

Revision No.

0

equipment to service. This, plus the periodic, documented inspection during operation makes it highly unlikely the equipment would be operated without the volume limiter properly installed.

IE GRA 2 This event assumes that the operator fails to realize that moderator is accumulating in the hopper.

IE GRA 3 This event postulates that the batch counter interlock (non-safety significant) fails.

IE RHD 5 This event assumes that water becomes available to the enclosure from some source outside the enclosure.

IE RHD 6 This event assumes that the enclosure integrity fails, allowing leaks into the enclosure, e

IE RHD 7 This event assumes that containment enclosure access doors are not properly installed while processing, providing a path for water to enter.

IE RHD 8 This event assumes that the containment enclosure access door interlock (non-safety significant) fails, and would not stop the process if all doors were not installed properly.

IE RHD 9 This initiating event assumes water accumulates in the granulator hopper. As the granulator is open through an 8 mesh screen, water would drain by gravity into the roll hood below, a passive engineered control.

Common Mode Failure There is significant common mode failure potential regarding IE# GRA 2, which appears in both the geometry and the moderator branch of the fault tree. The required periodic operator inspection should detect either powder accumulation or water leaking Initial Issue Date:

I6 OCT 98 Page No.

53

. Revision Date:

Revision No.

O

into the enclosure. The risk is considered acceptable because of:

1)

' Operator training, including sensitivity to past incidents.

2)

- The inspections are documented.

3) ~

Good visibility into the enclosure.

4)

. The strength of the other controls, including passive engineered controls and process control interlocks.

5)'

Any sources of moderator are expected to be readily detected.

6)

Any water getting into the granulator should pass by gravity through the screen, and out into the roll hood, i.e.,-it is not expected to be able to collect in the

. hopper.

Sununary Tables - see Table 5.3.3-1 and 5.3.3-2.

Initial Issue Date:

16 OCT 98 Page No.

54 Revision Date:

Revision No.

O i

Table 5.3.3-1 Summary of Defenses Provided Against a Single Failure for the Granulator Hopper Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

l l

React React

^

MODERATOR DEFENSEt Moderator available from This scenario is determined to be not credible. The enclosure is a internal source moderation control area. and the containers are under moderation control.

Moderator available from RilD RHD 8 Geometry Defense external source 5.6.7,9 GRA 2

GEOMETRY. DEFENSE :

l Volume Reducer Removed from

"'** ' * *"S*

GRA 1,3 GRA 2 l

Hopper l

l NOTES:

1

!)

See Section 5.3.3.12 for a discussion of common mode failure potential.

2)

Undetected removal of the volume limiter, rendering the granulator hopper non-favorable geometry, is highly unlikely. It would require multiple failures of rigorous administrative controls.

Initial Issue Date:

16 OCT 98 Page No.

55 Revision Date:

Revision No.

O

Table 5.3.3-2: Nuclear Criticality Safety Limits for k, = 0.90, 0.95, and Delayed Critical Granulator Hopper

' fPARAMETERS NdRMAL~

.-BOUNDING L tCRITICALITY

CRITICALITY

' CRITICALITY $

h t h [, '('<

IOPERATING.

. ASSUMITION, iSAFETY

SAFETY.'

. LIMIT) 2

+

lCONDITIONSh LIMIT:

? LIMIT 1 'r Delayed Critical-4 s 0.75:

i s 0.90; 5 0.%5 :

= 2 LOO T 2350 MASS Not Not Hopper Hopper Controlled Controlled Filled Filled MODERATOR /

s 0.30 wt. %

Optimum Optimum Optimum j

CONCENTRATION moisture Favorable Favorable Favorable GEOMETRY Volume Volume Volume Reducer Reducer Reducer Installed Installed Removed SPACING N/A N/A N/A N/A l

Approx.

Optimum Optimum Optimum DENSITY 4-5 g/cc (H/X = 250)

(H/X = 250)

(H/X = 250)

(dry) 1.9447 1.9447 gUO2/cc 1.9447 gUO2/cc gUO2/cc ABSORBERS None None None None ENRICHMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

Partial Water Partial Water Partial Water Partial Water REFLECTION (l")

(l")

(l")

(l")

NOTES:

1)

See CRI-97-018 and Section 5.3.3.11.

Initial Issue Date:

16 OCT 98 Page No.

56 Revision Date:

Revision No.

O

l l

i FIGURE 6.3.3-1 l

FAULT TREE FOR GRANULATOR HOPPER 1

i f

CRITICAUTY POSSIBLE l

l

< CRmCAUTY PRECURSOR >

i i

i GREATER THAN THE SAFETY l

UMITS OF MODERATOR AND GEOMETRY i

I I

MASS MODERATOR CONFIGURATION DEFENSES DEFENSES FAL DEFENSES FAL pg N/A

$REATER1h40$hE $4P3MWj t _ _.

- - ^ "j

,H NO CONTROLS

,T 6 OMATER (32 LNERet M '1 (epaulggp_,,[_i[]{yg ON MASS gg(ACCUUUL4p g g j DURING NORMAL OPERATIONS

/A l

IE GRA 1 l

IE GRA 2 IE GRA 3 VOLUME REDUCER OPERATOR F AILS TO BATCH COUNTER REMOVED DETECT NTERLOCK

,.m,

>,..,w 8

+

o COP-820114 P.PEL-X-11 APEL X-03 i

i l

l Initial Issue Date:

16 OCT 98 Page No.

57 Revision Da',e: _

Revision No.

O

FIGURE 6.3.3-1 (Cont'd)

FAULT TREE FOR GRANULATOR HOPPER

  1. Wf60fCT$ll>Yt4CY

.EE,~}?,,

d_a l GREATER THAN THE SAFETY TiyAOF WATEly(32 LITER 8)iR/Mi igjMMIESINHOPMMQ s

IE RHD 5 l l

IE RHD 9 l IE GRA 2 l WATER AVAILABLE WATER GETS INTO WATER ACCUMULATES OPERATOR FAILS TO FROM OUTSIDE ENCLOSURE AROUND IN HOPPER R

. O)

PEC P-PEL-X-08 P-PEL-X-10 COP-820114 IE RHD 6 I I

TRAINING, & WORK PPACTICE ENCLOSURE ACCESS DOORS A-PEL-X-03 INTEGRITY FAILS ALLOW WATER INTO ENCLOSURE PEC P-PEL-X-09 IE RHD 7 l IE RHD 8 ACCESS DOORS NOT ACCESS DOORS PROPERLY INSTALLED INTERLOCK FAILS h

COP-820114 A-PEL-X-04 Initial Issue Date:

16 OCT 98 Page No.

58 Revision Date:

Revision No.

0

l l

l PELLET PRESS l

In terms of criticatay safety, the amount of uranium powder in the pellet press dies is not of concern. The potential concern with the press operation is the moderator L-(lubricant and hydraulic fluids) present, and the possibility of accumulation of the moderators in combination with the accumulation of powder in the collection l

containers, i

There are two larger collection containers. -The primary sump, an approx.15 liter favorable geometry container, is the main collector for any oil or hydraulic fluid inside j

the press. It is normally drained by use of a drain plug on the back of the machine.

[

Should the primary sump fill and overflow via the slots, the fluid will run horizontally out the back of the press via an access hole, and down into a drainage pan under the press, thus eliminating the possibility of fluid buildup inside the press. The drainage pan is approx.1" deep, and sits on the concrete floor. Any overflow into the drainage pan is readily detected by the operator.

There are passive engineered controls, administrative controls and process limitations

'in place which render a criticality not credible. The favorable dimensions of the l

collection containers are the passive engineered controls. The administrative controls consist of a required, documented weekly inspection of the primary sump. Cleanout is l

required if the depth of powder / oil sludge exceeds approx. 0.5" thickness. There is l-also a required, documented inspection and cleanout of the upper portion on the press at the end of shift. COP-820206.

Concerning the process limitations, the design of the press precludes addition of

. uranium powder to lubrication or hydraulic reservoirs or sumps. Material collected during sump cleaning is sent to the-Analytical Services (Chemical) Laboratory for analysis of the uranium content. Evaluation had determined that the small surface accumulation of powder on internal gears, which in turn become deposited in the lubrication, is less than 5000 ppm. This very small presence of uranium in the oil means that the powder which does make it into the sump is extremely over-moderated, and therefore poses no threat to nuclear criticality.

At the boat loader, the operations are performed in a large, rectangular ventilated hood.

The right side of the hood contains machinery to accomplish the boat loading; because of the equipment and the manner in which the pellets are handled, it is not credible for significant quantities of uranium to accumulate in this portion of the hood. In the left side, the pellets are loaded onto a movable plate / table, under which there is a pan approx.1.5" deep. Under the table and pan is the bottom of the hood, with a hole through which the pellets are lowered into the boats below. The opening is framed 2

with a raised lip about 5/8" high, and is sloped toward the opening on one side.

j Procedure calls for cleaning the pan'and hood bottom each shift. If material were i

~

Initial Issue Date:

16 OCT 98 Page No.

59 Revision Date:

Revision No.

0 l

i

~

~

.. _ -. ~.

allowed to accumulate, it would spill out the bottom opening before reaching a safe slab height; any excessive accumulation would also be expected to interfere with process operations. Also, any water in the left side on the hood would likewise run out the bottom opening.

Nuclear critice ty.in tb pellet press and boat loader is judged to be not credible.

n Double Contingt tcy is not required, and no fault tree is provided.

No further evaluation is required.

It is noted that a previous evaluation was made of-the potential accumulation of SNM and oil in the pellet presses after an incident at another fuel fabricator. Most of the data presented in this section is from that evaluation.

SINTERING FURNACE The pellet sintering furnace is a very high temperature furnace through which favorable geometry, favorable volume molybdenum containers (" moly boats") filled with

" green" uranium pellets are processed. In the furnace, the green pellets sinter into ceramic UO2 Pellets. The furnace is essentially solid-brick' construction, with a small chamber through which the boats pass. The boats are pushed into the chamber at regular internals, with one boat exiting as another is pushed in. Residence time in the furnace is on the order of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The furnace high heat chamber cross-section is irregularly shaped, with the boats riding.

l in an elevated hearth plate. The high heat chamber sides are occupied by the heaters.

Pre-heat chamber length varies with furnace design. Overall chamber length is approx.

25 ' feet.

Evaluation has determined that though nonfavorable in dimension, the chamber is essentially a hood through which a favorable diameter-equivalent infinite

. cylinder of pellets travels. The entering boats are filled to the top with green pellets (approx. 60% theoretical density), with no mounding of pellets above the boat top edges. Boat size is approx. 4" ID high. Material exit density is over 90%, reducing the fill height of pellets in the boat by about 1/3, i.e.. to a height of approx. 2 2/3".

The boats move slowly, and occasionally a few pell,:ts spill out. The moly boats are inspected regularly for integrity and serviceability. Should a boat rupture inside the-l furnace, the resulting spill would cause a potential am inside the chamber, which J

would be detected immediately. The pixess would be stopped and the jam cleared.

. The longitudinal cross-section dimension of the boats in the furnace is approx. 9" x 4" high. This gives an equivalent cylinder diameter of 6.77".

Thus even if the boats were assumed to be full of >90% density pellets, the equivalent radius is significantly less than the MPV diameter (8.4") for 5.0 wt.% enrichment UO2 Pellets. The actual equivalent diameter is approx. 5.53" because the >90 wt.% pellets only occupy a fill height of approx. 2 2/3".

l

' Initial Issue Date:

16 OCT 98 Page No.

60 l

Revision Date:

Revision No.

O L

- - - -. ~..

Another measure of the margin of safety can be made by assuming an infinite X-Y slab of pellets at the height of the >90 wt.% pellets in the boats (approx. 2 2/3"). This height is well below the MPV slab height of 3.5" (UO Pellets at 5.0 wt.%

2 enrichment).

It was determined that there is no credible source of moderator available to the furnace chamber during operation, i.e., when pellets are in the chamber. If any water did enter the furnace, the process temperature is well above 1000 degrees Centigrade, which will

']

cause immediate vaporization into steam (a readily detectable condition).

Therefore is was concluded that nuclear criticality is not credible for the sintermg furnaces. Double Contingency is not required, and no fault tree is provided. No further evaluation is required.

GRINDING l

The grinder itself is clearly not a criticality safety concern. The feeder bowl, a batch added, favorable volume <3 inch high lipped dish, which vibrates to feed pellets into the linear vibrating conveyor to the grinder, is also not a criticality concern.

The recirculation surge tank, also called the coolant tank, is a 10.0 inch outer diameter, 20 inch long cylinder with various inlet and outlet pipes and connections. It is a bounding assumption that any uranium in the tank can be considered homogeneous.

Therefore the surge tank is favorable diameter.

The remainder of this section presents evaluations for the following:

Grinder centrifuge e

Collection chutes and packs under the grinder bowl feeders and under the grinder exit to the tray loaders Centrifuge The process upsets which are required for a criticality to be possible in the centrifuge bowl / housing are not credible. However, there are controls in place to give added margin of safety. These controls are discussed below, but no fault tree has been prepared.

' Controls l

The control for the centrifuge is the geometry / configuration of the centrifuge bowl. Controls l

that provide additional margin of safety are discussed in " Summary of Initiation Events..."

i below.

Initial Issue Date:

16 OCT 98 Page No.

61 Revision Date:

Revision No.

O i-

Margin of Safety The nuclear criticality margin of safety. for the grinder centrifuge has been evaluated to be extremely strong. The neutron multiplication factor (K,y) has been calculated to be

' 50.95 during normal operations and expected process upsets. No single process upset will take K,y ;t 1.00.

Technically, the centrifuge is a single parameter system, with geometry (mass accumulation) being the sole' parameter that directly affects neutron multiplication, assuming 5.0 wt.% zuU enrichment. The bowl and housing are favorable geometry, i

but accumulation above the lip of the bowl is nonfavorable. Assuming not credible events to occur, a criticality could be possible only given the following upset conditions:

Bowl and housing fill above the lip of the bowl e

Sunanary Of Initiating Events Which Lead.To Credible Process. Upsets For The Grinder Centrifuge These initiating events are provided for information only, to illustrate the size of the margin of safety for the centrifuge. There has never been a situation where the housing has filled with solids. Since the bowls were downsized several years ago, and the 150 tray counters were installed, there have been no incidents where a bowl has been filled completely with solids (a)' Group 1 Defense Elements (IE#s CEN 1-3: Geometry Defenses)

(a.1)

IE #CEN 1 Operators fail to clean out bowl after 150 trays This event assumes that the operators fail to stop grinding after 150 trays and clean out the bowl. There is a counter that stops the grinder after 150 trays have been ground. The operators by procedure are required to clean the boM before resetting the counter and continuing the grinding operation. They are also required to enter in their log that the bowl has been cleaned.

Possible causes include:

Counter circuitry failure Procedural violation (operator resetting counter and not cleaning out bowl)

Consequences of this event occurring:

Centrifuge accumulates more sludge Possible overload of bowl Initial Issue Date:

16 OCT 98 Page No.

62 Revision Date:

Revision No.

0

1 Defenses designed to prevent this event from occurring:

Operator training

~

. Independent residual defenses:

Obvious indications that bowl is overloading Process limitations that prevent bowl and housing from filling above lip of bowl t

(a.2)

IE #CEN 2 '. Failure of Interlock to Stop Grinder if ' Centrifuge Stops Spinning This event assumes that the centrifuge stops spinning due to electrical or mechanical malfunction, and the grinder continues to operate.

Possible causes include:

Electrical or mechanical failure Consequences of this event occurring:

Centrate enters centrifuge

. Sludge settles out in bowl Recirculation water becomes noticeably dirty Defenses designed to prevent this event from occurring:

Operators monitor centrifuge operation

' Operators detect filmy pellets

' Independent residual defenses:

Process limitations that prevent bowl and housing from filling above lip of bowl (a.3)-

IE #CEN 3 Operator Fails to Detect Centrifuge Malfunction This event assumes that the operator fails to detect that the centrifuge has stopped spinning.

Possible causes include:

Operator attention diverted elsewhere on line Shift change Inadequate training Consequences of this event occurring:

Sludge settles in bowl

' Defenses designed to prevent this event occurring:

Operator training Initial Issue Date:

16 OCT 98 Page No.

63 Revision Date:

Revision No.

O

Independent residual defenses:

  1. CEN 2 Interlock stops grinder if centrifuge stop:: spinning No potential common mode failures were identified.

Summary Tables.see Table 5.3.6.1-1.

Table 5.3.6.1-1:

Summary of Defenses Provided Against a Single Failure for the Grinder Centrifuge Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React GEOMETRY DEFENSE Bowl d

housing fill 1,2 3

It is not credible that the bowl or completely (above lip of bowl) housing area would fill with with sludge sludge above the lip of the bowl.

Collection Chutes Under Grinder Feeder Bowls and Tray Loaders

' Underneath the bowl feeder to each grinder is a collection chute leading to an 8" dia. poly pack in the event pellets or chips fall from the feeder. Lines 1-4 packs are inside an approx.

14" x 14" x 14" ventilated enclosure. The Line 5 pack sits in a favorable diameter (9"),

close-fitting enclosure, and also has a level probe / proximity switch (active engineered control) at the top of the pack. Activation of the level probe stops the bowl feeder, the vibratory feeder for the inlet and outlet of the grinder, and the vibratory track feeding the tray loader.

Line 5 only also has a collection chute under the pellets as they proceed single file from the grinder to the tray loader. The pack sits in a favorable diameter, close-fitting enclosure (9"),

and also has a level probe / proximity switch (active engineered control) at the top of the pack.

Activation of the level probe stops the bowl feeder, the vibratory feeder for the inlet and outlet of the grinder, and the vibratory track feeding the tray loader; it also stops the centrifuge and the coolant pump.

Controls Safety Significant Controls There are three types of safety significant controls identified and required in this evaluation.

Passive Engineered Controls Initial Issue Date:

16 OCT 98 Page No.

64 Revision Date:

Revision No.

O

. Passive engineered controls are described in' the License and in' Regulatory Affairs procedure RA-108. The requirements for functional verification are determined in this

- section.

a)

Favorable diameter collection pack fails. IE-4. Periodic verification is not required i.,

because of the frequent operator inspections. Control ID: P-PEL-x-17.

b)

The roof, overhead pipes, etc., provide integrity to prevent sources of moderator.

IE-5. Periodic verification is not required because any leaks are readily detected and corrected during normal process operations. Control ID: P-PEL-x-18.

c)

System covers etc., prevent water from entering collector chute. IE-6. Periodic verification is not required because sources of moderator are readily detected, overfilling the pack should cause water to run out onto the floor (enclosure not water-tight), and because of continuous operator attendance. Control ID: P-PEL-x-19.

d)

Gap between top of pack and the bottom of the chute permits overflow of any L

liquid. IE-7. Periodic verification is not required because of the fixed geometries involved. ControlID: P-PEL-x-20.

Active Engineered Controls Active Engineered Controls are defined in the License and in RA-108. They are also called safety significant interlocks. The requirements for functional verification are determined in this section.

a) Interlock to stop cperations when pack filled level is detected. IE-8. Either material (pellets / chips) or water will activate the interlock.

Periodic verification is required.

Control ID: PEL-x-09.

Administrative Controls with Computer and/or Alarm Assist Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm or visual indication. The requirements for functional verification are determined by this evaluation.

[None]

Administrative Controls Safety significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may l

require documentation via Control Form or some other record. Functional verification is not L

normally required.

l l

l Initial Issue Date:

16 OCT 98 Page No.

65 Revision Date:

Revision No.

O

a)

Configuration control of bowl' feeder fails.

IE-1.

Periodic verification is not required because of configuration controls procedures, continuous operator L

attendance, training, and work practice. Control ID: A-PEL-x-09.

l b)

Operator fails to detect and correct before pack fills with pellets / chips (or L

moderator)., IE-3.

Periodic verification is not required because of continuos operator attendance, training, and work practice. ControlID: A-PEL-x-10.

I Margin of Safety i

The nuclear criticality margin of safety for the collection chutes has been evaluated to be strong. The neutron multiplication factor (k,y) has been calculated to be s 0.95 during normal operations and expected process upsets. No single process upset will take k,,2: 1.0.

Criticality could be possible only given the following upset conditions:

I The pack and chute fill with pellets / chips to a level above the pack such that in excess of e

the safety limit for mass (64.0 kg UOJ accumuk...s, an. fill with water above the pack to d

a level in excess of the safety limit (32.8 liters), or For Lines 1-4 only, the ventilated enclosure fills with pellets / chips to a level such that non-e favorable geometry is achieved and the material becomes fully moderated interstitially.

Summary Of Initiating Events Which Lead To Credible Process Upsets For The Grinder Centrifuge l

The fau

o in t.gire 6.3.6.2-1 shows potential initiating events (IE's) that could lead to criticality, and the backup or residual defenses that provide protection should the initiating event take place. The discussion below briefly describes the event, and provides supplemental information regarding the fault tree.

  • IE-1 The configuration of the bowl feeder is administratively controlled by procedures TA-500 and RA-104. Failure of these controls could lead to installation of a feeder bowl that causes an L

excessive number of pellets to fall into the collector chute.

IE-2 (deleted)

-e IE-3 Operations is required to check, empty, and record material in the pack. Currently this frequency is each shift, although the frequency may be changed as required.

l l

Initial Issue Date:

16 OCT 98 Page No.

66 Revision Date:

Revision No.

O

~. _

i l

A recent incident' gives good information regarding the rate of fill in the collection pack l

. should a ' process upset occur.

The bowl feeder had been replaced without proper j.

configuration control. ' The rate of accumulation of pellets was as high as approx.1" pack l

level (approx. 5.9 kg UO ) Per shift; this probably can be considered as near the maximum 2

credible process upset condition that can be experienced. Under these conditions, it would l

take more than approx.12 shifts of undetected abnormal operation before the criticality safety 1

limit for mass could be accumulated. Under normal operation, the accumulation in one shift

' should not be more than one layer of pellets in the pack, and usually less than this.

I l

Currently there is a requirement for a documented inspection and cleanout of the co!!ection pack each shift of operation. If this control is executed properly, it is a-very strong control, albeit' administrative, to prevent accumulation of uranium (or moderator) in the collection pack and chute.

l Further, it is noted that as a result of the Root Cause Analysis for the incident, alternatives are l

being evaluated to replace the above purely administrative control with an engineered control.

  • IE-4 This event postulates that the favorable geometry collection of material is vichted by

- overfilling the pack; it is possible for the material to then back up into the chute and achieve non-favorable geometry. Also see CSE Section 5.3.6.2.11 for a discussion of failure to replace the pack in the ventilation enclosure, e IE-5 IE-5 postulates that there is an source of water external to the enclosures around the system.

e IE-6 i

The bowl feeder has a metal cover over the vibratory feeder and the chute below. It only l

partially protects the inside, including the collector chute, from overhead leaks, etc., because of the opening to accommodate pans of pellets being input to the feeder. Also, the tray loader l

queue on Line 5 is not protected from overhead leaks.

. IE-7 Gap between a of pack (8" dia.) and the bottom of the chute (2"-4" dia.) permits overflow of l

any liquid. Additionally, some lines have a vertical distance between the top of the pack and the bottom of the chute of up to approx.1". This event postulates that this natural overflow somehow does not work, or that is does work but the enclosure does not leak, i.e., fills up with liquid.

'Bulletin 91-01 Notification, Data Pack N98 04, August 19,1998.

Initial Issue Date:

16 OCT 98 Page No.

67 Revision Date:

Revision No.

0

It is noted that if the pack is under the chute opening, the pellets will back up into the chute, rather than spilling into the enclosure. This is what occurred in the incident referenced in IE-3 above. In a 14" x 14" enclosure, it is possible, but unlikely, for an 8" pack to be mis-positioned such that pellets do not fall into the pack.. If this situation occurs, the evaluation defaults to the pack-not-replaced scenario in CSE Section 5.3.6.2.11.

. IE This event postulates that the pack filled interlock somehow fails, and does detect either material or water when the pack fills. IE-8 is only applicable to Line 5.

Potential Common Mode Failures Common mode failure potential exists for IE-8 and IE-3 in that the level interlock and the administrative inspections will detect either material (uranium) or water, and therefore appear in both the geometry and the moderator branches of the fault tree. This risk was determined acceptable because:

a) The frequency of occurrence, both for uranium or water accumulation, is not likely, b) There are frequent, documented checks by operations, and c) Any water that did fill the pack should then run onto the floor because the ventilation enclosures are not leak tight.

Summary Tables - see Tables 5.3.6.2-1 and 5.3.6.2-2.

i i

i l

l i

i

?.

Initial Issue Date:

16 OCT 98 Page No.

68 Revision Date:

Revision No.

O L

Table 5.3.6.2-1:

Summary of Defenses Provided Against a Single Failure for the Collection Chute and Poly Pack Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React MASS CONTINGENCY Safe Cylinder 1,4 3,8 Moderation Contingency Diameter Fails

---~ ^ --- -~Q.fgg 3;g g;g3 y;y 3p g g q

l BCOKI1NGENCYW 'g> L shbM #$g 5. ^VWe WMii$q-KIN n;

51

!V"AliN Pk$%NTS%LOn Wlh ~ WInti.. N Di$$h ;

Full Interstitial Moderation 5,6 3,7,8 Mass Contingency NOTES:

1. The level probe interlock (IE-8) and administrative control (IE-3) to detect the accumulation of either mass or moderator create the potential for common mode failure.
2. See the end of CSE Section 5.3.6.2.12 for a discussion on common mode failure.

Initial Issue Date:

16 OCT 98 Page No.

69 Revision Date:

Revision No.

O

Table 5.3.6.2-2:

Nuclear Criticality Safety Limits for k,,

= 0.90, 0.95, and Delayed Critical 3 (PARAMETER,

YNORMAL' iCRITICALITY...

... NlllE

.c vBOUNDING f CRITICALIT:

.CRITICALITYf

  1. qdb iOPERATING: lASSUMPTIOi JSAFETY
Y; LIMITl f,.

I' iCONDITIONa L

7N-LIMITc 1 SAFETY

Delayed CriticalJ 2j$W.

Sl Es 0.90 ;

t 1 LIMIT',

"(0.98);

2 s 0.95/

e 235U MASS Very Small 45.6 kg UO 60.7 kg UO 2

2 64.0 kg UO 2

(Note 3)

Amount MODERATOR /

Dry

Optimum, 24.4 liters 29.1 liters 32.8 liters CONCENTRATIO Full Interstitial water r/ater water N

(Note 4)

GEOMETRY s Bottom of 12.13 inches 13.25 inches 14.01 inches (Note 5)

Pack Cova;ed up into chute up into chute up into chute SPACING N/A N/A N/A N/A N/A Heterogeneous DENSITY Sintered UO2 Pellets ABSORBERS None None None None None ENRICHMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

Partial Water REFLECTION (l") except 12" CONC (-

z)

Notes

1) See Section 5.3.6.2.11 and cale note CRI-98-020.
2) For criticality limits if pack not in place, also see Section 5.3.6.2.11
3) Min. mass based upon h/x=575, density of UO =0.9397 g/cc. K,y's vary slightly from 0.90, 0.95, and 2

0.98. See cale acte.

4) Min. volume based upon h/x=200, density of water =0.786 g/cc. K,y's vary slightly from 0.90, 0.95, and 0.98. See calc note.

I

5) Height up into chute based upon min. volume calculations.

Initial Issue Date:

16 OCT 98 Page No.

70 Revision Date:

Revision No.

0 1

l i

l

1 FIGURE 6.3.6.2-1 FAULT TREE FOR GRINDER BOWL FEED CHUTE & PELLET TRAY LOADERS l

l GREATER THAN THE SAFETY LNIT OF MASS AND MODERATOR ACCUMULATE IN COLLECTION PACK & CHUTE EjI 10k 41 Mifi aino > u e m

=::-

A I

l l

IE.4 IE 3 IE.1 PREVENT EXCESSIVE PACK FILLS AT MATERIAL COLLECTED OPERATOR DETECTS &

PACK FILLED SOURCE OF PELLETS NORMAL RATE IN FAVORABLE CORRECTS BEFORE INTERLOCK STOPS FALUNG HTO CHUTE.

GEOMETRY. 8" PACK PACK & CHUTE FILLS OPERATIONS l

PROPER TO 64 0 KG UO2 C

NOTE 2 NOTE 1 E

E TA 500 4 COP-820401 &

d RA104 P PEL A17 COP 829010 (LINE 5)

LINE 6 ONLY 4

2 APEL-F 09 A.PEL-X 10 PEL.Xm J

NOTES.

i

1) FOR CRITICAUTY LMTTS FOR PACK NOT IN PLACE, SEE CSE SECTION 5 3 6 211.
2) ALTHOUQH SHOWN AS AN EVENT TO COMPLETE THE LOOIC OF THE FAULT TREE, THIS IS NOT AN INITIATING EVENT PER SE. IT IS JUST NORMAL OPERATING I

CONDITIONS. FOR WHICH CONTROLS ARE NOT APPLICASLE. SEE lE-3 IN CSE SECTION 5 3 6.212 FOR A DISCUSSION OF PACK FILL RATES 1

3) IE-2 OELETEO.

i I

i l

I 1

1 Initial Issue Date:

16 OCT 98 Page No.

71 l

Revision Date:

Revision No.

O i

i

n.-.

...+-.n..

..+......-..a.

..... ~... _

... - - - _, - -.. ~ ~...

.-,n.,.,

. _,.... ~ - -

l FIGURE 6.3.6.2-1 (CONT'D)

FAULT TREE FOR GRINDER BOWL FEED CHUTE & PELLET TRAY LOADERS i

4 7

l a

e i

5 7

PaEVENT MAFETEY "J' #'Ef

J0%"!#0'#.

'"TR Cae JSL'TL PACK ANCVOR CHUTE l

l l

l l

\\e s u

u u

u

    • 4;;*,' y,JL';;l,

g= gag,,

p

.v reu ecairy

.vmu CO.

e n a ? d'."0eE

"?;

L'" * '"

g lgn "ggy,=;"

o'~~

OF MODERATOR COLLECTOR CHUTE PEC PEC COP 820401 &

P PEL-X.10 P-PEL-X-19 6 42 0 5)

P PEL-X-20 LX Initial Issue Date:

16 OCT 98 Page No.

72 Revision Date:

Revision No.

0

Chemical Safety and Fire Safety Controls

- To be provided in a future Integrated Safety Assessment.

l 4

Initial Issue Date:

16 OCT 98 Page No.

73 Revision Date:

Revision No.

O l

-.