ML20211K819

Rev 1 to Criticality Safety Evaluation License Annex Pelleting

ML20211K819
Person / Time
Site:	Westinghouse
Issue date:	08/31/1999
From:	WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML20211K810	List: ML20211K807 ML20211K819
References
NUDOCS 9909080077
Download: ML20211K819 (76)

Text

O CSE LICENSE ANNEX PELLETING O

O 9909080077 990931 PDR ADOCK 07001151 C

PDR

)

CSE LICENSE ANNEX PELLETING

' TABLE OF CONTENTS TABLE OF CONTENTS i

REVISIONRECORD il Process Summary 1

Environmental Protection and Radiation Safety Controls 15 Nuclear Criticality Safety (NCS) Controls And Fault Trees 15 Chemical Safety and Fire Safety Controls 73 0

I I

1 1 O Initialissue Date:

16 OCT 98 Page No.

i Revision Date:

31 AUG 99 Revision No.

I l

1

CSE LICENSE ANNEX Q

PELLETING V

REVISION RECORD REVISION DATE OF PAGES REVISION NUMBER REVISION REVISED RECORD 1

08-31-99 2,3,9,11, Clarification for passive overflow slot in 23,24,29, favorable geometry collection system 50,58,65, under the bulk container room. Separate 68,71,72 interitsk designation PEL-X-10 for grinder exit vibrator conversion collection pack.

O 1

1 i

i i

o Initial Issue Date:

16 OCT 98 Page No.

ii Revision Date:

31 AUG 99 Revision No.

1

A CSE LICENSE ANNEX Gi PELLETING Process Summary This document describes the normal operation of the ADU Pellet Area process for fabricating uranium dioxide fuel pellets from ceramic grade uranium oxide powders and includes all auxiliary operations.

The pellet fabrication process consists of five basic operations - pressfeed preparation, pellet pressing, pellet sintering, pellet grinding and inspection, and scrap processing.

PRESSFEED PREPARATION Uranium oxide powders, both UO2 and U30s, are delivered to the Pellet Area from the ADU Conversion Area as a blended product that meets the acceptance criteria of the powder product specification MA-PWUOOO (NFP 31036), Uranium Oxide Powder.

The UO2 powder is delivered in bulk blending containers,1750 kg UO2 maximum, or 8 inch diameter polypaks, gQ approximately 10 kg UO2 each, on powder carts. The U30s is delivered in 8 inch diameter i

polypaks, approximately 10 kg U30s each, on powder carts.

In addition, U30s is generated in the Pellet Area in the scrap processing operation. The U30s is packaged in 8 inch diameter polypaks and stored on powder carts or stationary racks in the Pellet Area.

Green scrap powder and pellets are also generated in the Pellet Area. The green scrap materials are packaged in 8 inch diameter polypaks and stored on powder carts or stationary racks in the Pellet Area.

POWDER MIXING AUTOMATED POWDER MIXING UO2 powder is delivered to the Pellet Line from the Bulk Blending Area in the bulk blending container with a powder feeder assembly attached. The bulk blending container is placed in the MODCON room on top of the UO2 vibratory feeder equipped with an inflatable seal. The infiatable seal is inflated to make contact with the bulk container to prevent spillage of powder into the MODCON room r\\

.]

Initial Issue Date:

16 OCT 98 Page No.

1 Revision Date: 31AUG99 Revision No. _1

q A powder batch is prepared by mixing UO2 with U30s recycle and green scrap recycle. A Q

Process Information Form (PIF) issued by Process Engineering specifies the processing parameters for the blend of UO2 powder. The UO2 weight, weight percent U30s, and weight percent green scrap recycle specified on the blend PIF are programmed into the automated powder mixing system PLC by the Process Operator. The automated powder mixing system is started by the Process Operator. UO2 powder is fed from the bulk blending container into the batch weighing hopper. When the correct UO2 weight is obtained the UO2 stops feeding. The PLC-calculates the weight of the first recycle material based on the weight percentage programmed into the PLC and the actual weight of the UO2 in the weighing hopper. The first recycle feeder feeds the recycle into the weighing hopper until the calculated weight is reached.

The process repeats for each programmed weight percent recycle until the batch of UO2 and recycle materials is made. The valve in the bottom of the weighing hopper opens and dumps the batch into the powder mixing blender. The mixing cycle starts when the weighing hopper valve closes. When mixing is completed the valve on the bottom of the blender opens while the mixer is operating. The mixed materials are emptied out of the blender into the powder lift pan underneath. The mixed batch of UO2 and recycle material in the powder lift pan is raised by the powder lift elevator pre-compactor feed hopper and the empty pan returned to the powder mixing hood. A level probe in the pre-compactor hopper controls the maximum amount of mixed material allowed in the hopper. This process step will not initiate unless there is no material detected at the level probe. This operation will repeat automatically, the normal mode of operation, or on request by the Process Operator, in the manual operation mode, when the emptied powder lift pan returns and is positioned under the blender. When in s

,),

the automatic operational mode, the powder batching, mixing, and delivery to the pre-compactor hopper will repeat automatically until powder is detected by the powder level probe in the pre-compactor hopper. The process will stop and hold until the powder level in the pre-compactor hopper is below the powder level probe. This process sequence is controlled by the PLC.

Ventilation of the MODCON room for the bulk container, recycle hood, powder mixing hood, and powder lift elevator is provided by a dust collector.

The Process Operator is required to routinely visually check the MODCON room powder collection system, green scrap recycle mill hood, recycle feeders, and top and bottom interior of the powder lift elevator enclosure for powder leaks and/or accumulations. The checks are documented on a controlled form.

Four active engineered safety significant controls (interlocks) exist in the MODCON room l containing the bulk blending container to prevent and/or detect powder spills. A low seal pressure on the inflatable seal between the UO2 feeder and the bulk container is interlocked via a pressure switch to stop the feeder on the bulk blending container, close the valve in the bulk container feeder, stop the UO2 feeder, and sound an audible alarm. The same interlock actions occur if high air pressure to the inflatable seal is detected via a second pressure switch. The i

same interlock actions occur if a powder leak / spill is detected via powder accumulation in a collection container with a level probe located below the MODCON room. The fourth l l

Initial Issue Date:

16 OCT 98 Page No.

2

' Revision Date: 31AUG99 Revision No. j

{

interlock action prevents the. inflatable seal from inflating unless the bulk container is in position on top of the UO2 feeder, preventing damage to the seal during bulk container handling.

One passive engineered safety significant control exists in the MODCON room powder accumulation collection container enclosure. An overflow slot in the collection container enclosure will drain any moderator that enters the MODCON room.

Two sctive engineered safety significant controls (interlocks) exist in the powder lift elevator to detect powder spills. _ Two powder detection level probes are located in the bottom of the powder lift elevator. A high powder level in the bottom of the elevator, detected by either probe, is interlocked to stop the operation of the powder lift elevator.

MANUAL POWDER MIXING A manual mixing operation is sometime used on the Pellet Lines when the UO2 powder is supplied in polypaks. The manual mixing operation is performed in the powder mixing hood of the pressfeed preparation area.

UO2 powder is supplied to the Pellet Line from the Blending Area in 8 inch diameter polypaks.

The polypaks are delivered on powder carts.

- A powder batch is prepared by mixing UO2 with U30s recycle and green scrap recycle in the powder mixing hood. A Process Information Form (PIF) issued by Process Engineering specifies the processing parameters for the blend of UO2 powder. One polypak of UO2 powder is transferred into the hood and the powder, approximately 10 kg, is dumped into the powder lift pan. A volumetric scoop is used to added the correct amount of U30s and green scrap recycles to the UO2. The batch of material is mixed manually. The powder lift pan is repositioned in the powder lift elevator. A minimum 12 inch spacing is maintained between containers of material in the powder mixing hood.

The Process Operator initiates the powder lift elevator to raise the mixed batch to the pre-compactor hopper. The mixed batch is dumped into the pre-compactor hopper and the empty pan returned to the powder mixing hood. A level probe in the pre-compactor hopper controls the maximum amount of mixed material allowed in the hopper. This process step will not initiate unless there is no material detected at the level probe. The operation of the powder lift elevator is controlled by a PLC.

This operation is repeated as required by the Process Operator.

Ventilation of the powder mixing hood and powder lift elevator is provided by a dust collector.

O Initial Issue Date:

16 OCT 98 Page No.

3 Revision Date: 31AUG99 Revision No. _1

c The Process Operator is required to routinely visually check the top and bottom interior of the O

powder lift elevator enclosure for powder leaks and accumulations.

The checks are documented on a controlled form.

Two safety significant controls (interlocks) exist in the powder lift elevator to detect powder spills. Two powder detection level probes are located in the bottom of the powder lift elevator. A high powder level in the bottori of the elevator, detected by either probe, is interlocked to stop the operation of the powder uit elevator.

PRE-COMPACTION - GRANULATION - PRESSING LUBRICANT ADDITION All of the Pellet Lines are equipped with a similar pre-compaction / granulation / pressing lubricant addition system. The pre-compaction and granulation part of the system is controlled by a PLC.

The mixed UO2 powder and tecycle materials are fed from the pre-compactor hopper by a vibratory feeder and drop by gravity into the pre-compactor. The compacted product drops by gravity into the granulator located in the roll mixing. The granulator consists of a series of rotating bars adjacent to a screen. The compacted product from the pre-compactor is forced through the granulator screen by the wiping action of the rotating bars. The resulting product from the granulator is granules. Granules drop by gravity from the granulator into a 9.5" diameter collection polypak. The collection polypak is positioned on a weight trip platform.

.qQ When the weight trip limit is reached, the PLC stops the operation of the roll compactor hopper vibratory feeder, pre-compactor, and granulator. The Process Operator removes the filled polypak of granules and installs an empty polypak on the weight trip platform.

A pressing lubricant is added to and dispersed in the batch of granules in the 9.5 inch tiiameter polypak in the roll mixing hood. A lid is placed on the polypak and sealed with tape. The polypak is rolled to disperse the lubricant in the granules. When the roll mixing is completed, the polypak is opened and the granules are dumped into the pellet press feed hopper, the top of the hopper being at the floor level of the roll mixing hood.

This process is repeated as required by the Process Operator.

Ventilation of the pre-compactor, granulator, and roll mixing hood is provided by a dust collector.

The Process Operator is required to routinely visually check the area around the pre-compactor for powder leaks and accumulations and for compacted powder accumulation in the granulator feed hopper. The checks are documented on a controlled form.

The granulator feed hopper has a safe geometry by virtue of an installed volume limiter box inside the hopper.

' Initial Issue Date:

16 OCT 98 Page No.

4 Revision Date: 31AUG99 Revision No. _1

p

.A batch counter program in the automated powder mixing system PLC monitors and controls -

V the number of batches inputted to the pre-compactor hopper and removed from below the

. granulator. Each time a batch is inputted to the pre-compactor hopper the batch counter adds one count, and'each time a batch is removed from the weight trip platform below the

. granulator the batch counter subtracts one count. If the batch count difference equals the maximum allow count, the powder lift elevator operation will stop. This is an indication of possible accumulation of compacted powder in the granulator feed hopper. The Process Operator checks for actual accumulation, cleans out the accumulation if present, corrects the cause of the accumulation, and resets the batch counter to zero. If no accumulation is present, the Process Operator will run the pre-compactor and granulator empty and reset the batch counter to zero.

PELLET PRESSING The pellet pressing operation consist of forming a~ green (unsintered) pellet with required physical-dimensions and loading the green pellets into the molybdenum (moly) sintering boats

' for the sintering operation.

The batches of pressfeed (the UO2, recycle materials, and pressing lubricant produced by the pressfeed preparation operation) are dumped into the pellet press feed hopper for delivery to the pellet press dies. The green pellets are formed in the dies filled with pressfeed when the top and bottom punches apply pressure to the pressfeed.

The green pellets are loaded into the moly' sintering boats either with a vacuum head boat loader or manually.

PELLET PRESS The pellet press is a rotary press. A central lubrication system supplies lubricating oils to the press' to prevent wear and damage to the moving parts. The spent lubricating oils, containing

. very small amounts of SNM, drain to the oil sump in the bottom of the press. The oil sump is approximately 10 inches x 20 inches x 5.5 inches. In the event the oil sump overfills, the overflow will be collected in a metal pan under the pellet press that is approximately 1 inch deep.

i Pressfeed for pressing pellets is contained in the pellet press hopper. The hopper is 9 inches in diameter and can hold up to 90 kg of pressfeed. On the bottom of the hopper is a vibrr<ory feed shoe to meter out the pressfeed into the feed frame resting on the rotating pellet press table where the dies are located. The purpose of the~ feed frame is to deliver pressfeed into the j

dies as.they rotate below a bed of pressfeed. The feed frame is curved to match the pellet press table curvature and maintains a bed of pressfeed approximately 3 inches x 14 inches x 0.75 inches deep on the press table. An overflow stream of pressfeed, approximately 0.75

- inches x 0.5 inch high, from the feed frame rotates around the inside of the press table and re-1 enters the feed frame on the other end.

Initial Issue Date:

16 OCT 98 Page No.

5 Revision Date: 31AUG99 Revision No. _1_

i

.i

' The green pellets are pushed out of the die by the bottom punch and removed from the press table by the pellet wipe off bar. The green pellets are delivered to a belt conveyor for delivery to the boat loader or collected on a platform for removal by the Process Operator for manual loading of the boats -

The green pellets are right circular cylinders that range in size from approximately 0.4 inches long x 0.3 inches in diameter to 0.7 inches long x 0.5 inch in diameter, weighing 5 - 10 gm.

The area of the pellet press where the pellets are being pressed and transferred to the boat loader or manually loaded into moly boats is contained in a hood. The hood is ventilated by a dust collector. There is some leakage of pressfeed from the press table and from around the bottom punches in the dies. The material will accumulate in the hoad and pellet press enclosure. Green pellets may also be knocked over and fall off the press table and accumulate in the hood.

The Process Operator is required to clean out pressfeed and green pellet accumulations in the pellet press hood at the end of each shift of operation.

The oil sump is drained once per week by Maintenance personnel. The Process Operator checks for oil-powder sludge accumulation in the sump once per week. An oil-powder sludge p

accumulation over 0.5 inch deep is cleaned out and a sample submitted to the Chem Lab for

()

%U analysis. The checks and clean out are documented on a controlled form.

BOAT LOADER The green pellets from the pellet press are delivered to the vacuum head boat loader by a belt conveyor. A layer of pellets to be loaded in the moly sintering boat is made up. When a complete layer is made it is placed into the moly sintering. The process repeats for the next layer of pellets. Any pellets and pellet chips left will be swept off into a collection pan under the table.

Other pellets will fall down into the boat loader and collect in a collection tray surrounding the top of the moly boat.

When the boat is full, as determined by the number of layers in the boat, the boat will be ejected onto the moly boat roller conveyor for delivery to the sintering furnaces. An empty moly boat will be moved into position for loading.

The pellets are loaded into the moly boats to a height of approximately 4 inches. The weight in the boat is approximately 11.5 kg.

The operation of the pellet press, belt conveyor, and boat loader are controlled by a programmable logic computer (PLC).

OV Initial Issue Date:

16 OCT 98 Page No.

6 Revision Date: 31AUG99 Revision No. _1_

m The belt conveyor and boat loader are contained in hoods. The hoods are ventilated by a dust

'O collector.

The Process Operator is required to clean out pellets and pellet chips from the collection pan under the boat loader table, the collection tray around the top of the moly boat, and the collection polypak for the " flash" removal vacuum once per shift.

MANUAL BOAT LOADING The loading process is performed in the pellet press hood. - An empty moly boat is placed in the hood under the platform where the pellets are collected off of the pellet press table. The Process Operator rakes the pellets off into their hand and places the pellets in the moly boat.

The boat is loaded to the top edge and is leveled off at that height.

PELLET SINTERING Green (unsintered) pellets are delivered to the sintering operation in molybdenum (moly)

I sintering boats. The weight of pellets in a moly boat is approximately 11.5 kg. The moly boats are transported to the sintering furnaces on a roller conveyor system, one layer high.

The sintering furnaces are pusher type furnaces. They are electrically heated. The atmosphere gases are: 1) nitrogen for purging air out of the furnace during start up, the safety backip gas in the event of a power failure, and as the second gas when the furnace is operating in the mixed gas hydrogen and nitrogen mode and 2) hydrogen for operating at 100% hydrogen.

Natural gas is used as the pilot light at the furnace doors and burn off stacks to insure that the hydrogen exiting the furnace from the doors and burn off stacks is ignited and burns. Cooling water is required on the furnace heating element connections and the cooling chamber section of the furnace.

The purpose of the sintering operation is to increase the density of the pellets by sintering at a high temperature and reduce the O/U ratio of the uranium oxide to slightly above 2.00 by sintering in a reducing atmosphere. The maximum sintering temperature used is 1780"C. The normal sintering atmosphere is 50% hydrogen and 50% nitrogen. The atmosphere can also be 100% hydrogen. The source of the atmosphere gases is a cryogenic supply system for the plant.

The dew point of the sintering atmosphere gas (s) input to the furnaces is controlled. This dew point is controlled by passing part of the gas through water in a moisturizing tank.

The furnace consist of three sections, the preheat section, the high heat section, and the cooling section. The preheat section is an inconel muffle with a cross section of approximately 10 inches x 7.5 inches. The high heat section is an high alumina brick line chamber with a cross section of approximately 17 inches x 13 - 16 inches. The cooling section is a metal muffle with a cross section of 10 inches x 7.5 inches.

.l InitialIssue Date:

16 OCT 98 Page No.

7 Revision Date: 31 AUG99 Revision No.,_1

g The furnaces are a pusher design. The pushing cycle is as follows: 1) the entrance door opens, a boat is pushed into the entrance chamber of the furnace, and the door closes, 2) the main

. pusher pushes the entire row of-boats down the furnace one boat width until the end boat contacts a limit switch indicating it is in position at the exit end of the furnace, 3) the main boat

. pusher retracts, 4) the exit door opens, the boat at the end of the furnace is pushed out of the furnace, and the exit door closes, and 5) the furnace sits waiting for the timer to time out and start the next boat push cycle. This process is automatic and is controlled by an electrical stepping switch. The Process Operator expects to get a boat out of the exit end shortly after a boat goes in the entrance end. If the main pusher travels past the distance equal to one boat width, a limit switch will be made which sounds an alarm indicating a possible boat jam and stops the main pusher. The Process Operator must contact the Team Manager and inform them of the possible boat jam in the furnace.

When a boat exits a furnace, the sintered pellets are transferred to stainless steel pans with lids, approximately 9 inches x 11.5 inches x 2.25 inches deep. Sintered density sample pellets are obtained from each boat / pan of pellets. The sample pellets are ground and the sintered density of the samples are measured. The pans with acceptable density pellets are stored, with lids on, one layer high on a storage shelf and held for grinding.

The furnaces are controlled with both manual controls and a PLC. All the safety controls are p

controlled by the PLC. 'A loss of electrical power or a loss of hydrogen pressure is interlocked Q

to shutoff the hydrogen gas supply and turn on the nitrogen supply. A loss of nitrogen pressure is interlocked to shutoff the hydrogen supply. An over temperature condition is interlocked to shut off electrical power to the heating elements.

PELLET GRINDING The pellet grinding operation consist of grinding the OD of the sintered pellets with acceptable densities to a specific size, loading the ground pellets on stainless steel trays, drying the pellets, and visually inspecting the pellets.

1 Water is used as the coolant for the pellet grinding process. Coolant water is sprayed on the j

grinding wheel and pellets during grinding, the water containing the ground off UO2 flows i

from the grinder to a centrifuge, the centrifuge removes the majority of the UO2 and water from the centrifuge flows to a surge tank with a coolant pump, the coolant pump pumps the water back to the grinder.

The ground off UO2 (grinder sludge) is cleaned out of the i

centrifuge bowl after grinding 150 trays of pellets.

l PELLET CENTERLESS GRINDING i

Sintered pellets have a diameter that is slightly larger than the diameter required on the fuel pellet product drawing. To achieve the final required diameter the pellets are ground to size using a centerless grinder. The grinder uses an abo 3 regulating wheel to hold the pellets in Initial Issue Date:

16 OCT 98 Page No.

8 j

Revision Date: 31AUG99 Revision No. _1

I contact with the grinding wheel, a diamond impregnated grinding wheel, a recirculating-1 cooling water system, an entrance vibratory feeder to orient and present the ' pellets to the grinder, and an Lexit vibratory feeder and belt conveyor or vibratory track to remove the ground pellets away from the grinder.

The sintered pellets in the stainless steel pans are in a random configuration. The pellets must be presented to the grinder oriented in the axial direction. A spiral bowl feeder is used to

orient the pellets in the axial direction. The bowl is approximately 15 inches in diameter x 3 inches deep. A' pan of pellets is placed in the manually operated pan dumper and upended to dump the pellets into the pellet bowl feeder. Approximately 5 - 15 kg of pellets will be maintained in the feed bowl during the operation of the grinder. As the feed bowl vibrates, the pellets move around the outer part of the bowl and move onto a spiral track. Orienting devices allow the pellets lying on their side and aligned with their axis in line with the spiral track to stay on the track as the other pellets fall off back into the bowl. The aligned pellets feed out of the bowl feeder onto the entrance linear vibrator. The linear vibrator vibrates the pellets into

)

the grinder. The linear vibrator is set to feed the pellets at a speed a little slower than the bowl feeder. A sensor on the front end of the linear vibrator detects when the pellet queue on the feeder backs up to the front end and is interlocked to stop the bowl feeder. When the pellet queue moves away from the sensor the interlock allows the bowl feeder to restart and feed pell-ts to the linear vibrator thus maintaining a continuous flow of sintered pellets to the grinder.

j The bowl feeder is -completely enclosed in a containment housing to prevent airborne contamination. On Pellet Lines 1 - 4 the top of the containment is approximately 30 inches in diameter x 17 inches high and the bottom is conical shaped approximately 30 inches in

- diameter at the top, 2 - 4 inches in diameter at the bottom' x 21 inches high with an 8 inch collection polypak below. On Pellet Line 5 the top of the containment is approximately 30 inches in diameter x 17 inches high and the bottom is conical shaped approximately 30 inches in diameter at the top, 9 inches in diameter at the bottom x 9 inches high with an 8 inch collection polypak below. The bowl feeder is designed to segregate out pellet chips and pieces of pellets from the whole pellets. These pellet chips and pieces drop into a reject slot / hole and fall into the 8 inch diameter collection polypak in the bottom of the feed bowl containment.

The Process Operator cleans out the polypak at the end of the shift and documents the cleanout and amount of material removed on a control form. On Pellet Lines 1 - 4 the collection polypak is housed in a non-favorable geometry containment, approximately 14 inches x 14 inches x 14 inches. On Pellet Line 5 the collection polypak is housed in a favorable geometry i

containment, approximately 9 inches in diameter x 22 inches high.

One active engineered safety significant control (interlock) exists to detect a pellet accumulation in the Pellet Line 5 feed bowl containment collection polypak. A level probe located in a position just above the polypak will detect a pellet accumulation and is interlocked to activate an alarm light and stop the feed bowl, entrance linear vibrator, grinder, centrifuge, coolant pump, exit linear vibrator, and exit vibratory conveyor track.

Initial Issue Date:

16 OCT 98 Page No.

9 Revision Date: 31AUG99 Revision No. _1 f f

c

.n Pellets are pushed into the grinder by the entrance linear vibrator. When the pellets get U

between the regulating wheel and diamond grinding wheel, the rotation of the two wheels pull the pellets through as the OD is ground off to the required diameter. The wheels are enclosed in a containment which is ventilated. Cooling water is flushing the pellets being ground to keep them cool and wash away the grinding residue. The water flows down to the bed of the grinder and out the drain.to the centrifuge. The grinder base is approximately 20 inches x 25 inches with a depth of approximately 0.5 inches on the front and 1.5 inches on the back. The regulating wheel assembly occupies approximately half of the base area. Some pellet chips and whole pellets will fall onto the grinder bed and are periodically removed by the Process Operator. The drain in the base of the grinder is covered with an 8 mesh screen to prevent whole pellets and large pellet pieces from getting into the centrifuge.

The feed bowl and grinder wheels are ventilated by a dust collector. The ventilation air passes through a moisture drop out tank in the ventilation line where any water in the air will drop out I

The pushing action of the succeeding pellets being ground pushes the pellets onto the exit linear vibrator. The exit linear vibrator moves the pellets in single file onto the belt conveyor, Pellet Lines 1 - 4, or vibratory track, Pellet Line 5. A high velocity vacuum is pulled through slots in the side of the V-track of the exit vibrator to remove surface water from the pellets.

The vacuum to the slots is pulled through an approximate 1.5 inch x 1.5 inch x 24 inches long chamber under the slot. The vacuum air stream passes through a stand pipe on the surge tank where the water is dropped out of the air stream. The vacuum pump exhausts to the grinder O

ventilation dropout tank to remove any water from the air stream that may have passed through the standpipe.

Ground pellets on Pellet Lines 1 - 4 are transferred in single file by the belt conveyor to the pellet stroker. The drive system of the belt conveyor is located below the conveyor in a 7 inches x 15 inches x 60 inch containment.

Personnel safety is primary reason for the containment. Few, if any, pellet chips or whole pellets can get into the containment because of its construction. The pellet stoker is an oscillating clamping mechanism that grips a row of pellets and pushes the row of pellets onto the pellet tray positioned on the pellet tray loader.

The pellet stroke is enclosed, approximately 21 inches x 11 inches x 9 inches, with a collection 1

funnel in the bottom for pellets. The collection funnel is approximately 20 inches long x 4 inches wide at the top and approximately 6 inches deep with a 2 inch diameter connection to a flexible hose with an 8 inch polypak on the end to collect any pellets that fall from the pellet stroker.

. Ground pellets on Pellet Line 5 are transferred in single file by the vibratory track and pushes a row of pellets onto the pellet tray positioned on the pellet tray loader. The vibratory track is enclosed in a containment approximately 16 inches x 35 inches x 16 inches deep. Any pellets that fall from the vibratory track fall into a collection funnel below the track and into a 8 inch collection polypak. The collection funnel is approximately 16 inches long x 35 inches x 14 inches deep with an approximately 6 inch diameter bottom. The collection polypak is housed in a favorable geometry containment, approximately 9 inches in diameter x 12 inches high, which Initial Issue Date:

16 OCT 98 Page No.

10 i

Revision Date: 31 AUG99 -

Revision No. _1_

p is connected to the collection funnel by an approximately 4 inch long x 6 inch diameter rubber d

boot. The vibratory track enclosure is ventilated by a dust collector.

l One active. engineered safety significant control (interlock) exists to detect a pellet

~

accumulation in the Pellet Line 5 vibratory track containment collection polypak. A level probe located in a position just'above the polypak will detect a pellet accumulation and is interlocked to activate an alarm light and stop the feed bowl.

PELLET GRINDING RECIRCULATING COOLING WATER SYSTEM During pellet grinding, cooling water is flushing the pellets being ground to keep them cool and wash away the grinding residue. The water containing the ground off UO2 drains from the grinder to the centrifuge via a 2 inch diameter flexible hose. The centrifuge removes the majority of the UO2 from the water. The water from the centrifuge flows to a surge tank via a 2 inch diameter flexible hose. A coolant pump in the surge tank pumps the water back to the grinder.

The centrifuge consists of an outer housing and inner bowl. The cooling water from the grinder flows into the spinning bowl and the centrifuged water overflows into the outer housing which drains to the surge tank. The bowl has been modified to a total volume of 19 liters, it is approximately 20 inches in diameter and 4.5 inches deep. The wet UO2 (grinder sludge)

O

. deposits on the outside wall of the bowl and builds up to a maximum depth of approximately 2 inches. The estimated weight of a 2 inch depth of grinder sludge in the bowl is 46.7 kg.

The centrifuged water overflows into the surge tank. The surge tank is cylinderical in shape and is approximately 10 inches in diameter x 20 inches long. A coolant pump is mounted in the tank and pumps the water back to the pellet grinder. There are four sources of water entry into the tank; centrifuged water from the centrifuge (primary source), make up water from a water supply line, water from the exit linear vibrator vacuum pellet drier, and water from the ventilation line moisture drop out tank.

The centrifuge bowl is cleaned out routinely. The grinder system PLC has a tray counter which counts the number of trays ground based on the indexing of pellet tray out of the pellet tray loader. When the tray count reaches 150 the pellet grinder, centrifuge and coolant pump are automatically shutdown by the PLC. The Process Operator must clean out the grinder sludge from the centrifuge bowl before restarting the grinder system. The 150 tray limit is based on not completely filling the centrifuge bowl to the 2 inch grinder sludge depth when grinding the pellet design that will result in the most ground off UO2 per pellet.

PELLET LOADING ON TRAYS Ground pellets are loaded onto stainless steel trays by the pellet tray loader. The pellet tray is a corrugated stainless steel sheet, with stiffeners on the bottom and one end closed, that is p

(

approximately 23 inches x 15 inches.

The corrugations allow 25 rows of pellets, initid Issue Date:

16 OCT 98 Page No.

11 Revition Date: 31AUG99 Revision No. _1

p approximately 22 inches long,.to be loaded onto a tray. A full tray of pellets will weigh V

between 5 to 10 kg net, depending on the pellet design.

The pellet tray loader is a mechanical device that positions an empty pellet tray in place for loading, indexes the tray one row at a time until the tray is full, and moves the filled tray onto roller conveyor for transporting the tray of pellets to the drying oven. A row of pellets is pushed onto a tray by the pellet stroker on Pellet Lines 1 - 4 or vibratory track on Pellet Line

5. A sensor located above the end of the tray detects when the pellet row reaches the end of the tray. Pellet feeding to the tray is stopped, the tray loader indexes over to the next empty position of the tray, and pellet feeding is resumed. Pellets that fall from a tray are caught on a catch pan,23 inches x 28 inches, under the tray and are readily visible to the Process Operator for clean up. An 8 inch diameter collection polypak is located on the floor next to the pellet tray loader for the Process Operator to discard pellets into.

PELLET DRYING Tie pellet trays are transported to the on-line drying oven on a roller conveyor. Trays are transported one layer high. A catch pan under the roller conveyor will catch any pellets that may fall off of a tray. The pellets are readily visible to the Process Operator for clean up.

A continuous drying oven is used to dry the ground pellets on a tray. The oven is operated at 120 C.

Pellet trays move through the oven on a power driven roller conveyor at a rate of approximately 4 inches per minute. Pellets that fall from a tray are caught on a catch pan inside the oven. Very few pellets fall from the trays at this rate of travel.

PELLET VISUAL INSPECTION The pellet trays are' transported to the inspection station on a roller conveyor. Trays are transported one layer high. A catch pan under the roller conveyor will catch any pellets that may fall off of a tray. The pellets are readily visible to the Process Operator for clean up.

The visual inspection is performed in a hood located adjacent to the roller conveyor. The Process Operator transfers a single tray of pellets into the hood. The pellets are visually inspected on the tray for physical defects, such as chips, cracks, holes, etc. The defective pellets are removed and discarded into a 2 inch diameter flexible hose connected to an 8 inch polypak. The tray of pellets is filled back up with pellets obtained from a filler tray. The filler tray is positioned in the hood approximately 13 inches above the working surface of the hood.

The visually inspected tray is manually transferred to a pellet tray cart for storage.

The pellet tray storage cart contains five groups of three or four shelves for storing single pellet trays, the shelf spacing only allows one tray per shelf. Each group of shelves is separated from the next group by 8.625 inches. A total of 14 - 16 pellet trays are normally stored in a cart, the bottom four shelves are not normally used. The cart has a door that is 3

kept closed except when loading or unloading trays from the cart. The cart is mounted on Initial Issue Date:

16 OCT 98 Page No.

12 Revision Date: 31AUG99 Revision No. _1_

i

. wheels to that it can be transported from one location to another. A stabilizer box is mounted V

to the bottom of the cart to prevent the cart from falling over if a wheel should fail.

The visual inspection station hood is ventilated by a dust collector.

SCRAP PROCESSING There are two basic types of scrap generated in the ADU Pellet Area, green scrap (unsintered material) and sintered scrap.

Clean green scrap is recycled with the UO2 during the powder mixing process described in Section 1.1.1.

Contaminated green scrap is sintered, packaged in 8 inch polypaks, and transferred to ADU Conversion Scrap Processing Area.

Sintered scrap is generated from three sources; contaminated sintered scrap, scrapped sintered pellets, and grinder sludge cleaned out of the grinder centrifuge. The contaminated sintered scrap is packaged in 8 inch polypaks and transferred to ADU Conversion Scrap Processing Area. Both the hard scrap pellets and grinder sludge are oxidized to U30s in the Pellet Area.

OXIDATION OF SINTERED SCRAP Each Pellet Line is eguipped with an oxidation process. In addition there is an off line oxidation process to handle excess sintered scrap from the Pellet Lines and sintered pellets from scrapped fuel rods.

The sintered scrap is stored on the Pellet Line for processing. Sintered hard scrap pellets are stored in 8 inch polypaks on stationary racks or powder carts. The wet grinder sludge is stored in stainless steel oxidizing pans, approximately 17.75 inches x 10.75 inches x 2.25 inches

deep, on a stationary rack for wet grinder sludge only.

Each oxidizing process uses an oxidizing oven for oxidizing the scrap in an air atmosphere.

The hard scrap pellets or wet grinder sludge are placed in oxidizing pans. Approximately 5 kg of hard scrap pellets or wet grinder sludge are placed in an oxidizing pan. Up to four pans are placed in the oxidizing oven per oxidation run. The material is heated in air to oxidize the UO2 to U30s. The oxidized material is screened. The oversize material will be re-oxidized.

The screened U30s will be transferred to the powder mixing process in the Pellet Lines or packaged in 8 inch polypaks and stored on powder carts or stationary racks.

U30s screening is 'normally performed in the vibratory sifter. The sifter is a vibrating screen device. The screening container is approximately 8 inches in diameter x 8 inches high. The sifted U30s drops into an 8 inch diameter polypak. A sensor in the connection between the vibrating screen and the 8 inch polypak will shut the sifter off when the polypak is filled.

O v

Initial Issue Date:

16 OCT 98 Page No.

13 Revision Date: ~ 31 AUG99 Revision No. _1 m

- U30s can also be screened by hand. The hand screen is approximately 8 inches in diameter x 2 g

inches deep. Oxidized U30s is placed in the screen and the Process Operator shakes the screen over an empty oxidizing pan to catch the screened U30s. The screened U30s is transferred to an 8 inch polypak.

All handling of the sintered scrap and screening of the U30s is performed in a ventilated hood.

The ventilation is provided by a dust collector.

MOISTURE SAMPLING OF THE U30s All the U30s that is t.o be transferred out of the Pellet Lines must be moisture sampled and have acceptable results before it is transferred.

Two moisture samples are obtained. The first moisture sample is a composite sample. The composite sample is analyzed for moisture content. if the first moisture result is =/< 0.3%

then the second moisture sample is requested by Quality Control. Three randomly picked polypaks will be sampled by Quality Control and analyzed for moisture.

If the second moisture result is =/< 0.3% then the sampled polypaks of U30s can be transferred from the Pellet Line.

The Team Manager is notified if either moisture sample result is > 0.3%.

The following operating procedures are used to fabricate uranium dioxide fuel pellets in the ADU Pellet Area:

COP-820112, Bulk Container Handling At Powder Prep COP-820114, Automatic Feed Preparation - Pellet Lines 1,2,3, And 4 COP-820116, Manual Press Feed Preparation COP-820206, Pellet Press Operation COP-822524, Pellet Press Boat Loader COP-820207, Servicing Of Torit 84 And 124 Dust Collectors In Pellet Area COP-822521, Pellet Area Fabriemax Dust Collector - Startup, Operation, And Shutdown COP-820301, Sintering Furnace Operation COP-820401, Grind Pellets - ADU Lines 1-4 COP-829012, Grind Pellets On ADU Grinding Line 5 COP-820404, Clean Pellet Grinder System COP-825202, On-Line Pellet Dryer Oven COP-820406, Pellet Inspection COP-825101, Oxidation - Lines 1, 2, 3, 4, 5 COP-829007, Oxidation / Screen Reject Pellets, Clinkers, And Grinder Sludge - Pilot Line COP-829005, Moisture Sampling Of U30s COP-829013, Functional Verification Of Safety Significant Controls OM82000, SI - Safety Interlock Check, Pellet Lines PM82012, SS - Moisture Drop Out Tank (Quarterly PM)

Initial Issue' Date:

16 OCT 98 Page No.

14 Revision Date: 31AUG99 Revision No. _1

O savireameat i erotectiea aa a ai tioa Serety Coairei.

To be provided in a future Integrated Safety Assessment.

Nucie r Critic lity S fety (NCS) Controls And F ult Trees This Section summarizes the results of the Safety Analysis of the ADU Pellet Process.

The analysis for the hoods used in the pelleting system, the process ventilation that supports the hoods and enclosures, and storage of material in the area is addressed in separate documents.

PELLET BULK CONTAINER / ENCLOSURE SYSTEM Controls Safety Significant Controls Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs

(~3 Procedure RA-108. The requirements for functional verification are determined by this V

evaluation.

a)

Container or prep feed line integrity fails. IE# BLK 1. Periodic verification is n_ot required because of continuous surveillance provided by events BLK 6,7, and 8.

Integrity of the bulk container is addressed in a separate CSE (including periodic PM's to assure container integrity). Control ID: P-PEL-x-01.

b)

Bulk container feeder valve fails open. IE# BLK 4.

Periodic verification is accomplished by the test each time a feeder valve is readied for use; further annual verification is not required. Control ID: P-PEL-x-02, c)

Cover plate comes off bulk container (with feeder valve).

IE# BLK 5.

Continuous verification is accomplished by having a person (s) in attendance during movement of the container; further annual verification is not required.

Control ID: P-PEL-x-03.

d)

Favorable geometry collection capability fails.

IE# BLK 6.

Periodic verification is n_ot required because of continuous protection and surveillance provided by events BLK 1,2,3, and 8. Control ID: P-PEL-x-04.

e)

Water available from outside source (roof leak, pipe leak, etc.). IE# BLK 9.

Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-05.

f)

Bulk enclosure room leaks.

IE# BLK 10.

Periodic verification required.

Control ID: P-PEL-x-06.

p

(

l Initial Issue Date:

16 OCT 98 Page No.

15 Revision Date: 31AUG99 Revision No. _1

5 g)

Overflow slots in FG collection system fail. IE# BLK 12. Periodic verification O

required. Control ID: P-PEL-x-07.

Active engineered controls (AEC)

Active Engineered Controls are described in License SNM-1107 and in Regulatory Affairs Procedure RA-108. They are also called safety significant interlocks. The requirements for functional verification are determined by this evaluation, a)

Inflatable O-ring seal interlock fails.

IE# BLK 2.

Periodic functional verification is required. Control ID: PEL-x-01, b)

Container-in-place interlock fails. IE# BLK 3. Periodic functional verification is required. Control ID: PEL-x-02.

c)

Powder level probe fails.

IE# BLK 7.

Periodic functional verification is required. Control ID: PEL-x-03.

Administrative controls with computer or alarm assist (AC)

Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm. The requirements for functional verification are determined by this evaluation.

[none]

Administrative controls Safety Significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or some other record.

Functional verification is not normally required, a)

Operators fail to detect accumulation of powder or moderator. IE# BLK 8.

Control ID: A-PEL-x-01.

b)

Bulk enclosure room doors left open. IE# BLK 11. Control ID: A-PEL-x-02.

Margin of Safety The nuclear criticality margin of safety has been evaluated to be very strong for the bulk enclosure. The neutron multiplication factor (kerr) has been calculated to be s 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take keer 21.00.

The parameters that directly affect neutron multiplication for the bulk enclosure, assuming 5.0 wt.% "U enrichment, are mass and moderation. Criticality safety limits 2

(CSLs) and Bounding Assumptions (BA) are established for mass and moderator, ultimately with the intent to limit geometry. A criticality (kerr = 1.00) could be possible O

in the bulk enclosure given the following upset condition:

Initial Issue Date:

16 OCT 98 Page No.

16 Revision Date: 31AUG99 Revision No. _1

The cone transition piece filled to at least 13 inches with optimally moderated UO2 e

powder at optimum density. This equates to approximately 148.7 kg UO2 powder or 60.1 liters of water (ken = 1.0).

SUMMARY

OF INITIATING EVENTS WIIICH LEAD TO CREDIBLE PROCESS UPSETS FOR TIIE BULK ENCLOSURE (a)

Group 1 Defense Elements (IE#s BLK 1-9: Mass Defenses)

(a.1)

IE #BLK 1 Bulk container or prep feed line integrity is violated.

This event assumes that the integrity of either the bulk container or the prep feed system line is compromised such that an avenue becomes available for powder to spill into the enclosure.

Possible causes include:

Material defect Inadequate preventive maintenance e

Intrusion of foreign object Consequences of this event occurring:

UO2 powder begins to flow into enclosure e

O Defenses designed to prevent this event occurring:

Bulk container integrity certified (DOT)

Preventive maintenance requirements e

Independent residual defenses:

BLK 6 Favorable Geometry Collection Container BLK 7 Powder Level Probe Interlock e

BLK 8 Operators Inspect e

l Moderator Defense (a.2) IE #BLK 2 Inflatable 0-ring fails This event assumes that the active engineered control for low air pressure to the inflatable O-ring between the container and feed system fails, allowing powder to pass into the enclosure.

This safety significant interlock is designed to give a visual alarm, audible alarm, stop the vibratory feeder, shut the bulk container feeder valve, and stop the vibratory feeder upon sensing low air pressure.

Possible causes include:

Improper operator handling of container when loading damages o-ring or seal Under inflation (0-ring)

(

e Initial Issue Date:

16 OCT 98 Page No.

17 Revision Date: 31 AUG99 Revision No. _1

p Settling of seal collar.

m e

)

e Puncture of inflatable seal Overpressurization of inflatable ring leading to bursting e

Consequences of this event occurring:

Powder falls into the enclosure Defenses ' designed to prevent this event from occurring:

Interlock for low air pressure to inflatable seal fails e-Operator training for container handling e

Procedural compliance Preventive maintenance e

Independent residual defenses:

BLK 3 Container in Place Interlock e

e

' BLK 6 Favorable Geometry Collection Container e

- BLK 7 Powder Level Probe Interlock BLK 8 Operators Inspect e

Moderator Defense (a.3) IE #BLK 3 Container - in - place interlock fails Gb This event. assumes 'that the active engineered control'(safety significant container-in-place interlock): fails, such that the container comes off the o-ring / seal and the interlock fails to

]

function as designed when called upon to do so. The container-in-place switch allows the seal to inflate. If the tank comes off the switch, the seal deflates, resulting in low seal pressure; upon sensing low seal pressure, the interlock stops the process. The interlock also functions to 1

I prevent seal damage during tank installation.

Possible causes include:

Container shifts off stick probe -

Feeder valve actuator fails Loss of actuator air pressure e

! onsequences of this event occurring:

C

' Feeder valve will not shut if interlock is activated e

Defenses designed to prevent this event occurring:

e -

Safety rignificant interlock verification Operator training e

Procedural compliance e-Independent residual defenses:

i Initial Issue Date:

16 OCT 98 Page No.

18

- Revision Date: ' 31 AUG99 Revision No.

1 i

i

BLK 6 Favorable Geometry Collection Container eb' e-BLK 7 Powder Level Probe Interlock BLK 8 Operators Inspect e

Moderator Defense (a.4) IE #BLK 4 Feeder valve fails open during bulk container installation This event assumes that the bulk container feeder valve somehow fails open during the container loading evolution, resulting in powder spilling into the enclosure. Note that in order for this to happen, the cover plate would have to be removed.

Possible causes include:

Valve failure Operator error (opening valve)

. Consequences of this event occurring:

UO2 powder spills into enclosure (if cover plate is off)

Defenses designed to prevent this event occurring:

.Very strong spring return to close Feeder valve checks before container leaves blend room 4

Operator training p

e V-e' Procedural compliance Independent residual defenses:

BLK 5 Cover plate in place BLK 6 Favorable Geometry Collection Container e

BLK 7 Powder Level Probe Interlock BLK 8 Operators Inspect e

Moderator Defense (a.5) IE #BLK 5 Cover plate comes off during transport This event assumes that the cover plate comes off or becomes dislodged during container handling, and that it allows powder to spill into the enclosure. The feeder valve would also have to fail open in order for the cover plate failure to result in powaer spillage.

Possible causes include:

. Installed incorrectly Container dropped in enclosure e

Clamp failure e

O Consequences of this event occurring:

V' Initial Issue Date:

16 OCT 98 Page No.

19 Revision Date: 31AUG99 Revision No. _1

Powder spills into enclosure (if feeder valve is open)-

e Defenses designed to prevent this event occurring:

. Operator training e

Procedure Independent residual defenses:

BLK 4 Feeder valve shut e

BLK 6 Favorable Geometry Collection Container e

BLK 7 Powder Level Probe Interlock e

BLK 8 Operators Inspect e

Moderator Defense

- (a.6). IE #BLK 6 Favorable geometry collection capability fails This event assumes that the passive engineered control favorable geometry powder collection system somehow fails, and that powder is not collected in a favorable geometry.

i Possible causes include:

Blockage at bottom of enclosure Powder bridges e

p Different means of discharge screw control / indication from line to line e

O Consequences of this event occurring:

Powder potentially accumulates in NFG configuration Defenses designed to prevent this event occurrmg.

3 Operator training (keep bottom of enclosure clear) e e

Procedure Independent residual defenses:

Moderator defense (a.7) IE #BLK 7 Powder level probe interlock in favorable geometry collection system fails This event assumes that the powder level interlock fails to function when called upon to do so, that the feeder valve remains open and the alarm fails to sound, and that powder continues to spill into the enclosure. It is noted that this probe is also effective in detecting accumulation of moderator.

Possible causes include:

Probe fails to detect powder due to density variation O

e V

Initial Issue Date:

16 OCT 98 Page No.

20

- Revision Date: 31AUG99 Revision No.,_i_

E e

Feeder valve actuator malfunctions p/

Loss of actuator air pressure C

e

~ Consequences of this event occurring:

Either powder (or moderator) accumulate in enclosure e-

- Defenses designed to prevent this event from occurring:

Safety significant interlock verification e'

Fail-safe design'.

' Operator training e

Procedural compliance Independent residual defenses:

BLK 8 Operators Inspect Mass Defenses if moderator is accumulating

-e Moderator Defenses if mass is accumulating e

.(a.8) IE #BLK 8 Operators fail to inspect once per day This event assumes that operators fail to inspect the enclosure once per day as required by COP-820114, and fail to detect the powder or moderator accumulation, or that the operator checks, but does not detect the powder or moderator accumulation.

Possible causes include:

Operator error (fails to detect) e eL

- Failure to follow procedure (fails to inspect once per day)

Consequences of this event occurring:

Either powder (or moderator) continues to accumulate in enclosure e

Defenses designed to prevent this event from occurring:

Training Independent residual defenses:

I Mass Defenses if moderator is accumulating e

Moderator Defenses if mass is accumulating e

.(b)

Group 2 Defense Elements (IE#s BLK 9-12: Moderation Defenses)

(b.1) IE #BLK 9 Moderator (water) becomes available from source outside enclosure O

Initial Issue Date:'

16 OCT 98 Page No.

21 Revision Date: 31AUG99 Revision No. _1 1

G L.

This event assumes that water becomes available to the enclosure from some source outside the gy enclosure. Possible sources include: rain water leaking through the roof, air conditioning duct condensation, and water lines which run overhead.

Possible causes include:

e' Failed cooling water piping Failed city water piping e

Consequences of this event occurring:

e

. Water available to enclosure l

Defenses designed to prevent this event occurring:

e '-

Piping integrity Operators present in area Roofintegrity e

dependent residual defenses:

BLK 8 Operators Inspect e

BLK 10 Bulk Enclosure Watertight e

' BLK 12 Overflow Slots for Water

-e Mass Defense O

(b.2) IE #BLK 10 Bulk Enclosure room leaks -

fThis event assumes that the bulk enclosure leaks.

Possible causes include:

Gaps in enclosure wall-to-wall or wall-to-roof seams.

t Loose gasket material covering front doors or rear door f

Material failure of enclosure -

J e

Hole in lexan window e

Consequences of this event occurring:

Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance e.

Gasketed doors Independent residual defenses:

BLK 9 Moderator Not Available e

Operator presence in area e

Initial Issue Date:

16 OCT 98 Page No.

22 Revision Date: 31AUG99 Revision No. _1_

,e Mass defense -

(b.3) IE #BLK 11 Bulk enclosure doors left open during processing This event assumes that bulk enclosure doors are left ajar while processing a container, providing a path for water to enter.

Possible causes include:

Operator error (doors closed in incorrect order) e Doors drift open e

Operator fail to shut door e

Consequences of this event occurring:

e Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance Independent residual defenses:

BLK 8 Operators Inspect e

Mass defense bQ

'(b.4) IE #BLK 12 Overflow slots in favorable geometry collection system fail to drain

. water This event assumes that water has somehow entered the enclosure, drains to the bottom as designed, and then does not drain out the built-in overflow slots at the bottom, resulting in water accumulating in the enclosure. It is noted that the slot is designed to drain liquid during a moderator contingency only. Therefore it may be degraded or defeated if powder (mass) is also present.

Possible causes include:

Foreign material plugs slots (plastic, tape)

Water flow rate in overwhelms maximum drain rate slots can provide, e

Concurrent powder accumulation l

e Consequences of this event occurring:

Water continues to accumulate in enclosure Defenses designed to prevent this event from occurring:

Preventive maintenance (to keep the slots clear) l p-Independent residual defenses:

.L)

Initial Issue Date:

16 OCT 98 Page No.

23 Revision Date: 31AUG99 Revision No. _1

g l

BLK 8 Operators Inspect j

f

'e

. Mass defense l(b.5) See IE# BLK 7 l(b.6). See IE# BLK 8 Common Mode Failure -

In a classic sense, there is commen mode failure potential in that IE# BLK 7, powder level probe interlock failure, appears in both the mass and the moderator branch of the

. fault tree. ~In reality there is very low risk in that the potential occurrence of mass and

- moderator in the chute are essentially independent of each other. The primary function of the probe is to detect any mass accumulations. The primary defense against potential water in the chute is the passive engineered control of slots in the bottom of the chute, which would cause water to flow into the collection pot hood and onto the floor. The probe was shown in the moderator portion of the tree, however, because it would be very effective in detecting accumulations of water in the collection pot.

j c

.In a similar way, IE# BLK. 8, operators fail to detect accumulations of mass or l moderator, is a potential common mode failure. The risk is judged acceptable because there are no sources of moderator in the bulk enclosure. room, and because any moderator sources (leaks) would be readily detected by persons in the area.

Regarding IE# BLK 12, it is noted that the presence of powder (mass contingency) may degrade or defeat the effectiveness of this overflow slot. This risk is judged acceptable because:

(a)

The probability of a concurrent mass contingency is extremely low, and.

(b)

The remaining controls for the moderator contingency are very strong in preventing a source of moderator inside the bulk enclosure room and in preventing its accumulation.

Summary Tables - see Tables 5.3.1-1 and 5.3.1-2.

O Initial Issue Date:

16 OCT 98 Page No.

24 Revision Date: 31 AUG99 -

Revision No. _1 i

r\\b TABLE 5.3.1-1

SUMMARY

OF DEFENSES PROVIDED AGAINST A SINGLE FAILURE FOR THE BULK ENCLOSURE Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React MASS DEFENSE-Container or Seal /O-ring failure 1,2 6

7,8 Moderator Defense

_ during processing Cc:::ainer comes off seat during 3

6 7,8 processing Mass spillage during container 4,5 6

7,8 installation or removal e

1

'q/

MODERATOR DEFENSE Moderator available from This scenario is determined to be not credible. The enclosure is a internal source moderation control area, and the containers are under moderation control.

Moderator available from 9,10,11 12 7,8 Mass Defense external source NOTES:

1)

The level probe interlock and administrative control to detect the accumulation of either mass or moderator is a potential common mode failure.

2)

See the end of CSE Section 5.3.1.12 for a discussion of common mode failure potential.

O Initial Issue Date:'

16 OCT 98 Page No.

25 Revision Date: 31 AUG99 Revision No. _1_

TABLE 5.3.1-2 NUCLEAR CRITICALITY SAFETY LIMITS FOR kerr = 0.90, 0.95, AND DELAYED CRITICAL PARAMETER NORMAL BOUNDING CRITICALITY CRITICALITY CRITICALITY 4

OPERATING ASSUMP110N SAFETY SAFETY-LIMIT CONDITIONS LIMIT LIMIT Delayed Critical l

s 0.90 s 0.95 (0.98) 235U Mass Essentially 89.1 Kg UO2 112.7 Kg UO2 132.1 Kg UO2 Zero Moderator /

s 1.0 Wt. %

Optimum 36.0 Liters 45.6 Liters 53.4 Liters Concentration Moisture Water Water Water 10.7 inches 11.75 Inches 12.5 Inches Geometry Inches In Chute Spacing N/A N/A N/A N/A N/A O

/

Ilomogeneous -

C Density Optimum

)

1.9447 gUO2/Cc j

Absorbers None None None None None i

Enrichment s 5.0 Wt. %

15.0 Wt.%

$ 5.0 Wt. %

s 5.0 Wt. %

s 5.0 Wt. %

Partial Water Reflection (l") Except 24" CONC -Z Offset 24" Notes

1) Mass limits calculated from height in collector chute at 11/235U = 250. (1.9447 gUO2/cc)

2) Moderator limits calculated from height in collector chute at H/ '5U = 200. (0.7861 II20/cc) 2

3) See CRI-96-033-0, Chart I and Tables BLK-ENCL.XLS.

4) Delayed critical limits set at kerr = 0.98. (arbitrary - see Section 5.3.1.11) m Initial Issue Date:

16 OCT 98 Page No.

26 Revision Date: 31AUG99 Revision No. j

FIGURE 6.3.1-1 ADU PELLET AREA BULK ENCLOSURE FAULT TREE CRITICALITY POSSIBLE I

< CRITICALITY PRECURSOR >

UNACCEPTABLE AMOUNT OF MASS AND MODERATOR INSIDE THE NONFAVORABLE GEOMETRY j

I i

\\

MASS MODERATOR CONFIGURATION DEFENSES l

DEFENSES FAIL DEFENSES FAIL FAIL I

I

~

A1 OF WATER (53.4 UTERS) OETS INTO N/A P

E

< CONTINGENCY >

< CONTINGilNCY >

GREATER THAN THE SAFETY UMIT ORMATER THAN THE SAFEN LIMIT OF MASS (132.1 kg UO2)

AND ACCUMULATES IN

' ACCUMULATES IN ENCLOSURE ENCLOSURE BULK ENCLOSURE IS NONFAVORABLE GEOMETRY VESSEL I

I GREATER THAN THE GREATER THAN THE A2 SAFETY LIMIT OF SAFETY LIMIT OF WATER (53 4 LITERS 3

WATER (53 4 LITERS H2O) GETS INTO H2O) ACCUMULATES ENCLOSURE IN ENCLOSURE l

O v

Initial Issue Date:

16 OCT 98 Page No.

27 Revision Date: 31 AUG99 Revision No. _1

FIGURE 6.3.1-1 (Cont'd)

ADU PELLET AREA BULK ENCLOSURE CONTINGENCY PROTECTIONS F

< CONTINGENCY >

GREATER THAN THE SAFETY LIMIT

' OF MASS (132.1 KG UO2)

ACCUMULATES IN ENCLOSURE I

I FG Operators Fail Collection to Detect System Fails E

I Material Leaks Matenal Leaks into Enclosure into Enclosure O

During Operation During Installation or Removal A.PEL-X41 ho 1

I i

i Container or inflatable Container Feeder Valve Cover Plate is Prop Feed 0-Ring Fails in-Place Fails Open Off Line Integrity Interlock Fails Falls Favorable Powder Geometry Level Collection Probe Ca adlity Inte k BLK1 BLK2 BLK3 BLK4 BLK5 PEC PEC AEC AE P-PEL.X41 PEL X 01 PEL-X42 e

BLK7 P.PEL-X42 P.PEL-X43 BLK6 3

PEC AEC P PEL-X 04 O

Initial Issue Date:

16 OCT 98 Page No.

28 Revision Date: 31AUG99 Revision No. _1

FIGURE 6.3.1-1 (Cont'd) q(>

ADU PELLET AREA BULK ENCLOSURE CONTINGENCY PROTECTIONS l

GREATER THAN THE GREATER THAN THE SAFETY LIMil OF WATER SAFETY LIMIT OF WATER (53.4 LITERS H2O)GETS (53.4 LITERS H2O)

INTO ENCLOSURE 2

3 ACCUMULATES IN

/

\\

ENCLOSURE I

3 "I

I Water Available Bulk Enclosure l

l BLK12 l

BLK7 BLK8 l

From Outside Water Tight Source Integrity Falls Lev be Fa t o etect Ce on System Falls p,gj, PEC 7

BLK10l 8 "

EC AEC p

COP 820114 Bulk Enclosure Bulk Enclosure PPEL-XW

• 1 APEL X 01 l

Room Leaks Room Doors Left Open n2 PPEL-Xa Ptic P PEL-X4 Notes:

1. Overflow slot rnay be degraded or ineffective if powder is also present in the collection pack / chute.

I Initial Issue Date:

16 OCT 98 Page No.

29 Revision Date: 31AUG99 Revision No.

1 i

O b

POWDER TRANSPORT SYSTEM The powder transport system, also called the automatic feed preparation (at:to feed prep) system, includes the powder feed line from the bulk enclosure, add back system, ribbon blending system, powder lift, and roll compactor hopper. The transport system components which warrant evaluation are the powder lift enclosure and the roll compactor hopper.

Powder Lift System Controls

' Safety Significant Controls Passive' engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# MOD 1.

O Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-12.

b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# MOD

2. Periodic verification required. ControlID: P-PEL-x-13.

Active engineered controls (AEC) j Active Engineered Controls are described in the License and in Regulatory Affairs procedure RA-108.

They are also called safety significant interlocks.

The requirements for functional verification are determined by this evaluation.

a)

Drexelbrook capacitance level probe interlock fails. IE# PWL 1.

Periodic i

functional verification is required. Control ID: PEL-x-05.

b)

Endress-Hauser vibration fork level interlock fails.

IE# PWL 2.

Periodic functional verification is required. Control ID: PEL-x-04.

Administrative controls with computer or alarm assist (AC) l Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm. The requirements for functional verification are determined by this evaluation.

' Initial Issue Date:

16 OCT 98 Page No.

30 Revision Date: 31AUG99 Revision No.,_1

[none]

Administrative controls Safety Significant administrative controls are required operator actions that.usually occur without prompting from a computer / control panel alarm or indication. These controls _ may require documentation via Control Form or some other record.

Functional verification is not normally required, a)

Operators fail to detect accumulation of powder or moderator. IE# PWL 4.

Control ID:

A-PEL-x-05.

b)

Enclosure access door (s) not closed properly. IE# MOD 3. This condition should cause the process control interlock to prevent operation. Control ID: A-PEL-x-06.

Margin of Safety The nuclear criticality margin of safety has been evaluated to be very strong for this system. The neutron multiplication factor (ken) has been calculated to be 5; 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take ken 21.00.

The parameters that directly affect neutron multiplication, assuming 5.0 wt.% 2"U enrichment, are mass (controlled by level) and moderation. Criticality safety limits 4

(CSLs) and Bounding Assumptions (BA) are established for mass and moderator. A criticality (ken = 1.00) could be possible in the powder lift enclosure only given the following upset condition:

Powder of optimum density becomes optimally moderated (100.81'kg UO2 and 42.6 liters of H2O), and forms into a piled hemisphere (a conservative geometry).

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS (a) Group 1 Defense Elements (IE#s PWL 1-4 Geometry Defenses)

(a.1)

IE #PWL 1 Drexelbrook capacitance probe interlock in the lift enclosure system fails This event assumes that the Drexelbrook capacitance powder probe level interlock fails to function as designed, so that the alarm fails to alert operator, and that powder continues to accumulate into the enclosure.

Possible causes include:

Initial Issue Date:

16 OCT 98 Page No.

31 Revision Date: 31AUG99 Revision No. _1

r Probe fails to detect powder e

O Electrical failure of supporting equipment e

Consequences of this event occurring:

Powder accumulates in the enclosure Defenses designed to prevent this event from occurring:

Fail safe design Operator training.

Procedural compliance Independent residual defenses:

Endress-Hauser vibrating fork probe Operators inspect e

Moderator defenses (a.2) IE #PWL 2 Endress-Hauser vibrating fork probe interlock in the lift enclosure system fails This event assumes that the Endress-Hauser powder probe level interlock fails to function as designed, so that the alarm fails to alert operator, and that powder continues to accumulate into the enclosure.

V Possible causes include:

Probe fails to detect powder Electrical failure of supporting equipment e

Consequences of this event occurring:

Powder accumulates in the enclosure Defenses designed to prevent this event from occurring:

Fail-safe design Operator training e

Procedural compliance Independent residual defenses:

Drexelbrook capacitance probe Operators inspect e

Moderator defense (a.3)

IE# PWL 3 Powder Repeatedly Spills into Enclosure This event assumes that with each lifting process an amount of powder is spilled into 7

\\

Initial Issue Date:

16 OCT 98 Page No.

32 Revision Date: 31AUG99 Revision No. _1_

the enclosure bottom. This could be a small amount, which over a period of time pQ would accumulate to a nonfavorable geometry, or the entire pan contents, which wculd need to occur at least 4 times in order to accumulate greater than the safety limit.

Possible'causes include:

Material defect of pan

• ~

Operator error (over-filling the pan)

Mechanical malfunction of the lifting system e

Consequences of this event occurring:

Significant accumulation of powder Defenses designed to prevent this event from occurring:

~

Design of the process Operator training' j

Procedural compliance e

Independent residual defenses:

IE #PWL 1 Drexelbrook capacitance probe interlock IE #PWL 2 Endress-Hauser vibrating fork probe interlock e

e Moderator Not Available Operator presence in area (a.4);

IE #PWL 4 Or rator fails to inspect lift enclosure per procedure This event assumes that certain other controls have failed, and that either material or moderator have begun to accumulate'in the powder lift enclosure.

Possible causes include:

Operator error (fails to detect) e-Failure to follow procedure (fails to inspect once per shift) e Consequences of this event occurring:

Either powder (or moderator) continues'to accumulate in enclosure e

Defenses designed to prevent this event from occurring:

Training Independent residual defenses:

IE #PWL 1 Drexelbrook capacitance probe interlock e

IE #PWL 2 Endress-Hauser vibrating fork probe interlock e

Moderator Defenses O

Initial Issue Date:

16 OCT 98 Page No.

33 Revision Datei 31 AUG99 -

Revision No. _1_

m (a.5)

. IE #PWL 5 Batch counter interlock fails V

Possible causes include:

Sensor failure Circuitry failure Consequences of this event occurring:

Accumulation of powder in the system Defenses designed to prevent this event from occurring:

i e

Batch counter interlock Independent residual defenses:

IE #PWL 1 Drexelbrook capacitance probe interlock

' IE #PWL 2 Endress-Hauser vibrating fork probe interlock e

IE # PWL 4 Operater detects e

e

' Moderator defenses (b) Group 3 Defense Elements (IE#s MOD 1-4: Enclosure Moderation Defenses)

(b.1)

IE# MOD 1 Moderator (water) becomes available from source outside enclosure

(]

U This event assumes that water becomes available to the encloscre from some source outside the enclosure. Possible sources include: rain water leaking through the roof, air conditioning duct condensation, and water lines which run overhead.

Possible causes include:

Leaky roof Failed cooling water piping Failed city water piping e

Consequences of this event occurring:

Significant water available to enclosure (greater than the safety limit)

Defenses designed to prevent this event occurring:

Piping integrity Operators present in area Roof integrity e

Independent residual defenses:

Operators inspect e

Mass defense

'Q U

Initial Issue Date:

16 OCT 98 Page No.

34 Revision Date: 31AUG99 Revision No. _1

Gasket seal around maintenance access doors e

e IE # MOD 2 enclosure doesn't leak e

IE # MOD 3 access doors properly secured e

IE # MOD 4 access doors interlock Redundant, diverse level probes with interlock e

(b.2)

IE # MOD 2 Enclosure integrity This event assumes that the powder lift enclosure leaks at any point.

Possible causes include:

Gaps in enclosure service doors.

e Improper sealing of gasket material on access doors Material failure of enclosure e

Hole in lexan windows of access doors Gap in light fixture on base of enclosure e

Consequences of this event occurring:

Airborne problem in area e

Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

O Enclosure inspections / maintenance Independent residual defenses:

Operator presence in area e

IE # MOD 1 Moderator available e

IE # MOD 3 Access Doors Properly Secured IE # MOD 4 Access Doors Interlock e

Mass Defense (b.3)

IE # MOD 3 Containment Enclosure Access Doors Not Properly Secured This event assumes that containment enclosure access doors are not properly installed while processing, providing a path for water to enter.

Possible causes include:

Operator error (doors not closed properly)

Doors drift open Operator fail to shut door Consequences of this event occurring:

Initial Issue Date:

16 OCT 98 Page No.

35 Revision Date: 31AUG99 Revision No. _1_

i Airborne problem in area

.(~

\\

Path created for water to enter enclosure e

Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance Independent residual defenses:

Operators Inspect Geometry defense e

IE # MOD 1 Moderator available IE # MOD 2 Enclosure Doesn't Leak

)

e IE # MOD 4 Access Doors Interlock j

(b.4)

IE # MOD 4 Containment Enclosure Access Door Interlock failure 4

This event assumes that operators have installed an access door improperly, and the containment enclosure access door interlock fails.

Possible causes include:

Contact switch failure Door misalignment during installation e

A Consequences of this event occurring:

Airborne problem in area Path created for water to enter enclosure e

Defenses designed to prevent this event from occurring:

Component reliability Operator training Training (to keep the slots clear)

Independent residual defenses:

e IE # MOD 1 Moderator available e

IE # MOD 2 Enclosure Doesn't Leak IE # MOD 3 Access Doors Properly Secured Geometry Defense e

Common Mode Failures There is common mode failure potential regarding the level probes appearing in both the mass and the moderator branches of the fault tree. The risk is acceptable because 1)

The reason for the probes is primarily for potential powder accumulation. They

)

are, however, shown in the moderator branch because they are equally effective Initial Issue Date:

16 OCT 98 Page No.

36 Revision Date: 31AUG99 Revision No. _1_

for water.

h-2)

The strength of the other controls.

3)

Any sources of moderator are expected to be readily detected.

There is more significant common mode failure potential regarding IE# PWL 4. The required periodic operator inspection should detect either powder accumulation or water leaking into the enclosure. The risk is considered acceptable because of 1)

Operator training, including sensitivity to past incidents.

2)-

Documented inspections.

3)

Good visibility into the enclosure.

4)

The strength of the other controls, including SS interlocks.

5)

Any sources of moderator are expected to be readily detected.

Summary Tables - see Tables 5.3.2.1-1 and 5.3.2.1-2.

O O

Initial Issue Date:

16 OCT 98 Page No.

37 Revision Date: 31AUG99 Revision No. j

.m Table 5.3.2.1-1: Summary of Defenses Provided Against a Single Failure C.

for the Powder Lift Enclosure Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React GEOMETRY DEFENSE Mass spillage during lift process PWL3 PWL Moderator defense 1,2,4,5 MODERATOR DEFENSE Moderator available from This scenario is determined to be not credible. The enclosure is a internal source moderation control area.

Moderator available from MOD 1,2,3 PWL Geometry defense external source 1,2,4 MOD 4 NOTES:

1)

See Section 5.3.2.1.12 for a discussion of common mode failure potential.

O Initial Issue Date:

16 OCT 98 Page No.

38 Revision Date: 31 AUG99 Revision No. __1

r

(

Table 5.3.2.1-2: Nuclear Criticality Safety Limits for kerr = 0.90, 0.95, and Delayed Critical Powder Lift PARAMETER NORMAL BOUNDING CRITICALITY CRITICALITY CRITICALITY OPERATING ASSUMIrrION SAFETY SAFETY LIMIT CONDITIONS LIMIT LIMIT Delayed Critical s 0.9017 s 0.9453 (0.98) 2"U MASS Very Low 75.38 kg UO2 91.27 kg UO2 MODERATOR /

s 0.3 wt. %

Optimum 31.8 liters 1120 38.5 liters 1120 CONCENTRATION moisture GEOMETRY inches 0 inches 1 inch 2.4 inches plus hemisphere plus hemisphere plus hemisphere SPACING N/A N/A N/A N/A N/A Ilomogeneous -

DENSITY Optimum 1.9447

,f sv) gUO2/cc

(

ABSORBERS None None None None None ENRICHMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

Partial Water REFLECTION (1") except 12" CONC (-z)

Notes:

1) Moderator limits calculated from h/u235 = 250. (0.821 liters ll20/cc)

2) See Section 5.3.2.1.11 of CSE.

O Initial Issue Date:

16 OCT 98 Page No.

39 Revision Date: 31AUG99 Revision No. _1

FIGURE 6.3.2.1-1 FAULT TREE FOR PELLET POWDER LIFT ENCLOSURE CRmCAuiv POSSIDLE

,,:4 o

n 4

GREATER THAN THE $AFETY LIMITS OF MASS.

MODERATOR. AND GEOMETRY l

l l

MASS MOOERATOR CmFMTm DEFENSES FR DEFENSES FAL DEFENSES Fall N/A MASS LEVEL IS CONTROLLED AS CONFIGURATION DEFENSE lE MOD 1 l E M00 2 i E PWL 4 l

l WATEN AVAILABLE WATER GETS MTO OPERATOR FALS TO LEVEL PROBES FROM ENCLOSURE DETECT (PWL 4)

WTERL,OCK FAL 70 ni ncin ne w r pwnyw r

..a.

OPEC IEPWL5l IE PWL 3 l l

IE PWL 4 l BATCH COUNTER POWDER LEVEL PROBES OPERATOR F AILS WTERLOCK REPEATEDLY SPLLS NTERLOCKS FAL TO DE TECT P PEL X 12 A-PEL X45 IE MOD 2 W10 FNet OWF l

ENCLOSURE

• i m 84:

MAH

</,

WTEGRITY lE MOO S l IF MOD 4 !

ACCESS DOOR (S) NOT ACCESS DOOR l

AM X45 CLOSED PROPERLY WTERLOCK FAILS ip q, I IF M 2 l w

OPEC E+1 VlBRATION FORK DREAELBHOOK CAPACITANCE PROBE CAPACITMCE PROBE pagg PROBE FAILS k

6

^

l F

P OBE LS P PEL X-13 L'#

L-X&

TRAINING & WORK PRACTICE MC AEC A ML-X46 l

i i

Initial issue Date:

16 OCT 98 Page No.

40 Revision Date: 31 AUG99 Revision No. _1_

<n' Roll Compactor Hopper O

Controls Safety Significant Controls Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# MOD ;

Periodic verification is not required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-14.

b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# MOD

2. Periodic verification required. ControlIDi P-PEL-x-15.

c)

Water accumulates in hopper.

IE# MOD 5.

Periodic verification is no_t required because the hopper naturally drains by gravity down through the roll compactor and granulator. Control ID: P-PEL-x-16.

Active engineered controls (AEC)

Active Engineered Controls are described in the _ License and in Regulatory Affairs procedure RA-108.

They are also ' called safety significant interlocks.

The requirements for functional verification are determined by this evaluation. Control ID:

PEL-x-08.

a)

Level probe fails to stop operation.

IE# RHD 1.

Periodic functional verification is required.

Administrative controls with computer or alarm assist (AC)

- Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm. The requirements for functional verification are determined by this evaluation.

[none]

Administrative controls Safety Significant administrative controls are required operator actions that usually occur without prompting from-a computer / control panel alarm or indication. These controls may require documentation via Control Form or come other record.

Functional verification is not normally required.

l O

Initial Issue Date:

16 OCT 98 Page No.

41

~ Revision Date: 31AUG99 Revision No. _1_

a)

Vibratory feeder fails, allowing bridging. IE# RHD 2. Control ID: A-PEL-x-07, b)

Operator fails to detect buildup of powder or water in hopper. IE# RHD 3.

Control ID:

A-PEL-x-08.

c)

Enclosure access door (s) not closed properly. IE# MOD 3.

This condition should cause the process control interlock to prevent operation. Control ID: A-PEL-x-06 (the same control as in Section 5.3.2.1).

Margin of Safety The nuclear criticality margin of safety has been evaluated to be very strong for this system. The neutron multiplication factor (ken) has been calculated to be s; 0.95 during normal operations and expected process upsets. Further, a single contingency (loss of mass or moderator defense), will not take ken 21.00.

The parameters that directly affect neutron multiplication, assuming 5.0 wt.% 2"U enrichment, are mass (controlled by level) and moderation. Criticality safety limits (CSLs) and Bounding Assumptions (BA) are established for mass and moderator. A criticality (ken = 1.00) could be possible only given the following upset condition:

A sufficient mass (full hopper, i.e., more than 114.7 kg UO2) accumulates in the hopper such that it forms a nonfavorable geometry, and the powder becomes g

optimally moderated (more than 48.4 liters H2O).

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE FROCESS UPSETS (a) Group 1 Defense Elements (IE#s RHD 1-3: Geometry Defenses)

(a.1)

IE #RHD 1 Level Probe Fails to Stop Fill Operation This event assumes that the powder sensing level probe in the hopper fails to stop the fill operation when it senses powder as designed, so that powder continues to accumulate in the hopper, filling the hopper and potentially also eventually spilling over into the enclosure bottom.

The probe elevation in the hopper is such that only one pan of powder at a time is allowed to be dumped. As the powder flows through the compactor, and drops below the probe, the system allows the elevator to send another pan of powder up. Volume in the hopper is approximately 57 liters. A single overfill incident, caused by a failed level probe, would not result in greater. than a minimum critical mass in the hood, as long as the operator regularly inspects and cleans out the hood as required.

Possible causes include:

Level probe failure Initial Issue Date:

16 OCT 98 Page No.

42 Revision Date: 31AUG99 Revision No.

1

Electrical failure of supporting equipment e

p) e Interlock failure

(

Consequences of this event occurring:

Powder accumulation in the hopper and enclosure Defenses designed to prevent this event from occurring:

l Level probe is reliable instrument Operator training e

Procedural compliance Operators periodically verify operation e

l Independent residual defenses:

)

IE #RHD 2 Vibratory feeder IE #RHD 3 Operator detects IE #RHD 4 Batch counter interlock e

e Moderator defense

-(a.2)

IE #RHD 2. Vibratory Feeder Fails to Operate This event assumes that the vibratory feeder mounted on the hopper fails, which might i

q cause powder to bridge across the opening at the bottom. Successive cycles could fill the I

hopper to a nonfavorable geometry.

Possible causes include:

Electrical or mechanical failure Consequences of this event occurring:

UO2 powder bridges across opening, and may accumulate in hopper

)

Defenses designed to prevent this event from occurring:

Operators take material off granulator Operators monitor feeder operation Independent residual defenses:

IE #RHD 1 Level probe IE #RHD 3 Operator detects e

IE #RHD 4 Batch counter interlock e

' Moderator defense (a.3)

IE #RHD 3 ' Operator Fails to Detect Powder Accumulation in Hopper This event assumes that the operator fails to realize that material is accumulating in the m)

. Initial Issue Date:

16 OCT' 98 Page No.

43 Revision Date: 31AUG99 Revision No. _1

)

hopper. This would be evident to him because the pack in the roll hood would not fill.

%)

Possible causes include:

Operator attention diverted elsewhere on line

-e Shift change -

e Inadequate training Consequences of this event occurring:

Powder fills the hopper after approx. sixth dump Defenses designed to prevent this event occurring:

Operator training Independent residual defenses:

IE #RHD 1 Level probe IE #RHD 2 Vibratory feeder o'

IE #RHD 4 Batch counter interlock Moderator defense (a.4)

IE #RHD 4 Batch counter interlock fails (process control - not SS)

Possible causes include:

O Sensor failure e'

- Circuitry failure Consequences of this event occurring:

Accumulation of powder in the system Defenses designed to prevent this event from occurring:

e Batch counter interlock Independent residual defenses:

e -

IE #RHD 1 Level probe IE #RHD 2 Vibratory feeder IE #RHD 3 Operator detects e

Moderator defense (b) Group 3 Defense Elements (IE#s MOD 1-4: Enclosure Moderation Defenses)

[ Note: These events are essentially identical to those for the powder lift.]

.(b.1)

- IE # MOD 1 Moderator (water) becomes available from source outside enclosure

('\\

L.J :

Initial Issue Date:

16 OCT 98 Page No.

44 Revision Date: 31AUG99 Revision No. _1

This event assumes that water becomes available to the enclosure from some source qV outside the enclosure. Possible sources include: rain water leaking through the roof, air conditioning duct conder,sation, and water lines which run overhead.

Possible causes include:

Leaky roof e

Failed cooling water piping e

Failed' city water piping Consequences of this event occurrmg:

Significant water available to enclosure (greater than the safety limit)

)

Defenses designed to prevent this event occurring:

Piping integrity Operators present in area Roofintegrity.

Independent residual defenses:

IE #RHD 3 operators detect IE # MOD 2 enclosure doesn't leak IE # MOD 3. access doors properly secured e

e IE # MOD 4. access doors interlock Db e

-IE # MOD 5 water does not accumulate in hopper Geometry defense e

.(b.2) lE # MOD 2 enclosure leaks This event assumes that the powder lift enclosure leaks at any point..

Possible causes include:

I Gaps in enclosure service doors.

e Improper sealing of gasket material on access doors e

Material failure of enclosure Hole in lexan windows of access doors e

Gap in light fixture on base of enclosure e

p Consequences of this event occurring:

Airborne problem in area e

Path created for water to enter enclosure 4

Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance

' Initial Issue Date:

16 OCT 98 Page No.

45 Revision Date: 31AUG99 Revision No. _1_

l I

l-l Independent residual defenses:

RHD 3 Operators Detect x

e IE # MOD I Moderator not available l

IE # MOD 3 Access Doors Properly Secured IE # MOD 4 Access Doors Interlock IE # MOD 5 Water does not accumulate in hopper e

Geometry Defense e

(b.3)

IE # MOD 3 Containment Enclosure Access Doors Not Properly Secured This event assumes that containment enclosure access doors are not properly installed l

while processing, providing a path for water to enter.

- Possible causes include:

Operator error (doors not closed properly)

Doors drift open e

Operator fail to shut door Consequences of this event occurring:

Airborne problem in area Path created for water to enter enclosure e

Defenses designed to prevent this event from occurring:

Enclosure inspections / maintenance Independent residual defenses:

IE #RHD 3 Operators Detect IE # MOD 1 Moderator not available IE # MOD 2 Enclosure Doesn't Leak e

IE # MOD 4 Access Doors Interlock e

IE # MOD 5 Water does not accumulate in hopper Geometry defense e

(b.4)

IE # MOD 4 Containment Enclosure Access Door Interlock failure -

Th.is event assumes that operators have installed an access door improperly, and the containment enclosure access door interlock fails.

Possible causes include:

Contact switch failure Door misalignment during installation e

Initial Issue Date:

16 OCT 98 Page No.

46 Revision Date: 31AUG99 Revision No. _1_

l-

l Consequences of this event occurring:

e' Airborne problem in area e

Path created for water to enter enclosure Defenses designed to prevent this event from occurring:

Component reliability Operator training Training (to keep the slots clear)

Independent residual defenses:

RHD 3 Operators Detect e

IE # MOD 1 Moderator available e

IE # MOD 2 Enclosure Doesn't Leak IE # MOD 3 Access Doors Properly Secured e

IE # MOD 5 Water does not accumulate in hopper Geometry Defense e

Common Mode Failures There is significant common mode failure potential.regarding IE# RHD 3.

The required

_f periodic operator inspection should detect either powder accumulation or water leaking into the enclosure. The risk is considered acceptable because of 1)

Operator training, including sensitivity to past incidents.

2)

Documented inspections, 3)

Good visibility into the enclosure.

4)

_ The strength of the other controls, including SS interlocks.

5)

Any sources of moderator are expected to be readily detected.

6)-

Any water getting into the roll compactor hopper should pass down through the rollers, the granulator, and out into the roll hood, i.e., it is not expected to be able to collect in the hopper.

Summary Tables - see Table 5.3.2.2-1 and 5.3.2.2-2.

Initial Issue Date:

16 OCT 98

. Page No.

47 Revision Date: 31AUG99 Revision No. _1,

Table 5.3.2.2-1:

Summary of Defenses Provided Against a Single Failure for s

(

the Roll Compactor Hopper Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React GEOMETRY DEFENSE Ilopper fills with powder RilD 2 RilD 1,4 RilD 3 Moderator Defense MODERATOR DEFENSE Moderator available from This scenario is determined to be not credible. The enclosure is a internal source moderation control area, and the containers are under moderation control.

Moderator available from MOD MOD 4 Geometry Defense external source 1,2,3,5 RIID 3 l

NOTES:

"Q(N 1)

See Section 5.3.2.2.12 for a discussion of common mode failure potential.

O Initial Issue Date:

16 OCT 98 Page No.

48 Revision Date: 31AUG99 Revision No. _1

n Table 5.3.2.2-2: Nuclear Criticality Safety Limits for kerr = 0.90, 0.95, and il Delayed Critical Roll Compactor Hopper v

PARAMETER NORMAL BOUNDING CRITICALITY CRITICALITY CRITICALITY OPERATING ASSUMPTION SAFETY SAFETY LIMIT CONDITIONS LIMIT

' LIMIT Delayed s 0.90

$ 0.95 Critical (0.98) 2"U MASS Approx.

69.3 kg UO2 90.3 kg UO2 106.3 kg UO2 38 kg UO2 MODERATOR /

s 0.3 wt. %

Optimum 29.3 liters 1120 38.1 liters 1120 44.9 liters II20 CONCENTRATION moisture GEOMETRY Approx.

11.0 inches 12.5 inches 13.5 inches 8 inches SPACING N/A N/A N/A N/A N/A o/

Ilomogeneous -

DENSITY Optimum 1.9447 gUO2/cc ABSORBERS None None None None None ENRICIIMENT s 5.0 wt. %

$ 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

REFLECTION Partial Water (l")

Notes

1) See Section 5.3.2.2.11 of CSE.

2) Mass during normal operation is up to approx. 38 kg UO2 (level probe height plus one batch)

3) Volume / geometry during normal operation is approx. 8" height in hopper (probe height vol. plus 9 liters)

4) The heights for 0.98,0.95, and 0.90 were actually a little higher, but were rounded down to the next lowest

%" for conservatism.

l (O

v Initial Issue Date:

16 OCT 98 Page No.

49 Revision Date: 31 AUG99 Revision No. _1_

l

)

p FIGURE 6.3.2.2-1 O

FAULT TREE FOR PELLET ROLL COMPACTOR HOPPER CRmCum POSSISLE r..

m. ;,

.e

"'^%'.T '.'"'"

a MODERATOR. AND GEOMETRY I

I I

W8 MODERATOR CONFIGURATION DEFENSES F4 DEFENSES FR DEFENSES FM i

NrA C

R D A8 CONFIGURATION DEFENSE i

samsI s uco i l I

s uoo m W ATER AVAlLAOLE WATER GET5 INTO WATER ACCUMULATE.$

OPERATORS FM TO FROM ENCLOSURE W HOPPER DETECT gM OPE,RATOR FRS SATCH COUNTER MATERIAL FLLS OPEC O DETECT WTERLOCg HOPPER PEC E

A enL.x-to COP 420116(LNE S) g g

WTEGRITY A.PEL-X48 M=>

l

-I sabE.,

7tOs70%"O47

1. EE'c'Es Ins tEvEL PR E,as TO RA v EE R PEC STOP OPERATION ALLOWING BRM%

P.PEL.X-t$

,_ _.,,,_,.E

,_ _. _ _ T.E PEL 4,

AML-X48 Initial Issue Date:

16 OCT 98 Page No.

50 Revision Date: 31AUG99 Revision No. _1

y i?

Compaction and Granulation L

j

' Controls l

Safety Significant Controls l

l l:

Passive engineered controls (PEC)

Passive engineered controls are described in the License and in Regulatory Affairs Procedure RA-108. The requirements for functional verification are determined by this evaluation.

t.

a)

Water available from outside source (roof leak, pipe leak, etc.). IE# RHD 5.

. Periodic verification is not. required because any leaks are readily detected during normal operations. Control ID: P-PEL-x-08, b)

Enclosure integrity fails, allowing water to leak into the enclosure. IE# RHD 6.

Periodic verification required. Control ID: P-PEL-x-09.

c)

.. Water accumulates in hopper. IE# RHD 9. Periodic verification is not required I

because the hopper naturally drains by gravity down through the granulator, and into the pack being filled, and because any water leaks are expected to be readily detectable. Control ID: P-PEL-x-10.

d)

Volume reducer removed. IE# GRA 1. Periodic verification is not required

-because of periodic, documented check by operations per COP-820114, and because the granulator hopper will be flagged (as a result of this evaluation) as equipment that contains safety significant components (see IE GRA 1 in Section j

5.3.3.12). Control ID: P-PEL-x-11.

Active engineered controls (AEC)

' Active' Engineered Controls are described in the License and in Regulatory Affairs procedure RA-108.

They.are also called safety significant interlocks.

The requirements for functional verification are determined by this evaluation.

[None]

Administrative controls with computer or alarm assist (AC) i Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm. The requirements for functional verification are determined by this evaluation.

[none]'

' Administrative controls Initial Issue Date:

16 OCT 98 Page No.

51 Revision Date: 31AUG99 Revision No. _1_

t

n I

L Safety Significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or some other record.

Functional verification is pot normally required.

a)

Operators fail to detect accumulation of powder or moderator. IE# GRA 2.

Control ID: A-PEL-x-03.

b)

Powder lift enclosure access door (s),1 or more, not closed properly. IE# RHD

7. This condition should cause an interlock to prevent operation of the lift (see IE# RHD 8 below). Control ID: A-PEL-x-04.

Margin of Safety l

The nuclear criticality margin of safety for the granulator hopper is evaluated to be l

strong. Calculations performed in support of this CSE indicate that kar 5; 0.95 for all i

normal conditions and expected process upsets.

l The parameters that directly affect neutron multiplication for the granulator hopper, 2

assuming 5.0 wt.%

"U enrichment, are moderator and geometry.

That is, the geometry of the hopper must become nonfavorable by removal of the volume reducer inside, and it must be filled with UO: powder at optimum moderation. Criticality safety limits (CSLs) and bounding assumptions (bas) have been established to prevent the removal of the volume reducer, and the introduction of moderator. A criticality would be possible in a granulator hopper given the following process upsets:

Volume reducer is removed and not detected, and the hopper is filled with UO2 e

powder at optimum moderation.

SUMMARY

OF INITIATING EVENTS WHICH LEAD TO CREDIBLE PROCESS UPSETS The fault tree in Figure 6.3.3-1 shows potential initiating events (IE's) that could lead to criticality, and the backup or residual defenses that provide protection should the initiating event take place. The discussion below briefly describes the event, and provides supplemental information regarding the fault tree.

IE GRA 1 This event assumes that the volume reducer is removed from the granulator hopper.

This event alone constitutes a contingency, in that it renders the hopper a nonfavorable geometry. As a result of this evaluation, this piece of equipment will be flagged in MAPCON as containing safety significant (SS) components. This means that if any maintenance is performed on the granulator hopper, the work order will include an t

"SS" flag, and a warning that functional testing may be required prior to returning the Initial Issue Date:

16 OCT 98 Page No.

52 Revision Date: 31AUG99 Revision No. _1

p equipment to service. This, plus the periodic, documented inspection during operation tj makes it highly unlikely the equipment.would be operated without the volume limiter properly installed.

IE GRA 2 This event assumes that the operator fails to realize that moderator is accumulating in the hopper.

IE GRA 3 This event postulates that the batch counter interlock (non-safety significant) fails.

IE RHD 5

. This event assumes that water becomes available to the enclosure from some source outside the enclosure.

'IE RHD 6 This event assumes that the enclosure integrity fails, allowing leaks into the enclosure.

IE RHD 7 This event assumes that containment enclosure access doors are not properly installed while processing, providing a path for water to enter.

IE RHD 8

- This event assumes that the containment enclosure access door interlock (non-safety significant). fails, and would not stop the process if all doors were not installed properly.

IE RHD 9 This initiating event assumes water accumulates in the granulator hopper. As the granulator is open through an 8 mesh screen, water would drain by gravity inte the roll hood below, a passive engineered control.

Common Mode Failure There is significant common mode failure potential regarding IE# GRA 2, which appears in both the geometry and the moderator branch of the fault tree. The required periodic operator inspection should detect either powder accumulation or water leaking Initial Issue Date:

16 OCT 98 Page No.

53 Revision Date: 31AUG99 Revision No. _1

F

,y into the enclosure. The risk is considered acceptable because of:

--u 1)

Operator training, including sensitivity to past incidents.

2)

The inspections are documented.

3)

Good visibility into the enclosure.

4).

The strength of the other controls, including passive engineered controls and process control interlocks.

5).

Any sources of moderator are expected to be readily detected.

6)

Any water getting into the granulator should pass by gravity through the screen, and out into the roll hood, i.e., it is not expected to be able to collect in the hopper.

Summary Tables - see Table 5.3.3-1 and 5.3.3-2.

l i

l l

l l

O Initial Issue Date:

16 OCT 98 Page No.

54 Revision Date: - 31 AUG99 Revision No. _1

f n

(_)

Table 5.3.3-1 Summary of Defenses Provided Against a Single Failure for the Granulator Hopper Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

)

React React MODERATOR DEFENSE Moderator available from This scenario is determined to be not credible. The enclosure is a internal source moderation control area, and the containers are under moderation control.

Moderator available from RIID RilD 8 Geometry Defense l

external source 5,6,7,9 GRA 2 i

GEOMETRY DEFENSE Volume Reducer Removed

1. 1. • • I # #"'#

GRA 1,3 GRA 2 from Ilopper

.]

NOTES:

1)

See Section 5.3.3.12 for a discussion of common mode failure potential.

2)

Undetected removal of the volume limiter, rendering the granulator hopper non-favorable geometry, is highly unlikely. It would require multiple failures of rigorous administrative controls.

M.

(G Initial Issue Date:

16 OCT 98 Page No.

55 Revision Date: 31AUG99 Revision No. _1

p Table 5.3.3-2: Nuclear Criticality Safety Limits for ken = 0.A),0.95, and Delayed Critical d

Granulator Hopper l

l l

l PARAMETER NORMAL BOUNDING CRITICALITY CRITICALITY CRITICALITY i

OPERATING ASSUMPTION SAFETY SAFETY LIMIT CONDITIONS LIMIT LIMIT Delayed Critical s 0.75 5 0.90 s 0.%5 2 1.00 2"U MASS Not Not llopper liopper Controlled Controlled Filled Filled MODERATOR /

s 0.30 wt. %

Optimum Optimum Optimum CONCENTRATION moisture Favorable Favorable Favorable GEOMETRY Volume Volume Volume i

Reducer Reducer Reducer Installed Installed Removed SPACING N/A N/A N/A N/A y

Approx.

Optimum Optimum Optimum DENSITY 4-5 g/cc (II/X = 250)

(11/X = 250)

(II/X = 250) l (dry) 1.9447 1.9447 gUO2/cc 1.9447 gUO2/cc gUO2/cc ABSORBERS None None None None ENRICllMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

Partial Water Partial Water Partial Water Partial Water REFLECTION (l")

(l")

(l")

(l")

l l

NOTES:

1)

See CRI-97-018 and Section 5.3.3.11.

[v Initial Issue Date:

16 OCT 98 Page No.

56 Revision Date: 31AUG99 Revision No. _1 1

O FIGURE 6.3.3-1 i

V FAULT TREE FOR GRANULATOR HOPPER CRmCALITY POSSIBLE l

e CRITICALITY PRECURSOR >

GREATER THAN THE SAFETY LIMITS OF MODERATOR AND GEOMETRY I

l MASS MODERATOR CONFIGURATION DEFENSES DEFENSES FML DEFENSES FML pgL

!O F

F e CONTINGENCY >

a CONTINGENCY >

NsA GREATER THAN THE SAFETY LIMIT

, VOLUME REDUCER REMOVED.

NO CONTROLS OF WATER (52 LITERS) -

HOPPER SECOMES NONFAVORASLE ON MASS

- ACCUMULATES IN HOPPER GEOMETRY VESSEL g

DURING NORMAL OPERATIONS

/A l

l IE GRA 1 IE GRA 2 IE GRA 3 VOLUME REDUCER OPERATOR FAILS 1O BATCH COUNTER REMOVED DETECT INTERLOCK

_,..s.

-p., -

e o

o COP-820114 P-PEL-X-11 A-PEL-X-03 O

V Initial Issue Date:

16 OCT 98 Page No.

57 Revision Date: 31AUG99 Revision No. j

FIGURE 6.3.3-1 (Cont'd)

FAULT TREE FOR GRANULATOR HOPPER F

< CONTINGENCY >

GREATER THAN THE SAFETY LIMIT OF WATER (32 LITERS)

ACCUMULATES IN HOPPER e

IE RHD 5 l l

IE RHD 9 l l GRA2 WATER AVAILABLE WATER GETS INTO WATER ACCUMULATES DETECT FROM OUTSIDE ENCLOSURE AROUND IN HOPPER ant 5% f AlL S '

PEC O

P-PEL-X48 O

lE RHD 8 a

TRAINING. & WORK PRACTICE ENCLOSURE ACCESS DOORS A-PEL-X-03 INTEGRITY FAILS ALLOW WATER INTO ENCLOSURE PEC P-PEL-X-09 IE RHD 7 l l

IE RHD 8 ACCESS DOORS NOT ACCESS DOORS PROPERLY INSTALLED INTERLOCK FAILS COP-820114 A-PEL-X-04 O

Initial Issue Date:

16 OCT 98 Page No.

58 Revision Date: 31 AUG99 Revision No, j a

PELLET PRESS In terms of criticality safety, the amount of uranium powder in the pellet press dies is not 'of concern. The potential concern with the press operation is the moderator 1

(lubricant and hydraulic fluids) present, and the possibility of accumulation of the moderators in combination. with the accumulation of powder in the collection containers, i

There are two larger collection containers. The primary sump, an approx.15 liter favorable geometry container, is the main collector for any oil or hydraulic fluid inside the press. It is normally drained by use of a drain plug on the back of the machine.

Should the primary sump fill and overflow via the slots, the fluid will run horizontally out the back of the press via an access hole, and down into a drainage pan under the press, thus eliminating the possibility of fluid buildup inside the press. The drainage pan is approx.1" deep, and sits on the concrete floor. Any overflow into the drainage pan is readily detected by the operator, i

There are passive engineered controls, administrative controls and process limitations in place which render a criticality not credible. The favorable dimensions of the collection containers are the passive engineered controls. The administrative controls consist of a req'uired, documented weekly inspection of the primary sump. Cleanout is required if the depth of powder / oil sludge exceeds approx. 0.5" thickness.

There is also a required, documented inspection and cleanout of the upper portion on the press at the end of shift. COP-820206.

~Concerning the process limitations, the design of the press precludes addition of uranium powder to lubrication or hydraulic reservoirs or sumps. Material collected during sump cleaning is sent to the Analytical Services (Chemical) Laboratory for analysis of the uranium content. Evaluation had determined that the small surface accumulation of powder on internal gears, which in turn become deposited in the lubrication, is less than 5000 ppm. This very small presence of uranium in the oil means that the powder which does make it into the sump is extremely over-moderated, and therefore poses no threat to nuclear criticality.

At the boat loader, the operations are performed in a large, rectangular ventilated hood.

The right side of the hood contains machinery to accomplish the boat loading; because of the equipment and the manner in which the pellets are handled, it is not credible for significant quar.tities of uranium to accumulate in this portion of the hood. In the left side, the pellets are loaded onto_a movable plate / table, under which there is a pan approx.1.5" deep. Under the table and pan is the bottom of the hood, with a hole through which the pellets are lowered into the boats below. The opening is framed with a raised lip about 5/8" high, and is sloped toward the opening on one side. Procedure 1

calls for cleaning the pan and hood bottom each shift. If material were allowed to Initial Issue Date:

16 OCT 98 Page No.

59 Revision Date: 31AUG99 Revision No. _1

(

accumulate, it would spill out the bottom opening before reaching a safe slab height;

(

any excessive accumulation would also be expected to interfere with process operations.

Also, any water in the left side on the hood would likewise run out the bottom opening.

Nuclear criticality in the pellet press and boat loader is judged to be not credible.

Double Contingency is not required, and no fault tree is provided.

No further evaluation is required.

It is noted that a previous evaluation was made of the potential accumulation of SNM and oil in the pellet presses after an incident at another fuel fabricator. Most of the data presented in this section is from that evaluation.

SINTERING FURNACE The pellet sintering furnace is a very high temperature furnace through which favorable geometry, favorable volume molybdenum containers (" moly boats") filled with " green" uranium pellets are processed. In the furnace, the green pellets sinter into ceramic UO2 pellets. The furnace is essentially solid-brick construction, with a small chamber through which the boats pass. The boats are pushed into the chamber at regular internals, with one boat exiting as another is pushed in. Residence time in the furnace is on the order of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, r'\\

("j The furnace high heat chamber cross-section is irregularly shaped, with the boats riding in an elevated hearth plate. The high heat chamber sides are occupied by the heaters.

Pre-heat chamber length varies with furnace design. Overall chamber length is approx.

25 feet.

Evaluation has determined that though nonfavorable in dimension, the chamber is essentially a hood through which a favorable diameter-equivalent infinite cylinder of pellets travels. The entering boats are filled to the top with green pellets (approx. 60% theoretical density), with no mounding of pellets above the boat top edges. Boat size is approx. 4" ID high. Material exit density is over 90%, reducing the fill height of pellets in the boat by about 1/3, i.e., to a height of approx. 2 2/3".

The boats move slowly, and occasionally a few pellets spill out. The moly boats are inspected regularly for integrity and serviceability. Should a boat rupture inside the furnace, the resulting spill would cause a potential jam inside the chamber, which would be detected immediately. The process would be stopped and the jam cleared.

The longitudinal cross-section dimension of the boats in the furnace is approx. 9" x 4" high. This gives an equivalent cylinder diameter of 6.77". Thus even if the boats were assumed to be full of >90% density pellets, the equivalent radius is significantly less than the MPV diameter (8.4") for 5.0 wt.% enrichment UO2 pellets.

The actual equivalent diameter is approx. 5.53" because the >90 wt.% pellets only occupy a fill height of approx. 2 2/3".

m Initial Issue Date:

16 OCT 98 Page No.

60 Revision Date: 31AUG99 Revision No.,_1

rm Another measure of the margin of safety can be made by assuming an infinite X-Y slab b

of pellets at the height of the >90 wt.% pellets in the boats (approx. 2 2/3"). This height is well below the MPV slab height of 3.5" (UO2 pellets at 5.0 wt.% enrichment).

i It was determined that there is no credible source of moderator available to the furnace chamber during operation, i.e., when pellets are in the chamber. If any wr2ter did enter the furnace, the process temperature is well above 1000 degrees Centigrade, which will cause immediate vaporization into steam (a readily detectable condition).

Therefore is was concluded that nuclear criticality is not credible for the sintering furnaces. Double Contingency is not required, and no fault tree is provided. No further evaluation is required.

GRINDING The grinder itself is clearly not a criticality safety concern. The feeder bowl, a batch added, favorable volume <3 inch high lipped dish, which vibrates to feed pellets into the linear vibrating conveyor to the grinder, is also not a criticality concern.

The recirculation surge tank, also called the coolant tank, is a 10.0 inch outer diameter, 20 inch long cylinder with various inlet and outlet pipes and connections. It is a bounding assumption that any uranium in the tank can be considered homogeneous.

7~sv)

Therefore the surge tank is favorable diameter, t

The remainder of this section presents evaluations for the following:

Grinder centrifuge e

Collection chutes and packs under the grinder bowl feeders and under the grinder exit to the tray loaders Centrifuge The process upsets which are required for a criticality to be possible in the centrifuge bowl / housing are not credible. However, there are controls in place to give added margin of safety. These controls are discussed below, but no fault tree has been prepared.

Controls The control for the centrifuge is the geometry / configuration of the centrifuge bowl. Controls that provide additional margin of safety are discussed in " Summary of Initiation Events..."

below.

,m,Q Margin of Safety Initial Issue Date:

16 OCT 98 Page No.

61 Revision Date: 31AUG99 Revision No. _1

n The nuclear criticality margin of safety for the grinder centrifuge has been evaluated to be extremely strong. The neutron multiplication factor (Km) has been calculated to be 50.95 during normal operations and expected process upsets. No single process upset will take Ka 21.00.

Technically, the centrifuge is a single parameter system, with geometry (mass accumulation) being the sole parameter that directly affects neutron multiplication, assuming 5.0 wt.% "U enrichment. The bowl and housing are favorable geometry, 2

but accumulation above the lip of the bowl is nonfavorable. Assuming not credible events to occur, a criticality could be possible only given the following upset conditions:

Bowl and housing till above the lip of the bowl

)

Summary Of Initiating Events Which Lead To Credible Process Upsets For The Grinder Centrifuge These initiating events are provided for information only, to illustrate the size of the margin of safety for the centrifuge. There has never been a situation where the housing has filled with solids. Since the bowls were downsized several years ago, and the 150 tray counters were installed, there have been no incidents where a bowl has been filled O

completely with solids (a) Group 1 Defense Elements (IE#s CEN 1-3: Geometry Defenses)

(a.1)

IE #CEN 1 Operators fail to clean out bowl after 150 trays This event assumes that the operators fail to stop grinding after 150 trays and clean out the bowl. There is a counter that stops the grinder after 150 trays have been ground. The operators by procedure are required to clean the bowl before resetting the counter and continuing the grinding operation. They are also required to enter in their log that the bowl has been cleaned.

Possible causes include:

Counter circuitry failure Procedural violation (operator resetting counter and not cleaning out bowl)

Consequences of this event occurring:

Centrifuge accumulates more sludge Possible overload of bowl Defenses designed to prevent this event from occurring:

O Operator training Initial Issue Date:

16 OCT 98 Page No.

62 Revision Date: 31AUG99 Revision No. _1

l A

Independent residual defenses:

1 Obvious indications that bowl is overloading l

Process limitations that prevent bowl and housing from filling above lip of bowl (a.2)

IE #CEN 2 Failure of Interlock to Stop Grinder if Centrifuge Stops Spinning This event assumes that the centrifuge stops spinning due to electrical or mechanical malfunction, and the grinder continues to operate.

Possible causes include:

L Electrical or mechanical failure Consequences of this event occurring:

j Centrate enters centrifuge Sludge settles out in bowl Recirculation water becomes noticeably dirty Defensea designed to prevent this event from occurring:

Operators monitor centrifuge operation Operators detect filmy pellets O,

Independent residual defenses:

)

Process limitations that prevent bowl and housing from filling above lip of bowl.

(a.3)

IE #CEN 3 Operator Fails to Detect Centrifuge Malfunction l

This event assumes that the operator fails to detect that the centrifuge has stopped spinning.

4 Possible causes include:

Operator attention diverted elsewhere on line -

Shift change Inadequate training Consequences of this event occurring:

Sludge settles in bowl Defenses designed to prevent this event occurring:

Operator training

. Independent residual defenses:

1. CEN 2 Interlock stops grinder if centrifuge stops spinning I

' Initial Issue Date:

16 OCT 98 Page No.

63 Revision Date: 31AUG99 Revision No. j

!u

OV No potential common mode failures were identified.

Summary Tables - see Table 5.3.6.1-1.

Table 5.3.6.1-1:

Summary of Defenses Provided Against a Single Failure for the Grinder Centrifuge j

Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React l

GEOMETRY DEFENSE Bowl and housing fill 1,2 3

It is not credible that the bowl or completely (above lip of bowl) housing area would fill with with sludge sludge above the lip of the bowl.

l Collection Chutes Under Grinder Feeder Bowls and Tray Loaders Underneath the bowl feeder to each grinder is a collection chute leading to an 8" dia, poly pack in the event pellets or chips fall from the feeder. Lines 1-4 packs are inside an approx.

14" x 14" x 14" ventilated enclosure. The Line 5 pack sits in a favorable diameter (9"), close-(q

,y fitting enclosure, and also has a level probe / proximity switch (active engineered control) at the top of the pack. Activation of the level probe stops the bowl feeder, the vibratory feeder for the inlet and outlet of the grinder, and the vibratory track feeding the tray loader.

Line 5 only also has a collection chute under the pellets as they proceed single file from the grinder to the tray loader. The pack sits in a favorable diameter, close-fitting enclosure (9"),

and also has a level probe / proximity switch (active engineered control) at the top of the pack.

Activation of the level probe stops the bowl feeder, the vibratory feeder for the inlet and outlet of the grinder, and the vibratory track feeding the tray loader; it also stops the centrifuge and the coolant pump.

l Controls Safety Significant Controls There are three types of safety significant controls identified and required in this evaluation.

Passive Engineered Controls Passive engineered controls are described in the License and in Regulatory Affairs procedure o

RA-108. The requirements for functional verification are determined in this section.

, b l

Initial Issue Date:

16 OCT 98 Page No.

64

. Revision Date: 31AUG99 Revision No. _1

a)

Favorable diameter collection pack fails. IE-4. Periodic verification is not required O

because of the frequent operator inspections. Control ID: P-PEL-x-17.

b)

The roof, overhead pipes, etc., provide integrity to prevent sources of moderator.

IE-5. Periodic verification is M required because any leaks are readily detected and corrected during normal process operations. Control ID: P-PEL-x-18.

c)

System covers etc., prevent water from entering collector chute. IE-6. Periodic verification is not required because sources of moderator are readily detected, overfilling the pack should cause water to run out onto the floor (enclosure not water-tight), and because of continuous operator attendance. Control ID: P-PEL-x-19.

d)

Gap between top of pack and the bottom of the chute permits overflow of any liquid.

IE-7. Periodic verification is not required because of the fixed geometries involved.

Control ID: P-PEL-x-20.

i Active Engineered Controls Active Engineered Controls are defined in the License and in RA-108. They are also called safety significant interlocks., The requirements for functional verification are determined in j

this section.

l a) Interlock to stop operations when pack filled level is detected. IE-8. Either material (pellets / chips) or water will activate the interlock. - Periodic verification is required.

Control ID: PEL-x-09, (feed bowl collector pack) and PEL-X-10 (exit vibrator conveyor collection pack).

l Administrative Controls with Computer and/or Alarm Assist Administrative controls with computer or alarm assist (AC) typically consist of operator actions that are prompted or assisted by computer output or hard-wired alarm or visual i

indication. The requirements for functional verification are determined by this evaluation.

[None]

Administrative Controls Safety significant administrative controls are required operator actions that usually occur without prompting from a computer / control panel alarm or indication. These controls may require documentation via Control Form or some other record. Functional verification is not normally required.

a)

Configuration control of bowl feeder fails.

IE-1.

Periodic verification is not required because _ of configuration controls procedures, continuous operator attendance, training, and work practice. Control ID: A-PEL-x-09.

O Initial Issue Date:

16 OCT 98 Page No.

65 Revision Date: 31AUG99 Revision No. __1

p b)

Operator fails to detect and correct before pack fills with pellets / chips (or moderator). IE-3. Periodic verification is not required because of continuos operator attendance, training, and work practice. Control ID: A-PEL-x-10.

Margin of Safety -

1 l

The nuclear criticality margin of safety for the collection chutes has been evaluated to be strong. The neutron multiplication factor (kerr) has been calculated to be s 0.95 during normal operations and expected process upsets. No single process upset will take kerr 21.0.

Criticality could be possible only given the following upset conditions:

j The pack and chute fill with pellets / chips to a level above the pack such that in excess of e

the safety limit for mass (64.0 kg UO2) accumulates, and fill with water above the pack to a level in excess of the safety limit (32.8 liters), or For Lines 1-4 only, the ventilated enclosure fills with pellets / chips to a level such that non-favorable geometry is achieved a_nd the material becomes fully moderated interstitially.

Summary Of Initiating Events Which Lead To Credible Process Upsets For The Grinder Centrifuge 4

The fault tree in Figure 6.3.6.2-1 shows potential initiating events (IE's) that could lead to O

criticality, and the backup or residual defenses that provide protection should the initiating event take place. The discussion below briefly describes the event, and provides supplemental information regarding the fault tree.

• IE-1 The configuration of the bowl feeder is administratively controlled by procedures TA-500 and RA-104. Failure of these controls could lead to installation of a feeder bowl that causes an excessive number of pellets to fall into the collector chute.

IE-2 (deleted)

IE-3 e

Operations is required to check, empty, and record material in the pack. Currently this frequency is each shift, although the frequency may be changed as required.

A recent incident' gives good information regarding the rate of fill in the collection pack should a process upset occur. The bowl feeder had been replaced without proper configuration control. The rate of accumulation of pellets was as high as approx.1" pack level (approx. 5.9 b

%/

'Bulletin 91-01 Notification, Data Pack N98-04, August 19,1998.

. Initial Issue Date:

16 OCT 98 Page No.

66 Revision Date: 31AUG99 Revision No. _1

p kg UO2) per shift; this probably can be considered as near the maximum credible process upset C'

condition that can be experienced. Under these conditions, it would take more than approx.12 shifts'of. undetected abnormal operation before the criticality safety limit for mass could be accumulated. Under normal operation, the accumulation in one shift should not be more than one layer of pellets in the pack, and usually less than this.

Currently there is a requirement for a' documented inspection and cleanout of the collection pack each shift of operation. If this' control is executed properly, it is a very strong control, albeit administrative, to prevent accumulation of uranium (or moderator) in the collection pack and chute.

Further, it is noted that as a result of the Root Cause Analysis for the incident, alternatives are being evaluated to replace the above purely administrative control with an engineered control, e IE-4 This event postulates that the favorable geometry collection of material is violated by overfilling the pack; it is possible for the material to then back up into the chute and achieve non-favorable geometry. Also see CSE Section 5.3.6.2.11 for a discussion of failure to

. replace the pack in the ventilation enclosure.-

• IE-5 O

IE-5 postulates that there is an source of water external to the enclosures around the system.

• IE-6 The bowl feeder has a metal cover over the vibratory feeder and the chute below. It only partially protects the inside, including the collector chute, from overhead leaks, etc., because of the opening to accommodate pans of pellets being input to the feeder. Also, the tray loader queue on Line 5 is not protected from overhead leaks.

.. IE-7 Gap between top of pack (8" dia.) and the bottom of the chute (2"-4" dia.) permits overflow of any liquid. Additionally, some lines have a vertical distance between the top of the pack and the bottom of the chute of up to approx.1". This event postulates that this natural overflow somehow does not work, or that is does work but the enclosure does not leak, i.e., fills up with liquid.

It is noted that.if the pack is under the chute opening, the pellets will back up into the chute, rather than spilling into the enclosure. This is what occurred in the incident referenced in IE-3 above. In a 14" x 14" enclosure, it is possible, but unlikely, for an 8" pack to be mis-0 Initial Issue Date:

16 OCT 98 Page No.

67' Revision Date: 31AUG99 Revision No. _1_

T

~

1 i

p positioned such that pellets do not fall into the pack. If this situation occurs, the evaluation Q

defaults to the pack-not-replaced scenario in CSE Section'5.3.6.2.11.

. IE-8 This event postulates that the pack filled interlock somehow fails, and does detect either material or water when the pack fills. There is one collection pack under the grinder feed bowl, and another under the exit vibrator conveyor. IE-8 is currently only applicable to Line

'5.

Potential Common Mode Failures Common mode failure potential exists for IE-8 and IE-3 in that the level interlock and the administrative inspections will detect either material (uranium) or water, and therefore appear in both the geometry and the moderator branches of the fault tree. This risk was determined acceptable because:

a) The frequency of occurrence, both for uranium or water accumulation, is not likely, b)' There are frequent, documented checks by operations, and c) Any water that did fill the pack should then run onto the floor because the ventilation enclosures are not leak tight.

l Summary Tables - see Tables 5.3.6.2-1 and 5.3.6.2-2.

V' O

J Initial Issue Date:

16 OCT 98 Page No.

68

' Revision Date: 31AUG99 Revision No. j

p Table 5.3.6.2-1:

Summary of Defenses Provided Against a Single Failure for the d

Collection Chute and Poly Pack Defense Set 1 Defense Set 2 General Descriptor Prevent Regulate Detect /

Prevent Regulate Detect /

React React MASS CONTINGENCY Safe Cylinder 1,4 3,8 M deration Contingency Diameter Fail MODERATION CONTINGENCY Full Interstitial Moderation 5,6 3,7,8 Mass Contingency

' NOTES:

1. The level probe interlock (IE-8) and administrative control (IE-3) to detect the accumulation of either mass or moderator create the potential for common mode failure.

2. See the end of CSE Section 5.3.6.2.12 for a discussion on common mode failure.

O Initial Issue Date:

16 OCT 98 Page No.

69 Revision Date: 31AUG99 Revision No. j

Table 5.3.6.2-2:

Nuclear Criticality Safety Limits for kerr = 0.90, 0.95, and Delayed Critical PARAMETER NORMAL BOUNDING CRITICALITY CRITICALI CRITICALITY OPERATING ASSUMPTIO SAFETY TY LIMIT

{

CONDITION N

LIMIT SAFETY Delayed Critical S

s 0.90 LIMIT (0.98) s 0.95

(

2"U MASS Very Small 45.6 kg UO2 60.7 kg UO2 (A.0 kg UO2 (Note 3)

Amount MODERATOR /

Dry

Optimum, 24.4 liters 29,1 liters 32.8 liters CONCENTRATIO Full Interstitial water water water N

f (Note 4)

GEOMETRY s Bottom of 12.13 inches 13.25 inches 14.01 inches (Note 5)

Pack Covered up into chute up into chute up into chute SPACING N/A N/A N/A N/A N/A lieterogeneous DENSITY Sintered UO2 Pellets I

ABSORBERS None None None None None ENRICIIMENT s 5.0 wt. %

s 5.0 wt %

s 5.0 wt. %

s 5.0 wt. %

s 5.0 wt. %

Partial Water REFLECTION (l") except 12" CONC (-

z)

Notes

1) See Section 5.3.6.2.11 and cale note CRI-98-020.

2) For criticality limits if pack not in place, also see Section 5.3.6.2.11

3) Min, mass based upon h/x=575, density of UO2=0.9397 g/cc. Ken's vary slightly from 0.90, 0.95, and 0.98. See cale note.

4) Min. volume based upon h/x=200, density of water =0.786 g/cc. Ken's vary slightly from 0.90, 0.95, and 0.98. See cale note.

5) lleight up into chute based upon min. volume calculations.

OV Initial Issue Date:

16 OCT 98 Page No.

70 Revision Date: 31AUG99 Revision No. j

1 FIGURE 6.3.6.2-1 FAULT TREE FOR GRINDER BOWL FEED CHUTE & PELLET TRAY LOADERS OREATER THAN THE SAFETY MODERA OR AC TE IN COLT ECTION PACK & CHUTE h

W WWW A

l l

iE.

iE 3 ie4 lE.1 PNEVENT EACES$1VE PACK FILLS AI TERIAL COLLECTED JPERATOR DETECT 6 &

PACK FILLED SOURCE OF PELLETS NORMAL RATE IN FAVORABLE CORRECTS BEFORE INTERLOCK STOP$

FALLING INTO CHUTE -

CEOMETRY: FPACK PACK & CHUTE FILLS OPERATIONS PROPER TO 64 0 KG UO2 "N*""d* ' "

NOTE 2 TE 1 E

TA 500 &

COP 420401 &

RM04 P.PEL X-17 COP 429010 (UNE 5)

LINE 6 ONLY A-PEL-X40 A PEL.X-10 PEL-X@

NOTE S.

1) FOR CRITICAUTY LIMITS FOR PACK NOT IN PLACE. SEE CSE SECTION 5.3 6.211.

2) ALTHOUGH SHOWN AS AN EVENT TO COMPLETE THE LOGIC OF THE FAULT TREE. THIS IS NOT AN INITIATING EVENT PER SE. IT 13 JUST NORMAL OPERATING CONDITIONS. FOR WHICH CONTROLS ARE NOT APPUCABLE. SEE IE-3 IN CSE SECTION 6 3 6.212 FOR A DISCUSSION OF PACK FILL RATES.

3) IE 2 DELETED.

Initial Issue Date:

16 OCT 98 Page No.

71 Revision Da'.e: 31AUG99 Revision No. j

(-

FIGURE 6.3.6.2-1 (CONT'D)

FAULT TREE FOR GRINDER BOWL FEED CHUTE & PELLET TRAY LOADERS l

.ga LIO3"14%IEo

=*~rwon

!%"is" O

'"5?%^#"!

COLLECTOR CHLfrE ING O

I I

I ms iE 7 iE4 l

l

,E.,

VENTS CE F5 TOM NT R TO L

R OF MODERATOR COLLECTOR CHUTE I

PEC PEC COP 420401 &

LIN Y

COP O( E 5)

PML 020 M

P-PEL 518 PML X-19 O

f Initial Issue Date:

16 OCT 98 Page No.

72 Revision Date: 31AUG99 Revision No. j

O cnemicai seretr eaa rire seretv coatroie To be provided in a future Integrated Safety Assessment.

)

l l

O O

Initial Issue Date:

16 OCT 98 Page No.

73 Revision Date: 31AUG99 Revision No. _1