Text

Probabilistic Boron Dilution Analysis, Final Rept. Related Correspondence
	ML20215B272
Person / Time
Site:	South Texas
Issue date:	09/30/1986
From:	; WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:	;
Shared Package
ML20215B268	List: ML20215B272; ST-HL-AE-1765, Forwards Probabilistic Boron Dilution Analysis Final Rept, Per SER Open Item 15.Analysis Demonstrates That at Least 15 Minutes Available for Operator Response in Event of Boron Dilution Transient.Related Correspondence;
References
	OL, NUDOCS 8610060463
	Download: ML20215B272 (148)
	v • d • e

m

~

ATTACHMENT I l

ST HL AE 17'd - .

PAGEl OFlA3 !

<=

l Final Report South Texas Project PROSABILISTIC BORON DILUTION ANALYSIS September 1986 Westinghouse Electric Corporation Risk Assessment Technology

-P.O. Box 355 Pittsburgh, Pennsylvania 15230 i

1 I

8610060463 860930

{DR ADOCK 05000498-PDR c2cs.in-oeisee

b ATTACHMENT I

,- ST HL AE- 1*7 65-PAGE 1, OF p3 i TABLE OF CONTENTS Section Pace 1.0 Introduction ~

1-1 2.0 Summary 2-1 3.0 Chemical and Volume Control System Description 3-1 4.0 Analysis 4-1 4.1 Initiating Events 4-1 4.2 Probabilistic Analysis 4-4 4.3 Response Time Calculations 4-16 5.0 Results 5-1 6.0 Conclusions 6-1 7.0 References 7-1 Appendix A: Screening Analysis for Potential Initiators A-1 Appendix B: Failure Modes and Effects Analysis B-1

Appendix C: Calculations and Data for Probabilistic Analysis C-1 Appendix D: Response Time Calculations D-1 02C3s 16-091486 j

ATI ACFI).ENT I ST-HL. AE 17 /oS I PAGI. 3 OFIA3 TABLES AND FIGURES.

Table Page 4.1-1 Fotential Initiating Events 4-17 4.2-1 Frequency of Initiating Events 4-20

_ 4.2-2 Top Event failure Probabilities 4-22 5.0-1 Frequency cf Unplanned Boron Dilution Events 5-3 C-1 Component failure Rate Data C-15 C-2 Human Error Probabilities C-17 C-3 Dperator Errors C-19 D-1 Dilution Flow Rates D-7 D-2 Parameters (Volumes, Baron Worths, Alarm Setpoint, D-8 and % SDY) e ns.i.-o m e jj

ATTACHMENT /

. ST HL FE t 7LE PAGE V OF135 i Figure Page

-4.2-1 Event Tree for Reactor Makeup Fails, MODE Sa 4-23 4.2-2 Event Tree for Reactor Makeup Fails, MODES 3 and 4 4-24 4.2-3 Event Tree for Loss of Shutdown Margin 4-25 5.1-1 Required Shutdown Margin vs. RCS Critical Boron Concentratien (M3DE Sa) 5-4 5.1-2 Required Shutdown Margin vs. RCS Critical Boron Concentration (MDDES 3 and 4) 5-5 5.1-la Required Shutdown Margin vs. RCS Boron Concentration (MODE Sa) 5-6 5.1-2a Required Shutdown Margin vs. RCS Baron Concentration (MODES 3 and 4) 5-7 C.1-1 Fault Tree for BTRS Boron Flushing C-21 C.1-2 Fault Tree for BTRS Resin Flushing C-22 C.2-1 Fault Tree for Failure to Restore Shutdown Margin C-23 cm. a-mm

$$j t

ATTACHMENT /

. ST.HL AE l%s PAGE 6 OF IA3 l

1.0 INTRODUCTION

The primary purpose of this report is to identify potential equipment faults or operator errors which could result in an inadvertent dilution of the Reactor Coolant System during shutdown modes. These potential ir.itiators are then evaluated with respect to U.S. NRC Standard Review Plan (NUREG-0800) requirements to identify any administrative or technical specifications changes required to provide regulatory compliance.

Additionally, a probabilistic analysis of the boron dilution events is performed to supplemer.t the above analysis, and to assist the utility in evaluating whether its procedures and operator training programs are sufficient to reduce the probability and consequences of a boron dilution event to an acceptable level.

The Chemical and Volume Control System (CVCS) is described in Section 3 to aid in understanding the analysis described in Section 4. The results are presented in Section 5 and the conclusions are presented in Section 6.

i, era. i -erm i_1

ATTACHMENT 1 l

. ST HL AE-t'TL5 i PAGE (o OF lR.3 l

, 2.0

SUMMARY

The South Texas Project Plant Chemical and Volume Control System (CVCS) was systematically evaluated for failures during shutdown modes (MODES 3, 4, and

5) which would lead to a dilution of the primary system boron concentration resulting in a total loss of shutdown margin. MODE 5 was further partitioned into MODE Sa (reactor coolant loops filled) and MODE Sb (reactor coolant loops drained). Potential flow paths between the unborated water supplies and the Reactor Coolant System (RCS) were identified.

A failure modes and effects analysis (FMEA) for each potential dilution path identified the component failures associated with each CVCS operation requiring unborated water.

The potential boron dilution initiators associated with each boron dilution path and the likelihood of occurrence were identified as follows.

1. Failure to isolate unborated water during flushing operations of the CVCS mixed-bed demineralizers (or cation-bed demineralizers) (6.3%).

2. Failure to isolate unborated water during boron flushing operations of Boron Thermal Regeneration System (BTRS) demineralizers (0.4%).

, 3. Failure to isolate unborated water during resin flushing operations of i

the BIRS demineralizers (0.8%).

4. Failure to isolate unborated water during flushing operations of the Boron Concentration Measurement System (12.5%).

5. Failure during Reactor Makeup operations (62.8%).

6. Failure to secure chemical addition (17.3%).

en1. s o-w m g.$

l

ATTACHMENT / l ST HL !AE /%s i PAGE 7 0F l;L3 ;

, , Each boron dilution initiator was analyzed in each shutdown mode. The total frequency of losing shutdown margin, based on the probabilistic analysis, is estimated as 4.2E-4 per reactor year.

Graphs of the minimum required shutdown margin versus RCS critical boron concentration (Figures 5.1-1 and 5.1-2) were constructed as a function of the minimum response time of 15 minutes. Additionally, graphs of required shutdown margin versus RCS boron concentration (Figures 5.1-la and 5.1-2a) were constructed as a part of the analysis and are presented for comparison purposes. These graphs show the minimum shutdcwn margin allowed to meet the required 15 minute operator response time between time of the Gamma-Metrics flux multiplication alarm and a total loss of shutdown margin.

A postulated boron dilution event in MODES 1 and 2 relies upon the existing South Texas Project (STP) protection features to provide an alarm indicating that a dilution event is occurring. The FMEA documented in this report;is not applicable to the evaluation of the boron dilution event in MODES 1 & 2 since acceptable results are obtained analytically without it. Documentation of the methods and the results of the MODES 1 & 2 boron dilution analysis is presented in the STP FSAR, Sections 15.4.6.2 and 15.4.6.3.

HDDE 6 (refueling) was analyzed for postulated boron dilution events, but because the active volume considered is so small relative to the active volume in power and other shutdown modes, it is necessary to lock out by administrative control all boron dilution initiators in this mode. ,

caci. i.-*

2-2

ATTACHMENT / i ST-HL AE 1765 !

PAGE E CFi n 3.0 CHEMICAL AND VOLUME CONTROL SYSTEM DESCRIPTION The Chemical and Volume Control System (CVCS) is used to control the soluble neutron absorber and to maintain proper inventory in the Reactor Coolant System (RCS)..

Any time that the plant is at power, the quantity of boric acid retained and ready for injection from the BA tanks always exceeds that quantity required for normal cold shutdown, assuming that the control assembly of greatest worth is in its fully withdrawn position. This quantity always exceeds the quantity of boric acid required to bring the reactor to hot shutdown and.to compensate for subsequent xenon decay. An adequate quantity of boric acid is also available in the refueling water storage tank to achieve cold shutdown.

When the reactor is subtritical, i.e., during cold or hot shutdown, refueling, and approach to criticality, the neutron source multiplication is continuously monitored and indicated. Any appreciable increase in the neutron source multiplication, including that caused by the maximum physical boron dilution rate, is slow enough to give ample time to start a corrective action to prevent the total loss of shutdown margin. The rate of boration from the BA tanks, with a single boric acid transfer pump operating, is sufficient to take the reactor from full power operation to 1 percent shutdown in the hot condition, with no rods inserted, in less than 90 minutes. In less than 90 additional minutes, enough boric acid can be injected to compensate for xenon decay, although xenon decay below the equilibrium operating level will not begin until approximately 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after shutdown. Additional boric acid is employed if it is desired to bring the reactor to cold shutdown conditions.

Two separate and independent flow paths are available for reactor coolant boration, i.e., the charging line and the reactor coolant pump seal injection line. A single failure does not result in the inability to borate the RCS.

em. +mese 3-1

[ ]

ATTACHMENT / i

.: ST HL-AE / %$ l PAGE 4 OFIA3 l If the normal charging line is not available, charging to the RCS is continued

{

via reacter coolant pump seal injection at the rate of approximately 5 gpm per pump via leakage through the #1 seals. At the charging rate of 20 gpa (5 gpm per reactor coolant pump), approximately 3.5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months are required to add enough boric acid solution to counteract xenon decay, although xenon-decay below the full power equilibrium operating level will not begin until approximately 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months after the reactor is shut down.

As backup to the normal beric acid supply, the operator can align the refueling water storage tank outlet to the suction of the charging pumps.

The CVCS is capable of making up for a small RCS leak of approximately 130 gpm-using one centrifugal charging pump and still maintaining se'al injection flow to the reactor coolant pumps. This also allows for a minimum RCS cooldown contraction. This is accomplished with the letdown isolated.

3.1 FUNCTIONS OF CVCS The basic functions of the CVCS are:

a. maintenance of programmed water level in the pressurizer, i.e.,

maintaining the required water inventory in the RCS;

b. maintenance of seal water injection flow to the reactor coolant pumps (RCPs);

c. control of reactor coolant water chemistry conditions, activity level, soluble chemical neutron absorber concentration, and makeup;

d. supplying means for filling, draining, and pressure testing of the RCS.

The design base descriptions are given in the following subsections.

l cm. 4-mass 3-2

ATTACHMENT /

ST HL-AE /M.S '

+

PAGE /C OF lA3 ,

. 3.1.1 Reactivity Control The CVCS regulates the concentration of chemical neutron absorber (boren) in the reactor coolant to control reactivity changes resulting from the change in reactor coolant temperature between cold shutdown and hot full power operation, burnup of fuel .and burnable poisons, buildup of fission products in the fuel, and xenon transients.

Reactor Makeup Contrcl

a. The CVCS is capable of borating the RCS through either one of two flow paths and from either one of two boric acid sources.

b. The amount of boric acid stored in the Boric Acid Tanks always exceeds that amount required to borate the RCS to cold shutdown concentration assuming the the control assembly with the highest reactivity worth is stuck in its fully withdrawn position. This amount of boric acid also exceeds the amount required to bring the reactor to hot shutdown and to compensate for subsequent xenon decay.

Boron Thermal Regeneration The CVCS is designed to control the changes in reactor coolant baron concentration te compensate for the xenon transients during load follow operations without adding makeup for either boration or dilution. This is accomplished by the boron thermal regeneration process, which is designed to allow load follow operations as required by the design load cycle.

3.1.2 Regulation of Reactor Coolant Inventory The CVC5 maintains the coolant inventory in the RCS within the allowable pressurizer level range for all normal modes of operation, including startup from cold shutdown, full poaer operation, and plant cooldown. This syster also has sufficient makeup capacity to maintain the minimum required inventory in the event of minor RCS leaks.

un . ' * -" ' "'

3-3 1

i

- ATTACHMENT /

ST HL-AE- / 765 I PAGE // OF I;L3 3.1.3 Reactor Coolant Purification The CVCS is capable of removing fiscion and activation products, in ionic form or as particulates, from the reactor coolant in order to permit access to those process lines carrying reactor coolant during operation and to reduce radioactivity releases due to leaks.

3.1.4 Chemical Additions for Corrosion Control The CVCS provides a means for adding to the RCS chemicals that control the pH of the ccclant during initial startup and subsequent operation, scavenge oxygen from the coolant during startup, and counteract the production of oxygen in the reactor coolant due to radiolysis of water in the core region.

3.1.5 Seal Water Injection The CVCS is able to continuously supply filtered water to each reactor coolant pump seal, as required by the reactor coolant pump design.

3.1.6 Hydrostatic Testing of the Reactor Coolant System The CVCS is capable of supplying water at the maximum test pressure specified to verify the integrity of the RCS. The hydrostatic test is performed prior to initial operation and also as part of the periodic RCS inspection program.

3.2 SYSTEM DESCRIPTION The CVCS consists of seseral subsystems: the Charging, Letdown, and Seal Water System; the Reactor Coolant Purification and Chemistry Control System; the Reactor Makeup Control System; and the Boron Thermal Regeneration System.

The CVCS is shown in Figures 9.3.4-1 through 9.3.4-5 (piping and instrumentation diagrams) of the South Texas Project FSAR.

em. u-em" 3-4

ATTACHMENT -/

l ST-HL- AE- / 765 PAGE /A OF I;L3 l

. 3.2.1 Charging, Letdown, and Seal Water System The charging and letdown functions of the CVCS are employed to maintain a programmed water level in the RCS pressurizer, thus maintaining proper reactor coolant inventory during all phases of plant operation. This is achieved by means of a continuous feed and bleed process, during which the feed rate is automatically controlled based on pressurizer water level. The bleed rate can be chosen to suit various plant operational requirements by selecting the proper combination of letdown orifices in the ietdown flow path.

Reactor coolant is discharged to the CVCS from a reactor coolant loop cold leg; it then flows through the shell side of the regenerative heat exchanger (HX), where its temperature is reduced by heat transfer to the charging flow passing through the tubes. The coolant then experiences a large pressure reduction as it passes through the letdown orifice (s) and flows through the tube side of the letdown heat exchanger, where its temperature is further reduced. Downstream of the letdown heat exchanger, a second pressure reduction occurs. This second pressure reduction is performed by the low pressure letdown valve, the function of which is to maintain upstream pressure, thus preventing flashing downstream of the letdown orifices.

The coolant then flows through one of the two letdown filters and then on to the mixed-bed demineralizers. The flon may then pass through one of the cation-bed demineralizers which are used intermittently when additional purification of the reactor coolant is required.

From a point upstream cf the Boron Thermal Regeneration System or from a point upstream of the reactor coolant filters, a small sample flow may be diverted from the letdown stream to the Boron Concentration Measurement System. The readout of the boron concentration is given in the main control room.

During reactor coolant boration and dilution operations, especially during.

load follow, the letdown flow leaving the demineralizers may be directed to the Boron Thermal Regeneration System. Af ter return from the BTRS, the coolant then flows through one of the two reactor coolant filters and into the volunie control tank (VCT) through a spray nozzle in the top of the tank.

ema. em" 3-5 l

r -

ATTACHMENT I ST.HL AE 1%s i PAGE 12 0F ip Hydrogen (from the Pressurized Gas Distribution System) is continuously supplied to the VCT, where it mixes with fission gases which are stripped from the reactor coolant into the tank gas space. The containment hydrogen is vented to the Gaseous Waste Processing System (GWPS). The partial pressure of hydrogen in the VCT determines the concentration of hydrogen dissolved in the reactor coolant. This controls the concentration of oxygen produced by radiolysis of water in the core.

Three pumps (one positive displacement pump and two centrifugal charging pumps) are provided to take suction from the VCT and return the cooled, purified reactor coolant to the RCS. Normal charging flow is handled by one of the two centrifugal charging pumps. This charging flow splits into two paths. The bulk of the charging flow is pumped back to the RCS through the tube side of the regenerative heat exchanger. The letdown flow in the shell side of the regenerative heat exchanger raises the charging flow to a temperature approaching the reactor coolant temperature. The flow is then injected into a cold leg of the RCS, through either of two charging paths. A flow path is also provided from the regenerative heat exchanger outlet to the pressurizer spray line. An air operated valve in the spray line is employed to provide auxiliary spray to the vapor space of the pressurizer during plant cooldown. This provides a means of cooling and depressurizing the pressurizer near the end of plant cooldown, when the reactor coolant pumps, which normally provide the driving head for the pressurizer spray, are not operating.

A portion of the charging flow is directed to the reactor coolant pumps (nominally B gpm per pump) through a seal water injection filter. The seal water is directed down to a point above the pump shaft bearing and the thermal barrier cooling coil. Here, the flow splits and a portion (nominally 5 gpm per pump) cools the lower bearing and then enters the RCS through the labyrinth seals and thermal barrier. The remaindar of the flow is directed up the pump shaft to the no. 1 seal leakoff. The no. I seal leakoff flow discharges to a common manifold, exits from the Containment, and then passes through the seal water return filter and the seal water heat exchanger to the suction side of the charging pumps, or by alternate path to the VCT. A very small portion of the seal flow leaks through to the no. 2 seal. A no. 3 seal i un. mem" 3-6

. ATTACHMENT /

ST-HL AE- 1766 l PAGEI4 OF1;3 i provides a final barrier to leakage of reactor coolant to the Containment atmosphere. The no. 2 leakoff flow is discharged to the reactor coolant drain tank (RCDT) in the Liquid Waste Processing System (LWPS). The no. 3 seal leakoff flow is discharged to the Containment sump (this leakoff flow consists of a portion of the reactor makeup water which is injected into the no. 3

, seal).

Should-the normal charging paths be unavailable, two separate charging paths can be made available by closing the charging pump discharge isolation valves and opening the bypass valves. One path is via charging pump A to RCP seal injection. The other path is via charging pump B to normal charging.

The primary purpose of the positive displacement pump is that of hydrotesting the RCS. However, it can also be used to provide reactor coolant pump seal injection flow and reactor coolant boration capability for the abnormal condition when both centrifugal charging pumps are out of service. During this abnormal operating condition, the flow from the positive displacement pump is directed to the reactor coolant pumps, where the flow splits, with one portion entering the RCS and the other returning through the seal return lines to the charging pump suction header. In order to maintain proper reactor coolant inventory, the inleakage of water to the RCS must be balanced by bleeding water from the RCS via the excess letdown line.

The excess letdown path is provided from the RCS as an alternate in the event that the normal letdown path is inoperable. Reactor coolant can be discharged from a cold leg to flow through the tube side of the excess letdown heat exchanger, where it is cooled by component cooling water. Downstream of the heat exchanger, a remote-manual control valve controls the letdown flow. The flow normally joins the no. I seal discharge manifold and passes through the seal water return filter and heat exchanger to the suction side of the charging pumps. The excess letdown flow can also be directed to the Reactor Coolant Drain Tank or directly into the VCT via a spray nozzle. When the ,

normal letdoan line is not available, the normal purification path is also not in operation. Therefore, the alternate condition would allow continued power operation for a limited period of time, dependent on RCS chemistry and em. * "" 3-7

ATTACHMENT /

ST HL AE-l%S i PAGE 15 OF IJG

, radioactivity. The excess letdown flow path is also used to provide additional letdcwn capability during the final stages of plant heatup. This path removes some of the excess reactor coolant due to expansion of the syste-as a result of the RCS temperature increase.

Surges in RCS inventory due to load changes are accommodated for the most part in the pressurizer. The VCT provides surge capacity for reactor coolant expansion not accommodated by the pressurizer. If the water level in the VCT exceeds the normal operating range, a controller modulates a three-way valve downstream of the reactor coolant filter to divert a portion of the letcown to the Boron Recycle System (BRS). If the high-level setpoint in the VCT is reached, an alarm is actuated in the control room, and the letdown flow is completely diverted to the BRS.

Low level in the VCT initiates makeup from the Reactor Makeup Control System.

If the Reactor Makeup Control System does not supply sufficient makeup to keep the VCT level from falling to 4 lower level, a low alarm is actuated. Manual action may correct the situation or, if the level continues to decrease, a low-low level signal from the level channels causes the suction of the charging pumps to be transferred to the refueling water storage tank.

3.2.2 Reactor Coolant Purification and Chemistry Control System pH Control 4

The pH control chemical employed is lithiim hydroxide. This chemical is chosen for its compatibility with the materials and water chemistry of borated water / stainless steel / zirconium /inconel systems. In addition, lithium-7 is produced in the core region due to irradiation of the dissolved boron in the

' coolant.

The concentration of lithium-7 in the RCS is maintained in the range specified for pH control. If the concentration exceeds this range, as it may in the early stages of a core cycle, one of the cation-bed demineralizers is employed l

em mem" 3-8 l

L

ATTACMMENT / L ST HL AE /765 .I PAGE IEOF 1 2 i in the letdown line in series operation with a mixed-bed demineralizer. Since the amount of lithium to be removed is small (its buildup can be readily calculated), the flow through the cation-bed demineralizer is not required to be full letdown flow. If the concentration of lithium-7 is below the specified limits, lithium hydroxide can be introduced into the RCS via the charging flow. The solution is prepared in the laboratory and poured into the chemical mixing tank. Reactor makeup water is then used to flush the solution to the suction manifold of the charging pumps.

Oxygen Control During reactor startup from the cold condition, hydrazine is employed as an oxygen scavenging agent. The hydrazine solution is introduced into the RCS in the same manner as described above for the pH control agent. Hydrazine is nct employed at any time other than startup from the cold shutdown state.

Dissolved hydrogen is employed to control and scavenge oxygen produced due to radiolysis of water in the core region. Sufficient partial pressure of hydrogen is maintained in the VCT such that the specific equilibrium concentration maintains a minimum pressure of 15 to 20 psig in the vapor space of the VCT. This value can be adjusted to provide the correct equilibrium hydrogen concentration (25 to 50 cc hydrogen at standard temperature and pressure per kg of water). Hydrogen is supplied from the hydrogen manifold in the Pressurized Gas Distribution System.

Reactor Coolant Purification Mixed-bed demineralizers are provided in the letdown line to provide cleanup of the letdown flow. The demineralizers remove ionic corrosion products and certain fission products. One demineralizer is in continuous service and can be supplemented intermittently by the cation-bed demineralizers, if necessary, for additional purification. The cation resin principally removes cesium and lithium isotcpes from the purification flow. The second mixed-bed demineralizer serves as a standby unit for use if the operating demineralizer becomes exhausted during operation.

em iresim 3-9

+ ATTACHMENT /

ST HL-AE- l'/fa5 PAGE s7 OF i;t3 i

~

A further cleanup feature is provided for use during cold shutdown, refueling shutdown, and resideal heat removal operations. A remote-operated valve admits a bypass flow from the Residual Heat Removal System (RHRS) into the letdown line upstream of the letdtwn heat exchanger. The flow passes through the heat exchanger, then through a mixed-bed demineralizer and a reactor coolant filter to the VCT. A second spray nozzle is provided in the VCT to assist in handling the 450 gpm flow when needed. The VCT atmosphere at this time is nitrogen. The fluid is then returned to the RCS via the normal charging path. A circulation pump (reactor coolant purification pump)~ located upstream of the letdown heat exchanger and capable of 450 gpm flow is provided for use when the inlet pressure from the RHRS is below 350 psig. During this mode of operation, the fluid is returned to the suction of one of the RHR pumps from upstream of the VCT.

Filters are provided at various locations to ensure filtration of particulate and resin fines and to protect the seals on the reactor coolant pumps.

Fission gases are removed from the reactor coolant by continuous purging of the VCT to the Gaseous Waste Processing System.

3.2.3 Reactor Makeup Control System The soluble neutron abscrber (beric acid) concentration is controlled by the Boron Thermal Regeneration System and by the Reactor Makeup Control System.

The Reactor Makeup Control System is also used to maintain proper reactor coolant inventory. In addition, for emergency boration and makeup, the capability exists to provide refueling water or 4 weight percent boric acid directly to the suction of the charging pumps.

The Reactor Makeup Control System provides a manually preselected makeup composition to the charging pump suction header or to the VCT. The makeup control functions are those of maintaining desired operating fluid inventory in the VCT and adjusting reactor coolant boron concentration for reactivity control. Reactor makeup water and boric acid solution (4 weight percent) are em. i..cm" 3-10

ATTACHMENT i ST HL-AE 1965 i PAGEif OF ig3

. blended together in order to achieve the reactor coolant boron concentration needed for use as makeup to maintain VCT inventory, or they can be used separately to change the reactor coolant boron concentration.

A Boron Concentration Measurement System is provided to monitor the boron content of the reactor coolant in the letdown line. The baron concentration is indicated in the main control room The boric acid is stored in two boric acid tanks. Two boric acid transfer pumps are provided, with one pump normally aligned to provide boric acid to the suction header of the charging pumps and the second pump in reserve. On a demand signal by the reactor makeup controller, the pump starts and delivers boric acid to the suction header of the charging pumps. The pump can also be used to retirculate the boric acid tank fluid.

The portions of the CVCS which normally contain concentrated boric acid solution (4 weight percent boric acid) are located within a heated area in order to maintain solution temperature at >65'F or are provided with some

'other means (e.g., heat tracing) to maintain solution temperature at >65'F.

During reactor operation, changes are made in the reactor coolant boron concentration for the following conditions.

1. Reactor startup - Boron concentration must be decreased from shutdown concentratien to achieve criticality.

2. Load follow - Boron concentration must be either increased or decreased to compensate for the xenon transient following a change in '

load.

3. Fuel burnup - Boron concentration must be decreased to compensate for fuel burnup and the buildup of fission products in the fuel. .

4. Cold shutdown - Boron concentration must be increased to the cold shutdown concentration.

em. n omu 3 11 1

, ATTACHMENT / l ST.Ht:M- 1965 PAGE 19 OF 12.3 The Boron Thermal Regeneration System is normally used to control boron concentration to ccmpensate for xenon transients during load follow operations. Boron thermal regeneration can also be used in conjunction with dilution operations of the Reactor Makeup Control System to reduce the amount of effluent to be processed by the BRS.

The reactor makeup water pumps, taking suction from the reactor makeup water storage tank (RMWST), are employed for various makeup and flushing operations throughout the systems. One of these pumps also starts on demand from the reactor makeup controller and provides flow to the suction header of the charging pumps or the VCT through the letdown line and spray nozzle.

The reactor makeup control consists of a group of instruments arranged to provide a manually preselected makeup composition to the charging pump sucticn header or the volume control tank. The makeup control functions are to maintain desired operating fluid inventory in the volume control tank and to adjust reactor coolant boron concentration for reactivity and shim control.

The reactor makeup control switches are located on the main control board along with the batch integrators and the flow controllers. Two switches are provided, one for 0FF/ MANUAL / BORATE / AUTO MAKEUP / ALTERNATE DILUTE / DILUTE and one for STOP/ NEUTRAL / START.

Automatic Makeup The Automatic Makeup mode of operation of the reactor makeup control provides dilute boric acid solution, preset to match the boron concentration in the RCS. The automatic makeup compensates for minor leakage of reactor coolant without causing significant changes in the coolant boron concentration. It operates on demand signals from the volume control tank level controller (LICA-112).

Under normal plant operating conditions, the mode selector switch is set in the " Automatic Makeup" position and the boric acid and reactor makeup water flow controllers are set to give the same concentration of borated water as em. i.-cr ea:

3-12

ATTACHMENT /

ST HL4E 1%5 PAGE C OF lA2

. contained in the RCS. The mode selector switch must be in the correct position and the control energized by prior manipulation of the " Start" switch. A preset low level signal from the volume control tank level controller (LICA-112) causes the automatic makeup control action to start a selected reactor makeup water pump and a boric acid transfer pump, open the makeup stop valve to the charging pump header (FCV-110B), open boric acid flow control valve (FCV-110A), and open the reactor makeup water flow control valve (FCV-111A). The flow controllers automatically set the boric acid and reactor makeup water flows to the preset rates.

Makeup additien to the charging pump suction header causes the water level in the tank to rise. At a preset high level point, the reactor makeup water pump stops and the boric acid transfer pump stops, the reactor makeup water and boric acid flow control valves close, and the makeup stop valve closes. This operation may be terminated manually at any time by actuating the makeup stop position on the three position reactor makeup control switch.

The quantities of boric acid and total makeup injected are totalized by the batch counters and the flow rates are recorded on strip recorders. Deviation alarms and automatic makeup termination for both boric acid and total makeup are provided if flow rates deviate from setpoints for longer than a set time delay.

Beration The borate mode of operation permits the addition of a preselected quantity of concentrated boric acid solution at a preselected flow rate to the RCS. The operator sets the mode selector switch to " Borate", the concentrated boric acid flow controller setpoint to the desired flow rate, the concentrated boric acid batch integrator to the desired quantity, and actuates the makeup start.

Actuating the start switch opens the makeup stop valve (FCV-1105) to the charging pump suction and the boric acid flow control valve (FCV-110A) and, starts the selected boric acid transfer pump. The concentrated boric acid is added to the charging pump suction header. The total quantity added in most em. i.-em" 3-13 1

ATTACHMENT / .

ST-Hb AE- /%5 -j 1

. PAGE .11 OF /A3 ;

f-cases will be so small that it will have only a minor effect on the volume control tank level. When the preset quantity of concentrated boric acid solution has been added, the batch integrator causes the boric acid transfer

-pump to stop and the boric acid flow control valve and the makeup step valve to close. This operation may be terminated manually at any time by actuating the makeup step. A deviation in the boric acid flow will actuate an alarm and terminate the operation af ter a time delay.

Boration can also be accomplished by cperating the Boron Thermal Regeneration System in the boron release mode.

Dilution The " Dilute" mude of operation permits the addition of a preselected quantity of reactor makeup water at a preselected flow rate to the RCS through the volume control tank. The operator sets the mode selector switch to " Dilute",

the reactor makeup water flow controller setpoint to the desired flow rate, the reactor makeup water batch integrator to the desired quantity and actuates the makeup start. The start signal causes the makeup control to start a selected reactor makeup water pump and open the makeup stop valve (FCV-1118) to the volume control tank inlet and the reactor makeup water flow control valve (FCV-111A). The makeup water is injected through the volume control tank spray no::le. Excessive rise cf the volume control tank water level is prevented by automatic actuation of a three-way diversion valve (by the tank level controller), which diverts the reactor coolant letdown flow to the BRS holdup tanks. When the preset quantity of reactor makeup water has been added, the batch integrator causes the reactor makeup water pump to step and the makeup stop valves and reactor makeup water flow control valve to close.

This operation may be terminated manually at any time by actuating the makeup stop. A deviation in the reactor makeup water flow will alarm and terminate the operation after a time delay.

Dilution also can be accomplished by operating the Boron Thermal Regeneration System in the boron storage mode, em. i. man 3 14

1 ATTACHMENT / !

ST-HL AE-17(c5 i PAGE & OFl23 Alternate Dilution The " Alternate Dilute" mode of operation is similar to the dilute mede except a portion of the dilution water flows directly to the charging pump suction (FCV-1108) and a portion flows into the volume control tank (FCV-1118) via the spray nozzle and then flows into the charging pump suction. This decreases the delay in diluting the RCS caused by directing dilution water to the volume control tank.

~

Manual The manual mode of operation permits the addition of a preselected quantity and blend of beric acid solution to the refueling water storage tank, the spent fuel pit or through the temporary (flanged) connection to another item of equipment. While in the manual mode of operation, automatic makeup to the RCS is precluded. The discharge flow path must be prepared by opening manual valves in the desired path.

The operator then sets the mode selector switch to " Manual", the boric acid and total makeup flow controller setpoints to the desired flow rates, the boric acid and total makeup batch integrators to the desired quantities and actuates the makeup start switch. Actuating the start switch activates the boric acid flow control valve (FCV-110A) and reactor makeup water fica controi valve (FCV-111A) and starts the preselected reactor makeup water pump and boric acid transfer pump.

When the preset quantities of boric acid and reactor makeup water have been added, the pumps stcp and the boric acid and reactor makeup water flow control valves close. This operation may be stopped manually by actuating the makeup stop sw'tch.

If either batch integrator is satisfied before the other has recorded its ,

required total, the pump and valve asso:iated with the integrator which has been satisfied will terminate flon. The flow controlled by the other integrator will continue until that integrator is satisfied. The boric acid em. i .-o""

3-15

}

. ATTACHMENT I ! 1 ST HL- AE l%5 I l

PAGE A3 OF in ! l

. l flow rate should always be set slightly higher than the required mixture rate, to insure that boric acid flon is-terminated first and the lines are flushed by reactor makeup water.

Makeup Stop By switching to the "STOP" position on the 3 position makeup control switch, the operator can terminate the makeup operation in any of the five modes of operation.

Alarm Functicns The reactor makeup control has been provided with alarm functions to call the operater's attentien to the following conditions:

a. deviation of reactor makeup water flow rate from control setpoint; b, deviation of concentrated boric acid flow rate from control setpoint;

c. low level (makeup initiation point) in the Volume Control Tank when the reactor makeup control selector is not in the automatic makeup control mode or at a low level if the automatic mode fails or is unable to maintain the level;

d. low-low water level (automatic switchover to RWST).

Makeup Stop Valves in addition to the automatic operations previously discussed, valves FCV-110B and FCV-111B can be controlled by the operator via switches on the main control board.

c.o.ie ee'"'

3-16

}

- ATTACHMENT / j

, ST HL AE /745 PAGE cN OF Eb '

3.2.4 Boron Thermal Regeneration System Downstream of the demineralizers, the letdown flow can be diverted to the Boron Thermal Regeneration System, where part or all of the letdown flow can be treated when boron concentration changes are desired for load follow.

Af ter processing, the flow is returned to a point upstream of the reactor coolant filter.

The Boron Concentration Measurement System can be used to monitor the boron content in the letdown stream before it is diverted to the Boron Thermal Regeneration System for processing; or it can monitor the adjusted boren content of the letdown stream after it has been treated by the thermal regeneration process.

Storage and release of boren during load follow operation is determined by the temperature of fluid entering the thermal regeneration demineralizers. A chiller unit and a group of heat exchangers are employed to provide the desired fluid temperatures at the demineralizer inlets for either storage or release operation of the system.

The flowpath through the Baron Thermal Regeneration System is different for the boron storage and the beron release operations. During boron storage, the letdown stream enters tre moderating heat exchanger and from there passes through the letdown chiller heat exchanger. These two heat exchangers cool the letdown stream prior to its entering the demineralizers. The letdown reheat heat exchanger is valved out on the tube side cnd performs no function during boron storage operations. The temperature of the letdown stream at the point of entry to the demineralizers is controlled automatically by a temperature control valve, which controls the shell side flow to the letdowa chiller heat exchanger. After passing through the BTRS demineralizers, the letdown enters the moderating heat exchanger shell side, where it is heated by the incoming letdown stream before returning to the letdown path and .

continuing through the reactor coolant filter to the VCT.

I em. +esin' 3-17

. ATTACHMENT /

ST-HL AE 1765 PAGEJL50F m Therefore, for boron storage, a decrease in the boric acid concentration in the reactor coolant is accomplished by sending the letdown flow at relatively low temperatures to the thermal regeneration demineralizers. The resin, which was depleted of boron at high temperature during a prior boron release operation, is now capable of storing boron from the low-temperature letdown stream. Reactor coolant with a decreased concentration of boric acid leaves the demineralizers and is directed to the RCS via the charging system.

During the boron release operation, the letdown stream enters the moderating heat exchanger tube side, bypasses the letdown chiller heat exchanger, and passes through the shell side of the letdown reheat heat exchanger. The moderating and letdown reheat heat exchangers heat the letdown stream prior to its entering the resin beds. The temperature of the letdown at the point of entry to the demineralizers is controlled automatically by a temperature control valve, which centrols the flowrate on the tube side of the letdown reheat heat exchanger. Af ter passing through the demineralizers, the letdown stream enters the shell side of the moderating heat exchanger, passes through 1

the letdown chiller heat exchanger, and then returns to the letdown path and goes to the VCT. The temperature of the letdown stream entering the VCT is controlled automatically by adjusting the shell side flowrate on the letdown chiller heat exchanger. Thus, for boron release, an increase in the beric acid concentrat %n in the reactor coolant is accomplished by sending the letdown flow at relatively high temperatures to the thermal regeneration demineralizers. The water flowing through the demineralizers now absorbs boron which is released by the resin in the demineralizers. The boron was stored by the resin at low temperature during a previous boron storage operation. The boron-enriched reactor coolant is returned to the RCS via the charging system.

Although the Boron Thermal Regeneration System is primarily designed to compencate for xenon transients occurring during load follow, it can also be used to handle boron swings far in excess of the design capacity of the deminerali:ers. During startup dilution, for example, the resin beds are first saturated, then washed off to the BRS, then again saturated and washed off. This operation continues until the desired dilution in the RCS is ,

! obtained.

C)$)s ig=C""

3-18

- ATTACMMEjMT I

.' ST.Hl.-AE 1765 PAGE Are OF U;L3 As an additional function, a thermal -egeneration demineralizer can be used as a deborating demineralizer, which would be used to dilute the RCS down to very low baron concentrations towards the end of a core cycle. To make such a bed effective, the effluent concentration from the bed must be kept very low, close to zero ppm boron. This low effluent concentration can be achieved by using fresh resin. Use of fresh resin can be coupled with the normal replacement cycle of the resin, one resin bed being replaced during each core cycle.

3.3 COMPONENT DESCRIPTION OF THE CHEMICAL AND VOLUME CONTROL SYSTEM Descriptions of the Chemical and Volume Control System components are given in Section 9.3.4.1.2.5 of the South Texas Project FSAR. The description of the Reactor Coolant Purification Pump is included here because this component is specific to the South Texas plants.

Reactor Coolant Purification Pump This centrifugal pump can circulate reactor coolant from the RHRS through t a CVCS for purification during a cold shutdown. This pump, together with the parallel operation of both mixed-bed demineralizers, both cation-bed demineralizers, and both reactor coolant filters, permits the CVCS to process a purification flow during plant cooldown and cold shutdown that is greater than the maximum purification flow that can be achieved via the letdown orifices when the reactor is at power or in the hot shutdown condition.

3.4 CHEMICAL AND VOLUME CONTROL SYSTEM OPERATION Reactor Startup Reactor startup is defined as the operations which bring the reactor from cold shutdown to normal operating temperature and pressure.

em. i..er en 3 19

ATTACHMENT l-ST HL AE l?65

. PAGE .2? OF in

. l

. It is assumed that:

a. normal residual heat removal is in progress;

b. RCS boron concentration is at the cold shutdown concentration;

c. the Reactor Makeup Control System is set to provide makeup at the cold

-shutdown concentration;

d. the RCS is either water solid or drained to minimum level for the purpose of refueling or maintenance (if the RCS is water solid, syster pressure is maintained by operation of a charging pump and controlled by the low pressure letdown valve in the letdown line (letdown is achieved via the RHRS));

e. the charging and letdown lines of the CVCS are filled with coolant at the cold shutdown boron concentration; the letdown orifice isolation valves are closed.

If the RCS requires filling and venting, the procedure is as follows:

a. one charging pump is started, which provides blended flow from the Reactor Makeup Control System at the cold shutdown boron concentration;

b. the vents on the head of tne reactor vessel and pressurizer are opened;

c. the RCS is filled and the vents closed.

The system pressure is raised by using the charging pump and is controlled by the low pressure letdown valve. When the system pressure is adequate for operation of the reactor coolant pumps, seal water flow to the pumps is established, and the pumps are operated and vented sequentially until all gases are cleared from the system. Final venting takes place at the pressurizer, em. . *

3-20

ATTACW.2I. ' ..~.=- l ST HL AE- 1763

. PAGE Jg0F 103 l a

. After filling and venting operations are completed, charging and letdown flows are established. The pressurizer heaters are then energized. Steam bubble formation in the pressurizer is accomplished by increasing the letdown flow above the charging flow. After the pressurizer bubble has been formed. the reactor coolant pumps are started to heat up the system. When the pressurizer water level reaches the no-load programmed setpoint, the pressurizer level control is shifted to centrol the charging flow to maintain programmed level.

The RHRS is then isolated from the RCS, and the normal letdown path is established. The pressurizer heaters are now used to increase RCS pressure.

The reactor coolant boren concentration is now reduced either by operating the Reactor Makeup Control System in the dilute mode or by operating the Boron

. Thermal Regeneration System in the boren storage mode and, when the resin beds are saturated, washing off the beds to the BRS. 'The reactor coolant boron concentration is corrected to the point where the control rods may be withdrawn and criticality achieved.

Prior to or during the heating process, the CVCS is employed to obtain the correct chemical properties in the RCS. The Reactor Makeup Control System is operated on a continuing basis to ensure correct RCS inventory and boren concentration. Chemicals are added through the chemical mixing tank as required to control reactor coolant chemistry such as pH and dissolved oxygen content. Hydrogen overpressure is established in the VCT to assure appropriate hydrogen concentration in the reactor coolant.

Power Generation At a constant power level, the rates of charging and letdown are dictated by the requirements of seal water to the reactor coolant pumps and purification of the RCS. One charging pump is employed and charging flow is controlled automatically from pressurizer level. The only adjustments in boron concentration necessary are those to compensate for core burnup. These .

adjustments are made at infrequent intervals to maintain the control groups within their allowable limits. Rapid variations in power demand are accommodated automatically by control rod movement. If variations in power em. ,s-wm 3.y

ATTACHMENT /

ST HL AE / 705 PAGE 49 0F iA3 level occur, and the nea poaer level is sustained for long periods, some adjustment in boron concentration may be necessary to maintain the control groups within their maneuvering band.

During normal operation, normal letdown flow is maintained, and one mixed-bed demineralizer is in service. Reactor coolant samples are taken periodically to check boron concentration, water quality, pH, and radioactivity level. The charging flow to the RCS is controlled automatically by the pressurizer level control signal through the charging header flow cc. trol valve.

Lead Follow A power reduction will initially cause a xenon buildup followed by xenon decay to a new, lower equilibrium value. The reverse occurs if the power level ir. creases; initially, the xenon kvel decreases, and then it increases to a new and higher equilibrium value associated with the amount of the power level change.

The Boron Thermal Regeneration System is normally used to vary the reactor coolant boron concentration to compensate for xenon transients occurring when reactor power level is changed. The Reacter Makeup Control System may also be used to vary the boron concentration in the reactor coolant.

The most important indication available to the plant operator, enabling him to determine whether dilution or boration of the RCS is necessary, is the position of the control rods. For example, if the control rods are below their desired position, the operator must borate the reactor coolant to bring the rods outward. If, on the other hand, the control rods are above their desired position, the operator must dilute the reactor coolant to bring the rods inward.

During periods of plant loading, the reactor coolant expands as its temperature rises. The pressurizer absorbs this expansion as the level controller raises the level setpoint to the increased level associated with the new power level. The excess coolant due to RCS expansion is let down and stored in the VCT. During this period, the flow through the letdown orifice om. +wm 3-22

ATTACHMENT /

ST HL.AE / 765 PAGE JC OF lace remains constant, and the charging flow is reduced by the pressurizer level control signal, resulting in an increased temperature at the regenerative heat exchanger outlet. The temperature controller downstream from the letdown heat exchanger increases the component cooling water flow to maintain the desired letdown temperature.

During periods of plant unloading, the charging flow is increased by automatic control to make up for the coolant contraction not accommodated by the programmed reduction in pressurizer level.

Hot Standby / Hot Shutdewn If required for periods of maintenance or following spurious reactor trips, the reactor can be held subtritical, but with the capability to return to full power within the period of time it takes to withdraw control rods. During this hot standby period, temperature is maintained at no-load T,yg by initially dumping steam to remove core residual heat, or at later stages by running reactor coolant pumps to maintain system temperature.

Following shutdown, xenon buildup occurs and increases the degree of shutdown; i.e., immediately after reactor trip, with initial xenon concentration and all control rods inserted, the core is maintained at a minimum of 1.75 percent ak/k subtritical. The effect of xenon buildup is to increase this value to a maximum of abou't 3 percent ak/k at about 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months following shutdown from equilibrium full power conditions. If hot shutdown is maintained past this point, xenon decay results in a decrease in degree of shutdown. Since the value of the initial xenon concentration is about 3 percent ak/k (assuming that an equilibrium concentration had been reached during operation), boration of the reactor coolant is necessary to counteract the xenon decay and maintain shutdown.

If a rapid recovery is required, dilution of the system may be performed to counteract this xenon buildup. However, af ter the xenon concentration reaches a peak, boration must be performed to maintain the reactor suberitical as the xenon decays out.

em. m em" 3-23

ATTACHMENT I !

, ST.HL AE 1765 PAGE 31 OF IM 4

\

Cold Shutdown Cold shutdown is defined by the reactor being suberitical by at least 1.75 percent ak/k and T,yg 5,200* F . ;

-Before proceeding to cold shutdown, the RCS hydrogen concentration is lowered by reducing the VCT overpressure, by replacing the VCT hydrogen atmosphere with nitrogen, and by continaous purging to the Gaseous Waste Processing System.

Before ccoldown and depressurization of the reactor are initiated, the reactor coolant boron concentration is increased to the cold shutdown value. After the boration is completed and reactor coolant samples verify that the concentration is correct, the operator resets the Reactor Makeup Control System for leakage makeup and system contraction at the shutdown reactor coolant boron concentration.

Contraction of the coolant during cooldown of the RCS results in actuation of the pressurizer level control to maintain normal pressurizer water level. The charging flow is increased, relative to letdown flow, and results in a decreasing VCT level. The VCT level controller automatically initiates makeup

'to maintain the inventory.

After the RHRS is placed in service and the reactor coolant pumps are shut down, further cooling of the pressurizer liquid is accomplished by charging through the auxiliary spray line. Coincident with plant cooldown, a portion '

of the reactor coolant flow is diverted from the RHRS to the CVCS for cleanup. Demineralization of ionic radioactive impurities and stripping of fission gases from the VCT reduce the reactor coolant radioactivity level sufficiently to permit personnel access for refueling or maintenance opera tier.s.

Should the normal systems be unavailable, safety-related backups are provided to achieve cold shutdown following a SSE and a LOOP.

om. i.-w .'

3-24

ATTACHMENT l .

ST HL AE.17 G PAGE 3 20F ist3 .

4.0 ANALYSIS The NRC Standard Revien Plan (NUREG-0800) requires that a boron dilution incident of moderate frequency in combination with any single active component failure or single operator error shall be considered. In addition, at least 15 minutes in MODES 1-5 or 30 minutes in MODE 6 should be available between the time that an alarm announces the inadvertent boron dilution and the time of total loss of shutdown margin. In order to address these requirements, three analyses are performed:

a. screening analysis to identify potential boron dilution initiators;

b. probabilistic analysis of the baron dilution events;

c. analysis of response time between alarm annunciation and total loss of shutdown margin.

These analyses are performed for shutdown MODES 3 through 6. MODE 5 (cold shutdown) is divided into MODE Sa (RC loops filled) and MODE Sb (RC loops drained).

4.1 INITIATING EVENTS A screening analysis of all components in the CVCS and the Boron Thermal Regeneration System (BTRS) was performed to identify components which have an effect on boron dilution in all possible mod of failure. Once the components which affect dilution were identified, a detailed Failure Modes and Effects Analysis (FMEA) was performed to further analyze the potential initiators of boron dilution events. Passive components (heat exchangers, tanks, pipes, manual valves) are not included in either analysis except for the manual valves that could lead to a boron dilution event. The results of the screening analysis are listed in Appendix A and the FMEA results are .

listed in Appendix B.

C2Cb 16 09140t 4.}

L

ATTACHMENT l ST Hi-AE 1M; l

.. PAGE 130Fl a3 '

. Only the failures asso:iated with flushing operations requiring unborated' water are considered in the BTRS since load following is not performed during the shutdown modes.

Rapid purification can take place during either cold shutdown or refueling operations. The reactor coolant purification pump is placed in operation, both spray valves are opened in the VCT, both mixed-bed demineralizers are placed in operation, and both reactor coolant filters are placed in ,

operation. The maximu- letdown during this operation is 450 gpm. Before this procedure is initiated, valves CV0302, CV0261, CV0214, CV0124A, CV01245, CV0133A, CV01339, CV0215, and CV0221 will be verified closed and locked closed. No flushing cperations will be allowed. If VCT level indicates that makeup will be necessary over the time span of these operations, makeup should be completed before the purification process and the 6 position CVCS mode switch placed in the "0FF" position before purification is initiated to preclude a possible source of dilution from the Reactor Makeup Water System.

VCT level will be closely monitored during this operation. During refueling operations and in MODE Sb (RC loops drained), all dilution sources will be locked out to preve'1t potential baron dilution events as specif'ied below, l

During a refueling operation (MODE 6), the following valves are locked closed and secured in position by mechanical stops or by removal of air or electrical power (iech Spe: 3.9.1) and verified closed:

FCV-1108 - Isolates reactor makeup water line to charging pump suction line CV0201A - Isolates the chemical injection line CV0215 - Isolates reactor makeup water in the emergency boration line CV0221 - Isolates manual emergency boration path.

FCV-1118 - Isolates fiow from reactor makeup water line to VCT in addition, all flushing operations will be prevented, unless the system '

associated ',.ith the flushing operation is also locked out such that there is no path to the VCT or charging pump suction line.

Tne above restrictions on valves and flushing operations will also be initiated in HDDE Sb.

cman-mm 4-2

ATTACHMENT /

ST Hi<AE- 1765

, PAGE 34 OF y;is The potential bcron dilution initiators identified in the FMEA are summarized in Table 4.1-1. These potential initiators were combined and categorized as follows:

Event Initiator FMEA Number 1 Radiation monitor flush 12 2 Emergency beration line flush 67,68 3 CVCS demineralizer flush 14,15,16,17,18,19 4 BTRS boron flush 29,32,41,64 5 BTRS domineralizer resin flush 35,36,37 6 BCMS flush 43 7 Reactor makeup system 45,69,70 6 Chemical addition 65,66 During shutdown modes, potential initiators 2-5 will be under administrative control. Operating precedures require that control roca personnel are notified that a flushing operation will commence. Control room personnel will also be notified when the operations are completed. All valves that are to be closed at the end of the operation will be checked and verified closed or locked closed and properly tagged. Hence, control room operators will be alerted to monitor the volume control tank '(VCT) level and be aware that an abnormally increasing VCi level could be an indication that a potential bcron dilution event began during the flushing operation.

Reactor makeup water is delivered te the CVCS through manual valve CV0198.

This valve will be positioned to restrict the flow to 250 gpm. After verification of the flow rate, the valve will be locked in place. This procedure will limit the maximum flow to the CVCS to 250 gpm in all modes of operation. In addition, the setpoint for modulating valve FCV-111A will be reset to a maximum of 150 gom (including uncertainty in the flow) during MODE Sa.

l em. i.-emie 43 i

l 4

1 ATTACHMENT /

. ST HL AE-1765 PAGE 350F lab I 4.2 PROSABILISTIC ANALYSIS In order to perform the probabilistic analysis, the probability that each postulated boron dilution event could be initiated is calculated. The frequency of operation per reactor year associated with the dilution event is estimated and combined with the probability to yield the frequency of each boren dilution initiating event. An event tree is constructed to model the responses to each initiating event and calculate the frequency of loss of shutdown margin per reactor year (R-Y). As part of this analysis, the majcr support systems (component cooling water, instrument air, AC and DC power) are assumed te be available.

4.2.1 Frequency of Operation In order to calculate the frequency of operation, the following conservative estimates of time spent in each mode of operation per year are assumed:

MODES 3 and 4 480 hours0.00556 days 0.133 hours 7.936508e-4 weeks 1.8264e-4 months MODE Sa (RC loops filled) 1200 hours0.0139 days 0.333 hours 0.00198 weeks 4.566e-4 months MODE Sb (RC loops drained) 240 hours0.00278 days 0.0667 hours 3.968254e-4 weeks 9.132e-5 months MODES 3 and 4 are combined because of their similar volume and boron concentrations. These times are used to calculate the frequencies of operation for those initiators which are figured on an hourly use basis. For all others, frequency of operation is based on the number of times per year the system would be in use.

4.2.2 Description of Initiating Events Each potential initiator is described in the following sections.

4. 2. 2.1 Radiation Monitor Flushing Flushing of radiation monitor RT-8039 is handled as a " purge" operation at the radiation monitor. A " purge" signal from the radiation monitoring software closes the sample inlet valve, opens the flush inlet valve, and allows em. i.. emu 44

ATTACHMENT I

ST HL AE- t 765

. PAGE 36 OF g3 !

. flushing _to take place for a time preset in the software. At.the end of that time, the sample inlet is opened, the purge inlet is closed (by the sof tware),

and the process sample is again examined by the detector. The signal to flush the radiation monitor is manually generated locally or in the control room, and the flushing operation is conservatively assumed to occur every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months in the shutdown modes. If the purge valve fails open after the flushing operation, unborated water could be delivered to the Volume Control Tank. The maximum flow rate would be 7 gpm and the time to total loss of shutdown margin would be longer than 3 weeks. Since this flushing occurs approximately every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , even if the purge valve fails open after one flushing operation, the radiation menitoring system or erroneous readings from the radiation monitor would alert the control room operators to the purge valve failure within the 3 weeks necessary for total loss of shutdown margin. Therefore, this potential initiating event is not considered to be a credible event.

4.2.2.2 Emergency Boration Line Flush l

Emergency boration is implemented when the addition of boric acid to the RCS is necessary under abnormal conditions requiring rapid but controlled insertion of negative reactivity. If the normal boration path (through valves FCV-110A and FCV-1105) is not available, then remote-manual motor-operated valve MOV-0218 is opened by the cperator. if this valve does not open, then manual valve CV0221 could be opened as an alternative path for emergency baration. If this path is also not available, the RWST may be opened to the charging pump suction, but this will require three times as much flow to deliver the equivalent boren concentration change.

If MOV-0218 is opened, the emergency boration flush line valve CV0215 would be opened to the Reactor Makeup Water System for a short time period to insure that 4% boric acid solution does not remain in the emergency boration line for long periods of time. If valve CV0215 is left open, the RCS will be diluted at the maximum ficw rate any time a reactor makeup water pump is running for operations other than reactor makeup. If the makeup system is operating, the flow could be split, resulting in a lower dilution rate.

om. i com 4-5

ATTACHMENT I

, ST HL AE I*165 ;

PAGE 370F 14

. Strict administrative controls are placed on CV0215. This valve will be locked closed with the key under supervisor control. If this valve is opened for a flushing operation, it will then be verified closed with no flow through the valve. CV0215 will be specifically tagged and only opened after tFe control room supervisor is also notified.

CV0221 is also administrative 1y controlled. This valve would be used only under abnormal conditions, mainly if MOV-0218 failed to open. This path would be a cilution path if the valve 1s not closed curing a flushing operation of the boration line. This would be a very infrequent operation. The same strict administrative contrels are implemented on this valve as for CV0215.

The emergency beration line will be flushed only after an abnormal event which is assessed at a frequency of 0.1/R-Y. Both valves are locked closed and specially tagged to prevent either valve from being opened accidentally.

Because of the strict administrative controls implemented on valves CV0215 and CV0221, the two events associated with the flushing operations are removed as credible dilution events.

4.2.2.3 CVCS Demineralizer Flush One mixed-bed demineralizer is considered to be in constant use. For flushing and sluicing (resin change) operations, manual inlet valve CV0118A (or CV011BB) is closed and manual outlet valve CV0125A (or CV0125B) is closed. If either of these valves is lef c open during these operations, unborated water will be delivered through the other demineralizer or directly to the path to the VCT. After the flushing or sluicing operation is completed, unborated water could be delivered to the VCT path if CV0124A (or CV0124B) is not closed (assuming that the LWPS spent resin sluice pump is running). The same scenario is postulated'for cation-bed demineralizer flushing and sluicing operations, except the.t inlet valve CV0127A (or CV0127B) and outlet valve CV0134A (or CV0134B) should be closed. The cation-bed demineralizers are not in constant use and are ncrmally valved out of service. Since failure to close these inlet and outlet valves is less likely than for the mixed-bed demineralizers, the failures during flushing / sluicing operations of the cation-bed demineralizers are bounded by the failures during the flushing / sluicing operations of the mixed-bed demineralizers.

cru.i. e s

4-6 i

i _ -

ATTACHMENT 8 -

ST.HL AE- l%5 I

. PAGE.jEOfIA3 It is assured that each demineralizer is flushed once per reactor year. A probability of 0.1 is assigned that the flushing operation could occur in MDDES 3 and 4.

4.2.2.4 BTRS Boron Flush The BTRS can be used to adjust boron concentrations during startup. In this case, the resin beds are saturated with boron from the CVCS flow, and the boron is then flushed off to the Boron Recycle System. Manual outlet valve CV0275 on the path to the VCT is closed. Manual inlet valves CV0206 and CV0261 and FCV-111A are opened to provide reactor makeup water to the BTRS demineralizers. The control switch for BTRS demineralizer bypass valve HCV-387 is placed in the "DEMIN" position and the BTRS mode selector switch is place in the " BORATE" position. When the operation is terminated, valves CV0206, CV0261, and FCV-111A are closed, the control switch for HCV-387 is placed in the " BYPASS" position, the BTRS mode selector switch is placed in the "0FF" position, and CV0275 is opened. Two potential dilution scenarios could occur.

a. Durinc boron flushina coeration If manual valve CV0275 is not closed and the operator does not place the HCV-357 switch in the "DEMIN" position, unborated water will be delivered to the VCT via FV-3376 which is open during the borate mode of operation.

If the HCV-387 switch is in the "DEMIN" position and CV0275 is open, borated water would be delivered until the boron is flushed from the demineralizers. Unborated water could be delivered to the VCT if the operator fails to terminate the operation.

b. After boren flushina operation If manual valves CV0206 and CV0261 are not closed, then unborated water will be delivered to the VCT path (whenever a RMW pump is running) via the path from HCV-387 (in bypass position).

02:3s it-091881 4.]

AT TACHMENT ' -

ST HL AE 1765

. PAGE S10F GS Although this operation is normally performed during startup, one flushing operation per year is assuT.ed which could occur with equal probability (.5) in MODES 3 and 4 or. MODE Sa.

4.2.2.5 BTRS Demineralizer Resin Flush There are five BTRS demineralizers (A-E), but it is assumed that only one demineralizer is flushed per fuel cycle. The demineralizer is vented as part cf the resin change. Unborated water would be delivered to the volume control tank during a resin flushing operation under two conditions.

a. Durino the resin flushinc operation The demineralizer is not isolated during the resin flushing operation.

Considering the A demineralizer, if either inlet valve CV0266A or outlet valve CV0272A is left open, combined with the failure of an operator to close manual valve CV0275 on the path to the volume control tank, then unborated water would be delivered to the VCT.

b. After the resin flushino operation The LWPS is not isolated after the resin flushing operation. If manual valves CV0298A and CV0302 are left open, then unborated water will be delivered to the VCT path (whenever the spent resin sluice pump is running) via open valves in the BTRS.

It is assumed that one demineralizer per year is flushed in MODE Sa (i.e.,

probability = 1.0). A probability of 0.1 is assigned that the flushing operation could occur in MODES 3 and 4.

4.2.2.6 Boron Concentration Measurement System Flush l The Boron Concentration Measurement System (BCMS) is periodically flushed with I demineralized water. Manual valve CV0163 to the VCT is closed, FV-3124 is closed, manual valve CV0650 is opened to drain the BCMS and the demineralized em.a-m."

4-8

ATTACHMENT /

ST Hl. AE 17(5 PAGE 46/ OF I;3 i

. water valve DWO694 is opened. If a closed valve fails open to the CVCS or VCT during a BCMS flushing operation, it will not cause an uncontrolled boron dilution event since the flowrate from this source is so small (<7 gpm).

However, if DWO694 is not closed af ter the flushing operation, then unborated water would be delivered to the VCT. Therefore, this is the only event considered.

Fluching the BCMS is assumed to be necessary whenever the RCS boron concentration is changed appreciably. The time to reach total loss of shutdown margin as the result of this initiator would be longer than 3 weeks.

Therefore, it is unlikely that this event could occur during MODES 3 and 4 as it is assumed that the plant will either return to power or go to cold shutdown. A frequency of 2 events per reactor year is assigned to this event in cold shutdown to bound an event that could start in MODES 3 and 4 and result in a dilution event in MDDE Sa.

This event has the same dilution flowrate as radiation monitor flushing. It is considered as a credible dilution event because operation of the BCMS is low frequency in the shutdown modes, thereby making it improbable that operators would detect valve DWO694 erroneously open before dilution to total loss of shutdown margin potentially occurs.

4.2.2.7 Reactor Makeup System The Reactor Makeup System will normally be operated in the automatic makeup mode. Each of the other modes (dilute, alternate dilute, borate) is selected for its specific purpose by the operator. The operator not only sets the mode switch for these other modes, but performs other tasks as well, such as dialing flow rates, opening mode specific valves, and starting pumps. Each component mode is verified before the start switch is activated. Therefore, selecting the wrong mode of operation (e.g., dilute instead of borate) would involve a total breakdown of procedures. On the other hand, pump operation or valve position may not be verified in the automatic mode. The random failures that could occur in either the borate or dilute mode are included in the i C2:3 It-09188t 4.g

ATTACHMENT i

ST.HL AE 1765 PAGE #f 0F ist A l auterratic mode of operation. Although a common mode failure (such as loss of AC or DC power, loss of instrument air, or failure of the automatic signal) could fail the operation of makeup, these common mode failures would not initiate a boron dilution event as valves FCV-111A, FCV-111B, and FCV-1105 on the flow path from the Reactor Makeup System would fail closed.

In the automatic mode, the beric acid and reactor makeup water flow controllers are set to give the same concentration of borated water as contained in the RC5. A low level signal from the volume control tank level controller starts a selected reactor makeup water pump and a boric acid transfer pump, opens the makeup stop valve (FCV-1103), the boric acid flow control valve (FCV-110A), and the reactor makeup water flow control valve (FCV-111A).

Makeup addition to the charging pump suction header causes the water to rise in the VCT. When the level reaches a high setpoint, the pumps are stopped and the valves are closed (automatically).

Unborated water could be delivered to the suction line of the charging pumps if no boric acid is delivered through valve FCV-110A. The temperature, level, and boron concentration of the water in the boric acid tanks are checked and verified at least once every 7 days. All heat tracing will be verified operable whenever the room temperature falls below 65'F. The valve alignments will also be checked and verified at least once a month, as well as after any maintenance operations. Therefore, the main contributors to the failure to deliver boric acid solution are the failure of valve FCV-110A to open or failure of the boric acid transfer pump to start or run. If no boric acid flow is delivered, then a deviation alarm is activated. The operator would then stop the makeup operation.

Valve FCV-111A modulates the flow from the reactor makeup water pumps. A deviation alarm will activate if total makeup exceeds the setpoint flow by 15 gpm.

em.+enau 4-10

ATTACHMENT /

.. ST4iL AE l?66 PAGE @0F193 The VCT level controller will automatically stop makeup at a high setpoint.

If this level control action fails, the volume will continue to rise until a divert flow setpoint is reached. The letdown flow will then be partially diverted to the BRS. If the level continues to rise and the high level indicator is reached, a high level alarm will activate and the letdown flow will be totally diverted to the BRS.

The sequence of possible events which could result in a boron dilution event is descrice with an event tree. Figure 4.2-1 is the event tree for MSDE Sa.

The top events (nodes) of the event tree are as follows.

NBD Boric acid is not delivered to the makeup operation.

BDA Boric acid deviation alarm fails to activate.

OP1 Operator fails to diagnose the cause of the boric acid deviation alarm (given that the alarm activates) and fails to stop the reactor makeup water pump.

MFC Modulating valve FCV-111A f ails in wide open position.

TDA The total makeup deviation alarm fails to activate.

em. u-emie 4 11

ATTACHMENT i ST HL AE 065

.. PAGE 13 OF I;L3 U

The operator fails to diagnose the cause of the total makeup deviation alarm (given that the alarm activates) and fails to stop the reactor makeup water pump.

E Reactor makeup is not automatically stopped by the VCl-level controller.

Three dilutien events are postulated, as follows:

a. beric acid is being mixed with the reactor makeup water, but valve FCV-111A has failed and is delivering reactor makeup water at the maximum flow rate such that the RCS boron concentration is being diluted by a flow rate of approximately 100 gpm (250 gpm of reactor makeup water mixed with boric acid sufficient only for makeup at 150 gpm);

b. beric acid is not being mixed with the reactor makeup water, but valve FCV-111A is delivering reactor makeup water at the setpoint flow rate (valve FCV-111A has not failed);

c. boric acid is not being mixed with the reactor makeup water, but valve FCV-111A has failed open and is delivering reactor makeup water at the maximum flow rate.

The consequences on each path of the event tree are specified by an identifier. Any identifier ending with an I is an initiating event. The identifiers are defined as follows.

NODll No dilution event is initiated, em. t -esme 4-12

ATTACHMENT I

'. ST HL. AE l'u,5

. PAGE W OFlA3 MINXDIL The incorrect bcron concentration has been delivered to the RCS. Reactor makeup water is being blended with the boric acid, but at a flow rate of 250 gpm instead of 150 gem. The boron concentration has been reduced, but the makeup operation has been terminated within the 15 minute requirement.

MIXDILI The incorrect baron concentration has been delivered to the RCS and a dilation event is initiated. Boric acid is being blended with the reactor makeup water, but valve FCV-111A has failed open and is delivering reactor makeup water at the maximum flow rate of 250 gpm instead of 150 gpm. As a result, the RCS baron concentration is being diluted at approximately 100 gpm.

MINADIL Beric acid is not being delivered to the makeup system. RCS baron concentration is being reduced by reactor makeup water at the setpoint flow rate of 150 gpm. The reactor makeup water flow has been stopped within the 15 minute requirement.

AVGDILI Boric acid is not being delivered to the makeup system. A boron dilution initiating event results. Reactor makeup water is delivered at the setpoint flow rate of 150 gpm.

MINFDIL Boric acid is not being delivered to the makeup system. RCS boron concentration is reduced by reactor makeup water at the maximum flow rate of 250 gpm instead of 150 gpm. The reactor makeup water flow has been stopped within the 15 minute requirement.

e m .in-e m ie 4 13

ATTACHMENT /

ST HL AE. /765

, PAGE 4/50F lAS

I l

MAXDILI !

Boric acid is net being delivered to the makeup system. A boron dilution initiating event results. Reactor makeup water is delivered at the maximum flow rate of 250 gpm.

Figur e 4.2-2 is tiie event tr ee fur MODE 5 3 and 4. In MODES 3 and 4, FCV-111A has not been reset, therefere the maximum flow could be 250 gpm through this valve. The top events NSD, BDA, OF1, and AMS are the same as described abcVe for Figure 4.2-1. The path identifiers are defined as follows.

NO31L No dilution event is initiated.

MINDIL Boric acid is not being delivered to.the makeup system. The reactor makeup water flew has been stopped within the 15 minete requirement.

DILI A boron dilution event is initiated.

The frequencies of automatic makeup are assigned as follows:

MODES 3 and 4: Once every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months MODE Sa: Once every 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months c :2. i -e isu 4 14

ATTACHMENT I

ST HL AE- /Wc.5

. PAGE 4t43F ig.3 4.2.2.8 Chemical Addition Af ter chemicals are added from the chemical mixing tank, outlet valve CV0214 and inlet valve CV0201A are opened to flush out the tank with reactor makeup water. If these valves are left open after the flushing operation, then unborated reactor makeup water will be delivered to the charging pump suction.

The frequencies of chemical addition are assigned as follows:

MODES 3 and 4: once every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months MODE Sa: 2 times 4.2.3 Boron Dilution Event Mitigation Once a dilution event has been initiated, it is assumed that the flux multiplication alarm will activate. If the alarm succeeds, then the operator will assess the situation to determine that a boron dilution evant is occurring, and take the appropriate action to restore the required shutdown margin. The operator will close off the dilution source and/or initiate emergency boration in this case. He will close the VCT outlet isolation valves (MOV-0112B or MOV-0113A) and open the valves from the RWST to the suction line of the charging pump (MOV-0112C and MOV-113B). Emergency boration could also be initiated through MOV-0218 or CV0221, although no credit is taken for beration through either of these valves. These sequences of events are modeled with an event tree and shown in Figure 4.2-3. The top events (nodes) on the event tree are as follows.

1E.

1 Frequency of initiating event.

FMA Flux multiplication alarm activates.

4 ein. i.-m .e 4-15

ATTACHMENT I

,' ' ST-HL. AE 17(c5 PAGE 4'70F in 0A Operator takes action on the flux multiplication alarm.

E The VCT valves are closed, RWST valves are opened or emergency boration is initiated through MOV-0218.

The consequences of each path are defined as follows.

Success Boron dilution event mitigated and shutdown margin restored.

LSM Total less of shutdown margin occurs.

The top event failure probabilities are calculated in Appendix C. Table 4.2-2 lists these top event failures as well as the initiating event frequencies for each potential initiator.

Each initiating event is quantified for both MODES 3 and 4 and MODE Sa. The probability of LSM is calculated for each initiating event in each shutdown mode and reported in Table 5.0-1.

4.3 RESPONSE TIME CALCULATIONS Appendix D contains the basic model, assumptions, basic equations and parameters necessary for the calculation of the time from alarm to the time of total loss of shutdown margin for each boron dilution initiator listed in Table 4.2-1. The results of these calculations are presented in graphic form in Section 5.0.

em. i. m es 4-16 se- *

ATTACFDAENT /

, ST HL AE 1165 l

. PAGE 4F0FI Ab l Table 4.1-1 Potential Initiating Events FMEA Number Component Operation Remarks 12 Radiation Monitor Furge valve open after Frequency of RT-8039 radiation monitor use limits its flush dilution potential 14 Demineralizer Valve open inlet valve during resin (CV0118A or CV011BB) flush 15 Demineralizer Valve open outlet valve during resin (CV0125A or CV0125B) flush 16 Liquid waste system Valve open Locked closed outlet valve after resin all modes (CV0124A or CV0124B) flush 17 Cation demin inlet Valve open during valve (CV0127A or resin flush CV0127B) 18 Cation demin outlet Valve open during valve (CV0134A or resin flush CV0134B) 19 Liquid waste system Valve open after Locked closed outlet valve resin flush all modes (CV0133A or CV0133B) en a-miei 4 17

ATTACHMENT /

. /MS ST PAGEHL

4 AJ 0F /Bi3 Table 4.1-1 (cont)

Potential Initiatina Events FMEA Number Component Operation Remarks 29 Reactor makeup water Valve open RMWS manual to BTRS manual valve af ter boron valve CV0206 CV0261 flush must also fail open 1

32 BTRS demin Open to bypass No dilution bypass valve HCV-387 durir.g boron occurs if flush valve CV0275 remains closed 35 BTRS demin manual Valve open outlet valves during resin CV0272A-E sluicing 36 Liquid waste system Valve open CV029BA, B, C, D, or E -

to BTRS manual valve af ter resin must also fail CV0302 sluicing open 37 BTRS demin manual Valve open inlet valves during resin CV0266A-E sluicing 41 BIRS outlet Valve open HCV-387 must fail manual valve during baron open to bypass for CV0275 flush maximum dilution 43 Demin water manual Valve open af ter valve DWO694 BCMS flush e m i.-eeisee 4-18

ATTACHMENT l i

ST HL-AE D65

PAGE =EOFIR3 Table 4.1-1 (cont)

Potential Initiating Events FMEA

. Number Comocnent Operation Remarks 45 Air-diaphragm globe Fails wide open during Flow deviation alarm valve FCV-111A automatic makeup alerts operator 64 Reactor makeup water Valve open after Manual valve CV0261 to BTRS manual valve boron flush must also fail open CV0206 65 Chemical mixing Valve open after Outlet valve CV0214 tank inlet valve chemical addition must also fail open CV0201A for dilution 66 Chemical mixing tank Valve open after Locked closed outlet valve CV0214 chemical addition all modes 67 Emergency boratier. Valve open after Locked closed line manual valve line flush all modes CV0215 68 Manual outlet Fails open after Locked closed valve CV0221 alternate emergency all modes boration 69 Air-diaphragm Fails closed during Flow deviation globe valve automatic makeup alarm alerts FCV-110A operator .

70 Boric acid Fails to deliver Flow deviation transfer pump fluid in automatic alarm alerts makeup operator i

em. n e., n 4_19

- ~

Table 4.2-1 Frequency of Initiating Events Initiating Mode frequency Probability Frequency of Comment Event of Operation of Occurring Initiating _ Event

1. CVCS Demineralizer Flush 3 and 4 0.1/R-Y 1.6 E-3 1.6 E-4/R-Y Sa 4.0/R-Y 1.6 E-3 6.4 E-3/R-Y Sb 0 Administrative Control 6 0 Administrative Control

2. BTRS Boron Flush 3 and 4 0.5/R-Y 3.5 E-4 1.8 E-4/R-Y a 5a 0.5/R-Y 3.5 E-4 1.8 E-4/R-Y b Sb 0 Administrative Control 6 0 Administrative Control

3. BTRS Demin Resin Flush 3 and 4 0.1/R-Y 8.0 E-4 8.0 E-5/R-Y Sa 1.0/R-Y 8.0 E-4 8.0 E-4/R-Y 5b 0 Administrative Control 6 0 Administrative Control 3

4. BCMS Flush 3 and 4 -

2.0/R-Y 0

1.30 E-2 2.6 E-2/R-Y Not a credible event Sh Sa DM%

Sb 0 bounded by MODE Sa 6 0 bounded by MODE Sa $(n--

nun. mm

Table 4.2-1 (cont)

Frequency of Initiating Events Initiating Mode Frequency Probability Frequency of Comment Event of Operation of Occurring Initiating Event

5. Reactor Makeup System 3 and 4 60/R-Y 7.22 E-4 4.3 E-2/R-Y Sa 48/R-Y 4.31 E-4 2.1 E-2/R-Y Sb 0 Administrative Control 6 0 Administrative Control

6. Chemical Addition 3 and 4 10/R-Y 2.0 E-4 2.0 E-3/R-Y Sa 2.0/R-Y 2.0 E-4 4.0 E-4/R-Y C3 Sb 0 Administrative Control 6 0 Administrative Control i

R;W

<> sli' prpe:

DE

-p -t h%

bl 0701. = 6 091RAA

l ATTACHMENT I t ST44L. AE- 1765 PAGE s3 0F lA3 Table 4.2-2 Initiating Event Frequencies and Top Event Failure Probabilities for Quantifying Loss of Shutdown Margin Event Tree Event Tree Node Modes 3 and 4 Mode 5a 1 IE 1.6 E-4/R-Y 6.4 E-3/R-Y FMA 3.9 E-4 3.9 E-4 OA 3.0 E-4 3.0 E-3 MIT 7.3 E-4 7.3 E-4 2 IE 1.8 E-4/R-Y 1.8 E-4/R-Y FMA 3.9 E-4 3.9 E-4 OA 3.0 E-3 3.0 E-3 MIT 7.3 E-4 7.3 E-4 3 IE 8.0 E-5/R-Y 8.0 E-4/P-Y FMA 3.9 E-4 3.9 E-4 OA 3.0 E-4 3.0 E-3 MIT 7.3 E-4 7.3 E-4 4 IE --

2.C E-2/R-Y FMA --

3.9 E-4 0A --

9.0 E-4 MIT --

7.3 E-4 5 IE 4.3 E-2/R-Y 2.1 E-2/R-Y FMA 3.9 E-4 3.9 E-4 OA 3.0 E-3 3.6 E-3 MIT 7.3 E-4 7.3 E-4 6 IE 2.0 E-3/R-Y 4.0 E-4/R-Y FMA 3.9 E-4 3.9 E-4 OA 1.5 E-2 1.0 E-1 MIT 7.3 E-4 7.3 E-4 l

u n. .. w .

4-22

l lll!

M >nIE$~

.>T -

. Ia.m.,D# Din a

l l l l l L l l L L I L I l l Ll l L I l i l D Di lI ID ID L II DI L l l 1 l l I L i l I l D D i D i D iD D i D ID i X X D X D A A D D D D N N N N N N N 0 O I I I I WWN WND NA I I I V l l A l A I V 1 l A l A G D WWN WN N M M M M MMMA MMMMMM A MMMMM 1 2 3 4 5 S T 8 9 0 1 2 3 4 5 6 7 es0 1 1 1 1 1 1 1 1 1 l t 2 2 S

M A _

,i ,3 ,3 ! ,' ,I ,' ! _

2 P

O

)

a l ,l S e

d A o P M

(

T 1

s

{ _

2l 4a

.i F

e C

rp W

uu ge ik Fa M

r o

t c

3 P a O e R

A O

D O

B H

- T E

I

a i

i

, ET HD SOA OPl apeg i NODil 2 MIN 0ll I

n , 3 MIN 0ll d ' - 4 DILI 5 M1pOIL

' s plL1 i

4 m u)>

d -e a (v1,-a.bl-e

'.c hM o44 f

'M i q;m$ _

1 W l !

! Figure 4.2-2 Reactor Makeup Fails (Modes 3 and 4) m.______ _ _ _ _ _

1 4

4 I

, IE FMA OA Pfl T I

I g g gg 2 LSM o,

to 3 tsM v.

4 LSM

't 4

l i

i nu) d -t >w i o++

m p.- >

. o udz i &DF o- m:

moz VH l

s 3~ % ,

Figure 4.2-3 Loss of Shutdown Margin

i ATTACHMENT l !

- i ST HL AE-l%5 i I PAGE 5'7 OF jag l

~5.0 RESULTS The following initiators are quantified:

1. CVCS demineralizer flush

2. BTRS boron flush

3. BTRS demineralizer resin flush

4. BCMS flush

5. Reactor makeup system

6. Chemical addition Initiators 5 and 6 will be administrat.vely locked out in MODE Sb (RC loops drained) and MODE 6. ' Initiators 1-3 will not be performed in MODE Sb and only allowed in MODE 6 if additional controls are imposed (additional valves closed). Initiator 4 is bounded in MODES Sb and 6 by the analysis for MODE Sa.

The probability of each initiator occurring is quantified in Appendix C and reported in Table 4.2-1. The frequency of each operation is siso shown in Table 4.2-1, as well as the frequency of each initiating event (frequency of operation times the probability of each event occurring).

The response times available to the operator from time of the flux multiplication alarm to the time of total loss of shutdown margin are quantified in Apperdix D. The graphs showing the minimum required shutdown margin versus RCS critical boron concentration are given in Figure 5.1-1 (MODE Sa) and Figure 5.1-2 (MODES 3 and 4). Additionally, graphs showing the required shutdown margin versus RCS boron concentration are given in Figure 5.1-la (MODE Sa) and Figure 5.1-2a (MODES 3 and 4) for comparison. Based on the required shutdown margin to yield a minimum of 15 minutes for operator response, the frequency of total loss of shutdown margin is quantified with the mitigating event tree (Figure 4.2-3). The probability of total loss of shutdown margin is listed in Table 5.0-1, as well as the frequency per reactor year of each initiating event. The product of the probability of total loss of shutdown margin and the frequency of each initiating event is also listed in Table 5.0-1 as the frequency of total loss of shutdown margin. The overall frequency of a total less of shutdown margin is 4.2 E-4/R-Y. The percent c m . a-o m ie 5-1

ATTACHMENT j

- ST HL AE- 1%5 1 pag ST Of IA3 l i

i contribution of each initiator is listed in Table 5.0-1. The largest contributor is failure of the reactor makeup system. Failure of the reactor makeup system contributes a total of 63%. This is mainly attributed to the postulated numbe- cf times that the system would be in operation during the shutdown modes.

4 f

a 1

cm.in w

5-2

,, -- . . , ---..m, - -- _

-,,, .- ..m-. -. . . , __rr m_ -_ , _ _ . _ - , - .--

ATTACHMENT / :

ST.HL AE 1765 .

- - PAGE 59 OF 1205 i ,

. l Table 5.0-1 Frequency of Unplanned Boron Dilution Events (Per Reactor Year)

Frecuency**

Initiator Mode Probability

Event LSM % Contribution 1 3 and 4 1.4 E-3 1.6 E-4 2.24 E-7 0.05 Sa 4.1 E-3 6.4 E-3 2.62 E-5 6.23 2 3 and 4 4.1 E-3 1.8 E-4 7.38 E-7 0.18 Sa 4.1 E-3 1.8 E-4 7.38 E-7 0.18 3 3 and 4 1.4 E-3 8.0 E-5 1.12 E-7 0.03 Sa 4.1 E-3 8.0 E-4 3.28 E-6 0.79 4 Sa 2.0 E-3 2.6 E-2 5.20 E-5 12.46 5 3 and 4 4.1 E-3 4.3 E-2 1.76 E-4 42.17 Sa 4.1 E-3 2.1 E-2 8.61 E-5 20.63 6 3 and 4 1.6 E-2 2.0 E-3 3.20 E-5 7.67 Sa 1.0 E-1 4.0 E-4 4.00 E-5 9.58 Total 4.17 E-4 100.00

Results of quantification of event tree.

- Frequency of initiating event and frequency of total loss of shutdown margin due to unplanned boren dilution events.

em. u-emit 5-3

- ~

SOUTH TEXAS PROJECT UNTTS 1 & 2 MODE 5 a FIGURE 5.1-1 REQUIRED SHUTDOWN MARGIN VERSUS RCS CRITICAL BORON CONCENTRATION, ALL-RODS-IN MINUS MOST REACTIVE R0D STUCK IN WITHDRAWN POSITION (MODE Sa)

(INDEPENDENT OF TEMPERATURE) 6.00

_. _. . . l ...._ .__ . _. d_ .,_ _ ! _ .. . ..f_. _ .

i

. _ t ._ _.. . , _

. f. . ._ _ _. .

. l /_ f . _

m s j.

. _ .. .} . l .._1.

_ 4 ._. _ ._ ._ ..

.._ tf ..

G['

5.00 -

I

.. J .

!/

[ .. ..._. . _ .._ L f

f_l

._. __.._ ._. . _ . .. . .._._ _ _ . _. .. . . . . . .. _.._b

/ _l I

g

4. _ .. ._ __._ ._. _._ . . ..._. ._. _ ._ .._ . ._ .. _ . __ ..

(G 4.00 -- .

/

4 j 8

) . . . _ . _ .. .-.-._.

._._-._y .. -_ _. - .._ .._. . __ .. ..

t. I y

.\- . _. .___. ._...

y - . . _ . . _. - .-. . . _..._

{.

~ _ . _ . .

___/_ '

V' o 3.00 -

O _- _ . __ . ._._ . . _ _ _.._ __._ _ _ .

/

_/ _ . _._. __.._.. ._. . .. _ . . ...L_ . .

b ._ ..._ _._. y ..____ ._ -_ 1. l

/

.y. . _ ._._.

M .

2.00

/

a _

N _ . _ ._._ _.___ _ _. _. . ..._ .

0F 1.00 .,

to ._ .___ _ __ .. ..._.___ .

c;g; o D: . _ ,_ _...- ..-_ . .

EP >

o 0.00 - @

W '

0 0.4 0.8 1.2 1.6 2 2.4 (Thousands)

RCS CRITICAI, BORON CONCENTRATION (PPM)

ALL-RODS-IN MINUS MOST REACTIVE R00 STUCK IN WITHDRAWN POSITION

ATTACHMENT l

' ST HL-AE l%5

. PAGE 6/ OF /A3 e

v .

I I ! I l l I N

.e I

~ . ! l ! !

I t l l l 1 l l ! I I m . . -

. s.

g . !

, f ..b,-- I w . '\ l

!, ! i !. ! t i f o - -

o i l i i I i ! '

! ! I I I E

~

v i ~!~T -

\

i ; f' } j i

' i i

j - ~ ' " " ' " ~' '-

~

2 oz .' i 1 ! !

! I

~o i

!\ . : l i H- i l

<H N l j g 4 \ g . I

$~

Oc

~

7N 'Ni;, l l.'l -'l 1 i i i ll u, r r r 1 , n .-

z _4 i

4

i ; i . .

gg i

ts . . i , ,. i i i v<gg ' I !

I : '

- + - - + - -m .-- , '. -

Zo I l t \ ' l i ! l l l l I I ^

@5 i i ! l \ : i . I e i i ' ; I =

c- '

.. A c*

vA H cO 3 ! '\i i.

?

- E.

k JZ t

! l i k l 9 8 I e $~

-x

' i i

- !,\ l Z c o c Hg 8 8 l 1 l ! ! l l w w -o cr e U

i . i i s. , ;

i P 5 g U ~! ' l I

\ ! l 0

f e %

b) i

b 9 H

m c3 vo

- I

-e i

\.1

\

l l I f l l

'c Ag z p-D7 ^

l 1 t I t i 6 -

mw . E \ .

i i 3 m>

. e . i ;

m. mW u H$gC h bQ g

M-cr se.

e i

--.+--4'--.l--

l .\i } l . {

l O

Lg,j (T) p4[.d W0 I - _,d_ _. .I_ .. f I '

g M 7

O v) r wo-cr +

i -

l . - i i i i N -

p v2o r p qy - <

I !

, 3g i a i m

4Q @$$ 1

t t '

i l i ! I E u) %

O coa III,-

--.t i

. . i l t i j j

' l C@

A cr

>$, Em 2o o z u-f, Ch '

i N

h. , f .' ,,!-- - -

' O-y Lu s o-o i j . . . t ; ,

i i C r HE , w v D H i

! j ! l l ! @ <y

% =ZZ -

w b

D U"O, d __.i .- I I M CE O

emz -

i . : : -i ; ; o -

wow '

m U) cm o c' -

! l>_ i

! i M I f ! l ! I to o

-eg i

- 1 g z Sr O z' 7 " --t. l l ; I

! E mo wa- t I i : .

2<* ! ,

i i 6 l l j ; j i + =

l ' '

i I ; I ! d E I

m a

i } f l l I f I i

.- i :: 3 f t- l 1 t

j m

e m

i i I i i ! i i l l o o

y -._ j M f -

_.1.- -.j! ] _..

$ . -- ; ,! l _.

!. j l

j e

a u_1_

. . u. ,

i l i

i l l I

! i e .

1 C C C C C C C C. C. C. C. C. C. C.

(/7 is) NIDHYK N A O G.I.n H E GEHInbEE 5-5

SOUTH TEXAS PROJECT UNITS i & 2 MODE 5 a FIGURE 5.1-la REQUIRED SHUTDOWN MARGIN VERSUS MEASURED RCS BORON CONCENTRATION (MODE Sa)

(INDEPENDENT OF TEMPERATURE) 6.00

/

, / _.

5.00 - ' -

dl .- - _ .-- .. - _ . .. . .-.. . . . .. _ . . . _ _ . _ _- _.._ . .. . ,/ . ._ _

/

_p H _. _ . _ _. .__. ___. _ -. . ._ . _ _ .. . _ _ . .

. _ _ ._ _. ..._ s .. .. ._ . . . .

0 /

4.00 - ,/

-_ _ ._ -._..__. - .-- . .- - - .. . .. ._ ._ . - - _ .._ / _. . ..._ _ ._ .. . .- _._

r. - . . .. ..._. .- . . .. . _ ..r

/

, /-..- ...._ .._ _. _

[ 3.00 -- /

Q __._._ _ _ ._._-_ ..__. _ _ .. . _._ . _ . .._ ._ _.._

/ _... _ . . ..___ __... . .. _.___.- __ . . _._

/_ ___. . _. _._ .-. - __ -.- _. . _ _ _ _ .-

lg __ _._.___._ _ _._ ._ . .. ._ __ . ._.- . _ . _.. _ .y'.. . .._. . .__ _ ___._ __ _ _ _ ... - _ _ __

2.00 -

a ! . - ..._ _. _... .- - ._- _ --- _ - _ _ _._ _.-- -

N _.- - _ _ _. -. ...-_ -- -._ _. _. _ _.- ._-. .. _. .. - .- --

or 1.00 - $

M g

S' m>

D 0.00 u) -

0 0.4 0.8 1.2 1.6 2 2.4 (Thousands)

RCS BORON CONCENTRATION (PPM)

ALL-P,0DS-IN MINUS MOST REACTIVE R0D STUCK IN WITHDRAWN POSITION

ATTACHYENT /

l ST HL-AE. /ng

. PAGE 6J OF ta3

t \ j i i

I I b i I l l

! f 1 i i ! I i \1 i ! I i j _y

. \ ! . ! ! ! : ! i i N 3

l\ i l i ! I i i ! I i i i l\ i j j j i e i i i Ni i , e i l . i !

i i ' '

! +

i \' ! i i ! l i I \ ! i i

! i I ' i

, . l\ . i , l r i .

I i 1 j i ! I j l ! l l I .

! l t

- N

__ 1_ ! ! ! ; I t I A

I i '

N I !

I

' I

!\ i I I I l l I i Ni i i i i i z g + 6 ; I c

, i I j \i a l i j ^

i .

l i, K. . i i .i 1 . I E M g e o.

Q O t >

j\ i 6 ;

w e

i .

t- -

t

- C. A y

oe I t i i-

i i ! \ l e j i i -

v4 V zg Me ! l * . i i i \l I g o"

[

H we T.

i i

t t

I i i i

i '

i i

\ ! !

j i l

l i '

8 TO c M

g i ' i t a ' i j l\ l l Ni i ! l ;

't!

d CM 7 Mu ma-

.! l. '\\,l ! : I af mg z 3

bQ wow Ug

I l ' I I O >Im em i i : . i ym r

- l ,

- cQ C A-a vu z H + i i . : i i e ~\ i w

-ze . '

o trj eoe i

i Pz w ar t: I t I ! \ !

O Q-qg Lu <s mwc. =

l

. ' , e I 1

l u M o EgEw . ! . : i e i i I t Y ! C LI) % zH H ' i i i ; i i ! i . ! D ecr:

az' Ow ' '

I

I t I t

! l f

o g W

' CUO ; ; ,

sz ' .

' 8 .

t i l l I i O -

DC H '

j - g A H zuz ' '

i ' -

j ' e 9 i ; ; ,

. U Z

N zO

' I

! ! I

! I M y coz ww w i

i . , i i ! i ; i i a e 3 maa i *

' M

. mu

'---+-

, I i i i ! s

@ D C I I k I l g e O

CMz t e , i ; j l r WU* .

EE* I e l I i l 6 I i M i i I h ! ! 5 g

i ,

, i i

i t I i I

I i i i

_1 C e i

! I i ! ! l N l ' l 3 l

z l l I 1

1 M I f M j g C M I I . _

o w i i ! !

J i i i i i i i a _ ,i i I i l 1 I: i i a a 1 i -

w e

- i, ! !. ! !. I I <

k 0 h

g $

I i l i l C O C C C C C C. C. C. C. C. C. C.

(J v ;) , NIDHY3t NAOG.LnHS CIEHIn6EH 5-7

. .-- .. = .

ATTACHMENT /

. ST HL AE ned

p PAGE 6v0FlA3

~*

6.0 CONCLUSION

S Based on the results of the analysis of the time between the Gamma-Metrics flux multiplication alarm and total loss of shutdown margin, at least 15 minutes are available for operator response to all initiating events. This allow: sufficient time for the operator to respond to the events. It also shows that the 15 minute minimum requirement specified in the Standard Review Plan is met for all events.

l I

l c m . + e.,

3 6-1 l

I

, ATTACHMENT /

. ST HL AE 1765

- PAGE G50fIA3

7.0 REFERENCES

1. NUREG-0800, U.S. Nuclear Regulatory Commission Standard Review Pian, Section 15.4.6, July 1981.

2. South Texas Project Units 1 and 2 FSAR, Amendment 52 (November 1985).

3. Table 6.1, WCAP 11123, STP Cycle 1 Nuclear Design Report, May 1986.

4. Westinghouse internal memo, Nuclear Fuel Division, Maximum Boron Worth for South Texas Project plants, 12 August 1985.

5. Westinghouse internal memo, Fluid Systems, South Texas Project Boron Dilution Flowrates, 13 March 1985.

6. Westinghouse internal memo, Fluid Systems, Volumes for South Texas Project plants, 29 May 1985.

7. South Texas Project Plant Procedures 1-POP 2-CV-1, 1-POP 2-CV-3, 1-POP 2-CV-4.

8. Communication with Houston Lighting and Power Operations staff on limiting reactor makeup water flow, March 1986.

9. Communication with Bechtel Fluid Systems on maximum Liquid Waste System flows, March 1986.

10. Memo from Bechtel on Gamma Metrics Flux Multiplication Alarm, 11 December 1985.

l l

11. Precautions, Limitations, and Setpoints document for South Texas Project Units 1 and 2, Rev. 2, December 1985.

12. Westinghouse internal memo, Transient Analysis, South Texas Project Boron Dilution Data, 9 April 1986.

13. Westinghouse internal memo, Transient Analysis, STP Boron Dilution Tech Spec Transmittal, 1 August 1985.

enm .-em s. 7_1

ATTACHMENT /

ST-HL AE 145 PAGE GL OF 123 Data Sources

14. Millstone Unit 3 Probabilistic Safety Study, August 1983 (WNTD data base).

15. NUREG/CR-2770, Common Cause Fault Rates for Valves, February 1983.

16. IEEE Standard 500-1984, The Institute of Electrical and Electronic Engineers, Inc (IEEE) Guide to the Collection and Presentation of Electrical, Electronic, Sensing Component, and Mechanical Equipment Reliability Data for Nuclear Power Generation Stations, IEEE, Inc. 1984.

17. NUREG/CR-1278, Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, Final Report, June 1983.

cm u-eme' 7-2

ATTACHMENT -1 o

. ST HL AE 1, x -* -

,, PAGE t.1Ofi y e-

.\

i !

- .. l

. u 4

l t

a ,

j '- t c,

t 4

i Appendix A' 4'

s Screening Analysis of CVCS/BTRS i ~- Valves and Components for Potential

! ' Boron Dilution Initiators l r J

l f

4 a

? -

t 1-l l

i-1

.l i

s

(

t r-l.

i t

$~ +

3 e

i i

! 1 1 i a.

i l-1 i

f d

'l 4

4-

! C2:3= 1D-061446 4

f -[

4 p-, re . h v- - , , - - . . - ,w,...,,ge~~-v-+w

ATTACHMENT I

.- ST HL AE 1965 .

PAGEh9 OFIAS Page No. 1 08/06/86 SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 1 MOTOR OPERATED CHARGING AND VOLUME NO EFFECT GATE VALVE CONTROL-LETDOWN FLOW LCV-465 (LCV-468 ANALOGOUS) 2 MOTOR OPERATED CHARGING AND VOLUME NO EFFECT DIAPHRAGM VALVE CONTROL-LETDOWN FLOW MOV-0013 (MOV-0012 AND MOV-0014 ANALOGOUS) 3 RELIEF VALVE CHARGING AND VOLUME NO EFFECT PSV-3100 CONTROL-LETDOWN FLOW 4 MOTOR OPERATED RESIDUAL HEAT NO EFFECT GATE VALVE REMOVAL-LETDOWN FOR MOV-0066A PURIFICATION (MOV-0066B ANALOGOUS) 5 MOTOR CPERATED CHARGING AND VOLUME NO EFFECT GATE VALVE CONTROL-LETDOWN FLOW MOV-0023 (MOV-0024 ANALOGOUS) 6 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED GLOBE CONTROL - BORON VALVE TCV-381B THERMAL REGENERATION (BORATION) 7 REACTOR COOLANT RCS PURIFICATION FOR NO EFFECT PURIFICATION REFUELING PUMP 1A 8 MOTOR OPERATED RCS PURIFICATION FOR NO EFFECT GLOBE VALVE REFUELING HCV-133 9 RELIEF VALVE RCS PURIFICATION FOR NO EFFECT I PSV-3134 REFUELING 10 AIR DIAPHRAGM CHARGING AND VOLUME NO EFFECT OPERATED GLOBE CONTROL - LETDOWN VALVE PCV-135 FLOW

ATTACHMENT l

ST HL AE- I 765 l

PAGE69 OFI D 1 Paga No. 2

, 08/06/86

' SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 11 RELIEF VALVE CHARGING AND VOLUME NO EFFECT

'PSV-3201 CONTROL - LETDOWN FLOW 12 RADIATION RADIATION MONITOR COMPONENT HAS EFFECT ON MONITOR RT-8039 FLUSHING OPERATION BORON DILUTION 13 AIR DIAPHRAGM CHARGING AND VOLUME NO EFFECT OPERATED CONTROL - LETDOWN THREE-WAY VALVE FLOW TCV-143 14 IliLET MANUAL MIXED BED COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER RESIN BORON DILUTION CV0118B (CV0118A FLUSHING AND ANALOGOUS) SLUICINC 15 OUTLET MANUAL MIXED BED COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER RESIN BORON DILUTION CV0125B (CV0125A FLUSHING AND ANALOGOUS) SLUICING 16 INLET MANUAL MIXED BED COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER RESIN BORON DILUTION CV0124B (CV0124A FLUSHING AND ANALOGOUS) SLUICING 17 INLET MANUAL CATION BED COMPONENT HAS EFFECT ON i

BALL VALVE DEMINERALIZER RESIN BORON DILUTION CV0127A (CV0127B FLUSHING AND ANALOGOUS) SLUICING l

18 OUTLET MANUAL CATION BED COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER RESIN BORON DILUTION CV0134A (CVO134B FLUSHING AND ANALOGOUS) SLUICING 19 INLET MANUAL CATION BED COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER RESIN BORON DILUTION i

CV0133A (CV0133B FLUSHING AND i ANALOGOUS) SLUICING 20 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED BALL CONTROL - BORON

l VALVE FV-3127 THERMAL REGENERATION OR STORAGE l

l l

i

, - . - ~ , - ,. . - . . , . . , . . . . - . - - _ . , .. , . , - . - - . , ,. _ . , _ , , . . , , - _ . , - . _ , _ , - . . . . -

AT1 ACHMENT /

ST HL AE- / 765 l PAGE 90 OF lA3 Pags No. 3 08/06/86 SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION

-- --------- -------------- ------------------------ j l

21 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED GLOBE MEASUREMENT SYSTEM VALVE FV-3126 22 AIR DIAPHRAGM BORON CONCENTRATION COMPONENT HAS EFFECT ON OPERATED GLOBE MEASUREMENT SYSTEM BORON DILUTION d

VALVE TV-3124 23 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED GLOBE MEASUREMENT SYSTEM VALVE TV-3125 24 AIR DIAPHRAGM BORON THERMAL NO EFFECT OPERATED BALL REGENERATION SYSTEM VALVE FV-3381 INLET 25 AIR DIAPHRAGM BTRS LETDOWN CHILLER NO EFFECT OPERATED BALL HEAT EXCHANGER VALVE FV-3378 ISOLATION (BORATION)

! 26 AIR DIAPHRAGM BTRS LETDOWN CHILLER NO EFFECT OFERATED BALL HEAT EXCHANGER VALVE FV-3375 BYPASS (BORATION) 27 AIR DIAPHRAGM BTRS LETDOWN CHILLER COMPONENT HAS EFFECT ON OPERATED BALL HEAT EXCHANGER BORON DILUTION VALVE FV-3376 RETURN (BORATION) 28 AIR DIAPHRAGM BTRS LETDOWN CHILLER NO EFFECT OPERATED BALL HEAT EXCHANGER VALVE FV-3383' ISOLATION (BORATION) 29 INLET MANUAL BTRS DEMINERALIZER COMPONENT HAS EFFECT ON BALL VALVE FLUSHING FROM BORON DILUTION CV0261 REACTOR MAKEUP 30 RELIEF VALVE BORON THERMAL NO EFFECT PSV-3376 REGENERATION INLET 31 AIR DIAPHRAGM TUBE SIDE FLOW FOR NO EFFECT

OPERATED GLOBE LETDOWN REHEAT HEAT VALVE TCV-381A EXCHANGER 32 AIR DIAPHRAGM FLOW BYPASS OF BTRS COMPONENT HAS EFFECT ON

OPERATED DEMINERALIZERS BORON DILUTION THREE-WAY VALVE HCV-387

.- , . _ _ _ _ . . ~ . - . . _ _ . . _ - . _ . - _ . _ _ _ . , . _ _ _ _ . . _ _ . _ . _ _ _ _ . . _ . , _ _ _ _ . . _ . _ , , - _ _

ATTACHMENT I ST HL-AE-I?65 PAGE '1/ OF lA3 '

l Page No. 4 i

08/06/86 !

SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS l FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 33 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED BALL CONTROL - BORON VALVE FV-3377 REGENERATON AND STORAGE 34 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED BALL CONTROL - BORON VALVE FV-3382 REGENERATION AND STORAGE 35 MANUAL DISCHARGE BTRS DEMINERALIZER COMPONENT HAS EFFECT ON BALL VALVE SLUICING OPERATION BORON DILUTION CV0272A-(CV0272B, CV0272C, CV0272D, CV0272E ANALOGOUS) 36 MANUAL INLET BTRS DEMINERALIZER COMPONENT HAS EFFECT ON BALL VALVE SLUICING OPERATION BORON DILUTION CV0302 WITH ANY OF CV0298A, CV0298B, CV0298C, CV0298D, CV0298E 37 MANUAL INLET BTRS DEMINERALIZER COMPONENT HAS EFFECT ON BALL VALVE SLUICING OPERATION BORON DILUTION CV0266A (CV0266B, CV0266C, CV0266D, CV0266E ANALOGOUS) 38 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED BALL CONTROL - BORON VALVE FV-3379 REGENERATION AND STORAGE ,

1 39 AIR DIAPHRAGM BORON CONCENTRATION NO EFFECT OPERATED BALL CONTROL - BORON VALVE TV-3384 REGENERATION AND l STORAGE

)

1 40 MANUAL INLET BTRS DEMINERALIZER COMPONENT HAS EFFECT ON l BALL VALVE BORON FLUSHING BORON DILUTION CV0301 OPERATION

ATTACHMENT /

ST HL AE / %5 PAGE %iLOF 123 Page No. 5 08/06/86

, SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT- OPERATING MODE EFFECT ON BORON DILUTION 41 MANUAL BALL BTRS DEMINERALIZER COMPONENT HAS EFFECT ON VALVE CV0275 BORON FLUSHING BORON DILUTION OPERATION 42 AIR DIAPHRAGM BORON THERMAL' COMPONENT HAS EFFECT ON OPERATED BALL REGENERATION SYSTEM BORON DILUTION VALVE FV-3380 OUTLET 43 MANUAL DIAPHRAGM BORON CONCENTRATION COMPONENT HAS EFFECT ON VALVE DWO694 MEASUREMENT SYSTEM BORON DILUTION LINE FLUSHING 44 AIR DIAPHRAGM CVCS LETDOWN FLOW TO COMPONENT HAS EFFECT ON OPERATED BRS RHT ON VCT HIGH BORON DILUTION THREE-WAY VALVE LEVEL SIGNAL LCV-112A 45 AIR DIAPHRAGM CVCS MAKEUP ADDITION COMPONENT HAS EFFECT ON OPERATED GLOBE FOR ALTERNATE BORON DILUTION VALVE FCV-111A DILUTE, DILUTE, MANUAL, AND AUTOMATIC MODES 46 AIR CYLINDER CVCS MAKEUP ADDITION COMPONENT HAS EFFECT ON OPERATED BALL FOR DILUTE AND BORON DILUTION VALVE FCV-111B ALTERNATE DILUTE MODES 47 AIR CYLINDER CVCS MAKEUP ADDITION COMPONENT HAS EFFECT ON OPERATED BALL FOR ALTERNATE BORON DILUTION VALVE FCV-110B DILUTE, AUTOMATIC, AND BORATE MODES 48 AIR DIAPHRAGM PUMP SEAL STANDPIPE NO EFFECT OPERATED GLOBE FILL LINE VALVE LCV-178 (LCV-179, LCV-180, LCV-181 ANALOGOUS) >

49 AIR DIAPHRAGM REACTOR COOLANT PUMP NO EFFECT OPERATED GLOBE SEAL #1 RETURN FLOW VALVE FV-3154 CONTROL ;

(FV-3155, FV-3156, FV-3157 ANALOGOUS) i

ATTACHMENT /

ST.HL AE-)7 6,5

. PAGE 13 0F l A 3 Page No. 6

'. 08/06/86

, SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 50 MOTOR OPERATED REACTOR COOLANT NO EFFECT DIAPHRAGM VALVE EXCESS LETDOWN MOV-0083 51 MOTOR OPERATED REACTOR COOLANT NO EFFECT DIAPHRAGM VALVE EXCESS LETDOWN MOV-0082 52 MOTOR OPERATED RCS EXCESS LETDOWN NO EFFECT GLOBE VALVE HEAT EXCHANGER HCV-227 OUTLET ISOLATION 53 AIR DIAPHRAGM RCS EXCESS LETDOWN NO EFFECT OPERATED THREE FLOW DIVERT TO WAY VALVE LIQUID WASTE FV-3123 PROCESSING 54 RELIEF VALVE SEAL RETURN RELIEF NO EFFECT PSV-3200 TO PRESSURIZER RELIEF TANK 55 MOTOR OPERATED CONTAINMENT NO EFFECT DIAPHRAGM VALVE ISOLATION OF SEAL MOV-0077 RETURN AND EXCESS LETDOWN FLOW 56 MOTOR OPERATED CONTAINMENT NO EFFECT DIAPHRAGM VALVE ISOLATION OF SEAL MOV-0079 RETURN AND EXCESS LETDOWN FLOW 57 RELIEF VALVE SEAL WATER RETURN NO EFFECT PSV-3169 RELIEF TO VCT 58 MANUAL INLET RETURN FROM BRS NO EFFECT BALL VALVE EVAPORATOR FEED PUMP CV0572 59 AIR CYLINDER VCT WASTE GAS VENT NO EFFECT

, OPERATED BALL LINE l VALVE PCV-115

! 60 RELIEF VALVE VCT RELIEF VALVE NO EFFECT l

PSV-3101 l

l t

ATTACHMENT l ST HL AE 1%5 PAGE '140F Ib3 l

. Page No. 7 08/06/86 SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS 1 FOR POTENTIAL BORON DILUTION INITIATORS l

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 61 AIR DIAPHRAGM H2 SUPPLY LINE TO NO EFFECT OPERATED GLOBE VCT FOR FISSION GAS VALVE PV"3110 STRIPPING 62 AIR DIAPHRAGM N2 SUPPLY LINE TO NO EFFECT OPERATED GLOBE VCT FOR SHUTDOWN VALVE PV-3111 MODE COVER GAS

6. MOTOR OPERATED VOLUME CONTROL TANK COMPONENT HAS EFFECT ON GATE VALVE OUTLET TO CHARGING BORON DILUTION MOV-0113A SUCTION (MOV-0112B ANALOGOUS) 64 MANUAL OUTLET RMW FLOW TO BTRS FOR COMPONENT HAS EFFECT ON BALL VALVE DEMINERALIZER BORON DILUTION CV0206 FLUSHING AND OTHER MANUAL FILL OPERATIONS 65 MANUAL INLET CHEMICAL MIXING TANK COMPONENT HAS EFFECT ON BALL VALVE FILL FROM RMWS BORON DILUTION CV0201A 66 MANUAL OUTLET CHEMICAL MIXING TANK COMPONENT HAS EFFECT ON BALL VALVE OUTLET FLOW TO BORON DILUTION CV0214 CHARGING 67 MANUAL OUTLET RMWS FLUSHING OF COMPONENT HAS EFFECT ON BALL VALVE EMERGENCY BORATION BORON DILUTION CV0215 LINE TO CHARGING 68 MANUAL OUTLET ALTERNATE EMERGENCY COMPONENT HAS EFFECT ON DALL VALVE BORATION LINE BORON DILUTION CV0221 69 AIR DIAPHRAGM BORIC ACID FLOW FOR COMPONENT HAS EFFECT ON OPERATED GLOBE BORATION AND DORON DILUTION VALVE FCV-110A EMERGENCY BORATION 70 BORIC ACID BORIC ACID FLOW FOR COMPONENT HAS EFFECT ON TRANSFER PUMP 1A REACTOR MAKEUP BORON DILUTION (PUMP 1B ANALOGOUS) e 71 MOTOR OPERATED EMERGENCY BORATION NO EFFECT GATE VALVE TO CHARGING MOV-0218

Ali ALHMENI i ST HL AE I')bS

. PAGE18 0F I A3 PIga No. 8 08/06/86 SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS

, FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 72 MOTOR OPERATED RWST FLOW FOR NO EFFECT

'\TE VALVE BORATION OR VCT HOV-0112C LOW-LOW LEVEL (MOV-0113B SWITCHOVER ANALOGOUS) 73 AIR DIAPHRAGM CENTRIFUGAL AND PD NO EFFECT OPERATED GLOBE CHARGING PUMP VALVE FCV-202 MINIFLOW LINE TO (FCV-201, SEAL WATER HX HCV-285 ANALOGOUS) 74 CENTRIFUGAL CHARGING AND VOLUME COMPONENT HAS EFFECT.ON CHARGING PUMP 1A CONTROL - CHAk",ING BORON DILUTION (PUMP 1B FLOW ANALOGOUS) 75 POSITIVE SEAL WATER INJECTION NO EFFECT DISPLACEMENT FLOW AND RCS PUMP 1A HYDROSTATIC TEST 76 MOTOR OPERATED CENTRIFUGAL CHARGING NO EFFECT GATE VALVE PUMP ISOLATION MOV-8377A (MOV-8377B ANALOGOUS) 77 RELIEF VALVE POSITIVE NO EFFECT PSV-3250 DISPLACEMENT CHARGING PUMP RELIEF 78 MOTOR OPERATED CENTRIFUGAL CHARGING NO EFFECT GLOBE VALVE PUMP 1A SEAL WATER MOV-8348 INJECTION 79 SOLENOID CENTRIFUGAL CHARGING NO EFFECT OPERATED GLOBE PUMP 1B ISOLATION VALVE HCV-206 VALVE BYPASS 80 AIR DIAPHRAGM SEAL WATER INJECTION NO EFFECT OPERATED GLOBE FLOW CONTROL VALVE HCV-218 81 MOTOR OPERATED SEAL WATER INJECTION NO sFFECT DIAPHRAGM VALVE SHUTOFF MOV-0033A (MOV-0033B, MOV-0033C, MOV-0033D ANALOGOUS)

ATTACHMENT /

ST-HL AE- / 45

. PAGE '7(c OF J g3 Page No. 9 08/06/86 SCREENING ANALYSIS OF CVCS/BTRS VALVES AND COMPONENTS FOR POTENTIAL BORON DILUTION INITIATORS

COMPONENT OPERATING MODE EFFECT ON BORON DILUTION 82 AIR DIAPHRAGM CHARGING AND VOLUME COMPONENT itAS EFFECT ON OPERATED GLOBE CONTROL - CHARGING BORON DILUTION VALVE FCV-205 FLOW CONTROL 83 MOTOR OPERATED CVCS CHARGING FLOW NO EFFECT GATE VALVE CONTAINMENT MOV-0025 ISOLATION 84 MOTOR OPERATED CVCS CHARGING NORMAL NO EFFECT GATE VALVE OUTLET LINE MOV-0003 85 AIR DIAPHRAGM CVCS CHARGING TO NO EFFECT OPERATED GLOBE PRESSURIZER VALVE LV-3119 AUXILIARY SPRAY 86 MOTOR OPERATED CVCS CHARGING TO NO EFFECT GATE VALVE ALTERNATE RCS MOV-0006 CHARGING e

ATTACHMENT /

- ST HL AE- 1765 PAGE ??OF lA3 LIST OF ACR0hTMS AND ABBREVIATIONS USED IN APPENDIX A AND B BA - BORIC ACID BCMS -

BORON CONCEhTRATION EASUREEhT SYSTEM BRS - BORON RECYCLE SYSTEM BTR -

BORON TERMAL REGENERATION BTRS - BORON TERMAL REGENERATION SYSTEM CB - CONIROL BOARD CVCS - CEMICAL AND VOLUE C0hTROL SYSTEM DEMIN - DEMINERALIZER HX - EAT EXCHANGER LWPS -

LIQUID WASTE PROCESSING SYSTEM PRZ - PRESSURIZER RC - REACTOR COOLANT RCS - REACTOR C00LANI SYSTEM RES -

RESIDUAL EAT REMOVAL SYSTEM RMa'S - REACIOR MAKEUP WATER SYSTEM L'ST -

REFUELING WATER STORAGE TANK VCT - VOLUE CONTROL TAKK i

l i

.- _ - . - . _ . . _ - - _ , . ~ - - _

f-' . . ATT/sCHMENT ~ /

= '-

ST-HL AE- 1765 - )

i' . .

PAGE 78'0F la3 1

i l

!- s 1

f i

f, s

4 Appendix B-b Failure Modes and Effects Analysis

! of Components Which Have an I Effect on Boron Dilution 4

l J.

4 l

f l

1, i

1 i

i 4

1 1

i 5

i f

i 1

1 4

i 1

I 1

i i

0203s 1t-081446 1

n.,s. . . . . , - -,,,,m.,,,,n--,,,n-,.n..,-n,m. .m.n,.--,,,,w.-,-e,,...-,-,-

ATTACHMENT I ST-Hi..AE 17 65 l

, PAGE 19 OF 19.3

. , n n n n sg

- =

.m

A

=-s s E 8

AI

= gw:I E E E L' E Eu gi a -

s swr a sa g:i 53u E Es E Ear E E gm

.= -E- $

si gE gsw. -

E! -

mEP me =Bg5 me .!

E! Es EEE Eu EEEE Em EE I I I I I. I l

E E E E E

= a m. s a um e' s a a u a as e - - - - - -c g e = e e e --

- e

- e e

e . e m

EE m.

I I. I, I. .E. I. E7.

gi IE W u m .m sw

a

=

I

. Ew-E

=

In e-E Eaw g:ii m-mm EI ,E

=e.s agga I,-,

a

m. -

.ws amm * =

E m

=

I*ete!

m e -

Es u,m e

e [,gge

-m ww m m- e. w .e -

s.*Es, el-a 85.u.m. ,

e me a uwm

-sm. mes E=E. zum z m --e 8=E*e=s e Ia as,gg mz -

gi g5-Ege=

5-E gS- ww l5-eg .EgI y mE g c

.. m-e.I g=ags, e em

.m=-

umg

. gsgws wg8 2wm E g ags-m Ezu

.=

= w Emmac s -- ..s--- sm*w =E w=-, gm .s

= *= m m8 -

g e gassw -

Es sw- e m

a

.: . age.

wm -

Esse Ws.

[m*.

Iwg E--

. a us=

m.== g g ,w* s.s eIg E.5EE S a Eg us M Mwf-Eg EW

, -w EEIe,8 m--

wgE zg -

E,msE m .:g w.summ EEEEmg wee Ee E EmEn EteEEN Ee E

a w

.G-mc E wS" w E . . *=

I es =g mg E sj=s gjg gjg E -- .wm .wm 85 WEW WEB E REh Ewe Ewe

!=: =I GI

=e E-mE SI se Es et EI me a

1 E .

m E a

5 8 EaE 8 B Eg

E Es =wgE WE_

Erg EE-di pe mu = = c L _ .. _ _ _ . _ _ _ . _ __ _ _ . _ _ - _ _ - _ . _ . - - _ _ - - . - - - - - - - - - -- ---- -

ATTACHME$f' / l ST HL AE 8%5 l PAGE PbOF /g3

. a I s a

. m = - =

E

=

g EE c5 wel W

==

-=

N__3"

.g W "

g $

g g g g

..

m= gw= _ a s

a

_ . . - g w _

ewe une n=E m

er8 aw 8 aEs E g s= e.= g '

a mE .. " . -

a a,s

,m=. -..

e [WE w =r -

wm .zd e .g g _ g=TA" em w" m )

a E I E I E g - - - - -

Ewgv e -

e - -

e .E E E E E E g Egg 3 3 3 m a El gass wa e

e e c

=

el e _m.-

u

=WW3 e e e e e i a-w=.

b b b b- b EI . Ewk"s w- .I. .

I.

. I.

. E.

m

. = .s E- m..gw meg e a

c

= m =emm- sem s..!w

=a k=ne. as. sawwe == saww

3 w- - -s -

sum -

e g ce==

ss 8 E5e Em.mm "

-Ea mm Em.sm" e e s

umfr. -u- Ew!*== 's" EmE*==

g aEsw ws- mE E =8=- me s2"E=s E

.- se .. z g E em m-a ss-- mes gEgw-E a -

Ww=rg E gE=-

=gw -

=

=w- suan e.w.

Wa.=

.w-s e--ug E.s. m Wa.

s e=-ag

-s.c.

i e [ .,. . w g e E:s

. = _. w

.seu =gs s--e

-gs.

d d*

-Ed* s.

. - es e= we=ws eE_E=E W m

- w a se a Eg= e g=-me ,8 .a sgos = GEE.a .m=

s .g Eag Emgm Em=a

. E=

emew- eaa a w--matg .z. w w--s Es E 5a. m.m=== =m- EwEe.- sw es=i

=ww Emieu-w w l

W W W EG "C "G y EE M EE M EE M E O E O a -

= R. .=R ww 8

. .=E

= *w E ww -8

=

mE= EEs z=s 8*=

& =

. w- -E mw- =m=E m

g1 Oa .

l s 2

S.Qg zw . Sg S.

z- -

S-g a-5.

ze w wa-u .a d w& ww mB a a "

g~n l

~

g= ~ gs -

5 E5s ewEj E5= 85=

ja E

R:

m .

ww

_ _ e_.t ewl.

wwE

___g ewe gwe_l l.

50 -

s e a n

ATTACHMENT /

ST HL AE.1765

. PAGE 81 OF 133 sa = a es zw v a= 5

==m = g ,a

_ mz .

ser -

_ wm .s8 e

5sj

-e.

! WE en.

!e. *E s-E#E gIm.

as i="E e,

E*

,m

-m lE,_

-Egz

_m e

e -E were

=

. EE E $5r glg

.w

= l853 gm w ws:-

m -.

w-. Eee s=m E=_ a

- _n.- 5 _=

E E I E E E E E I E I E a n s n v. n e w w w = s a E

e E

e E"

E E

m i m y l

. .E . .a ,- - . . .

. es sm, a E -

gn=

_.swmg si saa

==

m e,e. en

=w Egs,I -

8.

wms8 E

8 as a

(: sus

-s-m

. E _u = E" wm I mE: ~s m ". a s -

z 2c am

_n ,- -

EE=*md ,

--s mgsa- .. l=.m e

e meE

.-E . == ==

=== g =a gg

_wE e

mEs wm E=a8wm gaeMe

s*

B*z wa g weta g -

sg e E Erms e*E =n E - -agI.

mas Ew *e-

. m I e=..s mmE8 E ge n=a -

E Ee= sm**= === Nae gg -*

E E ._gE 3: c ,=w eawss ms. -ss,a_ . s e

e [s.- u .sE.*

em e =E== .8 m

Em - =,ssEm

- .g_ ,=s e a.

g E geg s e E e =s w e.

I*m w E,[ew egE s-a . 8 ef- -

=g .- wm _ e- g=w sE=os en s- m- e- m En e a=a =I wn-

. E.=a .

saE w Es a *www e

-m sw e ess Estemen ==w e=.Eme E*EEEm o -

h es=I-EcewES 2*w Eds a

nG s.

"s

d

==s EWE

_ 5I

e. - Eg E .== zE

-= wg E

a

Em sws 5*v Es E

en .c e =ss ss was bi 5*e we EWM g . "s . .

. $*s 5.*Eg Sg S.

s-m - Sg a

S.

a-m

.a : ae a ma _m. a me -e f

E-un i

En en E==

Ee.n tw .

_A "Ew W- _*-

"EW

.A a' a __85 Ww _. Egw

. . E. g W .

mE "I E A A

ATTACHMENT I

ST.HL AE 1%s

. PAGE 8 d;LOF /A3

. = u

= e -

4. 5-.t = W-

.s s .t .- . e.

s zg.

sawe

gI .nz .a a a Ed* We gi d?"g new EeE* 8W*

e Wg.

wl gg es en gl=a

a se- .es

_m5= -

E =- -

=-5

!e EEIE

-e-3 f .m E

=- w-mE l E ,' i8 w-.E!. mE,

s._nef

_ _m -m E _.

E E E -

E E E

- - - -wge - l ie i a

i a

iE!n mEEE i=

w = =

m el - - - a :8 8 W -

E G E

.s EE E=I m

e e .en.w- E" E W

m. .

W WawaE

.w-m_a I.

EE WEm - E -

m . e= -. .S kE E

=: m wgs. E mEE m B a .m c:

s w

I_ add cm..

ss E*E=--SI ew gww*g-w 5 d We W E E5*

e s

w gsas e-ew a.gzeR s a.E-um,== *fmEE w _e*s

=

-E" m.=

wa e

e 5

a m Im=kEe u g3 * - e. w sm, rE --su gs,_ EEa8-gg*w s u, ,s g sew 2.s-Eg et.g Wgm.am -

g Wos..wes g gm s- m aE_

=

m .

a gwen s- t--

e gE a

,s e E_es a gslv s .

~~

~

e - --

= - _- a s_ w w e _ _ - -

gg_a

._=g-we e z [ wen.s .m e- =wys , E t

gl e =

s

.gs

= e gwEs-Ig=e sw em

.gs- c-s

a g

e=!

sw - de8.mmaes =g

. E.w=w

=m -

= e .2 m Im siam.s

_-.aI ". "E~

gag

=Ee e-Ee=IE.

g Es-weg wEgwh Eg EEm8s wE5EEc= = [ _.,

E s EEwEE WacWEE!we 5E55n WEEEEEE E=E mE

=-

.in a=s

WEE e W E. B, ---

a

.E E

.E Rif=a mew E =am mE

=E 2 8 W

. e-

e. e. g eE m e.e E EE EE Ee EEEwE EEm e a a e

=

a t.

m a _w E ew -=w is m WW EEW

s. e es -

n n

TiACHMENTl ST-HL AE 1%5 PAGE %3 0FIAb

-n . - . _ .

On 5 = 5 C 5

?=s = Es wg RE =

s.a g- s s- g-sE se

?rd .s Eg" 78 E ME E

==

W EE-

=M

E@e En En E

s s-s s- E* s- s s

= E. e ._gss , ge

_c.

es

g -

ge

_e- g e -=e

=

w_ . _.

5-k mv.

E-=

mv.

Ees

.sw ew._=

-= E !

m

.e a. e

=

s E I n n n n n n r r w a e a E E a a s s a a e = = s a w w E' e e e e n =

b d E E E e E n b b b b b b w w y.. w w g w e s. .

s. s. .. s a 5 - - 5

- se w- w

.g_s- g a -

I: w.E I

= g- we . . . m --

e _w- a-5

=am_= a -

m Ew = m I 558 ":585 8-*5 ES 558"5 =

ss e s- = .s= =

Rs-e=

eg.

e e

eE== s

- Eses .=-

E

_Em.

_e. m E- m -

g e g.E=.

.m = ys-En mz=ms Ese Eswen- a- s==

m s ,. -

a swe=- -

w=m . e, -

g -

g-gegw m E g. , e_.

s= -

aswe

=

ags g g=gw -

a E. Egsc d!

E"

=

e sWg!!

_e- e!,EE5 eE d as-

-E s g g!!

w _s-8 e

g b" d a. u= 5_ EEEES m d _m E_ . g" .da"5 .a_ :

e -

Eiss 8 [g8Ess E w5mtg8"[E. EEEs* [

_g.a _gS:

5 O wasgs g.gSEe.

mes_d s w==g-

=x- .gs _-mm g_W=" a " s_ R R__a g

a=m *seg

.e m E we=ms-

. u- w use w

-- u E EE a se ms_ w

. e. w= e w a

m W

EE SE EM

=5

w da d*

da E Br 5 E*W "g E

_a sw =

E8c

=

c *w E :e EE Es5 =E E Ed udb EM g o ma .

- E

=

5. Sg Ea S.gg, Sg S. 5 2

EE m mo mead E -

E md E5 m

E m

. I gEdW l Eg l

. .g o~g g=E,

-~ - -5"8,

~

5 !SS-w .5 -

v=eg Eages

-E e -E~ E g. eo cg

mRo mo~m W a E ~g .RE w~28 ja .

W E_gi W

. E. E .E E m WE_$.~E

.F.U ! R 4 4

ATTACHMENT I

, ST HL-AE l%S PAGE M OFlA3

- 58 5 a E a Es 6 s "E.E

.a wm -- -

EmE" wm E .a-E ge ag a ges g; g le8 Ew 5 le"_

EEES 6$* ! mma, wI !e- Eg5 -

EE -

E E - GEE *:

I w ES"

-En E *E Es s c=

.5 m.

E5 b EEs -

.E Em_ s E E_, E w, E.i --- wt w. - E_

w E E I I E ie i= ia i a

ia e a e a a u E c e e e c

= e e e e e

. b b b . b b I . E. , I. E. E. E.

i8 em e

E E

e me

s.

.=s a an-m

.Eme e

mIE B g=e!n as m E s um!m smar I --

l

- mes em-

=*8 m*--

-a E*w-ga E= -

~

lg Il se E

g-e m.E!

E eE m.

. ENE~!

.s- -

=-

l,ww ElB"a.r d=

.e E_E ans E=-

=

- Il l

es -a s

w mam I I a

.8 ~

se =

== r Eg.

i = .. su age m g!

e= s E=e r-e,_E -a _

s,E I E8 gg E 8" s- eEEe a=

g E =_, ii~."g:8e E5El E:EE*indgGW EE E [En el

- [5 e.E, sg w=

gs*.

=d= m E.gga-e5 .a s- BI*E E "E

. ;i s (E E w E_~m_ E_E =a 3 gad - -

.-- ~E.mEE_

w .. EE.EE w - ~ E !v_

wg_EE

=.

E 5:E WEEEEEE EEEE WEwEmGe E is We e

~

e

~ ~ s.

e

! se! z5 ! mE!

=

Et =E a =

=

m E

a =B=s se

!2 I d

EI Ed Em 2m E=

SE

. EI Ed E

2 s w E g .

=s s 25 al Ng E .I 5Er if lwE lEs EEE .

g.e

.a -

s = = l

ATTACHMENT /

ST HL AE-(%5

. PAGE 85 OF lA%

a a a e we Es- .

a

=as: ** E5 u"w -aI E= E Es

=

Xmm- -g a

=

gav m-e. s ss -

= .=a-7 em m5

~

g ; E ~! E m"" uE

- g wvgg==e g g-=-

s E w

- s-

=a gg 5 E w m5 __

n n _e a ss=s,g W= ~h

[ a g=g E

_n e

B ee ==- mE -

E=m Eas== ss=w8 *1

=

m E

=

.gw=g w.am. we emE ma= wee s- E Egs E sE msa W e_

. g a. e. e. g

n-n n n n n

= = = 8 g

m a

e i

a E

a mI a = = a = = =s E e = = c e W

es WW b d W W d n 6 b b b ,b by W W W W W E~

E. .. ..

.m -

Ie,m g s . ma w a se= =.es =g= saw -

s a ums m sw-s esw EE g eer- v===e -

( m-s -gv.Es m.

Emm, m- e a= ==

mess s=m w -e m

=

Ng C ESG= eeS -[ g.= wg Ee*~ -WW e as e I== ,m ste w es g e n .m o ag. was ge=mE=gg mm w=

mme

-= - ew -

-s8 8ow 2.

-=- gR I a8=s= a

-ware mee-a me W e.M

-u

.ss en t.

~

.=== E.E =

weg-gse W.. -- m m e-m se I

=

e sE=.

_ s. Wes== .=sa om: m == a .=

se =w or g = = = w =: m-=ea

==- =EwenEs

.- c= g, 5

~

EE E E E~E 55 I'E Elws 2E e =!guE sE d2 m_mam m.-s ==

EmaE mawasgs W

a E=n=-

e5 a r d #us.-

5EEd end

zss seems =as re=w5k==sa

Wm Wm

> am s1 .=

e.lSa ma (.

.a e

. ,e

n. -s -E

=m

== ss

= e, g-*

g m-=

W

-=s EWEe

[w.

- s2 E e

=

- gs e-m

_a -

e ..w M.=s= Egm e ara gl e e e:

Es 2d as Sb a.

Ed s as Shw

am.

=hs Em ch

- a W a. -

w HEB !!

~ ~ g:$

m IE$ le "E

w EEw ag-f.u. egw

. . m..e .

Et c cu i = =

t i

A0lw 111A Villa 3J 3AWA J0 N3d6 3 M llWJ S38011 3013W311 El N3HR S 30011 3H1 HilR 531dA03 38R119J *SAMU 3H1 H11A 315U00 GRW '311 WD1 W 80ll-A3J 34WA

83 IV illi-ill NI S10ll1NO3 NEW W AE 839013 h Il011V31MI 'IM31 DA '83 53X301 M lllR 3A1WA SINI *6 SB01198]dG 311W01W GNU 'N0linll8 31VW311W '310110 31VW311W 80J N3d6 511VJ llWG E31W 3d6 M30NilA3 u!W 16 6Q

ibu if E31W31M I N0111604 341WA INW t 530AM NI SW 133JB 3 NS 'N011NDI MlWO 143313 835013 S1 341W4 IEllllGOW M33Wil S3A3

[3" NADE IN3A3 N011RllE E3 IV liaW1v 13A31 nel EW E3N!vut 51 H31515 IW 1003 g IZil-Ill NOI1V31M I 13A31 N013W311 3111 N]Ist S 300W V 31V111NI I M 'l1111 38R11V3 *N01130S and MIBuM3 El 01NI 11133818 31 lllN IMI N115 134 '83 IW NeWW N011WIAM NI SilWINO3 Nil 10W A8 83S013 N0110llt 30 SHM A150 3H133NIS 'N011Rllt 03S013 2013 533WW 19101 '83 53M1 M lllR 3AlWA SIH1 *6 IW 831W31 9 1 N0111 Sed 34'lWA GRW t 530011 NI SW 133333 3WS INij DA El A 3SA 31111101110114111R 3MillIVJ SlIVJ un0E

83111W88 S1 M31515 I W 1003 13A 3H1 M31113 81 M31VR A3 Nil BODV3d 3013W311311 Mllel S 3006 031Wh00NG N0llt lllR Villa 3J 3AlWA 30 N3d8 S300W 310110 31tW311W Elli-AJJ 341VA 83 IV illi-ill NI S10415 3 NillGW A8 835013 3NRllVJ M1 N11A 831dRO3 3MilllVJ *N011VM3d0 533301 M 1118 341VA SlH1 *t #3Hli NODUM 30 S3001131n118 31W831W suu 31R11E 1103 K3d0 llvE E31Vu3d0 N011V315! 13A31 DA '83 N01118W M33Wil SlA3 SllWJ M30NilA3 NIV 99 AW G31W314N1 N011150d 3AlWA OW t 5300W NI SW 1333 H 3tlWS Env 310118 3N1 $NillA$ 143313 835013 S1 3AlWA 8314 liaWW N011tlA30 A0lj GW '531mn03 H31V8 A013 S 300W A33tNi 'lell-Mil S51540338 111 NnOS 83Nives S1 W31515 A013 M319R dil33W !83 IW 1W1003 50DW35 3H1 Il3HR NuWlv 13A31 RIl GW llil-Ill 100 53 2 1 38 0100HS 31111 IN343 NOI111110 N0800 NOI1V3(INI 13A31134 '83 Il31M m 33W tol'lW3d 3H1 *6 V 31V111m! 10m lilR 38011V3 *N011100W H31M 035013 IW E31V31 MI N011150d 3AlWA W W t 5300d NI SW 133333 361WS. 5 33Wil 80J SitNI 311 30 3SA S1181H0dd 3milVJ SilWJ ADW 40J 53A3 3H1 01 31Wbn013 0313311S38d v IV Uliva dHDWii 801]V38 30 Ima0W G313313538d W 30 N0lllGGW 3H1 1113A MJ OSlv 0100R 33111WJ

N01130S and 9NI98VH3 3H1 110 13A 3H1 93 IV WWW N011WIA30 S 300W NI SulH31ul ADW NG13W3M 83158081WI NI 11053d A013 GNU '531NQ03 H31 W A013 INIOS 03NIVd6 51 S3d 3H1 N3HR G1003 1935013 E3 M llillA3 30 '80llA3J 53006i 311W01DV

3 Nil *(til-MJi Su!6u0338 1A0 53I301 M 51ROHS 3 Nil '8111A33 A 53d6 3MilllWJ N11R 831A03 SW '1WRauli '310118 Vill-A33 3AlWA 00 NAM B011331M SD 33B S 300W SD 3333 6 1 I S30011 30411 Sell 1VM3d0 3Ml!VJ 1N3R0403 8 SISAlgus SD3333 av $3006 3tGilVJ 90110/90 g *ag h d

ATTACHMENT /

ST.HL AE i_765 PAGE f 7 OF /Sh 2 2 E- E s*g g ws: = g!- -

E see-= =

s w 3_ v e-= s g = s W . s-w s-s- e

- e-

-E 85 Ew s

- se*E

=E= W I

E s-mea

=EwsW a

=

s-

=E BI5g 8 -g_

-eE .

8, EW85 w:Eg$ )w E da E" g=2ms !

El E! W6Eet We wg*!g6-We! Est EEEW ew I

E5 w

-g g

I I

I E i

=

E* gE ms=*=.

gag E m

E a

la E a

5 e

g g

ww!! !- =w cW- n m

e a

e

. y e.nre ee eg. g e e . e e

e

=

e H Wl N 5ciWI. .W.

m N. N. I e:

e 5

g el-

_8 35!, e_. m t i

s"E

-gw i EEE la I #g*

g eIE=a ~

8 3

l *eEE .

w s s *E e 8 ..e=-

saw

sE !a= 8 w-g! IjE[E~Em

- wE*Es g,-

s- II*E- g l

g s- lw m5 afz E m = e ,-

E5 a

s--

e mse adlg*EE Wlmee_s E85EE5 5*"-*z .m m

sans gER e g- a E

g , , e z I -- ce 8=w 8 -=sI z e enE_===

es *~ w e

e m

e feg wkEs 3 -

BS 8 5 g mam-mm.E

- d ~.

..E* I I E" a :E*-SM

=

e g

s esE!=.l s- eIwEy.-g g*E-w =

s=m s- w!E .we!

. . - m a #

z 5EEE~e~ m mEdg. um g E

. E WE=Eee Ee w-s -E*E,a!nE8E===s- E

.EmIe w.a m., E s

wE EWInz,s I N EEEe,WE EEsE E WE eEs E Em 2 s a I g5 d e m

=

Ee .E, a Eg=s -g_

mag E: EsN Ezze El e

.= .

e g. . .

2l' en to es th to es 28 e

2 a

W 1

9 -

a . =E e

l

~

Eg5Ej sg t

gw l i! . smV*I EEE E EW l se cu -

= s

ATTACHMENT /

ST HL AE I?/oS

. PAGE8f OF176 s a =

. _Eg , gg ,, gg n z! = g== *s g s W=

s:s ge s.E -EE us, -8 =5 ee6 g

g =gg s . .w. s= g =y Wm sE-

=rs lg ge. -a ge .gE m

a z;. EEEE -aB EEEE I=

E=;e

!e EE

s. $555 rw.

, 5255 -

dE".res 52E!

e -

Eag E

m z =. w-.w =. =E zE =as w--m -5 a- wn_.

__ m E - E - ! I E

.; a.; - -

==gs-g EW-=E ==gsI EW-s w In E E

-se

==-e me=*.w a

g- awiEg zwiEg = = m E

cd- =

e.=Ie at em I. e -

c c e

n e

. bg.ng bg.ng b -b b sws I . Escuel Iselg E g g

.. I.

sE ** EE "' EE a E! E a

.l

- gse ==s w-Egt ga-a =w R em=- gs- ,g s5 g m- ew -,s

,_ s !.

u-- v a e

as a E e E-w _Ee= -

= -

aw5e5E En-s.--

=Ee- - -

-as*-

E=*=s e E- ,E=e=m =s gE asg

, gag, g gE e ,-e a 3a m_. gm a.

-igs-g

$g-!

g as E E ==-

=*=s. E _

w==gs!

-E-.- dg m m,e_ .

E=s er E , g. e s is E v g. es Egu se e,-!a,E,es g e e- e25*==

.s-e.

e_ e s=

e ==,I __,s

==, ,me- .

rg e 5 -

mers- -- - ==_ w MEEg*I, lEEl g

85 ess-@

es n lEE: w swweeme Elwe muff =

. mm .5@

. E E w =_ ,.a.=!

. _ _ _ mas.e s

- e. s -

E a: WEs!EM EEEE WEEE

,_E w=.=.=322E. s EEEE wg_-=_=t Wess E R. mgg I

=g =- =Es E= Es ~

=

= *s m.

we

_ _ _n Bo5 e,e

2. === .

s Es Ems EE,z re -

a es

.e es em -

.e es em 2 d Zh Ed ch Ed Ek

= e. -

m.

= = siw E! Ei a/ = [

w w

.Fs -: = = =

f ATTACHMENT /

ST.HL AE / 765

PAGE g4 OF lab R* ~

~

u

- M .

u ws Ew

E

E

- gw=d-a =~ s 8 8 gBJ.E-5 g~BER - -E gEJ.B-

-dS-d* -d2-d*

E--- 3 5a 5 E s e==- e. m W a ..vg Ig m.vEIg 8" :- =EE ..w E E-55*

e n **, -

m .gs

=EE 3 .s sE gEgesE E

= SEMM-E E' =-

W=I sE EWW32=

w EE WEE.32= rs e mEse v. g vs> ---c-w swwn mww- W- Ex-n- EsmW=w w=

- ISww-w I E E Em me.-g I

e a

E a

Er"8 ag "E e

a g a a s e

aggE; c mz a

e e e e d S.E E b d W W

. b W W W *w. W g w

= E. E. W

..wm. .E se M- .

n ..

E e zw 8 8 .-m w

. c_ e a -

8 ms 8E ssE. a me=

a er n =w- a- = m=-

= e-wer ee swa wE-s s =w NW = -- s g

g-wg-e .== -- s*m2 E Bem! a e

-sme-s a g u 8e ..a gg=- Emwww: ~E

. g# -w

e "u"5 .wwEE. gsE"S- E e m"8**

b

- E5= E_ . e~tE:wE ge e- . *g*=m E==E E-g w-g w me E - g*a g5E e a mm-s E-megeg z w ta w _s egw=ge _, s n Eg gs s r .e . s e, e --- was Mg -

.:g=ma g c .ss- en s.e e-= .meEen ys e =e=s m s w=sar-eswa g=amga ne= g .g 3 g e sesw mew e-g E l

m E

=t - ws ges -a z a- d or=m -

sg a[v y 2 . e- _.

=wess. --a g

. _s=w El ==E,ewas "-E= EE g w w

E===

e- = *M5=s=

=s- -

eed=s wE E_SEEus m.g3 ug_k Emes ,

SE=EE . ESWE-EE EwSE E u E

b w E E g Ew z _w, h

-E=-

f g w

- =E wE EW E [5 MgEE E w= EWEE E' .= me . .e e es es es em es 2 2d ab 2d ab 2d a

w

=- g2 av "

' en .E

= m EE- *-

w "Ew 2s u w

- s. E w-

5. 2 s

= -

i s 1

[

ATTACHMENT /

ST.HL AE- /?65

. PAGE 90 0FIE

. . s a w e

e

- e a = .

Is!

gsmE s g Eet.eg En= ,E.g=v.m gwss e .-

sEge2 aEs e s- Esammea ev-n a as s=Ee=e= see-t- mA. .ce.

e-- -

ma sm.aEma. eewe ag _s w

s

.s s - Ee

s I - I-m8r p=s8s gs I v -

a ws - -

n = n=s-z!EE

- - 8s =sm -

-s9s.n=sEg

=

w:

I=e,IEj=so= -2 M E e r. ! E e a gE VEE E c w r e.f s w-gEc mEm 9 g E =e E I E E -

. c M E E Im I e = a e = m a a g - -

y e e y- e e n w e w w m ,: W W

m. E~. I.

.g, w , ,e a a a my*w e 8 Mg=

e g e

y Ee,,=.--gws E

W,

=g. e.w=E zEU m=g-g*En -

- l suss Eg a =g, g s w Wmm w me . -= a _imgm g Egg m

-= e.

-E

--ga -,m -

me-so m.m s a egm. m_- m,s w=n -a

. w

, =._WW =s Etw wg=g-e kI*I, m -- a -

e n gE wg.w-e=E -- -

~ S B-e g e=w mWaz==

g I w f

. a-Iw.mm

- m z= --

- g gm a. n ~~*lEeEwE.

3 m=dwa,m a g

y sEme- -g eg-g85*5 l,

- . -= d-g = avememaww--m=E E 5-azw -- - E = W E8"g m g

e e

E*mue=w.

w_gn==

.n. .

E*E g.s=

m== aEm ,_ s gsW svgW igm..

a

- = == E =w = = E Eg.wgs - == - ~=s= w 2 -

s. -

=8.wE e n wm.E E_. w e

= =E=s= =.158=s m-m

s,=ss aurma..

eg w ame avgg=a

=

Ew asItsmew.e IE erws 1 m, R rwm e We_smes Ew s zu r, w s. 85 85 s -e

=a I.

I E58 .=

, Ems

= vs EY es =!,

s, ,

sw ans em. Im=.

-w e E-= e. eg E e s=e 2- a ud a

w a

-- wEsm mw =E-s

2. .

mk s

g- g mE E .

e d =g t=6 -

we - = =a w a=, -

aE E

m ,

mI*EI E-a emI_a=I I " m E w, a

es - = = a

ATTACHMENT /

ST-HL AE /765 PAGE 9/ OF /A3 Appendix C Probabilistic Calculations and Data Base C2C3. It-09148 6

ATTACHMENT 1

- ST-HL AE- 1%5

. PAGE 9-;LOF 123 Appendix C Probabilistic Calculations and Data Base This appendix presents the calculations and data base for the probabilistic analysis of Section 4.2. The failure rates and their sources are reported in Table C-1. The human error probabilities (HEPs) from NUREG/CR-1278 are reported in Table C-2. Human errors are combined foi each postulated action.

Errors of omission (omitting a step in the procedures) and selection errors (selecting wrong valve) are combined. Credit is given for independent verification of valve position. Each operator error is combined and the total HEP listed in Table C-3.

C.1 Initiating Event Frequencies The prcbability of each bcron dilution initiator is calculated and combined with the frequency of each cperation in each shutdown mode. This yields the frequency per reactor year of each boren dilution initiator.

The following initiatcrs are quantified:

CVCS demineralizer flush BTRS boron flush BTRS demineralizer resin flush BCP.S flush Reactor makeup system Chemical addition J

C.1.1 CVCS Demineralizer Flush 1

The following assumptions were made in the analysis.

a. The procedure includes more than ten steps and each step is checked :

and independently verified.

e m . m c ie

C-1

ATT ACHMENT /

ST HL AE 145

, PAGE 93 OF l.L3

b. Each demineralizer is flushed or.ce per year.

c. The procedure is normally performed in cold shutdown during a maintenance outage,

d. One hour is required for each flushing operation.

e. The control room supervisor is alerted that a flushing operation will be performed.

With these assumptions, mechanical failures of valves (4.9 E-7/hr) will not contribute.

A boron dilution event could occur either during the flushing operation or after the flushing operation.

A. During the flushing operation The failure of the operator to close inlet valve CV0118A (or CV0118B) or outlet valve CV0125A (or CV0125B) would deliver unborated water to the VCT.

The HEP to close, check and independently verify that a valve is closed is 6.0 E-4 (Item 1, Table C-3). The failure to close either the inlet or outlet valve is 1.2 E-3.

Failure during flushing operation: 1.2 E-3 B. After the flushing operation If valve CV0124A (or CV0124B) is not closed and the demineralizer is placed in operation, unborated water would be delivered to the VCT any time the LWPS spent resin sluice purrp is running. This valve must be locked closed and verified locked closed. The HEP is 4.0E-4 (Item 2, Table C-3).

Failure after flushing operation: 4.0E-4. .

The combined failure (during and af ter the flushing operation) yields Probability of boron dilution event: 1.6E-3 c m . w w ses c.g

ATTACHMENT /

ST HL AE-i265

+ PAGE 9# Or /23 Each demineralizer is flushed once per year (including the caticn demineralizers). A frequency of 0.1/R-Y is assigned to MODES 3 and 4. The frequencies for each mode are:

MODES 3 and 4 1.6E-4/R-Y MODE Sa 6.4E-3/R-Y Administrative controls prevent this flushing operation in MODE Sb. This flushing operation should only be performed in MODE 6 with additional precautions such as isolating the path through the filters and the path from the demineralizers by closing additional valves.

C.1.3 BTRS Boron Flush The following assumptions were made in the analysis.

a. The procedure includes more than ten steps and each step is checked.

b. One hour is required for each flushing, therefore, mechanical failure of manual valves does net contribute.

c. The control room supervisor monitors the necessary actions in the centrol room.

A bcron dilution event could be initiated either during or after the flushing i operation. Figure C.1-1 is the fault tree for this event.

A. During the flushin; event Unborated water will be delivered to the VCT if manual valve CV0275 is not closed and the control switch for HCV-387 is not in "DEMIN" position.

Failure to closa CV0275 is an operator error (Item 3, Table C-3).

em.-corne C-3

ATTACHMENT /

. ST HL AE- / 765 PAGE 95 OF m3 Failure to have HCV-387 in the proper position is either an operator error of omission (Item 4, Table C-3) or failure of the valve to change position.

B. After flushing operation A boron dilution event could occur after the flushing operation if valves CV0261 and CV0206 are not closed af ter the flushing operation and verified closed (Item 5, Table C-3). If the boron has been flushed, valve CV0275 is not closed (Item 3, Table C-3), and the operator has not received verification to stop the operation (Item 7, Table C-3), then unborated water will be delivered tc the VCT.

The probability of a boron dilution event is found by quantifying the fault tree (Figure C-1) and is 3.5 E-4.

t Probability of a bcron dilution event:

l One baron flush per year is postulated in either MODES 3 and 4 or MODE Sa with equal probability of 0.5 in either. The frequency of this event is:

i MODES 3 and 4: 1.8 E-4/R-Y MODE Sa: 1.8 E-4/R-Y No boron flushing operations will take place in either MODE Sb er MODE 6.

[ C.1.3 ETRS Demineralizer Resin Flush The following assumptions were made in the analysis.

l l

a. The procedure includes more than ten steps which are checked.

! b. One demineralizer is flushed per year.

l '

\

c. One hour is required for the flushing operation, therefore, the mechanical failure of manual valves during the flushing operation will not contribute.

em. wween c.4

ATTACHMENT /

. ST-HL AE /7(25 1

. PAGE240FID

]

Unborated water could be delivered to the VCT during and after the flushing operation. Figure C.1-2 is the fault tree for this event.

I A. During the resin flushing operation If either the inlet valve CV0265A or the outlet valve CV0272A is left open combined with the operator failing to close manual valve CV0275, then

unborated water is delivered to the VCT. The failure during the operation is the combination (CV0275 and CV0266) or (CV0275 and CV0272). Therefore, the 1

3 failure during the operation is 2 times item 5, Table C-3.

i B. After the resin flushing cperation If the operator fails to close manual valves CV0302 and CV0298 (Item 6, Table C-3), then unborated water could be delivered to the VCT whenever the makeup system is utilized.

The probability of a boren dilution event is: 8.0 E-4. One demineralizer is flushed each year in MODE Sa. A frecuency of 0.1 per year is assigned in l MODES 3 and 4. Therefore, the frequency of this event per reactor year is:

MODES 3 and 4: 8.0 E-5/R-Y NODE Sa: 8.0 E-4/R-Y Administrative contrcl wculd prevent this flushing operation in MODE Sb and

! MODE 6.

C.1.5 Beren Concentration Measurement System Flush The following assumptions were made for this analysis,

a. The procedure includes more than ten steps. !

) b. The BCMS is flushed whenever the RCS boron concentration is changed appreciably.

c m .i. e m ie

C-5

ATTACHMENT l ST.HL AE- 1%5 PAGEQ 1 OF lA3 l

If DWO594 is not closed after the flushing operation, unborated water is delivered to the VCT. Failure to close the valve is 1.3 E-2 (Item 8, Table C-3).

Total failure probability is 1.30 E-2 A frequency of two flushings per reactor year is assumed in MODE Sa.

a Ine frequency of a cilution event is:

MODE Sa: 2.6 E-2/R-Y 5

C.1.5 Reactor Makeup System The folicwing assumpticns were made in the analysis, i

a. The frequency of makeup in MODES 3 and 4 is one per every eight hours,

b. The frequency of makeup in MODE Sa is once per every 25 hours2.893519e-4 days 0.00694 hours 4.133598e-5 weeks 9.5125e-6 months .

c. If the level instrumentation fails to shut off makeup at the setpoint of 48%, the level will increase to 68%, and letdown will then be diverted to the BRS system via valve LCV-112A.

d. All components with hourly failure rates are censervatively assigned I hour to operate, although most operations will take much less time.

Figures 4.2-1 and 4.2-2 are the event trees that model the boron dilution initiators in M3DE Sa and MODES 3 and 4, respect %cly.

I j Failures por hour or per demand of components are reported in Table C-1. .

Human errors are reported in Table C-2. The probability of failing each top event is calculated as follows.

] c m .i..ers

C-6

ATTACHMENT /

ST.Hl. AE.1765 PAGE 98 0F /;t3 NBD Boric acid is not delivered to the makeup operation as the result of either the failure of valve FCV-110A or failure of the boric acid transfer pump.

Failure of FCV-110A is calculated as:

Valve fails to open: 4.6 E-3/D Valve fails to remain open: 1.4 E-6/hr(1 hr)

Failure of beric acid transfer pump to start or run is calculated as:

Failure to run: 6.9 E-5/hr(1 hr)

Failure to start: 1.3 E-3/D Failure of valve or pump: 6.0 E-3 NBD = 6.0 E-3 BDA Beric acid deviation alarm fails to activate, it is assumed that the detector is only tested on a yearly basis; therefore, mean time to failure (T/ 2) is 4380 hours0.0507 days 1.217 hours 0.00724 weeks 0.00167 months .

Failure of BDA is determined as:

Failure of detector: 4.7 E-6/hr x 4380 hrs = 2.1 E-2 Failure of sional conditioning system: 7.5 E-6 hr x 4380 hrs = 3.3 E-2 (only to detector)

Failure of alarm bistable: 8.2 E-7/hr x 4380 hrs = 3.6 E-3 Failure of alarm: 1.0 E-6/hr x 4380 hrs = 4.4 E-3 Failure of BDA = 6.2 E-2 exa.i..eeine' C-7

4

. ATTACHMENT /

. ST HL- AE J W,5

. PAGE99 0F/B OP1 Operator fails to stop makeup after boric acid deviation alarm Failure of OP1: 8.0 E-2 (Table C-3 Item 9) 1 MFC Modulating valve FCV-111A fails in wide open position Valve fails open: 4.6 E-3/D (Table C-1 Item 2a) i TDA Total flow deviation alarm fails. The same assumptions and failures are applied to TDA as te BDA.

! Failure of TDA: 6.2 E-2 i

OP2 i

Operator fails to stop makeup after total flow deviation alarm. If this is the only operater action, then OP2 is same as OP1 or Failure of OP2: 8.0 E-2 (only action)

If OP1 has also failed, then f ailure of second operator action, given that the first has failed, i:, 3.0 E-1 (Item 11, Table C-2).

! Failure of OP2: 3.0 E-1 (given OA1 failed).

If FCV-111A has failed, the operator must close the valve FCV-110B and stop l

l the pump (double failure) or the signal must fail during the time of the l makeup operation, which is of Ica probability (7.5 E-6/hr). Therefore, the l human error failures will dominate the failure of OP1 and OP2.

AMS .

i The makeup operation will be automatically terminated when the 48% level on l the VCT is reached. The VCT volume is 620 ft3 (4637 gals) and it would normally be expected that this level would be reached in less than 30 minutes (minimum time to total loss of shutdown margin at the required shutdown Mr94rn)=. C-8 I_,______.__._.~._,_-___,__._______

_ _ _ _ _ _ _ _ _ _ . . _ _ _ _ _ __ _ _ _ , , _ . - _ _ . . . . ~ _ .

. . .- . . . . - - _ . - - . - .. =__ - _ _ - . - . . ~ . .

I ATTACHMENT / l

. ST HL-AE. ins :

. PAGE Icc0F /p.3 )

Failure to terminate the dilution would only be a failure of the level indicator and signal system. But to account for the possibility of a leak rate close to the makeup rate such that makeup stops, tnen starts but is still diluting, a conservative value of 5.0 E-1 is assigned to this event.

1 Failure of AMS: 5.0 E-1 1

Quantification* of the event tree (Figure 4.2-1) yields the following values for MDDE Sa:

MINADIL: 5.59 E-3 1

MIXDIll: 3.13 E-4 MINXDIL: 4.26 E-3

]

AVGDILI: 4.09 E-4

. MINFDIL: 3.11 E-6

) MAXDILI: 6.77 E-7 l The initiators are:

i

MIXDILI: 3.13 E-4 AVGDILI: 4.09 E-4 MAXDILI 6.77 E-7 MIXDILI will deliver approximately 100 gpm unborated water, as boron is being mixed at the expected rate. AVGDILI will deliver 150 gpm. AVGDILI and i MIXDILI are combined as the probability of a dilution event with probability l of 7.22 E-4 MAXDILI would cnly occur if all components and/or operator i actions fail. This involves multiple failures of components and/or operator failures and is not a credible dilution event.

1 The same probabilities are input into the event tree for MDDES 3 and 4 (Figure l

4.2-2). Only one dilution event occurs, with probability of 4.31 E-4.

i i

!

Computer program ARBRE I

l un. i. ers '

C-9 1

t

ATTACHMENT /

ST HL-AE 1765 PAGE ec/ OF /2 3 The probability of a boron dilution event occurring is:

MODES 3 and 4: 7.22 E-4 MODE Sa: 4.31 E-4 The frequency of makeup is assessed as 60 times in MODES 3 and 4 and 48 times in MODE Sa, Based on the probabilities determined by the event tree analyses, the frequency of dilution events are:

MODES 3 and 4: 4.3 E-2/R-Y MODE Sa: 2.1 E-2/R-Y Reactor makeup is isolated in MODES Sb and 6.

c C.1.6 Chemical Additica l The following assumptions were made in the analysis.

a. The procedure includes more than ten steps.

I b. Less than one hour is required, therefore, mechanical failure of the l valves will not contribute.

A boron dilution event could be initiated either during or after a chemical addition, if both the inlet valve CV0201A and the outlet valve CV0214 (locked valve) are not closed. The procedures will state that CV0214 is checked and verified as locked closed. The operator error is 2.0 E-4 (Item 6, Table C-3).

3 Failure of chemical addition: 2.0 E-4 The frequency of chemical addition is estimated as once every 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months in l

j MODES 3 and 4 (10 times) and twice during MODE Sa. Therefore, the frequency 1

of a boron dilution event occurring is:

l 1 MODES 3 and 4: 2.0E-3/R-Y MODE Sa: 4.0E-4/R-Y em. i.-cei."

C-10

_. . __ _ _ _ _ _ - . _ _ _ _ _ _ _ ~ _ . _ _

ATTACHMENT /

ST-HL AE /76S PAGE /c.20F /J23 C.2 Mitigating Action Event Tree Top Events This section presents the calculations for the failure probabilities for the mitigating event tree described in Section 4.2.3. The initiating event frequencies are calculated in Section C.1.

M Flux Multiplication Alarm l

Technical specifications require that at least one neutron flux detector be j operable during shutdown MODES 3, 4, and 5, with a channel check performed I every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and an analog channel operational test monthly. It was assumed *

, that any detecter or signal conditioning fault would be detected within 12 i hours, either during the channel check or by comparison with the redundant I detector indicators. No additional credit was taken for the redundant channel. The alarm annunciator is tested daily. Failure of FMA with a mean time te failure of T/2 is:

Failed detector: 5.0E-6/hr x 6 hrs = 3.0 E-5 Failed signal conditioning system: 7.5 E-6/hr x 6 hrs = 4.5 E-5 Failed alarm bistable: 8.2 E-7/hr x 360 hr = 3.0 E-4

. Failed alarm: 1.0 E-6/hr x 12 hrs = 1.2 E-5 Total FMA unavailability = 3.9 E-4 E Operator Action on FMA 1

The following assumptions were made with respect to this top event.

a. For the flux multiplication alarm, it is assumed that the operators l are familiar with the immediate actions +o the alarm which will include isolation of flow from the VCT and actuation of emergency i

boration.

b. The operators have been forewarned to expect baron dilution from reactor makeup and flushing operations of the CVCS and BTRS demineralizers. A lower bound human error probability is therefore i

em. u-w .. C-11 a

, , . , - _ _ _ - _ _ . _ - ~ _ _ _ _ . . - _ . . . . - _ _ , _ _ _ , , _ _ _ . _ _ _ _ .

.____,_,..,________.,c,_-_.____., -__m__.---c _ _ _ _ _ _ _ - - . , ,,r

ATTACHMENT /

ST HL-PAGE /OJOF AE/ /%5)3 assumed for these initiators. For chemical addition and BCMS flushing, a longer time may be necessary to identify the initiator, so upper bound human errors are assumed,

c. If all parameters are constant, except the dilution flowrate, the tine from alarm to total loss of shutdown margin will vary linearly with the dilution flow rate.

Based on these assumptions, the following human errors of diagnosis were assigned. ,

Modes 3 and 4 i

Maximum dilution flow rate of 250 gpm gives a minimum of 15 minutes for operator action time which corresponds to a lower bound HEP of 3.0 E-3 (Item 5,TableC-2). For flushing operations with the LWPS, Uu dilution flow rates are less than 150 gpm. Therefore, using the linear relationship between available response time and flowrate, the response time for these initiators i is (250/150)x15 = 25 minutes, which corresponds to a lower bound HEP of 3.0

E-4 (Item 6, Table C-2). Similarly, the chemical addition flow rate of 122 gom yields a response time of (250/122)x15 = 30 minutes and an upper bound HEP of 1.5 E-2 (Item 7, Table C-2).

Mode Sa Paximum flowrate of 150 gpm gives a minimum of 15 minutes for operator action time which corresponds to a lower bound HEP of 3.0 E-3 (Item 5 Table C-2).

4 f or chemical addition, the flowrate of 122 gpm yields a respense time of (150/122)x15 = 18 minutes and an upper bound HEP of IE-1 (Item 8, Table

C-2). Similarly, the BCMS flushing flowrate of 7 gpm yields a response time of (150/7)x15 = 320 minutes and an upper bound HEP of 9E-4 (Ite.n 9, Table C-2). The HEPs for all initiators are as follows: .

I i

i c m. 4-* *" C-12 I

ATTACHMENT /

ST HL AE. I'45

. PAGE sch0F / A3

. HEPs initiator Modes 3 and 4 Mede 5a Reactor Makeup Boron FhJshing' 3.0 E-3 3.0 E-3 Flushing with LWPS 3.0 E-4 3.0 E-3 Chemical Addition 1.5 E-2 1.0 E-1 BCMS Flushing --

9.0 E-4 U.T, if the operator does not fail to respond, then he will close the VCT outlet line (close valves MOV-0113A and MOV-0112B) and initiate emergency boration.

Procedures state that emergency boration can be accomplished through motor-operated valve MOV-0218, through manual valve CV0221, or via the RWST through motor operated valves MOV-0112C or MOV-01138. However, since failures of components on the first twc paths of emergency boration were modeled as contributing to a beren dilution event, these paths have been conservatively neglected as mitigation paths.

The failure to isolate the VCT is:

Failure to close 2 MOVs = (2.6 E-3/D)2 Common cause failure of 2 MOVs (assume tested at least yearly) =

7.5 E-8/hr x 4320 hrs = 3.2 E-4 Combired failure = 3.3 E-4 The failure to borate the RCS results frcm:

Failure of charging pump to run = 6.9 E-5/hr x 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months (maximum :aission time) = 6.9 E-5 Failure of emergency beration via the RWST:

Failure to open 2 MOVs = (2.6 E-3/D)2 cm. i. m."

C-13

. ATTACHMENT l ST HL AE 1%s PAGE IO50F /A3 Common cause failure of 2 M3Vs (assume tested at least yearly) =

7.5 E-8/hr x 4320 hrs = 3.2E-4 Combined f ailure = 6.9 E-5 + (2.6~ E-3)2 + 3.2 E-4 = 4.0 E-4 The failure to restore shutdown margin is, therefore:

3.3 E-4 + 4.0 E-4 = 7.3 E-4.

Figure C.2-1 shows the fault tree for the failure to restore shutdown margin.

o m .i. m es' C-14

l . .

TABLE C-1 COMPONENT FAILURE RATE DATA Failure per Component Type Failure Mode Hour or Demand Data Source Comments

1. Manual Valve a. Transfers closed 2.2 E-6/hr WNTD

b. Transfers open 4.9 E-7/hr .WNTD

~3

2. Air-Operated Valve a. Failure to operato 4.6 x 10 /D WNTD Also used for 3-way on demand A0V

-0

b. Transfers open 4.3 x 10 /hr WNTD n c. Transfers closed 1.4 E-6/hr WNTD G

-3

3. Motor-Operated Pump a. Fails to start on 1.3 x 10 /D WNTD demand

-5

b. Fails during run 6.9 x 10 /hr operation

4. Level or Flow Detectors All modes 4.7 E-6/hr NUREG/CR-2771 Includes both inopera-ability and reduced $

capability faults b 7; E5Ib o;A

5. Neutron Flux All modes 5.0 E-6/hr NUREG/CR-2771 Includes both inopera- Z'8 2 Detector ability and reduced capability faults sm..mina

- - . . -- -- -. ~ . . - . . _

TABLE C-1 (cont)

COMPONENT FAILURE RATE DATA failure per Component Type failure Mode Hour or Demand Data Source Comments

6. Instrument Signal Condi- All modes 7.5 E-6/hr NUREG/CR-2771 Includes both inopera-tioning System ability and reduced i capability faults

7. Alarm Bistable All modes 8.2 E-7/hr IEEE-500 i

9 8. Alarm Annunciator fails to operate 1.0 E-6/hr IEEE-500 l

G

9. Air-Operated Valve Common cause failure 1.5 E-7/hr NUREG/CR-2770 t

of 2 A0Vs l

! 10. Motor-Operated Valve fails to change 2.6E-3/D WNTD position i

11. Motor-Operated Valve Common cause failure 7.5E-8/hr NUREG/CR-2770 @L3, of 2 MOVs sis

.o .

Obl

'^ ? 5:

?&

i l

1 l .

t, l

i

.m. . .

l I

1

. ATTACFedENT I ST HL AE 1765 PAGE so t OF /A3 TABLE C-2 HUMAN ERROR PROBABILITIES NUREG/CR-1278 Error Probability Table (Item)

(1) Omitting a step in a procedure

a. Short list < 10 3.0 E-3 15.3(3)

b. Long list 1.0 E-2 15.3(4)

c. Short list, checked 1.0 E-3 15.3(1)

d. Long list, checked 3.0 E-3 15.3(2)

(2) Selection error for manual valves

a. As part of a group 3.0 E-3 14-1(2)

b. Locked salves 1.0 E-3 Table 16-2 (1)

(3) Dependency (operator closes two 5.0 E-1 Table 20-21 (4) valves)

(4) Routine checking er verifying 1.0 E-1 Table 20-22 (1)

(5) Failure to diagnese cause of 3.0 E-3 rigure 12.4, lower flux multiplicatien alarm bound HEP, time =

15 minutes (6) Failure to diagncse cause of 3.0 E-4 Figure 12.4, lower flus multiplication alarm bound HEP, time =

25 minutes (7) Failure to diagnose cause of 1.5 E-2 Figure 12.4, upper flux multiplication alarm bound HEP, time =

30 minutes no. . * "'

C-17

ATTACHMENT I S T H L ,*$ E. I ') 6 5

, PAGE 109 OF /A3 TABLE C-2 (cont)

HUMAN ERROR PROBABILITIES NUREG/CR-1278 Error Probability Table (Item)

(8) Failure to diagnose cause cf 1.0 E-1 Figure 12.4 upper flux multiplication alarm bound HEP, time =

18 minutes (9) Failure to diagnose cause of 9.0 E-4 Figure 12.4, upper flux multiplication alarm bound HEP, time =

320 minutes (10) Failure to diagnose cause of 3.0 E-2 Figure 12-4, Median flow deviatien alarm joint HEP (11) Failure to diagnese cause of 3.0 E-1 Table 12-4 (9), and second deviation alarm Figure 12-4, Median joint HEP (12) Failure te ste; makeu:, 5.0 E-2 Table 12-3 (1) given an alare cro...e.is '

C-18

TABLE C-3 OPERATOR ERRORS Error of Error to Change Description Ononission Valve Position Dependence Verify Total Comment ;

1. Failure to close 3.0 E-3 3.0 E-3 -

0.1 6.0 E-4 Long list manual valve. c'ecked (checked) and verified i

l

2. Failure to close manua! 3.0 E-3 1.0 E-3 -

0.1 4.0 E-4 Long list !

)

valve (check and verify) (checked) t l and lock closed 1 l t n l

4 3. Failure to close 3.0 E-3 3.0 E-3 6.0 E-3 Long list e

manual valve (checked) (checked)

4. Failure of control room 3.0 E-3 3.0 E-3 Long list operator to change (checked) position of valve

5. Failure to close two 3.0 E-3 3.0 E-3 0.5 0.1 3.0 E-4 Long list ;

manual valves (checked (checked) s$$a s m

cy.f- g i i and verified) r l N l ts cK~ ~

us en e ouses I

_ __ _ _- _ _ _ . . _ _ _ _ _ . _ - . _ _ . . . . ~ _

l TABLE C-3 (cont)

{ OPERATOR ERRORS i

i Error to Change Error of j Description Ommission Valve Position Dependence Verify Total Comment i

{ 6. Failure to close two 3.0 E-3 1.0 Es3 0.5 0.1 2.0 E-4 Long List l manual valves (check and s. (checked) verify), one locked t i

closed 1

! 7. Failure to verify (3.0 E-3) x 2 0.1 6.0 E-4 Long list chem analysis and (checked) stop operation 1

8. Failure to close 1.0 E-2 3.0 E-3 1.3E-2 Long list

) manual valve i '

j 9. Failure to stop 3.0 E-2 5.0 E-2* 8.0 E-2 makeup after one alarm wn>

"r$

error to stop makeup.

=>I I k 33 '

l GE2 i &

.=w . . .

1 ,

e

ATT ACHMENT l

, ST HL- AE j %s

, PAGE IIGOF /a3 e

EI ung;es'Et gafte DCktvlett tC et' F#34 9'88 9380h FLU $ ate; g OR

/\ec.i FA!LUltI A rg PROSABILITY V

! t ves:es't: ..'te was:catt: .atte Cttt9(et; g.g;n: Ct.netetc Artge 8665=le: f6US*le 0*gestice opgeaflCe (3 /\

em e t i o*tes'ce ra;6s a:e 3s' in st a:tos vot6+ o*teatten ace f 6 C.cif Ms. A 9' Pat! PCittlCe satte a:' ftentsatts va.st tect'! Is;6atts I i 1 c't e s'

F ai. s pan::= rai69sts cotonice Fa:ts cessatos rai6s c% g ama.es;s o*testco s ai66 f C Cast.L v a. vt c' en.vt 'C f C Ctest pas.a. 96 (6tst enAmwa. act tielp:(t te c6 cit swr.a.

'C$ltics (namit #4&lf1Ce VA6tt 4:42G6 tasti (s0766 o'teattom at' V Att (80278 steert:

Figure Ce1-1 BTRS Boron Flushing C-21

.- .=-_ - ._ -. _ . _ -

ATTACHMENT l ST Ht. AE ih5

. PAGE IIS OF12 b e

i

e EI Wut34a't3 ma'te a E lettt: 't *C' FROM 9tet PClia FLV1=le:

aPr e a" te M

1 1

6 FAILURE I

PROSABILITY

) 7%

1 1 4 vet:*a't: m a 't e usgsea't; ma'te Dr.neteC* DJa.*: Otsletet; n'fte ett.6 8.'n*;e e 9ttle F.v5=se!

. Cotes' ice Pt#4'lOs i

I l 0 5 O

! l 0(q;ggen.13te Ot91 sten.IIts Osten'ce F ai.S Degan'Oe re.6%

83' Ig;.a't* ea' llo a'Et to C. tit amt fG C.Clt Cf42944 tote tec3tg i

(

i B

l I tote s'Ce r a..$ Cotea'Gs Falkt Gegea'On ra.68 D,efea'ce e c.est fa.6$

es e. cit me. A et, c. cst em is eseit aa..a. =co. 1

ta.st EfCd's vs.ft (felsea VAft ges3's v Att C942724 i

4 i

i t

i Figure Col-2 BTRS Resin Flushing

)

j C-22 1

]

ATT ACHMENT I ST.Ht AE 8965

, PAGE 114 0F /p3 1 r ai.cc ec

.Rfitcag ue:i.

guetC:n EIT

/\ .3 rm OR F t FAILURI is:,..'ic. er :e es io. or a:s Ptote1LITY raits rans

/\ /\

,, em

! l (Lw tacst pas;;- ra.. vet t ranLget 't f ansuet Cr sauver Cr 90'* Or e:'= # Arts sw a't v.'s ses' c= Aesius eJ=P fC vA rts C'(* C*fu #du em a

r a.6 #C C*i n c' fais.e( 0*fe C I Co'et* Caest nas;;*

al.vett E v.c.13a Ev C.12t Fa6.#t or va.vtl '4 0*te i

I Fal6@( Ct F al6V#I Cr nce.ciet? Mce 9.i39 Figure C.2-1 Failure to Restore Shutdown Margin C-23

ATT ACHMENT I ST-Hl. AE 11b5 PAGElis OF/13 Appendix 0 Response Time Calculations em. is etme

ATI ACHMENT I

. ST H!<AE r165

PAGEligGF/23 i

Appendix D

Response Time Calculations i

This appendix presents the basic model, equations and parameters used in the calculation of response times.

h I. Basic Model i

For suberitical conditions, the neutron flux (e) is proportional to 1/(1-K,ff),or A

' * (1-keff),

4 l where A is a proportionality constant depending on neutron source strength, macrosecpic thermal abscrption cross section, resonance escape probability and reacter geometry.

If e, is the neutron flux at time t=0 and K,ff(0) is the effective multiplication factor, then the ratio of e (at time t) to d o(at time t=0) is

, ,1 - K,f f(0)

o 1~h eff .

If C is the boren concentratien at time t, then Eeff = 1 - (C - C )c EW, Equation 1 I

, where C e is the critical boren concentration and SW is the boron werth.

1 Equation 1 can also be written in terms of shutdown margin (SDM) as SDM = (C - Cc ) 0

3 4

i om. .es.us n.1 j

ATTACHMENT l ST HL AE- 145 PAGE til OF lJ3 The ratio of the flux (e) at time t to the flux (e ) gat time t=0 can, therefore, be rewritten as .

L = (C, - Cc) Equatien 2 c, (C - Cc }'

where baron worth (BW) is considered to be constant for small changes in boron concentration.

The detector count rate (CR) at any time t is proportional to the neutron L flux, therefore CR = (C,- Cc ) Equation 3 K

o (C - CC }'

Therefore, the ratio of the count rate at time t to the count rate at time t 0should yield the relative changes in boron concentration at the setpoint of the flux multiplication alarm (SP), or CR = (C g -C)=SD c Equation 4

% (Cg - C) c where C g is the boron concentration at the time of the alarm.

l The change in boron concentration per unit time is conservatively assumed as a constant (D) over the time interval from the start of the dilution accident (t o) to the time of total loss of shutdown margin (Tc)' "

C o

-C c=D Equation 5 I .

4 The dilution rate (ppm / minute) is assumed constant, therefore (C -C)=T A c A'

Equaiion6 D

where T A is the time from response of the alarm to the time of total loss of shutdown margin.

em. i . ""

D-2

ATT ACHMENT 3 ST HL.- AE- t 7(c5 PAGEIlFOF/23' The time to total loss of shutdown margin (Tc ) is calculated as follows.

A differential equation representing the rate of change of boron concentration in a mixing volume can be written as V dC/dt = OC - OC in, Equation 7 where V = RCS volume (gallons)

C = boron concentration in the RCS (ppm)

C in

= boron concentration of injected water (ppm) 0 = flow rate (gallons / minute).

4 Under the assumption that the injected water contains no boron (Cin=0),

equation 5 is dC/dt = (0/V)C.

Integrating this equation yields C = C, exp (-Ot/V),

where gC is the initial boron concentration.

At the time T , the critical boron concentration C c c is l C c

=C g exp (-0 T c/V).

Solving this equation for T c, Tc = (V/0) in(Cg/C c ).

Equation 8 cmo.-weie D-3 l

L-----.- . . , . _ _ - , . - - - . , - . . , . - - . - - . . _ - . . - _ . . _ - _ - _ - - _ - - _ _ -

. ATTACHMENT '

ST-HL AE f45

- PAGE HqOF123 As criticality is approached, the change in baron concentration is not the simple linear relationship expected from Equation 4. Hence, the change in boron concentration (C 4 - Cc) cannot be found simply from Equation 4.

Equation 6 also depends on this relative change (C A

- Cc ). Therefore, the solution technique used to calculate the amount of time from alarm to total loss of shutdown margin (Tg ) is the same as that developed in support of the Westinghouse flux-doubling system and accepted by the NRC. Based on information provided to Westinghouse by the utility, the applicability of the Westinghouse methodology using the Gamma-Metrics flux multiplication system has been verified. The methodology accounts for a nonlinear source / detector relationship incorporating currently available Westinghouse PWR data which the utility has agreed to verify during and following cycle one operation.

II. Baron Dilution Parameters The dilutien flow rates, RCS volumes, boron worth, flux multiplication setpoint, shutdown margin, initial and critical boron concentrations are discussed in this section. The volumes, boron worth, flux multiplication alarm setpoint, and shutdown margin parameters are listed in Table D-2.

1. Dilution flow rates A detailed review of the CVCS system and associated procedures was performed and potential boron dilution events identified. The resulting dilution flow rate was calculated for each of these initiators.

l Table 0-1 lists the dilution flow rates for each initiator. The maximum postulated flow rate from the Liquid Waste Processing System is 150 gpm. This l flow will join the letdown flow before entering the VCT. If the letdown flow I and charging flow are less than the spray flow of 250 gpm, the VCT level will

( rise and when the level reaches 68%, flow will be partially diverted to the 1

BRS. This will reduce the net dilution rate, but only the bounding value of 150 gpm is reported in Table D-1.

Modulating valve FCV-110A is reset in MODE Sa to limit maximum reactor makeup water flow to 150 gpm.

e m o .. w ee D-4

ATTACelMENT I ST HL AE l%s 4

PAGE lac 0F IM

2. Volumes The volumes for MODES 3 and 4 are similar and correspond to the volume with at least one reactor coolant pump running. The volume in cold shutdown is assessed with no reactor coolant pumps running and only the RHR in operation so that mixing will only occur in one reactor coolant loop.

3. Boron Worth A conservative boron worth of 16.0 pcm/ ppm is used for H0 DES 3, 4, and Sa to bound the worst case in all fuel cycles.

4. Flux Multiplication Alarm The Gamma-Metrics flux multiplication alarm is set at 1.5 times the initial (lowest) count rate. However, the alarm is assumed to conservatively respond at 2 times the initial rate for calculational purposes.

5. Shutdown Margin A minimum shutdown margin of 1.75% is assessed in MODES 3, 4, and Sa.

6. Initial and Critical Boron Concentrations l

l No point estimate values are utilized in this analysis. Because the required boron concentration will change as a function of cycle core characteristics, a bounding analysis is performed and discussed in detail in the next section.

III. Time from Alarm to Total Loss of Shutdown Margin The time from alarm to total loss of shutdown margin is a function of the RCS volume, the initial and critical boron concentrations, and the dilution flow rate. Figures 5.1-1 and 5.1-2 are graphs of the minimum required shutdown margin versus RCS critical boren concentration which define the locus of points for which 15 minutes is available between an alarm indicating a boron dilution event and a total loss of plant shutdown margin. The RCS critical e m . a w ees D-5

ATTACHMENT l ST.HL. AE 11 5

. PAGElatOF 3 boron concentration is defined as the mode-specific critical concentration based on an all rods-in (ARI) conditien minus the most reactive rod stuck in its withdrawn position. The minimum shutdown margin of 1.75% is the cutoff

value for all three modes of operation. MODES 3 and 4 are combined because the same mixing volume, boron worth, and dilution rate are used in the calculation. The maximum postulated dilution rate is used to calculate bounding operator response times for both MODES 3 and 4 (250 gpm) and MODE Sa (150 gpm).

4 A calculated value of more than 15 minutes from the time of alarm to total loss of shutdoan margin (T g ) will result at any RCS critical boron ,

1 concentration less than 855 ppm in MODE Sa or less than 900 ppm in MODES 3 and 4 with a boren worth of 16 pcm/ ppm, when the minimum shutdown margin of 1.75%

is maintained.

The use of Figures 5.1-1 and 5.1-2 requires a knowledge of the critical boron concentration in the RCS at any given time. Once the critical concentratior is known, the associated minimum required percent shutdown margin is read from the appropriate curve depending on the current mode of operation. The amount i

of required shutdown margin must be greater than or equal to the amount defined by the intersection of the RCS critical boron concentration and the curve on the figure. If the actual shutdown margin conditions are beneath the curve, action is required to increase the shutdown margin in the core to a position above the curve on the figure. Doing this assures that a minimum of 15 minutes is available between an alarm indicating a potential boron dilution event and a total loss of plant shutdown margin.

i l

om o .* "' D-6

. ATTACHMENT l ST HL AE- ntS PAGE LLLOF e Table 0-1 Dilution Flow Rates Initiator Description Flow Rates (gom)

M33ES 3 and 4 MODE Sa 1 CVCS Demineralizer Flush 150 150 2 BTRS Boron Flush 250 150 3 BTFS Demineralizer Resin Flush 150 150 4 BCMS Flush 7 7

! 5 Reactor Makeup System 250 150 6 Chemical Addition 122 122 -

l eza. ,.-oe,ese 07

ATTACHMENT i

. ST HL AE- 1965 PAGE ISOF 123 Table D-2 Parameters Volumes 3

ft Q MODES 3 and 4 11,251.9 84,164 MODE Sa 6,428.2 48,083 Boron Worth Worst Case Expected MODES 3 and 4 16 pcm/ ppm 14 pcm/ ppm MODE Sa 16 pcm/ ppm 14 pcm/ ppm Flux Multiplication Alarm All shutdown modes: 2 times background count rate Shutdown Margin Minimum all shutdown modes: 1.75%

I l

j c2ca. ie-es taat g.g

. . - - - _- . . - . .- .~ -. _

.l

(

l i !

i {

d a

ATTACH. MENT 2

< i f

I

'l I

l i

l Ll/NRC/uo

ATT ACWENT JL.

STP FSAR ST HleAE- M E5

. PAGE I OFJ 4 i, curves during the first part of the transient, the increase in core flow with cooler water results in an increase in nuclear power and a decrease in core average temperature. The minimum DNBR during the transient is considerably

(

greater than 1.30.

Reactivity addition for the inactive loop startup accident case is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the cooler water entering the core from the hot leg side (colder temperature side prior to the startup of the transient) of the steam generator in the inactive loop. Thus, the reactivity insertion rate for this transient changes with tire. The resultant core nuclear power transient, computed with consideration of both moderator and Doppler reactivity feedback effects, is shown on Figure 15.4-16.

The calculated sequence of events for this accident is shown in Table 15.4-1.

The transient results illustrated on Figures 15.4-16 through 15.4-20 indicate that a stabilized plant condition, with the reactor tripped, is approached at 30 seconds. Plant cooldown may subsequently be achieved by following normal shutdown procedures.

15.4.4.3 Radiological Consequences. There are only minimal radiological consequences associated with startup of an inactive reactor coolant loop at an incorrect temperature. Therefore, this event is not limiting. The reactor trip causes a turbine trip and heat is removed from the secondary system through the steam generator power relief valves or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological con-sequences associated with this event are less severe than the steam line break 1

event, as discussed in Section 15.1.5.

15.4.4.4 Conclusions. The transient results show that the core is not adversely affected. The DNBR remains above 1.30 thrcughout the transient; thus, the DSB design basis as described in Section 4.4 is met. l43 15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop Ihat Results in an Increased Reactor Coolant Flow Rate Not applicable to South Texas.

15.4.6 Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Reactor Coolant i 15.4.6.1 Identification of Causes and Accident Description. Reactivity l canbeaddedtothecorebyfeedingreactorgradewaterintotheRCSviathe Boron dilution is a manual operation ren: M r9 rg , ai J k CVCS 7 under strict administrative controls with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to

permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the RCS. The CVCS is designed to limit the potential rate of diluti(n to a value which, after indication through alarms and instrumentation, provides the operator sufficient time to I correct the situation in a safe and orderly manner.

\\ '

Chvma Mm cs Co tad SyW-rt-- ~

s

)

15.4-18 Amendment 43

. ATTACHMENT L STP FSAR ST.Ht. AE 1%S PAGE A 0F A( .

The opening of the primary water makeup control valve provides makeup to the RCS which can dilute the reactor coolant. Inadvertent dilution from this I

source can be readily terminated by closing the control valve. In order for makeup water to be added to the RCS at pressure, at least one charging pump must be running in addition to a reactor makeup water pump.

%e-rate-of -eddition of-unborated makeup-water-to-the RCS-when-it ic no tat-praccure-is-limited by-the cap 2 cit; ef the re ct er r2 1r-up "e t er ; ? ;s, Nor- 43 mally, only one reactor makeh'up water supply pump is operating while the other is on standby. With the RCS at pressure, the maximum delivery rate is limited by the control valve.

The boric acid f rom the boric acid tank is blended with reactor grade water de-tE b' " - and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.

'- crder te dilute, tre c:peret rper: tion: cre required:

1. The-operator-inust-switch-from-the 2rterntic m heup rede tc the dilut: :: 43 nit ernate dilute c.ede4-

2. Make-up cont ro14 witch -aust -be-switched- f rom-of f-.co start-pos,iti% 43 At444e p, e i t he r-st-e p-would p r c z e n t dilutier.

- m. : ,~ C / ._ .

Information on the status of the Reactor Makeup Water (RMW) re;;:ncr sys- l 43 temf*jis continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS and

( Reactor Makeup Water System (RMWS). Alarms are actuated to warn the operator l43 if boric acid or deminern hre (water flow rates deviate from preset values as a result of system malfunction. ' M, mo k r m 7, 2

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure Q211.

6 15.0-19.

This event is classified as an ANS Condition II incident (an incident of mod-erate frequency) as defined in Section 15.0.1.

15.4.6.2 Analysis of Effects and Consequences.

Method of Analysis het sha.tdete, To cover all phases of the plant operation, boron dilution during refueling, startup, cold shutdown,xhot standby and power operation are considered in this analysis. -Table--15.4-4-c4,n ta in: the ti:2 ::qu nce f : cent: f: thir :::i Tl.nph5 = dest-r i ------+

b Dilution During Refueling An uncontrolled boron dilution accident cannot occur during refueling, M a y er ~q 2, t - , tm . . p .- ). r t e rei r . . ., c t i g .' This accident is pre-m - 7 7 ~ .1 :

vented by administrative controls which isolate the RCS from the potential source of unborated water.

15.4-19 Amendment 43

. ATTACHMENT a-ST.HL AE 8'765

. Insert X PAGEg OFfl4 ,

A detailed Failure Modes and Effects Analysis (FMEA) has been performed to identify potential boron dilution initiators in Modes 3, 4 and 5 (hot standby, hot shutdown and cold shutdown, respectively). Each component of the CVCS was considered to determine the consequences of each possible failure mode. In estimating the maximum dilution flow rates which result from a particular identified initiator, the effects of a single additional active failure or a single operator error of omission has been considered. In order to bound the initiators in the shutdown and standby modes, the initiator with the highest dilution flow rates, the reactor makeup water system, has been considered.

f i

i l

i 4

i i 1 1

4 Ll/NRC/uo 1

l

- - - , . . , _ . - . ~ . _ . _ . . . - _ _ _ _ . . - - _ _ _ _ - - - _ _ , _ - _ - - . - . . _ _ . . _ - . - _ _ - . . . _ _ - _ . , . _ . . - - _ _ _ _ - ~ ~ - . . , . - , _ ,

ATT ACHMENT .1-Ig E ,

STP FSAR ST-HL AF. l'765 PAGE // OFe2Ll

. c .

Valveg CV0198,in the CVCS will be locked closed,during refueling operations. l26 v

valvej vill block the flow paths which could allow to reach the PCS. Any makeup which is required during refueling will b unborated -eekeep$,ater f borated water supplied from the refueling water storage tank (RWST) by the low head safety injection (LHSI) pumps.

. , l The most littiting alternate sodrce of uncontrolled 4oron dilution would 'be thi!

inadverten't opening of a valve in the Boron Thercl1 Regeneration System n (BTRS). /For this case highly borated RCS water As depleted of boron as it d passes /through the BTRS and is returned via the volume control tank. The s 7

following conditions are assutred for an uncont' rolled bc ron dilution during

/

\' !

ref cling: /

~ ;

T>chnical Specifications will require the reactor to be borated to at least l27 '

500 ppe and shutdown by at least 5.0% Ak at refueling. The maximum baron concentration to lose all shutdown margin is very conservatively ectimated to be 1500 ppm. <

/ <

Dilution flow is assumed to be the maximum capacity of the BTRS (450 gal / min) f with 0 ppm water returning to the RCS. This is assumed althMh normally this '

f system is not operated during refueling conditio.s. j

/

Mixing of the reactor coolant is accomplished by the operation of one residual

/ '

heat removal pump. ,

/ . !

A minittum water volume (4759 ft8) in the RCS is used. This is the minir:um volur'coftheRCSforresi/ualheatremovalsyst96 operation. /

u. v h. ~. a.ns DilutionDuring@t Standby and Strrtup hed b

r. .

EscT ihdde % D C.d Conditions at/ hot standby w -t-ru p require the reactor to have available at least 1.75 percent Ak shutdown margin. S c-reni :: be:cr ::n::ntraticr r e qu i ed t e me e t-this-shut &wm-F-argi n i c c er c e va t ive l y c c t i .c t e d t e ' c 1,2'*

.ppe., The following conditions are assumed fory cr.tinuou: boron dilution duringyhot stan o.n u.nce nbe ikd het s nwro,dby *od-etartup:

r. . . o.m

2. Dilutien f1cu ir :cuzed to be th cenbined pacity of the t;; r::::cr

-we+er keup-pumps-with4he-RCS-at 2,250 pri (2pprovir?tely 382 ;;21/"

~~~^!

h and tD nW

2. A minimum water volume (ll T ft3) in the RCS is used. This volume cor-responds to the active vclume of the RCS ( - the prerrr-irer "clu :. .

W to 4, e nc R C P k of:w.o ti ew , W l" d ' u I'nauf @.

Dilution During Full Power Operation M4. @%M .

With the unit at power and the RCS at pressure, the dilution rate is limited by the capacity of the charging pump (analysis is performed assuming two charging pumps are in operation although only on. is normally in operation).

The effective reactivity addition rate is a function of the reactor coolant temperature and boron concentration. The reactivity insertion rate calculated is based on a conservatively high value for the expected boron concentration at power ( . ppm) as well as a conservatively high charging flow rate y ;c.ity (382 gal / min).

g;;; HA 61--

The RCS volume assumed (445% f tS) corresponds to the active volume of the RCS excluding the pressurizer.

15.4-20 Amendment 43

ATTACHMENT .L ST HL AE 1965

. INSERTS PAGE 5 0FflQ .

1 FCV110B, FCV-111B, CV0201A, CV0215, and CV0221 2

or isolated by removal of instrument air or electrical power A

Dilution During Cold Shutdown Conditions at cold shutdown require the reactor to have available at least 1.75 percent Ak shutdown margin. The following conditions are assumed for an uncontrolled boron dilution during cold shutdown:

1. Dilution flow (150 gpm) is assumed as the best estimate maximum flow from the RMWS assuming that multiple simultaneous failures of control valves and alarms have an extremely low probability of occurrence.

2. A minimum water volume (6428 ft ) in the RCS is used. This is a conservative estimate of the active volume of the RCS with the reactor coolant loops and the pressurizer filled while on one train of RRR.

When the water level is drained down from a filled and vented condition in cold shutdown, an uncontrolled boron dilution accident is prevented by administrative controls which isolate the RCS from the potential source of unborated water. The valves specified in the previous section will be required to be locked out in this cold shutdown condition.

~

B

1. Dilution flow (250 gpm) is assumed as the best estimate maximum flow from the RMWS assu=ing that multiple simultaneous failures of control valves and alarms have an extremely low probability of occurrence.

( C i 3. With no RCP in operation during hot shutdown (with th3) required RHR pumps in operation) the minimum water volume (6428 ft is used along with dilution flow limited to 150 gpm. This dilution rate is l

restricted by limiting the flow through valve FCV-111A to 150 gpm.

l Conditions at startup require the reactor to have available at least 1.75 percent Ak shutdown margin. The maximum boron concentration required to meet this shutdown margin is conservatively estimated to uncontrolled boron dilution during startup.

1. Dilucion flow (382 gpm) is assumed as the combined capacity of two RMW pumps with the RCS at 2250 psia.

2. A minimum water volu=e (11252 ft ) in the RCS is used. This volume corresponds to the active volume of the RCS excluding the pressurizer.

R1/NRC/uo

~

ATTACHMENT TA.

STP FSAR ST HL AE. l?&5 PAGE 6 OF Ay 15.4.6.3 Results and Conclusions.

Dilution During Refueling 4 0,'

' , For dilution du[ing refueling, the midimum time required for the shutdown ,\

f.

v [ margintob,e'lostandthereactor/dbecomecriticalis40;[ minutes.

i Dilutio[DuringHotStandbyand'Startup

\

l {

For dilution during hot s dby and startup, the min mum time required for the i/shutdownmargintobe1,ostandthereactortobeepecriticalis19.6 minutes./

Q . J Dilution During Full Power Operation ed anberntLd

1. With the reactor in automatic control, the power and tempera re increase from boron dilution results in insertion of the RCCAs and a/ decrease in the shutdown margin. The rod insertion limit alarms (low nd low-low settings) provide the operator with adequate time ( f the order of -fe-87 minutes) to determine the cause of dilution, isolate the,rcr:: . o. ode-water source, and initiate reboration before the total shutdown margin is lost due to dilution. ,,p

2. With the reactor in manual control and if no operator action As taken, the power and temperature rise will cause the reactor to rea9h the over-temperature AT trip setpoint. The boron dilution accident its this case is essentially identical to a RCCA withdrawal accident. The /taximum reac-tivity insertion rate for boron dilution is approximately @ pcm/sec

( and is seen to be within the range of insertion rates analyzed. Prior to the overtemperature AT trip, an overtemperature AT alarm and turbine runback would be actuated. There is adequate time available (on the order ofjl. minutes) after a reactor trip for the operator to determine C het cause of dilution, isolate the r p t^r gr. ads water sourceM and ini-p<J tiate reboration before the reactor han return to criticality.

-> L wi6en3d M' ,"9 15.4.6.4 Radiological Consequences. There are only minimal radiological

[ consequences associated with a CVCS malfunction that results in a decrease in boron concentration in the reactor coolant. 3e--reactor--t-r4p cruc:: tur41ne. F 3

-t-r-ip-end h::t ir rece fed f r-- the recendary cyct~. th ugh the et::e ;;:::::: :

prer-c; creted relief 21>cc ^r c2fety fri>cc. Jince no fuel damage occurs h3 from this transient, the radiological consequences associated with this event are less severe than the steam line break event analyzed in Section 15.1.5.3.

15.4.6.5 Conclusions. No fuel damage occurs. The radiological conae-p (a.t fra + 15 quences of this event are not limiting.

(O rr W )

The results presented above show that there is adeqdate timen for the operator tomanuallyterminatethesourceofdilutionflovy/Followingterminationof the dilution flow, the reactor will be in a stable condition. The operator can then initiate reboration to recover shutdova margin. -4 15.4.7 Inadvertent Loading of a Fuel Assembly into an Improper Position 15.4.7.1 Identification of Causes and Accident Description. Fuel and core loading errors, such as can arise from the inadvertent loading of one or 15.4-21 Amendment 43

ATTACHMENT As

ST HL AE 8765 PAGE 1 OF84 E

Dilution during refueling cannot occur due to administrative controls as discussed in Section 15.4.6.2.

Dilution Durinn Cold Shutdown For dilution during cold shutdown, the Technical Specifications specify the required shutdown margin (with the RCS not drained down). The specified shutdown margin ensures that the operator has at leest 15 minutes from the time of the flux multiplication alarm until the total loss of shutdown margin.

Dilution in this mode with the RCS drained down cannot occur due to administrative controls as discussed in Section 15.4.6.2.

Dilution During Hot Shutdown and Hot Standby For dilution during hot shutdown and hot standby, the Technical Specifications specify the required shutdown margin. The specified shutdown margin ensures that the operator has at least 15 minutes from the time of the flux multiplication alarm until the total loss of shutdown margin.

Dilution During Startup In the event of an unplanned approach to criticality or boron dilution during power escalation while in the startup mode, a reactor trip at the power range high neutron flux low setpoint provides the operator with adequate time (on the order of 20 minutes) to determine the cause of dilution, isolate the unborated water source, and initiate reboration before the total shutdown margin is lost due to dilution. Table 15.4-1 contains the time sequence of events for this accident.

E <

Table 15.4-1 contains the time sequence of events for this accident.

E

in the full power, startup, hot standby, hot shutdown and cold shutdown l (with the RCS not drained down) modes of operation, i 9 Uncontrolled boron dilution in the cold shutdown (with the RCS drained down) and refueling modes is administrative 1y precluded, i

L1/NRC/uo i

ATTACHMENT L STP FSAR ST HL- AE- nb5 PAGE 9 0F ,2 4 Tabic 15.4-1 (Continued)

TIME SEOUENCE OF EVENTS FOR INCIDENTS MIICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec.)

2. Case B Initiation of uncontrolled 0 RCCA withdrawal at a small reactivity insertion rate (5 pcm/sec)

Overtemperature AT reactor 10.2 l18 trip signal initiated Rods begin to fall into core 12.2 l18 Minimum DNBR occurs 12.7 l18 Startup of an Inactive Initiation of pump 0 Reactor Ccolant Loop Startup l43 Power reached P-8 interlock 10.2 setpoint, coincident with 43 low reactor coolant flow

( Rods begin to drop 11.2 Minimum DNER occurs 12.0 l18 Uncontrolled Boron Dilution H. Dilution-during -~ ----Dilution-Begins . 4 l43

--r4 fuelin g .

-Opera tor-isolatcs- source a442G

-ef-dilut f er ; minimum-margin 44-cr444cality eccurs. .

I v

Dilution during 4!!: tie. L oi.e- 0 J.

let etcaiby-end. F M A 9 1- Y.M #"1** h*. N y startup O g rater iceleter terr 4e ~1180-

_ f dilutien. 4 4-,,-

--vg<m-te crit 4-=14*y ^'-"r=_.

.htdra y ey M o j,g eg (if d W m u Q L NF]

15.4-38 Amendment 43 L

ATT ACHMENT 2; ST HL AE l?65 STP FSAR PAGE 'l OFAd ,

Table 15.4-1 (Continued) .

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMA1.IES

, Accident Event Time (sec.)

$ '/. Dilution during

full power operation 9 ,, A fa f m g 2 h ;. A '

l r.e:. M Ltl cr- W & *-n *

a. Automatic --841=ic.. Mgins-- 4.. n y n' ? ,,t , m . O reactor control i Shutdown margin lost ~-4%e- / 6 E C

r. . -)i..,,,.

[ t- d .- f v 7 _, a - g

ag < ( .

t. s *W : <cta

LT G'~i f ' ' '. c'a 4t L Q L.cr_

' ^- l C ~* '

a!aJc % , rrw w .,L't -

{${ $ -

W

~

i px Q) l 1

i J

t 4

I I

I l

t i

i l

i

,1

, 15.4-39 Amendment 43

ATTACHMENT 2s ST HL AE- /%5

. STP FSAR PAGE (00F;24 Question 440.67N Provide the following information with regard to the "CVCS Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant" analysis:

e. For each operational mode, list the alarms and indicaticas that would alert the operators to the occurrence of a BDE, and verify their redun-dancy. Also describe any automatic mitigation systems. Confirm that your technical specification will require two alarms to be operable during all shutdown and refueling modes,

b. The FSAR states that the maximum dilution flow during startup and h<st standby is 382 gpm based on operation of two reactor nakeup water (RMW) pumps while the RCS is at 2250 psi. For this dilution flow rate, the minimum time for loss of shutdown margin is 19.6 minutes.

1. Please confirm that you will impose technical specification limits to ensure that RCS pressure, when accounting for instrument error, will not be dropped belov 2250 psi in either of these two modes.

2. Please provide analyses of boron dilution events in modes 4, 5, and

6. How do you intent to ensure RCS pressure never drops below the pressure corresponding to the maximum dilution flow assumed in your analysis? Our concern is that the SRP Section 15.4.6 criterion of 15 minutes (30 minutes for Mode 6) for minimum time availability before shutdown margin is lost will be met with maximum dilution flows assuming operation of two charging pumps and two RMW pumps at minimum RCS pressure for the particular mode analyzed.

c. The FSAR states that valve CV0298 in the CVCS will be locked closed during refueling. Discuss whether additional valves should also be locked closed for redundancy.

Demonstrate that all possible dilution flow paths have locked closed valves, and confirm that the tech specs will contain this information.

f Lwf X.

\Response \

a. The following information describes the alarms and indica s available to alert the operators to the occurrence of a boron 4 tion event.

N There are several diffbrent alarms / indicator ich would alert an operator of a boron dilution vent at ST neluding those as follows:

54

1. Source Range Neutron Flux

~

'bsvel Alarm - When the reactor is suberitical (Modes 3,,AT'S & 6), th'e' source range high flux alarm is visually and audi If' annunciated in the' control room when the setpoint is ched. The audible alarm is alsos given incide the contai - no as the containment evacuation alarm. 's s l

Vol. 3 Q&R 15.4-2N Amendment 54 I

i

--- ---..- - --- ~._ -. __ _ _ _ _ _ _ _ _ _ _ _ _ __

ATYACHMENT S-ST-HL AE l'7/c5

PAGE it OFcH .

STP FSM Response (Continued)

}

2. Source Range Audible Counter (Modes 3, 4, 5 6 6) - An isolated

\ output from the pulse amplifier for the source range instrume tation s provides an audible tone proportional to the selected source ange

\ channel count rate. The indicated source range neutron f1 count

\(s also provided.

N

3. Flow Differential Alarm (All Modes) - As described in .ction 9.3.4.l.3.7, if the boric acid or blended makeup flow, rates deviate by mo,res than the preset values, flow deviation alarms are provided to aler the operator.

4 Monitorirls Instrumentation (All Modes) - Record}cg of the boric acid and blended makeup flow rate and CVCS and RMWS/ pump status lights are provideh (See Sections 9.2.7, 9.3.4, and able 7.5-1).

\

5. Overtemperature AT and Rod Insertion Limi Alarms (Modes 1 and 2) -

With the reactop critical and with the rfactor in automatic control (Mode 1), the power and temperature inpfease from a boron dilution event would result in insertion of th( RCCAs and a decrease in the shutdown margin. \perodinsertion imit alarms (low and low-low settings) would ale (t the operator to a dilution event. If allowed to proceed, an overt eperature A trip (with alarm) would occur. 5 With the reactor in ma ual co trol (Modes 1 and 2) and if no operator action is take , t e power and temperature rise from a boron dilution event wou cause the reactor to reach the overtemperature AT trip atpoint. Power range neutron flux (low and high settings) alarms d rips are also provided, f 6. Neutron Flux Shutdovn Monito sAlarm (Modes 3, 4, 5, 6) - Qualified, l

redundant, safetyj grade neutron flux shutdown monitors are provided tomeasurethee,ountratefromthequalifiedClass1Eextendedrange neutron flux monitors (refer to Table 7.5-1). The shutdown monitors provide alarmd when the countrate increases by an amount equal to the preset arm ratio.

With the above ins rumentation, the reactor op ator can be alerted to any reduction in shupIdown margin. This variety of allable alarms provides diversity in a rting the operator to a boron di tion event.

The analysip of the boron dilution event for South exas takes explicit credit

, for four a,larms. These are, for dilution events during Technical Specification Modes 3, 4, 5 and 6, the Neutron Flux Shutdown Monitor Alare; for Mod,e'2 and Made 1 in manual rod control, the overt 'sperature AT and power

range,,high neutron flux reactor trips; and for Mode 1 i automatic rod conttol, the Low Rod Insertion Limit Alarm.

/ Neutron Flux Shutdown Monitor Alarms are Class lE, prot etion grade and

.e edundant. The audible alarm is via the QDPS (see Section 7 5.6.2).

t I

l Vol. 3 Q&R 15.4 3N Amendment 54

ATT ACHMENT S ST Ht. AE IJbs STP FSAR PAGE 11 Or A4 The overtemperature AT and power range high neutron flux reactor trip are part of the React Trip System and are therefore completely safety rade.

The Low Rod Insertion Limit Alarm is control grade. However, it is designed to satisfy NRC General Design Criteria (GDC) 10,13,19,25and/6,IEEE 279-1971 (Section 4.7)- and ANSI standards N18.2-1973, N18.2a- 975, and 18.8 1973.

There is no automatic mit y,ation system provided for a boro dilution event.

The STP Technical Specifications do not currently address he r.eutron flux shutdown monitors. The Tecfmical Specifications will be evised after the boron dilution analysis has en completed (second quar er 1986).

b. RCS pressure is typically 250 psia in Modes 1 d 2. Assuming a RCS depressurization contradic operational proce re and presames an additional aberration, inde endent of the occ rence of a boron dilution event. The boron dilution ehent is defined Standard Review Plan (SRP) 15.4.6 as a Condition II evenh - an event o moderate frequency. An inadvertent RCS depressurizatihn concurrem! with an inadvertent RCS boron dilution is not expected to occ r with moderate frequency and would not be considered a Condition II ev t. Thefefore, Modes 1 and 2 do not consider the possibility of a si ific/itRCSdepressurization. When the plant isatpower,theTechnical5ecfficationsrequirepressurizer 54 pressure to be maintained within a prtain band to ensure that the DNB design basis is met. There are su cient conservatisms in the analysis to account for small changes in d u ion flowrate caused by small fluctuations in pressure.

Analysis to demonstrate that t,e South exas Project meets regulatory requirementsregardingboronpilutione nts is in process. If any intain regulatory compliance, administrative changes are nycessary to these changes will be identJfied. As par of this effcrt, a probabilistic analysis wilJ be performed t evaluate the probability of boron dilution events. Pf ant response to e ch credible initiator will be modeled to obtain the prpbability of an uncol\ trolled boron diluticn event t criticality. The pr6babilistic analysis will j

resulting in inadverteph identify where the Sop Texas Project is susch tible to boron dilution events, and thus al1 09 Houston Lighting & Power Company to insure that administrativerequf'rementsaresufficienttoreucetheprobabilityof boron dilution eve es to an acceptable level.

l The analyses for the boron dilution event will be c mpleted in the second quarter of 1986

c. Figure 9.3.4- (note 9) identifies the valves in the CS system that are locked close, during refueling operations. As can be een, there are additional ocked closed valves downstream of valve CVO 98. Those valves which are pecified as locked closed can be found in the Technical Specific ions.

I I

Vol. 3 Q&R 15.4-4N Amendment 54

_ - . = . . . ~ _ _ . -. -

ATTACHMENT 4 4

- Insert X ST HLlAE 17G3PAGE 3 0Fjul

Response

a) The alarms and indications that would alert the operators to the occurrence of a boron dilution event are:

1) indication of the boric acid and blended flowrates (all modes);

2) CVCS and RM'.'S pump status lights (all modes);

3) deviation alarms if the boric acid or blended rates deviate by more than 10% from the preset values (all modes);

a

4) Neutron Flux - when the reactor is suberitical:

a) High Flux at Shutdown alarm, j b) indicated Source Range Neutron Flux count rate, j c) audible Source Range Neutron Flux count rate, and i

d) neutron flux-multiplication alarm;

5) Neutron Flux - when the reactor is critical:

a) Axial Flux Difference alarm (reactor power >50%),

b) Control Rod Insertion Limit Low and Low-Low alarms, c) Overtemperature AT alarm (at power). and d) Overtemperature AT reactor trip;

6) Power Range Neutron Flux reactor trip, both high and low setpoints.

I South Texas has provided a probabilistic analysis (letter ST-HL-AE-1765 dated 9/30/86) which indicates that an automatic mitigation system is not required due to the boron dilution (BD) protection system. This system provides an alarm from neutron flux-multiplication instrumentation located in the excore

< flux detector spare wells to alert the operator to a dilution while the reactor is suberitical. Existing alarms are taken credit for in other operating modes as discussed in the Sections 15.4.6.1 and 15.4.6.3. The required operator action time (i.e., 15 minutes between an alarm indicating dilution and a total loss of plant shutdown margin) is met through the implementation of the Technical Specifications.

4 l The Technical Specification will require 2 neutron flux channels to be operable in Modes 1 through 5. An uncontrolled boron dilution accident in

~

modes where the RCS loops are not filled will be precluded via administrative control in the Technic:1 Specifications, i

i i

Ll/NRC/uo

, ATTACHMENT d-ST.HL AE-I7E

. Insert X (Continued) b) The revised calculations consider the presence of an alarm to the operator at least 15 minutes prior to the total loss of plant shutdown margin for an unmitigated event. For Modes 1 and 2, power operation and startup, the original analysis assumption of 382 gpm dilution flowrate with the RCS pressure at 2250 psia is maintained. For Modes 3, 4 and 5 (hot standby, hot shutdown and cold shutdown, respectively) the dilution flowrate is based on a probabilistic Failure Modes and Effects Analysis which results in a conservative dilution rate based on probabilities.

The dilution rate used in the analysis in these modes is less than that for Modes 1 and 2. The analysis confirms that sufficient time is available following a flux-multiplication alarm for action to preclude the total loss of plant shutdown margin.

Details of the boron dilution analysis assumptions and results are provided in revised Section 15.4.6.

An RCS pressure decrease which may result in a higher dilution flowrate is not a concern in Modes 3, 4, or 5 since the flowrate used in the study is based on a probabilistic Failure Modes and Effects Analysis (FMEA) .

The FMEA determines the limiting flowrates for the given operating mode of the plant taking pressure conditions into consideration.

In Modes 1 and 2, a dilution flow rate of 382 gpm corresponds to the combined capacity of 2 RM'.' pumps with the RCS at 2250 psia. In Mode 1, the Technical Specifications limit the pressurizer pressure to a minimum of 2205 psig, which includes instrument error. The Technical Specifications do not address the pressurizer pressure in Mode 2. The plant operating procedures require the RCS to be pressurized to 2235 psig prior to entering 1: ode 2. Thus, Mode 2 operation implies that a pressurizer pressure of 2250 psia is maintained in the plant while in this mode. Section 15.0.3 presents the accident analysis assumption of pressurizer pressure of 2250 psia and a measurement error band of + 30 psi. Therefore, Modes 1 & 2 do not consider the possibility of a significant decrease in the RCS pressure in the boron dilution analysis. Fcr both Modes 1 and 2, there are sufficient conservatisms in the analysis te account for small changes in dilution flowrate caused by small fluctuations in system pressure.

c) In order to establish redundancy, the following additional valves in the CVCS have been required locked closed in refueling and cold shutdown when the reactor coolant loops are drained: FCV-110B, FCV-111B, CV0201A, CV0215 and CV0221. Since FCV-110B and FCV-111B are solenoid-operated air-cylinder valves, they will be isolated by removal of electrical power or instrument air in these modes. These additional requirements are reflected in the Technical Specifications and are sFown in revised Section 15.4.6.2.

In order to ease operational conflicts, an exception is made in the Technical Specifications for opening valve CV0198 when the reactor makeup water system is needed for refill operations of the refueling water storage tank. This valve will only be open during these refill operations and will be locked closed at all other time during refueling.

L1/NRC/uo

- - - . . - - - - . . . . = _ _- _

' ATTACHMENT &

ST Hi AE 1%5

FAGE IS OF M .

STP FSAR c l>

~ N Question 440.68N

)

Describe or reference the analytical model used in the BDE calculations.

Discuss the degree of conservatism of this model, including that of scram times, moderator and Doppler coefficients, and mixing of coolant.

hwh y ,

sponse Th slution technique used for the STP boron dilution analysis ytas developed j

in suppgrt of the Westinghouse flu.x-doubling detection and automatic boron dilution' %itigation system. The me thod is used to calculate phe amount of time from N flux-doubling signal to criticality for an unmitfgated boron dilution ac ident from suberitical modes of operation. For/ operation at larm until shutdown margin is lost efromreactortriporrodinse:tionlimitfcompliancewiththe l

power, the t 1

for an unmitigated BDE is calculated. I

Standard Revie Plan (SRP) 15.4.6 (Rev. 1 - July 1981) and Regulatory Guide l.70 (Revs. 2 an 3), the solution is utilized to vep.fy that the amount of time necessary fo detection and mitigation of the yoron dilution accident is 4

less than the amoun of time to criticality for aty' unmitigated event. The technique was presen dtotheNRCpreviouslyanfisconsistentwiththe methodology used for p ants with the automatic oron dilution protection system.

Additionally, as described n the response o Question 440.67, a probabilistic analysis is being performed go evaluate the probability of boron dilution j

events during suberitical mod s of opera ' ion.

The analysis will begin with a d tail Failure Mode and Effects Analysis (IMEA) to identify potential boro 6 ution initiators. The IKEA will provide a detailed evaluation of the CVCS s stem to identify potential equipment i

faults or operator errors which co 1 result in an inadvertent dilution of reactor coolant system boron con ntra ion. Subcritical Moden 3 (hot standby), 4 (hot shutdown), 5 (c'old shu own), and 6 (refueling) will be analyzed. ,

\

The frequency of each credible boron diluti event will be calculated using industry accepted equipment failure and huma error probabilities. Maximum

/

dilution flow rates for ep'ch initiator will bg identified. Minimum Outdown margin for each mode wilf be obtained from Tech ical Specifications.

Additionally, minimum actor coolant system vol e will be identified for each mode. Using this inf ation, the time to alarni a boron dilution event and time to criticality ill be calculated to show c iance with regulatory requirements.

Additionally, a robabilistic analysis of boron diluho events will be

! Ev tte tree modeling will be employed to calc late the frequency of performed.

boron diluti events which result in unplanned criticali y. This analysis will includ an evaluation of alarm reliabilities, and a p obabilistic evaluation of the operator response to the boron dilution e*ent. ;

\

Section 5.4.6 will be revised to reflect-the results of the nalyses which

. are t9 be completed second quarter 1986.

/ Vol. 3 Q&R 15.4-5N ndment 54

. ATTACHMENT k ST.HL- AE l'7h5

- Insert Y PAGE /6 0FJ4

Response

The solution technique used for the boron dilution analysis was developed in support of the Vestinghouse flux multiplication detection system. The method is used to calculate the amount of time from a flux-multiplication signal to total loss of shutdown margin or an unmitigated baron dilution accident. The analysis provides necessary shutdown margin vs RCS critical boron concentration as a function of the operating mode to ensure that the available time from a flux-multiplication signal to total loss of shutdown margin for an unmitigated boron dilution accident is greater than 15 minutes.

The boron dilution analysis is performed using a hand calculation to solve a differential equation of boron concentration as a function of time. Perfect mixing is assumed. The time at which the loss of shutdown margin is predicted to occur is a function of the dilution flowrate, the active volume in the reactor coolant system and boron concentration. The active volumes and dilution flowrates used in the analysis have been assumed bcsed on a probabilistic evaluation of modes of operation and the CVCS design. As an j additional degree of conservatism, the differential boron worth is assumed to be constant rather than a decreasing function of boron concentration. The solution technique was presented to the NRC previously snd is consistent with the methodology used in licensing analyses for other Westinghouse plants.

Although the solution technique was developed in support of the Westinghouse flux-multiplication detection system, it has been determined that the Gamma-Metrics (G-M) flux multiplication system used at STP is at least as conservative and use of the G-M system is bounded by the analysis.

i i

i L1/NRC/uo 1

l I

l

ATTACHME k ,

.ST.HL AE-'/ }7(c5 fj 7 g)

. . PAGE V7 OF A4

'I' 3/a.1 REACTIVITY CONTROL SYSTEMS "

3/a.1.1 80 RATION CONTROL SHUTDoww MARGIN -

avs

, LIMITIM CONDITION FOR OeETJ' ION I.757, 3.1.1.1 The SHUTDOWN MARGIN shall be greater than or equal to [1 ~2 AA/k.

oP AP P LICA E!LI?f: M:0E5 If 2* x 3;amc1.

ACTION:

I,75

With the SHUTDOWN MARGIN less than U ~~; ak/k, immediately initiate.and l continue boration at greater than or ecual to 30 gpa of a solution containing greater than or ecual to 7.000 ppa boren or equivalent until the required SHUTCOWh MARGIN is restorec.

SURVEILLANCE REQUIREVENTS

.I 4.1.1.1.1 The SHUTDOWN MARGIN shall be determined to be greater than or equal to g _. ---; ak/ k: '

l I.7He *

a. Within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after detection of an inoperable control rod (s) and l l

at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter while the rod (s) is inoperatie.

l If the inoperatie conteci rod is 1sunovable or untrippatie, the acove recuirec SHUTDOWN MARGIN shall be verified acceptable with an increasec allevance for the withdrawn worth of the 1::vnovable er untrippable control roc (s);

L. R e. '., "00 1 er "000 2 witt (ff g eeter tt,en er eq.el to 1 et j 1;.;t ...;; ;;;r 1.2 7,e. ; tj .;7if fi ;; 0F,;t ;; ,t el L; ,k .;itP.O: :1 i:

vitM tT.; ii;it; ef Os,ee'.I'eei.'... O.1.O.0, I

b. c when in M00E 2 with X,ff less than~1, within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months prior to l achieving reactor criticality by verifying that the precicted critical control red position is within the limits of Specification 3.1.0.6; I

c. 4 Prior to initial operation above 5% RATED THERMAL POWER after each fuel loading, by consideration of the factors a: .--;-+

^'

- -_ - c

- i". below, with the control banks at the maximum inser- -

tion limit of Specification 3.1.3.6I Q "See Special Test E.xceptions Specification 3.10.1. l W-STS

- 3/4 1-1 .

07/15/86 NUREG 0452/STPEG5 COMPARISON

ATTACHMENT c2- {= " -

ST.HL AE. I?e5 r-

/ . REACTIVITY COWROL SYSTEMS PAGE lt OFcR4 e kl i.

SURVEILLANCE REOUIPEWENTS (Centinvec)

M. 'A _

v.

Z: ; ..

inli _ ; ;,m.

, __ ? - - - t - :-- - N .'. ; E- r r - ' " r t h . c f

_ 1) Reactor Ceclant System baron concentration,

2) Control red position,

3) Reacter Coolant Systes av'erage tasperature, ,,

4) Fuel burnup based on gross thermal energy generation,

5) Xenen concentration, and

6) Samarius concentration. .

4.1.1.1.2 The overall core reactivity balance shall be cascared t .

precictec values to cea nstrate agreement within i 1% Ak/k at least once l per 31 Ef fective Full Power Days (EFPD). his cosparijon shall consicer at least these facters stated in Specificatic 4.1.1.1.Iy. 7 acove. The '

l precictee reactivity values shall be adjusted (normalizac) to correscene to -

the actual ccre conditions prior to excepding a fuel burnup of 60 EFPD af ter eacn fuel loacir.g. l

... . ., , w --

' : s. . .

r,W. "? .

p . p - :,,j .

2.;(_i s '.- Y .

v

'- *?4l.R

.- G .i-S. . .u: . . . . -

ty:ct;1% 'T

. >.:;9. 7 -

. . 3. ;, , . : . . - '

a v%

m.

o%,? -

-;r, !.:,

. .s Q;,.;c.- % ..:y..~;-+ .

q..m.' .-

W.u-J

-L . - n.= e

&nik u..-

f .. . . .

3-575 3/4 1-2 07/15/86 N'SEG 0452/STPEG5 COMPARISON l _. _ - _ - - -- _ -. - -- - - - - - - - - - - - -----

' ATTACHMENT ft-ST.HL AE. l% 5 r pr PAGE 19 0F All l,q m )o L REACTIVITY CONTROL SYSTEMS SHUTDOW MARGIN - T l' ~ 7-, C; 701 TE T2 0

LCCPS hu.E.b LIMITING CONDITION FOR OPERATION 3.1.1.2 The SHgTDOW gtRGIN shall be greater than or equal to 15-mea. Oie.MT.

9 * *'t td M ST9 Cyc\e. sp4A c.,. %% n. -t APPLICAEILITY: M. gg

g ACTION:

lidspiksd A% ST9 C e.h M S ikk p Cen bTA M9ecT With the SHUTDCVh MARGIN less than C J !i. immediately initiate and continue beration at greater than or equal to 1 gpa of a solution containing greater l than or equal to7CZ cpt boren or equivalent until the required SHUTDOWN MARGIN is restored.

SURVEILLANCE REOUIREMENTS 4.1.1.2 The SHUTDOW MARGIN : hall be determined to be greater than or equal to u 1-Yta likit: [

a. Within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after detection of an inoperable control rod (s) and at !

least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter while the rod (s) is inoperable.

If the inoperable control rod is innovable or untrippable, the SHUTDOWN MARGIN shall be verified acceptable with an increased allowance for the withdrawn worth of the immovable er untrippable control roc (s); and l

b. At least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months by consideration of the following factors:

1) Reactor Coolant Systas boren concentration,

2) Control rod positien,

3) Reactor Coolant System average tamparature,

4) Fuel burnup based on gross thennal energy generation,

5) Xenon concentration, and

6) Samarium concentration.

"%hdee.r L,yd y o fe e l w-STS 3/4 1-3 NUREG 0452/STPEGS CDE2fBL%4

ATTACHMENT ST HL1 AE l%

PAGE Bo0FM o

Wiks, L j

RE. ACTIVITY CONTROL SYSTEMS l 5HUTDChH MARGIN - - ,yg i - ---

r- " ~

6 N MO l LIMITING CONDITION FOR OPERATION 3.1.1.2 The SHUTDOWN MARGIN shall be greater than or equal to N. 5.09'o c. c

-+he. Rc.5, Rota n concu&cdioN EbU he c3teoit.r h er e io 460Dgy APPLICAEILITY: MDE 5." wh W u r is m., ngh d*q ACTION: a.b ut .

witk%e,(epuiremed 3 2. '. '.1 nd'_Edisbeb, immediately initiata and c

_m m

..x. z .

beration at greater than or equal to 1 gpa of a solution cent.aining greater than or equal to 71'i.9 ppa boron or equivalent until u- ,ali-' m . . . i . -- Aa.a

'sannun tmunis res to red , %c, g* g* C **yM i' 8 */* A W l K.

44u , ~ < e. t c t%, b, e.

yeatte %m .c 4 h A reo pp rvi' SURVEILLANCE REOUIRE.MENTS

^

Ne. w:>ce ce b'sUve dr%e. eMM1 cdeve sk\\ be, de_%6d te b,,,_

4.1.1.2 _": i- N -- - ;c - : r- " " " - -

t- 1 -

u. E n its M&: 3 l

4. Within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after detection of an inoperable control rod (s) and at l

least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter while the rod (s) is inoperable.

If the inocerable control rod is imovable or untrippable, the SHUTDOWN MARGIN shall be verified acceptable with an increased allowance for the withdrawn worth of the f amovable or untrippable control red (s); and l

b. At least once per 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months by consideration of the following factors:

1) Reactor Coolant System boron concentration,

2) Control rod position,

3) Reactor Coolant System average temperature,

4) Fuel burnup based on gross thermal energy generation,

5) Xenon concentration, and

6) Samarium concentration.

D bsturi+er I-evel 6 0*/o W-STS 3/4 1-3 NUREG 0452/STPEGS cfEPApqison

. .. .. ..... . . ATT AC HME NT. 1., .

. ST HL AE- /% p O

PAGENOFA9 ib)Dt11[g F ;

REACTOR COOLANT SYSTEM 1

H0T SHUTDOW LIMITING CONDITION FOR OPERATION 3.4.1.3 A At.least two of the loops listed below shall be OPERA 8LE and 1t t=^

_ c f _u:: 1rx :n! 5 '- - - t'er = ,

aR i). Reactor Coolant LoopbA(and its associated steam generator and reactor coolant pump,**

& .1) Reactor Coolant Loob 8(and its associated steam generator and

. reactor coolant pump,"*

8,3) Reactor Coolant LoobCQnd its associated steam generator and reactor coolant pump,*"

6.4)ReactorCoolantLoop D and its associated steam generator and reactor coolant pump,"* -

6 5) RHR LoopkAT, ont

/ 3. y.1. ~16 Ai- ledane, ek WeSob" 4 A .

fe(,)RHRL'oophE[ 0 "" E R* kT* A Ca*

W W ]

g'Q RHR Loor C. D..cwE. A w n L uswt R h e t Leep APPLICAEILITY: MODE 4. W" V6'"E Cl 'V) l Fcy-ggg 4 g[g g go ACTICH:

a. With less than the above required loops OPERASLE, isusediately initiata corrective action to return the required . loops to OPERA 8LE status as soon as possible; if the remaining GPERA8LE loop is an RHR loop, be in COLD SHUTDOWN within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

3. 4.1. 3 8 uar mer- - '

b. With er i rn N ry: c a , suspend all operations involving a reduc-tion in boren concentration of the Reactor Coolant System and immediately initiata corrective action to return to operation.

3, y . g, g g, (), g,q,g,g.]

"All reactor coolant pumps and RHR pumps any be deenergized for up to 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months provided: (1) no operations are permitted that would cause dilution of the Reactor Coolant System boren concentration, and (2) cor outlet temperature is maintained at least 10*F below saturation tamperature.

- A reactor coolant pumo shall not be started with one or more of the Reactor '

Coolant System cold leg tanceratures less than or equal to 150 *F unless the seconcary water tancerature of each steen generator is less than 50 F above each of the Resctor Coolant System cold leg temperatures.

l 75T5 3/4 4-3 NUREG 0452/STPEGS

___ - - - - me"

ATTACHMENT EL-P.EAC~C' CCCL N SYSTEM ST HL- AE- 1795 __, . u i , ,

PAGE dtA.0F M SURVEILLANCE REGUIREMENTS 4.4.1.3.1 The required reactor coolant pumpif(s)/ not4.and $ h R pu.mps in operation, shall be cetermined OPERAELE once per 7 days by verifyin,'g correct breaker indicated power availability.

4.4.1.3.2 The required steam generator (s) shall be determined OPERABLE by verifying secondary side water level to be greater than or equal toVlgte,:; at l least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . f o% wac, wr

(*t W4 r-cN-m A iM'Yt1 to 150p 4.4.1.3.3 At least one reactor coolant er 3 RHR loop 3shall be verified in operation and circulating reactor coolant at least once per 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

4.4.1.3.4 At least once per 18 sonths by

, Verifying automatic isolation and interlock action of the RHR systes from the Reactor Coolant System by ensuring that:

a) With a simulated or actual Reactor Coolant Systee pressure ~ye

. signal greater than or ecual to **SApsig the interlocks prevent tne valves from being opened, and . .

b) with a simulated or actual Reactor Coolant System cressurt_ 7co M^"- signTl)hss than or equal to [*4HdsTg the interlocks will cause the valves to automatically close.

l 1

1 1

V-STS 3/4 4-4 N 2/STpEGS

r

. . ATTACHMENT A ST.HL AE 176 5 PAGE PD> OFJL4 , y 3/4.1 REACTIVITY CONTROL SYSTEMS h IL

~

BASES

' ed 3 /4.1.1 BORATION CONTP.0L 5 2 te e u< '

3 /4.1.1.1 and 3/4.1.1.2 SHUTDOW MARGIN [

et A sufficient SHUTDOW MARGIN ensures that: (1) the reactor can be made :.2 suberitical from all operating conditions, (2) the reactivity transients asso ciated with postulated accident conditions are controllable within acceptable E7 C

limits, and (3) the reactor will be maintained sufficiently suberitical to preclude inadvertent criticality in the shutdown condition. fk*(C wI E d

SHUTDOW MARGIN recuirements vary throughout core life as a function of 5 h [

fuel depletion, RCS boron concentration, and RCS T,yg. The most restrictive 4 g g condition occurs at EOL, with T avg at no load operating temperature, and is Ee f w t%Au .i. accident and resulting uncon- r I s4 gg associated with a postulated steam line break.

trollec RCS coolcion .. In the analysis of this accident, a minimus SHUTDOW l@ c,.E 2 v I7 N __ MARGIN off M A is required to control the reactivity transient.Y. -"Sh,7eE bu- 3:y, /ne SHUTDOW MARGIN requirement is based upon this limiting z {' @.J

~

A concmondand is consistent with FSAR safety analysis assteeptions. With T ayg 4 m ThAe.s less than 200*F, the reactivity transients resulting from a postulated staa=

3gq* line break cooldown are minimal and g .

u ib ,

" 'l * * -

"4 3/4.1.1.3 MCOERATOR TEMPERATURE COEFFICIENT "

The limitations on moderator temperature coefficient (MTC) are provided to ensure that the value of this coefficient remains within the limiting l

condition assumed in the FSAR accident and transient analyses.

The MTC values of this specification are applicable to a specific set of

, plant conditions; accordingly, verification of MTC values at conditions other I than those explicitly stated will require extrapolation to those conditions in order to permit an accurate comparison.

The most negative MTC, value equivalent to the most positive moderator l density coefficient (MDC), was obtained by incrementally correcting the MDC used in the FSAR analyses to nominal operating conditions. These corrections y-STS B 3/4 1-1 i NUREG 0452/STPEGS ,

COMPARIS0N l

(-

~

ATTACHMENT e ST-HL AE M/oS PAGEfly OFJd

~

ADMINISTRATIVE CONTROLS SEMIANNUAL RADI0 ACTIVE EFFLUENT RELEASE REPORT (Continued) -

j pursuant to Specification 6.15. It shall also include a listing of new loca-tions for dose calculations and/or environmental monitoring identified by the Land Use Census pursuant to Specification 3.12.2.

The Sesiannual Radioactive Effluent Release Reports shall also include the following: an explanation as to why the inoperability of liquid or gaseous affluent monitoring instrumentation was not corrected within the time specified in Specification 3.3.3.10 or 3.3.3.11, respectively; and oescription of the events leading to liquid holdup tanks or gas storage tanks axceeding the limits of Specification 3.11.1.4 or 3.11.2.6, respectively.

MONTHLY OPERATING REPORTS 6.9.1.[' Routine reports of operating statistics and shutdown experience, j including 2Tdocumentation of all challenges to the PORVs or safety valves,}

shall be submitted on a monthly basis to the Director, Office of Resource Management, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555, with a copy to the Regional Administrator of the Regional Office of the NRC, no later -

than the 15th of each eionth following the calendar month covered by the report.

STP C1cLE 59EctMc. Cee.E bMTR '

-SI;_ FE-- 1-i .iii- M REPORT c % ST9 Cde Spe.eSt c.cc %.Q4M RTp) shall be provided to -

6. 9.1.f' ) ; m r ,y . ;;; n n- - : n T--51 _ ':-E;F ?,y the NRC Regional Administrator with a copy to Director of Nuclear Reactor Reculation, Attention: Chief, Core Performance Branch, U.S. Nuclear Regulatory A Commission, Wasnington, D. C. 20555,,kfor all core planes containing Bank "0" T

at F liWits control rods and all unrodded core planes and the cl.Aqot cLf credicted (Fq PRei) w w. pe-foe D vs Axial Core Height with the limit envelope Aat least 60 days prior to each gggqcycle initial criticality unless otherwise approved by the Commission by letter.

( remq) In addition, in the event that the limit should change requiring a new substan- '

tial or an amended submittal ^a ^_n ". i ' ^ 1 .t L' will be submittad 60 days prior to the date the limit would become effective unless f otherwise approved by the Commission by letter. Any information needed to i support F P will be by request from the NRC and need not be included in this l report.

, % ddu% tutabdoN MBSMN ce. m. m k b WDES 3,4 Mb*

I MN loops ALLEb d Loo 95 NOT FtLLE) was,gg, peg ggg my I't* N h ttmoN ki4 Lists CufwES ,

6-20 NUREG 0452/STPEGS PSTS COMPARIS0N

. - _ _ _ _

ML20215B272

Contents

Text

1.0 INTRODUCTION

SUMMARY

6.0 CONCLUSION

7.0 REFERENCES

.m

..

=a k=ne. as. sawwe == saww

s*

w = =

.gs- c-s

=M

=5

s.

. g a. e. e. g

zss seems =as re=w5k==sa

a z;. EEEE -aB EEEE I=

==-e me=*.w a

Response

Response

Navigation menu

ML20215B272

Text

1.0 INTRODUCTION

SUMMARY

6.0 CONCLUSION

7.0 REFERENCES

.m

..

=a k=ne. as. sawwe == saww

s*

w = =

.gs- c-s

=M

=5

s.

. g a. e. e. g

zss seems =as re=w5k==sa

a z;. EEEE -aB EEEE I=

==-e me=*.w a

Response

Response

Navigation menu

Search