ML21286A281
Text
BFN-27 3.8-1 3.8 STANDBY LIQUID CONTROL SYSTEM 3.8.1 Safety Objective The safety objective of the Standby Liquid Control System is to provide a backup method, which is independent of the control rods, to make the reactor subcritical over its full range of operating conditions and provide sufficient buffering agent to maintain the suppression pool pH at or above 7.0 following a DBA LOCA involving fuel damage (see Section 14.6.3.5). Making the reactor subcritical is essential to permit the nuclear system to cool to the point where corrective actions can be carried out. Maintaining the suppression pool pH at or above 7.0 following a LOCA involving fuel damage supports the LOCA radiological dose analyses that do not consider the re-evolution of iodine to the containment atmosphere. The Standby Liquid Control System is classified as a special safety system.
3.8.2 Safety Design Basis
- 1.
Backup capability for reactivity control shall be provided, independent of normal reactivity control provisions in the nuclear reactor, to shut down the reactor if the normal control is impaired so that cold shutdown (MODE 4) cannot be obtained with control rods alone.
- 2.
The backup system shall have the capacity for controlling the reactivity difference between the steady-state rated operating condition of the reactor and the cold shutdown condition (MODE 4), including shutdown margin, to assure complete shutdown from the most reactive condition at any time in the core life.
- 3.
The time required for actuation and effectiveness of the backup reactivity control shall be consistent with the nuclear reactivity rate of change predicted between rated operating and cold shutdown conditions (MODE 4). A scram of the reactor or operational control of fast reactivity transients is not specified to be accomplished by this system.
- 4.
Means shall be provided by which the functional performance capability of the system components can be verified periodically under conditions approaching actual use requirements. Demineralized water, rather than the actual neutron absorber solution, is injected into the reactor to test the operation of all components of the redundant control system.
- 5.
The neutron absorber shall be dispersed within the reactor core in sufficient quantity to provide a reasonable margin for leakage, dilution, or imperfect mixing.
BFN-27 3.8-2
- 6.
The system shall be reliable to a degree consistent with its role as a special safety system.
- 7.
The possibility of unintentional or accidental shutdown of the reactor by this system shall be minimized.
- 8.
The system shall be capable of supplying buffering agent to the suppression pool in the event of a large recirculation break. Sufficient buffering agent shall be provided to ensure that the pH of the suppression pool for DBA post-LOCA events involving fuel damage remains at or above 7.0 for 30 days.
3.8.3 Description (Figures 3.8-1, 3.8-2, 3.8-3, 3.8-5, and 3.8-6)
The Standby Liquid Control System is manually initiated from the Main Control Room to pump a boron neutron absorber solution into the reactor if:
- 1. The operator determines the reactor cannot be shut down or kept shut down with the control rods; or
- 2. Fuel damage occurs post-LOCA.
The Standby Liquid Control System is required to shut down the reactor at a steady rate within the capacity of the shutdown cooling systems and to keep the reactor from going critical again as it cools.
The Standby Liquid Control System is needed in the improbable event that not enough control rods can be inserted in the reactor core to accomplish subcriticality in the normal manner.
The Standby Liquid Control System is also required to supply sodium pentaborate solution for post-LOCA events that involve fuel damage to maintain the suppression pool pH at or above 7.0. The radiological dose analyses for the DBA LOCA assumes concentrations of iodine species consistent with a suppression pool pH at or above 7.0 (i.e., re-evolution of iodine to the containment atmosphere is not considered). The sodium pentaborate solution is credited as a buffering agent to offset the post-LOCA production of acids (e.g., radiolysis products).
The system consists of a boron solution tank, a test water tank, two positive-displacement pumps, two explosive-actuated valves, and associated local valves and controls. They are mounted in the Reactor Building outside the primary containment. The liquid is piped into the reactor vessel via the differential pressure and liquid control line and discharged near the bottom of the core lower support plate through a standpipe so it mixes with the cooling water rising through the core (see Sections 4.2, "Reactor Vessel and Appurtenances Mechanical Design," and 3.3, "Reactor Vessel Internals Mechanical Design").
BFN-28 3.8-3 The Boron-10 isotope absorbs thermal neutrons and thereby terminates the nuclear fission chain reaction in the uranium fuel.
The specified neutron absorber solution is enriched sodium pentaborate (Na2B10016-10H20). It consists of a mixture of borax, enriched boric acid, and demineralized water prepared in accordance with approved plant procedures to ensure the proper volume and enriched sodium pentaborate concentration is present in the standby liquid control tank. A sparger is provided in the tank for mixing, using air. To prevent system plugging, the tank outlet is raised above the bottom of the tank and is fitted with a strainer.
At all times when it is possible to make the reactor critical, the configuration of the Standby Liquid Control System shall satisfy the following equation:
C Q E 8.7 WT% 50 GPM 94 ATOM% 1.0 C = sodium pentaborate solution weight percent concentration Q = SLCS pump flow rate in gpm E = Boron-10 atom percent enrichment in the sodium pentaborate solution The SLC system is used to control the Suppression Pool pH in the event of a DBA LOCA by injecting sodium pentaborate into the reactor vessel. The solution is then transported to the suppression pool by mixing with the ECCS flow circulating through the reactor and flowing out of the recirculation break into the suppression chamber. The amount of sodium pentaborate solution that must be available for injection following a DBA LOCA is determined as part of the DBA LOCA radiological dose analysis. This quantity is maintained in the storage tank as specified in the Technical Specifications.
The solution concentration is normally limited to a maximum of 9.2 weight percent to preclude unwanted precipitation of the sodium pentaborate. The saturation temperature of the 9.2 percent solution is 40F which provides a 10F thermal margin below the lowest temperature predicted for the SLCS equipment area. Tank heating components provide backup assurance that the sodium pentaborate solution temperature will never fall below 50. The sodium pentaborate solution concentration is allowed to be 9.2 weight percent provided the concentration and temperature of the solution are within the limits permitted by the technical
BFN-27 3.8-4 specifications. High or low temperature, high or low liquid level, or a shorted heater causes an alarm in the control room. Tank level indication is also provided in the control room.
Each positive displacement pump was originally sized to inject sodium pentaborate into the reactor in 50 to 125 minutes (approximately 50 gpm), depending on the amount of solution in the tank, at the reactor vessel maximum operating pressure.
The minimum quantity of enriched sodium pentaborate is injected when required in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The pump and system design pressure is 1500 psig. The two relief valves are set at approximately 1425 psig to exceed the reactor operating pressure by a sufficient margin to avoid valve leakage. To prevent bypass flow from one pump, in case of relief valve failure in the line from the other pump, a check valve is installed downstream of each relief valve line in the pump discharge pipe.
A bladder-type pneumatic-hydraulic accumulator is installed on the discharge piping near each relief valve to dampen pulsations from the pumps to protect the system.
Unit 1 is equipped with a maintenance-free suction accumulator at the SLC pump-inlet flange to provide suction stabilization and protect the system.
Unit 2 is equipped with a maintenance-free suction accumulator at the SLC pump-inlet flange to provide suction stabilization and protect the system.
Unit 3 is equipped with a maintenance-free suction accumulator at the SLC pump-inlet flange to provide suction stabilization and protect the system.
The two explosive-actuated injection valves provide high assurance of opening when needed and ensure that the boron solution will not leak into the reactor even when the pumps are being tested. The valves have a demonstrated firing reliability in excess of 99.99 percent. Each explosive valve is closed by a plug in the inlet chamber. The plug is circumscribed with a deep groove so the end will readily shear off when pushed with the valve plunger. This opens the inlet hole through the plug.
The sheared end is pushed out of the way in the chamber and is shaped so it will not block the ports after release.
The shearing plunger is actuated by an explosive charge with dual ignition primers inserted in the side chamber of the valve. Ignition circuit continuity is monitored by a trickle current, and an alarm occurs in the control room if either circuit opens.
Indicator lights show which primer circuit is opened. To service a valve after firing, a 6-inch length of pipe (spool piece) must be removed immediately upstream of the valve to gain access to the shear plug.
The Standby Liquid Control System is actuated by a five-position spring return to "normal" keylock switch located on the control room console. The keylock feature
BFN-27 3.8-5 ensures that switching from the "stop" position is a deliberate act (safety design basis 7). Momentarily placing the switch to either "start A" or "start B" position starts the respective injection pump, opens both explosive valves, and closes the Reactor Water Cleanup System isolation valves to prevent loss or dilution of the boron solution.
A green light in the control room indicates that power is available to the pump motor contactor, but that the contactor is open (pump not running). A red light indicates the contactor is closed (pump running). A white light indicates that the motor has tripped or the local handswitch is in the test position.
A red light beside the switch turns on when liquid is flowing through an elbow style flow meter and associated flow indicating switch downstream of the explosive valves. If the flow light or pump lights indicate that the liquid may not be flowing, the operator can immediately turn the switch to the other side, which actuates the alternate pump. Crosspiping and check valves assure a flow path through either pump and either explosive valve. The chosen pump will start even though its local switch at the pump is in the "stop" position for test or maintenance. Pump discharge pressure indication is also provided in the control room.
Equipment drains and tank overflow are piped not to the waste system but to separate containers (such as 55-gallon drums) that can be removed and disposed of independently to prevent any trace of the boron solution from inadvertently reaching the reactor.
Instrumentation is provided locally at the standby liquid control tank consisting of solution temperature indication and control, tank level, and heater status.
3.8.4 Safety Evaluation 3.8.4.1 Reactivity Control The Standby Liquid Control System is a special safety system not required for normal plant operation, and is never expected to be needed for reactor shutdown because of the large number of control rods available to shut down the reactor.
The system is designed to make the reactor subcritical from rated power to a cold shutdown (MODE 4) at any time in core life. The reactivity compensation provided will reduce reactor power from rated to the after-heat level and allow cooling the nuclear system to normal temperature with the control rods remaining withdrawn in the rated power pattern. It includes the reactivity gains due to complete decay of the rated power xenon inventory. It also includes the positive reactivity effects from eliminating steam voids, changing water density from hot to cold, reduced Doppler effect in uranium, reduction of neutron leakage from the boiling to cold condition,
BFN-28 3.8-6 and decreasing control rod worth as the moderator cools. A licensing analysis is performed each cycle to verify adequate SLCS shutdown capacity. The analysis assumes the specified minimum final concentration of boron in the reactor core and allows for calculational uncertainties. The SLCS shutdown capacity is reported in Appendix N.
The specified minimum average concentration of natural boron in the reactor to provide the specified shutdown margin, after operation of the Standby Liquid Control System, is 720 ppm (parts per million). The minimum quantity of sodium pentaborate to be injected into the reactor is calculated based on the required 720 ppm average concentration in the reactor coolant, Boron-10 enrichment, the quantity of reactor coolant in the reactor vessel, recirculation loops, and the entire RHR system in the shutdown cooling mode, at 70F and reactor normal water level.
The result is increased by 25 percent to allow for imperfect mixing, leakage, and volume in other piping connected to the reactor. This minimum concentration is achieved by preparing the solution as defined in paragraph 3.8.3 and maintaining it above saturation temperature. This satisfies safety design basis 5.
Cooldown of the nuclear system will take several hours, at a minimum, to remove the thermal energy stored in the reactor, cooling water, and associated equipment, and to remove most of the radioactive decay heat. The controlled limit for the reactor coolant temperature cooldown is 100F per hour. Normal operating temperature is about 550F. Usually, shutting down the plant with the main condenser and various shutdown cooling systems will take 10 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before the reactor vessel is opened, and much longer to reach room temperature (70F). The addition of RHR shutdown cooling volume results in the dilution of the dissolved boron. Therefore, the pressure at which RHR shutdown cooling is activated represents the point of maximum reactivity, when the control rods are still withdrawn, and is the point which requires the maximum boron. Analyses are performed to bound the saturation temperature at this pressure using the equivalent of 720 ppm at 70 F. Analyses demonstrating that adequate shutdown capability exists under these conditions ensure that safety design basis 2 is met.
The specified boron injection rate is limited to the range of 7 to 40 ppm per minute change of boron concentration in the reactor pressure vessel and recirculation loop piping water volumes. The lower rate ensures that the boron is injected into the reactor in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, which is considerably faster than the cooldown rate.
The upper limit injection rate insures that there is sufficient mixing such that the boron does not recirculate through the core in uneven concentrations which could possibly cause asymmetric power oscillations in the core. This satisfies safety design basis 3.
BFN-27 3.8-7 3.8.4.2 Suppression Pool pH Control The Standby Liquid Control System is required to supply sodium pentaborate solution for post-LOCA events that involve fuel damage to maintain the suppression pool pH at or above 7.0. The radiological dose analysis for the DBA LOCA assumes concentrations of iodine species consistent with a suppression pool pH at or above 7.0 (i.e., re-evolution of iodine to the containment atmosphere is not considered).
The quantity of sodium pentaborate necessary to offset the post-LOCA production of acid and maintain the suppression pool pH at or above 7.0 has been documented as part of the LOCA radiological dose analysis. This quantity is maintained in the storage tank as specified in the technical specifications. Maintaining the suppression pool pH at or above 7.0 is a concern following a DBA LOCA involving fuel damage. With a LOCA involving a recirculation pipe break, there will be sufficient flow from the ECCS systems through the reactor vessel and out of the break to transport the buffering agent to the suppression pool. The calculation methodology for suppression pool pH control was based on the approach outlined in NUREG-1465 and NUREG/CR-5950. The design inputs were conservatively established to maximize the post-LOCA production of acids and to minimize the post-LOCA production and/or addition of bases. Other design input values such as initial suppression pool volume and pH were selected to minimize the calculated pH.
It is expected that the initial effects on post-accident suppression pool pH will come from rapid fission product transport and the formation of cesium compounds, which would result in increasing the suppression pool pH. However, cesium compounds are not credited in the long-term pH analyses and the determination of the final (30 day) pH value. As radiolytic production of nitric acid and hydrochloric acid proceeds, and these acids are transported to the pool over the first days of the event, the pH would become more acidic.
The buffering effect of sodium pentaborate solution injection within several hours is sufficient to offset the affects of these acids that are transported to the suppression pool. In these events, the addition of a buffering agent to the suppression pool offsets the radiolysis production of acids. This satisfies safety design basis 8.
3.8.4.3 System Safety Evaluation The Standby Liquid Control System is classified as a special safety system. To assure the availability of the Standby Liquid Control System, two sets of the components required to actuate the pumps and explosive valves are provided in parallel for redundancy (safety design basis 6).
BFN-28 3.8-8 The SLC components required for the performance of the safety-related suppression pool pH control function are qualified for the post-LOCA environmental conditions they will be subjected to during the performance of this function.
The Standby Liquid Control System is designed as a Class I system for withstanding the specified earthquake loadings (see Appendix C). Nonprocess equipment such as the test tank is designed as Class II. The system piping and equipment are designed, installed, and tested in accordance with USAS B31.1.0,Section I.
For the reactivity control function, the Standby Liquid Control System is not required to be designed to meet the single failure criterion because it serves as a backup to the control rods. System reliability is enhanced by providing redundancy of pumps and valves. Hence, redundancy is not required for the tank heater or the heating cable.
For the suppression pool pH control function, the SLC system does not completely meet the single failure criteria with regard to the containment isolation check valves and the main control room selector switch. Although a single failure to open one of the two check valves could prevent SLC injection, the potential for failure is very low based on the quality as established by its procurement as an ASME,Section III, Class 2 safety-related valve, periodic testing and inspection, and historical performance of the component. Also, although a failure of the selector switch in the main control room could prevent either train or both trains of injection from functioning, the switch is a highly reliable component at an accessible location. The switch could be easily replaced or bypassed to start one of the SLC trains if it were to fail.
The Standby Liquid Control System is required to be operable in the event of a station power failure so the pumps, valves, and controls are powered from the standby AC power supply in the absence of normal power. The pumps and valves are powered and controlled from separate buses and circuits so that a single failure affecting power supply will not prevent system operation. The essential instruments and lights are powered from the 120-V AC instrument power supply.
The Standby Liquid Control System and pumps have sufficient pressure margin, up to the system relief valve nominal setting of 1425 psig, to assure solution injection into the reactor at a pressure of at least three percent above the lowest setpoint of the main steam relief valves (1174 psig). The nuclear system is protected from overpressurization during operation of the Standby Liquid Control System positive displacements pumps by the nuclear system main steam relief valves.
For the Standby Liquid Control System suppression pool pH function, this operating condition is consistent with other two train systems. Although the Standby Liquid Control System is not strictly a two train system, active components most
BFN-27 3.8-9 susceptible to failure (e.g., pumps and squib valves) are redundant which provides additional assurance that most single failures will not impede the ability of the system to perform its function. Only one of the two standby liquid control pumps is needed for proper system operation. If one pump is inoperable, there is no immediate threat to shutdown capability, and reactor operation may continue while repairs are being made. The system pumps are powered by a diesel backed source and are not load shed. The period during which one redundant component upstream of the explosive valves may be out of operation will be consistent with the very small probability of failure of both the control rod shutdown capability and the alternate component in the Standby Liquid Control System, together with the fact that nuclear system cooldown takes 10 or more hours while liquid control solution injection takes less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. This indicates the considerable time available for testing and restoring the Standby Liquid Control System to operable condition after testing while reactor operation continues. Assurance that the system will still fulfill its function during repairs is obtained by demonstrating operation of the operable pump.
It can be seen that the Standby Liquid Control System satisfies safety design basis 1.
3.8.4.4 Quality Assurance The equipment that performs the special safety functions of the Standby Liquid Control System (provide a backup method to make the reactor subcritical and provide sufficient buffering agent to maintain the suppression pool pH at or above 7.0 following a DBA LOCA involving fuel damage) are classified as quality related.
As delineated by condition of the Units 1, 2, and 3 BFN Operating Licenses, the Augmented Quality Program for the Standby Liquid Control System provides the quality control elements to ensure component reliability for the required alternative source term function as governed by the BFN Quality Assurance Program.
3.8.5 Inspection and Testing Operational testing of the Standby Liquid Control System is performed in at least two parts to avoid injecting boron into the reactor inadvertently. By opening two closed valves to the solution tank, the boron solution may be recirculated by turning on either pump with its local switch. With the valves to and from the solution tank closed and the three valves opened to and from the test tank, the demineralized water in the test tank can be recirculated by turning on either pump locally. After pumping boron solution, demineralized water is pumped to flush out the pumps and pipes. Functional testing of the injection portion of the system is accomplished by closing the open valve from the solution tank, opening the closed valve from the test tank, and actuating the switch in the control room to either the A or B circuit. This starts one pump and ignites one of the explosive actuated injection valves to open.
BFN-27 3.8-10 The lights and alarms in the control room indicate that the system is functioning.
This satisfies safety design basis 4.
After the functional test, the affected injection valve and explosive charge must be replaced and all the valves returned to their normal positions as indicated in Figures 3.8-1, 3.8-2, 3.8-3, 3.8-5, and 3.8-6.
By closing a local normally open valve to the reactor in the containment, leakage through the injection valves can be detected at a test connection in the line between the containment isolation check valves. (A position indicator light in the control room indicates when the local valve is full open and ready for operation.) Leakage from the reactor through the first check valve can be detected by opening the same test connection whenever the reactor is pressurized.
The test tank contains sufficient demineralized water for testing pump operation.
Demineralized water from the makeup or condensate storage system is available at 30 gpm for refilling or flushing the system.
Should the boron solution ever be injected into the reactor, either intentionally or inadvertently, then after making certain that the normal reactivity controls will keep the reactor subcritical, the boron is removed from the reactor coolant system by flushing for gross dilution followed by operation of the reactor cleanup system.
There is practically no effect on reactor operations when the boron concentration has been reduced below about 50 ppm.
The sodium pentaborate solution weight percent in the SLCS storage tank is periodically determined by titration or equivalent chemical analysis. The Boron-10 isotopic atom percent concentration of the solution is also determined periodically, utilizing mass spectrometry or equivalent technology.
The gas pressure in the discharge accumulators is measured periodically to detect leakage. A pressure gauge and portable nitrogen supply are required to test and recharge the accumulators.