ML21286A308

Amendment 29 to Updated Final Safety Analysis Report, Chapter 3, Section 3.4, Reactivity Control Mechanical Design

ML21286A308
Person / Time
Site:	Browns Ferry
Issue date:	10/04/2021
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML21286A574	List: ML21277A142 ML21286A195 ML21286A196 ML21286A197 ML21286A198 ML21286A199 ML21286A200 ML21286A201 ML21286A204 ML21286A205 ML21286A206 ML21286A210 ML21286A211 ML21286A212 ML21286A213 ML21286A216 ML21286A217 ML21286A218 ML21286A219 ML21286A220 ML21286A221 ML21286A222 ML21286A223 ML21286A224 ML21286A225 ML21286A226 ML21286A227 ML21286A229 ML21286A230 ML21286A231 ML21286A232 ML21286A233 ML21286A234 ML21286A235 ML21286A236 ML21286A237 ML21286A238 ML21286A239 ML21286A240 ML21286A241 ML21286A242 ML21286A243 ML21286A244 ML21286A245 ML21286A246 ML21286A247 ML21286A248 ML21286A249 ML21286A250 ML21286A252 ... further results
References
Download: ML21286A308 (34)

Text

BFN-27 3.4 REACTIVITY CONTROL MECHANICAL DESIGN 3.4.1 Safety Objective The safety objective of the reactivity control mechanical design is to provide a means to quickly terminate the nuclear fission process in the core so that damage to the fuel barrier is limited. The objective is met by inserting reactivity control devices into the reactor core.

3.4.2 Power Generation Objective The power generation objective of the reactivity control mechanical design is to provide a means to control power generation in the fuel. This objective is met by positioning reactivity control devices in the reactor core.

3.4.3 Safety Design Basis

1. The reactivity control mechanical design shall include control rods.

a. The control rods shall be so designed and have sufficient mechanical strength to prevent the displacement of their reactivity control material.

b. The control rods shall have sufficient strength and be of such design as to prevent deformation that could inhibit their motion.

c. Each control rod shall include a device to limit its free fall velocity to such a rate that the nuclear system process barrier is not damaged due to a pressure increase caused by the rapid reactivity increase resulting from the free fall of a control rod from its fully inserted position.

2. The reactivity control mechanical design shall provide for a sufficiently rapid insertion of control rods so that no fuel damage results from any abnormal operating transient.

3. The reactivity control mechanical design shall include positioning devices each of which individually support and position a control rod.

4. Each positioning device shall:

a. Prevent its control rod from withdrawing as a result of a single malfunction.

b. Avoid conditions which could prevent its control rod from being inserted.

c. Be individually operated such that a failure in one positioning device does not affect the operation of any other positioning device.

3.4-1

BFN-27

d. Be individually energized when rapid control rod insertion (scram) is signaled so that failure of a power source external to the positioning device does not prevent other control rods from being inserted.

e. Be locked to its control rod to prevent undesirable separation.

f. Provide positive indication of control rod position to the operator.

3.4.4 Power Generation Design Basis

1. The reactivity control mechanical design shall include reactivity control devices (control rods) which shall contain and hold the reactivity control material necessary to control the excess reactivity in the core.

2. The reactivity control mechanical design shall include provisions for adjustment of the control rods to permit control of power generation in the core.

3. The reactivity control mechanical design shall provide indication of the CRDM temperature to the operator.

3.4.5 Description The reactivity control mechanical design consists of control rods which can be positioned in the core, during power operation, by individual control rod drive (CRD) mechanisms.

The CRD mechanisms are part of the CRD System. The CRD System hydraulically operates the CRD mechanisms using water from the condensate storage system as a hydraulic fluid. The CRD mechanisms are used to manually position individual control rods during normal operation but act automatically to rapidly insert all control rods during abnormal (scram) conditions.

The control rods, CRD mechanisms, and that part of the CRD Hydraulic System necessary for scram operation are designed as Class I equipment in accordance with Appendix C, "Structural Qualification of Subsystems and Components."

3.4.5.1 Reactivity Control Devices 3.4.5.1.1 Control Rods The control rods perform the dual function of power shaping and reactivity control.

Power distribution in the core is controlled during operation of the reactor by manipulation of selected patterns of control rods. The control rods are positioned in 3.4-2

BFN-27 a manner which counterbalances steam void effects at the top of the core and results in significant power flattening.

Five General Electric control rod designs and one Westinghouse design are currently approved for use in BFN reactors: (1) Original Equipment, (2) Modified BWR/6, (3) Hybrid I, (4) Marathon, (5) Ultra, and (6) Westinghouse CR-82M-1. All of these control rods are "Matched Worth" designs. The reactivity worth of the replacement control rods is nearly identical to the Original Equipment control rod design so that all the designs can be used interchangeably without affecting lattice physics and core reload analyses or core monitoring software. These control rods are also designed to be interchangeable considering system performance and mechanical fit. A brief description of each design follows.

Original Equipment Control Rod The Original Equipment control rod consists of a sheathed cruciform array of neutron absorber rods consisting of stainless steel tubes filled with boron-carbide powder. The control rods are 9.75 inches in total span and are located uniformly through the core on a 12-inch pitch. Each control rod is surrounded by four fuel assemblies.

The main structural member of a control rod is made of type 304 stainless steel and consists of a top casting which incorporates a handle, a bottom casting which incorporates a velocity limiter and control rod drive coupling, a vertical cruciform center post, and four U-shaped absorber tube sheaths. The two end castings and the center post are welded into a single skeletal structure. The U-shaped sheaths are resistance welded to the center post and castings to form a rigid housing to contain the neutron absorber rods. Rollers or spacer pads at the top and the rollers at the bottom of the control rod provide guidance for the control rod as it is inserted and withdrawn from the core. The control rods are cooled by the fuel assembly bypass flow. The U-shaped sheaths are perforated to allow the coolant to freely circulate about the absorber tubes. Operating experience has shown that control rods constructed as described above are not susceptible to dimensional distortions, as required by safety design basis 1.b.

The boron-carbide (B4C) powder in the stainless steel absorber tubes is compacted to about 70 percent of its theoretical density; the boron-carbide contains a minimum of 76.5 percent by weight natural boron. The Boron-10 (B-10) content of the boron is 18.0 percent by weight minimum. The absorber tubes are made of type 304 or a high purity type 348 stainless steel. An absorber tube is 0.188 inch in outside diameter and has a 0.025 inch wall thickness (Figure 3.4-2). An absorber tube is sealed by a plug welded into each end. The boron-carbide is separated longitudinally into individual compartments by stainless steel balls at approximately 16-inch intervals. The steel balls are held in place by a slight crimp of the tube.

Should the boron-carbide tend to compact further in service, the steel balls will distribute the resulting voids over the length of the absorber tube.

3.4-3

BFN-27 The end of control blade life occurs when any quarter segment of the control blade reaches a 10-percent reduction in relative reactivity worth. The reduction in blade worth is due to a combination of Boron-10 depletion and boron carbide loss resulting from cracking of the absorber rod tubes. The mechanism identified as causing the tube failures is B4C swelling resulting in stress corrosion cracking. Given sufficient exposure, the B4C swelling may initiate small stress corrosion cracks on the tube surface. Examinations of high exposure blades have shown that these surface cracks may exist at average segment Boron-10 depletions greater than 20 percent.

Ultimately, the cracks will propagate through the tube wall allowing reactor coolant to enter the tube. In this condition, B4C can be leached out slowly by the reactor coolant, resulting in a loss of control blade worth. Examinations have shown that the combination of Boron-10 depletion and loss of B4C result in a 10-percent reduction in relative control blade worth at approximately 34 percent average Boron-10 depletion. This is the defined end of useful blade life for the standard all B4C control blades.1 Modified BWR/6 Control Rod The Modified BWR/6 control rods differ from the Original Equipment blades by having increased wing thickness, increased neutron absorber, and a double bail handle (Figure 3.4-1). The absorber tubes have a 0.220 inch outside diameter and a 0.027 inch wall thickness. The BWR/6 control rods have been modified with replacement pins and rollers made from low-cobalt materials and sized for BWR/4 application. Cobalt reduction is desirable to reduce activation products within the reactor system and to reduce radiation levels of spent control rods. The design blade life for the BWR/6 control rods is 34 percent average Boron-10 depletion, which is the same as for the Original Equipment blades.

Hybrid I Control Rod Hybrid I Control Rod (HICR) assemblies contain improved B4C absorber rod material to eliminate cracking during assembly lifetime.2,3 Also in the HICR design, the three outermost absorber tubes in each wing are replaced with solid hafnium rods which increase blade lifetime compared to standard all-B4C control blades. End-of-life boron equivalent depletion for the HICRs is 56 percent for any quarter segment of the control blade.

2 Safety Evaluation of General Electric Hybride I Control Rod Assembly, NEDE-22290-A, September 1983.

3 General Electric BWR Control Rod Lifetime, NEDE-30931-P, March 1985.

3.4-4

BFN-27 Marathon Control Rod The Marathon control rod (Figure 3.4-12) differs from the preceding designs by replacement of the absorber tube and sheath arrangement with an array of square tubes, which results in reduced weight and increased absorber volume4. The square tubes are fabricated from a high purity stabilized Type-304 stainless steel that provides high resistance to irradiation-assisted stress corrosion cracking. The absorber tubes are welded lengthwise to form the four wings of the control rod. For the BFN BWR/4 D-lattice design, each wing is comprised of 14 absorber tubes. The absorber tubes each act as an individual pressure chamber for the retention of helium which is produced during neutron absorption reactions. The four wings are welded to a central tie rod to form the cruciform-shaped member of the control rod.

The square tubes are circular inside and are loaded with either B4C or hafnium. The absorber tubes have an inside diameter of 0.250 inches and a nominal wall thickness of 0.024 inches. The B4C is contained in separate capsules to prevent its migration. The capsules are placed inside the absorber tubes and are smaller than the absorber tube inside diameter, allowing the B4C to swell before it makes contact with the absorber tubes thereby providing improved resistance to stress corrosion.

The B4C capsules are fabricated from stainless steel tubing and have stainless steel caps attached by rolling the tubing into grooves in the caps. The capsules are loaded into the individual absorber tubes, which are then sealed at each end by welded end caps. The capsules securely contain the B4C while allowing the helium to migrate through the absorber tube.

The Marathon design offers increased blade lifetimes due to the increased absorber loading and absorber tube design improvements. The Marathon blades have a quarter segment, end-of-life Boron-10 equivalent depletion limit of 68 percent.

Ultra Control Rod The GEH manufactured Ultra MD and Ultra HD control rods (formerly known as Marathon-5S and Marathon-Ultra, respectively) are similar to the original Marathon design shown in Figure 3.4-12. The NRC acceptance of the Marathon-5S and Marathon-Ultra Control Rods is documented by Licensing Topical Reports (LTRs). 9,10 .The Ultra MD Control Rod consist of simplified absorber tubes, edge welded together to form the control rod wings, and welded to a full-length tie rod to form the cruciform assembly shape. The absorber tubes are filled with a combination of boron carbide (B4C) capsules, and empty capsules. The Ultra HD 9 NEDE-33284P-A Rev. 2, Marathon-5S Control Rod Assembly, October 2009.

10 NEDE-33284 Supplement 1P-A Rev. 1, Marathon-Ultra Control Rod Assembly, March 2012.

3.4-5

BFN-27 Control Rod is a derivative version of the Ultra MD Control Rod in that it uses an identical outage structure. The only differences for the Ultra HD Control Rod is the inclusion of full length hafnium rods in high-depletion absorber tubes, and the use of a then-wall boron carbine capsule, similar in geometry to the previous Marathon control rod design. 4 The original Marathon design was intended to reduce stress/strain associated with B4C swelling. The Ultra MD and Ultra HD designs were developed to eliminate stress/strain associated with B4C swelling to prevent end of life cracking issues. The Ultra MD and Ultra HD blades have quarter segment, end-of-life Boron-10 equivalent depletion limit of less than 57 percent to 67 percent, respectively.

Westinghouse CR-82M-1 Control Rod The Westinghouse CR-82M-1 control rod (Figure 3.4-13) consists of four stainless steel sheets welded together to form the cruciform shaped rod.5,6 Each sheet has horizontally drilled holes to contain the absorber materials (boron carbide powder and hafnium). The hafnium tip of the CR-82M-1 design protects the control rod from absorber material swelling when operated in the fully withdrawn position. The blade material used in the CR-82M-1 design is AISI 316L stainless steel. AISI 316L stainless steel as structural material is an irradiation resistant steel not readily sensitized to irradiation assisted stress corrosion cracking, and also has an extremely low cobalt content (< 0.02 percent). The design with horizontally drilled absorber holes limits the washout of boron carbide in case of a defect in a wing, thus maintaining full reactivity worth.

The absorber hole geometry for the Westinghouse CR-82M-1 control rod is optimized to provide a matched worth (within 5 percent) to the initial worth of an original equipment control rod. The nuclear end-of-life (10 percent worth decrease from initial original equipment value) depletion limits for the CR-82M-1 design are:

85 percent equivalent Boron-10 depletion for the top quarter segment, and 89 percent equivalent Boron-10 depletion for the other quarter segments. [Note:

These are equivalent depletion limits developed to allow the utility to monitor the CR-82M-1 control rod as if it were an original equipment control rod.

Conclusion Thus, the control rods and absorber tubes meet the requirements of safety design basis 1.a.

3.4-6

BFN-27 3.4.5.1.2 Control Rod Velocity Limiter (Figures 3.4-3 and 3.4-4)

The control rod velocity limiter is an integral part of the bottom assembly of each control rod. This static engineered safeguard protects against a high reactivity insertion rate by limiting the control rod velocity in the event of a control rod drop accident. It is a one way device, in that the control rod scram velocity is not significantly affected but the control rod dropout velocity is reduced to a permissible limit.

The velocity limiter is in the form of two nearly mated conical elements that act as a large clearance piston and baffle inside the control rod guide tube over the length of the control rod stroke.

It is fabricated of type 304 stainless steel. It has a nominal diameter of approximately 9.2 inches, and is fitted inside the control rod guide tube which has an inside diameter of 10.4 inches. This configuration results in an annulus between the limiter and the guide tube of approximately 0.6 inch. The limiter always remains in the guide tube except when the control rod is removed. Four adjacent fuel assemblies and the fuel assembly support casting must be removed before the control rod can be removed because of the shape of the velocity limiter.

The hydraulic drag forces on a control rod are approximately proportional to the square of the rod velocity and are negligible during normal rod withdrawal or rod insertion. However, during the scram stroke the rod reaches high velocity and the drag forces could become appreciable.

In order to limit control rod velocity during dropout but not during scram, the velocity limiter is provided with a streamlined profile in the scram (upward) direction. Thus, when the control rod is scrammed, the velocity limiter assembly offers little resistance to the flow of water over the smooth surface of the upper conical element into the annulus between the guide tube and the limiter. In the dropout direction, however, water is trapped by the lower conical element and discharged through the annulus between the two conical sections. Because this water is jetted in a partially reversed direction into water flowing upward in the annulus, a severe turbulence is created, thereby slowing the descent of the control rod assembly to less than 5 ft/sec at 70 degrees F.7 3.4.5.2 Control Rod Drive Mechanisms (Figures 3.4-3, 3.4-5, 3.4-6, and 3.4-9)

The CRD mechanism (drive), used for positioning the control rod in the reactor core, is a double-acting, mechanically latched, hydraulic cylinder using water from the condensate storage system as its operating fluid. The individual drives are mounted on the bottom head of the reactor pressure vessel. Each drive is an integral unit contained in a housing extending below the reactor vessel. The lower end of each 3.4-7

BFN-27 drive housing terminates in a flange to which the drive is bolted. The drives do not interfere with refueling and are operative even when the head is removed from the reactor vessel. The bottom location makes maximum utilization of the water in the reactor as a neutron shield giving the least possible neutron exposure to the drive components. The use of reactor water from the condensate storage system as the operating fluid eliminates the need for special hydraulic fluid. Drives utilize simple piston seals whose leakage does not contaminate the reactor vessel and helps cool the drive mechanisms.

The drives are capable of inserting or withdrawing a control rod at a slow controlled rate for reactor power level adjustment, as well as providing rapid insertion when required. A locking mechanism on the drive allows the control rod to be locked at every six inches of stroke over the twelve foot length of the core.

A coupling at the top end of the drive index tube (piston rod) engages and locks into a mating socket at the base of the control rod. The weight of the control rod is sufficient to engage and lock this coupling. Once locked, the drive and rod form an integral unit which must be manually unlocked by specific procedures before a drive and its rod can be separated; this prevents accidental separation of a control rod from its drive.

Each drive positions its control rod in 6-inch increments of stroke and holds it in these distinct latch positions until actuated by the hydraulic system for movement to a new position. Indication is provided for each rod that shows when the insert travel limit or withdraw travel limit is reached.

An alarm annunciates when withdraw overtravel limit on the drive is reached.

Normally, the control rod seating at the lower end of its stroke prevents the drive withdraw overtravel limit from being reached. If the drive can reach the withdrawal overtravel limit, it indicates that the control rod is uncoupled from its drive. The overtravel limit alarm allows the coupling to be checked.

Individual rod position indicators are grouped together on the control panel in one display and correspond to the relative rod location in the core. Each rod indicator gives continuous rod position indication in digital form. A separate, smaller display is located just below the large display on the vertical part of the bench board. This display presents the positions of the control rod selected for movement and the other rods in the rod group. For display purposes the control rods are considered in groups of four adjacent rods centered around a common core volume monitored by four LPRM strings. Rod groups at the periphery of the core may have less than four rods. The small rod display shows the positions in digital form of the rods in the group to which the selected rod belongs. A white light indicates which of the four rods is the one selected for movement.

3.4-8

BFN-27 3.4.5.2.1 Components Figure 3.4-5 illustrates the principles of operation of a drive. Figures 3.4-6, 3.4-9 and 3.4-9a illustrate the drive in more detail. Currently BWR/6 drives (Figure 3.4-9a) obtained from Hartsville Nuclear Plant and modified by General Electric are acceptable replacements for BWR/4 drives (Figures 3.4-6 and 3.4-9). BWR/6 drives are currently in use at Browns Ferry Nuclear Plant. Throughout the following sections, details for the BWR/4 drives are being maintained for historical purposes.

Following is a description of the main components of the drive and their functions.

Drive Piston and Index Tube The drive piston is mounted at the lower end of the index tube which functions as a piston rod. The drive piston and index tube make up the main moving assembly in the drive. The drive piston operates between positive end stops, with a hydraulic cushion provided at the upper end only. The piston has both inside and outside seal rings and operates in an annular space between an inner cylinder (fixed piston tube) and an outer cylinder (drive cylinder).

The effective piston area for down-travel or withdraw is about 1.2 square inches versus 4.0 square inches for up-travel or insertion. This difference in driving area tends to balance out the control rod weight and makes it possible to always have a higher insertion force than withdrawal force.

The index tube is a long hollow shaft made of nitrided type 304 stainless steel (XM-19 for BWR/6 drives). Any index tubes which are found to need replacing during normal CRD maintenance are replaced by index tubes of identical design made of Grade XM-19 stainless steel. This tube has circumferential locking grooves spaced every 6 inches along the outer surface. These grooves transmit the weight of the control rod to the collet assembly.

Collet Assembly The collet assembly serves as the index tube locking mechanism. It is located in the upper part of the drive unit. The collet assembly prevents the index tube from accidentally moving downward. The collet assembly consists of the collet fingers, a return spring, a guide cap, a collet housing (part of the cylinder, tube, and flange assembly), and the collet piston seals.

Locking is accomplished by six fingers mounted on the collet piston at the top of the drive cylinder. In the locked or latched position, the fingers engage a locking groove in the index tube.

3.4-9

BFN-27 The collet piston is normally held in the latched position by a return spring force of approximately 150 pounds. Metal piston rings are used to seal the collet piston from reactor vessel pressure. The collet assembly will not unlatch until the collet fingers are unloaded by a short, automatically sequenced, drive in signal. A pressure of approximately 180 psi above reactor vessel pressure acting on the collet piston is required to overcome spring force, slide the collet up against the conical surface in the guide cap, and spread the fingers out so that they do not engage a locking groove. The collet piston is nitrided to minimize wear due to rubbing against the surrounding cylinder surfaces.

Fixed in the upper end of the drive assembly is a guide cap. This member provides the unlocking cam surface for the collet fingers. It also serves as the upper bushing for the index tube and is nitrided to provide a compatible bearing surface for the index tube.

As reactor water is used to supplement accumulator pressure during a scram, it is drawn through a filter on the guide cap.

Piston Tube and Stop Piston Extending upward inside the drive piston and index tube is an inner cylinder or column called the piston tube. The piston tube is fixed to the bottom flange of the drive and remains stationary. Water is brought to the upper side of the drive piston through this tube. A series of orifices at the top of the tube combined with drive seals and bushings provides progressive water shutoff to cushion the drive piston at the end of its scram stroke.

A stationary piston, called the stop piston, is mounted on the upper end of the piston tube. This piston provides the seal between reactor vessel pressure and the space above the drive piston. It also functions as a positive end stop at the upper limit of control rod travel. A stack of spring washers just below the stop piston helps absorb the final mechanical shock at the end of control rod travel on the BWR/4 design. In the BWR/6 design a buffer piston is included between the drive piston and the stop piston. This isolates the higher pressures from the drive piston seals during the deceleration phase of the scram stroke. The piston rings are similar to the outer drive piston rings. A bleed-off passage to the center of the piston tube is located between the two pairs of rings. This arrangement allows seal leakage from the reactor vessel (during a scram) to be bled directly to the discharge line, rather than to the space above the drive piston. The lower pair of seals is used only during the cushioning of the drive piston at the upper end of the stroke.

Position Indicator The center tube of the drive mechanism forms a well to contain the position indicator probe. The position indicator probe is an aluminum extrusion attached to a cast 3.4-10

BFN-27 aluminum housing. Mounted on the extrusion are a series of hermetically sealed, magnetically operated, position indicator switches. Each switch is sheathed in a braided glass sleeve, and the entire probe assembly is protected by a thin-walled stainless steel tube. The switches are actuated by a ring magnet of Alnico S carried at the bottom of the drive piston. The drive piston, piston tube, and indicator tube are all of nonmagnetic stainless steel, allowing the individual switches to be operated by the magnet as the piston passes. One switch is located at each position corresponding to an index tube groove, thus allowing indication at each latching point. An additional switch is located at each midpoint between latching points, allowing indication of the intermediate positions during drive motion. Thus, indication is provided for each 3 inches of travel. Duplicate switches are provided for the full-in and full-out positions. One additional switch (an overtravel switch) is located at a position below the normal full-out position. Because the limit of down-travel is normally provided by the control rod itself as it reaches the backseat position, the index tube can pass this position and actuate the overtravel switch only if it is uncoupled from its control rod. A convenient means is thus provided to verify that the drive and control rod are coupled after installation of a drive or at any time during plant operation. A thermocouple is located in each position indicator to indicate drive mechanism temperature in the control room. This satisfies safety design basis 4.f.

Cylinder, Tube, and Flange Assembly The cylinder, tube, and flange assembly consists of an inner cylinder, outer tube, and a flange. Both the cylinder tube and outer tube are welded to the drive flange.

The tops of these tubes have a sliding fit to allow for differential expansion.

A sealing surface on the upper face of this flange is used in making the seal to the drive housing flange. Teflon-coated, stainless steel "O" rings are used for these seals. In addition to the reactor vessel seal, the two hydraulic control lines to the drive are sealed at this face. A drive can thus be replaced without removing the control lines, which are permanently welded into the housing flange. The drive flange contains the integral ball or two-way check (shuttle) valve. This valve is so situated as to direct reactor vessel pressure or driving pressure, whichever is higher, to the underside of the drive piston. Reactor vessel pressure is admitted to this valve from the annular space between the drive and drive housing through passages in the flange. A screen is provided to intercept foreign material at this point. A cooling water orifice, adjacent to the insert port of the flange, permits cooling water flow from the CRD through the annulus formed by the CRD outer tube and the thermal sleeve in the CRD housing.

Water used to operate the collet piston passes between the outer tube and the cylinder tube. The inside of the cylinder tube is honed to provide the surface required for the drive piston seals.

3.4-11

BFN-27 Coupling Spud, Plug, and Unlocking Tube The upper end of the index tube is threaded to receive a coupling spud. The coupling (Figure 3.4-3) is designed to accommodate a small amount of angular misalignment between the drive and the control rod. Six spring fingers allow the coupling spud to enter the mating socket on the control rod. The control rod weight (approximately 250 pounds) is sufficient to force the spud fingers to enter the socket and push the lock plug up, allowing the spud to enter the socket completely and the plug to snap back into place. However, with the lock plug in place, a force in excess of 50,000 pounds is required to pull the coupling apart.

Two means of uncoupling are provided. With the reactor vessel head removed, the lock plug may be raised against the spring force of approximately 50 pounds by a rod extending up through the center of the control rod to an unlocking handle located above the control rod velocity limiter. The control rod, with the lock plug raised, can then be separated from the drive. The lock plug may also be pushed up from below to uncouple a drive without removing the reactor pressure vessel head for access to change a CRD drive or perform maintenance or inspections. In this case, the central portion of the drive mechanism is pushed up against the uncoupling rod assembly which raises the lock plug and allows the coupling spud to disengage the socket as the drive piston and index tube are driven down.

The coupling spud and locking tube meet the requirements of safety design basis 4.e.

3.4.5.2.2 Materials of Construction Factors determining the choice of materials are listed below:

a. The index tube must withstand the locking and unlocking action of the collet fingers. A compatible bearing combination must be provided which is able to withstand moderate misalignment forces. The reactor environment limits the choice of materials suitable for corrosion resistance. The column and tensile loads can be satisfied by an annealed 300 series stainless steel. The wear and bearing requirements are provided by Malcomizing the completed tube.

To obtain suitable corrosion resistance, a carefully controlled process of surface preparation is employed. Index tubes for BWR/6 drives and replacement index tubes are made of XM-19.

b. The coupling spud is made of Inconel 750 which is aged to produce maximum physical strength and also provide the required corrosion resistance. As misalignment tends to produce a chafing in the semispherical contact area, the entire part is protected by a thin vapor-deposited chromium plating (Electrolyzing). This plating also serves to prevent galling of the threads attaching the coupling spud to the index tube.

3.4-12

BFN-27

c. Inconel 750 is used for the collet fingers, which must function as leaf springs when cammed open to the unlocked position. Colmonoy 6 hard facing is applied to the area contacting the index tube and unlocking cam surface of the guide cap to provide a long-wearing surface adequate for design life.

d. For BWR/4 CRDs, Graphitar 14 is selected for seals and bushings on the drive piston and stop piston. The material is inert and has a low friction coefficient when water lubricated.

For BWR/6 CRDs, a composite material of nickel, chrome, graphite and resin is selected for seals and bushings on the drive piston and stop piston. The material reduces the leakage due to excessive wear or premature breakage.

The drive is supplied with cooling water to normally hold temperatures below 250 degree F. The CRD high temperature alarm set point is 350 degrees F based on the BWR/6 seals and bushings being more temperature resistant than the BWR/4 seals.

The Graphitar is relatively soft, which is advantageous when an occasional particle of foreign matter reaches a seal. The resulting scratches in the seal reduce sealing efficiency until worn smooth, but the drive design can tolerate considerable water leakage past the seals into the reactor vessel. These seals determine the service life of the CRDM.

All drive components exposed to reactor vessel water are made of AISI 300 series stainless steel except the following:

a. Seals and bushings on the drive piston and stop piston are Graphitar 14. For later model BWR/6 CRDs, seals and bushings on the drive piston and stop piston are a composite material of nickel, chrome, graphite and resin.

b. All springs and members requiring spring-action (collet fingers, coupling spud, and spring washers) are made of Inconel 750.

c. The ball check valve is a Haynes Stellite cobalt-base alloy.

d. Elastometric 0-ring seals are ethylene propylene.

e. Collet piston rings are Haynes 25 alloy.

f. Certain wear surfaces are hard faced with Colmonoy 6.

g. Nitriding by a proprietary New Malcomizing process, Electrolyzing (a vapor deposition of chromium), and chromium plating are used in certain areas where resistance to abrasion is necessary.

3.4-13

BFN-27

h. The drive piston head is made of Armco 17-4Ph.

i. Replacement index tubes and piston tubes are made of grade XM-19 stainless steel.

j. BWR/6 drives also use XM-19 for the index tubes and piston tubes.

k. The buffer assembly for BWR/6 CRDs consists of the stop piston, buffer piston, seal ring, nut, locking cup and the buffer shaft which is secured to the top of the piston tube assembly. The materials used to fabricate these components are Inconel X-750, Inconel-600, Armco 17-4PH and Haynes 25.

Pressure containing portions of the drives are designed and built in accordance with the requirements of Section III of the ASME Boiler and Pressure Vessel Code.

3.4.5.3 Control Rod Drive Hydraulic System (Figures 3.4-8a Sheets 1, 2, 3, 4 and 5, 3.4-8b, 3.4-8c, 3.4-8d, 3.4-8e, 3.4-8f, 3.4-8g, and 3.4-8h)

The Control Rod Drive Hydraulic System supplies and controls the pressure and flow requirements to the drives.

There is one supply subsystem which supplies water at the proper pressures and sufficient flow to the hydraulic control units (HCU's). Each HCU controls the flow to and from a drive. The water discharged from the drives during a scram flows through the HCU's to the scram discharge volume. The water discharged from a drive, during a normal control rod positioning operation, flows through its HCU and into the exhaust header. The discharged water then backflows through the other 184 CRD exhaust valves into the reactor vessel via the cooling water header.

3.4.5.3.1 CRD Hydraulic Supply and Discharge Subsystems (Figures 3.4-7, 3.4-8a Sheets 1, 2, 3, 4 and 5, 3.4-8c, 3.4-8d, 3.4-8e, 3.4-8f, 3.4-8g and 3.4-8h)

The CRD hydraulic supply and discharge subsystems control the pressure and flows required for the operation of the control rod drive mechanisms. These hydraulic requirements identified by the function they perform are as follows:

a. An accumulator charging pressure of approximately 1400 to 1500 psig is required. Flow is required only during scram reset or during system startup.

b. Drive pressure of about 260 psi above reactor vessel pressure is required at a flow rate of approximately 4 gpm to insert a control rod and 2 gpm to withdraw a control rod during normal operation.

3.4-14

BFN-27

c. Cooling water to the drives is normally supplied at pressures greater than reactor pressure and at adequate flow rate to prevent drive component degradation due to elevated temperatures.

d. The exhaust water header is maintained at a pressure about 20 psig above vessel pressure to direct the flow of the water displaced during normal control operation of the drives back into the reactor vessel by backflowing through the other 184 CRD exhaust valves.

e. A scram discharge volume of approximately 3.3 gallons per drive to receive the water displaced from the drives during a scram is required. The scram discharge volume is vented and drained except during scram when it is isolated and filled with scram water until the scram signal is cleared and the scram reset. The scram discharge volume will reach reactor pressure following a scram.

The CRD hydraulic supply and discharge subsystems provide the required functions with the pumps, filters, valves, instrumentation, and piping shown in Figures 3.4-8a sheets 1, 2, 3, and 4, 3.4-8b, 3.4-8c, 3.4-8d, 3.4-8e, and 3.4-8f and described in the following paragraphs. Duplicate components are included, where necessary, to assure continuous system operation if an in-service component requires maintenance.

Pumps One 100 percent capacity supply pump is provided for each unit to pressurize the system with water from the condensate storage system. One common 100 percent capacity spare pump is provided for Units 1 and 2. It can supply water to either control rod drive hydraulic systems. Unit 3's system is separate and has one spare 100 percent capacity pump. Change over (or selection) of the pumps is performed manually, either locally or from the main control room. Each pump is installed with a suction strainer and a discharge check valve to prevent bypassing flow backwards through the nonoperating pump.

A minimum flow bypass connection between the discharge of the pumps and the condensate storage tank prevents overheating of the pumps in the event that the pump discharge is inadvertently closed. In addition, a portion of the CRD flow is directed to the recirculation and the reactor water cleanup pump bearing seals for pump seal cooling and Reactor Vessel Level Instrumentation System (RVLIS) reference leg back filler. Pump discharge pressure is indicated locally at the inlet to the drive water filters by a pressure indicator.

Filters 3.4-15

BFN-27 Two parallel filters remove foreign material larger than 50 microns absolute (25 microns nominal) from the hydraulic supply subsystem water. The isolated filter can be drained, cleaned, and vented for reuse while the other is in service. A differential pressure indicator monitors the filter element as it collects foreign material. A strainer in the filter discharge line guards the hydraulic system in the event of filter element failure.

Accumulator Charging Pressure The accumulator charging pressure is maintained automatically by a flow-sensing element, controller, and an air-operated flow control valve. During normal operation, the accumulator charging pressure is established upstream from the flow control valve by the restriction of the flow control valve. During scram, the flow-sensing system upstream of the accumulator charging header detects high flow in the charging header and closes the flow control valve. The flow control valve is closed so that the proper flow to recharge the accumulators is diverted from the hydraulic supply header to the accumulator charging header. The parallel spare valve is provided with isolation valves to permit maintenance of the noncontrolling valve.

The pressure in the charging header is monitored in the control room with a pressure indicator and high pressure alarm.

During normal operation, the constant flow established through the flow control valve is the sum of the maximum water required to cool all the drives and that amount of water needed to provide a stable hydraulic system for insertion and withdrawal of the mechanism.

Drive Water Pressure The drive water pressure control valve, which is manually adjusted from the control room, maintains the required pressure in the drive water header.

A flow rate of approximately 6 gpm (the sum of the flow rates required to insert and to withdraw a control rod) normally passes from the drive water pressure header through two solenoid-operated stabilizing valves (arranged in parallel) and then goes into the line downstream from the cooling pressure control valve. The two solenoid-operated stabilizing valves also have identical, backup function, solenoid-operated stabilizing valves which are selectable from the main control room in the event that the normal path valves become inoperative or require online maintenance. One stabilizing valve passes flow equal to the nominal drive insert flow; the other passes flow equal to the drive withdrawal flow. The appropriate stabilizing valve is closed when operating a drive to divert the required flow to the drive. Thus, the flow through the drive pressure control valve is always constant.

3.4-16

BFN-27 Flow indicators are provided in the drive water header and in the line downstream from the stabilizing valves, so that flow rate through the stabilizing valves can be adjusted. Differential pressure between the reactor vessel and the drive water pressure header is indicated in the control room.

Cooling Water Pressure The cooling water header passes the flow from the drive water pressure control valve through the control rod drives and into the vessel. At normal flow rates, the cooling water header pressure will be approximately 10 to 15 psi above reactor vessel pressure.

A differential pressure indicator in the control room indicates the difference between reactor vessel pressure and the drive cooling water pressure. Although the drives can function without cooling, the life of their seals is shortened by exposure to reactor temperatures.

Exhaust Water Header The exhaust water header takes water discharged during a normal control rod positioning operation and directs it through the other CRD exhaust valves into the reactor vessel. If necessary, the exhaust water may be directed into the reactor vessel via the RWCU system by opening a normally closed valve.

Scram Discharge System The scram discharge system is used to contain the reactor vessel water from all the drives during a scram. This system is provided in the two scram discharge volumes (SDVs) which each drain to a scram discharge instrument volume (SDIV). Water level monitors on the SDIVs provide an alarm if water is retained in the system.

During normal plant operation, the volumes are empty with their drain and vent valves open.

Upon receipt of a scram signal, the drain and vent valves close. Position indicator switches on the drain and vent valves indicate valve position by lights in the control room.

During a scram, the scram discharge volume partially fills with water which is discharged from above the drive pistons. While scrammed, the control rod drive seal leakage continues to flow to the discharge volume until the discharge volume pressure equals reactor vessel pressure. There is a check valve in each HCU which prevents reverse flow from the scram discharge volume to the drive. When the initial scram signal is cleared from the reactor protection system, the scram discharge volume scram signal may be overridden with the override switch and the 3.4-17

BFN-27 scram discharge system drained. A control system interlock will not allow the drives to be withdrawn until the discharge system is emptied to a safe level.

A test pilot valve allows the discharge volume valves to be tested without disturbing the reactor protection system. Closing the discharge volume valves allows the outlet scram valve seats to be leak tested by timing the accumulation of leakage inside the scram discharge volume. As an alternative to the test pilot valve in Units 1, 2 and 3, a key-lock test switch is provided to de-energize each of the SDV Drain and Vent Pilot Solenoid valves. This will allow stroke time testing of SDV Drain and Vent Valves to be performed.

Six level switches on the scram discharge instrument volume, set at three different water levels, guard against operation of the reactor without sufficient free volume present in the scram discharge volume to receive the scram discharge water in the event of a scram. At the first (lowest) level, one level switch initiates an alarm for operator action. At the second level, one level switch initiates a rod withdrawal block to prevent further withdrawal of any control rod. At the third (highest) level, the four level switches (two for each reactor protection system trip system) initiate a scram to shut down the reactor while sufficient free volume is still present to receive the scram discharge. After a scram, these same level switches must be cleared by draining the scram discharge volume before reactor operation can be resumed.

The piping and equipment pressure parts in the CRD hydraulic supply and discharge subsystems are designed in accordance with USAS B 31.1.0.

3.4.5.3.2 Hydraulic Control Units (Figures 3.4-7, 3.4-8a Sheets 2 and 4, 3.4-8c, 3.4-8e, and 3.4-11)

Each hydraulic control unit controls a single CRD. The basic components in each hydraulic control unit are manual, pneumatic and electrically operated valves, an accumulator, filters, related piping, and electrical connections.

Each hydraulic control unit furnishes pressurized water, upon signal, to a control rod drive. The drive then positions its control rod as required. Operation of the electrical system which supplies scram and normal control rod positioning signals to the hydraulic control unit is described in Subsection 7.7, "Reactor Manual Control System."

The basic components contained in each hydraulic control unit and their functions are as follows:

Insert Drive Valve The insert drive valve is a solenoid-operated valve which opens on an insert or withdrawal signal to supply drive water to the bottom side of the main drive piston.

3.4-18

BFN-27 Insert Exhaust Valve The insert exhaust valve is a solenoid-operated valve which opens on an insert or withdrawal signal to discharge water from above the drive piston to the exhaust header.

Withdrawal Drive Valve The withdrawal drive valve is a solenoid-operated valve which opens on a withdrawal signal to supply drive water to the top side of the drive piston.

Withdrawal Exhaust Valve The withdrawal exhaust valve is a solenoid-operated valve which opens on a withdrawal signal to discharge water from below the main drive piston to the exhaust header.

Speed Control Valves The speed control valves, which regulate the control rod insertion and withdrawal rates during normal operation, are manually adjustable flow control valves used to regulate the water flow to and from the volume beneath the main drive piston. Once a speed control valve is properly adjusted, it is not necessary to readjust the valve except to compensate for changes in piston seal leakage.

Scram Pilot Valves The scram pilot valves are operated from the Reactor Protection System Trip System. Two scram pilot valves control both the scram inlet valve and the scram exhaust valve. The scram pilot valves are identical, 3-way, solenoid-operated, normally energized valves. On loss of electrical signal to the pilot valves, the pressure ports are closed and the exhaust ports are opened on both pilot valves.

The pilot valves are arranged as shown in Figures 3.4-7, 3.4-8a sheets 2 and 4, 3.4-8c, and 3.4-8e so that the trip system signal must be removed from both valves before air pressure is discharged from the scram valve operators.

Scram Inlet Valve The scram inlet valve is opened to supply scram water pressure to the bottom of the drive piston. The scram inlet valve is a globe valve which is opened by the force of an internal spring and system pressure and closed by air pressure applied to the top of its diaphragm operator. The opening force of the spring is approximately 700 pounds. The valve opening time is approximately 0.1 second from start to full open.

3.4-19

BFN-27 Scram Exhaust Valve The scram exhaust valve opens slightly before the scram inlet valve, exhausting water from above the drive piston during a scram. Quicker opening times are achieved because of a greater spring force in the valve operator. Otherwise this valve is similar to the scram inlet valve.

The scram inlet and scram exhaust valves have a position indicator switch which energizes a light in the control room as soon as both valves open.

Scram Accumulator The scram accumulator stores sufficient energy to insert a control rod to the fully inserted position during a scram independent of any other source of energy. The accumulator consists of a water volume pressurized by a volume of nitrogen. The accumulator has a piston separating the water on top from the nitrogen below. A check valve in the charging line to each accumulator retains the water in the accumulator in the event supply pressure is lost.

During normal plant operation, the accumulator piston has a differential pressure across it which is equal to the difference in the charging water pressure and the nitrogen cylinder pressure.

Loss of nitrogen causes a decrease in the nitrogen pressure which actuates the pressure switch and sounds an alarm in the control room.

Also, to ensure that the accumulator is always capable of producing a scram it is continuously monitored for water leakage. A float-type level switch actuates an alarm if water leaks past the barrier and collects in the accumulator instrumentation block. The accumulator instrumentation block is located below the accumulator (nitrogen side) in such a way that it will receive any water which leaks past the accumulator piston.

The scram accumulator meets the requirements of safety design basis 4.d.

3.4.5.4 Control Rod Drive System Operation The control rod drive system performs three operational functions: rod insertion, row withdrawal, and scram. The functions are described below.

Rod Insertion Rod insertion is initiated by a signal from the operator to the insert valve solenoids which opens both insert valves. The insert drive valve applies reactor pressure plus 3.4-20

BFN-27 approximately 90 psig to the bottom of the drive piston. The insert exhaust valve allows water from above the drive piston to discharge to the exhaust header.

As is illustrated in Figure 3.4-6, the locking mechanism is a ratchet-type device and does not interfere with rod insertion. The speed at which the drive moves is determined by the pressure drop through the insert speed control valve which is approximately 4 gpm for a shim speed (nonscram operation) of 3 inches per second.

During normal insertion, the pressure on the downstream side of the speed control valve is 90 to 100 psi above reactor vessel pressure. However, if the drive slows down for any reason, the flow through and pressure drop across the insert speed control valve will decrease and the full drive water differential pressure will be available to cause continued insertion. With 250 psi differential pressure acting on the drive piston, the piston exerts an upward force of 1000 pounds.

Rod Withdrawal Drive withdrawal is, by design, more involved. First the collet fingers (latch) must be raised to reach the unlocked position as in Figure 3.4-5. The notches in the index tube and the collet fingers are shaped so that the downward force on the index tube holds the collet fingers in place. The index tube must be lifted before the collet fingers can be released. This is done by opening the drive insert valves (in the manner described in the preceding paragraph) for approximately 1 second using an automatic sequence timer. The withdraw valves are then opened (by the sequence timer mechanism), applying driving pressure above the drive piston and opening the area below the piston to the exhaust header. Pressure is simultaneously applied to the collet piston. As the collet piston raises, the collet fingers are cammed outward, away from the index tube, by the guide cap.

The pressure required to release the latch is set and maintained high enough to overcome the force of the latch return spring plus the force of reactor pressure opposing movement of the collet piston. When this occurs, the index tube is unlatched and free to move in the withdrawal direction. Water displaced by the drive piston flows out through the withdrawal speed control valve which is set to give the control rod a shim withdrawal of approximately 3 inches per second. The entire valving sequence is automatically controlled and is initiated by a single operation of the rod withdraw switch.

Rod Scram During a scram the scram pilot valves and scram valves are operated as previously described. With the scram valves open, accumulator pressure is admitted under the drive piston and the area over the drive piston is vented to the scram discharge volume.

3.4-21

BFN-27 The large differential pressure (initially about 1400 psi and always several hundred psi depending on reactor vessel pressure) produces a large upward force on the index tube and control rod, giving the rod a high initial acceleration and providing a large margin of force to overcome any possible friction. The characteristics of the hydraulic system are such that, after the initial acceleration is achieved (approximately 30 milliseconds after start of motion), the drive continues at a fairly constant velocity of approximately 5 feet per second. This characteristic provides a high initial rod insertion rate. As the drive piston nears the top of its stroke, the piston seals close off the large passage in the stop piston tube and the drive slows down. In the BWR/6 design a buffer piston is included between the drive piston and the stop piston. This isolates the higher pressures from the drive piston seals during the deceleration phase of the scram stroke.

Each drive requires about 2.5 gallons of water during the scram stroke. There is adequate water capacity in each drive's accumulator to complete a scram in the required time at low reactor vessel pressure. At higher reactor vessel pressures, the accumulator is assisted on the upper end of the stroke by reactor vessel pressure acting on the drive via the ball check (shuttle) valve. As water is forced from the accumulator, the accumulator discharge pressure falls below reactor vessel pressure. This causes the check valve to shift its position to admit reactor pressure under the drive piston. Thus, reactor vessel pressure furnishes the force needed to complete the scram stroke at higher reactor vessel pressures. When the reactor vessel is up to full operating pressure, the accumulator is actually not needed to meet scram time requirements. With the reactor at 1000 psig and the scram discharge volume at atmospheric pressure, the scram force without an accumulator is over 1000 pounds.

3.4-22

BFN-27 SCRAM TIMES (a)(b)

(seconds)

NOTCH POSITION REACTOR STEAM DOME PRESSURE

> 800 psig 46 0.45 36 1.08 26 1.84 06 3.36 (a) Maximum scram time from fully withdrawn position, based on de-energization of scram pilot valve solenoids at time zero.

(b) Scram times as a function of reactor steam dome pressure, when <800 psig are within established limits.

3.4.6 Safety Evaluation 3.4.6.1 Evaluation of Control Rods As discussed above, it has been determined that the control rods meet the design basis requirements. The description also indicates how the control rod-to-drive coupling unit meets design basis requirements.

3.4.6.2 Evaluation of Control Rod Velocity Limiter The control rod velocity limiter limits the free fall velocity of the control rod to a value which cannot result in nuclear system process barrier damage, as required by safety design basis 1.c. This velocity is evaluated by the rod drop accident analysis in Section 14, "Plant Safety Analysis."

The following sequence of events is necessary to postulate an accident in which the control rod velocity limiter is required:

1. The rod-to-drive coupling fails.

2. The control rod sticks near the top of the core.

3. The drive is withdrawn and the control rod does not follow.

4. The operator fails to notice the lack of plant response as the control rod drive is withdrawn.

3.4-23

BFN-27

5. The control rod later becomes loose and falls freely to the fully withdrawn position.

3.4.6.3 Evaluation of Scram Time The rod scram function of the Control Rod Drive System provides the negative reactivity insertion which is required by safety design basis 2. The scram time shown in the description is adequate as shown by the transient analyses of Section 14, "Plant Safety Analysis."

3.4.6.4 Analysis of Malfunctions Relating to Rod Withdrawal There are no known single malfunctions which could cause even a single rod to withdraw. The following malfunctions have been postulated and the results analyzed:

a. Drive Housing Fails at Attachment Weld The bottom head of the reactor vessel has a penetration with an internal nozzle for each control rod drive location. A drive housing is raised into position inside each penetration and fastened to the top of the internal nozzle with a J-weld. The drive is raised into the drive housing and bolted to a flange at the bottom of the housing. The basic failure considered is a complete circumferential crack through the housing wall at an elevation just below the J-weld. The housing material is seamless type 304 stainless steel pipe with a minimum tensile strength of 75,000 psi.

Static loads on the housing wall include the weight of the drive and control rod, the weight of the housing below the attachment weld to the vessel nozzle, and reactor pressure acting on the 6-inch diameter cross-sectional area of the housing and the drive. Dynamic loading is due to the reaction force during drive operation.

If the housing were to fail, as described above, the following sequence of events is foreseen. The housing would separate from the vessel and the control rod, the drive and the housing would be blown downward against the support structure by reactor pressure acting on the cross-sectional area of the housing and the drive. The amount of downward motion of the drive and associated parts would be determined by the gap between the bottom of the drive and the support structure and by the amount the support structure deflects under load. In the current design, maximum deflection is approximately 3 inches. If the collet were to remain latched, no further control rod ejection would occur.8 The housing would not drop far enough to clear the vessel penetration. Reactor water would leak through the 0.06-inch diametral clearance between the housing o.d. and the vessel penetration i.d. at a rate of approximately 440 gpm.

3.4-24

BFN-27 If the basic housing failure were to occur at the same time the control rod is being withdrawn (this is a small fraction of the total drive operating time), and if the collet were to stay unlatched, the housing would separate from the vessel, the drive and housing would be blown downward against the control rod drive housing support and calculations indicate that the steady state rod withdrawal velocity would be 0.3 ft/sec.

During withdraw, pressure under the collet piston would be approximately 250 psi greater than the pressure over it. Therefore, the collet would be held in the unlatched position until driving pressure is removed from the pressure-over port.

b. Rupture of Either or Both Hydraulic Lines to a Drive Housing Flange (1) Pressure-Under Line Breaks In this case, a partial or complete circumferential opening is postulated at or near the point where the line enters the housing flange. Failure is more likely to occur after another basic failure wherein the drive housing, or housing flange, separates from the reactor vessel. Failure of the housing, however, does not necessarily lead directly to failure of the hydraulic lines.

If the pressure-under line were to fail, and if the collet were latched, no control rod withdrawal would occur. There would be no pressure differential across the collet piston in this case, and therefore no tendency to unlatch the collet. Consequently, it would not be possible to either insert or withdraw the control rod involved.

If reactor pressure were to shift the drive ball check valve against its upper seat, the broken pressure-under line would be sealed off. If the ball check valve were to be prevented from seating, reactor water would leak to the atmosphere. Cooling water could not be supplied to the drive involved because of the broken line. Loss of cooling water would cause no immediate damage to the drive. However, prolonged drive exposure to temperatures at or near reactor temperature could lead to deterioration of material in the seals. High temperature would be indicated to the operator by the thermocouple in the position indicator probe.

If the basic line failure were to occur at the same time the control rod is being withdrawn, and if the collet were to remain open, calculations indicate that the steady state control rod withdrawal velocity would be 2 ft/sec. In this case, however, there would not be sufficient hydraulic force to hold the collet open and spring force would normally cause the collet to latch, stopping rod withdrawal.

(2) Pressure-Over Line Breaks 3.4-25

BFN-27 The failure considered is complete breakage of the pressure-over line at or near the point where the line enters the housing flange. If the line were to break, pressure over the drive piston would drop from reactor pressure to atmospheric pressure. If there were any significant reactor pressure (approximately 500 psig or greater) it would act on the bottom of the drive piston, and the drive would insert to the fully inserted position. Drive insertion would occur regardless of the operational mode at the time of the failure. After full insertion, reactor water would leak past the stop piston seals, the contracting seals on the drive piston and the collet piston seals.

This leakage would exhaust to atmosphere through the broken pressure-over line. In an experiment to simulate this failure, a leakage rate of 80 gpm has been measured with reactor pressure at 1000 psi. If the reactor were hot, drive temperature would increase. The reactor operator would be apprised of the situation by indication of the fully inserted drive, by high drive temperature indicated and printed out on a recorder in the control room, and by operation of the drywell sump pump.

(3) Coincident Breakage of Both Pressure-Over and Pressure-Under Lines This failure would require simultaneous occurrence of the failures described above. Pressures above and below the drive piston would drop to zero and the ball check valve would shift to close off the broken pressure-under line.

Reactor water would flow from the annulus outside of the drive through the vessel ports to the space below the drive piston. As in the pressure-over line break case, the drive would then insert at a speed dependent on reactor pressure. Full insertion would occur regardless of the operational mode at the time of failure. Reactor water would leak past the drive seals and out of the broken pressure-over line to the atmosphere as described above. Drive temperature would increase. The reactor operator would be apprised of the situation by indication of the fully inserted drive, high drive temperature printed out and alarmed by a recorder in the control room, and by operation of the drywell sump pump.

c. All Drive Flange Bolts Fail in Tension Each control rod drive is bolted by eight cap screws to a flange at the bottom of a drive housing which is welded to the reactor vessel. Bolts are made of AISI-4140 steel.

Replacement cap screws are made of AISI-4340 or SA-540 B23 steel which is more resistant to stress corrosion cracking.

In the event that progressive or simultaneous failure of all the bolts were to occur, the drive would separate from the housing and the control rod and the drive would be blown downward against the support structure due to reactor pressure acting on the cross-sectional area of the drive. Impact velocity and support structure loading would be slightly less than in drive housing failure, since reactor pressure would act on the 3.4-26

BFN-27 drive cross sectional area only and the housing would remain attached to the reactor vessel. The drive would be isolated from the cooling water supply. Reactor water would flow downward past the velocity limiter piston and through the large drive filter into the annular space between the thermal sleeve and the drive. For worst case leakage calculations, it is assumed that the large filter would be deformed or swept out of the way so that it would offer no significant flow restriction. At a point near the top of the annulus, where pressure has dropped to 350 psi, the water would flash to steam and choke-flow conditions would exist. Steam would flow down the annulus and out the space between the housing and the drive flanges to the atmosphere. Steam formation would limit the leakage rate to approximately 840 gpm.

If the collet were latched, control rod ejection would be limited to the distance the drive can drop before coming to rest on the support structure. Since pressure below the collet piston would drop to zero, there would be no tendency for the collet to unlatch.

Pressure forces, in fact, exert 1435 pounds to hold the collet in the latched position.

If the bolt failure were to occur while the control rod is being withdrawn, pressure below the collet piston would drop to zero and the collet, with 1650 pounds return force, would latch, stopping rod withdrawal.

d. Weld Joining Flange to Housing Fails in Tension The failure considered is a crack in or near the weld joining the flange to the housing that extends through the wall and completely around the circumference of the housing so that the flange can separate from the housing. The flange material is a forged type 304 stainless steel and the housing material is seamless type 304 stainless steel pipe.

A conventional full penetration weld of type 308 stainless steel is used to join the flange to the housing. Minimum tensile strength is approximately the same as the parent metal. The design pressure is 1250 psig and the design temperature is 575F. A combination of reactor pressure acting downward on the cross-sectional area of the drive; the weight of the control rod, drive and flange; and the dynamic reaction force during drive operation result in a maximum tensile stress at the weld of approximately 6,000 psi.

In the event that the basic failure described above were to occur, the flange and the attached drive would be blown downward against the support structure. The support structure loading would be slightly less severe than in drive housing failure, since reactor pressure would act only on the drive cross-sectional area. Since there would be no differential pressure across the collet piston, the collet would remain latched and control rod motion would be limited to approximately 3 inches. Downward drive movement would be small; therefore, most of the drive would remain inside the housing.

The pressure-under and pressure-over lines are flexible enough to withstand the small downward displacement and remain attached to the flange. Reactor water would follow the same leakage path described in c, above, except that the exit to the atmosphere would be through the gap between the lower end of the housing and the top of the 3.4-27

BFN-27 flange. Water would flash to steam in the annulus surrounding the drive. The leakage rate would be approximately 840 gpm.

If the basic flange-to-housing joint failure were to occur at the same time the control rod is being withdrawn (a small fraction of the total operating time), and if the collet were held unlatched, the flange would separate from the housing, the drive and flange would be blown downward against the support structure, and the calculated steady state rod withdrawal velocity would be 0.13 ft/sec. Since the pressure-under and pressure-over lines remain intact, driving water pressure would continue to be supplied to the drive and the normal exhaust line restriction would exist. The pressure below the velocity limiter piston would decrease below normal due to leakage out of the gap between the housing and the flange to the atmosphere. This differential pressure across the velocity limiter piston would result in a net downward force of approximately 70 pounds.

However, leakage out of the housing would greatly reduce the pressure in the annulus surrounding the drive so that the net downward force on the drive piston would be less than normal. The overall effect would be a reduction of rod withdrawal speed to a value approximately one-half of normal speed. The collet would remain unlatched with a 560-psi differential across the collet piston, but should relatch as soon as the drive signal is removed.

e. Housing Wall Ruptures The failure considered in this case is a vertical split in the drive housing wall just below the bottom head of the reactor vessel. The hole was considered to have a flow area equivalent to the annular area between the drive and the thermal sleeve so that flow through this annular area, rather than flow through the hole in the housing, would govern leakage flow. The housing is made from type 304 stainless steel seamless pipe.

If the housing wall rupture described above were to occur, reactor water would flash to steam and leak to the atmosphere at approximately 1030 gpm through the hole in the housing. Choke flow conditions described in c, above would exist. In this case, however, the leakage flow would be greater because the flow resistance is less; that is, the leaking water and steam would not have to flow down the length of the housing to reach the atmosphere. Critical pressure at which the water would flash to steam is 350 psi.

There would be no pressure differential across the collet piston tending to cause collet unlatching, but the drive would insert due to loss of pressure in the drive housing and, therefore, in the space above the drive piston.

If the basic housing wall failure were to occur at the same time the control rod is being withdrawn (a small fraction of the total operating time), the drive would stop withdrawing, but the collet would remain unlatched. The drive stoppage would be caused by a reduction in the net downward force acting on the drive line. This would occur when the leakage flow of 1030 gpm reduces the pressure in the annulus outside 3.4-28

BFN-27 the drive approximately 540 psig and therefore reduces the pressure acting on the top of the drive piston to this value. There would be a pressure differential of approximately 710 psi across the collet piston, holding the collet unlatched as long as the operator held the withdraw signal.

f. Flange Plug Blows Out A 3/4-inch-diameter hole is drilled in the drive flange to connect the vessel ports with the bottom of the ball check valve. The outer end of this hole is sealed with an 0.812-inch-diameter plug 0.250 inch thick. The plug is held in place with a full-penetration weld of type 308 stainless steel. The failure considered is a full circumferential crack in this weld and subsequent blow-out of the plug.

If the weld were to fail and the plug were to blow out, there would be no control rod motion provided the collet were latched. There would be no pressure differential across the collet piston tending to cause collet unlatching. Reactor water would leak past the velocity limiter piston, down the annulus between the drive and the thermal sleeve through the vessel ports and drilled passage and out the open plug hole to the atmosphere at approximately 320 gpm. This leakage calculation is based on liquid only exhausting from the flange as a worst case. Actually, hot reactor water would flash to steam, and choke-flow conditions would exist, so that the expected leakage rate would be lower than the calculated value. Drive temperature would rise, and the alarm would signal the operator.

If the basic plug weld failure were to occur at the same time the control rod is being withdrawn (a small percentage of the total operating time), and if the collet were to stay unlatched, calculations indicate that control rod withdrawal speed would be approximately 0.24 ft/sec. Leakage out of the open plug hole in the flange would cause reactor water to flow downward past the velocity limiter piston. The small differential pressure across the piston would result in an insignificant driving force of approximately 10 pounds tending to increase withdraw velocity.

The collet would be held unlatched by a 295 psi pressure differential across the collet piston as long as the driving signal was maintained.

The exhaust path from the drive would have normal flow resistance since the ball check valve would be seated at the lower end of its travel by pressure under the drive piston.

g. Pressure Regulator and Bypass Valves Fail Closed (Reactor Pressure O psig)

Pressure in the drive water header supplying all drives is controlled by regulating the amount of water from the supply pump that is bypassed back to the reactor. This is accomplished primarily with the drive water control valves, and secondarily with the pressure stabilizing valves. There are two drive water control valves arranged in parallel. One is a motor-operated valve that can be adjusted from the control room.

3.4-29

BFN-27 This valve is normally in service and is partially open to maintain a pressure of reactor pressure plus 260 psig in the header just upstream from the valve. The other is a hand-operated valve that is normally closed but that can be valved in and operated locally whenever the motor-operated valve is out of service.

The pressure stabilizing valves are solenoid-operated and have built-in needle valves for adjusting flow. The two valves are arranged in parallel between the drive water header and the cooling water header. The two solenoid-operated stabilizing valves also have identical, backup function, solenoid-operated stabilizing valves which are selectable from the main control room in the event that the normal path valves become inoperative or require online maintenance. One valve is set to bypass 2 gpm, and closes when any drive is given a withdraw signal, so that flow is diverted to the drive being operated rather than back to the reactor. Relatively constant header pressure is thus maintained. Similarly, the other valve is set to bypass 4 gpm, and closes when any drive is given an insert signal. The failure considered is when all of these valves are closed so that maximum supply pump head of 1700 psi builds up in the drive water header. The major portion of the bypass flow normally passes through the motor-operated valve; therefore, closure of this valve is most critical.

Since lowest exhaust line pressure exists when reactor pressure is zero, this reactor condition is also assumed.

If the valve closure failure described above were to occur at the same time the control rod is being withdrawn, calculations indicate that steady-state withdrawal speed would be approximately 0.5 ft/sec or twice normal velocity. The collet would be held unlatched by a 1670-psi pressure differential across the collet piston. Flow would be upward past the velocity limiter piston, but retarding force would be negligible.

h. Ball Check Valve Fails to Close Off Passage to Vessel Ports The failure considered in this case depends upon the following sequence of events. If the ball check valve were to seal off the passage to the vessel ports during the "up"-signal portion of the job withdraw cycle, the collet would be unlatched. This is the normal withdrawal sequence. Then if the ball were to move up and become jammed in the ball cage by foreign material or prevented from reseating at the bottom by foreign material that settles out on the seat surface, water from below the drive piston would return to the reactor through the vessel ports and the annulus between the drive and the housing. Since this return path would have lower than normal flow resistance, the calculated withdrawal speed would be 2 ft/sec. During withdrawal, there would be differential pressure across the collet piston of approximately 40 psi. Therefore, the collet would tend to latch and would have to stick open before continuous withdrawal at 2 ft/sec could occur. Water would flow upward past the velocity limiter piston and a small retarding force would be generated (approximately 120 pounds).

3.4-30

BFN-27

i. Hydraulic Control Unit Valve Failures Various failures of the valves in the HCU can be postulated, but none are capable of producing differential pressures which approach those described in the preceding paragraphs and none are capable alone of producing a high velocity withdrawal.

Leakage through either or both of the scram valves produces a pressure which tends to insert the control rod rather than withdraw it. If the pressure in the scram discharge volume should exceed reactor pressure following a scram, a check valve in the line to the scram discharge header prevents this pressure from operating the drive mechanisms.

j. Failure of the Collet Fingers to Latch The drive continues to withdraw (after removal of the signal) at a fraction of its normal withdrawal speed. There is no known means for the collet fingers to become unlocked without some initiating signal. Failure of the withdrawal drive valve to close following a rod withdrawal has the same effect as failure of the collet fingers to latch in the index tube and is immediately apparent to the operator. Accidental opening of the withdrawal drive valve normally does not unlock the collet fingers because of the characteristic of the collet fingers to remain locked until unloaded.

k. Withdrawal Speed Control Valve Failure Normal withdrawal speed is determined by differential pressures at the drive and set for a nominal value at 3 in./sec. The characteristics of the pressure regulating system are such that withdrawal speed is maintained independent of reactor vessel pressure.

Tests have determined that accidental opening of the speed control valve to the full open position produces a velocity of approximately 6 in./sec.

The Control Rod Drive System prevents rod withdrawal as required by safety design basis 4.a. It is shown above that only multiple failures in a drive unit and its control unit could cause an unplanned rod withdrawal.

3.4.6.5 Scram Reliability High scram reliability is the result of a number of features of the CRD System, such as the following:

a. There are two sources of scram energy to insert each control rod when the reactor is operating: accumulator pressure and reactor vessel pressure.

b. Each drive mechanism has its own scram and pilot valve so that only one drive can be affected by failure of a scram valve to open. Two pilot valves are provided for each drive. Both pilot valves must be vented to initiate a scram.

3.4-31

BFN-27

c. The Reactor Protection System and HCU's are designed so that the scram signal and mode of operation override all others.

d. The collet assembly and index tube are designed so that they will not restrain or prevent control rod insertion during scram.

e. The scram discharge volume is monitored for accumulated water and will scram the reactor before the volume is filled to a point that could interfere with a scram.

The scram reliability meets the requirements of safety design basis 4.b and 4.c.

3.4.6.6 Control Rod Support and Operation As shown in the description, each control rod is independently supported and controlled as required by safety design basis 3.

3.4.7 Inspection and Testing 3.4.7.1 Development Tests The development drive (one prototype) testing included over 5000 scrams and approximately 100,000 latching cycles during 5000 hours0.0579 days <br />1.389 hours <br />0.00827 weeks <br />0.0019 months <br /> of exposure to simulated operating conditions. These tests have demonstrated the following:

a. That the drive withstands the forces, pressures, and temperatures imposed without difficulty.

b. That wear, abrasion, and corrosion of the nitrided type 304 stainless parts are negligible. That mechanical performance of the nitrided surface is superior to materials used in earlier operating reactors.

c. That the basic scram speed of the drive has a satisfactory margin above minimum plant requirements at any reactor vessel pressure.

d. That usable seal lifetimes greater than 1000 scram cycles may be expected.

3.4.7.2 Factory Quality Control Tests Quality control of welding, heat treatment, dimensional tolerances, material verification, etc., was maintained throughout the manufacturing process to assure reliable performance of the mechanical reactivity control components. Some of the quality control tests on the control rods, control rod drive mechanisms, and hydraulic control units were as follows:

Control Rod Absorber Tube Tests 3.4-32

BFN-27

a. The tubing and end plug material integrity was verified by ultrasonic inspection.

b. Boron content of the Boron-10 fraction of each lot of boron-carbide was verified.

c. The weld integrity of the finished absorber tubes was verified by helium leak testing.

CRD Mechanism Tests

a. Hydrostatic testing of the drives to check pressure welds was in accordance with ASME codes.

b. Electrical components were checked for electrical continuity and resistance to ground.

c. All drive parts which could not be visually inspected for dirt were flushed with filtered water at high velocity. No significant foreign material was permissible in effluent water.

d. Seal leakage tests were performed to demonstrate proper seal operation.

e. Each drive was tested for shim motion, latching, and control rod position indicating.

f. Each drive was subjected to cold scram tests at various reactor pressures to verify proper scram performance.

Hydraulic Control Unit Tests Each HCU received the following tests:

a. All hydraulic systems were hydrostatically tested in accordance with USAS B31.1.0.

b. All electrical components and systems were tested for electrical continuity and resistance to ground.

c. The correct operation of the accumulator pressure and level switches was verified.

d. The unit's ability to perform its part of a scram was demonstrated.

e. Proper operation and adjustment of the insert and withdrawal valves was demonstrated.

3.4-33

BFN-27 3.4.7.3 Operational Tests After installation, all rods, hydraulic control units, and drive mechanisms were tested through their full range for operability. Details of the preoperational test are given in Subsection 13.4.

During normal operation, each time a control rod is withdrawn a notch, the operator can observe the in-core monitor indications to verify that the control rod is following the drive mechanism. All control rods that are partially withdrawn from the core can be tested for rod following by inserting or withdrawing the rod one notch and returning it to its original position, while the operator observes the in-core monitor indications.

To make a positive test of control rod to control rod drive coupling integrity, the operator can withdraw a control rod to the end of its travel and then attempt to withdraw the drive to the overtravel position. Failure of the drive to overtravel demonstrates rod-to-drive coupling integrity.

Hydraulic supply subsystem pressures can be observed from instrumentation in the control room. Scram accumulator pressures can be observed locally on the nitrogen pressure gages.

3.4-34