ML23291A396
| ML23291A396 | |
| Person / Time | |
|---|---|
| Site: | Susquehanna  |
| Issue date: | 10/12/2023 |
| From: | Susquehanna |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML23291A105 | List:
|
| References | |
| PLA-8081 | |
| Download: ML23291A396 (38) | |
Text
SSES-FSAR Text Rev. 59 4.6 FUNCTIONAL DESIGN OF REACTIVITY CONTROL SYSTEMS Functional design of the control rod drive system (CRD) is discussed below. Functional design of the recirculation flow control system and standby liquid control system are described in subsections 5.4.1 and 9.3.5, respectively.
4.6.1 Information for CRDS 4.6.1.1 Control Rod Drive System Design 4.6.1.1.1 Design Bases 4.6.1.1.1.1 General Design Bases 4.6.1.1.1.1.1 Safety Design Bases The control rod drive mechanical system shall meet the following safety design bases:
(1) Design shall provide for a sufficiently rapid control rod insertion that no fuel damage results from any abnormal operating transient.
(2) Design shall include positioning devices, each of which individually supports and positions a control rod.
(3) Each positioning device shall:
- a. Prevent its control rod from initiating withdrawal as a result of a single malfunction.
- b. Be individually operated so that a failure in one positioning device does not affect the operation of any other positioning device.
- c. Be individually energized when rapid control rod insertion (scram) is signaled so that failure of power sources external to the positioning device does not prevent other positioning devices' control rods from being inserted.
4.6.1.1.1.1.2 Power Generation Design Basis The control rod system drive design shall provide for positioning the control rods to control power generation in the core.
4.6.1.1.2 Description The control rod drive (CRD) system controls gross changes in core reactivity by incrementally positioning neutron absorbing control rods within the reactor core in response to manual control signals. It is also required to quickly shut down the reactor (scram) in emergency situations by rapidly inserting withdrawn control rods into the core in response to a manual or automatic signal. The control rod drive system consists of locking piston control rod drive mechanisms, FSAR Rev. 69 4.6-1
SSES-FSAR Text Rev. 59 and the CRD hydraulic system (including power supply and regulation, hydraulic control units, interconnecting piping, instrumentation and electrical controls).
4.6.1.1.2.1 Control Rod Drive Mechanisms The CRD mechanism (drive) used for positioning the control rod in the reactor core is a double-acting, mechanically latched, hydraulic cylinder using water as its operating fluid. (See Figure 4.6-1, 4.6-2, 4.6-3, and 4.6-4.) The individual drives are mounted on the bottom head of the reactor pressure vessel.
The drives do not interfere with refueling and are operative even when the head is removed from the reactor vessel. The drives are also readily accessible for inspection and servicing.
The bottom location makes maximum utilization of the water in the reactor as a neutron shield and gives the least possible neutron exposure to the drive components. Using water from the condensate system as the operating fluid eliminates the need for special hydraulic fluid. Drives are able to utilize simple piston seals whose leakage does not contaminate the reactor water but provides cooling for the drive mechanisms and their seals.
The drives are capable of inserting or withdrawing a control rod at a slow, controlled rate, as well as providing rapid insertion when required. A mechanism on the drive locks the control rod at 6-inch increments of stroke over the length of the core.
A coupling spud at the top end of the drive index tube (piston rod) engages and locks into a mating socket at the base of the control rod. The weight of the control rod is sufficient to engage and lock this coupling. Once locked, the drive and rod form an integral unit that must be manually unlocked by specific procedures before the components can be separated.
The drive holds its control rod in distinct latch positions until the hydraulic system actuates movement to a new position. Withdrawal of each rod is limited by the seating of the rod in its guide tube. Withdrawal beyond this position to the over-travel limit can be accomplished only if the rod and drive are uncoupled. Withdrawal to the over-travel limit is annunciated by an alarm.
The individual rod indicators, grouped in one control panel display, correspond to relative rod locations in the core. A separate, smaller hardwired display is located on the standby information panel. A presentation is available on the unit operating benchboard. This latter display presents the position of the control rod selected for movement as well as the other rods in the affected rod group.
For display purposes the control rods are considered in groups of four adjacent rods centered around a common core volume. Each group is monitored by four LPRM strings (see Subsection 7.6.1.5). Rod groups at the periphery of the core may have less than four rods. The small rod display shows the positions, in digital form, of the rods in the group to which the selected rod belongs. A white light indicates which of the four rods is the one selected for movement.
4.6.1.1.2.2 Drive Components Figure 4.6-2 illustrates the operating principle of a drive. Figures 4.6-3 and 4.6-4 illustrate the drive in more detail. The main components of the drive and their functions are described below.
FSAR Rev. 69 4.6-2
SSES-FSAR Text Rev. 59 4.6.1.1.2.2.1 Drive Piston The drive piston is mounted at the lower end of the index tube. This tube functions as a piston rod. The drive piston and index tube make up the main moving assembly in the drive. The drive piston operates between positive end stops, with a hydraulic cushion provided at the upper end only. The piston has both inside and outside seal rings and operates in an annular space between an inner cylinder (fixed piston tube) and an outer cylinder (drive cylinder). Because the type of inner seal used is effective in only one direction, the lower sets of seal rings are mounted with one set sealing in each direction.
A pair of nonmetallic bushings prevents metal-to-metal contact between the piston assembly and the inner cylinder surface. The outer piston rings are segmented step-cut seals with expander springs holding the segments against the cylinder wall. A pair of split bushings on the outside of the piston prevents piston contact with the cylinder wall. The effective piston area for downtravel, or withdrawal, is approximately 1.2 sq. in. versus 4.1 sq. in. for uptravel, or insertion. This difference in driving area tends to balance the control rod weight and assures a higher force for insertion than for withdrawal.
4.6.1.1.2.2.2 Index Tube The index tube is a long hollow shaft made of nitrided stainless steel. Circumferential locking grooves, spaced every 6 inches along the outer surface, transmit the weight of the control rod to the collet assembly.
4.6.1.1.2.2.3 Collet Assembly The collet assembly serves as the index tube locking mechanism. It is located in the upper part of the drive unit. This assembly prevents the index tube from accidentally moving downward.
The assembly consists of the collet fingers, a return spring, a guide cap, a collet housing (part of the cylinder, tube, and flange), and the collet piston.
Locking is accomplished by fingers mounted on the collet piston at the top of the drive cylinder.
In the locked or latched position the fingers engage a locking groove in the index tube.
The collet piston is normally held in the latched position by a force of approximately 150 lb.
supplied by a spring. Metal piston rings are used to seal the collet piston from reactor vessel pressure. The collet assembly will not unlatch until the collet fingers are unloaded by a short, automatically sequenced, drive-in signal. A pressure, approximately 180 psi above reactor vessel pressure, must then be applied to the collet piston to overcome spring force, slide the collet up against the conical surface in the guide cap, and spread the fingers out so they do not engage a locking groove.
A guide cap is fixed in the upper end of the drive assembly. This member provides the unlocking cam surface for the collet fingers and serves as the upper bushing for the index tube.
If reactor water is used during a scram to supplement accumulator pressure, it is drawn through a filter on the guide cap.
FSAR Rev. 69 4.6-3
SSES-FSAR Text Rev. 59 4.6.1.1.2.2.4 Piston Tube The piston tube is an inner cylinder, or column, extending upward inside the drive piston and index tube. The piston tube is fixed to the bottom flange of the drive and remains stationary.
Water is brought to the upper side of the drive piston through this tube. A buffer shaft, at the upper end of the piston tube, supports the stop piston and buffer components.
4.6.1.1.2.2.5 Stop Piston A stationary piston, called the stop piston, is mounted on the upper end of the piston tube. This piston provides the seal between reactor vessel pressure and the space above the drive piston.
It also functions as a positive end stop at the upper limit of control rod travel. Piston rings and bushings, similar to those used on the drive piston, are mounted on the upper portion of the stop piston. The lower portion of the stop piston forms a thin-walled cylinder containing the buffer piston, its metal seal ring, and the buffer piston return spring. As the drive piston reaches the upper end of the scram stroke it strikes the buffer piston. A series of orifices in the buffer shaft provides a progressive water shutoff to cushion the buffer piston as it is driven to its limit of travel. The high pressures generated in the buffer are confined to the cylinder portion of the stop piston, and are not applied to the stop s steel tube. The switches are actuated by a ring magnet located at the bottom of the drive piston.
The drive piston, piston tube, and indicator tube are all of nonmagnetic stainless steel, allowing the individual switches to be operated by the magnet as the piston passes. One switch is located at each position corresponding to an index tube groove and one switch is located at the midpoint between each latching point. Thus, indication is provided for each 3 inches of travel.
Duplicate switches are provided for the full-in and full-out positions. Redundant overtravel switches are located at a position below the normal full-out position. Because the limit of downtravel is normally provided by the control rod itself as it reaches the backseat position, the drive can pass this position and actuate the overtravel switches only if it is uncoupled from its control rod. A convenient means is thus provided to verify that the drive and control rod are coupled after installation of a drive or at any time during plant operation.
4.6.1.1.2.2.6 Flange and Cylinder Assembly A flange and cylinder assembly is made up of a heavy flange welded to the drive cylinder. A sealing surface on the upper face of this flange forms the seal to the drive housing flange. The seals contain reactor pressure and the two hydraulic control pressures. Teflon coated, stainless steel rings are used for these seals. The drive flange contains the integral ball, or two-way, check (ball-shuttle) valve. This valve directs either the reactor vessel pressure or the driving pressure, whichever is higher, to the underside of the drive piston. Reactor vessel pressure is admitted to this valve from the annular space between the drive and drive housing through passages in the flange.
Water used to operate the collet piston passes between the outer tube and the cylinder tube.
The inside of the cylinder tube is honed to provide the surface required for the drive piston seals.
Both the cylinder tube and outer tube are welded to the drive flange. The upper ends of these tubes have a sliding fit to allow for differential expansion.
FSAR Rev. 69 4.6-4
SSES-FSAR Text Rev. 59 The upper end of the index tube is threaded to receive a coupling spud. The coupling (see Figure 4.6-1) accommodates a small amount of angular misalignment between the drive and the control rod. Six spring fingers allow the coupling spud to enter the mating socket on the control rod. A plug then enters the spud and prevents uncoupling.
Two means of uncoupling are provided. With the reactor vessel head removed, the lock plug can be raised against the spring force of approximately 50 pounds by a rod extending up through the center of the control rod to an unlocking handle located above the control rod velocity limiter. The control rod, with the lock plug raised, can then be lifted from the drive.
4.6.1.1.2.2.7 Lock Plug The lock plug can also be pushed up from below, if it is desired to uncouple a drive without removing the reactor pressure vessel head for access. In this case, the central portion of the drive mechanism is pushed up against the uncoupling rod assembly, which raises the lock plug and allows the coupling spud to disengage the socket as the drive piston and index tube are driven down.
The control rod is heavy enough to force the spud fingers to enter the socket and push the lock plug up, allowing the spud to enter the socket completely and the plug to snap back into place.
Therefore, the drive can be coupled to the control rod using only the weight of the control rod.
However, with the lock plug in place, a force in excess of 50,000 lb. is required to pull the coupling apart.
4.6.1.1.2.3 Materials of Construction Factors that determine the choice of construction materials are discussed in the following subsections.
4.6.1.1.2.3.1 Index Tube The index tube must withstand the locking and unlocking action of the collet fingers. A compatible bearing combination must be provided that is able to withstand moderate misalignment forces. The reactor environment limits the choice of materials suitable for corrosion resistance. The column and tensile loads can be satisfied by an annealed, single phase, nitrogen strengthened, austenitic stainless steel. The wear and bearing requirements are provided by Malcomizing the complete tube. To obtain suitable corrosion resistance, a carefully controlled process of surface preparation is employed.
4.6.1.1.2.3.2 Coupling Spud The coupling spud is made of Inconel 750 that is aged for maximum physical strength and the required corrosion resistance. Because misalignment tends to cause chafing in the semispherical contact area, the part is protected by a thin chromium plating (Electrolyzed). This plating also prevents galling of the threads attaching the coupling spud to the index tube.
4.6.1.1.2.3.3 Collet Fingers Inconel 750 is used for the collet fingers, which must function as leaf springs when cammed open to the unlocked position. Colmonoy 6 hard facing provides a long wearing surface, FSAR Rev. 69 4.6-5
SSES-FSAR Text Rev. 59 adequate for design life, to the area contacting the index tube and unlocking cam surface of the guide cap.
4.6.1.1.2.3.4 Seals and Bushings Graphite Composite is selected for seals and bushings on the drive piston and stop piston. The material is inert and has a low friction coefficient when water-lubricated. Because some loss of Graphitar strength is experienced at higher temperatures, the drive is supplied with cooling water to hold temperatures below 250°F. The Graphitar is relatively soft, which is advantageous when an occasional particle of foreign matter reaches a seal. The resulting scratches in the seal reduce sealing efficiency until worn smooth, but the drive design can tolerate considerable water leakage past the seals into the reactor vessel.
4.6.1.1.2.3.5 Summary All drive components exposed to reactor vessel water are made of austenitic stainless steel except the following:
(1) Seals and bushings on the drive piston and stop piston are Graphite Composite.
(2) All springs and members requiring spring action (collet fingers, coupling spud, and spring washers) are made of Inconel-750.
(3) The ball check valve is a Haynes Stellite cobalt-base alloy.
(4) Elastomeric O-ring seals are ethylene propylene.
(5) Metal piston rings are Haynes 25 alloy.
(6) Certain wear surfaces are hard-faced with Colmonoy 6.
(7) Nitriding by a proprietary new Malcomizing process and chromium plating are used in certain areas where resistance to abrasion is necessary.
(8) The drive piston head is made of Armco 17-4Ph.
Pressure-containing portions of the drives are designed and fabricated in accordance with requirements of Section III of the ASME Boiler and Pressure Vessel Code.
4.6.1.1.2.4 Control Rod Drive Hydraulic System The control rod drive hydraulic system (Dwgs. M-146, Sh. 1 and M-147, Sh. 1) supplies and controls the pressure and flow to and from the drives through hydraulic control units (HCU).
The water discharged from the drives during a scram flows through the HCUs to the scram discharge volume. The water discharged from a drive during a normal control rod positioning operation flows through the HCU, the exhaust header, through the other HCUs to combine with the cooling water flow at the CRD's, and into the reactor vessel. There are as many HCUs as the number of control rod drives.
FSAR Rev. 69 4.6-6
SSES-FSAR Text Rev. 59 4.6.1.1.2.4.1 Hydraulic Requirements The CRD hydraulic system design is shown in Dwgs. M-146, Sh. 1, M-147, Sh. 1, and M1-C12-85, Sh. 1. The hydraulic requirements, identified by the function they perform, are as follows:
(1) An accumulator hydraulic charging pressure of approximately 1400 to 1500 psig is required. Flow to the accumulators is required only during scram reset or system startup.
(2) Drive pressure of approximately 250 psi above reactor vessel pressure is required. A flow rate of approximately 4 gpm to insert a control rod and 2 gpm to withdraw a control rod is required.
(3) Cooling water to the drives is required at approximately 30 psi above reactor vessel pressure and at a flow rate of 0.20 to 0.34 gpm per drive unit. (Cooling water to a drive can be interrupted for short periods without damaging the drive.)
(4) The scram discharge volume is sized to receive and contain all the water discharged by the drives during a scram; a minimum volume of 3.34 gal. per drive is required.
4.6.1.1.2.4.2 System Description The CRD hydraulic systems provide the required functions with the pumps, filter, valves, instrumentation, and piping shown in Dwgs. M-146, Sh. 1 and M-147, Sh. 1 and described in the following subsection.
Duplicate components are included, where necessary, to assure continuous system operation if an in-service component requires maintenance.
Leakage inside containment from the CRD Hydraulic System can be detected by the leakage detection system described in Subsection 5.2.5. Again referencing the CRD Hydraulic System, Dwgs. M-146, Sh. 1, M-147, Sh. 1 and M1-C12-85, Sh. 1, it may be seen that the CRD system piping which is downstream of the drivewater pumps is maintained above vessel pressure.
Thus, any leakage from the CRD system between the drive water pumps and the HCU will be the relatively clean water, low temperature fluid of the CRD Hydraulic System. If the leakage were to be so large as to cause a significant pressure decrease in the CRD system piping there could be flow from the primary system out the leakage path. If the leak occurred in the piping between the pumps and the HCU, an additional failure of a hydraulic control unit check valve would be necessary for there to be a loss of primary coolant. In any case, a large leak of the CRD system fluid would cause one or more of the following depending on the location of the leak: a decrease in scram accumulator pressure (which alarms an annunciator); or a decrease in drive water pressure or cooling water flow (both of which are displayed on the control room panel).
In the case of leakage from the primary system, there would be reverse flow from the reactor pressure vessel to the drives. This induction of hot primary system coolant into the drive would cause the drive to heat and alarm a high temperature annunciator.
FSAR Rev. 69 4.6-7
SSES-FSAR Text Rev. 59 4.6.1.1.2.4.2.1 Supply Pump One supply pump pressurizes the system with water from the condensate system. One spare pump is provided for standby. A discharge check valve prevents backflow through the nonoperating pump. A portion of the pump discharge flow is diverted through a minimum flow bypass line to the condensate storage tank. This flow is controlled by an orifice and is sufficient to prevent immediate pump damage if the pump discharge is inadvertently closed.
Condensate water is processed by two filters in the system. The pump suction filter is a disposable element type with a 25-micron absolute rating. The drive water filter down-stream of the pump is a replaceable element type with a 50-micron absolute rating. Differential pressure indicators and control room alarms monitor the filter elements as they collect foreign materials.
4.6.1.1.2.4.2.2 Accumulator Charging Pressure Initially, the accumulator is precharged to 575 psig nominal at 70°F (580 psig max. at 70°F) with nitrogen.
Accumulator charging pressure is established by the discharge pressure of the system supply pump. During scram the scram inlet (and outlet) valves open and permit the stored energy in the accumulators to discharge into the drives. The resulting pressure decrease in the charging water header allows the CRD supply pump to "run out" (i.e., flow rate to increase substantially) into the control rod drives via the charging water header. The flow sensing system upstream of the accumulator charging header detects high flow and decreases flow returning to the RPV.
This action maintains increased flow through the charging water header.
Pressure in the charging header is monitored in the control room with a pressure indicator and low pressure alarm.
During normal operation the flow control valve maintains a constant system flow rate. This flow is used for drive flow, drive cooling, and system stability.
4.6.1.1.2.4.2.3 Drive Water Pressure Drive water pressure required in the drive header is maintained by the pressure control valve, which is manually adjusted from the control room.
A flow rate of approximately 6 gpm (the sum of the flow rate required to insert and withdraw a control rod) normally bypasses the drive water pressure control station through two solenoid operated stabilizing valves (arranged in parallel). The flow through one stabilizing valve equals the drive insert flow; that of the other stabilizing valve equals the drive withdrawal flow. When operating a drive, the required flow is diverted to that drive by closing the appropriate stabilizing valve. Thus, flow through the drive pressure control valve is always constant.
Flow indicators in the drive water header and in the line downstream from the stabilizing valves allow the flow rate through the stabilizing valves to be adjusted when necessary. Differential pressure between the reactor vessel and the drive pressure stage is indicated in the control room.
FSAR Rev. 69 4.6-8
SSES-FSAR Text Rev. 59 4.6.1.1.2.4.2.4 Cooling Water Header All water passing through the pressure control valve and the stabilizing valves is routed to the reactor via the cooling water header. Without flow in the drive and charging water headers the cooling water flow is equal to the flow passing through the flow control valve.
The flow through the flow control valve is virtually constant. Therefore, once adjusted, the drive pressure control valve can maintain the required pressure independent of reactor pressure.
Changes in setting of the pressure control valve is required only to adjust for changes in the cooling requirements of the drives, as their seal characteristics change with time. A flow indicator in the control room monitors cooling water flow. A differential pressure indicator in the control room indicates the difference between reactor vessel pressure and drive cooling water pressure. Although the drives can function without cooling water, seal life is shortened by long-term exposure to reactor temperatures. The temperature of each drive is recorded in the reactor building, and excessive temperatures are annunciated in the control room.
4.6.1.1.2.4.2.5 Scram Discharge Volume The scram discharge volume consists of header piping which connects to each HCU and drains into an instrument volume. The header piping is sized to receive and contain all the water discharged by the drives during a scram, independent of the instrument volume.
Each of the two sets of headers has its own directly connected scram discharge instrument volume (SDIV) attached to the low point of the header piping. The large diameter pipe of the instrument volume thus serves as a vertical extension of the SDV (though no credit is taken for it in determining SDV requirements).
During normal plant operation the scram discharge volume is empty, and vented to atmosphere through its open vent and drain valves. When a scram occurs, upon a signal from the safety circuit these vent and drain valves are closed to conserve reactor water. Redundant vent and drain valves are provided to assure against loss of reactor coolant from the SDV following a scram. Lights in the control room indicate the position of these valves.
During a scram, the scram discharge volume partly fills with water discharged from above the drive pistons. After scram is completed, the control rod drive seal leakage from the reactor continues to flow into the scram discharge volume until the discharge volume pressure equals the reactor vessel pressure. A check valve in each HCU prevents reverse flow from the scram discharge header volume to the drive. When the initial scram signal is cleared from the reactor protection system, the scram discharge volume isolation signal is overridden with a keylock override switch, and the scram discharge volume is drained and returned to atmospheric pressure.
Remote manual switches in the pilot valve solenoid circuits allow the discharge volume vent and drain valves to be tested without disturbing the reactor protection system. Closing the scram discharge volume valves allows the outlet scram valve seats to be leak-tested by timing the accumulation of leakage inside the scram discharge volume.
Twelve liquid-level instruments connected to the instrument volume, monitor the volume for abnormal water level. They are set at three different levels. Two level switches are set at the lowest level. These level switches actuate to indicate that the volume is not completely empty during post-scram draining or to indicate that the volume starts to fill through leakage FSAR Rev. 69 4.6-9
SSES-FSAR Text Rev. 59 accumulation at other times during reactor operation. Two level switches are set at the second level. These level switches produce a rod withdrawal block to prevent further withdrawal of any control rod, when leakage accumulates to half the capacity of the instrument volume. The remaining 8 instruments (see Subsection 7.2.1.1.4.2(g)) are interconnected with the trip channels of the Reactor Protection System (RPS) and will initiate a reactor scram should water accumulation fill the instrument volume.
To assure more reliable and safer operation of the Scram Discharge Volume System, the following modifications have been made:
- 1. Added redundant vent and drain valves to ensure that an uncontrolled loss of reactor coolant would not result in the event of a single active failure.
- 2. Redundant and diverse sensors are used such that no single component failure or service condition will prevent scram, alarm and rod block functions.
- 3. Instrument piping has been designed to minimize the transient hydrodynamic effects.
Instrumentation taps are provided on the vertical scram discharge instrument volume.
- 4. The scram discharge volume vent line is a dedicated, non-submerged line routed to the Reactor Building sump. A vacuum breaker is installed on the high point of the vent line and will open on a differential pressure of no greater than five inches of water.
- 5. The air-operated vent and drain valves will close under loss of air; valve position is provided in the main control room.
- 6. System piping geometry is designed such that the system drains continuously during normal plant operation. The drain line is a dedicated line routed to the Reactor Building sump.
- 7. The level instrumentation is designed to be maintained, tested and calibrated during plant operation without causing a scram.
4.6.1.1.2.4.3 Hydraulic Control Units Each hydraulic control unit (HCU) furnishes pressurized water, on signal, to a drive unit. The drive then positions its control rod as required. Operation of the electrical system that supplies scram and normal control rod positioning signals to the HCU is described in Subsection 7.7.1.2.
The basic components in each HCU are manual, pneumatic, and electrical valves; an accumulator; related piping; electrical connections; filters; and instrumentation (see Dwgs. M-147, Sh. 1, M1-C12-85, Sh. 1, and Figure 4.6-7). The components and their functions are described in the following paragraphs.
4.6.1.1.2.4.3.1 Insert Drive Valve The insert drive valve is solenoid-operated and opens on an insert signal. The valve supplies drive water to the bottom side of the main drive piston.
FSAR Rev. 69 4.6-10
SSES-FSAR Text Rev. 59 4.6.1.1.2.4.3.2 Insert Exhaust Valve The insert exhaust solenoid valve also opens on an insert signal. The valve discharges water from above the drive piston to the exhaust water header.
4.6.1.1.2.4.3.3 Withdraw Drive Valve The withdraw drive valve is solenoid-operated and opens on a withdraw signal. The valve supplies drive water to the top of the drive piston.
4.6.1.1.2.4.3.4 Withdraw Exhaust Valve The solenoid-operated withdraw exhaust valve opens on a withdraw signal and discharges water from below the main drive piston to the exhaust header. It also serves as the settle valve, which opens following any normal drive movement (insert or withdraw) to allow the control rod and its drive to settle back into the nearest latch position.
4.6.1.1.2.4.3.5 Speed Control Units The insert drive valve and withdraw exhaust valve have a speed control unit. The speed control unit regulates the control rod insertion and withdrawal rates during normal operation. The manually adjustable flow control unit is used to regulate the water flow to and from the volume beneath the main drive piston. A correctly adjusted unit does not require readjustment except to compensate for changes in drive seal leakage.
4.6.1.1.2.4.3.6 Scram Pilot Valves The scram pilot valves are operated from the reactor protection system. A scram pilot valve with two solenoids controls both the scram inlet valve and the scram exhaust valve. The scram pilot valves are three-way, solenoid-operated, normally energized valves. On loss of electrical signal to the solenoids, such as the loss of external AC power, the inlet port closes and the exhaust port opens. The pilot valves (Dwgs. M-146, Sh. 1 and M-147, Sh. 1 are designed so that the trip system signal must be removed from both solenoids before air pressure can be discharged from the scram valve operators. This prevents inadvertent scram of a single drive in the event of a failure of one of the pilot valve solenoids.
4.6.1.1.2.4.3.7 Scram Inlet Valve The scram inlet valve opens to supply pressurized water to the bottom of the drive piston. This quick opening globe valve is operated by an internal spring and system pressure. It is closed by air pressure applied to the top of its diaphragm operator. A main control room indicating light is energized when both the scram inlet valve and the scram exhaust valve are fully open.
4.6.1.1.2.4.3.8 Scram Exhaust Valve The scram exhaust valve opens slightly before the scram inlet valve, exhausting water from above the drive piston. The exhaust valve opens faster than the inlet valve because of the higher air pressure spring setting in the valve operator.
FSAR Rev. 69 4.6-11
SSES-FSAR Text Rev. 59 4.6.1.1.2.4.3.9 Scram Accumulator The scram accumulator stores sufficient energy to fully insert a control rod at lower vessel pressures. At higher vessel pressures the accumulator pressure is assisted or supplanted by reactor vessel pressure. The accumulator is a hydraulic cylinder with a free-floating piston. The piston separates the water on top from the nitrogen below. A check valve in the accumulator charging line prevents loss of water pressure in the event supply pressure is lost.
During normal plant operation, the accumulator piston is seated at the bottom of its cylinder.
Loss of nitrogen decreases the nitrogen pressure, which actuates a pressure switch and sounds an alarm in the control room.
To ensure that the accumulator is always able to produce a scram, it is continuously monitored for water leakage. A float type level switch actuates an alarm if water leaks past the piston barrier and collects in the accumulator instrumentation block.
4.6.1.1.2.5 Control Rod Drive System Operation The control rod drive system performs rod insertion, rod withdrawal, and scram. These operational functions are described below.
4.6.1.1.2.5.1 Rod Insertion Rod insertion is initiated by a signal from the operator to the insert valve solenoids. This signal causes both insert valves to open. The insert drive valve applies reactor pressure plus approximately 90 psi to the bottom of the drive piston. The insert exhaust valve allows water from above the drive piston to discharge to the exhaust header.
As is illustrated in Figure 4.6-3, the locking mechanism is a ratchet-type device and does not interfere with rod insertion. The speed at which the drive moves is determined by the flow through the insert speed control valve, which is set for approximately 4 gpm for a shim speed (non-scram operation) of 3 in./sec. During normal insertion, the pressure on the downstream side of the speed control valve is 90 to 100 psi above reactor vessel pressure. However, if the drive slows for any reason, the flow through, and pressure drop across, the insert speed control valve will decrease; the full differential pressure (250 psi) will then be available to cause continued insertion. With 250-psi differential pressure acting on the drive piston, the piston exerts an upward force of 1040 lb.
4.6.1.1.2.5.2 Rod Withdrawal Rod withdrawal is, by design, more involved than insertion. The collet finger (latch) must be raised to reach the unlocked position (see Figure 4.6-3). The notches in the index tube and the collet fingers are shaped so that the downward force on the index tube holds the collet fingers in place. The index tube must be lifted before the collet fingers can be released. This is done by opening the drive insert valves (in the manner described in the preceding paragraph) for approximately 1 sec. The withdraw valves are then opened, applying driving pressure above the drive piston and opening the area below the piston to the exhaust header. Pressure is simultaneously applied to the collet piston. As the piston raises, the collet fingers are cammed outward, away from the index tube, by the guide cap.
FSAR Rev. 69 4.6-12
SSES-FSAR Text Rev. 59 The pressure required to release the latch is set and maintained at a level high enough to overcome the force of the latch return spring plus the force of reactor pressure opposing movement of the collet piston. When this occurs, the index tube is unlatched and free to move in the withdraw direction. Water displaced by the drive piston flows out through the withdraw speed control valve, which is set to give the control rod a shim speed of 3 in./sec. The entire valving sequence is automatically controlled and is initiated by a single operation of the rod withdraw switch.
4.6.1.1.2.5.3 Scram During a scram the scram pilot valves and scram valves are operated as previously described.
With the scram valves open, accumulator pressure is admitted under the drive piston, and the area over the drive piston is vented to the scram discharge volume.
The large differential pressure (initially approximately 1500 psi and always several hundred psi, depending on reactor vessel pressure) produces a large upward force on the index tube and control rod. This force gives the rod a high initial acceleration and provides a large margin of force to overcome friction. After the initial acceleration is achieved, the drive continues at a nearly constant velocity. This characteristic provides a high initial rod insertion rate. As the drive piston nears the top of its stroke the piston seals close off the large passage (buffer orifices) in the stop piston tube, providing a hydraulic cushion at the end of travel.
Prior to a scram signal the accumulator in the Hydraulic Control Unit has approximately 1450-1510 psig on the water side and 1050-1100 psig on the nitrogen side. As the inlet scram valve opens, the full water side pressure is available at the control rod drive acting on a 4.1 sq. in.
area. As CRD motion begins, this pressure drops to the gas side pressure less line losses between the accumulator and the CRD. At low vessel pressures the accumulator completely discharges with a vaulting gas side pressure of approximately 575 psi. The control rod drive accumulators are required to scram the control rods when the reactor pressure is low, and the accumulators retain sufficient stored energy to ensure the complete insertion of the control rods in the required time.
The ball check valve in the drive flange allows reactor pressure to supply the scram force whenever reactor pressure exceeds the supply pressure at the drive. This occurs, due to accumulator pressure decay and inlet line losses, during all scrams at higher vessel pressures.
When the reactor is close to or at fully operating pressure, reactor pressure alone will insert the control rod in the required time, although the accumulator does provide additional margin at the beginning of the stroke.
The control rod drive system, with accumulators, provides scram performance at full power operation, in terms of average elapsed time after the opening of the reactor protection system trip actuator (scram signal) for the drives to attain the scram strokes.
4.6.1.1.2.6 Instrumentation The instrumentation for both the control rods and control rod drives is defined by that given for the manual control system. The objective of the reactor manual control system is to provide the operator with the means to make changes in nuclear reactivity so that reactor power level and power distribution can be controlled. The system allows the operator to manipulate control rods.
FSAR Rev. 69 4.6-13
SSES-FSAR Text Rev. 59 The design bases and further discussion are covered in Chapter 7.
4.6.1.2 Control Rod Drive Housing Supports 4.6.1.2.1 Safety Objective The control rod drive (CRD) housing supports prevent any significant nuclear transient in the event a drive housing breaks or separates from the bottom of the reactor vessel.
4.6.1.2.2 Safety Design Bases The CRD housing supports are engineered safety features and shall meet the following safety design bases:
(1) Following a postulated CRD housing failure, control rod downward motion shall be limited so that any resulting nuclear transient could not be sufficient to cause fuel damage.
(2) The clearance between the CRD housings and the supports shall be sufficient to prevent vertical contact stresses caused by thermal expansion during plant operation.
4.6.1.2.3 Description The CRD housing supports are shown in Figure 4.6-8. Horizontal beams are installed immediately below the bottom head of the reactor vessel, between the rows of CRD housings.
The beams are supported by brackets welded to the steel form liner of the drive room in the reactor support pedestal.
Hanger rods, approximately 10 ft. long and 1-3/4 in. in diameter, are supported from the beams on stacks of disc springs. These springs compress approximately 2 inches under the design load.
The support bars are bolted between the bottom ends of the hanger rods. The spring pivots at the top, and the beveled, loose fitting ends on the support bars prevent substantial bending moment in the hanger rods if the support bars are overloaded.
Individual grids rest on the support bars between adjacent beams. Because a single piece grid would be difficult to handle in the limited work space and because it is necessary that control rod drives, position indicators, and in-core instrumentation components be accessible for inspection and maintenance, each grid is designed for in-place assembly or disassembly. Each grid assembly is made from two grid plates, a clamp, and a bolt. The top part of the clamp guides the grid to its correct position directly below the respective CRD housing that it would support in the postulated accident.
When the support bars and grids are installed, a gap of approximately 1 inch at room temperature (approximately 70°F) is provided between the grid and the bottom contact surface of the control rod drive flange. During system heatup, this gap is reduced by a net downward expansion of the housings with respect to the supports. In the hot operating condition, the gap is approximately 1/4 inch.
FSAR Rev. 69 4.6-14
SSES-FSAR Text Rev. 59 In the postulated CRD housing failure, the CRD housing supports are loaded when the lower contact surface of the CRD flange contacts the grid. The resulting load is then carried by two grid plates, two support bars, four hanger rods, their disc springs, and two adjacent beams.
The American Institute of Steel Construction (AISC) Manual of Steel Construction, "Specification for the Design, Fabrication and Erection of Structural Steel for Buildings," was used in designing the CRD housing support system. However, to provide a structure that absorbs as much energy as practical without yielding, the allowable tension and bending stresses used were 90%
of yield and the shear stress used was 60% of yield. These design stresses are 1.5 times the AISC allowable stresses (60% and 40% of yield, respectively).
For purposes of mechanical design, the postulated failure resulting in the highest forces is an instantaneous circumferential separation of the CRD housing from the reactor vessel, with an internal pressure of 1086 psig acting on the area of the separated housing. The weight of the separated housing, control rod drive, and blade, plus the pressure of 1086 psig acting on the area of the separated housing, gives a force of approximately 32,000 lb. This force is used to calculate the impact force, conservatively assuming that the housing travels through a 1-in. gap before it contacts the supports. The impact force (109,000 lb.) is then treated as a static load in design.
All CRD housing support subassemblies are fabricated of commonly available structural steel, except for the disc springs, which are Schnorr, Type BS-125-71-8.
4.6.2 Evaluations of the CRDS This subject is covered under nuclear safety and operational analysis (NSOA) in Appendix 15A, Subsection 15A.6.5.3.
4.6.2.1 Safety Evaluation Safety evaluation of the control rods, CRDS, and control rod drive housing supports is described below. Further description of control rods is contained in Section 4.2.
4.6.2.1.1 Control Rods 4.6.2.1.1.1 Materials Adequacy Throughout Design Lifetime The adequacy of the materials throughout the design life was evaluated in the mechanical design of the control rods. The primary materials, B4C powder and 304 austenitic stainless steel, have been found suitable in meeting the demands of the BWR environment.
4.6.2.1.1.2 Dimensional and Tolerance Analysis Layout studies are done to assure that, given the worst combination of part tolerance ranges at assembly, no interference exists which will restrict the passage of control rods. In addition, preoperational verification is made on each control blade system to show that the acceptable levels of operational performance are met.
FSAR Rev. 69 4.6-15
SSES-FSAR Text Rev. 59 4.6.2.1.1.3 Thermal Analysis of the Tendency to Warp The various parts of the control rod assembly remain at approximately the same temperature during reactor operation, negating the problem of distortion or warpage. What little differential thermal growth could exist is allowed for in the mechanical design. A minimum axial gap is maintained between absorber rod tubes and the control rod frame assembly for the purpose. In addition, dissimilar metals are avoided to further this end.
4.6.2.1.1.4 Forces for Expulsion An analysis has been performed which evaluates the maximum pressure forces which could tend to eject a control rod from the core. The results of this analysis are given in Subsection 4.6.2.3.2.2.2. In summary, if the collet were to remain open, which is unlikely, calculations indicate that the steady-state control rod withdrawal velocity would be 2 ft./sec. for a pressure-under line break, the limiting case for rod withdrawal.
4.6.2.1.1.5 Functional Failure of Critical Components The consequences of a functional failure of critical components have been evaluated and the results are covered in Subsection 4.6.2.3.2.2.
4.6.2.1.1.6 Precluding Excessive Rates of Reactivity Addition In order to preclude excessive rates of reactivity addition, analysis has been performed both on the velocity limiter device, an engineered safety feature, and the effect of probable control rod failures (see Subsection 4.6.2.3.2.2).
4.6.2.1.1.7 Effect of Fuel Rod Failure on Control Rod Channel Clearances The control rod drive mechanical design ensures a sufficiently rapid insertion of control rods to preclude the occurrence of fuel rod failures which could hinder reactor shutdown by causing significant distortions in channel clearances.
4.6.2.1.1.8 Mechanical Damage Analysis has been performed for all areas of the control system showing that system mechanical damage does not affect the capability to continuously provide reactivity control.
In addition to the analysis performed on the control rod drive (Subsection 4.6.2.3.2.2 and Subsection 4.6.2.3.2.3) and the control rod blade, the following discussion summarizes the analysis performed on the control rod guide tube. The guide tube can be subjected to any or all of the following loads:
(1) Inward load due to pressure differential (2) Lateral loads due to flow across the guide tube (3) Dead Weight (4) Seismic (Vertical and Horizontal)
(5) Vibration FSAR Rev. 69 4.6-16
SSES-FSAR Text Rev. 59 In all cases analysis was performed considering both a recirculation line break and a steam line break. These events result in the largest hydraulic loadings on a control rod guide tube.
Two primary modes of failure were considered in the guide tube analysis; exceeding allowable stress and excessive elastic deformation. It was found that the allowable stress limit will not be exceeded and that the elastic deformations of the guide tube never are great enough to cause the free movement of the control rod to be jeopardized.
4.6.2.1.1.9 Evaluation of Control Rod Velocity Limiter The control rod velocity limiter limits the free fall velocity of the control rod to a value that cannot result in nuclear system process barrier damage. This velocity is evaluated by the rod drop accident analysis in Chapter 15. The control rod velocity limiter is an engineered safety feature.
4.6.2.1.2 Control Rod Drives 4.6.2.1.2.1 Evaluation of Scram Time The rod scram function of the control rod drive system provides the negative reactivity insertion required by safety design basis in Subsection 4.6.1.1.1.1.1. The scram time shown in the description is adequate as shown by the transient analyses of Chapter 15.
4.6.2.1.2.2 Analysis of Malfunction Relating to Rod Withdrawal There are no known single malfunctions that cause the unplanned withdrawal of even a single control rod. However, if multiple malfunctions are postulated, studies show that an unplanned rod withdrawal can occur at withdrawal speeds that vary with the combination of malfunctions postulated. In all cases the subsequent withdrawal speeds are less than that assumed in the rod drop accident analysis as discussed in Chapter 15. Therefore, the physical and radiological consequences of such rod withdrawals are less than those analyzed in the rod drop accident.
4.6.2.1.2.2.1 Drive Housing Fails at Attachment Weld The bottom head of the reactor vessel has a penetration for each control rod drive location. A drive housing is raised into position inside each penetration and fastened by welding. The drive is raised into the drive housing and bolted to a flange at the bottom of the housing. The housing material is seamless, Type 304 stainless steel pipe with a minimum tensile strength of 75,000 psi. The basic failure considered here is a complete circumferential crack through the housing wall at an elevation just below the J-weld.
Static loads on the housing wall include the weight of the drive and the control rod, the weight of the housing below the J-weld, and the reactor pressure acting on the 6-in. diameter cross-sectional area of the housing and the drive. Dynamic loading results from the reaction force during drive operation.
If the housing were to fail as described, the following sequence of events is foreseen. The housing would separate from the vessel. The control rod drive and housing would be blown downward against the support structure by reactor pressure acting on the cross-sectional area of the housing and the drive. The downward motion of the drive and associated parts would be determined by the gap between the bottom of the drive and the support structure and by the FSAR Rev. 69 4.6-17
SSES-FSAR Text Rev. 59 deflection of the support structure under load. In the current design, maximum deflection is approximately 3 in. If the collet were to remain latched, no further control rod ejection would occur (Reference 4.6-1); the housing would not drop far enough to clear the vessel penetration.
Reactor water would leak at a rate of approximately 220 gpm through the 0.03-inch diametral clearance between the housing and the vessel penetration.
If the basic housing failure were to occur while the control rod is being withdrawn (this is a small fraction of the total drive operating time) and if the collet were to stay unlatched, the following sequence of events is foreseen. The housing would separate from the vessel. The drive and housing would be blown downward against the control rod drive housing support. Calculations indicate that the steady-state rod withdrawal velocity would be 0.3 ft./sec. During withdrawal, pressure under the collet piston would be approximately 250 psi greater than the pressure over it. Therefore, the collet would be held in the unlatched position until driving pressure was removed from the pressure-over port.
4.6.2.1.2.2.2 Rupture of Hydraulic Line(s) to Drive Housing Flange There are three types of possible rupture of hydraulic lines to the drive housing flange: (1) pressure-under line break; (2) pressure-over line break; and (3) coincident breakage of both of these lines.
4.6.2.1.2.2.2.1 Pressure-under Line Break For the case of a pressure-under line break, a partial or complete circumferential opening is postulated at or near the point where the line enters the housing flange. Failure is more likely to occur after another basic failure wherein the drive housing or housing flange separates from the reactor vessel. Failure of the housing, however, does not necessarily lead directly to failure of the hydraulic lines.
If the pressure-under line were to fail and if the collet were latched, no control rod withdrawal would occur. There would be no pressure differential across the collet piston and, therefore, no tendency to unlatch the collet. Consequently, the associated control rod could not be withdrawn, but if reactor pressure is greater than 600 psig, it will insert on a scram signal.
The ball check valve is designed to seal off a broken pressure-under line by using reactor pressure to shift the check ball to its upper seat. If the ball check valve were prevented from seating, reactor water would leak to the atmosphere. Because of the broken line, cooling water could not be supplied to the drive involved. Loss of cooling water would cause no immediate damage to the drive. However, prolonged exposure of the drive to temperatures at or near reactor temperature could lead to deterioration of material in the seals. High temperature would be indicated to the operator by the thermocouple in the position indicator probe. A second indication would be high cooling water flow.
If the basic line failure were to occur while the control rod is being withdrawn the hydraulic force would not be sufficient to hold the collet open, and spring force normally would cause the collet to latch and stop rod withdrawal. However, if the collet were to remain open, calculations indicate that the steady-state control rod withdrawal velocity would be 2 ft./sec.
FSAR Rev. 69 4.6-18
SSES-FSAR Text Rev. 59 4.6.2.1.2.2.2.2 Pressure-over Line Break The case of the pressure-over line breakage considers the complete breakage of the line at or near the point where it enters the housing flange. If the line were to break, pressure over the drive piston would drop from reactor pressure to atmospheric pressure. Any significant reactor pressure (approximately 600 psig or greater) would act on the bottom of the drive piston and fully insert the drive. Insertion would occur regardless of the operational mode at the time of the failure. After full insertion, reactor water would leak past the stop piston seals. This leakage would exhaust to the atmosphere through the broken pressure-over line. The leakage rate at 1000 psi reactor pressure is estimated to be 4 gpm nominal but not more than 10 gpm, based on experimental measurements. If the reactor were hot, drive temperature would increase.
This situation would be indicated to the reactor operator by the drift alarm, by the fully inserted drive, by a high drive temperature (indicated and printed out on a recorder in the control room),
and by operation of the drywell sump pump.
For the simultaneous breakage of the pressure-over and pressure-under lines, pressures above and below the drive piston would drop to zero, and the ball check valve would close the broken pressure-under line. Reactor water would flow from the annulus outside the drive, through the vessel ports, and to the space below the drive piston. As in the case of pressure-over line breakage, the drive would then insert (if the reactor were above 600 psi) at a speed dependent on reactor pressure. Full insertion would occur regardless of the operational mode at the time of failure. Reactor water would leak past the drive seals and out the broken pressure-over line to the atmosphere, as described above. Drive temperature would increase. Indication in the control room would include the drift alarm, the fully inserted drive, the high drive temperature printed out on a recorder in the control room, and operation of the drywell sump pump.
4.6.2.1.2.2.3 All Drive Flange Bolts Fail in Tension Each control rod drive is bolted to a flange at the bottom of a drive housing. The flange is welded to the drive housing. Bolts are made of AISI-4140 (or AISI-4340) steel, with a minimum tensile strength of 125,000 (or 135,000 for AISI-4340) psi. Each bolt has an allowable load capacity of 14,800 (or 28,800 for AISI-4340) pounds. Capacity of the 8 bolts is 118,400 (or 230,400 for AISI-4340) pounds. As a result of the reactor design pressure of 1250 psig, the design basis load on all 8 bolts is 45,015 pounds.
If a progressive or simultaneous failure of all bolts were to occur, the drive would separate from the housing. The control rod and the drive would be blown downward against the support structure. Impact velocity and support structure loading would be slightly less than that for drive housing failure, because reactor pressure would act on the drive cross-sectional area only and the housing would remain attached to the reactor vessel. The drive would be isolated from the cooling water supply. Reactor water would flow downward past the velocity limiter piston, through the large drive filter, and into the annular space between the thermal sleeve and the drive. For worst-case leakage calculations, the large filter is assumed to be deformed or swept out of the way so it would offer no significant flow restriction. At a point near the top of the annulus, where pressure would have dropped to 350 psi, the water would flash to steam and cause choke-flow conditions. Steam would flow down the annulus and out the space between the housing and the drive flanges to the drywell. Steam formation would limit the leakage rate to approximately 840 gpm.
FSAR Rev. 69 4.6-19
SSES-FSAR Text Rev. 59 If the collet were latched, control rod ejection would be limited to the distance the drive can drop before coming to rest on the support structure. There would be no tendency for the collet to unlatch, because pressure below the collet piston would drop to zero. Pressure forces, in fact, exert 1435 pounds to hold the collet in the latched position.
If the bolts failed during control rod withdrawal, pressure below the collet piston would drop to zero. The collet, with 1650 pounds return force, would latch and stop rod withdrawal.
4.6.2.1.2.2.4 Weld Joining Flange to Housing Fails in Tension The failure considered is a crack in or near the weld that joins the flange to the housing. This crack extends through the wall and completely around the housing. The flange material is forged, Type 304 stainless steel, with a minimum tensile strength of 75,000 psi. The housing material is seamless, Type 304 stainless steel pipe, with a minimum tensile strength of 75,000 psi. The conventional, full penetration weld of Type 308 stainless steel has a minimum tensile strength approximately the same as that for the parent metal. The design pressure and temperature are 1250 psig and 575°F. Reactor pressure acting on the cross-sectional area of the drive; the weight of the control rod, drive, and flange; and the dynamic reaction force during drive operation result in a maximum tensile stress at the weld of approximately 6000 psi.
If the basic flange-to-housing joint failure occurred, the flange and the attached drive would be blown downward against the support structure. The support structure loading would be slightly less than that for drive housing failure, because reactor pressure would act only on the drive cross-sectional area. Lack of differential pressure across the collet piston would cause the collet to remain latched and limit control rod motion to approximately 3 inches. Downward drive movement would be small, therefore, most of the drive would remain inside the housing. The pressure-under and pressure-over lines are flexible enough to withstand the small displacement and remain attached to the flange. Reactor water would follow the same leakage path described above for the flange bolt failure, except that exit to the drywell would be through the gap between the lower end of the housing and the top of the flange. Water would flash to steam in the annulus surrounding the drive. The leakage rate would be approximately 840 gpm.
If the basic failure were to occur during control rod withdrawal (a small fraction of the total operating time) and if the collet were held unlatched, the flange would separate from the housing. The drive and flange would be blown downward against the support structure. The calculated steady-state rod withdrawal velocity would be 0.13 ft./sec. Because pressure-under and pressure-over lines remain intact, driving water pressure would continue to the drive, and the normal exhaust line restriction would exist. The pressure below the velocity limiter piston would drop below normal as a result of leakage from the gap between the housing and the flange. This differential pressure across the velocity limiter piston would result in a net downward force of approximately 70 pounds. Leakage out of the housing would greatly reduce the pressure in the annulus surrounding the drive. Thus, the net downward force on the drive piston would be less than normal. The overall effect of these events would be to reduce rod withdrawal to approximately one-half of normal speed. With a 560-psi differential across the collet piston, the collet would remain unlatched; however, it should relatch as soon as the drive signal is removed.
FSAR Rev. 69 4.6-20
SSES-FSAR Text Rev. 59 4.6.2.1.2.2.5 Housing Wall Ruptures This failure is a vertical split in the drive housing wall just below the bottom head of the reactor vessel. The flow area of the hole is considered equivalent to the annular area between the drive and the thermal sleeve. Thus, flow through this annular area, rather than flow through the hole in the housing, would govern leakage flow. The housing is made of Type 304 stainless steel seamless pipe, with a minimum tensile strength of 75,000 psi. The maximum hoop stress of 11,900 psi results primarily from the reactor design pressure (1250 psig) acting on the inside of the housing.
If such a rupture were to occur, reactor water would flash to steam and leak through the hole in the housing to the drywell at approximately 1030 gpm. Choke-flow conditions would exist, as described previously for the flange-bolt failure. However, leakage flow would be greater because flow resistance would be less, that is, the leaking water and steam would not have to flow down the length of the housing to reach the drywell. A critical pressure of 350 psi causes the water to flash to steam.
No pressure differential across the collet piston would tend to unlatch the collet; but the drive would insert as a result of loss of pressure in the drive housing causing a pressure drop in the space above the drive piston.
If this failure occurred during control rod withdrawal, drive withdrawal would stop, but the collet would remain unlatched. The drive would be stopped by a reduction of the net downward force action on the drive line. The net force reduction would occur when the leakage flow of 1030 gpm reduces the pressure in the annulus outside the drive to approximately 540 psig, thereby reducing the pressure acting on top of the drive piston to the same value. A pressure differential of approximately 710 psi would exist across the collet piston and hold the collet unlatched as long as the operator held the withdraw signal.
4.6.2.1.2.2.6 Flange Plug Blows Out To connect the vessel ports with the bottom of the ball check valve, a hole of 3/4-inch diameter is drilled in the drive flange. The outer end of this hole is sealed with a plug of 0.812 inch diameter and 0.25 inch thickness. A full-penetration, Type 308 stainless steel weld holds the plug in place. The postulated failure is a full circumferential crack in this weld and subsequent blowout of the plug.
If the weld were to fail, the plug were to blow out, and the collet remained latched, there would be no control rod motion. There would be no pressure differential across the collet piston acting to unlatch the collet. Reactor water would leak past the velocity limiter piston, down the annulus between the drive and the thermal sleeve, through the vessel ports and drilled passage, and out the open plug hole to the drywell at approximately 320 gpm. Leakage calculations assume only liquid flows from the flange. Actually, hot reactor water would flash to steam, and choke-flow conditions would exist. Thus, the expected leakage rate would be lower than the calculated value. Drive temperature would increase and initiate an alarm in the control room.
If this failure were to occur during control rod withdrawal and if the collet were to stay unlatched, calculations indicate that control rod withdrawal speed would be approximately 0.24 ft./sec.
Leakage from the open plug hole in the flange would cause reactor water to flow downward past FSAR Rev. 69 4.6-21
SSES-FSAR Text Rev. 59 the velocity limiter piston. A small differential pressure across the piston would result in an insignificant driving force of approximately 10 lb., tending to increase withdraw velocity.
A pressure differential of 295 psi across the collet piston would hold the collet unlatched as long as the driving signal was maintained.
Flow resistance of the exhaust path from the drive would be normal because the ball check valve would be seated at the lower end of its travel by pressure under the drive piston.
4.6.2.1.2.2.7 Ball Check Valve Plug Blows Out As a means of access for machining the ball check valve cavity, a 1.25 inch diameter hole has been drilled in the flange forging. This hole is sealed with a plug of 1.31 inch diameter and 0.38 inch thickness. A full-penetration weld, utilizing Type 308 stainless steel filler, holds the plug in place. The failure postulated is a circumferential crack in this weld leading to a blowout of the plug.
If the plug were to blow out while the drive was latched, there would be no control rod motion.
No pressure differential would exist across the collet piston to unlatch the collet. As in the previous failure, reactor water would flow past the velocity limiter, down the annulus between the drive and thermal sleeve, through the vessel ports and drilled passage, through the ball check valve cage and out the open plug hole to the drywell. The leakage calculations indicate the flow rate would be 350 gpm. This calculation assumes liquid flow, but flashing of the hot reactor water to steam would reduce this rate to a lower value. Drive temperature would rapidly increase and initiate an alarm in the control room.
If the plug failure were to occur during control rod withdrawal, (it would not be possible to unlatch the drive after such a failure) the collet would relatch at the first locking groove. If the collet were to stick, calculations indicate the control rod withdrawal speed would be 11.8 feet per second. There would be a large retarding force exerted by the velocity limiter due to a 35 psi pressure differential across the velocity limiter piston.
4.6.2.1.2.2.8 Drive Pressure Control Valve Closure (Reactor Pressure, 0 psig)
The pressure to move a drive is generated by the pressure drop of practically the full system flow through the drive pressure control valve. This valve is either a motor operated valve or a standby manual valve; either one is adjusted to a fixed opening. The normal pressure drop across this valve develops a pressure 250 psi in excess of reactor pressure.
If the flow through the drive pressure control valve were to be stopped, as by a valve closure or flow blockage, the drive pressure would increase to the shutoff pressure of the supply pump.
The occurrence of this condition during withdrawal of a drive at zero vessel pressure will result in a drive pressure increase from 250 psig to no more than 1750 psig. Calculations indicate that the drive would accelerate from 3 in./sec. to approximately 6.5 in./sec. A pressure differential of 1670 psi across the collet piston would hold the collet unlatched. Flow would be upward, past the velocity limiter piston, but retarding force would be negligible. Rod movement would stop as soon as the driving signal was removed.
FSAR Rev. 69 4.6-22
SSES-FSAR Text Rev. 59 4.6.2.1.2.2.9 Ball Check Valve Fails to Close Passage to Vessel Ports Should the ball check valve sealing the passage to the vessel ports be dislodged and prevented from reseating following the insert portion of a drive withdrawal sequence, water below the drive piston would return to the reactor through the vessel ports and the annulus between the drive and the housing rather than through the speed control valve. Because the flow resistance of this return path would be lower than normal, the calculated withdrawal speed would be 2 ft./sec.
During withdrawal, differential pressure across the collet piston would be approximately 40 psi.
Therefore, the collet would tend to latch and would have to stick open before continuous withdrawal at 2 ft./sec, could occur. Water would flow upward past the velocity limiter piston, generating a small retarding force of approximately 120 pounds.
4.6.2.1.2.2.10 Hydraulic Control Unit Valve Failures Various failures of the valves in the HCU can be postulated, but none could produce differential pressures approaching those described in the preceding paragraphs and none alone could produce a high velocity withdrawal. Leakage through either one or both of the scram valves produces a pressure that tends to insert the control rod rather than to withdraw it. If the pressure in the scram discharge volume should exceed reactor pressure following a scram, a check valve in the line to the scram discharge header prevents this pressure from operating the drive mechanisms.
4.6.2.1.2.2.11 Collet Fingers Fail to Latch The failure is presumed to occur when the drive withdraw signal is removed. If the collet fails to latch, the drive continues to withdraw at a fraction of the normal speed. This assumption is made because there is no known means for the collet fingers to become unlocked without some initiating signal. Because the collet fingers will not cam open under a load, accidental application of a down signal does not unlock them. (The drive must be given a short insert signal to unload the fingers and cam them open before the collet can be driven to the unlock position.) If the drive withdrawal valve fails to close following a rod withdrawal, the collet would remain open and the drive continue to move at a reduced speed.
4.6.2.1.2.2.12 Withdrawal Speed Control Valve Failure Normal withdrawal speed is determined by differential pressures in the drive and is set for a nominal value of 3 in./sec. Withdrawal speed is maintained by the pressure regulating system and is independent of reactor vessel pressure. Tests have shown that accidental opening of the speed control valve to the full-open position produces a velocity of approximately 6 in./sec.
The control rod drive system prevents unplanned rod withdrawal and it has been shown above that only multiple failures in a drive unit and in its control unit could cause an unplanned rod withdrawal.
4.6.2.1.2.3 Scram Reliability High scram reliability is the result of a number of features of the CRD system. For example:
(1) Two reliable sources of scram energy are used to insert each control rod: individual accumulators at low reactor pressure, and the reactor vessel pressure itself at power.
FSAR Rev. 69 4.6-23
SSES-FSAR Text Rev. 59 (2) Each drive mechanism has its own scram and a dual solenoid scram pilot valve so only one drive can be affected if a scram valve fails to open. Both valve solenoids must be deenergized to initiate a scram.
(3) The reactor protection system and the HCUs are designed so that the scram signal and mode of operation override all others.
(4) The collet assembly and index tube are designed so they will not restrain or prevent control rod insertion during scram.
(5) The scram discharge volume is monitored for accumulated water and the reactor will scram before the volume is reduced to a point that could interfere with a scram.
4.6.2.1.2.4 Control Rod Support and Operation As described above, each control rod is independently supported and controlled as required by safety design bases.
4.6.2.1.3 Control Rod Drive Housing Supports Downward travel of the CRD housing and its control rod following the postulated housing failure equals the sum of these distances: (1) the compression of the disc springs under dynamic loading, and (2) the initial gap between the grid and the bottom contact surface of the CRD flange. If the reactor were cold and pressurized, the downward motion of the control rod would be limited to the spring compression (approximately 2 in.) plus a gap of approximately 1 in. If the reactor were hot and pressurized, the gap would be approximately 1/4 in. and the spring compression would be slightly less than in the cold condition. In either case, the control rod movement following a housing failure is substantially limited below one drive "notch" movement (6 in.). Sudden withdrawal of any control rod through a distance of one drive notch at any position in the core does not produce a transient sufficient to damage any radioactive material barrier.
The CRD housing supports are in place during power operation and when the nuclear system is pressurized. If a control rod is ejected during shutdown, the reactor remains subcritical because it is designed to remain subcritical with any one control rod fully withdrawn at any time.
At plant operating temperature, a gap of approximately 1/4 in. exists between the CRD housing and the supports. At lower temperatures the gap is greater. Because the supports do not contact any of the CRD housing except during the postulated accident condition, vertical contact stresses are prevented.
FSAR Rev. 69 4.6-24
SSES-FSAR Text Rev. 59 4.6.3 Testing and Verification of the CRDs 4.6.3.1 Control Rod Drives 4.6.3.1.1 Testing and Inspection 4.6.3.1.1.1 Development Tests The development drive (prototype) testing included more than 5000 scrams and approximately 100,000 latching cycles. One prototype was exposed to simulated operating conditions for 5000 hours0.0579 days <br />1.389 hours <br />0.00827 weeks <br />0.0019 months <br />. These tests demonstrated the following:
(1) The drive easily withstands the forces, pressures, and temperatures imposed.
(2) Wear, abrasion, and corrosion of the nitrided stainless parts are negligible. Mechanical performance of the nitrided surface is superior to that of materials used in earlier operating reactors.
(3) The basic scram speed of the drive has a satisfactory margin above minimum plant requirements at any reactor vessel pressure.
(4) Usable seal lifetimes in excess of 1000 scram cycles can be expected.
4.6.3.1.1.2 Factory Quality Control Tests Quality control of welding, heat treatment, dimensional tolerances, material verification, and similar factors is maintained throughout the manufacturing process to assure reliable performance of the mechanical reactivity control components. Some of the quality control tests performed on the control rods, control rod drive mechanisms, and hydraulic control units are listed below:
(1) Control rod drive mechanism tests:
- a. Pressure welds on the drives are hydrostatically tested in accordance with ASME codes.
- b. Electrical components are checked for electrical continuity and resistance to ground.
- c. Drive parts that cannot be visually inspected for dirt are flushed with filtered water at high velocity. No significant foreign material is permitted in effluent water.
- d. Seals are tested for leakage to demonstrate correct seal operation.
- e. Each drive is tested for shim motion, latching, and control rod position indication.
- f. Each drive is subjected to cold scram tests at various reactor pressures to verify correct scram performance.
FSAR Rev. 69 4.6-25
SSES-FSAR Text Rev. 59 (2) Hydraulic control unit tests:
- a. Hydraulic systems are hydrostatically tested in accordance with the applicable code.
- b. Electrical components and systems are tested for electrical continuity and resistance to ground.
- c. Correct operation of the accumulator pressure and level switches is verified.
- d. The unit's ability to perform its part of a scram is demonstrated.
- e. Correct operation and adjustment of the insert and withdrawal valves is demonstrated.
4.6.3.1.1.3 Operational Tests After installation, all rods and drive mechanisms can be tested through their full stroke for operability.
During normal operation, each time a control rod is withdrawn a notch, the operator can observe the in-core monitor indications to verify that the control rod is following the drive mechanism. All control rods that are partially withdrawn from the core can be tested for rod-following by inserting or withdrawing the rod one notch and returning it to its original position, while the operator observes the in-core monitor indications.
To make a positive test of control rod to control rod drive coupling integrity, the operator can withdraw a control rod to the end of its travel and then attempt to withdraw the drive to the overtravel position. Failure of the drive to overtravel demonstrates rod-to-drive coupling integrity.
Hydraulic supply subsystem pressures can be observed from instrumentation in the control room. Scram accumulator pressures can be observed on the nitrogen pressure gages.
4.6.3.1.1.4 Acceptance Tests Criteria for acceptance of the individual control rod drive mechanisms and the associated control and protection systems will be incorporated in specifications and test procedures covering three distinct phases: (1) pre-installation, (2) after installation prior to startup, and (3) during startup testing.
The pre-installation specification will define criteria and acceptable ranges of such characteristics as seal leakage, friction and scram performance under fixed test conditions which must be met before the component can be shipped.
Then after installation, prestartup tests will be performed as outlined in Chapter 14.
As fuel is placed in the reactor, the power test procedure will be performed as outlined in Chapter 14.
FSAR Rev. 69 4.6-26
SSES-FSAR Text Rev. 59 4.6.3.1.1.5 Surveillance Tests The surveillance requirements for the control rod drive system are described below.
(1) Sufficient control rods shall be withdrawn, following a refueling outage when core alterations are performed, to demonstrate with a margin of 0.25% k that the core can be made subcritical at any time in the subsequent fuel cycle with the strongest operable control rod fully withdrawn and all other operable rods fully inserted.
(2) Each partially or fully withdrawn control rod shall be exercised one notch at least once each 31 days.
In the event that operation is continuing with three or more rods valved out of service, this test shall be performed at least once each day.
The weekly control rod exercise test serves as a periodic check against deterioration of the control rod system and also verifies the ability of the control rod drive to scram. If a rod can be moved with drive pressure, it may be expected to scram since higher pressure is applied during scram. The frequency of exercising the control rods under the conditions of three or more control rods valved out of service provides even further assurance of the reliability of the remaining control rods.
(3) The coupling integrity shall be verified for each withdrawn control rod as follows:
- a. When the rod is first withdrawn, observe discernible response of the nuclear instrumentation; and
- b. When the rod is fully withdrawn the first time, observe that the drive will not go to the overtravel position.
Observation of a response from the nuclear instrumentation during an attempt to withdraw a control rod indicates indirectly that the rod and drive are coupled. The overtravel position feature provides a positive check on the coupling integrity, for only an uncoupled drive can reach the overtravel position.
(4) During operation, accumulator pressure and level at the normal operating value shall be verified. Experience with control rod drive systems of the same type indicates that weekly verification of accumulator pressure and level is sufficient to assure operability of the accumulator portion of the control rod drive system.
(5) At the time of each major refueling outage, each operable control rod shall be subjected to scram time tests from the fully withdrawn position.
Experience indicates that the scram times of the control rods do not significantly change over the time interval between refueling outages. A test of the scram times at each refueling outage is sufficient to identify any significant lengthening of the scram times.
FSAR Rev. 69 4.6-27
SSES-FSAR Text Rev. 59 4.6.3.1.1.6 Functional Tests The functional testing program of the control rod drives consists of the 5 year maintenance life and the 1.5X design life test programs as described in Subsection 3.9.4.4.
There are a number of failures that can be postulated on the CRD but it would be very difficult to test all possible failures. A partial test program with postulated accident conditions and imposed single failures is available.
The following tests with imposed single failures have been performed to evaluate the performance of the CRDs under these conditions.
Simulated Ruptured Scram Line Test Stuck Ball Check Valve in CRD Flange HCU Drive Down Inlet Flow Control Valve (V122) Failure HCU Drive Down Outlet Flow Control Valve (V120) Failure CRD Scram Performance with V120 Malfunction HCU Drive Up Outlet Control Valve (V121) Failure HCU Drive Up Inlet Control Valve (V123) Failure Cooling Water Check Valve (V138) Leakage CRD Flange Check Valve Leakage CRD Stabilization Circuit Failure HCU Filter Restriction Air Trapped in CRD Hydraulic System CRD Collet Drop Test CR Qualification Velocity Limiter Drop Test Additional postulated CRD failures are discussed in Subsections 4.6.2.1.2.2.1 through4.6.2.1.2.2.11.
4.6.3.2 Control Rod Drive Housing Supports 4.6.3.2.1 Testing and Inspection CRD housing supports are removed for inspection and maintenance of the control rod drives.
The supports for one control rod can be removed during reactor shutdown, even when the reactor is pressurized, because all control rods are then inserted. When the support structure is reinstalled, it is inspected for correct assembly with particular attention to maintaining the correct gap between the CRD flange lower contact surface and the grid.
4.6.4 Information for Combined Performance of Reactivity Systems 4.6.4.1 Vulnerability to Common Mode Failures The reactivity control systems have been located in accordance with the separation criteria described in Section 3.12. The locations of the equipment for these systems are shown on the figures in Section 1.2.
FSAR Rev. 69 4.6-28
SSES-FSAR Text Rev. 59 4.6.4.2 Accidents Taking Credit for Multiple Reactivity Systems There are no postulated accidents evaluated in Chapter 15 that take credit for two or more reactivity control systems preventing or mitigating each accident.
4.6.5 EVALUATION OF COMBINED PERFORMANCE As indicated in Subsection 4.6.4.2, credit is not taken for multiple reactivity control systems for any postulated accidents in Chapter 15.
4.
6.6 REFERENCES
4.6-1 Benecki, J. E., "Impact Testing on Collet Assembly for Control Rod Drive Mechanism 7RD B144A," General Electric Company, Atomic Power Equipment Department, APED-5555, November 1967.
FSAR Rev. 69 4.6-29
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD TO CONTROL ROD DRIVE COUPLING FIGURE 4.6-1, Rev. 47 Auto-Cad Figure Fsar 4_6_1.dwg
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD DRIVE UNIT FIGURE 4.6-2, Rev. 47 Auto-Cad Figure Fsar 4_6_2.dwg
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD DRIVE SCHEMATIC FIGURE 4.6-3
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD DRIVE (CUTAWAY)
FIGURE 4.6-4
THIS FIGURE HAS BEEN REPLACED BY DWG.
M-146, Sh. 1 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT Figure 4.6-5A replaced by dwg.
M-146, Sh. 1 FIGURE 4.6-5A, Rev. 50 AutoCAD Figure 4_6_5A.doc
THIS FIGURE HAS BEEN REPLACED BY DWG.
M-147, Sh. 1 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT Figure 4.6-5B replaced by dwg.
M-147, Sh. 1 FIGURE 4.6-5B, Rev. 55 AutoCAD Figure 4_6_5B.doc
THIS FIGURE HAS BEEN REPLACED BY DWG.
M1-C12-8, Sh. 1 FSAR REV. 65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT Figure 4.6-6 replaced by dwg.
M1-C12-8, Sh. 1 FIGURE 4.6-6, Rev. 49 AutoCAD Figure 4_6_6.doc
FSAR REV.65 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD DRIVE HYDRAULIC CONTROL UNIT FIGURE 4.6-7, Rev. 47 Auto-Cad Figure Fsar 4_6_7.dwg
Security-Related Information Figure Withheld Under 10 CFR 2.390 SUSQUEHANNA STEAM ELECTRIC STATION UNITS 1 & 2 FINAL SAFETY ANALYSIS REPORT CONTROL ROD DRIVE HOUSING SUPPORT FIGURE 4.6-8